Function at 0x401270
Capabilities:
Get common file path
Get disk information
Get graphical window text
Get token membership
Get token privileges

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x418876
mov eax, dword fs:[0]
push eax
sub esp, 0x6dc
mov eax, dword [0x421060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xff
xor ebx, ebx
lea eax, [ebp - 0x217]
push ebx
push eax
call fcn.0040a2b0
mov ecx, dword [0x423174]
mov esi, dword [0x423178]
add esp, 0xc
lea edx, [ebp - 0x67c]
push edx
push 0x3c
push 0xd
mov dword [ebp - 0x218], ecx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea eax, [ebp - 0x67c]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push ebx
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x54
lea ecx, [ebp - 0x6d8]
push ebx
push ecx
call fcn.0040a2b0
mov edx, dword [ebp - 0x634]
mov edi, dword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov eax, 0x4e2
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0x6a4], eax
add esp, 0xc
lea eax, [ebp - 0x6d8]
mov esi, 0x3e8
push eax
mov dword [ebp - 0x6d8], 0x54
mov dword [ebp - 0x6d4], edx
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6cc], ebx
mov dword [ebp - 0x6c8], 0x40006
mov dword [ebp - 0x6a8], esi
mov dword [ebp - 0x6a0], esi
call edi
mov ecx, dword [0x423178]
push 0x50
lea edx, [ebp - 0x6d4]
push ebx
push edx
mov dword [ebp - 0x6dc], ecx
mov dword [ebp - 0x6d8], ebx
call fcn.0040a2b0
add esp, 0xc
push 0x50
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ecx, dword [ebp - 0x6dc]
mov dword [ebp - 0x6b0], eax
mov eax, 1
mov dword [ebp - 0x6d8], 0x54
mov dword [ebp - 0x6d4], ecx
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6cc], ebx
mov dword [ebp - 0x6c8], ebx
mov dword [ebp - 0x6c4], 0x110
mov dword [ebp - 0x6c0], ebx
mov dword [ebp - 0x6bc], ebx
mov dword [ebp - 0x6b8], ebx
mov dword [ebp - 0x6b4], 0xa
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0x6a8], esi
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], ebx
mov dword [ebp - 0x69c], ebx
mov dword [ebp - 0x698], ebx
mov dword [ebp - 0x694], ebx
mov dword [ebp - 0x690], ebx
mov dword [ebp - 0x68c], 0xffffffff
lea edx, [ebp - 0x6d8]
push edx
mov dword [ebp - 0x688], ebx
call dword [sym.imp.COMDLG32.dll_PrintDlgExA]
push 0x54
lea eax, [ebp - 0x6d8]
push ebx
push eax
call fcn.0040a2b0
mov ecx, dword [ebp - 0x634]
add esp, 0xc
mov eax, 0x4e2
lea edx, [ebp - 0x6d8]
push edx
mov dword [ebp - 0x6d8], 0x54
mov dword [ebp - 0x6d4], ecx
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6cc], ebx
mov dword [ebp - 0x6c8], 0x40006
mov dword [ebp - 0x6a8], esi
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], esi
call edi
mov eax, dword [ebp - 0x620]
mov esi, dword [0x423170]
mov ecx, dword [0x423174]
cmp eax, dword [0x423178]
jne 0x4014e7
mov eax, ecx
cdq
lea edi, [esi + 4]
idiv edi
mov edx, eax
movzx eax, word [ebp - 0x620]
add eax, dword [0x42317c]
imul eax, esi
sub eax, edx
sub eax, dword [0x423168]
imul eax, dword [ebp - 0x6e8]
mov dword [ebp - 0x6e8], eax
mov edx, ecx
imul edx, edx, 0x119
mov eax, 0xffffffd3
sub eax, edx
mov dword [ebp - 0x62c], eax
add eax, 0xffffff0a
mov dword [ebp - 0x624], eax
push 2
lea eax, [ebp - 0x630]
push eax
add ecx, esi
push ecx
mov dword [ebp - 0x630], 0x604
mov dword [ebp - 0x628], 0x7c7
call dword [sym.imp.GDI32.dll_LPtoDP]
mov ecx, dword [ebp - 0x624]
mov edx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x62c]
push ecx
mov ecx, dword [ebp - 0x630]
push edx
push eax
push ecx
lea edx, [ebp - 0x640]
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [0x423170]
mov ecx, dword [0x423174]
push 1
add ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_SetMapMode]
mov eax, dword [0x423170]
mov ecx, dword [0x423174]
lea edx, [ebp - 0x640]
push edx
add ecx, eax
push ecx
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov eax, dword [0x423170]
cmp eax, ebx
jne 0x40159c
cmp dword [0x423178], ebx
je 0x401654
push 0x103
lea edx, [ebp - 0x117]
push ebx
push edx
mov byte [ebp - 0x118], al
call fcn.0040a2b0
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4015c0
sub eax, edx
inc eax
mov dword [ebp - 0x6dc], ebx
cmp dword [0x423174], ebx
jne 0x401611
push 0xffffffffffffffff
lea ecx, [ebp - 0x218]
push ecx
push eax
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x6dc]
push eax
call fcn.00407cee
add esp, 0x14
push 0x41af00
lea ecx, [ebp - 0x618]
push 0x200
push ecx
call fcn.00407d0e
add esp, 0xc
lea edx, [ebp - 0x118]
push 0x185
push edx
call dword [sym.imp.WLDAP32.dll_Ordinal_143]
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40163a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x423164], ebx
jmp 0x401644
mov dword [0x423164], 1
push ebx
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_88]
mov eax, dword [0x423170]
add esp, 8
mov ecx, dword [0x423174]
mov edx, dword [0x423178]
lea esi, [edx + ecx*4]
add esi, ecx
add esi, eax
mov eax, dword [0x423168]
cdq
idiv esi
mov dword [ebp - 0x6dc], ebx
add eax, ecx
add dword [ebp - 0x620], eax
lea eax, [ebp - 0x6dc]
push eax
lea ecx, [ebp - 0x62c]
push ecx
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
jne 0x4016a2
cmp dword [0x423170], ebx
je 0x4016a2
mov dword [0x423164], ebx
mov edx, dword [ebp - 0x6dc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [0x423170]
inc eax
xor esi, esi
mov dword [ebp - 0x6dc], ebx
mov dword [ebp - 0x628], 0x220
mov dword [ebp - 0x624], 0x223
mov byte [ebp - 0x638], bl
mov byte [ebp - 0x637], bl
mov byte [ebp - 0x636], bl
mov byte [ebp - 0x635], bl
mov byte [ebp - 0x634], bl
mov byte [ebp - 0x633], 5
test eax, eax
jle 0x40176b
cmp dword [ebp - 0x6dc], ebx
jne 0x40176b
mov edi, dword [ebp + esi*4 - 0x628]
lea ecx, [ebp - 0x6e0]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push edi
push 0x20
push 2
lea edx, [ebp - 0x638]
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401760
mov ecx, dword [ebp - 0x6e0]
lea eax, [ebp - 0x6e4]
push eax
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x401753
cmp dword [ebp - 0x6e4], ebx
je 0x401753
mov dword [ebp - 0x6dc], edi
mov edx, dword [ebp - 0x6e0]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [0x423170]
inc esi
inc eax
cmp esi, eax
jl 0x4016fa
lea ecx, [ebp - 0x6e4]
push ecx
push 8
mov dword [ebp - 0x6e4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x401791
mov dword [0x423164], ebx
mov eax, dword [ebp - 0x6e4]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [ebp - 0x6e0]
push edx
push ebx
push ebx
push 1
push eax
mov dword [ebp - 0x6e0], ebx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4017db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x4017db
mov ecx, dword [ebp - 0x6e4]
push ecx
mov dword [0x423164], ebx
call edi
mov dword [ebp - 0x6e4], ebx
push 4
call fcn.00407df7
add esp, 4
cmp eax, ebx
je 0x4017f3
lea edx, [ebp - 0x658]
mov dword [eax], edx
jmp 0x4017f5
xor eax, eax
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x6e0]
push eax
lea eax, [ebp - 0x658]
call fcn.00405ff0
mov ecx, dword [ebp - 0x648]
sub ecx, dword [ebp - 0x64c]
jne 0x401839
call fcn.004077ea
mov eax, dword [ebp - 0x6e0]
mov ecx, dword [ebp - 0x64c]
lea edx, [ebp - 0x6e0]
push edx
mov edx, dword [ebp - 0x6e4]
push eax
push ecx
push 1
push edx
call esi
test eax, eax
jne 0x401876
mov eax, dword [ebp - 0x6e4]
push eax
mov dword [0x423164], 1
call edi
mov dword [ebp - 0x6e4], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x64c]
cmp eax, ebx
je 0x401890
push eax
call fcn.0040792e
add esp, 4
mov ecx, dword [ebp - 0x658]
push ecx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
call fcn.0040792e
mov edx, dword [ebp - 0x620]
add esp, 4
cmp edx, dword [0x423178]
jne 0x4018f5
mov ecx, dword [0x423170]
mov eax, dword [0x423174]
cdq
lea esi, [ecx + 4]
idiv esi
movzx edx, word [ebp - 0x620]
add edx, dword [0x42317c]
imul edx, ecx
sub edx, eax
sub edx, dword [0x423168]
imul edx, dword [ebp - 0x6e8]
mov dword [ebp - 0x6e8], edx
push 4
call fcn.00407df7
add esp, 4
cmp eax, ebx
je 0x401913
lea ecx, [ebp - 0x658]
mov dword [eax], ecx
mov dword [ebp - 0x6dc], eax
jmp 0x401919
mov dword [ebp - 0x6dc], ebx
mov edx, dword [ebp - 0x6dc]
mov dword [ebp - 0x658], edx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 4], 3
mov esi, dword [0x423170]
mov eax, 4
sub eax, esi
mov dword [ebp - 0x6e0], eax
fild dword [ebp - 0x6e0]
call fcn.004158b0
mov edi, dword [0x423174]
mov ecx, edi
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
mov eax, dword [0x423168]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cdq
add ecx, edi
idiv ecx
imul eax, edi
cdq
idiv dword [0x42317c]
mov edx, dword [ebp - 0x620]
mov dword [ebp - 0x6e0], eax
fild dword [ebp - 0x6e0]
faddp st(1)
fild dword [ebp - 0x620]
test edx, edx
jge 0x4019ad
fadd qword [0x41b348]
mov ecx, dword [ebp - 0x6dc]
fnstcw word [ebp - 0x6e2]
movzx eax, word [ebp - 0x6e2]
faddp st(1)
or eax, 0xc00
mov dword [ebp - 0x6e0], eax
push ebx
fldcw word [ebp - 0x6e0]
push ecx
lea edx, [ebp - 0x6e0]
push edx
inc esi
mov dword [ebp - 0x6e0], esi
fistp qword [ebp - 0x628]
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x658]
fldcw word [ebp - 0x6e2]
call fcn.004060b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x64c]
cmp eax, ebx
je 0x401a27
push eax
call fcn.0040792e
add esp, 4
mov ecx, dword [ebp - 0x658]
push ecx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
call fcn.0040792e
mov edx, dword [0x423170]
inc edx
add esp, 4
xor edi, edi
mov dword [ebp - 0x6dc], ebx
mov dword [ebp - 0x628], 0x220
mov dword [ebp - 0x624], 0x223
mov byte [ebp - 0x638], bl
mov byte [ebp - 0x637], bl
mov byte [ebp - 0x636], bl
mov byte [ebp - 0x635], bl
mov byte [ebp - 0x634], bl
mov byte [ebp - 0x633], 5
test edx, edx
jle 0x401b06
cmp dword [ebp - 0x6dc], ebx
jne 0x401b06
mov esi, dword [ebp + edi*4 - 0x628]
lea eax, [ebp - 0x6e0]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push 0x20
push 2
lea ecx, [ebp - 0x638]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401afa
mov eax, dword [ebp - 0x6e0]
lea edx, [ebp - 0x6e4]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x401aed
cmp dword [ebp - 0x6e4], ebx
je 0x401aed
mov dword [ebp - 0x6dc], esi
mov ecx, dword [ebp - 0x6e0]
push ecx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov edx, dword [0x423170]
inc edi
inc edx
cmp edi, edx
jl 0x401a94
lea eax, [ebp - 0x6dc]
push eax
lea ecx, [ebp - 0x62c]
push ecx
mov dword [ebp - 0x6dc], ebx
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
jne 0x401b31
cmp dword [0x423170], ebx
je 0x401b31
mov dword [0x423164], ebx
mov edx, dword [ebp - 0x6dc]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [0x423178]
lea eax, [ebp - 0x67c]
push eax
push 0x3c
push 0xd
mov dword [ebp - 0x6dc], ebx
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [ebp - 0x67c]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push ebx
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x423174]
mov edx, dword [0x423178]
mov esi, dword [0x423170]
mov eax, dword [0x423168]
lea edi, [edx + ecx*8]
cdq
add edi, esi
idiv edi
mov edi, dword [0x42317c]
add eax, ecx
mov ecx, dword [0x423164]
add dword [ebp - 0x620], eax
imul ecx, esi
lea eax, [edi + esi]
cmp ecx, eax
jne 0x401c15
fild dword [0x423170]
call fcn.00415ea0
fnstcw word [ebp - 0x6e2]
movzx eax, word [ebp - 0x6e2]
movzx ecx, word [ebp - 0x6e8]
or eax, 0xc00
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x620]
fldcw word [ebp - 0x6dc]
add eax, 4
imul eax, ecx
fistp qword [ebp - 0x628]
fldcw word [ebp - 0x6e2]
mov edx, dword [ebp - 0x628]
add edx, edi
add eax, edx
imul eax, dword [0x423168]
mov dword [0x423168], eax
cmp esi, ebx
je 0x401ca5
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
push ebx
call edi
push 0x40
push ebx
mov esi, eax
call edi
lea edx, [ebp - 0x63c]
push edx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x401c50
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov dx, word [eax + 4]
mov ecx, dword [eax]
mov word [ebp - 0x624], dx
mov eax, dword [ebp - 0x624]
shr eax, 8
mov dword [ebp - 0x628], ecx
movzx ecx, al
push ecx
push 0x41af1c
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x63c]
push edx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov esi, dword [0x423170]
mov edi, dword [0x42317c]
mov ecx, dword [ebp - 0x620]
mov edx, dword [ebp - 0x620]
lea eax, [esi + 0xc]
imul eax, dword [0x423168]
add ecx, edx
cmp ecx, eax
jne 0x401cdb
mov eax, dword [0x423178]
lea ecx, [eax - 8]
xor edx, edx
mov eax, edi
div ecx
add eax, dword [0x423174]
sub dword [0x423168], eax
mov edx, dword [ebp - 0x620]
cmp edx, dword [0x423178]
jne 0x401d23
movzx eax, word [ebp - 0x620]
add eax, esi
imul eax, edi
imul eax, esi
cdq
lea ecx, [esi + 6]
idiv ecx
mov edi, dword [0x42317c]
mov ecx, eax
movzx eax, byte [0x423174]
imul eax, dword [0x423168]
cdq
idiv dword [0x42317c]
sub ecx, eax
add dword [ebp - 0x6e8], ecx
mov eax, dword [0x423164]
imul eax, esi
lea ecx, [edi + esi]
cmp eax, ecx
jne 0x401d50
movzx ecx, word [ebp - 0x6e8]
lea edx, [esi - 7]
imul edx, ecx
imul edx, dword [ebp - 0x620]
mov ecx, edi
sub ecx, edx
add dword [0x423168], ecx
lea ecx, [edi + esi]
cmp eax, ecx
jne 0x401db5
fild dword [0x423170]
call fcn.00415ea0
fnstcw word [ebp - 0x6e2]
movzx eax, word [ebp - 0x6e2]
movzx ecx, word [ebp - 0x6e8]
or eax, 0xc00
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x620]
fldcw word [ebp - 0x6dc]
add eax, 4
imul eax, ecx
fistp qword [ebp - 0x628]
fldcw word [ebp - 0x6e2]
mov edx, dword [ebp - 0x628]
add edx, edi
add eax, edx
imul eax, dword [0x423168]
mov dword [0x423168], eax
mov ecx, dword [0x423174]
mov edx, dword [0x423178]
mov eax, dword [0x423168]
lea edi, [edx + ecx*4]
cdq
add edi, ecx
add edi, esi
idiv edi
push 0x2c
push ebx
add eax, ecx
add dword [ebp - 0x620], eax
lea eax, [ebp - 0x66c]
push eax
call fcn.0040a2b0
add esp, 0xc
push 0x7f00
push ebx
mov dword [ebp - 0x670], 0x30
mov dword [ebp - 0x66c], 3
mov dword [ebp - 0x664], ebx
mov dword [ebp - 0x660], 4
mov dword [ebp - 0x65c], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x644], ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [ebp - 0x670]
mov edi, 1
push ecx
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], edi
mov dword [ebp - 0x64c], 0x41af28
mov dword [ebp - 0x648], 0x41af3c
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov esi, dword [0x423170]
lea edx, [ebp - 0x6e0]
push edx
push ebx
push ebx
push edi
push esi
mov dword [ebp - 0x6e0], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x401e9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x401e9c
add dword [0x423164], edi
mov eax, dword [ebp - 0x6e0]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x401eda
mov edx, dword [ebp - 0x6e0]
lea ecx, [ebp - 0x6e0]
push ecx
push edx
push edi
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x401eda
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [0x423164]
mov ecx, dword [0x423170]
cmp ecx, ebx
jne 0x401ef2
mov esi, dword [0x423178]
cmp esi, ebx
je 0x401fb1
push 0x103
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 0x118], cl
call fcn.0040a2b0
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401f16
sub eax, edx
inc eax
mov dword [ebp - 0x6dc], ebx
cmp dword [0x423174], ebx
jne 0x401f67
push 0xffffffffffffffff
lea ecx, [ebp - 0x218]
push ecx
push eax
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x6dc]
push eax
call fcn.00407cee
add esp, 0x14
push 0x41af4c
lea ecx, [ebp - 0x618]
push 0x200
push ecx
call fcn.00407d0e
add esp, 0xc
lea edx, [ebp - 0x118]
push 0x185
push edx
call dword [sym.imp.WLDAP32.dll_Ordinal_143]
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x401f90
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x423164], ebx
jmp 0x401f9a
mov dword [0x423164], 1
push ebx
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_88]
mov ecx, dword [0x423170]
mov esi, dword [0x423178]
add esp, 8
mov edx, dword [ebp - 0x620]
mov edi, dword [ebp - 0x620]
lea eax, [ecx + 0xc]
imul eax, dword [0x423168]
add edi, edx
cmp edi, eax
mov eax, dword [0x423174]
jne 0x401fed
mov eax, dword [0x42317c]
xor edx, edx
lea edi, [esi - 8]
div edi
mov edx, eax
mov eax, dword [0x423174]
add edx, eax
sub dword [0x423168], edx
cmp dword [ebp - 0x620], esi
jne 0x402020
cdq
lea edi, [ecx + 4]
idiv edi
movzx edx, word [ebp - 0x620]
add edx, dword [0x42317c]
imul edx, ecx
sub edx, eax
sub edx, dword [0x423168]
imul edx, dword [ebp - 0x6e8]
mov dword [ebp - 0x6e8], edx
cmp ecx, ebx
jne 0x40202c
cmp esi, ebx
je 0x4020e5
push 0x103
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 0x118], cl
call fcn.0040a2b0
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402050
sub eax, edx
inc eax
mov dword [ebp - 0x6dc], ebx
cmp dword [0x423174], ebx
jne 0x4020a1
push 0xffffffffffffffff
lea ecx, [ebp - 0x218]
push ecx
push eax
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x6dc]
push eax
call fcn.00407cee
add esp, 0x14
push 0x41af68
lea ecx, [ebp - 0x618]
push 0x200
push ecx
call fcn.00407d0e
add esp, 0xc
lea edx, [ebp - 0x118]
push 0x185
push edx
call dword [sym.imp.WLDAP32.dll_Ordinal_143]
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x4020ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x423164], ebx
jmp 0x4020d4
mov dword [0x423164], 1
push ebx
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_88]
mov esi, dword [0x423178]
add esp, 8
push 0x50
lea eax, [ebp - 0x6d4]
push ebx
push eax
mov dword [ebp - 0x6d8], ebx
call fcn.0040a2b0
add esp, 0xc
push 0x50
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x6d4], esi
mov dword [ebp - 0x6b0], eax
mov eax, 1
lea ecx, [ebp - 0x6d8]
mov edi, 0x54
mov esi, 0x3e8
push ecx
mov dword [ebp - 0x6d8], edi
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6cc], ebx
mov dword [ebp - 0x6c8], ebx
mov dword [ebp - 0x6c4], 0x110
mov dword [ebp - 0x6c0], ebx
mov dword [ebp - 0x6bc], ebx
mov dword [ebp - 0x6b8], ebx
mov dword [ebp - 0x6b4], 0xa
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0x6a8], esi
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], ebx
mov dword [ebp - 0x69c], ebx
mov dword [ebp - 0x698], ebx
mov dword [ebp - 0x694], ebx
mov dword [ebp - 0x690], ebx
mov dword [ebp - 0x68c], 0xffffffff
mov dword [ebp - 0x688], ebx
call dword [sym.imp.COMDLG32.dll_PrintDlgExA]
push edi
lea edx, [ebp - 0x6d8]
push ebx
push edx
call fcn.0040a2b0
mov eax, dword [ebp - 0x634]
add esp, 0xc
mov dword [ebp - 0x6d4], eax
mov eax, 0x4e2
lea ecx, [ebp - 0x6d8]
push ecx
mov dword [ebp - 0x6d8], edi
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6cc], ebx
mov dword [ebp - 0x6c8], 0x40006
mov dword [ebp - 0x6a8], esi
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], esi
call dword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov ecx, dword [0x423174]
mov edx, dword [0x423178]
mov esi, dword [0x423170]
mov eax, dword [0x423168]
lea edi, [edx + ecx*8]
cdq
add edi, esi
idiv edi
mov edx, ecx
imul edx, edx, 0x119
push 2
mov dword [ebp - 0x630], 0x604
mov dword [ebp - 0x628], 0x7c7
add eax, ecx
add dword [ebp - 0x620], eax
mov eax, 0xffffffd3
sub eax, edx
mov dword [ebp - 0x62c], eax
add eax, 0xffffff0a
mov dword [ebp - 0x624], eax
lea eax, [ebp - 0x630]
push eax
add ecx, esi
push ecx
call dword [sym.imp.GDI32.dll_LPtoDP]
mov ecx, dword [ebp - 0x624]
mov edx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x62c]
push ecx
mov ecx, dword [ebp - 0x630]
push edx
push eax
push ecx
lea edx, [ebp - 0x650]
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [0x423170]
mov ecx, dword [0x423174]
push 1
add ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_SetMapMode]
mov eax, dword [0x423170]
mov ecx, dword [0x423174]
lea edx, [ebp - 0x650]
push edx
add ecx, eax
push ecx
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 4
call fcn.00407df7
add esp, 4
cmp eax, ebx
je 0x4022f5
lea edx, [ebp - 0x658]
mov dword [eax], edx
mov dword [ebp - 0x6dc], eax
jmp 0x4022fb
mov dword [ebp - 0x6dc], ebx
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 4], 5
mov esi, dword [0x423170]
mov ecx, 4
sub ecx, esi
mov dword [ebp - 0x6e0], ecx
fild dword [ebp - 0x6e0]
call fcn.004158b0
mov edi, dword [0x423174]
mov ecx, edi
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
mov eax, dword [0x423168]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cdq
add ecx, edi
idiv ecx
imul eax, edi
cdq
idiv dword [0x42317c]
mov edx, dword [ebp - 0x620]
mov dword [ebp - 0x6e0], eax
fild dword [ebp - 0x6e0]
faddp st(1)
fild dword [ebp - 0x620]
test edx, edx
jge 0x40238f
fadd qword [0x41b348]
mov ecx, dword [ebp - 0x6dc]
fnstcw word [ebp - 0x6e2]
movzx eax, word [ebp - 0x6e2]
faddp st(1)
or eax, 0xc00
mov dword [ebp - 0x6e0], eax
push ebx
fldcw word [ebp - 0x6e0]
push ecx
lea edx, [ebp - 0x6e0]
push edx
inc esi
mov dword [ebp - 0x6e0], esi
fistp qword [ebp - 0x628]
mov eax, dword [ebp - 0x628]
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x628]
push eax
lea eax, [ebp - 0x658]
fldcw word [ebp - 0x6e2]
call fcn.004060b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x64c]
cmp eax, ebx
je 0x402409
push eax
call fcn.0040792e
add esp, 4
mov ecx, dword [ebp - 0x658]
push ecx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
call fcn.0040792e
mov esi, dword [0x423178]
mov ecx, dword [0x423170]
add esp, 4
cmp dword [ebp - 0x620], esi
jne 0x402476
movzx eax, word [ebp - 0x620]
add eax, ecx
imul eax, dword [0x42317c]
imul eax, ecx
cdq
lea edi, [ecx + 6]
idiv edi
mov edi, eax
movzx eax, byte [0x423174]
imul eax, dword [0x423168]
cdq
idiv dword [0x42317c]
sub edi, eax
add dword [ebp - 0x6e8], edi
mov edi, dword [ebp - 0x620]
mov edx, edi
imul edx, dword [0x423174]
cmp dword [ebp - 0x620], edx
jne 0x4024bb
mov eax, 0xaaaaaaab
mul dword [ebp - 0x6e8]
movzx eax, word [0x423174]
shr edx, 2
imul eax, ecx
imul edx, dword [0x42317c]
add edx, eax
imul edx, dword [ebp - 0x6e8]
mov dword [ebp - 0x6e8], edx
cmp ecx, ebx
jne 0x4024c7
cmp esi, ebx
je 0x40258b
push 0x103
mov byte [ebp - 0x118], cl
lea ecx, [ebp - 0x117]
push ebx
push ecx
call fcn.0040a2b0
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 1]
jmp 0x4024f0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4024f0
sub eax, edx
inc eax
mov dword [ebp - 0x6dc], ebx
cmp dword [0x423174], ebx
jne 0x402541
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push eax
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x6dc]
push ecx
call fcn.00407cee
add esp, 0x14
push 0x41af84
lea edx, [ebp - 0x618]
push 0x200
push edx
call fcn.00407d0e
add esp, 0xc
lea eax, [ebp - 0x118]
push 0x185
push eax
call dword [sym.imp.WLDAP32.dll_Ordinal_143]
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40256a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x423164], ebx
jmp 0x402574
mov dword [0x423164], 1
push ebx
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_88]
mov ecx, dword [0x423170]
mov esi, dword [0x423178]
add esp, 8
mov eax, dword [ebp - 0x620]
lea edx, [ecx + 0xc]
imul edx, dword [0x423168]
add edi, eax
cmp edi, edx
jne 0x4025b9
mov eax, dword [0x42317c]
xor edx, edx
lea edi, [esi - 8]
div edi
add eax, dword [0x423174]
sub dword [0x423168], eax
cmp dword [ebp - 0x620], esi
jne 0x4025f1
mov eax, dword [0x423174]
cdq
lea edi, [ecx + 4]
idiv edi
movzx edx, word [ebp - 0x620]
add edx, dword [0x42317c]
imul edx, ecx
sub edx, eax
sub edx, dword [0x423168]
imul edx, dword [ebp - 0x6e8]
mov dword [ebp - 0x6e8], edx
lea eax, [ebp - 0x6c0]
push eax
push 0x3c
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [ebp - 0x6c0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push ebx
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, dword [0x423178]
push 0x50
lea edx, [ebp - 0x6d4]
push ebx
push edx
mov dword [ebp - 0x6d8], ebx
call fcn.0040a2b0
add esp, 0xc
push 0x50
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x6b0], eax
lea eax, [ebp - 0x6d8]
mov edi, 1
push eax
mov dword [ebp - 0x6d8], 0x54
mov dword [ebp - 0x6d4], esi
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6cc], ebx
mov dword [ebp - 0x6c8], ebx
mov dword [ebp - 0x6c4], 0x110
mov dword [ebp - 0x6c0], ebx
mov dword [ebp - 0x6bc], ebx
mov dword [ebp - 0x6b8], ebx
mov dword [ebp - 0x6b4], 0xa
mov dword [ebp - 0x6ac], edi
mov dword [ebp - 0x6a8], 0x3e8
mov dword [ebp - 0x6a4], edi
mov dword [ebp - 0x6a0], ebx
mov dword [ebp - 0x69c], ebx
mov dword [ebp - 0x698], ebx
mov dword [ebp - 0x694], ebx
mov dword [ebp - 0x690], ebx
mov dword [ebp - 0x68c], 0xffffffff
mov dword [ebp - 0x688], ebx
call dword [sym.imp.COMDLG32.dll_PrintDlgExA]
mov ecx, dword [ebp - 0x620]
cmp ecx, dword [0x423178]
jne 0x402731
mov ecx, dword [0x423170]
mov eax, dword [0x423174]
cdq
lea esi, [ecx + 4]
idiv esi
movzx edx, word [ebp - 0x620]
add edx, dword [0x42317c]
imul edx, ecx
sub edx, eax
sub edx, dword [0x423168]
imul edx, dword [ebp - 0x6e8]
mov dword [ebp - 0x6e8], edx
lea eax, [ebp - 0x6e4]
push eax
push 8
mov dword [ebp - 0x6e4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402757
mov dword [0x423164], ebx
mov edx, dword [ebp - 0x6e4]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x6e0]
push ecx
push ebx
push ebx
push edi
push edx
mov dword [ebp - 0x6e0], ebx
call esi
test eax, eax
jne 0x40279e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x40279e
mov eax, dword [ebp - 0x6e4]
push eax
mov dword [0x423164], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6e4], ebx
push 4
call fcn.00407df7
add esp, 4
cmp eax, ebx
je 0x4027b6
lea ecx, [ebp - 0x658]
mov dword [eax], ecx
jmp 0x4027b8
xor eax, eax
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 4], 7
mov edx, dword [ebp - 0x6e0]
push edx
lea eax, [ebp - 0x658]
call fcn.00405ff0
mov eax, dword [ebp - 0x648]
sub eax, dword [ebp - 0x64c]
jne 0x4027fc
call fcn.004077ea
mov edx, dword [ebp - 0x6e0]
mov eax, dword [ebp - 0x64c]
lea ecx, [ebp - 0x6e0]
push ecx
mov ecx, dword [ebp - 0x6e4]
push edx
push eax
push edi
push ecx
call esi
test eax, eax
jne 0x402838
mov edx, dword [ebp - 0x6e4]
push edx
mov dword [0x423164], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6e4], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x64c]
cmp eax, ebx
je 0x402852
push eax
call fcn.0040792e
add esp, 4
mov eax, dword [ebp - 0x658]
push eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
call fcn.0040792e
add esp, 4
cmp dword [0x423170], ebx
je 0x402906
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
push ebx
call edi
push 0x40
push ebx
mov esi, eax
call edi
lea ecx, [ebp - 0x63c]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x4028b2
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea edx, [ebp - 0x63c]
push edx
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov dx, word [eax + 4]
mov ecx, dword [eax]
mov word [ebp - 0x624], dx
mov eax, dword [ebp - 0x624]
shr eax, 8
mov dword [ebp - 0x628], ecx
movzx ecx, al
push ecx
push 0x41afa0
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x63c]
push edx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov edi, 1
lea eax, [ebp - 0x6e4]
push eax
push 8
mov dword [ebp - 0x6e4], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40292c
mov dword [0x423164], ebx
mov edx, dword [ebp - 0x6e4]
lea ecx, [ebp - 0x6e0]
push ecx
push ebx
push ebx
push edi
push edx
mov dword [ebp - 0x6e0], ebx
call esi
test eax, eax
jne 0x40296d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x40296d
mov eax, dword [ebp - 0x6e4]
push eax
mov dword [0x423164], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6e4], ebx
push 4
call fcn.00407df7
add esp, 4
cmp eax, ebx
je 0x402985
lea ecx, [ebp - 0x658]
mov dword [eax], ecx
jmp 0x402987
xor eax, eax
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 4], 9
mov edx, dword [ebp - 0x6e0]
push edx
lea eax, [ebp - 0x658]
call fcn.00405ff0
mov eax, dword [ebp - 0x648]
sub eax, dword [ebp - 0x64c]
jne 0x4029cb
call fcn.004077ea
mov edx, dword [ebp - 0x6e0]
mov eax, dword [ebp - 0x64c]
lea ecx, [ebp - 0x6e0]
push ecx
mov ecx, dword [ebp - 0x6e4]
push edx
push eax
push edi
push ecx
call esi
test eax, eax
jne 0x402a07
mov edx, dword [ebp - 0x6e4]
push edx
mov dword [0x423164], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6e4], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x64c]
cmp eax, ebx
je 0x402a21
push eax
call fcn.0040792e
add esp, 4
mov eax, dword [ebp - 0x658]
push eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
call fcn.0040792e
add esp, 4
push 0x2c
lea ecx, [ebp - 0x66c]
push ebx
push ecx
call fcn.0040a2b0
add esp, 0xc
push 0x7f00
push ebx
mov dword [ebp - 0x670], 0x30
mov dword [ebp - 0x66c], 3
mov dword [ebp - 0x664], ebx
mov dword [ebp - 0x660], 4
mov dword [ebp - 0x65c], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x644], ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
lea edx, [ebp - 0x670]
push edx
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], edi
mov dword [ebp - 0x64c], 0x41afac
mov dword [ebp - 0x648], 0x41afc0
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov eax, dword [0x423170]
cmp eax, ebx
jne 0x402ae4
cmp dword [0x423178], ebx
je 0x402b93
push 0x103
mov byte [ebp - 0x118], al
lea eax, [ebp - 0x117]
push ebx
push eax
call fcn.0040a2b0
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x402b08
sub eax, edx
inc eax
mov dword [ebp - 0x6dc], ebx
cmp dword [0x423174], ebx
jne 0x402b59
push 0xffffffffffffffff
lea ecx, [ebp - 0x218]
push ecx
push eax
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x6dc]
push eax
call fcn.00407cee
add esp, 0x14
push 0x41afd0
lea ecx, [ebp - 0x618]
push 0x200
push ecx
call fcn.00407d0e
add esp, 0xc
lea edx, [ebp - 0x118]
push 0x185
push edx
call dword [sym.imp.WLDAP32.dll_Ordinal_143]
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x402b82
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x423164], ebx
jmp 0x402b88
mov dword [0x423164], edi
push ebx
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_88]
add esp, 8
push 0x104
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x402baf
mov dword [0x423164], ebx
lea ecx, [ebp - 0x428]
push 0x41afec
push ecx
call fcn.004077fa
add esp, 8
cmp eax, ebx
je 0x402bcd
xor edx, edx
mov word [eax + 2], dx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x6dc]
push eax
push ebx
push ebx
lea ecx, [ebp - 0x428]
push ecx
mov dword [ebp - 0x6dc], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x402bfd
mov edx, dword [0x423168]
mov dword [0x423164], edx
push 0x54
lea eax, [ebp - 0x6d8]
push ebx
push eax
call fcn.0040a2b0
mov ecx, dword [ebp - 0x634]
add esp, 0xc
mov dword [ebp - 0x6d4], ecx
mov ecx, 0x3e8
mov eax, 0x4e2
lea edx, [ebp - 0x6d8]
push edx
mov dword [ebp - 0x6d8], 0x54
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6cc], ebx
mov dword [ebp - 0x6c8], 0x40006
mov dword [ebp - 0x6a8], ecx
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0x6a4], eax
mov dword [ebp - 0x6a0], ecx
call dword [sym.imp.COMDLG32.dll_PageSetupDlgA]
mov ecx, dword [0x423174]
mov eax, dword [0x423178]
lea esi, [eax + ecx*4]
mov eax, dword [0x423168]
add esi, ecx
add esi, dword [0x423170]
cdq
idiv esi
lea edx, [ebp - 0x62c]
mov dword [ebp - 0x6dc], ebx
add eax, ecx
add dword [ebp - 0x620], eax
lea ecx, [ebp - 0x6dc]
push ecx
push edx
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
jne 0x402cbb
cmp dword [0x423170], ebx
je 0x402cbb
mov dword [0x423164], ebx
mov eax, dword [ebp - 0x6dc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 4
call fcn.00407df7
add esp, 4
cmp eax, ebx
je 0x402ce6
lea ecx, [ebp - 0x658]
mov dword [eax], ecx
mov dword [ebp - 0x6dc], eax
jmp 0x402cec
mov dword [ebp - 0x6dc], ebx
mov edx, dword [ebp - 0x6dc]
mov dword [ebp - 0x658], edx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 4], 0xb
mov esi, dword [0x423170]
mov eax, 4
sub eax, esi
mov dword [ebp - 0x6e0], eax
fild dword [ebp - 0x6e0]
call fcn.004158b0
mov edi, dword [0x423174]
mov ecx, edi
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
mov eax, dword [0x423168]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cdq
add ecx, edi
idiv ecx
imul eax, edi
cdq
idiv dword [0x42317c]
mov edx, dword [ebp - 0x620]
mov dword [ebp - 0x6e0], eax
fild dword [ebp - 0x6e0]
faddp st(1)
fild dword [ebp - 0x620]
test edx, edx
jge 0x402d80
fadd qword [0x41b348]
fnstcw word [ebp - 0x6e2]
movzx eax, word [ebp - 0x6e2]
or eax, 0xc00
faddp st(1)
mov dword [ebp - 0x6e0], eax
mov eax, dword [ebp - 0x6dc]
fldcw word [ebp - 0x6e0]
push ebx
push eax
lea ecx, [ebp - 0x6e0]
push ecx
lea edx, [ebp - 0x628]
fistp qword [ebp - 0x628]
mov edi, dword [ebp - 0x628]
inc esi
push edx
lea eax, [ebp - 0x658]
mov dword [ebp - 0x6e0], esi
fldcw word [ebp - 0x6e2]
call fcn.004060b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x64c]
cmp eax, ebx
je 0x402df4
push eax
call fcn.0040792e
add esp, 4
mov eax, dword [ebp - 0x658]
push eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
call fcn.0040792e
add esp, 4
push 0x2c
lea ecx, [ebp - 0x66c]
push ebx
push ecx
call fcn.0040a2b0
add esp, 0xc
push 0x7f00
push ebx
mov dword [ebp - 0x670], 0x30
mov dword [ebp - 0x66c], 3
mov dword [ebp - 0x664], ebx
mov dword [ebp - 0x660], 4
mov dword [ebp - 0x65c], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x644], ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
lea edx, [ebp - 0x670]
push edx
mov dword [ebp - 0x654], eax
mov dword [ebp - 0x650], 1
mov dword [ebp - 0x64c], 0x41aff4
mov dword [ebp - 0x648], 0x41b008
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov ecx, dword [0x423174]
mov eax, dword [0x423178]
lea esi, [eax + ecx*8]
mov eax, dword [0x423168]
add esi, dword [0x423170]
cdq
idiv esi
mov dword [ebp - 0x6e0], ebx
add eax, ecx
lea ecx, [ebp - 0x6e0]
push ecx
add edi, eax
push 8
mov dword [ebp - 0x620], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x402ef2
mov dword [0x423164], ebx
mov eax, dword [ebp - 0x6e0]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [ebp - 0x6dc]
push edx
push ebx
push ebx
push 1
push eax
mov dword [ebp - 0x6dc], ebx
call esi
test eax, eax
jne 0x402f3a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x402f3a
mov ecx, dword [ebp - 0x6e0]
push ecx
mov dword [0x423164], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6e0], ebx
push 4
call fcn.00407df7
add esp, 4
cmp eax, ebx
je 0x402f52
lea edx, [ebp - 0x658]
mov dword [eax], edx
jmp 0x402f54
xor eax, eax
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 4], 0xd
mov eax, dword [ebp - 0x6dc]
push eax
lea eax, [ebp - 0x658]
call fcn.00405ff0
mov ecx, dword [ebp - 0x648]
sub ecx, dword [ebp - 0x64c]
jne 0x402f98
call fcn.004077ea
mov eax, dword [ebp - 0x6dc]
mov ecx, dword [ebp - 0x64c]
lea edx, [ebp - 0x6dc]
push edx
mov edx, dword [ebp - 0x6e0]
push eax
push ecx
push 1
push edx
call esi
test eax, eax
jne 0x402fd9
mov eax, dword [ebp - 0x6e0]
push eax
mov dword [0x423164], 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6e0], ebx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x64c]
cmp eax, ebx
je 0x402ff3
push eax
call fcn.0040792e
add esp, 4
mov ecx, dword [ebp - 0x658]
push ecx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
call fcn.0040792e
mov eax, dword [0x423170]
mov ecx, dword [0x423164]
mov esi, dword [0x42317c]
imul ecx, eax
lea edx, [esi + eax]
add esp, 4
cmp ecx, edx
jne 0x40308d
fild dword [0x423170]
call fcn.00415ea0
fnstcw word [ebp - 0x6e2]
movzx eax, word [ebp - 0x6e2]
movzx ecx, word [ebp - 0x6e8]
or eax, 0xc00
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x620]
fldcw word [ebp - 0x634]
add eax, 4
imul eax, ecx
fistp qword [ebp - 0x628]
fldcw word [ebp - 0x6e2]
mov edx, dword [ebp - 0x628]
add edx, esi
add eax, edx
imul eax, dword [0x423168]
mov dword [0x423168], eax
cmp dword [0x423170], ebx
jne 0x4030a1
cmp dword [0x423178], ebx
je 0x40315f
mov dl, byte [0x423170]
push 0x103
lea eax, [ebp - 0x117]
push ebx
push eax
mov byte [ebp - 0x118], dl
call fcn.0040a2b0
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 1]
jmp 0x4030d0
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4030d0
sub eax, edx
inc eax
mov dword [ebp - 0x634], ebx
cmp dword [0x423174], ebx
jne 0x403121
push 0xffffffffffffffff
lea ecx, [ebp - 0x218]
push ecx
push eax
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x634]
push eax
call fcn.00407cee
add esp, 0x14
push 0x41b018
lea ecx, [ebp - 0x618]
push 0x200
push ecx
call fcn.00407d0e
add esp, 0xc
lea edx, [ebp - 0x118]
push 0x185
push edx
call dword [sym.imp.WLDAP32.dll_Ordinal_143]
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x40314a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x423164], ebx
jmp 0x403154
mov dword [0x423164], 1
push ebx
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_88]
add esp, 8
mov esi, dword [0x423178]
lea eax, [ebp - 0x6c0]
push eax
push 0x3c
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [ebp - 0x6c0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push ebx
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x423174]
mov esi, dword [0x423178]
lea edx, [edi + ecx]
cmp dword [ebp - 0x620], edx
jne 0x4031d8
mov edi, dword [0x42317c]
movzx eax, cx
cdq
idiv edi
xor edx, edx
imul eax, dword [ebp - 0x6e8]
imul eax, dword [0x423170]
div edi
mov edi, dword [ebp - 0x620]
add eax, esi
mov dword [ebp - 0x6e8], eax
imul edi, ecx
cmp dword [ebp - 0x620], edi
jne 0x403211
mov eax, 0xaaaaaaab
mul dword [ebp - 0x6e8]
shr edx, 2
imul edx, dword [0x42317c]
movzx eax, cx
imul eax, dword [0x423170]
add edx, eax
imul edx, dword [ebp - 0x6e8]
mov dword [ebp - 0x6e8], edx
mov eax, dword [0x423168]
lea edi, [esi + ecx*4]
add edi, ecx
add edi, dword [0x423170]
cdq
idiv edi
add eax, ecx
add dword [ebp - 0x620], eax
cmp dword [0x423170], ebx
je 0x4032c0
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
push ebx
call edi
push 0x40
push ebx
mov esi, eax
call edi
lea ecx, [ebp - 0x63c]
push ecx
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x40326b
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea edx, [ebp - 0x63c]
push edx
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov dx, word [eax + 4]
mov ecx, dword [eax]
mov word [ebp - 0x624], dx
mov eax, dword [ebp - 0x624]
shr eax, 8
mov dword [ebp - 0x628], ecx
movzx ecx, al
push ecx
push 0x41b034
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x63c]
push edx
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov ecx, dword [0x423174]
mov esi, dword [0x423178]
mov eax, dword [0x423168]
lea edi, [esi + ecx*4]
add edi, ecx
add edi, dword [0x423170]
cdq
idiv edi
mov edi, dword [ebp - 0x620]
add eax, ecx
add edi, eax
lea eax, [ebp - 0x67c]
push eax
push 0x3c
push 0xd
mov dword [ebp - 0x620], edi
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [ebp - 0x67c]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push ebx
push eax
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [0x423170]
mov edx, dword [ebp - 0x620]
lea eax, [ecx + 0xc]
imul eax, dword [0x423168]
lea esi, [edi + edx]
cmp esi, eax
jne 0x40334e
mov edx, dword [0x423178]
mov eax, dword [0x42317c]
lea edi, [edx - 8]
xor edx, edx
div edi
add eax, dword [0x423174]
sub dword [0x423168], eax
lea eax, [ebp - 0x6dc]
push eax
push ebx
push ebx
push 1
push ecx
mov dword [ebp - 0x634], ecx
mov dword [ebp - 0x6dc], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x403381
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x403381
inc dword [0x423164]
mov ecx, dword [ebp - 0x6dc]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x4033c5
mov eax, dword [ebp - 0x6dc]
mov ecx, dword [ebp - 0x634]
lea edx, [ebp - 0x6dc]
push edx
push eax
push edi
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4033c5
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [0x423164]
lea edx, [ebp - 0x6dc]
push edx
lea eax, [ebp - 0x62c]
push eax
mov dword [ebp - 0x6dc], ebx
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
jne 0x4033f0
cmp dword [0x423170], ebx
je 0x4033f0
mov dword [0x423164], ebx
mov ecx, dword [ebp - 0x6dc]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 0x620]
mov dword [ebp - 0x6dc], ebx
cmp edx, dword [0x423178]
jne 0x403486
movzx eax, word [ebp - 0x620]
mov ecx, dword [0x423170]
mov dword [ebp - 0x634], eax
add eax, ecx
imul eax, dword [0x42317c]
imul eax, ecx
cdq
lea edi, [ecx + 6]
idiv edi
mov edi, eax
movzx eax, byte [0x423174]
imul eax, dword [0x423168]
cdq
idiv dword [0x42317c]
sub edi, eax
add dword [ebp - 0x6e8], edi
mov eax, dword [0x423174]
lea edi, [ecx + 4]
cdq
idiv edi
mov edx, dword [0x42317c]
mov edi, dword [ebp - 0x634]
add edi, edx
imul edi, ecx
sub edi, eax
sub edi, dword [0x423168]
imul edi, dword [ebp - 0x6e8]
mov dword [ebp - 0x6e8], edi
mov edi, dword [0x423178]
lea eax, [ebp - 0x6c0]
push eax
push 0x3c
push 0xd
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
lea ecx, [ebp - 0x6c0]
push ecx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push ebx
push eax
push 0x30
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [0x423170]
mov edi, dword [0x423174]
add edx, 0xc
imul edx, dword [0x423168]
cmp esi, edx
mov esi, dword [0x42317c]
jne 0x4034f2
mov eax, dword [0x423178]
lea ecx, [eax - 8]
xor edx, edx
mov eax, esi
div ecx
add eax, edi
sub dword [0x423168], eax
mov ecx, dword [0x423170]
mov eax, dword [0x423164]
imul eax, ecx
lea edx, [esi + ecx]
cmp eax, edx
jne 0x403525
movzx eax, word [ebp - 0x6e8]
lea edx, [ecx - 7]
imul edx, eax
imul edx, dword [ebp - 0x620]
mov eax, esi
sub eax, edx
add dword [0x423168], eax
cmp ecx, ebx
jne 0x403535
cmp dword [0x423178], ebx
je 0x4035fd
mov cl, byte [0x423170]
push 0x103
lea edx, [ebp - 0x117]
push ebx
push edx
mov byte [ebp - 0x118], cl
call fcn.0040a2b0
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403560
sub eax, edx
inc eax
mov dword [ebp - 0x634], ebx
cmp edi, ebx
jne 0x4035ad
push 0xffffffffffffffff
lea ecx, [ebp - 0x218]
push ecx
push eax
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x634]
push eax
call fcn.00407cee
add esp, 0x14
push 0x41b040
lea ecx, [ebp - 0x618]
push 0x200
push ecx
call fcn.00407d0e
add esp, 0xc
lea edx, [ebp - 0x118]
push 0x185
push edx
call dword [sym.imp.WLDAP32.dll_Ordinal_143]
mov esi, eax
add esp, 8
cmp esi, ebx
jne 0x4035d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x423164], ebx
jmp 0x4035e0
mov dword [0x423164], 1
push ebx
push esi
call dword [sym.imp.WLDAP32.dll_Ordinal_88]
mov edi, dword [0x423174]
mov esi, dword [0x42317c]
mov ecx, dword [0x423170]
add esp, 8
mov eax, dword [ebp - 0x620]
add eax, edi
cmp dword [ebp - 0x620], eax
jne 0x40362d
movzx eax, di
cdq
idiv esi
xor edx, edx
imul eax, dword [ebp - 0x6e8]
imul eax, ecx
div esi
add eax, dword [0x423178]
mov dword [ebp - 0x6e8], eax
mov eax, dword [0x423164]
imul eax, ecx
lea edx, [esi + ecx]
cmp eax, edx
jne 0x4036a1
fild dword [0x423170]
call fcn.00415ea0
fnstcw word [ebp - 0x6e2]
movzx eax, word [ebp - 0x6e2]
mov ecx, dword [ebp - 0x620]
movzx edx, word [ebp - 0x6e8]
or eax, 0xc00
mov dword [ebp - 0x634], eax
add ecx, 4
fldcw word [ebp - 0x634]
imul ecx, edx
fistp qword [ebp - 0x628]
mov eax, dword [ebp - 0x628]
fldcw word [ebp - 0x6e2]
add eax, esi
add ecx, eax
imul ecx, dword [0x423168]
mov dword [0x423168], ecx
mov ecx, dword [0x423170]
cmp ecx, ebx
je 0x403721
mov edi, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push 0x40
push ebx
call edi
push 0x40
push ebx
mov esi, eax
call edi
mov edi, eax
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.ADVAPI32.dll_IsValidSid]
test eax, eax
jne 0x4036d8
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 0x63c]
push ecx
call dword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
mov edx, dword [eax]
mov ax, word [eax + 4]
mov word [ebp - 0x624], ax
mov ecx, dword [ebp - 0x624]
shr ecx, 8
mov dword [ebp - 0x628], edx
movzx edx, cl
push edx
push str.S_1__d
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x63c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
push 4
call fcn.00407df7
add esp, 4
cmp eax, ebx
je 0x40373f
lea ecx, [ebp - 0x658]
mov dword [eax], ecx
mov dword [ebp - 0x6dc], eax
jmp 0x403745
mov dword [ebp - 0x6dc], ebx
mov edx, dword [ebp - 0x6dc]
mov dword [ebp - 0x658], edx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 4], 0xf
mov esi, dword [0x423170]
mov eax, 4
sub eax, esi
mov dword [ebp - 0x634], eax
fild dword [ebp - 0x634]
call fcn.004158b0
mov edi, dword [0x423174]
mov ecx, edi
imul ecx, esi
mov eax, 0x2aaaaaab
imul ecx
mov eax, dword [0x423168]
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cdq
add ecx, edi
idiv ecx
imul eax, edi
cdq
idiv dword [0x42317c]
mov edx, dword [ebp - 0x620]
mov dword [ebp - 0x634], eax
fild dword [ebp - 0x634]
faddp st(1)
fild dword [ebp - 0x620]
test edx, edx
jge 0x4037d9
fadd qword [0x41b348]
fnstcw word [ebp - 0x6e2]
movzx eax, word [ebp - 0x6e2]
or eax, 0xc00
faddp st(1)
mov dword [ebp - 0x634], eax
mov eax, dword [ebp - 0x6dc]
fldcw word [ebp - 0x634]
push ebx
push eax
lea ecx, [ebp - 0x634]
push ecx
lea edx, [ebp - 0x628]
fistp qword [ebp - 0x628]
mov edi, dword [ebp - 0x628]
inc esi
push edx
lea eax, [ebp - 0x658]
mov dword [ebp - 0x634], esi
fldcw word [ebp - 0x6e2]
call fcn.004060b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x64c]
cmp eax, ebx
je 0x40384d
push eax
call fcn.0040792e
add esp, 4
mov eax, dword [ebp - 0x658]
push eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
call fcn.0040792e
mov ecx, dword [0x423170]
mov edx, dword [ebp - 0x620]
add ecx, 0xc
imul ecx, dword [0x423168]
add edi, edx
add esp, 4
cmp edi, ecx
jne 0x4038a7
mov eax, dword [0x423178]
lea ecx, [eax - 8]
mov eax, dword [0x42317c]
xor edx, edx
div ecx
add eax, dword [0x423174]
sub dword [0x423168], eax
push 0x2c
lea edx, [ebp - 0x66c]
push ebx
push edx
call fcn.0040a2b0
add esp, 0xc
push 0x7f00
push ebx
mov dword [ebp - 0x670], 0x30
mov dword [ebp - 0x66c], 3
mov dword [ebp - 0x664], ebx
mov dword [ebp - 0x660], 4
mov dword [ebp - 0x65c], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x644], ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x654], eax
lea eax, [ebp - 0x670]
mov esi, 1
push eax
mov dword [ebp - 0x650], esi
mov dword [ebp - 0x64c], 0x41b068
mov dword [ebp - 0x648], 0x41b07c
call dword [sym.imp.USER32.dll_RegisterClassExW]
lea ecx, [ebp - 0x6dc]
push ecx
lea edx, [ebp - 0x62c]
push edx
mov dword [ebp - 0x6dc], ebx
call sub.ADVAPI32.dll_ConvertSidToStringSidA
test eax, eax
jne 0x403964
cmp dword [0x423170], ebx
je 0x403964
mov dword [0x423164], ebx
mov eax, dword [ebp - 0x6dc]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [0x423170]
lea ecx, [edx + 1]
xor edi, edi
mov dword [ebp - 0x6dc], ebx
mov dword [ebp - 0x628], 0x220
mov dword [ebp - 0x624], 0x223
mov byte [ebp - 0x620], bl
mov byte [ebp - 0x61f], bl
mov byte [ebp - 0x61e], bl
mov byte [ebp - 0x61d], bl
mov byte [ebp - 0x61c], bl
mov byte [ebp - 0x61b], 5
test ecx, ecx
jle 0x403a39
nop
cmp dword [ebp - 0x6dc], ebx
jne 0x403a39
mov esi, dword [ebp + edi*4 - 0x628]
lea edx, [ebp - 0x6e0]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push esi
push 0x20
push 2
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x403a26
mov edx, dword [ebp - 0x6e0]
lea ecx, [ebp - 0x634]
push ecx
push edx
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x403a19
cmp dword [ebp - 0x634], ebx
je 0x403a19
mov dword [ebp - 0x6dc], esi
mov eax, dword [ebp - 0x6e0]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov edx, dword [0x423170]
inc edi
lea ecx, [edx + 1]
cmp edi, ecx
mov esi, 1
jl 0x4039c0
cmp edx, ebx
jne 0x403a49
cmp dword [0x423178], ebx
je 0x403b01
push 0x103
mov byte [ebp - 0x118], dl
lea edx, [ebp - 0x117]
push ebx
push edx
call fcn.0040a2b0
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403a70
sub eax, edx
inc eax
mov dword [ebp - 0x634], ebx
cmp dword [0x423174], ebx
jne 0x403ac1
push 0xffffffffffffffff
lea ecx, [ebp - 0x218]
push ecx
push eax
lea edx, [ebp - 0x618]
push edx
lea eax, [ebp - 0x634]
push eax
call fcn.00407cee
add esp, 0x14
push 0x41b08c
lea ecx, [ebp - 0x618]
push 0x200
push ecx
call fcn.00407d0e
add esp, 0xc
lea edx, [ebp - 0x118]
push 0x185
push edx
call dword [sym.imp.WLDAP32.dll_Ordinal_143]
mov edi, eax
add esp, 8
cmp edi, ebx
jne 0x403aea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x423164], ebx
jmp 0x403af0
mov dword [0x423164], esi
push ebx
push edi
call dword [sym.imp.WLDAP32.dll_Ordinal_88]
mov edx, dword [0x423170]
add esp, 8
mov ecx, dword [0x423174]
mov edi, ecx
imul edi, edi, 0x119
mov eax, 0xffffffd3
sub eax, edi
mov dword [ebp - 0x62c], eax
add eax, 0xffffff0a
mov dword [ebp - 0x624], eax
push 2
lea eax, [ebp - 0x630]
push eax
add ecx, edx
push ecx
mov dword [ebp - 0x630], 0x604
mov dword [ebp - 0x628], 0x7c7
call dword [sym.imp.GDI32.dll_LPtoDP]
mov ecx, dword [ebp - 0x624]
mov edx, dword [ebp - 0x628]
mov eax, dword [ebp - 0x62c]
push ecx
mov ecx, dword [ebp - 0x630]
push edx
push eax
push ecx
lea edx, [ebp - 0x650]
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [0x423170]
mov ecx, dword [0x423174]
push esi
add ecx, eax
push ecx
call dword [sym.imp.GDI32.dll_SetMapMode]
mov eax, dword [0x423170]
mov ecx, dword [0x423174]
lea edx, [ebp - 0x650]
push edx
add ecx, eax
push ecx
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 0x2c
lea edx, [ebp - 0x66c]
push ebx
push edx
call fcn.0040a2b0
add esp, 0xc
push 0x7f00
push ebx
mov dword [ebp - 0x670], 0x30
mov dword [ebp - 0x66c], 3
mov dword [ebp - 0x664], ebx
mov dword [ebp - 0x660], 4
mov dword [ebp - 0x65c], ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push 0x7f00
push ebx
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x644], ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x654], eax
lea eax, [ebp - 0x670]
push eax
mov dword [ebp - 0x650], esi
mov dword [ebp - 0x64c], str.MainMenu
mov dword [ebp - 0x648], str.window
call dword [sym.imp.USER32.dll_RegisterClassExW]
mov eax, dword [0x423170]
cmp eax, ebx
jne 0x403c48
cmp dword [0x423178], ebx
je 0x403cfb
push 0x103
lea ecx, [ebp - 0x117]
push ebx
push ecx
mov byte [ebp - 0x118], al
call fcn.0040a2b0
lea eax, [ebp - 0x218]
add esp, 0xc
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x403c70
sub eax, edx
inc eax
mov dword [ebp - 0x634], ebx
cmp dword [0x423174], ebx
jne 0x403cc1
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
push eax
lea eax, [ebp - 0x618]
push eax
lea ecx, [ebp - 0x634]
push ecx
call fcn.00407cee
add esp, 0x14
push str.__wchar_t__
lea edx, [ebp - 0x618]
push 0x200
push edx
call fcn.00407d0e
add esp, 0xc
lea eax, [ebp - 0x118]
push 0x185
push eax
call dword [sym.imp.WLDAP32.dll_Ordinal_143]
mov edi, eax
add esp, 8
cmp edi, ebx
jne 0x403cea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x423164], ebx
jmp 0x403cf0
mov dword [0x423164], esi
push ebx
push edi
call dword [sym.imp.WLDAP32.dll_Ordinal_88]
add esp, 8
lea ecx, [ebp - 0x6e0]
push ecx
push 8
mov dword [ebp - 0x6e0], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x403d21
mov dword [0x423164], ebx
mov eax, dword [ebp - 0x6e0]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea edx, [ebp - 0x6dc]
push edx
push ebx
push ebx
push esi
push eax
mov dword [ebp - 0x6dc], ebx
call edi
test eax, eax
jne 0x403d68
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x403d68
mov ecx, dword [ebp - 0x6e0]
push ecx
mov dword [0x423164], ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6e0], ebx
push 4
call fcn.00407df7
add esp, 4
cmp eax, ebx
je 0x403d80
lea edx, [ebp - 0x658]
mov dword [eax], edx
jmp 0x403d82
xor eax, eax
mov dword [ebp - 0x658], eax
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
mov dword [ebp - 4], 0x11
mov eax, dword [ebp - 0x6dc]
push eax
lea eax, [ebp - 0x658]
call fcn.00405ff0
mov ecx, dword [ebp - 0x648]
sub ecx, dword [ebp - 0x64c]
jne 0x403dc6
call fcn.004077ea
mov eax, dword [ebp - 0x6dc]
mov ecx, dword [ebp - 0x64c]
lea edx, [ebp - 0x6dc]
push edx
mov edx, dword [ebp - 0x6e0]
push eax
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x403e02
mov eax, dword [ebp - 0x6e0]
push eax
mov dword [0x423164], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x6e0], ebx
mov eax, dword [ebp - 0x64c]
cmp eax, ebx
je 0x403e15
push eax
call fcn.0040792e
add esp, 4
mov ecx, dword [ebp - 0x658]
push ecx
mov dword [ebp - 0x64c], ebx
mov dword [ebp - 0x648], ebx
mov dword [ebp - 0x644], ebx
call fcn.0040792e
add esp, 4
push 0x54
lea edx, [ebp - 0x6d8]
push ebx
push edx
call fcn.0040a2b0
mov eax, dword [ebp - 0x634]
mov ecx, 0x3e8
mov dword [ebp - 0x6a8], ecx
mov dword [ebp - 0x6a0], ecx
add esp, 0xc
mov dword [ebp - 0x6d4], eax
mov eax, 0x4e2
lea ecx, [ebp - 0x6d8]
push ecx
mov dword [ebp - 0x6d8], 0x54
mov dword [ebp - 0x6d0], ebx
mov dword [ebp - 0x6cc], ebx
mov dword [ebp - 0x6c8], 0x40006
mov dword [ebp - 0x6ac], eax
mov dword [ebp - 0x6a4], eax
call dword [sym.imp.COMDLG32.dll_PageSetupDlgA]
push 0x104
lea edx, [ebp - 0x428]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x403ebf
mov dword [0x423164], ebx
lea eax, [ebp - 0x428]
push 0x41b0e8
push eax
call fcn.004077fa
add esp, 8
cmp eax, ebx
je 0x403edd
xor ecx, ecx
mov word [eax + 2], cx
push ebx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x634]
push edx
push ebx
push ebx
lea eax, [ebp - 0x428]
push eax
mov dword [ebp - 0x634], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x403f0d
mov ecx, dword [0x423168]
mov dword [0x423164], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407204
mov esp, ebp
pop ebp
ret