Function at 0x422dee
Capabilities:
Check os version
Get keyboard layout
Get system information on windows
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c4
mov dword [ebp - 0x70], 2
mov dword [ebp - 0x3d0], 0x4e94f934
mov dword [ebp - 0x59c], 0xb2455f9
mov dword [ebp - 0x558], 0
mov dword [ebp - 0x560], 0xffffffff
mov dword [ebp - 0x568], 0
mov dword [ebp - 0x480], 0x6e82
mov dword [ebp - 0x164], 0xb0d69b45
mov dword [ebp - 0x15c], 0x58a13c4
mov dword [ebp - 0xfc], 0
jmp 0x422e67
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 2
jge 0x422e83
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x584], 7
jmp 0x422e5a
cmp dword [ebp - 0x70], 0
je 0x423177
mov dword [ebp - 0x60], 0xfffffffe
mov dword [ebp - 0x110], 1
mov dword [ebp - 0x4bc], 0x3fdda784
mov dword [ebp - 0xa4], 0
jmp 0x422ec1
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x422edd
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x510], 0
jmp 0x422eb4
mov dword [ebp - 0x70], 0x16
jmp 0x422eed
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0xb
je 0x422faf
mov dword [ebp - 0x470], 0xfff8
mov dword [ebp - 0x1dc], 0
mov dword [ebp - 0x478], 0xe9d60a22
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x3d0], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1dc]
cmp dword [ebp - 0x3d0], eax
jl 0x422f41
mov dword [ebp - 0x3d8], 1
jmp 0x422f48
and dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x70], 0
je 0x422f63
mov eax, 0xffcf33f2
test eax, eax
je 0x422f63
mov dword [ebp - 0x3ec], 1
jmp 0x422f6a
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x3d8]
cmp eax, dword [ebp - 0x3ec]
jl 0x422f84
mov dword [ebp - 0x430], 1
jmp 0x422f8b
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x470]
mov dword [ebp - 0x570], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x578], eax
mov dword [ebp - 0x478], 0
jmp 0x422ee6
mov dword [ebp - 0x60], 0
jmp 0x422fbf
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x12
jle 0x423175
mov dword [ebp - 0x5d8], 0xc7fffaa2
mov dword [ebp - 0x5e0], 0xf8abff5e
mov dword [ebp - 0x5e8], 0xe294b58f
mov dword [ebp - 0x5f0], 0xffffffff
mov dword [ebp - 0x608], 0xffffffff
mov dword [ebp - 0x610], 0xfffffff9
mov dword [ebp - 0x154], 0xb643
mov dword [ebp - 0x4b4], 8
cmp dword [ebp - 0x70], 0xbc24
jg 0x42302e
mov dword [ebp - 0x3f4], 1
jmp 0x423035
and dword [ebp - 0x3f4], 0
cmp dword [ebp - 0x3f4], 0xf126c7f0
jb 0x42304d
mov dword [ebp - 0x368], 1
jmp 0x423054
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp - 0x480]
cmp dword [ebp - 0x110], eax
je 0x42307e
push 5
pop eax
test eax, eax
jne 0x42307e
and dword [ebp - 0x488], 0
jmp 0x423088
mov dword [ebp - 0x488], 1
push 4
pop eax
shl eax, 1
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x510]
mov dword [ebp + ecx - 0x510], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x60]
cmp dword [ebp + eax - 0x510], ecx
je 0x4230bf
mov dword [ebp - 0x168], 1
jmp 0x4230c6
and dword [ebp - 0x168], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x168]
mov dword [ebp + eax - 0x584], ecx
mov eax, dword [ebp - 0x4b4]
cmp dword [ebp - 0x168], eax
jne 0x4230f3
mov dword [ebp - 0x3c4], 1
jmp 0x4230fa
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x154]
dec eax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0x15c]
add eax, dword [ebp - 0x3c4]
add ecx, eax
mov eax, dword [ebp - 0x368]
mov edx, dword [ebp - 0x15c]
inc edx
mov dword [ebp - 0x15c], edx
cmp eax, ecx
jl 0x423142
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x423142
and dword [ebp - 0x198], 0
jmp 0x42314c
mov dword [ebp - 0x198], 1
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x4bc], eax
jmp 0x422fb8
jmp 0x423198
mov dword [ebp - 0x620], 0x86b9bdd1
mov dword [ebp - 0x370], 0x176a
mov eax, dword [ebp - 0x370]
inc eax
mov dword [ebp - 0x370], eax
mov byte [ebp - 0x7c], 0
movzx eax, byte [ebp - 0x7c]
test eax, eax
je 0x4231b8
push 0x12b4
push 0
push 0x23cd
push 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
and dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x5c], 0xe85a7b05
mov dword [ebp - 0x20], 0xc
jmp 0x4231da
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xfffffffc
jne 0x423464
mov dword [ebp - 0x628], 0x3eef7d26
mov dword [ebp - 0x4d4], 0x83a7ef23
mov dword [ebp - 0xf4], 0
jmp 0x423211
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x42322d
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0xf0], 0xfda0e60f
jmp 0x423204
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xf0], 0xffffffe9
jmp 0x42325b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xf0], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf0], 3
jl 0x42345f
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x4dc], 0xfffffff6
mov dword [ebp - 0x1b8], 0xffffffff
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf0], 0
jne 0x423382
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x108], eax
je 0x4232bf
mov dword [ebp - 0x1a8], 1
jmp 0x4232c6
and dword [ebp - 0x1a8], 0
cmp dword [ebp - 0x108], 0xfffffffb
jb 0x4232db
mov dword [ebp - 0x1a0], 1
jmp 0x4232e2
and dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x1a0], 0xffffffff
jg 0x4232f7
mov dword [ebp - 0x378], 1
jmp 0x4232fe
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x378], eax
jne 0x423315
mov dword [ebp - 0x380], 1
jmp 0x42331c
and dword [ebp - 0x380], 0
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x380]
jl 0x423336
mov dword [ebp - 0x1b0], 1
jmp 0x42333d
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x1b0]
neg eax
je 0x42335f
mov eax, 0xff63
test eax, eax
je 0x42335f
and dword [ebp - 0x388], 0
jmp 0x423369
mov dword [ebp - 0x388], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
add eax, dword [ebp - 0x388]
jne 0x423448
mov dword [ebp - 0xb0], 0
jmp 0x42339b
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x4233b7
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x494], 0xfbc43cc9
jmp 0x42338e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x494], eax
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x4dc], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x1b8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf0]
cmp eax, dword [ebp - 0x1b8]
jl 0x423433
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
mov dword [ebp - 0x630], eax
imul eax, dword [ebp - 0x20], 0x63b8
test eax, eax
jne 0x423433
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf0], 0
jne 0x423433
and dword [ebp - 0x390], 0
jmp 0x42343d
mov dword [ebp - 0x390], 1
mov eax, dword [ebp - 0x390]
mov dword [ebp - 0x5c], eax
jmp 0x42345a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf0], 0
je 0x42345a
jmp 0x42345f
jmp 0x423240
jmp 0x4231d3
mov dword [ebp - 0x5c], 8
jmp 0x423474
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 5
jl 0x4234aa
mov dword [ebp - 0x20], 0xffffffea
jmp 0x42348a
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffe7
jle 0x4234a8
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x4234a6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x423483
jmp 0x42346d
mov dword [ebp - 0x2c], 0
jmp 0x4234ba
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x4234d0
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6c4], 0xfffffff6
jmp 0x4234b3
mov dword [ebp - 0x2c], 0
jmp 0x4234e0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x4234f6
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x530], 9
jmp 0x4234d9
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x530], 0
jmp 0x423521
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x530]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x530], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x530], 3
jg 0x42362b
mov dword [ebp - 0xc], 0
jmp 0x423544
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x42355a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x678], 0xffffffff
jmp 0x42353d
mov dword [ebp - 0xc], 0
jmp 0x42356a
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x423580
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x658], 0xfffffff6
jmp 0x423563
mov dword [ebp - 0xc], 0
jmp 0x423590
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x4235a6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x41c], 7
jmp 0x423589
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x658]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x658], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x41c], 3
jmp 0x4235ed
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x41c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x41c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x41c], 0
jl 0x423626
mov byte [ebp - 0x7a], 0
movzx eax, byte [ebp - 0x7a]
test eax, eax
je 0x423624
push 0x2cc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x4235d2
jmp 0x423508
mov dword [ebp - 0xb8], 0xffff
mov dword [ebp - 0x1c0], 0x93dda37b
mov dword [ebp - 0xd8], 0
jmp 0x423658
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 2
jge 0x423674
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x680], 0xd9ddcef9
jmp 0x42364b
mov dword [ebp - 0x1c0], 1
cmp dword [ebp - 0x1c0], 0
je 0x4236d2
mov dword [ebp - 0xb8], 0
jmp 0x4236a0
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jg 0x4236d0
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x4236ce
push 0x1565
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x423693
jmp 0x4236ed
mov byte [ebp - 0x62], 0
movzx eax, byte [ebp - 0x62]
test eax, eax
je 0x4236ed
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [ebp - 0xc0], 0xc184c506
mov dword [ebp - 0x4e4], 0x950ba1bf
mov dword [ebp - 0xe8], 0
jmp 0x42371a
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 2
jge 0x423736
mov eax, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x688], 5
jmp 0x42370d
mov dword [ebp - 0xc0], 1
jmp 0x42374f
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0
jl 0x423765
cmp dword [ebp - 0x4e4], 0
je 0x423763
jmp 0x423765
jmp 0x423742
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x3a0], 0xdc4b4e12
mov dword [ebp - 0x40], 0
jmp 0x423786
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jge 0x42379c
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x84], 0x90a624cd
jmp 0x42377f
mov dword [ebp - 0x40], 0
jmp 0x4237ac
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x4237c2
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x664], 0xe17c1097
jmp 0x4237a5
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x18], 0
jmp 0x4237db
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x42391b
mov dword [ebp - 0x1e4], 0x5e0710dd
mov dword [ebp - 0x3b8], 0xfffffffe
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x84], 0
je 0x423816
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x664], 0
jne 0x42387b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x84]
cmp dword [ebp + eax*4 - 0x84], ecx
jg 0x423838
mov dword [ebp - 0x398], 1
jmp 0x42383f
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x1e4]
cmp dword [ebp - 0x398], eax
jg 0x423859
mov dword [ebp - 0x1c8], 1
jmp 0x423860
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c8]
sub ecx, dword [ebp + eax*4 - 0x84]
jne 0x42387b
and dword [ebp - 0x1d0], 0
jmp 0x423885
mov dword [ebp - 0x1d0], 1
mov eax, dword [ebp - 0x3a0]
add eax, dword [ebp - 0x1d0]
imul eax, eax, 3
test eax, eax
je 0x4238a9
xor eax, eax
inc eax
je 0x4238a9
mov dword [ebp - 0x3a8], 1
jmp 0x4238b0
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 0x839e
jl 0x4238c8
mov dword [ebp - 0x1d8], 1
jmp 0x4238cf
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x84]
cmp dword [ebp - 0x1d8], eax
je 0x4238ed
mov dword [ebp - 0x3b0], 1
jmp 0x4238f4
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x3b0]
mov dword [ebp - 0x3b8], eax
mov eax, dword [ebp - 0x3b8]
add eax, dword [ebp - 0x1e4]
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x84], eax
jmp 0x4237d4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x423d1e
mov dword [ebp - 0x638], 0xffffffff
mov dword [ebp - 0x30], 0
jmp 0x423952
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x423968
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x600], 0
jmp 0x42394b
mov dword [ebp - 0x30], 0
jmp 0x423978
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x42398e
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x540], 0x5252cb13
jmp 0x423971
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x540], 2
jmp 0x4239bc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x540]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x540], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x540], 0
jl 0x423a83
mov dword [ebp - 0x42c], 1
mov dword [ebp - 0x428], 1
mov dword [ebp - 0x424], 1
mov dword [ebp - 0x420], 1
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x42c], 0
jmp 0x423a26
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x42c]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x42c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x42c], 2
jg 0x423a60
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x42c]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x42c]
mov eax, dword [ebp + eax*4 - 0x600]
mov dword [ebp + ecx*4 - 0x600], eax
jmp 0x423a0b
mov byte [ebp - 0x63], 0
movzx eax, byte [ebp - 0x63]
test eax, eax
je 0x423a7e
push 0xad0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MonitorFromWindow]
jmp 0x4239a1
mov dword [ebp - 0x118], 0x9bdd7770
mov dword [ebp - 0x468], 0x28d9ba5f
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0xc8], 0xc511ec1f
mov dword [ebp - 0x43c], 0x35a7ab5b
mov dword [ebp - 0xe0], 0
jmp 0x423ace
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 4
jge 0x423aea
mov eax, dword [ebp - 0xe0]
mov dword [ebp + eax*4 - 0x178], 0xfffffffe
jmp 0x423ac1
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x178], 0x15
jmp 0x423b15
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x178]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x178], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x178], 0x13
jle 0x423b43
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x423b41
push 0
push 0x1e16
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
jmp 0x423afc
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x178]
mov dword [ebp - 0x4a0], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x4a0]
mov dword [ebp + eax - 0x178], ecx
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x178], 0
je 0x423b9f
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x178]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x423b9f
mov dword [ebp - 0x2f4], 1
jmp 0x423ba6
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x468], eax
mov eax, 0xa4129b85
cmp eax, 0x1fc42ff1
jae 0x423bca
mov dword [ebp - 0x1ec], 1
jmp 0x423bd1
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x37c], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x178]
cmp dword [ebp - 0x37c], eax
jg 0x423bfd
mov dword [ebp - 0x1f4], 1
jmp 0x423c04
and dword [ebp - 0x1f4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x178]
add eax, dword [ebp - 0x1f4]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x178]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x178]
jle 0x423c3e
mov dword [ebp - 0x2fc], 1
jmp 0x423c45
and dword [ebp - 0x2fc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x178]
neg eax
cmp eax, dword [ebp - 0x2fc]
jg 0x423c68
mov dword [ebp - 0x1fc], 1
jmp 0x423c6f
and dword [ebp - 0x1fc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x178]
cmp dword [ebp - 0x1fc], eax
jge 0x423c8f
mov dword [ebp - 0x3c8], 1
jmp 0x423c96
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
add eax, 0x118c
jne 0x423cb5
cmp dword [ebp - 0x118], 0
jne 0x423cb5
and dword [ebp - 0x204], 0
jmp 0x423cbf
mov dword [ebp - 0x204], 1
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x648], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x178], 0
je 0x423cf3
cmp dword [ebp - 0xc8], 0
or eax, 0xffffffff
jne 0x423d04
mov dword [ebp - 0x304], 1
jmp 0x423d0b
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0x43c], eax
xor eax, eax
jmp 0x425cab
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0xf8], 0x1824a8c6
mov dword [ebp - 0xf8], 0xffffffe7
jmp 0x423d53
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xfffffff5
jg 0x423d79
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x423d77
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
jmp 0x423d46
mov byte [ebp - 0x67], 0
movzx eax, byte [ebp - 0x67]
test eax, eax
je 0x423d8d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x94]
cmp dword [eax], 0x4550
je 0x4242a3
mov dword [ebp - 0x5ac], 0xf9b3198a
mov dword [ebp - 0x5a8], 0xf9b3198a
mov dword [ebp - 0x5a4], 0xf9b3198a
mov dword [ebp - 0x5a0], 0xf9b3198a
mov dword [ebp - 0xa8], 0x18885c6f
mov dword [ebp - 0xd0], 0
jmp 0x423dea
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 2
jge 0x423e06
mov eax, dword [ebp - 0xd0]
mov dword [ebp + eax*4 - 0x690], 9
jmp 0x423ddd
mov dword [ebp - 0xa8], 0
jmp 0x423e1f
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 3
jg 0x423e41
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x423e3f
push 0x254f
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x423e12
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x4a4], 0xf12afbc
mov dword [ebp - 0x54c], 7
mov dword [ebp - 0x61c], 0xe1b460d5
mov dword [ebp - 0x554], 0xaf0db126
mov dword [ebp - 0x324], 0
mov dword [ebp - 0xac], 0
jmp 0x423ea7
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x423ec3
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0xa0], 2
jmp 0x423e9a
mov dword [ebp - 4], 0
jmp 0x423ed3
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jg 0x42420b
mov dword [ebp - 0xb4], 0
jmp 0x423ef6
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x423f12
mov eax, dword [ebp - 0xb4]
mov dword [ebp + eax*4 - 0x148], 2
jmp 0x423ee9
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa0], 0
jne 0x423fd6
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xa0], 0xffff
ja 0x423f42
mov dword [ebp - 0x20c], 1
jmp 0x423f49
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x8c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x8c], eax
jge 0x423f76
mov dword [ebp - 0x384], 1
jmp 0x423f7d
and dword [ebp - 0x384], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x384], eax
jl 0x423fa1
cmp dword [ebp - 4], 0
jne 0x423fa1
and dword [ebp - 0x4ac], 0
jmp 0x423fab
mov dword [ebp - 0x4ac], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa0]
mov dword [ebp - 0x5ec], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xa0], 0
jne 0x423fd6
and dword [ebp - 0x160], 0
jmp 0x423fe0
mov dword [ebp - 0x160], 1
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x160]
mov dword [ebp + eax - 0x148], ecx
mov eax, dword [ebp - 0x120]
cmp eax, dword [ebp - 0x160]
jle 0x42401a
mov dword [ebp - 0x214], 1
jmp 0x424021
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xa0]
cmp eax, dword [ebp - 0x214]
jl 0x42403f
mov dword [ebp - 0x444], 1
jmp 0x424046
and dword [ebp - 0x444], 0
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xa0], 0x51fe511b
jne 0x42406f
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xa0], 0
je 0x42406f
mov dword [ebp - 0x30c], 1
jmp 0x424076
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xa0]
cmp eax, dword [ebp - 0x30c]
jne 0x424094
mov dword [ebp - 0x21c], 1
jmp 0x42409b
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xa0]
cmp dword [ebp - 0x21c], eax
je 0x4240b9
mov dword [ebp - 0x3c0], 1
jmp 0x4240c0
and dword [ebp - 0x3c0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa0]
cmp dword [ebp - 0x3c0], eax
jg 0x4240e1
mov dword [ebp - 0x224], 1
jmp 0x4240e8
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0x224]
sub eax, 0x6200d40a
mov ecx, dword [ebp - 4]
cmp eax, dword [ebp + ecx*4 - 0xa0]
jle 0x42410b
mov dword [ebp - 0x314], 1
jmp 0x424112
and dword [ebp - 0x314], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x314]
sub ecx, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0xa0], ecx
jle 0x424133
mov dword [ebp - 0x22c], 1
jmp 0x42413a
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0xa0]
cmp dword [ebp - 0x22c], eax
jl 0x424158
mov dword [ebp - 0x38c], 1
jmp 0x42415f
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x38c], eax
jle 0x424176
mov dword [ebp - 0x234], 1
jmp 0x42417d
and dword [ebp - 0x234], 0
cmp dword [ebp - 0x234], 0
jl 0x424192
mov dword [ebp - 0x31c], 1
jmp 0x424199
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x31c]
add ecx, dword [ebp + eax*4 - 0xa0]
mov dword [ebp - 0x23c], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0xa0], ecx
cmp dword [ebp - 0x23c], 0xfffc
jae 0x4241d7
mov dword [ebp - 0x3dc], 1
jmp 0x4241de
and dword [ebp - 0x3dc], 0
cmp dword [ebp - 0x3dc], 0
jb 0x4241f3
mov dword [ebp - 0x244], 1
jmp 0x4241fa
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x244]
mov dword [ebp - 0x4a4], eax
jmp 0x423ecc
mov dword [ebp - 0x8c], 0
jmp 0x424224
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x17
jne 0x42429c
mov dword [ebp - 0x55c], 0xc507b392
mov dword [ebp - 0x634], 0x9bec7a42
mov dword [ebp - 0xbc], 0
jmp 0x42425a
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x424276
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x6b4], 1
jmp 0x42424d
mov byte [ebp - 0x64], 0
movzx eax, byte [ebp - 0x64]
test eax, eax
je 0x42428a
push 0
call dword [sym.imp.USER32.dll_SetCursor]
mov eax, dword [ebp - 0x324]
dec eax
mov dword [ebp - 0x324], eax
jmp 0x424217
xor eax, eax
jmp 0x425cab
mov dword [ebp - 0x44c], 0x4fc2285f
mov dword [ebp - 0x4c0], 0xfffffffe
mov dword [ebp - 0x4a8], 4
mov dword [ebp - 0x3cc], 0x87a5
mov dword [ebp - 0x564], 0xcb6a7f4e
mov dword [ebp - 0xc4], 0
jmp 0x4242ee
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x42430a
mov eax, dword [ebp - 0xc4]
mov dword [ebp + eax*4 - 0x414], 0x6df37d45
jmp 0x4242e1
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x414], 0
jne 0x4243ee
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x5f4], eax
push 4
pop eax
shl eax, 1
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x414]
cmp dword [ebp + eax - 0x414], ecx
jl 0x424350
mov dword [ebp - 0x24c], 1
jmp 0x424357
and dword [ebp - 0x24c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x414]
add eax, dword [ebp - 0x24c]
cmp eax, 0xfffffffb
ja 0x42437b
mov dword [ebp - 0x394], 1
jmp 0x424382
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x4c0], eax
push 4
pop eax
imul eax, eax, 3
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x414]
inc ecx
cmp dword [ebp + eax - 0x414], ecx
je 0x4243b7
mov dword [ebp - 0x254], 1
jmp 0x4243be
and dword [ebp - 0x254], 0
cmp dword [ebp - 0x254], 0xffffffff
jge 0x4243d3
mov dword [ebp - 0x32c], 1
jmp 0x4243da
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
add eax, 4
jne 0x4243ee
and dword [ebp - 0x454], 0
jmp 0x4243f8
mov dword [ebp - 0x454], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x414]
mov dword [ebp - 0x56c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x414], 0
jne 0x424432
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x414], 0
jne 0x424432
and dword [ebp - 0x25c], 0
jmp 0x42443c
mov dword [ebp - 0x25c], 1
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
push 0x39f7
push 0x3bbb
push 1
push 1
push dword [ebp - 0x94]
push 1
push 1
lea eax, [ebp - 0xdc]
push eax
push 0x1ea6
push 0x4ed9
push 0x632f
push 0x39af
push 0x287e
call fcn.0041c81f
add esp, 0x34
mov dword [ebp - 0x1c], 0x42c70bb7
mov dword [ebp - 0x34], 0
jmp 0x4244ac
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x4244c2
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x188], 0
jmp 0x4244a5
mov dword [ebp - 0x34], 0
jmp 0x4244d2
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x4244e8
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x520], 0
jmp 0x4244cb
mov dword [ebp - 0x1c], 2
jmp 0x4244f8
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x4247f9
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x33c], 0xffffffff
mov dword [ebp - 0x284], 0xca3c47aa
mov dword [ebp - 0x14], 2
jmp 0x42452d
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x4247f4
mov dword [ebp - 0x130], 0xf1fdbd01
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x188]
mov dword [ebp - 0x544], eax
cmp dword [ebp - 0x14], 0x5900
je 0x424566
mov dword [ebp - 0x128], 1
jmp 0x42456d
and dword [ebp - 0x128], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x128]
mov dword [ebp + eax - 0x520], ecx
cmp dword [ebp - 0x128], 0
jne 0x424595
mov dword [ebp - 0x264], 1
jmp 0x42459c
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 0xffffffff
jbe 0x4245b1
mov dword [ebp - 0x334], 1
jmp 0x4245b8
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x188]
cmp eax, dword [ebp - 0x334]
jl 0x4245d6
mov dword [ebp - 0x26c], 1
jmp 0x4245dd
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x188]
mov ecx, dword [ebp - 0x14]
add eax, dword [ebp + ecx*4 - 0x188]
cmp eax, dword [ebp - 0x26c]
jge 0x424605
mov dword [ebp - 0x150], 1
jmp 0x42460c
and dword [ebp - 0x150], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x150]
mov dword [ebp + eax - 0x188], ecx
cmp dword [ebp - 0x150], 0
jne 0x424634
mov dword [ebp - 0x39c], 1
jmp 0x42463b
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x39c]
mov dword [ebp - 0x130], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0x14], eax
je 0x424665
mov dword [ebp - 0x274], 1
jmp 0x42466c
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x130]
cmp dword [ebp - 0x274], eax
je 0x424692
mov dword [ebp - 0x27c], 1
jmp 0x424699
and dword [ebp - 0x27c], 0
mov dword [ebp - 0x33c], 0xfffffff6
mov eax, dword [ebp - 0x33c]
cmp eax, dword [ebp - 0x27c]
jl 0x4246bd
mov dword [ebp - 0x3f0], 1
jmp 0x4246c4
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x284], eax
jge 0x4246e7
mov dword [ebp - 0x344], 1
jmp 0x4246ee
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x344], eax
jge 0x424705
mov dword [ebp - 0x28c], 1
jmp 0x42470c
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x28c]
neg eax
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x520]
mov ecx, dword [ebp - 0x14]
cmp eax, dword [ebp + ecx*4 - 0x188]
je 0x42473a
mov dword [ebp - 0x3a4], 1
jmp 0x424741
and dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x3a4], 0xe1c
jle 0x424759
mov dword [ebp - 0x294], 1
jmp 0x424760
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x294], eax
jg 0x424777
mov dword [ebp - 0x34c], 1
jmp 0x42477e
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x34c], eax
jge 0x424795
mov dword [ebp - 0x29c], 1
jmp 0x42479c
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x188]
cmp dword [ebp - 0x29c], eax
jl 0x4247ca
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x520], 0
je 0x4247ca
mov dword [ebp - 0x45c], 1
jmp 0x4247d1
and dword [ebp - 0x45c], 0
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0x520], 0x3c1d
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x188], eax
jmp 0x424526
jmp 0x4244f1
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x42480d
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
cmp dword [ebp - 0xdc], 0
jne 0x42481d
xor eax, eax
jmp 0x425cab
mov dword [ebp - 0x54], 1
mov dword [ebp - 0xcc], 0xfffffff7
mov dword [ebp - 0x46c], 0x6179
mov dword [ebp - 0x44], 0
jmp 0x424848
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x42485e
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x404], 1
jmp 0x424841
mov dword [ebp - 0x44], 0
jmp 0x42486e
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x424884
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x4cc], 0x33bd
jmp 0x424867
mov dword [ebp - 0x54], 0
jmp 0x424894
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x424dcd
mov dword [ebp - 8], 0xfffc
mov dword [ebp - 0x2d4], 0
mov dword [ebp - 0x78], 0xc74c3eec
mov dword [ebp - 0x1f0], 1
mov dword [ebp - 0x17c], 0x772a30fb
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x404], 0
jne 0x4248e6
mov dword [ebp - 0x354], 1
jmp 0x4248ed
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
push 4
pop edx
imul edx, edx, 0
sub ecx, dword [ebp + edx - 0x404]
add ecx, dword [ebp - 8]
cmp eax, ecx
jg 0x424917
mov dword [ebp - 0x4d8], 1
jmp 0x42491e
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x54]
lea eax, [eax + ecx + 0x6aa1c33]
cmp eax, 0x215a6091
je 0x424950
mov dword [ebp - 0x3d4], 1
jmp 0x424957
and dword [ebp - 0x3d4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x404]
add eax, dword [ebp - 0x3d4]
jne 0x424985
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x4cc], 0
jne 0x424985
and dword [ebp - 0x2a4], 0
jmp 0x42498f
mov dword [ebp - 0x2a4], 1
mov eax, dword [ebp - 0x2a4]
sub eax, dword [ebp - 0x2d4]
cmp dword [ebp - 0x354], eax
jle 0x4249b1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4cc], 0
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x404], 0xffffffff
jb 0x424a48
mov dword [ebp - 0x3ac], 0x3f6d1d89
mov dword [ebp - 8], 0
jmp 0x4249df
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jg 0x424a3a
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x404]
mov dword [ebp - 0x57c], eax
mov eax, 0x88ad88ca
test eax, eax
je 0x424a13
cmp dword [ebp - 0x3ac], 0
je 0x424a13
mov dword [ebp - 0x2ac], 1
jmp 0x424a1a
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0x404], ecx
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x404], 0x11378331
jmp 0x4249d8
mov eax, dword [ebp - 0x3ac]
mov dword [ebp - 0x78], eax
jmp 0x424dc8
mov dword [ebp - 0x88], 0x5340
mov dword [ebp - 0x158], 0xffffffff
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x5b8], eax
imul eax, dword [ebp - 0x88], 0x2309
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x4cc]
jge 0x424a8d
mov dword [ebp - 0x2b4], 1
jmp 0x424a94
and dword [ebp - 0x2b4], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x2b4], eax
je 0x424aab
mov dword [ebp - 0x35c], 1
jmp 0x424ab2
and dword [ebp - 0x35c], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x35c]
jl 0x424acc
mov dword [ebp - 0x2bc], 1
jmp 0x424ad3
and dword [ebp - 0x2bc], 0
cmp dword [ebp - 0x2bc], 0
jb 0x424ae8
mov dword [ebp - 0x3e8], 1
jmp 0x424aef
and dword [ebp - 0x3e8], 0
cmp dword [ebp - 0x3e8], 0x7773
je 0x424b07
mov dword [ebp - 0x2c4], 1
jmp 0x424b0e
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x2c4]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xcc], eax
jl 0x424b31
mov dword [ebp - 0x364], 1
jmp 0x424b38
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x364], eax
je 0x424b52
mov dword [ebp - 0x2cc], 1
jmp 0x424b59
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x2cc]
dec eax
cmp dword [ebp - 0x1f0], eax
jl 0x424b74
mov dword [ebp - 0x3b4], 1
jmp 0x424b7b
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x158], eax
mov eax, dword [ebp - 0x2d4]
mov dword [ebp - 0x588], eax
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x5c0], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x404]
mov dword [ebp - 0x36c], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x36c]
mov dword [ebp + eax*4 - 0x404], ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x36c]
sub eax, dword [ebp - 0x78]
sub eax, 0x7a5c6a8b
cmp eax, 0x6e56995e
jg 0x424c27
mov dword [ebp - 0x464], 0xfffffff7
mov eax, dword [ebp - 0x464]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov dword [ebp - 0xcc], eax
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x424c22
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
jmp 0x424dc1
mov dword [ebp - 0x138], 0xfffffffd
mov dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x594], eax
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0x138], eax
jge 0x424c5e
mov dword [ebp - 0x2dc], 1
jmp 0x424c65
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x3c9d
jle 0x424c83
mov dword [ebp - 0x3bc], 1
jmp 0x424c8a
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x2e4], eax
mov eax, dword [ebp - 0x2e4]
sub eax, dword [ebp - 0x88]
cmp eax, 0x46a2ff81
jne 0x424cb5
mov dword [ebp - 0x4b0], 1
jmp 0x424cbc
and dword [ebp - 0x4b0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4cc]
mov dword [ebp - 0x5c8], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x404], 0xfffffffe
je 0x424ce8
mov dword [ebp - 0x374], 1
jmp 0x424cef
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x17c]
imul eax, dword [ebp - 0x374]
test eax, eax
je 0x424d15
cmp dword [ebp - 0x138], 0
je 0x424d15
mov dword [ebp - 0x2ec], 1
jmp 0x424d1c
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x138]
cmp dword [ebp - 0x2ec], eax
jle 0x424d36
mov dword [ebp - 0x18c], 1
jmp 0x424d3d
and dword [ebp - 0x18c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4cc]
cmp dword [ebp - 0x18c], eax
jg 0x424d5e
mov dword [ebp - 0x1e0], 1
jmp 0x424d65
and dword [ebp - 0x1e0], 0
cmp dword [ebp - 0x1e0], 4
jle 0x424d7a
mov dword [ebp - 0x1e8], 1
jmp 0x424d81
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x46c]
cmp dword [ebp - 0x1e8], eax
jge 0x424d9b
mov dword [ebp - 0x4d0], 1
jmp 0x424da2
and dword [ebp - 0x4d0], 0
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x5d0], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x5b0], eax
mov dword [ebp - 0x158], 0xfffffffe
mov dword [ebp - 0x78], 0xfffffff9
jmp 0x42488d
push 1
push 1
push 1
push 0x74d7
push 0x1048
push 0x27f1
push 1
push dword [ebp - 0x94]
push 1
push dword [ebp - 0x140]
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xdc]
push eax
push 0x3b07
call fcn.0042172f
add esp, 0x38
push dword [ebp - 0x24]
push 0x7ce7
push dword [ebp - 0x94]
push 1
push 0
push 0xb9
push 1
push 0x5f17
push dword [ebp + 8]
push 0x4cb1
call fcn.00410d0e
add esp, 0x28
mov dword [ebp - 0x90], 0xfffffffb
mov dword [ebp - 0x474], 0
mov dword [ebp - 0x47c], 1
mov dword [ebp - 0x3c], 0
jmp 0x424e6d
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x424e83
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x670], 0xa11015aa
jmp 0x424e66
mov dword [ebp - 0x3c], 0
jmp 0x424e93
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x424ea9
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x4b8], 0xfffffff9
jmp 0x424e8c
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x90], eax
je 0x424ec3
mov dword [ebp - 0x1f8], 1
jmp 0x424eca
and dword [ebp - 0x1f8], 0
mov dword [ebp - 0x474], 0x9cf1813f
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x1f8], eax
je 0x424eee
mov dword [ebp - 0x200], 1
jmp 0x424ef5
and dword [ebp - 0x200], 0
cmp dword [ebp - 0x90], 6
jl 0x424f0a
mov dword [ebp - 0x10c], 1
jmp 0x424f11
and dword [ebp - 0x10c], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x10c]
mov dword [ebp + eax - 0x670], ecx
mov eax, dword [ebp - 0x200]
cmp eax, dword [ebp - 0x10c]
jge 0x424f3d
mov dword [ebp - 0x114], 1
jmp 0x424f44
and dword [ebp - 0x114], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x114]
mov dword [ebp + eax - 0x4b8], ecx
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x114], eax
jge 0x424f71
mov dword [ebp - 0x208], 1
jmp 0x424f78
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0x208]
neg eax
mov dword [ebp - 0x47c], eax
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0xdc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x5b4], 0x799ac789
mov byte [ebp - 0x68], 0
movzx eax, byte [ebp - 0x68]
test eax, eax
je 0x424ffa
push 0
push 0x190c
push 0x1ea6
push 0xf39
push 0x17f0
push 0x1eed
push 0x17a0
push 0xbfe
push 0xab
push 0x21f0
push 0x19a5
push 0x1240
push 0x765
push 0x2013
call dword [sym.imp.GDI32.dll_CreateFontA]
mov byte [ebp - 0x66], 0
movzx eax, byte [ebp - 0x66]
test eax, eax
je 0x425011
push 0x18ca
call dword [sym.imp.USER32.dll_GetKeyboardType]
cmp dword [ebp - 0x210], 0
je 0x42505b
push 0x64ec
push 0x1631
push 1
push 0x492e
push 0
push 0x17ec
push 0x7605
push 0x2f5f
push 0x59bb
push 1
push dword [ebp - 0x210]
push 0
push dword [ebp - 0x24]
push 0x65d7
call fcn.004161bd
add esp, 0x38
mov dword [ebp - 0x504], 1
mov dword [ebp - 0x500], 1
mov dword [ebp - 0x4fc], 1
mov dword [ebp - 0x4f8], 1
mov dword [ebp - 0x4f4], 1
mov dword [ebp - 0x4f0], 1
mov dword [ebp - 0x4ec], 1
mov dword [ebp - 0x4e8], 1
mov dword [ebp - 0x250], 1
mov dword [ebp - 0x604], 0xfffffff8
mov dword [ebp - 0x38], 0
jmp 0x4250cf
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x4250e5
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x104], 0xac204e2d
jmp 0x4250c8
mov dword [ebp - 0x38], 0
jmp 0x4250f5
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 3
jge 0x42510b
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x6a8], 0x32883e73
jmp 0x4250ee
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x104], 0
jmp 0x425139
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x104], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0x17
jle 0x4252f9
mov dword [ebp - 0xd4], 0x3948
mov dword [ebp - 0x49c], 0xde6b9338
mov eax, dword [ebp - 0xd4]
neg eax
cmp eax, 0xfffffffb
jne 0x42517a
mov dword [ebp - 0x4e0], 1
jmp 0x425181
and dword [ebp - 0x4e0], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x104], 0x5bbb
jl 0x4251b0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x104], 0
je 0x4251b0
mov dword [ebp - 0x218], 1
jmp 0x4251b7
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0xd4]
add eax, dword [ebp - 0x218]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x104]
jge 0x4251de
mov dword [ebp - 0x220], 1
jmp 0x4251e5
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x220]
cmp eax, dword [ebp - 0xd4]
jg 0x425206
mov dword [ebp - 0x228], 1
jmp 0x42520d
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
add eax, 0x2ef7
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x504]
je 0x425233
mov dword [ebp - 0x230], 1
jmp 0x42523a
and dword [ebp - 0x230], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x504]
cmp dword [ebp - 0x230], eax
jge 0x42525a
mov dword [ebp - 0x484], 1
jmp 0x425261
and dword [ebp - 0x484], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x104]
mov dword [ebp - 0x5bc], eax
push 7
pop eax
cmp eax, 0xfffffff6
jae 0x425288
mov dword [ebp - 0x238], 1
jmp 0x42528f
and dword [ebp - 0x238], 0
cmp dword [ebp - 0x238], 0x7b1b0cad
jl 0x4252a7
mov dword [ebp - 0x240], 1
jmp 0x4252ae
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x49c]
cmp dword [ebp - 0x240], eax
jle 0x4252c8
mov dword [ebp - 0x248], 1
jmp 0x4252cf
and dword [ebp - 0x248], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x248]
mov dword [ebp + eax - 0x4f4], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x4f4], 0
je 0x4252f4
jmp 0x4252f9
jmp 0x42511e
mov eax, dword [ebp - 0x250]
inc eax
mov dword [ebp - 0x250], eax
push dword [ebp - 0x24]
call fcn.00417792
pop ecx
test eax, eax
jne 0x42531a
xor eax, eax
jmp 0x425cab
mov dword [ebp - 0x260], 0x5d1c58bd
mov dword [ebp - 0x124], 0x8b15e31
mov dword [ebp - 0x48], 0
jmp 0x42533e
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x425351
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x50], 0x3ad3b315
jmp 0x425337
mov dword [ebp - 0x48], 0
jmp 0x425361
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jge 0x425377
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x3e4], 0x14a9bacd
jmp 0x42535a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
je 0x425399
mov eax, 0xd11d962e
test eax, eax
je 0x425399
mov dword [ebp - 0x258], 1
jmp 0x4253a0
and dword [ebp - 0x258], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
cmp eax, dword [ebp - 0x258]
jne 0x4253be
mov dword [ebp - 0x268], 1
jmp 0x4253c5
and dword [ebp - 0x268], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
jae 0x4253e8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
jne 0x4253e8
and dword [ebp - 0x11c], 0
jmp 0x4253f2
mov dword [ebp - 0x11c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x11c]
mov dword [ebp + eax - 0x3e4], ecx
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x260], eax
mov eax, dword [ebp - 0x260]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x50]
cmp dword [ebp - 0x268], eax
je 0x425437
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3e4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3e4]
mov dword [ebp - 0x124], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x50]
mov dword [ebp - 0x644], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x50], 0
jne 0x42551d
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x3e4]
cmp dword [ebp + eax - 0x50], ecx
jne 0x425494
push 5
pop eax
test eax, eax
jne 0x425494
and dword [ebp - 0x270], 0
jmp 0x42549e
mov dword [ebp - 0x270], 1
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x270], eax
jl 0x4254b8
mov dword [ebp - 0x278], 1
jmp 0x4254bf
and dword [ebp - 0x278], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x278]
add ecx, 0x79b3
cmp dword [ebp + eax - 0x50], ecx
jge 0x4254e3
mov dword [ebp - 0x280], 1
jmp 0x4254ea
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x280], eax
jne 0x425504
mov dword [ebp - 0x288], 1
jmp 0x42550b
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x288]
inc eax
jne 0x42551d
and dword [ebp - 0x290], 0
jmp 0x425527
mov dword [ebp - 0x290], 1
mov eax, dword [ebp - 0x290]
add eax, 0x10cbedfa
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x3e4], eax
push 1
push 0x2935
push 0x503a
push 0xa40
push 1
push 0x8d
push dword [ebp - 0x24]
push 0x5233
push 0x5ceb
push 0
call fcn.00408b42
add esp, 0x28
mov dword [ebp - 0x5c4], 0xe3245f1d
mov dword [ebp - 0x60c], 0xe2c0d37a
mov dword [ebp - 0x48c], 0xdcb363f9
mov dword [ebp - 0x144], 0xf147909b
mov dword [ebp - 0x498], 0x781ced8f
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x2f0], 0x68029989
mov dword [ebp - 0x440], 0xc96c7979
mov dword [ebp - 0x5cc], 0xa61bf079
mov dword [ebp - 0x2b0], 0xffffffff
mov dword [ebp - 0x13c], 0xffffffff
mov dword [ebp - 0x438], 7
mov dword [ebp - 0x12c], 1
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x58], 0
jmp 0x42560a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x425620
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x69c], 0xedf1
jmp 0x425603
mov dword [ebp - 0x58], 0
jmp 0x425630
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 1
jge 0x425646
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x2c8], 0x96ee4e91
jmp 0x425629
mov eax, dword [ebp - 0x13c]
dec eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x134], 0
jne 0x425882
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x62c], eax
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x12c]
inc ecx
mov dword [ebp - 0x12c], ecx
test eax, eax
jne 0x42579e
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0
jne 0x4256b5
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c8], 0
jne 0x4256b5
and dword [ebp - 0x298], 0
jmp 0x4256bf
mov dword [ebp - 0x298], 1
imul eax, dword [ebp - 0x298], 0xffffffff
cmp dword [ebp - 0x2b0], eax
jg 0x4256da
mov dword [ebp - 0x2a0], 1
jmp 0x4256e1
and dword [ebp - 0x2a0], 0
mov eax, dword [ebp - 0x2a0]
add eax, 0x6c5f
je 0x4256ff
or eax, 0xffffffff
je 0x4256ff
mov dword [ebp - 0x2a8], 1
jmp 0x425706
and dword [ebp - 0x2a8], 0
imul eax, dword [ebp - 0x2a8], 0
cmp eax, dword [ebp - 0x498]
je 0x425721
mov dword [ebp - 0x2b8], 1
jmp 0x425728
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x2b0]
cmp dword [ebp - 0x2b8], eax
jl 0x425742
mov dword [ebp - 0x2c0], 1
jmp 0x425749
and dword [ebp - 0x2c0], 0
cmp dword [ebp - 0x2c0], 0xd69c
jl 0x425761
mov dword [ebp - 0x2d0], 1
jmp 0x425768
and dword [ebp - 0x2d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c8]
cmp eax, dword [ebp - 0x2d0]
jne 0x425789
mov dword [ebp - 0x434], 1
jmp 0x425790
and dword [ebp - 0x434], 0
or eax, 0xffffffff
jne 0x42579e
and dword [ebp - 0x2d8], 0
jmp 0x4257a8
mov dword [ebp - 0x2d8], 1
cmp dword [ebp - 0x2d8], 1
jb 0x4257bd
mov dword [ebp - 0x2e0], 1
jmp 0x4257c4
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x13c]
cmp dword [ebp - 0x144], eax
jg 0x4257ee
push 7
pop eax
test eax, eax
jne 0x4257ee
and dword [ebp - 0x2e8], 0
jmp 0x4257f8
mov dword [ebp - 0x2e8], 1
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 4
jne 0x425819
mov dword [ebp - 0x2f8], 1
jmp 0x425820
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x2f8], eax
jne 0x42583a
mov dword [ebp - 0x300], 1
jmp 0x425841
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x300]
jne 0x425861
mov eax, 0x12cf720a
test eax, eax
jne 0x425861
and dword [ebp - 0x308], 0
jmp 0x42586b
mov dword [ebp - 0x308], 1
cmp dword [ebp - 0x308], 0
jne 0x425882
xor eax, eax
inc eax
jne 0x425882
and dword [ebp - 0x310], 0
jmp 0x42588c
mov dword [ebp - 0x310], 1
mov eax, dword [ebp - 0x14c]
cmp dword [ebp - 0x310], eax
jne 0x4258a6
mov dword [ebp - 0x318], 1
jmp 0x4258ad
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
dec eax
sub eax, dword [ebp - 0x438]
mov dword [ebp - 0x440], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x425917
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xdc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x320], ecx
jne 0x4258e8
xor eax, eax
jmp 0x425cab
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x320]
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0
jne 0x42590d
xor eax, eax
jmp 0x425cab
mov eax, dword [ebp - 0x24]
mov dword [eax + 0x10], 1
mov dword [ebp - 0x10], 0xb999fb02
mov dword [ebp - 0x28], 0x949f4ffc
mov dword [ebp - 0x4c], 0x426a760
mov dword [ebp - 0x5d4], 0x86b9bdd1
mov dword [ebp - 0x614], 0
mov dword [ebp - 0x5dc], 0xb5826cce
mov dword [ebp - 0x460], 1
mov dword [ebp - 0x63c], 0xd6e3f992
mov dword [ebp - 0xe4], 0
jmp 0x425977
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jge 0x425993
mov eax, dword [ebp - 0xe4]
mov dword [ebp + eax*4 - 0x590], 0
jmp 0x42596a
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x425a25
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x5e4], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x28], eax
jne 0x4259c0
mov dword [ebp - 0x328], 1
jmp 0x4259c7
and dword [ebp - 0x328], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x328]
jle 0x4259de
mov dword [ebp - 0x330], 1
jmp 0x4259e5
and dword [ebp - 0x330], 0
cmp dword [ebp - 0x330], 0
jne 0x4259fa
mov dword [ebp - 0x450], 1
jmp 0x425a01
and dword [ebp - 0x450], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x550], eax
mov eax, 0xe24307a3
test eax, eax
jne 0x425a25
and dword [ebp - 0x338], 0
jmp 0x425a2f
mov dword [ebp - 0x338], 1
cmp dword [ebp - 0x338], 4
jle 0x425a44
mov dword [ebp - 0x340], 1
jmp 0x425a4b
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x340]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x4c], eax
jne 0x425a91
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x425a8c
push 0x15be
push 0
push 0
push 0
push 0
push 0x159a
push 0x191d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
jmp 0x425c2f
mov dword [ebp - 0x1b4], 1
mov dword [ebp - 0x458], 0x8ce2
mov dword [ebp - 0x1bc], 0x4826422f
cmp dword [ebp - 0x4c], 0
jne 0x425ac7
mov eax, 0x94b5
test eax, eax
jne 0x425ac7
and dword [ebp - 0x348], 0
jmp 0x425ad1
mov dword [ebp - 0x348], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x348], eax
jl 0x425ae8
mov dword [ebp - 0x350], 1
jmp 0x425aef
and dword [ebp - 0x350], 0
cmp dword [ebp - 0x350], 0xffffffff
jle 0x425b04
mov dword [ebp - 0x358], 1
jmp 0x425b0b
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x358], eax
jge 0x425b22
mov dword [ebp - 0x360], 1
jmp 0x425b29
and dword [ebp - 0x360], 0
mov dword [ebp - 0x10], 7
mov eax, dword [ebp - 0x360]
sub eax, 0x3be4655
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x10], eax
jne 0x425b52
mov dword [ebp - 0x190], 1
jmp 0x425b59
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x28]
jge 0x425b74
mov dword [ebp - 0x194], 1
jmp 0x425b7b
and dword [ebp - 0x194], 0
cmp dword [ebp - 0x194], 0xffffffff
jg 0x425b90
mov dword [ebp - 0x19c], 1
jmp 0x425b97
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x1b4], eax
jl 0x425bba
cmp dword [ebp - 0x4c], 0
je 0x425bba
mov dword [ebp - 0x1a4], 1
jmp 0x425bc1
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x458]
jg 0x425bdf
mov dword [ebp - 0x1ac], 1
jmp 0x425be6
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1bc], eax
mov dword [ebp - 0x10], 0x15
jmp 0x425c02
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1a
jge 0x425c2f
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1bc], eax
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x425c2d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
jmp 0x425bfb
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x460], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x4c]
cmp eax, 0xd796e990
jae 0x425c52
mov dword [ebp - 0x1c4], 1
jmp 0x425c59
and dword [ebp - 0x1c4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x590]
cmp dword [ebp - 0x1c4], eax
jg 0x425c7a
mov dword [ebp - 0x1cc], 1
jmp 0x425c81
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x10], 0
je 0x425c9e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1d4], eax
jmp 0x425ca5
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1d4]
mov esp, ebp
pop ebp
ret