Function at 0x4355af
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x38], ecx
push edi
inc esi
mov byte [ebp - 0x2d], dl
push esi
lea ecx, [ebp - 0x18c]
call fcn.0043523c
push esi
lea ecx, [ebp - 0xe8]
call fcn.0043523c
or edi, 0xffffffff
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0x9281c1d9
mov dword [ebp - 8], eax
jmp 0x435603
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18c]
mov dword [ecx + edx*4], 0x1928c176
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4355f0
mov dword [ebp - 8], eax
jmp 0x435620
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xe8]
mov dword [ecx + edx*4], 0xfffffffd
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43560d
mov ecx, dword [ebp - 0xe8]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ecx], eax
mov dword [ebp - 8], 0xcf5aa05
xor edx, edx
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, 4
setge dl
mov dword [ebp - 8], edx
mov dword [ebp - 0x14], eax
jmp 0x4356e9
mov dword [ebp - 0x34], 0x6c2db602
mov dword [ebp - 0x2c], 0x68169b2b
mov dword [ebp - 0x18], eax
jmp 0x435693
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x435690
push eax
push eax
push 0x1ae2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x435678
mov dword [ebp - 0x18], eax
jmp 0x4356e1
mov dword [ebp - 0x24], 0xeb3e1984
mov dword [ebp - 0x20], 6
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x4356de
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4356c8
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_EndPaint]
xor eax, eax
mov ecx, dword [ebp - 0x34]
cmp dword [ebp - 8], ecx
jle 0x4356d3
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], esi
dec dword [ebp - 8]
jns 0x4356b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x43569d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x435665
mov ecx, dword [ebp - 0xe8]
dec dword [ecx]
jns 0x435633
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x43571e
push eax
push eax
push eax
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
lea ecx, [ebp - 0xe8]
call fcn.0043530e
lea ecx, [ebp - 0x18c]
call fcn.0043530e
xor eax, eax
mov dword [ebp - 0xc], 0x477862f
mov dword [ebp - 0xc], eax
jmp 0x435771
mov dword [ebp - 0x34], eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x435767
push 0x86e
push 0x131f
push eax
call ebx
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
xor eax, eax
mov dword [ebp - 0x34], 0x8070ade2
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffa
jne 0x435742
mov ebx, dword [0x4b05ec]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0x1d69f428
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xc], eax
jmp 0x4357b1
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x1f0], 0x1891f782
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4357a0
dec dword [ebp - 0x20]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4357cd
push 0x45
call dword [sym.imp.USER32.dll_GetKeyboardType]
xor eax, eax
mov edi, dword [ebp + 8]
or ecx, 0xffffffff
mov dword [ebp - 0x14], ecx
xor edx, edx
mov dword [ebp - 0x24], 4
inc edx
push 3
pop esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xe58d020b
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x24], 0xb568be13
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x24], 0x8d303f02
mov dword [ebp - 0x24], 0xf88039d6
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xd28
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
mov dword [ebp - 8], eax
jmp 0x43583e
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xbc], 0x40d7
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x43582d
mov dword [ebp - 8], eax
jmp 0x435859
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1f8], 0x21ec2184
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x435848
mov dword [ebp - 8], eax
jmp 0x435875
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x204], 0x8b39
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x435864
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x4358ed
push edx
lea ecx, [ebp - 0xf4]
call fcn.0043523c
xor esi, esi
mov dword [ebp - 0x20], 0x6f4846e1
xor edx, edx
mov dword [ebp - 0xc], esi
inc edx
jmp 0x4358ae
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x43589f
mov eax, dword [ebp - 0xf4]
mov dword [eax], esi
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xbc], esi
jne 0x4358d2
mov eax, dword [ebp - 0xf4]
inc dword [eax]
cmp dword [eax], esi
jle 0x4358bb
inc dword [ebp - 0x20]
lea ecx, [ebp - 0xf4]
call fcn.0043530e
inc dword [ebp - 0x14]
xor eax, eax
push 1
pop edx
cmp dword [ebp - 0x14], eax
jle 0x435882
cmp byte [ebp - 0x2d], 0
je 0x435b9d
cmp ebx, edx
jne 0x435b9d
mov dword [ebp - 0x2c], 5
or ecx, 0xffffffff
mov dword [ebp - 0x24], 0x9e53e58b
mov dword [ebp - 8], 0xd2703d9b
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], 0x72b21a35
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0xf17e2f9d
mov dword [ebp - 0x24], 0xcf4a4163
mov dword [ebp - 0x28], 0xb3bfa32a
mov dword [ebp - 0x20], 0xa3531f1
mov dword [ebp - 0xc], 0x8586fd5d
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0xfffc
mov dword [ebp - 0x14], 0x40e708be
mov dword [ebp - 0x3c], 0x9cbadbef
mov dword [ebp - 0x24], 0x5c526587
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x43597f
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor edx, edx
xor eax, eax
inc edx
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x1c], eax
jne 0x43599b
mov dword [ebp - 0x20], 0x924f63ab
mov esi, eax
imul ecx, dword [ebp - 8], 0xffff
test ecx, ecx
je 0x43599d
mov esi, edx
dec dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp - 0x18]
cmp ecx, esi
setge dl
xor ebx, ebx
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
cmp ecx, edx
mov ecx, dword [ebp - 0x14]
setl bl
xor edx, edx
cmp ebx, ecx
setge dl
xor ecx, ecx
add edx, 0x53710cb2
cmp edx, 0xd8bc
setle cl
xor ebx, ebx
cmp ecx, 0x744ed25e
mov ecx, dword [ebp - 0xc]
setne bl
xor edx, edx
sub ebx, 0x6ed
cmp ecx, ebx
setle dl
cmp edx, dword [ebp - 0x1c]
jg 0x4359fa
cmp dword [ebp - 0xc], eax
jne 0x435a03
cmp dword [ebp - 0xc], eax
jne 0x435a03
mov ecx, eax
jmp 0x435a08
xor edx, edx
lea ecx, [edx + 1]
imul ecx, ecx, 0xfbc6
test ecx, ecx
jne 0x435a15
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x3c]
xor ebx, ebx
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
mov dword [edi + 8], 4
setne bl
or ecx, 0xffffffff
mov dword [ebp - 8], ebx
xor ebx, ebx
mov dword [ebp - 8], ecx
inc ebx
mov dword [ebp - 0xc], eax
jmp 0x435a44
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x40], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x435a3a
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x435a9f
mov dword [ebp - 0x14], 0x8a137b18
mov dword [ebp - 0x14], eax
jmp 0x435a8c
mov dword [ebp - 0xc], 0x9aa810d2
mov dword [ebp - 0xc], eax
jmp 0x435a84
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x435a81
push eax
push 0x1728
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x435a69
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x435a5d
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x40], eax
jne 0x435a9f
dec dword [ebp - 8]
jns 0x435a51
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jg 0x435b93
or edi, 0xffffffff
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa1b70]
lea ecx, [ebp - 0x1d8]
push ecx
lea ecx, [ebp - 0x1e8]
mov dword [ebp - 0x78], eax
push ecx
push eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], eax
movdqu xmmword [ebp - 0x1e8], xmm0
mov dword [ebp - 0x70], eax
call fcn.0043537f
mov dword [ebp - 0x28], 0xed383de4
xor eax, eax
mov dword [ebp - 0x3c], 0xfffffffb
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], 0xfffffffc
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x435b0d
push eax
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
xor eax, eax
mov ecx, dword [ebp - 0x78]
mov dword [ecx], eax
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x20], 0xf3938425
mov dword [ebp - 0xc], eax
jmp 0x435b2f
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x40], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x435b21
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x40]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x40]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x40]
cmp edx, ecx
mov ecx, dword [ebp - 0x3c]
sbb esi, esi
inc esi
cmp esi, ecx
setg dl
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, ebx
setge cl
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x78]
dec dword [ecx]
jns 0x435b12
lea ecx, [ebp - 0x78]
call fcn.0043530e
inc dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 8], eax
jle 0x435aae
mov edi, dword [ebp + 8]
mov ebx, dword [ebp - 0x34]
mov dword [edi + 0xc], 0x4b05ec
push 2
lea ecx, [ebp - 0x198]
call fcn.0043523c
xor eax, eax
mov dword [ebp - 0x1c], 0x13532fe2
mov dword [ebp - 0xc], eax
jmp 0x435bc8
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x198]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x435bb8
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x435bf1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x435bec
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x435bd9
lea ecx, [ebp - 0x198]
call fcn.0043530e
cmp dword [ebp - 0x38], ebx
jge 0x436c6e
mov dword [ebp - 0x18], 0x9ec4279c
lea ecx, [ebp - 0x9c]
push 3
call fcn.0043523c
mov dword [ebp - 0x14], 0x2280643b
xor eax, eax
mov dword [ebp - 8], 0xb667f5ae
mov dword [ebp - 0x14], 0x796a0b59
mov dword [ebp - 0x20], 0x7bd5
mov dword [ebp - 0x3c], 0xf60
mov dword [ebp - 0x1c], 0xd206f84c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x435c66
or ebx, 0xffffffff
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x435c51
push 2
mov dword [ebp - 8], eax
pop edx
jmp 0x435c7c
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x50], 0xc264f89c
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x435c6e
mov dword [ebp - 8], eax
jmp 0x435c93
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xc8], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x435c86
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, 0x7b6fe6d3
setge dl
xor ebx, ebx
add edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x9c]
setg bl
sub ebx, ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x28], ebx
mov dword [edi + 4], ebx
xor ebx, ebx
cmp ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
setl bl
xor edx, edx
cmp ecx, ebx
setg dl
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
setne bl
sub ebx, dword [ebp - 0x18]
neg ebx
sbb ebx, ebx
inc ebx
cmp dword [ebp - 0x18], ebx
jle 0x435d03
mov ecx, esi
cmp dword [ebp - 0x18], eax
jne 0x435d05
mov ecx, eax
mov dword [ebp - 8], ecx
xor edx, edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
setns dl
cmp edx, dword [ebp - 0x18]
je 0x435e2a
mov dword [ebp - 0xc], 0xffff
lea ecx, [ebp - 0x12c]
push 4
call fcn.0043523c
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x435d5e
or ebx, 0xffffffff
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x12c]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x435d49
mov dword [ebp - 0x18], 0xffffffed
jmp 0x435d81
mov dword [ebp - 8], 0xfffffff3
jmp 0x435d78
cmp dword [ebp - 0x14], eax
jne 0x435d7e
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe3
je 0x435d70
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 7
jge 0x435d67
mov ecx, dword [ebp - 0x14]
dec ecx
je 0x435dc7
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cmp ecx, edx
mov ecx, dword [ebp - 0x50]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0xc]
setge dl
sub edx, ecx
mov ecx, dword [ebp - 0x9c]
cmp edx, dword [ecx + 8]
jne 0x435dbe
mov ecx, eax
cmp dword [ebp - 0xc], eax
je 0x435dc0
mov ecx, esi
mov edx, esi
cmp dword [ebp - 0x14], ecx
jne 0x435dc9
mov edx, eax
mov ecx, dword [edi + 4]
imul ecx, edx
sub ecx, 0xfffffffc
neg ecx
sbb ecx, ecx
add ecx, 2
cmp ecx, dword [ebp - 0xc]
jge 0x435de5
mov ecx, esi
cmp dword [edi + 4], eax
jne 0x435de7
mov ecx, eax
mov eax, dword [ebp - 8]
sub ecx, eax
mov eax, dword [ebp - 0x12c]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov ecx, 0xfff6
sub eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x7a3ebef2
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x12c]
call fcn.0043530e
jmp 0x435eba
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x435e49
or edx, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x108], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x435e36
mov dword [ebp - 0x14], eax
jmp 0x435e6f
mov dword [ebp - 0x18], eax
jmp 0x435e66
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + edx*4], 0xa2b52f10
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x435e53
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff2
jl 0x435e4e
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x9c]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x108]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x104]
setne dl
xor ebx, ebx
cmp dword [ebp - 0x28], edx
setl bl
xor ecx, ecx
cmp eax, ebx
setg cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
inc dword [ebp - 0xc4]
mov esi, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 8]
cmp eax, ecx
lea ecx, [ebp - 0x9c]
setl dl
xor eax, eax
sub edx, dword [ebp - 0x4c]
cmp esi, edx
setge al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 4], eax
call fcn.0043530e
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa1b80]
lea ecx, [ebp - 0x1c8]
push ecx
xor eax, eax
lea ecx, [ebp - 0x1d8]
push ecx
mov edi, 0x4b05f0
mov dword [ebp - 0xa8], eax
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xc], edi
movdqu xmmword [ebp - 0x1d8], xmm0
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
call fcn.0043537f
push 3
pop esi
or eax, 0xffffffff
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x15c]
push esi
call fcn.0043523c
push esi
lea ecx, [ebp - 0x180]
call fcn.0043523c
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x435f88
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x15c]
mov dword [ecx + edx*4], 0xfffffffa
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x435f75
xor ebx, ebx
mov dword [ebp - 8], eax
inc ebx
cmp dword [ebp - 8], esi
jge 0x435fa9
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x180]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 8]
jmp 0x435f93
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x15c]
mov esi, dword [ebp - 0x180]
mov dword [ecx + 8], edx
mov dword [esi + 4], edx
test edx, edx
jne 0x435fcd
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + 0xc], eax
je 0x435fcf
mov eax, ebx
imul eax, eax, 0xd205
lea ecx, [ebp - 0x180]
mov dword [esi + 4], eax
call fcn.0043530e
lea ecx, [ebp - 0x15c]
call fcn.0043530e
lea ecx, [ebp - 0xa8]
call fcn.0043530e
xor eax, eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x38], eax
jle 0x4366c9
xor esi, esi
inc esi
or eax, 0xffffffff
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0xfc3a065c
mov dword [ebp - 0x1c], 0xf4f823aa
mov dword [ebp - 0x18], 0x41ac3dc9
mov dword [ebp - 8], 0xc3d6c1df
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0xd8], esi
mov dword [ebp - 0xd4], esi
mov dword [ebp - 0xd0], esi
mov dword [ebp - 0xcc], esi
push 2
call fcn.0043523c
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x436072
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + edx*4], 0xfff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x43605f
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], esi
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
inc ecx
add ecx, edx
jne 0x436099
mov ecx, eax
cmp dword [ebp - 0xc], eax
je 0x43609b
mov ecx, esi
mov dword [ebp - 8], ecx
xor ebx, ebx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
setle bl
xor ecx, ecx
cmp ebx, 0x70ad
setne cl
xor ebx, ebx
cmp ecx, 0x856d
mov ecx, dword [ebp - 0x14]
setl bl
xor edx, edx
cmp ebx, ecx
setg dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xd4], ecx
mov ecx, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0xd0]
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
jne 0x4360f4
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xc2e3
setg dl
mov dword [ebp - 0x1c], edx
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 0x114]
setle dl
xor ecx, ecx
cmp edx, 0xfffffffe
setge cl
imul ecx, dword [eax + 4]
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x114]
call fcn.0043530e
mov eax, dword [edi]
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], 0xb25b3b9d
mov dword [ebp - 0xc], eax
jmp 0x436161
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x44], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x436157
mov dword [ebp - 0x44], eax
jmp 0x436242
mov dword [ebp - 0x14], 0xfffe
mov dword [ebp - 8], 0x4e67
inc dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x28
jge 0x43623f
or ebx, 0xffffffff
push 2
lea ecx, [ebp - 0x144]
call fcn.0043523c
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], eax
jmp 0x4361b5
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x144]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4361a6
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x144]
mov dword [edx + 4], ecx
test ecx, ecx
je 0x43620b
mov dword [ebp - 8], 3
jmp 0x436203
mov dword [ebp - 0x18], eax
jmp 0x4361f4
mov dword [ebp - 0xc], 0x13
jmp 0x4361eb
mov dword [ebp - 0x20], ebx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jg 0x4361e5
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
jl 0x4361dc
mov ecx, dword [edx + 4]
mov dword [ebp - 0x20], ecx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffed
jl 0x4361d7
jmp 0x436225
mov dword [ebp - 0x28], 0x84902314
mov dword [ebp - 8], eax
jmp 0x43621f
cmp dword [ebp - 0x28], eax
jne 0x436225
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffee
jl 0x436217
lea ecx, [ebp - 0x144]
call fcn.0043530e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x28
jl 0x43618f
xor eax, eax
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x11
je 0x43616e
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x18], ecx
or ebx, 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xfffffffe
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffa
jl 0x436355
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0xf839e071
mov dword [ebp - 0x14], 6
cmp dword [ebp - 0x14], 0x17
jg 0x436340
push 3
lea ecx, [ebp - 0x174]
call fcn.0043523c
push 2
lea ecx, [ebp - 0x1b0]
call fcn.0043523c
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4362bb
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x174]
mov dword [ecx + edx*4], 0xfffffffd
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4362a8
mov dword [ebp - 8], eax
jmp 0x4362d5
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1b0]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4362c6
mov ecx, dword [ebp - 0x174]
mov dword [ecx + 4], eax
mov dword [ebp - 0x28], 0xee4cff15
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0xfaa32f3f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 0xb3799040
mov eax, dword [ebp - 0xc]
dec dword [ecx + 4]
cmp dword [ecx + 4], 0xfffffff8
mov dword [ebp - 0x1c], eax
jg 0x4362e4
lea ecx, [ebp - 0x1b0]
call fcn.0043530e
lea ecx, [ebp - 0x174]
call fcn.0043530e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
jle 0x436287
push 0xfffffffffffffff8
pop ecx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffa
jge 0x43626c
xor eax, eax
mov esi, dword [edi + 4]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x436370
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffffc
jne 0x4363eb
xor ecx, ecx
inc ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], 0x974a5202
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x13
jl 0x4363e2
mov dword [ebp - 0x28], 0x3e45bbbd
xor ebx, ebx
mov dword [ebp - 0x3c], 0x42206dd2
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
mov ecx, dword [ebp - 8]
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
imul edx, dword [ebp - 8]
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x13
jge 0x43638f
xor ecx, ecx
inc ecx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffc
je 0x43637c
add edi, 8
mov dword [ebp - 0x14], 0x22ba3946
xor edx, edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x14], eax
inc edx
jmp 0x43640a
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x48], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x436400
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x436445
mov dword [ebp - 0x28], 5
cmp dword [ebp - 0x14], eax
jne 0x436445
mov ecx, dword [ebp - 0x28]
xor ebx, ebx
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
mov ecx, dword [ebp - 0x14]
setl bl
lea edx, [ebx + 0xbf90a23]
mov dword [ebp + ecx*4 - 0x48], edx
dec dword [ebp - 0x14]
jns 0x436417
test esi, esi
jne 0x43644f
add edi, 8
mov dword [ebp - 0xc], edi
push 0xfffffffffffffff7
pop ecx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
or ecx, 0xffffffff
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], 0xabf6a420
mov dword [ebp - 8], eax
jmp 0x436481
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x90], 0xb9f9b319
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x436470
xor esi, esi
mov dword [ebp - 0x88], eax
inc esi
cmp dword [ebp - 0x88], 0xffffffe3
jle 0x4366b3
or edi, 0xffffffff
mov dword [ebp - 8], esi
mov dword [ebp - 8], eax
jmp 0x436693
mov dword [ebp - 0x18], 0x323d1bca
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x28], 0x2c4ee0c6
mov dword [ebp - 0x18], eax
jmp 0x4364d6
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x1c0], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x4364c5
mov dword [ebp - 0x18], eax
jmp 0x4364f2
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0xdc], 0x489d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x4364e1
mov dword [ebp - 0x18], eax
jmp 0x4365ae
mov dword [ebp - 0x28], 0xfffffffb
mov ecx, dword [ebp - 8]
cmp dword [ebp - 8], eax
jne 0x436562
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x6c]
add ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x14]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 8]
cmp edx, 0x458c458a
jge 0x43653f
cmp dword [ebp - 0x6c], eax
jne 0x43653f
cmp dword [ebp - 0x14], eax
jne 0x43653f
mov esi, eax
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp esi, ecx
setne dl
imul ecx, edx, 0x865e
test ecx, ecx
je 0x436556
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
xor esi, esi
mov ecx, dword [ebp - 0x18]
inc esi
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov edx, dword [ebp + ecx*4 - 0x6c]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
setge bl
add ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
cmp dword [ebp + ecx*4 - 0x6c], ebx
jne 0x436582
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1bc], esi
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4365ab
push 0x85b
push eax
push 0x1ed9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
xor eax, eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x4364ff
mov dword [ebp - 0x18], eax
jmp 0x436686
mov dword [ebp - 0x20], 0x884bb868
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x18], 0xf5ef7b60
jne 0x4365e3
mov edx, eax
cmp dword [ebp - 0x20], eax
je 0x4365e5
mov edx, esi
mov ecx, dword [ebp - 8]
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 8]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x18]
setle dl
xor ebx, ebx
imul edx, edx, 0xeedf
cmp edx, ecx
mov ecx, dword [ebp - 0x18]
setge bl
mov dword [ebp + ecx*4 - 0x1c0], ebx
cmp ebx, 0x23d2
jne 0x436622
mov edx, esi
cmp dword [ebp - 0x1c], eax
jne 0x436624
mov edx, eax
mov ecx, 0x84d2
sub ecx, edx
jne 0x436634
mov ecx, eax
cmp dword [ebp - 0x28], eax
je 0x436636
mov ecx, esi
cmp ecx, dword [ebp - 8]
jl 0x43663e
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x14]
xor edx, edx
test ecx, ecx
setle dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov ecx, dword [ebp - 0x20]
cmp ecx, esi
setg dl
imul ecx, edx, 0xfffc
test ecx, ecx
je 0x436665
mov ecx, dword [ebp - 0x1b8]
mov ecx, dword [ebp - 0xdc]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
mov ecx, eax
cmp dword [ebp - 8], eax
je 0x436680
mov ecx, esi
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x4365c0
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jg 0x4364ab
dec dword [ebp - 0x88]
cmp dword [ebp - 0x88], 0xffffffe3
jg 0x4364a0
mov edi, dword [ebp - 0xc]
add edi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x2c]
inc ebx
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x2c], ebx
cmp ebx, dword [ebp - 0x38]
jl 0x43600a
mov dword [ebp - 8], 0x8bbca631
mov dword [ebp - 0x14], 0xb8fa
mov dword [ebp - 0x2c], 0x8e17c109
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xf
jne 0x43679a
xor esi, esi
push 4
lea ecx, [ebp - 0x120]
call fcn.0043523c
mov dword [ebp - 0x24], 0x85e
mov dword [ebp - 0x14], esi
jmp 0x436719
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0x1265
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x436706
mov eax, dword [ebp - 0x120]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], 3
jg 0x436782
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
imul eax, dword [ebp - 0x1c], 0x3358
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x1c], 0x90611bc3
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setg bl
xor ecx, ecx
cmp eax, ebx
setle cl
xor eax, eax
test ecx, ecx
sets al
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x436737
xor esi, esi
lea ecx, [ebp - 0x120]
call fcn.0043530e
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xf
je 0x4366ed
mov eax, dword [edi]
lea ecx, [ebp - 0x84]
xor ebx, ebx
mov dword [ebp - 0x20], eax
inc ebx
mov dword [ebp - 0x18], ebx
push 2
call fcn.0043523c
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4367d2
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x84]
mov dword [ecx + edx*4], 0xfadacd7d
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4367bf
mov edi, dword [ebp - 0x84]
xor ecx, ecx
mov esi, dword [edi + 4]
test esi, esi
setne cl
xor edx, edx
cmp ecx, dword [edi]
setge dl
xor ecx, ecx
cmp edx, dword [edi]
setl cl
cmp ecx, esi
jl 0x436800
mov edx, ebx
test esi, esi
jne 0x436802
mov edx, eax
xor ecx, ecx
mov dword [ebp - 0x18], 0xeec5
cmp edx, dword [edi]
setg cl
xor ebx, ebx
cmp ecx, dword [edi]
mov ecx, dword [ebp - 0x18]
setge bl
xor edx, edx
cmp ecx, 0xa00f
setg dl
cmp edx, ebx
jl 0x436835
cmp dword [edi + 4], eax
je 0x436835
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x43683a
xor ebx, ebx
mov ecx, eax
inc ebx
or edx, 0xffffffff
cmp edx, ecx
mov ecx, dword [ebp - 0x84]
sbb edx, edx
inc edx
mov dword [ecx], edx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x436946
mov dword [ebp - 8], 0xfffffff8
mov dword [ebp - 0x18], eax
jmp 0x436934
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x84]
mov esi, dword [ecx + edx*4]
xor edx, edx
mov ecx, dword [ebp - 8]
neg esi
cmp esi, ecx
mov ecx, dword [ebp - 8]
setg dl
xor ebx, ebx
cmp edx, dword [edi + 4]
mov dword [ebp - 8], eax
setge bl
sub ebx, ecx
je 0x436912
xor ebx, ebx
inc ebx
cmp dword [ebp - 8], ebx
jg 0x436931
push 3
lea ecx, [ebp - 0x138]
call fcn.0043523c
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4368d4
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x138]
mov dword [ecx + edx*4], 0xe13c9534
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x4368c1
mov esi, dword [ebp - 0x138]
mov dword [esi + 8], ebx
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4368f6
push eax
push eax
call dword [sym.imp.USER32.dll_CopyRect]
xor eax, eax
dec dword [esi + 8]
jns 0x4368e3
lea ecx, [ebp - 0x138]
call fcn.0043530e
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x4368ad
xor eax, eax
jmp 0x436931
xor ebx, ebx
inc ebx
cmp dword [ebp - 8], ebx
jg 0x436931
or esi, 0xffffffff
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x84]
mov dword [ecx + edx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x43691d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x43686e
dec dword [ebp - 0x14]
jns 0x43685f
lea ecx, [ebp - 0x84]
call fcn.0043530e
mov edi, dword [ebp - 0xc]
lea ecx, [ebp - 0x100]
push ebx
call fcn.0043523c
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x43697a
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x100]
mov dword [ecx + edx*4], 0xd5e48d32
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x436967
mov ecx, dword [ebp - 0x100]
push 0xffffffffffffffea
pop esi
mov dword [ecx], esi
mov dword [ebp - 0x1c], 0x683c8fc5
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x1c], esi
jmp 0x4369d1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4369ce
push eax
push 0x303
push 0xb57
push 0x6be
push 0x176e
push 0x1bee
push 0x24a5
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
jg 0x43699d
cmp dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x100]
jne 0x4369e9
inc dword [ecx]
cmp dword [ecx], 0x15
jl 0x43698a
mov dword [ecx], ebx
lea ecx, [ebp - 0x100]
call fcn.0043530e
mov esi, dword [edi + 4]
lea ecx, [ebp - 0x1a4]
push 4
call fcn.0043523c
xor eax, eax
mov dword [ebp - 0x1c], 0x66fe7d8a
mov dword [ebp - 0x1c], eax
jmp 0x436a23
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1a4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x436a14
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x436a5a
mov dword [ebp - 0x24], 0xf82f
mov dword [ebp - 0x24], 0x4b25b3b9
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x436a55
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
dec dword [ebp - 0x1c]
jns 0x436a35
lea ecx, [ebp - 0x1a4]
call fcn.0043530e
or eax, 0xffffffff
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], 0xfc3a065c
mov dword [ebp - 8], 0xf4f823aa
mov dword [ebp - 0x38], 0x41ac3dc9
mov dword [ebp - 0x1c], 0xc3d6c1df
mov dword [ebp - 8], 8
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
push 2
call fcn.0043523c
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x436acd
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x150]
mov dword [ecx + edx*4], 0xfff8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x436aba
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x38]
mov ecx, dword [ebp - 8]
inc ecx
add ecx, edx
jne 0x436af4
mov ecx, eax
cmp dword [ebp - 0xc], eax
je 0x436af6
mov ecx, ebx
mov dword [ebp - 0x1c], ecx
xor ebx, ebx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
setle bl
xor ecx, ecx
cmp ebx, 0x70ad
setne cl
xor ebx, ebx
cmp ecx, 0x856d
mov ecx, dword [ebp - 0x14]
setl bl
xor edx, edx
cmp ebx, ecx
setg dl
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xb4], ecx
mov ecx, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0xb0]
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
jne 0x436b4f
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x38]
cmp ecx, 0xc2e3
setg dl
mov dword [ebp - 8], edx
xor edx, edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x150]
setle dl
xor ecx, ecx
cmp edx, 0xfffffffe
setge cl
imul ecx, dword [eax + 4]
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x150]
call fcn.0043530e
test esi, esi
jne 0x436c72
cmp byte [ebp - 0x2d], 0
mov ebx, dword [ebp - 0x20]
je 0x436bbe
xor eax, eax
inc eax
cmp dword [ebp - 0x34], eax
jne 0x436bbe
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [ecx + 8], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [edi + 0xc]
add edi, 0x10
push ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], edi
call fcn.00489ad6
mov dword [ebp - 0x34], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xc0], eax
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0xc0]
push eax
push ebx
call fcn.0046d85b
mov edi, dword [ebp - 0x5c]
xor esi, esi
mov ecx, esi
test ebx, ebx
jle 0x436c4a
mov eax, ecx
and eax, 0x80000001
jns 0x436c14
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x24]
add eax, ecx
add eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x28]
jmp 0x436c29
lea eax, [edx + 1]
cdq
idiv ebx
cmp word [edi + edx*2], si
jne 0x436c26
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov eax, dword [ebp - 0xc]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x34]
mov byte [ecx + edx], al
inc ecx
cmp ecx, ebx
jl 0x436c06
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x34]
mov dword [ecx], ebx
mov dword [ecx + 4], eax
test edi, edi
je 0x436c76
push edi
call fcn.0048afc6
pop ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x54], esi
mov edi, dword [ebp + 8]
jmp 0x436c78
xor esi, esi
jmp 0x436c78
xor esi, esi
jmp 0x436c69
mov edi, ecx
push 4
pop ebx
mov dword [ebp - 8], 0xfffffffe
lea ecx, [ebp - 0x168]
push ebx
call fcn.0043523c
mov dword [ebp + 8], 0x33c017f2
mov dword [ebp + 8], esi
jmp 0x436ca9
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], ebx
jl 0x436c9a
mov dword [ebp + 8], esi
jmp 0x436cc4
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x1c8], 0xfffffff6
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x436cb3
mov ecx, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0xffff0008
inc edx
mov dword [ebp + 8], ecx
xor ecx, ecx
mov eax, dword [ebp + 8]
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 0x168]
mov dword [eax + 0xc], esi
mov eax, dword [ebp - 8]
cmp eax, edx
mov eax, dword [ebp - 8]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 8]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 8]
setg cl
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 8]
sete dl
add eax, 0xb88dcfd8
add edx, eax
xor eax, eax
cmp edx, ecx
mov ecx, dword [ebp - 8]
setne al
xor edx, edx
cmp eax, ecx
lea ecx, [ebp - 0x168]
setg dl
mov dword [ebp - 0x1c4], edx
call fcn.0043530e
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret