Function at 0x42ade5
Capabilities:
Create pipe
Get thread local storage value
Parse pe header
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x85c
push esi
mov dword [ebp - 0x88], 0xfffffff9
mov dword [ebp - 0xa4], 0x5e1abe8f
mov dword [ebp - 0x320], 1
mov dword [ebp - 0x418], 0xfd29cc02
mov dword [ebp - 0x88], 0
jmp 0x42ae30
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xffffffe5
jg 0x42b2bf
mov dword [ebp - 0x13c], 0
jmp 0x42ae56
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x42ae6f
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x1c], 0xfffffffe
jmp 0x42ae49
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c], 0
jmp 0x42ae94
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0xfffffff2
jge 0x42b2a3
mov dword [ebp - 0x5c], 0xfffffff8
mov dword [ebp - 0x5c], 9
jmp 0x42aebc
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jl 0x42b29e
mov dword [ebp - 0xac], 0x1b61bab5
push 4
lea ecx, [ebp - 0x5e4]
call fcn.0042f0c5
mov dword [ebp - 0x30], 0
jmp 0x42aeed
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x42af09
push dword [ebp - 0x30]
lea ecx, [ebp - 0x5e4]
call fcn.0042f1b3
mov dword [eax], 9
jmp 0x42aee6
mov dword [ebp - 0x30], 0
jmp 0x42af19
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x42af2f
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x658], 0xe16851cc
jmp 0x42af12
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa4], 0
jmp 0x42af54
mov eax, dword [ebp - 0xa4]
dec eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0xfffffffa
jl 0x42b28e
push 2
lea ecx, [ebp - 0x480]
call fcn.0042f0c5
mov dword [ebp - 0x104], 0
jmp 0x42af87
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x42afa9
push dword [ebp - 0x104]
lea ecx, [ebp - 0x480]
call fcn.0042f1b3
mov dword [eax], 0x5b48
jmp 0x42af7a
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x88], eax
jl 0x42afc0
mov dword [ebp - 0x29c], 1
jmp 0x42afc7
and dword [ebp - 0x29c], 0
push 1
lea ecx, [ebp - 0x480]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x29c]
cmp ecx, dword [eax]
jge 0x42afea
mov dword [ebp - 0x3f4], 1
jmp 0x42aff1
and dword [ebp - 0x3f4], 0
cmp dword [ebp - 0x3f4], 0
je 0x42b006
mov dword [ebp - 0x508], 1
jmp 0x42b00d
and dword [ebp - 0x508], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
mov dword [ebp - 0x690], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x5c]
add eax, 0xc9ff
cmp eax, 0x3ae
jl 0x42b041
mov eax, 0xea38
test eax, eax
jne 0x42b041
and dword [ebp - 0x4ec], 0
jmp 0x42b04b
mov dword [ebp - 0x4ec], 1
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x634], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0xac], eax
je 0x42b075
mov dword [ebp - 0x3fc], 1
jmp 0x42b07c
and dword [ebp - 0x3fc], 0
push 0
lea ecx, [ebp - 0x480]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x3fc]
cmp ecx, dword [eax]
jle 0x42b09f
mov dword [ebp - 0x410], 1
jmp 0x42b0a6
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x418]
cmp dword [ebp - 0x410], eax
jg 0x42b0c0
mov dword [ebp - 0x4f4], 1
jmp 0x42b0c7
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x63c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0xac], eax
jne 0x42b0f7
mov eax, 0x96db
test eax, eax
jne 0x42b0f7
and dword [ebp - 0x440], 0
jmp 0x42b101
mov dword [ebp - 0x440], 1
mov eax, dword [ebp - 0xac]
cmp dword [ebp - 0x440], eax
jge 0x42b11b
mov dword [ebp - 0x3ec], 1
jmp 0x42b122
and dword [ebp - 0x3ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp dword [ebp - 0x3ec], eax
jne 0x42b140
mov dword [ebp - 0x400], 1
jmp 0x42b147
and dword [ebp - 0x400], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x400], eax
jg 0x42b15e
mov dword [ebp - 0x4fc], 1
jmp 0x42b165
and dword [ebp - 0x4fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
mov dword [ebp - 0x644], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1f0], eax
push 2
lea ecx, [ebp - 0x5e4]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x1f0]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x480]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x1f0]
cmp ecx, dword [eax]
je 0x42b1b9
mov dword [ebp - 0x1f8], 1
jmp 0x42b1c0
and dword [ebp - 0x1f8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x320]
cmp eax, dword [ebp - 0x1f8]
je 0x42b1ea
mov dword [ebp - 0x3b8], 1
jmp 0x42b1f1
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x3b8]
sub eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x88], eax
jl 0x42b20e
mov dword [ebp - 0x200], 1
jmp 0x42b215
and dword [ebp - 0x200], 0
cmp dword [ebp - 0x200], 0x2699
je 0x42b22d
mov dword [ebp - 0x328], 1
jmp 0x42b234
and dword [ebp - 0x328], 0
push 1
lea ecx, [ebp - 0x480]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x328]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0xac]
jl 0x42b25d
mov dword [ebp - 0x208], 1
jmp 0x42b264
and dword [ebp - 0x208], 0
mov eax, dword [ebp - 0xa4]
imul eax, dword [ebp - 0x208]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x658], eax
lea ecx, [ebp - 0x480]
call fcn.0042f197
jmp 0x42af47
lea ecx, [ebp - 0x5e4]
call fcn.0042f197
jmp 0x42aeb5
jmp 0x42ae7f
mov byte [ebp - 0x7c], 0
movzx eax, byte [ebp - 0x7c]
test eax, eax
je 0x42b2ba
push 0x20e6
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x42ae23
and dword [ebp - 0x20], 0
push 3
lea ecx, [ebp - 0x740]
call fcn.0042f0c5
push 1
lea ecx, [ebp - 0x558]
call fcn.0042f0c5
mov dword [ebp - 0x50], 0
jmp 0x42b2ed
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x42b309
push dword [ebp - 0x50]
lea ecx, [ebp - 0x740]
call fcn.0042f1b3
mov dword [eax], 8
jmp 0x42b2e6
mov dword [ebp - 0x50], 0
jmp 0x42b319
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x42b335
push dword [ebp - 0x50]
lea ecx, [ebp - 0x558]
call fcn.0042f1b3
mov dword [eax], 1
jmp 0x42b312
push 0
lea ecx, [ebp - 0x558]
call fcn.0042f1b3
and dword [eax], 0
jmp 0x42b36b
push 0
lea ecx, [ebp - 0x558]
call fcn.0042f1b3
mov dword [ebp - 0x444], eax
mov eax, dword [ebp - 0x444]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x444]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x558]
call fcn.0042f1b3
cmp dword [eax], 2
jg 0x42b3b8
mov byte [ebp - 0x76], 0
movzx eax, byte [ebp - 0x76]
test eax, eax
je 0x42b398
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov byte [ebp - 0x78], 0
movzx eax, byte [ebp - 0x78]
test eax, eax
je 0x42b3b6
push 0x22cd
push 0x112d
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x42b347
lea ecx, [ebp - 0x558]
call fcn.0042f197
lea ecx, [ebp - 0x740]
call fcn.0042f197
push 1
lea ecx, [ebp - 0x1d0]
call fcn.0042f0c5
push 2
lea ecx, [ebp - 0x160]
call fcn.0042f0c5
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x64c], 0xd0ee
mov dword [ebp - 4], 0
jmp 0x42b413
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x42b42c
push dword [ebp - 4]
lea ecx, [ebp - 0x1d0]
call fcn.0042f1b3
or dword [eax], 0xffffffff
jmp 0x42b40c
mov dword [ebp - 4], 0
jmp 0x42b43c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x42b458
push dword [ebp - 4]
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
mov dword [eax], 0xfffffff7
jmp 0x42b435
mov dword [ebp - 4], 0
jmp 0x42b468
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x42b47e
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x698], 0x46aa1dd5
jmp 0x42b461
push 0
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
and dword [eax], 0
jmp 0x42b4b4
push 0
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x210]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
cmp dword [eax], 0
jl 0x42b793
mov dword [ebp - 0x60], 1
mov dword [ebp - 0x6a0], 7
mov dword [ebp - 0x140], 0
jmp 0x42b4f4
mov eax, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 3
jge 0x42b510
mov eax, dword [ebp - 0x140]
mov dword [ebp + eax*4 - 0x83c], 1
jmp 0x42b4e7
mov dword [ebp - 0x60], 0
jmp 0x42b520
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jg 0x42b741
mov dword [ebp - 0x520], 0xfffffff6
push 0
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
push dword [eax]
lea ecx, [ebp - 0x1d0]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x60]
cmp dword [eax], ecx
jl 0x42b561
mov dword [ebp - 0x218], 1
jmp 0x42b568
and dword [ebp - 0x218], 0
push 0
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
push dword [eax]
lea ecx, [ebp - 0x1d0]
call fcn.0042f1b3
cmp dword [eax], 0xfffffffd
jg 0x42b593
mov dword [ebp - 0x510], 1
jmp 0x42b59a
and dword [ebp - 0x510], 0
mov eax, 0xc28cae2f
sub eax, dword [ebp - 0x60]
cmp eax, 1
jbe 0x42b5b3
mov dword [ebp - 0x330], 1
jmp 0x42b5ba
and dword [ebp - 0x330], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x330], eax
jge 0x42b5e4
push 0
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
push dword [eax]
lea ecx, [ebp - 0x1d0]
call fcn.0042f1b3
cmp dword [eax], 0
je 0x42b60f
push 0
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
push dword [eax]
lea ecx, [ebp - 0x1d0]
call fcn.0042f1b3
cmp dword [eax], 0
je 0x42b60f
mov dword [ebp - 0x518], 1
jmp 0x42b616
and dword [ebp - 0x518], 0
push 1
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
mov dword [ebp - 0x38], 0x1213
mov esi, dword [ebp - 0x38]
push 0
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
push dword [eax]
lea ecx, [ebp - 0x1d0]
call fcn.0042f1b3
cmp dword [eax], esi
jg 0x42b657
mov dword [ebp - 0x3c0], 1
jmp 0x42b65e
and dword [ebp - 0x3c0], 0
mov eax, dword [ebp - 0x218]
cmp eax, dword [ebp - 0x3c0]
jle 0x42b697
push 0
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
push dword [eax]
lea ecx, [ebp - 0x1d0]
call fcn.0042f1b3
cmp dword [eax], 0
je 0x42b697
mov dword [ebp - 0x220], 1
jmp 0x42b69e
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x520], eax
push 0
lea ecx, [ebp - 0x160]
call fcn.0042f1b3
push dword [eax]
lea ecx, [ebp - 0x1d0]
call fcn.0042f1b3
cmp dword [eax], 0
je 0x42b72c
push 0
lea ecx, [ebp - 0x1d0]
call fcn.0042f1b3
cmp dword [eax], 0
je 0x42b72c
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x38], eax
jle 0x42b6fb
mov dword [ebp - 0x338], 1
jmp 0x42b702
and dword [ebp - 0x338], 0
mov dword [ebp - 0x108], 0xed09eb81
mov eax, dword [ebp - 0x108]
cmp dword [ebp - 0x338], eax
jl 0x42b720
cmp dword [ebp - 0x38], 0
je 0x42b72c
mov dword [ebp - 0x228], 1
jmp 0x42b733
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x228]
mov dword [ebp - 0x38], eax
jmp 0x42b519
mov dword [ebp - 0x38], 0
jmp 0x42b751
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0xffffffef
jne 0x42b78e
mov dword [ebp - 0x6a8], 0xc53d8b3d
mov dword [ebp - 0x6b0], 0x29b4ccc
mov dword [ebp - 0x6b8], 0x7cb0be94
mov dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x40c]
inc eax
mov dword [ebp - 0x40c], eax
jmp 0x42b74a
jmp 0x42b490
mov byte [ebp - 0x7a], 0
movzx eax, byte [ebp - 0x7a]
test eax, eax
je 0x42b7c3
push 0xa01
push 0
push 0
push 0x14e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
lea ecx, [ebp - 0x160]
call fcn.0042f197
lea ecx, [ebp - 0x1d0]
call fcn.0042f197
mov dword [ebp - 0xb4], 0xb733c633
mov dword [ebp - 0x538], 0x89a5
push 2
lea ecx, [ebp - 0x5fc]
call fcn.0042f0c5
mov dword [ebp - 0x6c0], 0xffffffff
mov dword [ebp - 0x130], 0
jmp 0x42b81d
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 2
jge 0x42b83f
push dword [ebp - 0x130]
lea ecx, [ebp - 0x5fc]
call fcn.0042f1b3
mov dword [eax], 1
jmp 0x42b810
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xb4], eax
jle 0x42b859
mov dword [ebp - 0x528], 1
jmp 0x42b860
and dword [ebp - 0x528], 0
cmp dword [ebp - 0xb4], 0xffffffff
ja 0x42b875
mov dword [ebp - 0x230], 1
jmp 0x42b87c
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0xb4]
cmp eax, dword [ebp - 0x230]
jl 0x42b896
mov dword [ebp - 0x340], 1
jmp 0x42b89d
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0x340], eax
jge 0x42b8b7
mov dword [ebp - 0x530], 1
jmp 0x42b8be
and dword [ebp - 0x530], 0
cmp dword [ebp - 0xb4], 0xffffffff
je 0x42b8d3
mov dword [ebp - 0x238], 1
jmp 0x42b8da
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x538]
cmp dword [ebp - 0x238], eax
jg 0x42b8f4
mov dword [ebp - 0x1c0], 1
jmp 0x42b8fb
and dword [ebp - 0x1c0], 0
push 1
lea ecx, [ebp - 0x5fc]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x1c0]
mov dword [eax], ecx
cmp dword [ebp - 0x1c0], 0
je 0x42b932
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x42b930
push 0x1542
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x42b962
mov byte [ebp - 0x80], 0
movzx eax, byte [ebp - 0x80]
test eax, eax
je 0x42b962
push 0xa01
push 0
push 0
push 0x14e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
lea ecx, [ebp - 0x5fc]
call fcn.0042f197
mov dword [ebp - 0x54], 8
mov dword [ebp - 0x540], 0xfffffffc
mov dword [ebp - 0x1c4], 0x42c78ef8
mov dword [ebp - 0x56c], 0xf4d4e209
mov dword [ebp - 0x110], 0
jmp 0x42b9ab
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 4
jge 0x42b9c7
mov eax, dword [ebp - 0x110]
mov dword [ebp + eax*4 - 0x7f4], 0
jmp 0x42b99e
mov dword [ebp - 0x54], 0
jmp 0x42b9d7
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x14
jle 0x42b9e8
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x540], eax
jmp 0x42b9d0
mov dword [ebp - 0x54], 0
jmp 0x42b9f8
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffe2
jle 0x42bbc3
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x6c8], 0x662db8e9
mov dword [ebp - 0x6d0], 0xfffffff9
mov dword [ebp - 0x6d8], 0xfffffffe
mov dword [ebp - 0x6e0], 0x5245f5b1
mov dword [ebp - 0x6e8], 0
mov dword [ebp - 0x548], 0xffffffff
mov dword [ebp - 0x6f0], 6
mov dword [ebp - 0x6f8], 0xd5493e6
mov dword [ebp - 0x700], 0x9ba87a5
mov dword [ebp - 0x708], 0xd1cb6a7f
mov dword [ebp - 0x490], 0xffffffff
mov dword [ebp - 0x4e4], 9
mov dword [ebp - 0x40], 0
jmp 0x42ba94
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x42baaa
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x800], 0xe13f5e3d
jmp 0x42ba8d
mov dword [ebp - 0x40], 0
jmp 0x42baba
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x42bad0
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x84c], 0
jmp 0x42bab3
mov eax, dword [ebp - 0x1c4]
dec eax
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 0x548]
cmp dword [ebp - 0x1c4], eax
jg 0x42baf7
mov dword [ebp - 0x3c8], 1
jmp 0x42bafe
and dword [ebp - 0x3c8], 0
mov dword [ebp - 0x240], 5
imul eax, dword [ebp - 0x3c8], 0
mov ecx, dword [ebp - 0x240]
imul ecx, eax
mov dword [ebp - 0x348], ecx
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x348]
mov dword [ebp + eax - 0x7f4], ecx
cmp dword [ebp - 0x348], 0
je 0x42bb7b
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x7f4]
cmp dword [ebp - 0x56c], eax
jle 0x42bb5a
mov dword [ebp - 0x248], 1
jmp 0x42bb61
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x490]
cmp eax, dword [ebp - 0x248]
jl 0x42bb7b
mov dword [ebp - 0x438], 1
jmp 0x42bb82
and dword [ebp - 0x438], 0
imul eax, dword [ebp - 0x438], 0x116e
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x800]
cmp eax, 0xffffffff
ja 0x42bbab
mov dword [ebp - 0x250], 1
jmp 0x42bbb2
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x250]
mov dword [ebp - 0x4e4], eax
jmp 0x42b9f1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x710], 7
mov dword [ebp - 0x718], 0x439beb06
mov dword [ebp - 0x720], 1
mov dword [ebp - 0x728], 1
mov dword [ebp - 0x730], 1
push 2
lea ecx, [ebp - 0x750]
call fcn.0042f0c5
mov dword [ebp - 0x7bc], 0
mov dword [ebp - 0x350], 0x3c67ee39
mov dword [ebp - 0x150], 0
jmp 0x42bc38
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x42bc5a
push dword [ebp - 0x150]
lea ecx, [ebp - 0x750]
call fcn.0042f1b3
mov dword [eax], 0xae77ab39
jmp 0x42bc2b
mov eax, dword [ebp - 0x350]
dec eax
mov dword [ebp - 0x350], eax
lea ecx, [ebp - 0x750]
call fcn.0042f197
mov eax, dword [ebp - 0x184]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x42c25d
push 1
lea ecx, [ebp - 0x450]
call fcn.0042f0c5
mov dword [ebp - 0x4b4], 5
mov dword [ebp - 0x28], 0
jmp 0x42bcad
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x42bcc3
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x408], 0xf9b3
jmp 0x42bca6
mov dword [ebp - 0x28], 0
jmp 0x42bcd3
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x42bcef
push dword [ebp - 0x28]
lea ecx, [ebp - 0x450]
call fcn.0042f1b3
mov dword [eax], 1
jmp 0x42bccc
push 0
lea ecx, [ebp - 0x450]
call fcn.0042f1b3
mov dword [eax], 1
jmp 0x42bd28
push 0
lea ecx, [ebp - 0x450]
call fcn.0042f1b3
mov dword [ebp - 0x258], eax
mov eax, dword [ebp - 0x258]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x258]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x450]
call fcn.0042f1b3
cmp dword [eax], 0
jl 0x42c085
mov dword [ebp - 0x18], 0xfffffffa
push 1
lea ecx, [ebp - 0x62c]
call fcn.0042f0c5
push 4
lea ecx, [ebp - 0x614]
call fcn.0042f0c5
mov dword [ebp - 0x48], 0
jmp 0x42bd6f
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x42bd88
push dword [ebp - 0x48]
lea ecx, [ebp - 0x62c]
call fcn.0042f1b3
and dword [eax], 0
jmp 0x42bd68
mov dword [ebp - 0x48], 0
jmp 0x42bd98
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 4
jge 0x42bdb4
push dword [ebp - 0x48]
lea ecx, [ebp - 0x614]
call fcn.0042f1b3
mov dword [eax], 0xa907865e
jmp 0x42bd91
mov dword [ebp - 0x18], 1
jmp 0x42bdc4
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x42c06a
mov dword [ebp - 0x98], 7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x408], 0xfffffffa
push 0
lea ecx, [ebp - 0x450]
call fcn.0042f1b3
cmp dword [eax], 0xfffffffa
jne 0x42be04
mov dword [ebp - 0x260], 1
jmp 0x42be0b
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x7c4], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jg 0x42be28
mov dword [ebp - 0x3d0], 1
jmp 0x42be2f
and dword [ebp - 0x3d0], 0
push 0
lea ecx, [ebp - 0x450]
call fcn.0042f1b3
mov eax, dword [eax]
cmp eax, dword [ebp - 0x3d0]
jg 0x42be52
mov dword [ebp - 0x358], 1
jmp 0x42be59
and dword [ebp - 0x358], 0
mov eax, dword [ebp - 0x260]
sub eax, dword [ebp - 0x358]
cmp eax, dword [ebp - 0x98]
jle 0x42bfd5
push 2
lea ecx, [ebp - 0x620]
call fcn.0042f0c5
mov dword [ebp - 0x7e0], 0xc023
mov dword [ebp - 0x118], 0
jmp 0x42bea1
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 2
jge 0x42bec3
push dword [ebp - 0x118]
lea ecx, [ebp - 0x620]
call fcn.0042f1b3
mov dword [eax], 0x10af
jmp 0x42be94
mov esi, dword [ebp - 0x18]
push 1
lea ecx, [ebp - 0x620]
call fcn.0042f1b3
cmp esi, dword [eax]
jne 0x42bee3
mov dword [ebp - 0x268], 1
jmp 0x42beea
and dword [ebp - 0x268], 0
push 4
pop eax
shl eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x408]
cmp dword [ebp - 0x268], ecx
jg 0x42bf0e
mov dword [ebp - 0x414], 1
jmp 0x42bf15
and dword [ebp - 0x414], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x408]
cmp eax, dword [ebp - 0x414]
jge 0x42bf36
mov dword [ebp - 0x270], 1
jmp 0x42bf3d
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x408]
cmp dword [ebp - 0x270], eax
jne 0x42bf5b
mov dword [ebp - 0x188], 1
jmp 0x42bf62
and dword [ebp - 0x188], 0
push 1
lea ecx, [ebp - 0x614]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x188]
mov dword [eax], ecx
cmp dword [ebp - 0x188], 0
je 0x42bf90
xor eax, eax
je 0x42bf90
mov dword [ebp - 0x360], 1
jmp 0x42bf97
and dword [ebp - 0x360], 0
mov eax, dword [ebp - 0x360]
mov dword [ebp - 0x98], eax
mov byte [ebp - 0x7e], 0
movzx eax, byte [ebp - 0x7e]
test eax, eax
je 0x42bfc5
push 1
push 0
push 0xcd2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
lea ecx, [ebp - 0x620]
call fcn.0042f197
jmp 0x42c055
mov dword [ebp - 0x278], 0xfffffff7
mov dword [ebp - 0x98], 0
jmp 0x42bff8
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 6
jle 0x42c055
mov dword [ebp - 0xbc], 0x85b3d925
mov dword [ebp - 0xbc], 0
jmp 0x42c024
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x42c046
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x62c]
call fcn.0042f1b3
mov dword [eax], 0xc095b676
jmp 0x42c017
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
jmp 0x42bfeb
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x408]
mov dword [ebp - 0x4b4], eax
jmp 0x42bdbd
lea ecx, [ebp - 0x614]
call fcn.0042f197
lea ecx, [ebp - 0x62c]
call fcn.0042f197
jmp 0x42bd04
lea ecx, [ebp - 0x450]
call fcn.0042f197
mov dword [ebp - 0xe4], 1
mov dword [ebp - 0xa0], 0xd832937a
push 3
lea ecx, [ebp - 0x5f0]
call fcn.0042f0c5
mov dword [ebp - 0x58], 0
jmp 0x42c0c1
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x42c0d7
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x80c], 0
jmp 0x42c0ba
mov dword [ebp - 0x58], 0
jmp 0x42c0e7
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x42c103
push dword [ebp - 0x58]
lea ecx, [ebp - 0x5f0]
call fcn.0042f1b3
mov dword [eax], 0xfffffffa
jmp 0x42c0e0
mov dword [ebp - 0xe4], 0
jmp 0x42c11c
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jg 0x42c24b
mov dword [ebp - 0x1a8], 0xc60e
mov dword [ebp - 0x368], 0x71c097bc
mov dword [ebp - 0xa0], 9
cmp dword [ebp - 0x1a8], 0x5f4e
jl 0x42c15f
mov dword [ebp - 0x3d8], 1
jmp 0x42c166
and dword [ebp - 0x3d8], 0
cmp dword [ebp - 0x3d8], 1
jle 0x42c17b
mov dword [ebp - 0x280], 1
jmp 0x42c182
and dword [ebp - 0x280], 0
mov eax, dword [ebp - 0x280]
sub eax, 0x711e2ef
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x1a8]
jne 0x42c1c8
cmp dword [ebp - 0xa0], 0
jne 0x42c1c8
cmp dword [ebp - 0xa0], 0
jne 0x42c1c8
and dword [ebp - 0x500], 0
jmp 0x42c1d2
mov dword [ebp - 0x500], 1
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x7dc], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x67c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x80c]
cmp dword [ebp - 0xa0], eax
jl 0x42c20b
mov dword [ebp - 0x288], 1
jmp 0x42c212
and dword [ebp - 0x288], 0
cmp dword [ebp - 0x288], 0xad72
jge 0x42c22a
mov dword [ebp - 0x430], 1
jmp 0x42c231
and dword [ebp - 0x430], 0
push 0
lea ecx, [ebp - 0x5f0]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x430]
mov dword [eax], ecx
jmp 0x42c10f
lea ecx, [ebp - 0x5f0]
call fcn.0042f197
xor eax, eax
jmp 0x42e76f
mov eax, dword [ebp - 0x184]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xd0], ecx
mov dword [ebp - 0xcc], 0
push 2
lea ecx, [ebp - 0x45c]
call fcn.0042f0c5
mov dword [ebp - 0x138], 0
jmp 0x42c29f
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x42c2c1
push dword [ebp - 0x138]
lea ecx, [ebp - 0x45c]
call fcn.0042f1b3
mov dword [eax], 0xbacd
jmp 0x42c292
mov dword [ebp - 0xcc], 0x13
jmp 0x42c2da
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0xfffffffd
jg 0x42c4fa
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x498], 6
mov byte [ebp - 0x6f], 0
movzx eax, byte [ebp - 0x6f]
test eax, eax
je 0x42c30c
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x2c], 1
jmp 0x42c31c
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x42c4f5
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0
jmp 0x42c33d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x42c4c5
mov dword [ebp - 0x504], 1
cmp dword [ebp - 0xcc], 0xab97
jle 0x42c369
mov dword [ebp - 0x290], 1
jmp 0x42c370
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x290]
je 0x42c387
mov dword [ebp - 0x370], 1
jmp 0x42c38e
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x370]
cmp eax, 1
je 0x42c3ae
cmp dword [ebp - 0x14], 0
je 0x42c3ae
mov dword [ebp - 0x298], 1
jmp 0x42c3b5
and dword [ebp - 0x298], 0
push 1
lea ecx, [ebp - 0x45c]
call fcn.0042f1b3
mov esi, dword [ebp - 0x298]
sub esi, dword [eax]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x45c]
call fcn.0042f1b3
cmp esi, dword [eax]
je 0x42c3e8
mov dword [ebp - 0x3e0], 1
jmp 0x42c3ef
and dword [ebp - 0x3e0], 0
cmp dword [ebp - 0x3e0], 0xc33c
jle 0x42c407
mov dword [ebp - 0x2a0], 1
jmp 0x42c40e
and dword [ebp - 0x2a0], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x45c]
call fcn.0042f1b3
mov esi, dword [eax]
sub esi, dword [ebp - 0x2a0]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x45c]
call fcn.0042f1b3
cmp esi, dword [eax]
jne 0x42c442
mov dword [ebp - 0x378], 1
jmp 0x42c449
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x498]
cmp dword [ebp - 0x378], eax
jge 0x42c463
mov dword [ebp - 0x2a8], 1
jmp 0x42c46a
and dword [ebp - 0x2a8], 0
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x45c]
call fcn.0042f1b3
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2a8]
jge 0x42c48e
mov dword [ebp - 0x41c], 1
jmp 0x42c495
and dword [ebp - 0x41c], 0
cmp dword [ebp - 0x41c], 0x278
jle 0x42c4ad
mov dword [ebp - 0x2b0], 1
jmp 0x42c4b4
and dword [ebp - 0x2b0], 0
mov eax, dword [ebp - 0x2b0]
mov dword [ebp - 0x504], eax
jmp 0x42c336
mov dword [ebp - 0x14], 1
jmp 0x42c4d5
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jl 0x42c4f0
mov dword [ebp - 0x4a0], 0x622b
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4a0], eax
jmp 0x42c4ce
jmp 0x42c315
jmp 0x42c2cd
lea ecx, [ebp - 0x45c]
call fcn.0042f197
mov eax, dword [ebp - 0xd0]
cmp dword [eax], 0x4550
je 0x42cc65
mov dword [ebp - 0x3c], 0xbeb0647d
mov dword [ebp - 0xa8], 0x2733
mov dword [ebp - 0x2c0], 0
mov dword [ebp - 0x2d0], 0xffffffff
mov dword [ebp - 0x34], 0
jmp 0x42c54c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x42c562
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x484], 0x921ded68
jmp 0x42c545
mov dword [ebp - 0x34], 0
jmp 0x42c572
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jge 0x42c588
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x50c], 0xfffffffa
jmp 0x42c56b
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x380], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x380]
mov dword [ebp + eax - 0x484], ecx
cmp dword [ebp - 0x380], 0
jne 0x42c5bf
mov eax, 0x5950707d
test eax, eax
jne 0x42c5bf
and dword [ebp - 0x2d8], 0
jmp 0x42c5c9
mov dword [ebp - 0x2d8], 1
cmp dword [ebp - 0xa8], 0
jne 0x42c5e1
cmp dword [ebp - 0x3c], 0
jne 0x42c5e1
and dword [ebp - 0x2b8], 0
jmp 0x42c5eb
mov dword [ebp - 0x2b8], 1
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x2b8], eax
jne 0x42c605
mov dword [ebp - 0x3e8], 1
jmp 0x42c60c
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3e8], eax
jg 0x42c626
cmp dword [ebp - 0x3c], 0
jne 0x42c626
and dword [ebp - 0x4a8], 0
jmp 0x42c630
mov dword [ebp - 0x4a8], 1
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x638], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c0], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x2c0], eax
jl 0x42c65c
mov dword [ebp - 0x388], 1
jmp 0x42c663
and dword [ebp - 0x388], 0
cmp dword [ebp - 0x388], 0x11f3
jle 0x42c67b
mov dword [ebp - 0x2c8], 1
jmp 0x42c682
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x2c8], eax
je 0x42c699
mov dword [ebp - 0x434], 1
jmp 0x42c6a0
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
cmp dword [ebp - 0xa8], eax
jg 0x42c6c6
mov dword [ebp - 0x390], 1
jmp 0x42c6cd
and dword [ebp - 0x390], 0
mov eax, dword [ebp - 0x390]
sub eax, dword [ebp - 0xa8]
cmp eax, dword [ebp - 0x3c]
jl 0x42c6ea
mov dword [ebp - 0x3f0], 1
jmp 0x42c6f1
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x2d8]
cmp eax, dword [ebp - 0x3f0]
jg 0x42c70b
mov dword [ebp - 0x2e0], 1
jmp 0x42c712
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x2e0], eax
jne 0x42c72c
mov dword [ebp - 0x398], 1
jmp 0x42c733
and dword [ebp - 0x398], 0
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x398]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x50c], eax
mov dword [ebp - 0xec], 0
mov dword [ebp - 0x190], 0xf7b1466a
push 1
lea ecx, [ebp - 0x568]
call fcn.0042f0c5
mov dword [ebp - 0x1d8], 0xfffffffb
mov dword [ebp - 0x514], 0x8ca9
mov dword [ebp - 0x44], 0
jmp 0x42c78f
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 4
jge 0x42c7a5
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1e8], 2
jmp 0x42c788
mov dword [ebp - 0x44], 0
jmp 0x42c7b5
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x42c7ce
push dword [ebp - 0x44]
lea ecx, [ebp - 0x568]
call fcn.0042f1b3
and dword [eax], 0
jmp 0x42c7ae
mov byte [ebp - 0x7f], 0
movzx eax, byte [ebp - 0x7f]
test eax, eax
je 0x42c7e9
push 0
push 0
push 0x1d37
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x1e8], 0xb
jmp 0x42c814
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e8]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1e8], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1e8], 0xfffffff6
je 0x42cc53
mov dword [ebp - 0x94], 1
mov dword [ebp - 0xdc], 0xe4ddbb7a
mov dword [ebp - 0x1bc], 0xfffffffc
mov dword [ebp - 0x120], 0
jmp 0x42c85e
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 2
jge 0x42c87a
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x1b8], 0x6a530863
jmp 0x42c851
xor eax, eax
jne 0x42ca70
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b8]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1b8], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x784], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b8]
mov dword [ebp - 0x640], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1e8]
mov dword [ebp - 0x70c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1e8]
cmp dword [ebp - 0x190], eax
jle 0x42c8f0
mov dword [ebp - 0x2e8], 1
jmp 0x42c8f7
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0
je 0x42c91a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1e8], 0
mov eax, dword [ebp - 0xec]
neg eax
test eax, eax
jle 0x42c932
mov dword [ebp - 0x42c], 1
jmp 0x42c939
and dword [ebp - 0x42c], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x42c]
add ecx, dword [ebp + eax - 0x1e8]
mov dword [ebp - 0x4b0], ecx
push 0
lea ecx, [ebp - 0x568]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x4b0]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1e8], 0
je 0x42c993
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1b8], 0
je 0x42c993
mov dword [ebp - 0x2f0], 1
jmp 0x42c99a
and dword [ebp - 0x2f0], 0
cmp dword [ebp - 0x2f0], 0x9e96
jle 0x42c9bf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1b8], 0
jne 0x42c9bf
and dword [ebp - 0x3a0], 0
jmp 0x42c9c9
mov dword [ebp - 0x3a0], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e8]
cmp dword [ebp - 0x3a0], eax
jge 0x42c9e9
mov dword [ebp - 0x2f8], 1
jmp 0x42c9f0
and dword [ebp - 0x2f8], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x2f8], eax
jge 0x42ca0a
mov dword [ebp - 0x3f8], 1
jmp 0x42ca11
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0xe2ff
jg 0x42ca29
mov dword [ebp - 0x300], 1
jmp 0x42ca30
and dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x300], eax
jl 0x42ca4a
mov dword [ebp - 0x3a8], 1
jmp 0x42ca51
and dword [ebp - 0x3a8], 0
mov eax, dword [ebp - 0x3a8]
mov dword [ebp - 0x94], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1b8]
sub eax, dword [ebp - 0xdc]
push 0
lea ecx, [ebp - 0x568]
call fcn.0042f1b3
cmp dword [eax], 0x49a5
jl 0x42ca91
mov dword [ebp - 0x308], 1
jmp 0x42ca98
and dword [ebp - 0x308], 0
mov eax, dword [ebp - 0xdc]
imul eax, dword [ebp - 0x308]
test eax, eax
jne 0x42cabb
cmp dword [ebp - 0xdc], 0
jne 0x42cabb
and dword [ebp - 0x53c], 0
jmp 0x42cac5
mov dword [ebp - 0x53c], 1
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x648], eax
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x7c0], eax
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x650], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1e8]
cmp dword [ebp - 0x1bc], eax
jle 0x42cb15
mov dword [ebp - 0x43c], 1
jmp 0x42cb1c
and dword [ebp - 0x43c], 0
cmp dword [ebp - 0x43c], 0xffffffff
jg 0x42cb31
mov dword [ebp - 0x310], 1
jmp 0x42cb38
and dword [ebp - 0x310], 0
cmp dword [ebp - 0x310], 0x3c91
je 0x42cb50
mov dword [ebp - 0x3b0], 1
jmp 0x42cb57
and dword [ebp - 0x3b0], 0
mov eax, dword [ebp - 0x190]
cmp eax, dword [ebp - 0x3b0]
jl 0x42cb71
mov dword [ebp - 0x318], 1
jmp 0x42cb78
and dword [ebp - 0x318], 0
push 0
lea ecx, [ebp - 0x568]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x318]
sub ecx, dword [eax]
jne 0x42cb9b
mov dword [ebp - 0x1ec], 1
jmp 0x42cba2
and dword [ebp - 0x1ec], 0
mov eax, dword [ebp - 0x1d8]
neg eax
cmp eax, dword [ebp - 0x1ec]
jg 0x42cbc4
cmp dword [ebp - 0x94], 0
jne 0x42cbc4
and dword [ebp - 0x1f4], 0
jmp 0x42cbce
mov dword [ebp - 0x1f4], 1
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1f4], eax
jle 0x42cbe8
mov dword [ebp - 0x1fc], 1
jmp 0x42cbef
and dword [ebp - 0x1fc], 0
cmp dword [ebp - 0x1fc], 0xff24264a
jbe 0x42cc07
mov dword [ebp - 0x204], 1
jmp 0x42cc0e
and dword [ebp - 0x204], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1b8]
cmp dword [ebp - 0x204], eax
jge 0x42cc2f
mov dword [ebp - 0x4b8], 1
jmp 0x42cc36
and dword [ebp - 0x4b8], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x714], eax
mov eax, dword [ebp - 0x514]
mov dword [ebp - 0xec], eax
jmp 0x42c7fb
lea ecx, [ebp - 0x568]
call fcn.0042f197
xor eax, eax
jmp 0x42e76f
mov dword [ebp - 0x214], 0xfffffffa
mov dword [ebp - 0x24c], 8
mov dword [ebp - 0x148], 0
jmp 0x42cc92
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x42ccae
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x178], 0x2c03342e
jmp 0x42cc85
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x178], 0xffffffef
jmp 0x42ccdc
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x178], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 0xffffffe3
jle 0x42cf24
mov dword [ebp - 0xd4], 0xfffffffc
mov dword [ebp - 0x4c8], 0
mov dword [ebp - 0x128], 0
jmp 0x42cd1d
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x42cd39
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0xfc], 0x68f62c4d
jmp 0x42cd10
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 0
je 0x42cd5a
xor eax, eax
inc eax
je 0x42cd5a
mov dword [ebp - 0x20c], 1
jmp 0x42cd61
and dword [ebp - 0x20c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
cmp eax, dword [ebp - 0x20c]
jle 0x42cd82
mov dword [ebp - 0x4c0], 1
jmp 0x42cd89
and dword [ebp - 0x4c0], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xfc], 0xfff9
jne 0x42cda8
mov dword [ebp - 0x21c], 1
jmp 0x42cdaf
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
sub eax, dword [ebp - 0x21c]
cmp eax, dword [ebp - 0xd4]
jle 0x42cddb
mov dword [ebp - 0x224], 1
jmp 0x42cde2
and dword [ebp - 0x224], 0
mov eax, dword [ebp - 0xd4]
cmp dword [ebp - 0x224], eax
jne 0x42cdfc
mov dword [ebp - 0x22c], 1
jmp 0x42ce03
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0xd4]
imul eax, dword [ebp - 0x22c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xfc]
jne 0x42ce2b
mov dword [ebp - 0x234], 1
jmp 0x42ce32
and dword [ebp - 0x234], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
add eax, dword [ebp - 0x234]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x178]
jg 0x42ce60
mov dword [ebp - 0x23c], 1
jmp 0x42ce67
and dword [ebp - 0x23c], 0
cmp dword [ebp - 0x23c], 0xec1fcc8a
jne 0x42ce7f
mov dword [ebp - 0x244], 1
jmp 0x42ce86
and dword [ebp - 0x244], 0
cmp dword [ebp - 0x244], 1
jge 0x42ce9b
mov dword [ebp - 0x55c], 1
jmp 0x42cea2
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x24c]
mov dword [ebp - 0x65c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x65ab
sub ecx, dword [ebp + eax - 0xfc]
push 4
pop eax
imul eax, eax, 0
cmp ecx, dword [ebp + eax - 0xfc]
jg 0x42cedb
mov dword [ebp - 0x254], 1
jmp 0x42cee2
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x24c]
cmp dword [ebp - 0x254], eax
je 0x42cf09
push 3
pop eax
test eax, eax
jne 0x42cf09
cmp dword [ebp - 0xd4], 0
jne 0x42cf09
and dword [ebp - 0x25c], 0
jmp 0x42cf13
mov dword [ebp - 0x25c], 1
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x4c8], eax
jmp 0x42ccc1
mov byte [ebp - 0x71], 0
movzx eax, byte [ebp - 0x71]
test eax, eax
je 0x42cf46
push 0
push 0
push 0x14a
push 0x2359
push 0
call dword [sym.imp.USER32.dll_InsertMenuA]
push dword [ebp - 0xd0]
push 1
push 1
push 0x296b
push 0x3b34
lea eax, [ebp - 0x100]
push eax
push 0x4c
push 1
call fcn.00420867
add esp, 0x20
mov dword [ebp - 0xb0], 1
mov dword [ebp - 0x170], 0x888999d9
mov dword [ebp - 0x16c], 0x888999d9
mov dword [ebp - 0x168], 0x888999d9
mov dword [ebp - 0x164], 0x888999d9
mov dword [ebp - 0x284], 0x4af7bdd4
mov dword [ebp - 0x2ac], 0xa6b2
mov dword [ebp - 0x51c], 0
mov dword [ebp - 0x678], 1
mov dword [ebp - 0x4d0], 0xfffffff8
mov byte [ebp - 0x7b], 0
movzx eax, byte [ebp - 0x7b]
test eax, eax
je 0x42cfe3
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x170], 0
je 0x42d004
xor eax, eax
inc eax
je 0x42d004
mov dword [ebp - 0x264], 1
jmp 0x42d00b
and dword [ebp - 0x264], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
imul eax, dword [ebp - 0x264]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x170]
jg 0x42d039
mov dword [ebp - 0x26c], 1
jmp 0x42d040
and dword [ebp - 0x26c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x26c], eax
jne 0x42d063
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x170], 0
cmp dword [ebp - 0xb0], 0xf5537c57
jbe 0x42d07b
mov dword [ebp - 0x274], 1
jmp 0x42d082
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x274], eax
jne 0x42d09c
mov dword [ebp - 0x27c], 1
jmp 0x42d0a3
and dword [ebp - 0x27c], 0
mov eax, dword [ebp - 0x27c]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x284], eax
je 0x42d0c9
mov dword [ebp - 0x28c], 1
jmp 0x42d0d0
and dword [ebp - 0x28c], 0
cmp dword [ebp - 0x28c], 2
jle 0x42d0e9
push 5
pop eax
test eax, eax
jne 0x42d0e9
and dword [ebp - 0x294], 0
jmp 0x42d0f3
mov dword [ebp - 0x294], 1
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x294], eax
jne 0x42d116
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x170], 0
mov eax, dword [ebp - 0x2ac]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x170]
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x170]
jne 0x42d144
mov dword [ebp - 0x1d4], 1
jmp 0x42d14b
and dword [ebp - 0x1d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp eax, dword [ebp - 0x1d4]
je 0x42d16c
mov dword [ebp - 0x198], 1
jmp 0x42d173
and dword [ebp - 0x198], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x198]
mov dword [ebp + eax - 0x170], ecx
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x198], eax
je 0x42d1a0
mov dword [ebp - 0x2a4], 1
jmp 0x42d1a7
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x2a4]
sub eax, dword [ebp - 0x2ac]
jne 0x42d1cd
cmp dword [ebp - 0xb0], 0
jne 0x42d1cd
and dword [ebp - 0x2b4], 0
jmp 0x42d1d7
mov dword [ebp - 0x2b4], 1
mov eax, dword [ebp - 0x2b4]
sub eax, dword [ebp - 0x51c]
je 0x42d2d7
mov dword [ebp - 0x1b0], 0xffffffff
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x2cc], 0x74f98987
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x1b0]
inc ecx
imul ecx, dword [ebp - 0x1b0]
sub eax, ecx
cmp eax, dword [ebp - 0x4d0]
jle 0x42d231
mov dword [ebp - 0x2bc], 1
jmp 0x42d238
and dword [ebp - 0x2bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
cmp dword [ebp - 0x2bc], eax
jl 0x42d259
mov dword [ebp - 0x2c4], 1
jmp 0x42d260
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x1a0]
cmp dword [ebp - 0x2c4], eax
jl 0x42d27a
mov dword [ebp - 0x544], 1
jmp 0x42d281
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x668], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x170], 0
jae 0x42d2a9
mov dword [ebp - 0x4d8], 1
jmp 0x42d2b0
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x2cc]
mov dword [ebp - 0x680], eax
mov eax, dword [ebp - 0x1a0]
sub eax, dword [ebp - 0x2cc]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x170], eax
jmp 0x42d2ff
mov byte [ebp - 0x73], 0
movzx eax, byte [ebp - 0x73]
test eax, eax
je 0x42d2ff
push 0x709
push 0x11d8
push 0x4f6
push 0x204d
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp dword [ebp - 0x100], 0
jne 0x42d73b
or dword [ebp - 0x5cc], 0xffffffff
or dword [ebp - 0x5c8], 0xffffffff
or dword [ebp - 0x5c4], 0xffffffff
or dword [ebp - 0x5c0], 0xffffffff
lea ecx, [ebp - 0x1a9]
call fcn.0042f1c2
push eax
lea eax, [ebp - 0x5bc]
push eax
lea eax, [ebp - 0x5cc]
push eax
lea ecx, [ebp - 0x820]
call fcn.0042f1c5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x780]
call fcn.0042f171
mov dword [ebp - 0x10c], 1
push 2
lea ecx, [ebp - 0x770]
call fcn.0042f0c5
mov dword [ebp - 0x2d4], 0x65ee
mov dword [ebp - 0xf8], 0
jmp 0x42d397
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 2
jge 0x42d3b9
push dword [ebp - 0xf8]
lea ecx, [ebp - 0x770]
call fcn.0042f1b3
mov dword [eax], 0xc25f
jmp 0x42d38a
mov dword [ebp - 0x10c], 3
jmp 0x42d3d2
mov eax, dword [ebp - 0x10c]
dec eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jl 0x42d501
mov dword [ebp - 0xc0], 0x2c7c8a6b
mov dword [ebp - 0x674], 0xfffffffc
mov dword [ebp - 0x688], 1
mov dword [ebp - 0x630], 0xb807cfaf
mov dword [ebp - 0x794], 0x996f377c
mov dword [ebp - 0x684], 0x5457d670
mov dword [ebp - 0x71c], 0x9017
mov dword [ebp - 0x68c], 0
mov dword [ebp - 0x7a8], 0xd1dc6b79
mov dword [ebp - 0x694], 0x3403ca95
mov dword [ebp - 0x724], 1
mov dword [ebp - 0x69c], 1
push 4
lea ecx, [ebp - 0x760]
call fcn.0042f0c5
mov dword [ebp - 0x7a4], 0xfec1
mov dword [ebp - 0x114], 0
jmp 0x42d487
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 4
jge 0x42d4a9
push dword [ebp - 0x114]
lea ecx, [ebp - 0x760]
call fcn.0042f1b3
mov dword [eax], 4
jmp 0x42d47a
mov dword [ebp - 0xc0], 0
jmp 0x42d4c2
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 4
jge 0x42d4e4
push dword [ebp - 0xc0]
lea ecx, [ebp - 0x780]
call fcn.0042f1b3
mov dword [eax], 1
jmp 0x42d4b5
mov eax, dword [ebp - 0x2d4]
dec eax
mov dword [ebp - 0x2d4], eax
lea ecx, [ebp - 0x760]
call fcn.0042f197
jmp 0x42d3c5
lea ecx, [ebp - 0x770]
call fcn.0042f197
lea ecx, [ebp - 0x780]
call fcn.0042f197
mov dword [ebp - 0x2dc], 0xffffffff
mov dword [ebp - 0x6a4], 0xfffffffb
mov dword [ebp - 0x52c], 0x8f3c34ee
push 4
lea ecx, [ebp - 0x468]
call fcn.0042f0c5
mov dword [ebp - 0x570], 0x5feaf86f
mov dword [ebp - 0x524], 3
mov dword [ebp - 0xb8], 0x8d08
mov dword [ebp - 0x4e8], 0xffffffff
mov dword [ebp - 0x11c], 0
jmp 0x42d583
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 4
jge 0x42d5a5
push dword [ebp - 0x11c]
lea ecx, [ebp - 0x468]
call fcn.0042f1b3
mov dword [eax], 0x365653d4
jmp 0x42d576
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
push 3
lea ecx, [ebp - 0x468]
call fcn.0042f1b3
cmp dword [eax], 0
je 0x42d6f8
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0x6ac], eax
cmp dword [ebp - 0x2dc], 0xdb2213aa
jb 0x42d5f8
mov dword [ebp - 0x4e0], 1
jmp 0x42d5ff
and dword [ebp - 0x4e0], 0
cmp dword [ebp - 0x2dc], 0xce6
jne 0x42d617
mov dword [ebp - 0x2e4], 1
jmp 0x42d61e
and dword [ebp - 0x2e4], 0
push 2
lea ecx, [ebp - 0x468]
call fcn.0042f1b3
mov eax, dword [eax]
cmp eax, dword [ebp - 0x2e4]
jg 0x42d641
mov dword [ebp - 0x2ec], 1
jmp 0x42d648
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x2ec], eax
jl 0x42d662
mov dword [ebp - 0x2f4], 1
jmp 0x42d669
and dword [ebp - 0x2f4], 0
mov eax, dword [ebp - 0x2f4]
sub eax, dword [ebp - 0x570]
neg eax
cmp eax, dword [ebp - 0xb8]
je 0x42d692
push 2
pop eax
test eax, eax
je 0x42d692
mov dword [ebp - 0x2fc], 1
jmp 0x42d699
and dword [ebp - 0x2fc], 0
cmp dword [ebp - 0x2fc], 6
je 0x42d6ae
mov dword [ebp - 0x304], 1
jmp 0x42d6b5
and dword [ebp - 0x304], 0
mov eax, dword [ebp - 0x304]
sub eax, 0x75a6804a
je 0x42d6d7
cmp dword [ebp - 0x4e8], 0
je 0x42d6d7
mov dword [ebp - 0x30c], 1
jmp 0x42d6de
and dword [ebp - 0x30c], 0
mov eax, dword [ebp - 0x30c]
sub eax, dword [ebp - 0xb8]
je 0x42d6f8
mov dword [ebp - 0x314], 1
jmp 0x42d6ff
and dword [ebp - 0x314], 0
push 3
lea ecx, [ebp - 0x468]
call fcn.0042f1b3
mov esi, dword [ebp - 0x314]
sub esi, dword [eax]
push 3
lea ecx, [ebp - 0x468]
call fcn.0042f1b3
add esi, dword [eax]
mov dword [ebp - 0x52c], esi
lea ecx, [ebp - 0x468]
call fcn.0042f197
xor eax, eax
jmp 0x42e76f
mov dword [ebp - 0x180], 1
mov dword [ebp - 0x4f0], 0x1f90
mov dword [ebp - 0x54c], 0x1188
mov dword [ebp - 0x4f8], 2
mov dword [ebp - 0x7d8], 0xe32
mov dword [ebp - 0x7d4], 0xe32
mov dword [ebp - 0x7d0], 0xe32
mov dword [ebp - 0x7cc], 0xe32
mov byte [ebp - 0x89], 0
movzx eax, byte [ebp - 0x89]
test eax, eax
je 0x42d7ac
push 0xe50
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp dword [ebp - 0x180], 0x4bf8
je 0x42d7c4
mov dword [ebp - 0x31c], 1
jmp 0x42d7cb
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x180]
cmp eax, dword [ebp - 0x31c]
jg 0x42d7eb
cmp dword [ebp - 0x180], 0
jne 0x42d7eb
and dword [ebp - 0x324], 0
jmp 0x42d7f5
mov dword [ebp - 0x324], 1
mov eax, dword [ebp - 0x4f0]
add eax, dword [ebp - 0x324]
cmp eax, dword [ebp - 0x54c]
jge 0x42d815
mov dword [ebp - 0x32c], 1
jmp 0x42d81c
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x4f8], eax
push 0x63d9
push 0x4b34
push dword [ebp - 0x184]
push 1
push 0x651b
lea eax, [ebp - 0x100]
push eax
push 1
push 0x7acb
push dword [ebp - 0xd0]
push 1
push 1
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x7ac]
push eax
push 0x681c
call fcn.0042a381
add esp, 0x38
mov dword [ebp - 0x124], 0x1928c176
mov dword [ebp - 0x6b4], 0xc70c3099
mov dword [ebp - 0x734], 0xfffffffc
push 3
lea ecx, [ebp - 0x790]
call fcn.0042f0c5
mov dword [ebp - 0xc], 0
jmp 0x42d8aa
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x42d8c0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x85c], 0
jmp 0x42d8a3
mov dword [ebp - 0xc], 0
jmp 0x42d8d0
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jge 0x42d8ec
push dword [ebp - 0xc]
lea ecx, [ebp - 0x790]
call fcn.0042f1b3
mov dword [eax], 0xd9e177c4
jmp 0x42d8c9
mov dword [ebp - 0xc], 0
jmp 0x42d8fc
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x42d912
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x590], 0x520f3038
jmp 0x42d8f5
mov dword [ebp - 0x124], 0x12
jmp 0x42d92b
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 9
jl 0x42da1a
mov dword [ebp - 0x6bc], 6
mov dword [ebp - 0x7b4], 0xededb5ca
mov dword [ebp - 0x6c4], 0
mov dword [ebp - 0x744], 0xfffffff8
mov dword [ebp - 0x6cc], 0
mov dword [ebp - 0x7b0], 0x66a92721
mov dword [ebp - 0x6d4], 0x50f82bae
mov dword [ebp - 0x5b8], 1
mov dword [ebp - 0x5b4], 1
mov dword [ebp - 0x5b0], 1
mov dword [ebp - 0x5ac], 1
lea ecx, [ebp - 0x179]
call fcn.0042f1c2
push eax
lea eax, [ebp - 0x5a8]
push eax
lea eax, [ebp - 0x5b8]
push eax
lea ecx, [ebp - 0x830]
call fcn.0042f1c5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x818]
call fcn.0042f171
mov dword [ebp - 0x754], 0xf9b6917a
mov dword [ebp - 0x6dc], 0xf5a2
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x590]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x590], eax
lea ecx, [ebp - 0x818]
call fcn.0042f197
jmp 0x42d91e
lea ecx, [ebp - 0x790]
call fcn.0042f197
push 0x273b
push 0x49d2
push 0x76eb
push 0
push 0
push 0x66f5
push dword [ebp + 8]
push 1
push dword [ebp - 0xd0]
push 0x3869
push 1
push dword [ebp - 0x20]
call fcn.00415c6c
add esp, 0x30
mov dword [ebp - 0x64], 0xb7c7
push 3
lea ecx, [ebp - 0x5d8]
call fcn.0042f0c5
mov dword [ebp - 0x7c8], 0x9643
mov dword [ebp - 0x4c], 0
jmp 0x42da88
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jge 0x42da9e
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0xc8], 0x74dd032
jmp 0x42da81
mov dword [ebp - 0x4c], 0
jmp 0x42daae
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x42daca
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x5d8]
call fcn.0042f1b3
mov dword [eax], 1
jmp 0x42daa7
cmp dword [ebp - 0x64], 0
jne 0x42dad7
push 5
pop eax
test eax, eax
je 0x42dafd
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x42daeb
push 0
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x64]
mov dword [ebp + eax - 0xc8], ecx
jmp 0x42db17
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0xc8]
mov dword [ebp + ecx - 0xc8], eax
mov dword [ebp - 0x64], 0
jmp 0x42db27
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0
jl 0x42dca6
mov dword [ebp - 0x6c], 8
mov dword [ebp - 0x344], 1
mov dword [ebp - 0x494], 0xca8c
mov dword [ebp - 0x49c], 0xfa8fad74
mov dword [ebp - 0x6c], 0
jmp 0x42db66
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jg 0x42dca1
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x10], 0
jmp 0x42db87
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x42dba8
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x42dba6
push 0
push 0xd14
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
jmp 0x42db80
cmp dword [ebp - 0x6c], 0
je 0x42dbc0
cmp dword [ebp - 0x10], 0
je 0x42dbc0
mov dword [ebp - 0x334], 1
jmp 0x42dbc7
and dword [ebp - 0x334], 0
cmp dword [ebp - 0x334], 0xfffb
je 0x42dbe5
cmp dword [ebp - 0x10], 0
je 0x42dbe5
mov dword [ebp - 0x33c], 1
jmp 0x42dbec
and dword [ebp - 0x33c], 0
mov eax, dword [ebp - 0x10]
neg eax
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x33c]
add eax, 0x3fe6966e
imul eax, dword [ebp - 0x64]
cmp dword [ebp - 0x344], eax
jge 0x42dc1a
mov dword [ebp - 0x534], 1
jmp 0x42dc21
and dword [ebp - 0x534], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x10]
je 0x42dc38
cmp dword [ebp - 0x10], 0
jne 0x42dc45
xor eax, eax
jne 0x42dc45
and dword [ebp - 0x48c], 0
jmp 0x42dc4f
mov dword [ebp - 0x48c], 1
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp + eax*4 - 0xc8]
mov dword [ebp - 0x34c], eax
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x34c]
mov dword [ebp + eax*4 - 0xc8], ecx
push 2
lea ecx, [ebp - 0x5d8]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x34c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x494]
add eax, 6
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x6c]
mov dword [ebp - 0x49c], eax
jmp 0x42db5f
jmp 0x42db20
lea ecx, [ebp - 0x5d8]
call fcn.0042f197
mov eax, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x100]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x354], ecx
mov dword [ebp - 0x24], 0xe8cff0ea
push 3
lea ecx, [ebp - 0x57c]
call fcn.0042f0c5
mov dword [ebp - 0xd8], 0xffffffff
mov dword [ebp - 0x12c], 0
jmp 0x42dcfd
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x42dd1f
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x57c]
call fcn.0042f1b3
mov dword [eax], 0xb108f825
jmp 0x42dcf0
mov dword [ebp - 0x24], 0
jmp 0x42dd2f
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffff
jne 0x42dea1
mov dword [ebp - 0x134], 0xa6801fc3
mov dword [ebp - 0x134], 0
jmp 0x42dd5c
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jg 0x42de9c
mov dword [ebp - 0x9c], 0x121ac488
mov dword [ebp - 0x9c], 2
jmp 0x42dd8c
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jl 0x42de7d
mov dword [ebp - 0xf0], 0xffffffff
mov dword [ebp - 0xf0], 0
jmp 0x42ddbc
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 2
jg 0x42de38
mov dword [ebp - 0xf4], 3
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x57c]
call fcn.0042f1b3
cmp dword [eax], 0
je 0x42dde7
jmp 0x42de38
mov dword [ebp - 0xf4], 0
jmp 0x42de00
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jg 0x42de33
mov byte [ebp - 0x77], 0
movzx eax, byte [ebp - 0x77]
test eax, eax
je 0x42de31
push 0x1179
push 0x222b
push 0xf03
push 0x22ed
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
jmp 0x42ddf3
jmp 0x42ddaf
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jl 0x42de4c
mov dword [ebp - 0x18c], 1
jmp 0x42de53
and dword [ebp - 0x18c], 0
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x57c]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x18c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0xd8], eax
jmp 0x42dd7f
mov byte [ebp - 0x81], 0
movzx eax, byte [ebp - 0x81]
test eax, eax
je 0x42de97
push 0
call dword [sym.imp.USER32.dll_SetCursor]
jmp 0x42dd4f
jmp 0x42dd28
mov dword [ebp - 0xd8], 0xd
jmp 0x42deba
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xffffffea
jne 0x42df9a
push 1
lea ecx, [ebp - 0x608]
call fcn.0042f0c5
mov dword [ebp - 0xe0], 0xffffffff
mov dword [ebp - 0x144], 0
jmp 0x42def7
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 1
jge 0x42df19
push dword [ebp - 0x144]
lea ecx, [ebp - 0x608]
call fcn.0042f1b3
mov dword [eax], 0xd8143836
jmp 0x42deea
push 0
lea ecx, [ebp - 0x608]
call fcn.0042f1b3
and dword [eax], 0
mov dword [ebp - 0xe0], 0
mov dword [ebp - 0x24], 0xfffffffa
jmp 0x42df43
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe7
jg 0x42df8a
mov dword [ebp - 0xe0], 0
jmp 0x42df62
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xffffffed
je 0x42df88
mov byte [ebp - 0x79], 0
movzx eax, byte [ebp - 0x79]
test eax, eax
je 0x42df86
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
jmp 0x42df55
jmp 0x42df3c
lea ecx, [ebp - 0x608]
call fcn.0042f197
jmp 0x42dead
lea ecx, [ebp - 0x57c]
call fcn.0042f197
cmp dword [ebp - 0x354], 0
je 0x42dff9
push 0x75b2
push 0x1542
push dword [ebp - 0x354]
push 0x64b2
push 0x28db
push 0x172a
push 0xa50
push 1
push 1
push 1
push 1
push 0x7046
push 0x1bc6
push 0x5d14
push 0x6cc4
push dword [ebp - 0x20]
call fcn.0040b3c6
add esp, 0x40
mov dword [ebp - 0xe8], 0x9c28ade1
mov dword [ebp - 0xc4], 0xe1d925b0
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xe8], 0
jmp 0x42e032
mov eax, dword [ebp - 0xe8]
dec eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xffffffe9
jg 0x42e089
mov dword [ebp - 0xc4], 0xffffffe2
jmp 0x42e054
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0xffffffea
jl 0x42e087
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x42e085
push 0x85e
push 0x11de
push 0x16b
push 0x1a62
push 0
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x42e047
jmp 0x42e025
push dword [ebp - 0x20]
call fcn.0041bd3c
pop ecx
test eax, eax
jne 0x42e09d
xor eax, eax
jmp 0x42e76f
push 2
lea ecx, [ebp - 0x428]
call fcn.0042f0c5
mov dword [ebp - 0x5a4], 0xfff8
mov dword [ebp - 0x5a0], 0xfff8
mov dword [ebp - 0x59c], 0xfff8
mov dword [ebp - 0x598], 0xfff8
lea ecx, [ebp - 0x1a1]
call fcn.0042f1c2
push eax
lea eax, [ebp - 0x594]
push eax
lea eax, [ebp - 0x5a4]
push eax
lea ecx, [ebp - 0x828]
call fcn.0042f1c5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x588]
call fcn.0042f171
mov dword [ebp - 0x4ac], 9
mov dword [ebp - 0x194], 2
mov dword [ebp - 0x4bc], 5
mov dword [ebp - 0x14c], 0
jmp 0x42e13e
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 2
jge 0x42e160
push dword [ebp - 0x14c]
lea ecx, [ebp - 0x428]
call fcn.0042f1b3
mov dword [eax], 9
jmp 0x42e131
push 0
lea ecx, [ebp - 0x428]
call fcn.0042f1b3
mov dword [eax], 0x19
jmp 0x42e199
push 0
lea ecx, [ebp - 0x428]
call fcn.0042f1b3
mov dword [ebp - 0x35c], eax
mov eax, dword [ebp - 0x35c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x35c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x428]
call fcn.0042f1b3
cmp dword [eax], 0xffffffeb
jg 0x42e397
mov dword [ebp - 0x68], 0x6f377cc4
mov dword [ebp - 0x4cc], 0xffffffff
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x68]
cmp dword [ebp - 0x68], eax
jl 0x42e1d7
mov dword [ebp - 0x4a4], 1
jmp 0x42e1de
and dword [ebp - 0x4a4], 0
push 0
lea ecx, [ebp - 0x588]
call fcn.0042f1b3
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x764], eax
mov eax, 0xe779066
cmp eax, 0x64c9d8d9
jg 0x42e20c
mov dword [ebp - 0x364], 1
jmp 0x42e213
and dword [ebp - 0x364], 0
push 3
lea ecx, [ebp - 0x588]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x364]
add ecx, dword [eax]
jne 0x42e23c
mov eax, 0xfffa
test eax, eax
jne 0x42e23c
and dword [ebp - 0x36c], 0
jmp 0x42e246
mov dword [ebp - 0x36c], 1
push 0
lea ecx, [ebp - 0x428]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x36c]
cmp ecx, dword [eax]
jne 0x42e269
mov dword [ebp - 0x374], 1
jmp 0x42e270
and dword [ebp - 0x374], 0
mov eax, dword [ebp - 0x374]
neg eax
cmp eax, dword [ebp - 0x4ac]
jne 0x42e28c
mov dword [ebp - 0x37c], 1
jmp 0x42e293
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x194]
cmp dword [ebp - 0x37c], eax
jge 0x42e2ad
mov dword [ebp - 0x488], 1
jmp 0x42e2b4
and dword [ebp - 0x488], 0
mov eax, dword [ebp - 0x4bc]
mov dword [ebp - 0x6ec], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x7b8], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x6f4], eax
push 0
lea ecx, [ebp - 0x588]
call fcn.0042f1b3
mov eax, dword [eax]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x774], eax
mov eax, 0xbe74fd57
sub eax, dword [ebp - 0x68]
cmp eax, dword [ebp - 0x68]
jle 0x42e30c
mov dword [ebp - 0x384], 1
jmp 0x42e313
and dword [ebp - 0x384], 0
cmp dword [ebp - 0x384], 1
jle 0x42e328
mov dword [ebp - 0x4c4], 1
jmp 0x42e32f
and dword [ebp - 0x4c4], 0
push 0
lea ecx, [ebp - 0x428]
call fcn.0042f1b3
push 0
lea ecx, [ebp - 0x428]
call fcn.0042f1b3
cmp dword [eax], 0x14c2
jne 0x42e35d
mov dword [ebp - 0x38c], 1
jmp 0x42e364
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0x4cc], eax
mov byte [ebp - 0x70], 0
movzx eax, byte [ebp - 0x70]
test eax, eax
je 0x42e392
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x42e175
lea ecx, [ebp - 0x588]
call fcn.0042f197
lea ecx, [ebp - 0x428]
call fcn.0042f197
push dword [ebp - 0x20]
push 0
push 0x6e5b
push 0x6e14
push 0
push 0x4fb4
push 0x4be8
push 0x4a17
push 0x470f
push 1
push 0x7122
push 0x52dd
push 1
push 1
call fcn.0042374a
add esp, 0x38
mov dword [ebp - 0x90], 0
push 2
lea ecx, [ebp - 0x474]
call fcn.0042f0c5
mov dword [ebp - 8], 0
jmp 0x42e411
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x42e42d
push dword [ebp - 8]
lea ecx, [ebp - 0x474]
call fcn.0042f1b3
mov dword [eax], 0xe3cf
jmp 0x42e40a
mov dword [ebp - 8], 0
jmp 0x42e43d
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jge 0x42e453
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x664], 0xffffffff
jmp 0x42e436
mov dword [ebp - 8], 0
jmp 0x42e463
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x42e479
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x7a0], 0x67f5
jmp 0x42e45c
mov byte [ebp - 0x72], 0
movzx eax, byte [ebp - 0x72]
test eax, eax
je 0x42e4a1
push 0x9e9
push 0x1519
push 0x158c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x90]
jg 0x42e4c1
mov dword [ebp - 0x394], 1
jmp 0x42e4c8
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 1
ja 0x42e4dd
mov dword [ebp - 0x39c], 1
jmp 0x42e4e4
and dword [ebp - 0x39c], 0
push 1
lea ecx, [ebp - 0x474]
call fcn.0042f1b3
cmp dword [eax], 0xd1f2e966
jae 0x42e505
mov dword [ebp - 0x3a4], 1
jmp 0x42e50c
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x39c]
cmp eax, dword [ebp - 0x3a4]
jle 0x42e526
mov dword [ebp - 0x3ac], 1
jmp 0x42e52d
and dword [ebp - 0x3ac], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3ac]
mov dword [ebp + eax - 0x664], ecx
push 0
lea ecx, [ebp - 0x474]
call fcn.0042f1b3
mov esi, eax
push 1
lea ecx, [ebp - 0x474]
call fcn.0042f1b3
mov ecx, dword [esi]
cmp ecx, dword [eax]
jl 0x42e56e
mov dword [ebp - 0x3b4], 1
jmp 0x42e575
and dword [ebp - 0x3b4], 0
push 0
lea ecx, [ebp - 0x474]
call fcn.0042f1b3
mov ecx, dword [ebp - 0x3b4]
cmp ecx, dword [eax]
jg 0x42e6d5
mov dword [ebp - 0x3c4], 1
mov dword [ebp - 0x6fc], 0xa5e0b2f6
mov dword [ebp - 0x7e4], 0xd9c7279c
mov dword [ebp - 0x704], 7
mov dword [ebp - 0x3d4], 0xffff
mov dword [ebp - 0x90], 9
jmp 0x42e5db
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x36
jge 0x42e6d3
mov dword [ebp - 0x19c], 0
mov dword [ebp - 0x3cc], 0xcb441791
mov dword [ebp - 0x154], 0
jmp 0x42e615
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x42e631
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x670], 0x42c512dc
jmp 0x42e608
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x7a0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x7a0], eax
cmp dword [ebp - 0x19c], 0
jne 0x42e667
mov eax, 0xb597
test eax, eax
jne 0x42e667
and dword [ebp - 0x3bc], 0
jmp 0x42e671
mov dword [ebp - 0x3bc], 1
mov dword [ebp - 0x3c4], 0xc1de6fc6
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x3cc], eax
mov eax, dword [ebp - 0x3c4]
add eax, dword [ebp - 0x19c]
cmp eax, dword [ebp - 0x3cc]
jne 0x42e6a7
mov dword [ebp - 0x4d4], 1
jmp 0x42e6ae
and dword [ebp - 0x4d4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x19c]
mov dword [ebp + eax - 0x670], ecx
mov eax, dword [ebp - 0x3d4]
dec eax
mov dword [ebp - 0x3d4], eax
jmp 0x42e5ce
jmp 0x42e6f2
mov byte [ebp - 0x74], 0
movzx eax, byte [ebp - 0x74]
test eax, eax
je 0x42e6f2
push 0x168d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
lea ecx, [ebp - 0x474]
call fcn.0042f197
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x42e74e
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x100]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x3dc], ecx
jne 0x42e722
xor eax, eax
jmp 0x42e76f
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x3dc]
mov dword [ebp - 0x4dc], eax
cmp dword [ebp - 0x4dc], 0
jne 0x42e744
xor eax, eax
jmp 0x42e76f
mov eax, dword [ebp - 0x20]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x10], 0
je 0x42e762
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3e4], eax
jmp 0x42e769
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x3e4]
pop esi
mov esp, ebp
pop ebp
ret