Function at 0x4217b6
Capabilities:
Compare security identifiers
Contain obfuscated stackstrings
Query environment variable
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowPlacement]
mov esi, ecx
push 0
mov dword [ebp - 8], 0x31713b91
pop eax
mov dword [ebp - 8], 0x10
cmp dword [ebp - 8], 0xffffffea
push 1
mov dword [ebp - 0x48], esi
pop ebx
jg 0x421892
mov dword [ebp - 0x20], 0x38b6b0e1
mov dword [ebp - 0x18], 0x7359b504
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x42180e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
xor eax, eax
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setge dl
mov dword [ebp - 0x28], edx
xor edx, edx
cmp dword [ebp - 0x28], ecx
setg dl
xor ecx, ecx
cmp edx, 1
setge cl
cmp ecx, dword [ebp - 8]
jle 0x421856
cmp dword [ebp - 8], eax
je 0x421856
xor ecx, ecx
inc ecx
jmp 0x421858
mov ecx, eax
xor ebx, ebx
cmp ecx, 0x8594
mov ecx, dword [ebp - 8]
setle bl
sub ebx, 0xfffffffb
neg ebx
sbb ebx, ebx
add ebx, 0x82d58162
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
setg dl
mov dword [ebp - 0x20], edx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffea
jle 0x4217eb
xor ebx, ebx
inc ebx
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x280]
mov dword [ebp - 0x120], eax
push ecx
lea ecx, [ebp - 0x290]
mov dword [ebp - 0x11c], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x118], eax
push eax
lea ecx, [ebp - 0x120]
movdqu xmmword [ebp - 0x290], xmm0
call fcn.00408ca2
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], 0
jl 0x42190b
mov byte [ebp - 0x19], 0
cmp byte [ebp - 0x19], 0
je 0x421906
push 0x104e
push 0xbe3
push 0xf5f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
dec dword [ebp - 0x24]
jns 0x4218e0
lea ecx, [ebp - 0x120]
call fcn.00408170
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x14], 7
jmp 0x42195f
mov byte [ebp - 0x19], 0
cmp byte [ebp - 0x19], 0
je 0x42194c
push 0x1de3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov byte [ebp - 0x19], 0
cmp byte [ebp - 0x19], 0
je 0x42195c
call dword [sym.imp.USER32.dll_GetMessageTime]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff9
jge 0x421929
mov dword [ebp - 0xc], 0x31713b91
mov dword [ebp - 0xc], 0x10
cmp dword [ebp - 0xc], 0xffffffea
jg 0x422130
push 3
pop esi
mov dword [ebp - 0x24], 7
mov dword [ebp - 8], 0
jmp 0x42199e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x7c], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x421990
mov dword [ebp - 8], 0
jmp 0x4219be
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x304], 0xf20920a6
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4219ad
mov eax, dword [ebp - 0x78]
xor edx, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
add ecx, 0xc174
cmp eax, ecx
mov ecx, dword [ebp - 0x24]
setne dl
lea eax, [edx - 0x689a]
add ecx, eax
imul eax, ecx, 0x8807
add eax, dword [ebp - 0x78]
dec eax
neg eax
sbb eax, eax
neg eax
add eax, 0x5206
mov dword [ebp - 0x24], eax
je 0x421a0c
cmp dword [ebp - 0x24], 0
je 0x421a0c
mov edx, ebx
jmp 0x421a0e
xor edx, edx
mov eax, dword [ebp - 0x78]
xor ecx, ecx
cmp edx, eax
push 2
setge cl
mov dword [ebp - 0x300], ecx
lea ecx, [ebp - 0x228]
mov dword [ebp - 0x30], 0x38b6b0e1
call fcn.0040809e
mov dword [ebp - 0x14], 0xb0647dc4
lea ecx, [ebp - 0x278]
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x2c], 0x624cdb8f
mov dword [ebp - 0x2c], 0xe77ab392
push ebx
call fcn.0040809e
push dword [ebp - 0x4c]
movdqa xmm0, xmmword [str._t_t_t_t]
lea ecx, [ebp - 0x2c0]
push ecx
xor eax, eax
mov dword [ebp - 0x2c], 0x18e418a5
lea ecx, [ebp - 0x2d0]
mov dword [ebp - 0xcc], eax
push ecx
push eax
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xc8], eax
movdqu xmmword [ebp - 0x2d0], xmm0
mov dword [ebp - 0xc4], eax
call fcn.00408ca2
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x421abc
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x228]
mov dword [ecx + edx*4], 0xca631852
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x421aa9
mov dword [ebp - 8], eax
jmp 0x421ad6
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x278]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x421ac7
mov ecx, dword [ebp - 0xcc]
inc dword [ecx + 0xc]
mov dword [ebp - 0x14], 0xffffffe2
jmp 0x421afc
mov dword [ebp - 0x28], 0x5fff
cmp dword [ebp - 0x28], eax
jne 0x421b02
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x15
jge 0x421aed
lea ecx, [ebp - 0xcc]
call fcn.00408170
lea ecx, [ebp - 0x278]
call fcn.00408170
lea ecx, [ebp - 0x228]
call fcn.00408170
mov dword [ebp - 0x18], 0x7359b504
xor eax, eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 8], eax
jmp 0x421b5d
mov dword [ebp - 0x14], 0xdb22124f
mov dword [ebp - 0x14], 0xffffffea
jmp 0x421b54
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xd
jg 0x421b4b
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xe
jl 0x421b3b
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x14], eax
jmp 0x421b87
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x68], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x421b79
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x17
jl 0x421d83
mov dword [ebp - 8], 0xdbeccce1
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x20], 0xad46d232
push ebx
call fcn.0040809e
mov dword [ebp - 0x28], 0x6ab81d4b
mov dword [ebp - 8], 0
jmp 0x421bd6
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x421bc3
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 2
jg 0x421d2f
push ebx
lea ecx, [ebp - 0xdc]
call fcn.0040809e
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], eax
jmp 0x421c18
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xdc]
mov dword [ecx + edx*4], 0x3f9e923e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x421c05
mov ecx, dword [ebp - 0xdc]
mov dword [ecx], eax
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x421c41
push 0x6e0
push 0x258
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
xor eax, eax
mov ecx, dword [ebp - 0xdc]
inc dword [ecx]
cmp dword [ecx], 2
jle 0x421c25
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x68], eax
je 0x421ccc
cmp dword [ebp - 0x14], eax
jne 0x421c5f
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xdc]
sub edx, 0x250042
neg edx
sbb edx, edx
inc edx
mov dword [ecx], edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x68]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x144]
mov dword [ecx], edx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp + ecx*4 - 0x68]
xor ecx, ecx
cmp edx, 0xfffffff9
sete cl
xor edx, edx
cmp ecx, esi
setle dl
sub edx, 8
cmp edx, dword [ebp - 0x24]
jl 0x421ccc
mov ecx, dword [ebp - 0x144]
mov edx, ebx
cmp dword [ecx], eax
jne 0x421cce
mov edx, eax
mov eax, dword [ebp - 0x60]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x68]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 8]
sete bl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x68]
sub ebx, eax
mov eax, dword [ebp - 0x18]
cmp ebx, 1
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
lea ecx, [ebp - 0xdc]
setl dl
mov dword [ebp - 0x28], edx
call fcn.00408170
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
push 1
pop ebx
jle 0x421bec
mov byte [ebp - 0x19], 0
cmp byte [ebp - 0x19], 0
je 0x421d66
push 0x242f
push 0xabc
push 0xa6
push 0x2519
push 0x1913
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
lea ecx, [ebp - 0x144]
call fcn.00408170
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
jge 0x421b99
push 3
xor eax, eax
pop esi
mov byte [ebp - 1], al
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 8], 0xfffffff8
push esi
call fcn.0040809e
xor eax, eax
mov dword [ebp - 0x28], 0x51fa4c82
mov dword [ebp - 0x10], eax
jmp 0x421dba
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1e4]
mov dword [ecx + edx*4], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x421da7
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], al
je 0x421dd0
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor eax, eax
cmp dword [ebp - 8], eax
je 0x421e16
mov ecx, dword [ebp - 8]
xor edx, edx
test ecx, ecx
sets dl
cmp edx, dword [ebp - 8]
jle 0x421deb
mov edx, eax
cmp dword [ebp - 8], eax
je 0x421ded
mov edx, ebx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
mov eax, 0xfa3dfad5
setle cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 0xa3d7f191
ja 0x421e0c
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov edx, ebx
mov eax, dword [ebp - 8]
jmp 0x421e18
mov edx, eax
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1e4]
setge cl
xor edx, edx
imul ecx, dword [eax + 8]
mov eax, dword [ebp - 8]
cmp ecx, 0xc4c8
setne dl
xor ecx, ecx
cmp eax, edx
setl cl
imul ecx, dword [ebp - 8]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x1e4]
call fcn.00408170
cmp byte [ebp - 1], 0
je 0x421f8c
mov dword [ebp - 0x20], 0xfd47030f
xor eax, eax
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x18], 0x39425a33
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 8], eax
jmp 0x421e8e
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x38], 8
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x421e80
mov dword [ebp - 8], eax
jmp 0x421ea7
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x80], 0xc1a1fd29
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x421e99
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x38]
sub ecx, 0x73744644
jne 0x421ec7
mov edx, eax
cmp dword [ebp - 0x38], eax
je 0x421ec9
mov edx, ebx
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
add edx, ecx
mov ecx, dword [ebp - 0x38]
cmp edx, ecx
setle bl
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 0x34]
dec ecx
cmp ecx, 0x2b99
jg 0x421eee
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], eax
je 0x421f15
cmp dword [ebp - 0x20], eax
je 0x421f15
xor esi, esi
inc esi
jmp 0x421f17
mov esi, eax
mov ecx, dword [ebp - 0x38]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x38]
sete dl
imul ecx, edx
neg ecx
sbb ecx, ecx
add ecx, 0x6ea1325b
mov dword [ebp - 0x80], ecx
je 0x421f40
cmp dword [ebp - 0x80], eax
je 0x421f40
xor esi, esi
inc esi
jmp 0x421f42
mov esi, eax
mov ecx, dword [ebp - 0x38]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x34]
setl dl
cmp edx, 0xefd52276
sbb edx, edx
inc edx
sub edx, ecx
mov ecx, dword [ebp - 0x34]
neg edx
sbb edx, edx
neg edx
imul ecx, edx
cmp ecx, dword [ebp - 0x38]
jge 0x421f6e
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
sub ecx, 0xfffb
neg ecx
push eax
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push 3
pop esi
xor ebx, ebx
mov dword [ebp - 0x20], 0xb903cfcb
inc ebx
lea ecx, [ebp - 0x1d8]
mov dword [ebp - 0x18], ebx
push 2
call fcn.0040809e
mov dword [ebp - 0x20], ebx
lea ecx, [ebp - 0x1b4]
mov dword [ebp - 0x20], 0xf50e16ff
push esi
call fcn.0040809e
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x421fd1
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x44], 0xd7d490c4
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x421fc3
mov dword [ebp - 8], eax
jmp 0x421fe8
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xc0], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x421fdb
mov dword [ebp - 8], eax
jmp 0x422005
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1d8]
mov dword [ecx + edx*4], 0x6fc75dfc
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x421ff2
mov dword [ebp - 8], eax
jmp 0x422023
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1b4]
mov dword [ecx + edx*4], 0x3333
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x422010
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0xc0]
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xb8]
cmp dword [ebp - 0x44], eax
jne 0x422066
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x1d8]
cmp dword [ecx], eax
setge dl
imul edx, dword [ecx + 4]
mov dword [ebp - 0x20], edx
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1b4]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x1b4]
call fcn.00408170
lea ecx, [ebp - 0x1d8]
call fcn.00408170
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0xc]
setge bl
xor ecx, ecx
cmp ebx, eax
setg cl
xor ebx, ebx
xor eax, eax
inc ebx
cmp ecx, ebx
setge al
cmp eax, dword [ebp - 0xc]
jle 0x4220f5
cmp dword [ebp - 0xc], 0
je 0x4220f5
mov eax, ebx
jmp 0x4220f7
xor eax, eax
xor edx, edx
cmp eax, 0x8594
mov eax, dword [ebp - 0xc]
setle dl
sub edx, 0xfffffffb
neg edx
sbb edx, edx
add edx, 0x82d58162
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffea
jle 0x421980
mov esi, dword [ebp - 0x48]
push 2
pop edi
push edi
lea ecx, [ebp - 0x240]
call fcn.0040809e
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
jmp 0x42215f
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x240]
mov dword [ecx + edx*4], 0xfffffff9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x42214c
mov dword [ebp - 0x14], eax
jmp 0x42219c
mov dword [ebp - 0x2c], 0x87f2fb5a
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x18], 0xe4b7834d
mov dword [ebp - 0x10], eax
jmp 0x422191
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x50], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x422183
inc dword [ebp - 0x18]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x422169
lea ecx, [ebp - 0x240]
call fcn.00408170
cmp dword [esi], 0
je 0x423943
push dword [esi]
push 0
push dword [esi + 4]
call fcn.0046cdb7
add esp, 0xc
mov dword [ebp - 8], 0xc692beaa
lea ecx, [ebp - 0x234]
push ebx
call fcn.0040809e
xor eax, eax
mov dword [ebp - 0x28], 0x430688cd
mov dword [ebp - 0x10], eax
jmp 0x4221f8
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x234]
mov dword [ecx + edx*4], 0xfffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4221e5
cmp dword [ebp - 8], eax
je 0x42228e
push edi
lea ecx, [ebp - 0x174]
call fcn.0040809e
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x42222c
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x174]
mov dword [ecx + edx*4], 0x2d1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x422219
mov ecx, dword [ebp - 0x174]
dec dword [ecx + 4]
mov dword [ebp - 8], eax
jmp 0x422278
mov dword [ebp - 0x14], 0x46b6eb6b
mov dword [ebp - 0x14], eax
jmp 0x42225e
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x174]
mov dword [ecx + edx*4], 0xfffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x42224b
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x422275
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x18
jne 0x42223f
lea ecx, [ebp - 0x174]
call fcn.00408170
jmp 0x422338
mov dword [ebp - 0x20], 0x982b357f
mov dword [ebp - 8], eax
jmp 0x42232f
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jg 0x42230a
mov dword [ebp - 0x18], 0xc00eadd5
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
test ecx, ecx
mov ecx, dword [ebp - 0x20]
setle bl
xor edx, edx
dec ebx
cmp ebx, ecx
setne dl
cmp edx, dword [ebp - 0x20]
jne 0x4222e4
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x28], ecx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x4222ff
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x4222a8
xor ebx, ebx
inc ebx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x42232c
push eax
push 0x5bc
push eax
push 0x19d9
push 0x91f
call dword [sym.imp.GDI32.dll_ExtCreatePen]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], eax
jle 0x42229d
lea ecx, [ebp - 0x234]
call fcn.00408170
xor eax, eax
mov dword [ebp - 0x24], 0xf9c2
mov dword [ebp - 0x190], eax
lea ecx, [ebp - 0x1cc]
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x184], eax
push 3
call fcn.0040809e
xor eax, eax
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0xc], eax
jmp 0x422390
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x9c], 0xf2e5664d
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x42237f
mov dword [ebp - 0xc], eax
jmp 0x4223aa
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1cc]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x42239a
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x188], ecx
cmp dword [ebp - 0x24], eax
jne 0x4223fe
cmp dword [ebp - 0x98], eax
je 0x4223cc
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x1cc]
cmp dword [ecx + 8], eax
je 0x4223e1
mov esi, ebx
cmp dword [ebp - 0x98], eax
jne 0x4223e3
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
cmp esi, ecx
setg dl
cmp dword [ebp - 0x98], edx
jge 0x4223fa
cmp dword [ebp - 0x24], eax
jne 0x4223fe
mov edx, eax
jmp 0x422400
mov edx, ebx
mov eax, dword [ebp - 0x98]
xor ecx, ecx
cmp eax, edx
mov dword [ebp - 0x188], eax
setge cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x1cc]
call fcn.00408170
push dword [ebp - 0x50]
lea ecx, [ebp - 0x290]
xor eax, eax
push ecx
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 0x12c], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x128], eax
push eax
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x124], eax
movdqu xmmword [ebp - 0x2a0], xmm0
call fcn.00408ca2
push 3
lea ecx, [ebp - 0x15c]
call fcn.0040809e
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x10], 0
jmp 0x42248d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x15c]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x42247a
mov dword [ebp - 0xc], edi
cmp dword [ebp - 0xc], 0
jl 0x4225b0
mov dword [ebp - 0x14], 0x6ec79cf1
mov dword [ebp - 0x114], 0xffffffff
mov dword [ebp - 0x110], 0xffffffff
mov dword [ebp - 0x10c], 0xffffffff
mov dword [ebp - 0x108], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x15c]
imul eax, dword [eax + ecx*4], 9
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x14], 0x19
cmp dword [ebp - 0x14], 0x1b
jge 0x4225a7
mov esi, dword [ebp - 0x15c]
push dword [ebp - 0x50]
movdqa xmm0, xmmword [0xa6be30]
lea eax, [ebp - 0x2b0]
and dword [ebp - 0xec], 0
lea ecx, [ebp - 0xec]
and dword [ebp - 0xe8], 0
and dword [ebp - 0xe4], 0
push eax
lea eax, [ebp - 0x2c0]
push eax
push 0
movdqu xmmword [ebp - 0x2c0], xmm0
call fcn.00408ca2
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
mov dword [ebp - 0x28], 0xfffffff7
mov eax, dword [ebp - 0x28]
add eax, 0x78f1e0c8
add eax, ecx
xor ecx, ecx
cmp eax, dword [esi + 8]
mov eax, dword [ebp - 0x10c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xec]
sete dl
imul edx, dword [eax + 0xc]
cmp dword [ebp - 0xc], edx
jne 0x422587
cmp dword [ebp - 0xc], 0
je 0x422587
mov eax, ebx
jmp 0x422589
xor eax, eax
mov dword [ebp - 0x114], eax
lea ecx, [ebp - 0xec]
call fcn.00408170
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1b
jl 0x4224ff
dec dword [ebp - 0xc]
jns 0x4224a0
lea ecx, [ebp - 0x15c]
call fcn.00408170
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x24], 0x7a00
push 3
call fcn.0040809e
mov dword [ebp - 0x20], 0x57b5bf2d
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x2c], 0x5ec35211
mov dword [ebp - 0x10], eax
jmp 0x42260b
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c0]
mov dword [ecx + edx*4], 0xc74aa0d7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x4225f8
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x42263f
push 0xe14
push eax
push 0x45b
push 0x14f6
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov ecx, dword [ebp - 0x24]
xor eax, eax
mov esi, dword [ebp - 0x1c0]
mov dword [esi], ecx
cmp dword [esi + 8], ecx
setne al
add eax, ecx
cmp eax, 0xfffb
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
imul ecx, dword [esi + 8]
test ecx, ecx
jne 0x422672
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x24]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl cl
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
lea ecx, [ebp - 0x1c0]
call fcn.00408170
push 3
pop esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x10], 0
jmp 0x4226ef
mov dword [ebp - 0x14], 0xdb22124f
mov dword [ebp - 0x14], 0xffffffea
jmp 0x4226e6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xd
jg 0x4226dd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xe
jl 0x4226cd
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], 0
jl 0x422b70
mov dword [ebp - 0xc], 0x48af
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x18], 0xb8b78acc
mov dword [ebp - 0x14], 0x642e40c1
push esi
call fcn.0040809e
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x422741
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x26c]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x422731
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
xor ecx, ecx
sub edx, dword [ebp - 0xc]
imul edx, dword [ebp - 0xc]
push 2
pop esi
sub edx, 0xf628
cmp edx, 0x7e78
setl cl
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
mov ecx, dword [ebp - 0xc]
setne bl
xor edx, edx
cmp ebx, ecx
mov ecx, 0xfafd11d9
setg dl
sub ecx, edx
sub ecx, dword [ebp - 0x14]
sub ecx, esi
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0xc]
jne 0x42279a
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], 0x2da3c3d2
cmp dword [ebp - 0x18], eax
je 0x4227bb
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x4227d3
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x4227d3
mov dword [ebp - 0x14], eax
jmp 0x4227cd
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xc5c6a3f1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x14
jne 0x4227c0
lea ecx, [ebp - 0x26c]
call fcn.00408170
xor ebx, ebx
lea ecx, [ebp - 0x24c]
inc ebx
push ebx
call fcn.0040809e
mov dword [ebp - 0x14], 0xfffffff6
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x24], 0x3a266d21
mov dword [ebp - 8], 0x3bd65256
push 5
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x28], 0xc173
mov dword [ebp - 0xc], eax
jmp 0x42282f
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24c]
mov dword [ecx + edx*4], 0xa5d6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x42281c
mov dword [ebp - 0xc], eax
jmp 0x42284a
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x88], 0x1d14cd49
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x422839
mov dword [ebp - 0x14], eax
jmp 0x42288c
mov dword [ebp - 0xc], 0xede0b407
mov dword [ebp - 0xc], eax
jmp 0x422884
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], eax
jmp 0x42287c
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x422879
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x422868
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x422860
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x422854
mov ecx, dword [ebp - 0x18]
xor edx, edx
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x88]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x88]
cmp ecx, esi
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x84]
setl dl
add esi, edx
xor edx, edx
cmp esi, ecx
setne dl
mov dword [ebp - 0x84], edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x30], 0xfffffff8
je 0x4228e3
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x24c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
call fcn.00408170
xor eax, eax
mov byte [ebp - 0x19], al
mov dword [ebp - 0xc], 0x4a8c6a53
mov dword [ebp - 0xc], eax
jmp 0x4229ab
mov dword [ebp - 0x14], 0x2a1836cc
mov dword [ebp - 0x10], eax
jmp 0x422937
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x2f4], 0x4288a137
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x422926
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x422950
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4229a3
mov dword [ebp - 0x10], eax
jmp 0x42296b
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x210], 0xb283066c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x42295a
mov dword [ebp - 0x204], ebx
cmp dword [ebp - 0x204], eax
jl 0x4229a0
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x422998
push 0x147f
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
dec dword [ebp - 0x204]
jns 0x42297f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x422955
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x12
jg 0x42291a
cmp byte [ebp - 0x19], 0
je 0x422b64
push ebx
lea ecx, [ebp - 0x1f0]
call fcn.0040809e
mov dword [ebp - 0x14], 0xffffffff
xor eax, eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0xa9d01274
mov dword [ebp - 0xc], eax
jmp 0x4229f6
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1f0]
mov dword [ecx + edx*4], 0x2799
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x4229e3
mov dword [ebp - 0xc], eax
jmp 0x422a11
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x1a8], 0x2fa4ad74
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x422a00
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x422b41
push dword [ebp - 0x50]
movdqa xmm0, xmmword [0xa6be90]
lea ecx, [ebp - 0x2d0]
push ecx
lea ecx, [ebp - 0x2e0]
mov dword [ebp - 0x2c], 0xfffffff8
push ecx
mov dword [ebp - 0x2c], 0x14173bf3
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x10], 0xa50b5f0b
push eax
movdqu xmmword [ebp - 0x2e0], xmm0
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
call fcn.00408ca2
xor eax, eax
mov dword [ebp - 0x28], 0xbdf607db
mov dword [ebp - 0x10], eax
jmp 0x422a8f
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x6c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x422a85
mov esi, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1f0]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ecx + esi*4]
mov esi, ebx
inc dword [ebp - 0x24]
cmp ecx, edx
mov ecx, dword [ebp - 0x14]
cmovg esi, eax
xor edx, edx
cmp esi, ecx
setle dl
imul ecx, edx, 0x6d56
test ecx, ecx
je 0x422ae3
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x422aea
push 0x1b5
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
jmp 0x422aea
mov dword [ebp - 0x10], 0xa4e63097
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x422b2a
mov dword [ebp - 0x30], 0xffffffff
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x1a8]
cmp dword [ebp - 0x1a8], eax
jne 0x422b20
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x422b22
mov ecx, ebx
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x10]
jns 0x422af2
lea ecx, [ebp - 0x180]
call fcn.00408170
dec dword [ebp - 0x14]
push 0
pop eax
jns 0x422a23
lea ecx, [ebp - 0x1f0]
call fcn.00408170
push 0x104e
push 0xbe3
push 0xf5f
call edi
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
dec dword [ebp - 0x20]
push 3
pop esi
jns 0x422702
lea ecx, [ebp - 0x12c]
call fcn.00408170
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x18], 0x5d16
mov dword [ebp - 0x28], 0x33563700
mov dword [ebp - 0x2c], ebx
inc dword [ebp - 0x18]
je 0x422bf2
mov dword [ebp - 0x10], 0x717b
xor edx, edx
mov dword [ebp - 0x20], 8
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
je 0x422bc6
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], 0
je 0x422bd2
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x422c14
push 0x494
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
jmp 0x422c14
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x422c14
push 0x104e
push 0xbe3
push 0xf5f
call edi
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov eax, dword [ebp - 0x48]
push dword [eax + 4]
call fcn.0046e118
xor eax, eax
mov dword [ebp - 8], 0xcff0ea75
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
pop ecx
jne 0x422d60
push ebx
lea ecx, [ebp - 0x94]
call fcn.0040809e
xor eax, eax
mov dword [ebp - 0xc], 4
mov dword [ebp - 0xc], eax
jmp 0x422c60
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x94]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x422c50
mov dword [ebp - 0xc], eax
jmp 0x422c7b
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xd0], 0xe149cff2
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x422c6a
mov ecx, dword [ebp - 0x94]
mov dword [ecx], 0x108f8256
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jl 0x422d46
mov dword [ebp - 0x28], 0x6cd8
mov dword [ebp - 0x18], 9
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x422cc1
push 0x204e
push 0xd8f
call dword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
mov ecx, dword [ebp - 0x94]
cmp dword [ecx], eax
je 0x422d0c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x94]
mov ecx, dword [ecx + edx*4]
mov dword [ebp - 0x28], ecx
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x94]
mov esi, dword [edx + esi*4]
xor edx, edx
sub esi, ecx
mov ecx, dword [ebp - 8]
sub esi, ecx
mov ecx, dword [ebp - 0x94]
cmp dword [ecx], esi
setge dl
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xd0], 7
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x94]
cmp dword [ecx + edx*4], 0x2b7d1
setge bl
mov dword [ecx + esi*4], ebx
dec dword [ebp - 0xc]
jns 0x422c98
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x94]
call fcn.00408170
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xb
je 0x422c36
xor eax, eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], 0xffff
push 2
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], eax
pop esi
jmp 0x422d83
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x5c], 0xfffffffb
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x422d75
mov dword [ebp - 0xc], eax
jmp 0x422d9e
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xf0], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x422d8d
cmp dword [ebp - 8], eax
je 0x422dcd
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x422e50
push 0x262e
push eax
push 0x14da
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor eax, eax
jmp 0x422e50
mov dword [ebp - 0x28], eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x422dec
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x422e4b
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x5c]
cmp ecx, 0xfffffff7
setle dl
sub edx, dword [ebp - 0x28]
je 0x422e08
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x5c]
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x58]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x5c]
mov ecx, dword [ebp - 0x20]
cmp ecx, edx
mov ecx, dword [ebp - 8]
setne bl
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x5c]
cmp ecx, ebx
mov ecx, dword [ebp - 8]
setle dl
xor ebx, ebx
imul edx, dword [ebp + ecx*4 - 0x5c]
mov dword [ebp - 0xf0], edx
inc dword [ebp - 8]
inc ebx
cmp dword [ebp - 8], ebx
jle 0x422df1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x422e76
push eax
push 0x23b3
push 0x1f47
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 4
mov dword [ebp - 0xc], ebx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xfffffffb
je 0x422f3a
mov dword [ebp - 0x18], 0x948b
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x3c], 0xdc1094d0
mov dword [ebp - 0x10], eax
jmp 0x422ebd
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x2ec], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x422eac
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x422edb
push 0x117f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
cmp dword [ebp - 0xc], eax
jne 0x422eeb
cmp dword [ebp - 0x18], eax
je 0x422ee8
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov edx, ebx
sub edx, ecx
je 0x422ef7
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
xor ebx, ebx
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
mov ecx, dword [ebp - 0xc]
setne bl
xor edx, edx
sub ebx, 0x7b1b0cad
cmp ebx, ecx
push 1
setge dl
imul edx, dword [ebp - 0x20]
pop ebx
lea ecx, [edx - 0x6a6cfc04]
mov dword [ebp - 0x2ec], ecx
mov dword [ebp - 0x3c], ecx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffb
jne 0x422e96
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0x14], 0xffffffff
push ebx
call fcn.0040809e
mov dword [ebp - 0x2c], 0xc42206dd
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xc59458d8
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0xc], eax
jmp 0x422f85
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x21c]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x422f76
mov dword [ebp - 0xc], eax
jmp 0x422f9c
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x260], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x422f8f
mov dword [ebp - 0x14], 0xc
jmp 0x42300e
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xc3a0b8ee
mov dword [ebp - 0x2c], 0xafcb143e
mov dword [ebp - 0x2c], 0x9bf9f361
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x10], eax
jmp 0x422fec
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xe0], 0xdfba22e9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x422fdb
dec dword [ebp - 0x18]
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x42300b
push eax
push 0x1f91
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jl 0x422faa
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x42302d
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
lea ecx, [ebp - 0x21c]
call fcn.00408170
mov dword [ebp - 0x24], 7
cmp dword [ebp - 0x24], 0xfffffff9
jl 0x4236b4
mov eax, 0x170cd509
mov dword [ebp - 0xc], 0x91a049fe
mov dword [ebp - 0x25c], eax
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], eax
mov dword [ebp - 0xc], 0xe
jmp 0x423149
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0xfffffff4
jmp 0x42313c
mov dword [ebp - 0x104], 0x65653d42
mov dword [ebp - 0x100], 0x65653d42
mov dword [ebp - 0xfc], 0x65653d42
mov dword [ebp - 0xf8], 0x65653d42
mov dword [ebp - 0x100], 3
cmp dword [ebp - 0x100], 0
jl 0x423139
push ebx
lea ecx, [ebp - 0x138]
call fcn.0040809e
mov dword [ebp - 0x10], 0
jmp 0x4230ec
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x138]
and dword [eax + ecx*4], 0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4230dc
mov eax, dword [ebp - 0x138]
mov dword [eax], 3
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x42311c
push 0x10dc
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov eax, dword [ebp - 0x138]
dec dword [eax]
jns 0x4230fd
lea ecx, [ebp - 0x138]
call fcn.00408170
dec dword [ebp - 0x100]
jns 0x4230c7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff6
jle 0x42308c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1d
jge 0x423079
mov dword [ebp - 0x14], 0x57e8
mov dword [ebp - 0x18], 0x9c710427
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x18], 0xe283bc1b
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x14], 9
jne 0x4231d1
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
imul eax, dword [ebp - 0x18], 0x5a59
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0x574b
setl cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x20]
jne 0x4231d1
mov ecx, ebx
xor eax, eax
jmp 0x4231d5
xor eax, eax
mov ecx, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x4231f3
push eax
push 0x125e
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
mov byte [ebp - 1], al
mov dword [ebp - 0x18], 0xd00585b7
mov dword [ebp - 0x14], 0x9bacc5d9
mov dword [ebp - 0x20], 0xf4326038
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x10], eax
jmp 0x42322c
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x74], 0xfff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x42321e
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x70]
cmp edx, ecx
mov ecx, dword [ebp - 0x70]
setge bl
xor edx, edx
cmp ebx, ecx
setl dl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
add edx, ecx
mov ecx, dword [ebp - 0x70]
cmp edx, 0xffff
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, 0x8e56
setle bl
sub ecx, ebx
mov dword [ebp - 0x14], ecx
cmp byte [ebp - 1], 0
je 0x4233ee
mov dword [ebp - 8], 0xcff0ea75
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xb
jne 0x4233d7
push 1
lea ecx, [ebp - 0xa8]
call fcn.0040809e
xor eax, eax
mov dword [ebp - 0xc], 4
mov dword [ebp - 0xc], eax
jmp 0x4232d7
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xa8]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x4232c7
mov dword [ebp - 0xc], eax
jmp 0x4232f3
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xf4], 0xe149cff2
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x4232e2
mov ecx, dword [ebp - 0xa8]
mov dword [ecx], 0x108f8256
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], eax
jl 0x4233bc
mov dword [ebp - 0x28], 0x6cd8
mov dword [ebp - 0x18], 9
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x42333a
push 0x204e
push 0xd8f
call dword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx], eax
je 0x423385
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ecx + edx*4]
mov dword [ebp - 0x28], ecx
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xa8]
mov esi, dword [edx + esi*4]
xor edx, edx
sub esi, ecx
mov ecx, dword [ebp - 8]
sub esi, ecx
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx], esi
setge dl
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0xf4], 7
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + edx*4], 0x2b7d1
setge bl
mov dword [ecx + esi*4], ebx
dec dword [ebp - 0xc]
jns 0x423311
lea ecx, [ebp - 0xa8]
call fcn.00408170
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xb
je 0x4232ac
push 2
pop esi
push 0x1de3
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
xor eax, eax
push dword [ebp - 0xe0]
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 0x19], al
push ecx
lea ecx, [ebp - 0x2b0]
mov dword [ebp - 0x150], eax
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x14c], eax
push eax
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x148], eax
movdqu xmmword [ebp - 0x2b0], xmm0
call fcn.00408ca2
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 3
cmp dword [ebp - 0x20], 0
jl 0x423469
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x423464
push 0x104e
push 0xbe3
push 0xf5f
call edi
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
dec dword [ebp - 0x20]
jns 0x423442
lea ecx, [ebp - 0x150]
call fcn.00408170
cmp byte [ebp - 0x19], 0
je 0x423699
mov dword [ebp - 0x14], 0x24a8c6a5
lea ecx, [ebp - 0x168]
mov dword [ebp - 0xc], 0x29aa810d
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x20], 0x7f8b4dfe
mov dword [ebp - 0x10], 0xe3f9150f
mov dword [ebp - 0x30], 0x9740826f
push esi
call fcn.0040809e
mov dword [ebp - 0x2c], 0x697
xor eax, eax
mov dword [ebp - 0x28], 0xf3b720fa
mov dword [ebp - 8], eax
jmp 0x4234da
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x200], 0x5ee56e31
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4234c9
mov dword [ebp - 8], eax
jmp 0x4234f8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x168]
mov dword [ecx + edx*4], 0x4bf7a832
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4234e5
xor ebx, ebx
mov dword [ebp - 8], eax
inc ebx
jmp 0x42350f
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x4c], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x423505
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x17
jne 0x423619
mov edi, dword [ebp - 0x168]
mov dword [ebp - 8], 0xb283066c
mov dword [ebp - 0x54], 5
mov dword [ebp - 0x3c], 0xa3187110
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x40], 0x8f1edd1e
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x10], eax
jmp 0x423563
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x280], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x423556
dec dword [ebp - 0x20]
je 0x4235a0
mov edx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x280]
neg edx
mov ecx, dword [ebp - 0x1f8]
sbb edx, edx
neg edx
add ecx, edx
xor edx, edx
cmp ecx, 0xfffffffe
mov dword [ebp - 0x1fc], ecx
mov ecx, ebx
setge dl
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xb323fa9d
jne 0x4235a2
mov ecx, eax
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp - 0x20]
sub esi, 9
neg esi
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x30]
cmp esi, ecx
setl dl
mov dword [ebp - 0x10], edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 0x3c]
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x54]
setge bl
xor edx, edx
cmp ecx, ebx
setge dl
xor ebx, ebx
sub edx, dword [ebp - 0x40]
inc ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc dword [ebp - 8]
cmp edx, ecx
jne 0x4235f9
mov esi, eax
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp esi, ecx
push 2
setg dl
sub edx, dword [ebp - 0x14]
mov dword [edi + 4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
pop esi
je 0x423527
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x168]
mov dword [ecx + 4], ebx
mov ecx, dword [ebp - 0xc]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x42363b
cmp dword [ebp - 0x30], eax
je 0x42363d
mov eax, ebx
xor ecx, ecx
cmp eax, 0x295d0c5f
mov eax, dword [ebp - 0x20]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x200]
sub ecx, eax
mov eax, dword [ebp - 0x28]
add eax, ecx
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x4c], eax
call fcn.00408170
call dword [sym.imp.USER32.dll_GetMessageTime]
jmp 0x42369c
xor ebx, ebx
inc ebx
dec dword [ebp - 0x24]
mov eax, 0x170cd509
cmp dword [ebp - 0x24], 0xfffffff9
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
jge 0x42304e
mov dword [ebp - 0x18], 0xd2086bd0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], 0x5ba13b28
mov dword [ebp - 0x40], 0xfffffff9
mov dword [ebp - 0x40], 0x6d8b
mov dword [ebp - 0x24], 0
jmp 0x4236ed
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1a0], 0x4a41637c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x4236dc
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x28], 0x5ca42045
mov eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp eax, ecx
push 6
setg dl
xor ecx, ecx
cmp edx, 0x2a17d0b0
mov dword [ebp - 0x19c], edx
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setg cl
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x19c], 0
mov byte [ebp - 1], 0
je 0x423765
cmp byte [ebp - 1], 0
je 0x42377f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x42377f
cmp byte [ebp - 1], 0
je 0x42377f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov eax, dword [ebp - 0x48]
lea ecx, [ebp - 0xb4]
push ebx
and dword [eax + 4], 0
call fcn.0040809e
mov dword [ebp - 8], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0x24], eax
jmp 0x4237c0
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xb4]
mov dword [ecx + edx*4], 0xc176
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x4237ad
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jl 0x4238f9
mov dword [ebp - 0xc], 0xafe8b0d1
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xb4]
mov ecx, dword [ecx]
mov dword [ebp - 0xc], ecx
mov edi, dword [ebp - 8]
mov ebx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xb4]
mov dword [ebp - 0x28], ecx
mov ecx, dword [esi]
cmp ecx, dword [esi + edi*4]
mov edi, dword [ebp - 0x54]
setl dl
xor ecx, ecx
cmp edx, dword [esi + ebx*4]
setle cl
cmp ecx, 1
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xb4]
sbb edx, edx
xor ebx, ebx
neg edx
add edx, 2
cmp ecx, edx
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x40]
setne bl
add ebx, dword [esi + ecx*4]
xor ecx, ecx
cmp ebx, dword [esi + edx*4]
setge cl
xor edx, edx
cmp ecx, dword [esi + edi*4]
mov ecx, dword [ebp - 0x28]
setl dl
imul edx, dword [esi + ecx*4]
imul ecx, edx, 0xcf5
test ecx, ecx
je 0x4238c0
mov dword [ebp - 0x24], eax
jmp 0x42387c
mov ecx, dword [ebp - 0x24]
mov dword [ebp + ecx*4 - 0x198], 0xffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x42386b
mov dword [ebp - 0xc], eax
jmp 0x4238b8
cmp dword [ebp - 0x194], eax
jne 0x4238ed
mov edx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0xb4]
cmp dword [ecx + edx*4], 0x7c422d5f
mov ecx, dword [ebp - 0x194]
setle bl
imul ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jge 0x423887
jmp 0x4238ed
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x4238ed
mov dword [ebp - 0xc], eax
jmp 0x4238e3
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x4238e0
push 0x71
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jle 0x4238cd
dec dword [ebp - 0x14]
jns 0x4238c8
dec dword [ebp - 8]
jns 0x4237d1
xor ebx, ebx
inc ebx
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x14]
sub edx, eax
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax]
neg ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
lea ecx, [ebp - 0xb4]
setne al
add eax, 0x3b10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x2c], ebx
call fcn.00408170
mov eax, dword [ebp - 0x48]
and dword [eax], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret