Function at 0x437993
Capabilities:
Authenticate hmac
Check for time delay via gettickcount
Delete file
Encrypt data using speck
Get common file path
Get geographical location
Get graphical window text
Identify system language via api
Set registry value

Disassembly:
mov eax, 0x4bf191
call fcn.004be928
sub esp, 0xf38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x70], dl
mov dword [ebp - 0x64], ecx
xor edi, edi
inc edi
mov dword [ebp - 0x34], edi
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x6c4]
call fcn.0043557d
mov dword [ebp - 0x48], 0x65c829e
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x30], 0x9015
push 3
pop esi
push esi
lea ecx, [ebp - 0x6ac]
call fcn.0043557d
xor eax, eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jge 0x437a08
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c4]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x4379f2
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x437a20
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6ac]
mov dword [eax + ecx*4], 0x3624b674
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x437a0d
mov eax, dword [ebp - 0x6c4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
xor edx, edx
cmp eax, ecx
setle dl
cmp edx, dword [ebp - 0x20]
je 0x437a52
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x6ac]
mov dword [eax + 8], 0x82b357f0
lea ecx, [ebp - 0x6ac]
call fcn.0043564f
lea ecx, [ebp - 0x6c4]
call fcn.0043564f
mov dword [ebp - 0x18], 0xb32a831d
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0xbd4856cd
mov dword [ebp - 0x54], 0xfffc
mov dword [ebp - 0x34], 0xb296
mov dword [ebp - 0x3c], 0x1675
mov dword [ebp - 0x2c], 0xffff
mov dword [ebp - 0x44], 0x5e7
mov dword [ebp - 0x30], 0x42359916
mov dword [ebp - 0x28], 0
push 2
pop ecx
jmp 0x437acc
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x100], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x437abf
mov dword [ebp - 0x28], 0
jmp 0x437aeb
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa8], 0x1dda8db8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x437ada
mov dword [ebp - 0x28], 0
jmp 0x437b0a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xe4], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ecx
jl 0x437af9
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffff
jbe 0x437b2f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x437b31
mov dword [ebp - 0xfc], edi
mov ecx, edi
jmp 0x437b39
xor eax, eax
mov dword [ebp - 0xfc], eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x79c63c40
setg al
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
setle cl
cmp edi, ecx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x1c]
neg edx
mov eax, dword [ebp - 0xa8]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x100], 0x8101bc64
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, ecx
setle dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edi
setl cl
imul edx, ecx, 0x8e43
mov eax, dword [ebp - 0xe4]
sub edx, eax
mov eax, dword [ebp - 0xa8]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0xe0]
jl 0x437bec
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x437c70
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0x4ca6a668
mov dword [ebp - 0x38], 0xfffffff8
cmp dword [ebp - 0x2c], eax
je 0x437c2c
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0xfc], eax
je 0x437c4c
cmp dword [ebp - 0x44], eax
je 0x437c4c
mov eax, edi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, 0x350090e7
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xfc], eax
dec dword [ebp - 0x38]
jmp 0x437c9f
mov dword [ebp - 0x30], 0xf1f47437
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x54], 0
cmp dword [ebp - 0x54], edi
jg 0x437c9f
xor ebx, ebx
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0xe4], ebx
jne 0x437c9f
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], edi
jle 0x437c8b
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x38], 0x1f46
cmp dword [ebp - 0x38], 0x20e5
jle 0x437cf5
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x30], 0x7371
mov eax, edi
mov ecx, ebx
shl eax, cl
cdq
push edx
push eax
mov ecx, 0xab56b8
call fcn.00435439
add ebx, esi
dec dword [ebp - 0x30]
jne 0x437cc3
inc esi
cmp esi, 0x50d2
jl 0x437cba
inc edi
cmp edi, 0x1c8
jl 0x437cb8
xor edi, edi
inc edi
push 3
pop esi
mov dword [ebp - 0x24], 0x833fcb50
and dword [ebp - 4], 0
cmp dword [ebp - 0x38], 0x1d8b
jge 0x437d18
mov edx, str.vdf_hno_fwuhn_qgndxhpxc_rgbchcwl_dqmbjkca
mov ecx, 0xab56b8
call fcn.004371ef
or dword [ebp - 4], 0xffffffff
push 2
pop ebx
push 4
pop ecx
jmp 0x437d4e
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
jmp 0x437d69
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc3c], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x437d58
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x437db7
mov dword [ebp - 0x30], 0x6b8f3d42
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x437d98
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor eax, eax
push 0xfffffffffffffffd
pop esi
mov dword [ebp - 0x18], esi
jmp 0x437dac
cmp dword [ebp - 0x30], eax
jne 0x437ef3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x19
jge 0x437da0
jmp 0x437ef3
mov dword [ebp - 0x40], 0x9339b884
mov dword [ebp - 0x40], 0xfe1f230b
mov dword [ebp - 0x40], 0xdd8e181f
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x40], 0x7f5e1753
mov dword [ebp - 0x1c], eax
jmp 0x437df0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2ec], 0x188047d2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x437ddf
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2e4]
mov eax, dword [ebp - 0x2ec]
mov eax, dword [ebp - 0x2ec]
imul ecx, dword [ebp - 0x2ec], 0xf7d2
add ecx, 0x2e0f2044
xor eax, eax
cmp ecx, 0x9f19
setle al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2e4]
neg ecx
sbb ecx, ecx
add ecx, 0x94b8e204
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x2e8]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], esi
jg 0x437ef0
mov dword [ebp - 0x40], 0xd514faf1
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x40], 0x2a1efe0c
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x40], 0x98072f25
push esi
lea ecx, [ebp - 0x864]
call fcn.0043557d
mov dword [ebp - 0x30], 0x360e5697
mov dword [ebp - 0x18], 0
jmp 0x437eb4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x950], 0x983c17a3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x437ea3
mov dword [ebp - 0x18], 0
jmp 0x437ed5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x864]
mov dword [eax + ecx*4], 0x96a9cbd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x437ec2
dec dword [ebp - 0x30]
lea ecx, [ebp - 0x864]
call fcn.0043564f
inc dword [ebp - 0x24]
jmp 0x437e58
push 0xfffffffffffffffd
pop esi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x18], 0x3342eb9
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x30], 0xd68f9855
mov dword [ebp - 0x1c], 0
jmp 0x437f25
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x248], 0x85755261
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x437f14
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0xf
jle 0x437fc9
mov dword [ebp - 0x24], 0x6ec7516a
cmp dword [ebp - 0x24], 0
je 0x437f82
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
xor ebx, ebx
cmp eax, ecx
setge bl
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, ebx
setle al
cmp eax, dword [ebp - 0x24]
jle 0x437f82
mov eax, edi
jmp 0x437f84
xor eax, eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edi
sbb eax, eax
neg eax
xor ecx, ecx
cmp eax, edi
setge cl
xor eax, eax
cmp ecx, dword [ebp - 0x24]
jge 0x437fa1
cmp dword [ebp - 0x18], eax
je 0x437fa8
cmp dword [ebp - 0x24], eax
mov ecx, edi
jne 0x437faa
mov ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jg 0x437f3b
push 2
pop ebx
push 4
lea ecx, [ebp - 0x550]
call fcn.0043557d
mov dword [ebp - 0x48], esi
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x4ec], 0x5b0bb8bf
mov dword [ebp - 0x4e8], 0x5b0bb8bf
mov dword [ebp - 0x4e4], 0x5b0bb8bf
mov dword [ebp - 0x4e0], 0x5b0bb8bf
mov dword [ebp - 0x38], 0xfffd
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], 0xcefbde28
push edi
lea ecx, [ebp - 0x6dc]
call fcn.0043557d
mov dword [ebp - 0x1c], 0
jmp 0x43803f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6dc]
mov dword [eax + ecx*4], 0xbbb66efe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x43802c
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x4e8], eax
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x20]
dec edx
neg edx
sbb edx, edx
neg edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setle cl
imul eax, ecx, 0x32c5
mov dword [ebp - 0x30], eax
xor eax, eax
cmp dword [ebp - 0x30], eax
jne 0x43807c
cmp dword [ebp - 0x34], eax
je 0x43807e
mov eax, edi
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x4e8]
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp ecx, eax
setge dl
mov esi, dword [ebp - 0x48]
imul esi, edx
neg esi
sbb esi, esi
neg esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp esi, eax
setne cl
mov eax, dword [ebp - 0x6dc]
mov dword [eax], ecx
lea ecx, [ebp - 0x6dc]
call fcn.0043564f
mov dword [ebp - 0x34], 0x65c829e
mov dword [ebp - 0x48], 8
mov dword [ebp - 0x4c], 0x9015
mov dword [ebp - 0x18], 0x2e91a04
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x18], 0x19
mov dword [ebp - 0x58], 0xfffffff6
cmp dword [ebp - 0x18], 0x14
jl 0x4381a3
push ebx
lea ecx, [ebp - 0x6f4]
call fcn.0043557d
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
jge 0x438124
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x6f4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jl 0x43810e
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x438144
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xa4], 0x5cc25bfc
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x43812c
xor eax, eax
cmp dword [ebp - 0xa4], eax
jne 0x43815a
cmp dword [ebp - 0xa4], 0xef5d
mov ecx, eax
jle 0x43815c
mov ecx, edi
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6f4]
mov dword [eax], esi
neg ecx
mov eax, dword [ebp - 0xa4]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
xor edx, edx
cmp eax, dword [ebp - 0x58]
setne dl
mov eax, dword [ebp - 0xa4]
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, esi
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x6f4]
call fcn.0043564f
dec dword [ebp - 0x18]
jmp 0x4380ee
mov dword [ebp - 0x28], 0xfffffff3
jmp 0x4382a0
mov dword [ebp - 0x24], 0x23e5
mov dword [ebp - 0x30], 0x8f5063f3
mov dword [ebp - 0x1c], 0
jmp 0x4381d7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa5c], 0xe80c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x4381c6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
neg eax
je 0x4381ec
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
setne dl
cmp edx, 0x4e785c2f
jle 0x43820b
cmp dword [ebp - 0x18], 0
je 0x43820b
mov edx, edi
jmp 0x43820d
xor edx, edx
mov ecx, dword [ebp - 0xa5c]
mov eax, dword [ebp - 0x28]
add eax, edx
add ecx, eax
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp eax, ecx
setl dl
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setle cl
inc ecx
jne 0x43823a
xor eax, eax
cmp dword [ebp - 0x18], eax
mov ecx, eax
je 0x43823c
mov ecx, edi
mov eax, dword [ebp - 0x30]
sub ecx, eax
je 0x438285
mov dword [ebp - 0x24], 0xfffffff3
jmp 0x438261
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x43825e
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe6
jge 0x43824c
mov dword [ebp - 0x18], 9
jmp 0x43827d
mov dword [ebp - 0x30], 4
dec dword [ebp - 0x30]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff4
jle 0x438270
jmp 0x43829d
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x43829d
push 0x47f
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 7
je 0x4381af
push 3
pop esi
push esi
lea ecx, [ebp - 0x73c]
call fcn.0043557d
push ebx
lea ecx, [ebp - 0x95c]
call fcn.0043557d
push 4
lea ecx, [ebp - 0x70c]
call fcn.0043557d
mov dword [ebp - 0x40], 0xfffffffe
mov dword [ebp - 0x40], 0x164caf14
push esi
lea ecx, [ebp - 0x87c]
call fcn.0043557d
xor eax, eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], ebx
jge 0x438310
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x95c]
mov dword [eax + ecx*4], 0xeac8
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], ebx
jl 0x4382f6
xor eax, eax
mov dword [ebp - 0x5c], eax
push 4
pop ebx
cmp dword [ebp - 0x5c], ebx
jge 0x438335
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x70c]
mov dword [eax + ecx*4], 0x833fcb50
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], ebx
jl 0x43831b
xor eax, eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], esi
jge 0x438357
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x87c]
mov dword [eax + ecx*4], 0x729cf308
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], esi
jl 0x43833d
xor eax, eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], edi
jge 0x438377
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0xa30], 5
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], edi
jl 0x43835f
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x438389
push eax
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor eax, eax
mov ecx, dword [ebp - 0x70c]
mov dword [ecx + 0xc], eax
mov dword [ebp - 0x40], 0x8ef6b8f3
mov dword [ebp - 0x30], 0x947597a6
dec dword [ebp - 0x30]
inc dword [ecx + 0xc]
cmp dword [ecx + 0xc], edi
jle 0x438392
lea ecx, [ebp - 0x87c]
call fcn.0043564f
lea ecx, [ebp - 0x70c]
call fcn.0043564f
lea ecx, [ebp - 0x95c]
call fcn.0043564f
mov dword [ebp - 0x18], 0
jmp 0x4383e4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x550]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x4383d5
mov dword [ebp - 0x18], 0
jmp 0x438405
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x73c]
mov dword [eax + ecx*4], 0x3624b674
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x4383f2
push esi
lea ecx, [ebp - 0x3d4]
call fcn.0043557d
mov dword [ebp - 0x30], 0x18d58162
mov dword [ebp - 0x38], 0x4015fb26
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x54], 0x97b2c3cc
mov dword [ebp - 0x18], 0
jmp 0x438446
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3d4]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x438437
mov dword [ebp - 0x18], 0
jmp 0x438465
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x724], 0x9a9b8fa4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x438454
mov eax, dword [ebp - 0x3d4]
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp - 0x20]
xor eax, eax
cmp dword [ebp - 0x720], eax
je 0x4384ce
cmp dword [ebp - 0x20], eax
je 0x4384a1
mov eax, dword [ebp - 0x724]
xor ecx, ecx
cmp eax, edi
setg cl
cmp ecx, 0x82ad
je 0x43849f
mov ecx, edi
jmp 0x4384a3
xor eax, eax
mov ecx, eax
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
mov eax, dword [ebp - 0x3d4]
cmp edx, dword [eax]
setge cl
cmp ecx, 0xffff
sbb eax, eax
inc eax
test eax, eax
jle 0x4384ca
mov eax, dword [ebp - 0x20]
mov edx, edi
jmp 0x4384d0
mov edx, eax
neg edx
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
neg ecx
xor eax, eax
cmp ecx, 0x69b12db2
setne al
sub eax, dword [ebp - 0x38]
je 0x4384fb
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x724]
neg eax
add eax, eax
je 0x438535
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x43866b
push 0x751
push 0x1e43
push 0xe62
push 0x1879
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
jmp 0x43866b
xor eax, eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x438659
mov dword [ebp - 0x2c], 0x5b4d
cmp dword [ebp - 0x2c], 0x5e4c
jle 0x4385ef
mov ecx, eax
mov dword [ebp - 0x34], eax
mov ebx, eax
mov dword [ebp - 0x38], eax
mov esi, eax
mov dword [ebp - 0x30], esi
mov edx, ecx
mov ecx, ebx
sar edx, cl
mov dword [ebp - 0x44], edx
mov edi, eax
mov ebx, edx
mov ecx, esi
shl ebx, cl
mov eax, ebx
and eax, edi
cdq
push edx
push eax
lea ecx, [ebp - 0xd14]
call fcn.00401a1e
pop ecx
pop ecx
mov ecx, eax
call fcn.0043542e
push eax
call fcn.004a9457
pop ecx
push 0
push 1
lea ecx, [ebp - 0xd14]
call fcn.00435959
inc edi
cmp edi, 0x58ee
jl 0x438578
mov esi, dword [ebp - 0x30]
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x288d
push 0
pop eax
mov edx, dword [ebp - 0x44]
jl 0x438570
mov ebx, dword [ebp - 0x38]
inc ebx
mov dword [ebp - 0x38], ebx
cmp ebx, 0x1737
mov ecx, dword [ebp - 0x34]
jl 0x438562
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x4fd
jl 0x43855d
xor edi, edi
inc edi
push 3
pop esi
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x438603
push 0x255e
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x5856
jge 0x43861e
push str.nmiidzqj_crwwjsq_nthtdbi_olf_risreu_lyn_ephiqhe_pugp_xwh_khagdpy_jkyzc_hmnh_cezuvtrt_kzkzkgxb
call fcn.004a9457
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x43864f
inc dword [ebp - 0x54]
xor eax, eax
jmp 0x43853a
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x43866b
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea ecx, [ebp - 0x3d4]
call fcn.0043564f
mov eax, dword [ebp - 0x550]
mov eax, dword [eax + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp eax, ecx
setle dl
cmp edx, dword [ebp - 0x48]
je 0x4386a3
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x73c]
mov dword [eax + 8], 0x82b357f0
lea ecx, [ebp - 0x73c]
call fcn.0043564f
lea ecx, [ebp - 0x550]
call fcn.0043564f
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x694]
call fcn.0043557d
mov dword [ebp - 0x1c], 0x8e9934b0
push ebx
lea ecx, [ebp - 0x410]
call fcn.0043557d
mov dword [ebp - 0x18], 0
jmp 0x438704
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x694]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x4386f4
mov dword [ebp - 0x18], 0
jmp 0x438725
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x410]
mov dword [eax + ecx*4], 0xa01c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x438712
mov eax, dword [ebp - 0x694]
xor ebx, ebx
mov dword [eax + 8], ebx
mov eax, dword [ebp - 0x410]
inc dword [eax + 4]
jne 0x438768
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x438760
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], bl
je 0x43875d
push 0x15dd
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor eax, eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff9
jne 0x438747
jmp 0x43878e
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x38], 0xfffffff8
mov eax, dword [ebp - 0x30]
mov ecx, 0xfffa
mov eax, dword [ebp - 0x410]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x38], ecx
lea ecx, [ebp - 0x410]
call fcn.0043564f
lea ecx, [ebp - 0x694]
call fcn.0043564f
mov dword [ebp - 0x28], 0x5c68ec0a
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], ebx
jmp 0x438851
mov dword [ebp - 0x18], ebx
jmp 0x4387c8
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x12c], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x4387bb
mov dword [ebp - 0x18], ebx
push 4
pop ecx
jmp 0x4387e6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x160], 0x57bf5cd5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x4387d5
mov dword [ebp - 0x158], ebx
jmp 0x43880a
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x12c], 0xfff8
inc dword [ebp - 0x158]
cmp dword [ebp - 0x158], edi
jl 0x4387f3
cmp dword [ebp - 0x158], ebx
jne 0x438841
mov ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp eax, ecx
setg dl
cmp edx, dword [ebp - 0x28]
jne 0x438835
mov eax, dword [ebp - 0x154]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x30], 0x6273d594
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe7
jge 0x4387b6
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x20], 0x6ff23b1a
mov dword [ebp - 0x30], 0xa01c77dc
mov dword [ebp - 0x1c], ebx
jmp 0x438886
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x464], 0x7084bc9c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x438875
cmp dword [ebp - 0x20], ebx
jne 0x4388a0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x460]
mov eax, dword [ebp - 0x460]
neg eax
sbb eax, eax
neg eax
cmp edi, eax
sbb eax, eax
inc eax
cmp eax, 0x8e99
jg 0x4388e0
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x4388cb
push 0x37f
call dword [sym.imp.USER32.dll_IsWindow]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x4388f2
push 0x1255
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
jmp 0x4388f2
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x4388f2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
inc dword [ebp - 0x30]
mov dword [ebp - 0x30], 0x244d513c
mov dword [ebp - 0x18], 0x8d7cbae8
mov dword [ebp - 0x20], 0x4c7ba3f3
mov dword [ebp - 0x38], 0x2138b36c
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x1c], ebx
jmp 0x43892e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbc8], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x43891d
cmp dword [ebp - 0x18], ebx
jne 0x43893c
xor edx, edx
jmp 0x43893e
mov edx, edi
mov eax, dword [ebp - 0x18]
neg edx
xor ecx, ecx
cmp edx, eax
setl cl
mov eax, dword [ebp - 0x18]
add eax, 3
add ecx, eax
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
setle dl
mov eax, dword [ebp - 0x20]
xor ebx, ebx
cmp edx, eax
setge bl
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp ebx, eax
setne cl
add ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x18]
jle 0x43897f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x20], eax
mov edx, edi
jne 0x4389a0
mov edx, eax
mov eax, dword [ebp - 0xbc4]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xcd45
setl al
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x4b4], 5
mov dword [ebp - 0x4b0], 5
mov dword [ebp - 0x4ac], 5
mov dword [ebp - 0x4a8], 5
mov dword [ebp - 0x54], 0xa2afe01b
mov dword [ebp - 0x2c], 0x3ee1
cmp dword [ebp - 0x2c], 0x4143
jle 0x438a55
push 0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], 0x179d
xor edi, edi
xor esi, esi
mov eax, esi
or eax, edi
or eax, ebx
cdq
push edx
push eax
mov ecx, 0xab56b8
call fcn.00435439
inc esi
cmp esi, 0x4f8
jl 0x438a15
inc edi
cmp edi, 0x9f9
jl 0x438a13
dec ebx
dec dword [ebp - 0x30]
jne 0x438a11
mov ebx, dword [ebp - 0x38]
inc ebx
mov dword [ebp - 0x38], ebx
cmp ebx, 0x3571
jl 0x438a07
xor edi, edi
inc edi
push 3
pop esi
mov dword [ebp - 4], 4
cmp dword [ebp - 0x2c], 0x3ce2
jge 0x438a74
mov edx, str.tvv_zqme_hak
mov ecx, 0xab56b8
call fcn.004371ef
or dword [ebp - 4], 0xffffffff
jmp 0x438aa5
xor eax, eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], esi
jg 0x438afd
mov dword [ebp - 0x48], 0xf1d8987f
mov eax, dword [ebp - 0x54]
xor ebx, ebx
cmp dword [ebp + eax*4 - 0x4b4], ebx
jne 0x438afb
mov dword [ebp - 0x48], esi
xor eax, eax
cmp dword [ebp - 0x48], eax
jl 0x438af3
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x438aee
xor ebx, ebx
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x4b4], ebx
jne 0x438aec
dec dword [ebp - 0x20]
jns 0x438adb
xor eax, eax
dec dword [ebp - 0x48]
jns 0x438ace
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], esi
jle 0x438aaf
xor eax, eax
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x18], 0xb32a831d
push 4
pop ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0xbd4856cd
mov dword [ebp - 0x30], 0x326e
cmp dword [ebp - 0x30], 0x3444
jle 0x438b76
mov ebx, eax
mov edi, eax
mov esi, eax
mov eax, edi
cdq
idiv esi
mov eax, ebx
sub eax, edx
cdq
push edx
push eax
mov ecx, 0xab56b8
call fcn.00435439
inc esi
cmp esi, 0x77a
jl 0x438b2a
inc edi
cmp edi, 0x6aa9
push 0
pop eax
jl 0x438b28
inc ebx
cmp ebx, 0x5ca1
jl 0x438b26
push eax
push eax
push 0x1b9f
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor edi, edi
inc edi
push 3
pop esi
push 4
pop ebx
mov dword [ebp - 0x54], 0xfffc
mov dword [ebp - 4], 6
cmp dword [ebp - 0x30], 0x30a4
jge 0x438b9c
mov edx, str.wwgrqltr_cic_vfw_bivzgeui_ozzykg_magtxw_ccudehi_ocq_heh_eojvhy_npr_savx
mov ecx, 0xab56b8
call fcn.004371ef
or dword [ebp - 4], 0xffffffff
jmp 0x438bd0
xor eax, eax
mov dword [ebp - 0x34], 0xb296
mov dword [ebp - 0x3c], 0x1675
mov dword [ebp - 0x2c], 0xffff
mov dword [ebp - 0x44], 0x5e7
mov dword [ebp - 0x30], 0x42359916
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x438c13
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xdc], edi
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x438bfe
xor eax, eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], edi
jge 0x438c33
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x98], 0x1dda8db8
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x438c1b
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x438c49
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x110], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 2
jl 0x438c38
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffff
jbe 0x438c6f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x438c71
mov dword [ebp - 0xd8], edi
mov ecx, edi
jmp 0x438c79
xor eax, eax
mov dword [ebp - 0xd8], eax
mov ecx, eax
xor eax, eax
cmp ecx, 0x79c63c40
setg al
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
test eax, eax
setle cl
cmp edi, ecx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x1c]
neg edx
mov eax, dword [ebp - 0x98]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xdc], 0x8101bc64
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, ecx
setle dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edi
setl cl
imul edx, ecx, 0x8e43
mov eax, dword [ebp - 0x110]
sub edx, eax
mov eax, dword [ebp - 0x98]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x10c]
jl 0x438d2c
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x110]
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x438db0
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x40], 0x4ca6a668
mov dword [ebp - 0x38], 0xfffffff8
cmp dword [ebp - 0x2c], eax
je 0x438d6c
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0xd8], eax
je 0x438d8c
cmp dword [ebp - 0x44], eax
je 0x438d8c
mov eax, edi
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, 0x350090e7
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xd8], eax
dec dword [ebp - 0x38]
jmp 0x438de2
mov dword [ebp - 0x30], 0xf1f47437
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x54], 0
cmp dword [ebp - 0x54], edi
jg 0x438de2
xor ebx, ebx
mov eax, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x110], ebx
jne 0x438ddf
inc dword [ebp - 0x54]
cmp dword [ebp - 0x54], edi
jle 0x438dcb
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x79c]
call fcn.0043557d
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0x24], 0x833fcb50
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
jmp 0x438e17
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc64], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x438e06
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x438e67
mov dword [ebp - 0x30], 0x6b8f3d42
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x438e47
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffd
jmp 0x438e5c
cmp dword [ebp - 0x30], eax
jne 0x438f9e
cmp dword [ebp - 0x18], 0x19
jge 0x438e50
jmp 0x438f9e
mov dword [ebp - 0x40], 0x9339b884
mov dword [ebp - 0x40], 0xfe1f230b
mov dword [ebp - 0x40], 0xdd8e181f
mov dword [ebp - 0x40], 7
mov dword [ebp - 0x40], 0x7f5e1753
mov dword [ebp - 0x1c], eax
jmp 0x438ea0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2bc], 0x188047d2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x438e8f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2b4]
mov eax, dword [ebp - 0x2bc]
mov eax, dword [ebp - 0x2bc]
imul eax, dword [ebp - 0x2bc], 0xf7d2
add eax, 0x2e0f2044
xor ecx, ecx
cmp eax, 0x9f19
setle cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2b4]
neg ecx
sbb ecx, ecx
add ecx, 0x94b8e204
neg ecx
sbb ecx, ecx
inc ecx
mov eax, dword [ebp - 0x2b8]
sub ecx, eax
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], 0
jmp 0x438f95