Function at 0x41f88d
Capabilities:
Get common file path
Get memory capacity
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004a5c60
push esi
mov dword [ebp - 8], 0
mov dword [ebp - 0x60], 1
push 2
lea ecx, [ebp - 0x1d8]
call fcn.0043324a
mov dword [ebp - 0x140], 0xefd6e511
mov dword [ebp - 0x20c], 0
jmp 0x41f8d9
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 2
jge 0x41f8f8
push dword [ebp - 0x20c]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
or dword [eax], 0xffffffff
jmp 0x41f8cc
cmp dword [ebp - 8], 0
je 0x41f9af
mov dword [ebp - 0x1e4], 0x29bf39
mov dword [ebp - 0x984], 1
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0xe44], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0xd34], eax
mov eax, 0xa290
test eax, eax
jne 0x41f994
cmp dword [ebp - 8], 0
je 0x41f949
mov dword [ebp - 0x4d8], 1
jmp 0x41f950
and dword [ebp - 0x4d8], 0
mov eax, dword [ebp - 0x4d8]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x1e4], eax
jg 0x41f979
mov dword [ebp - 0x8c0], 1
jmp 0x41f980
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x8c0]
jle 0x41f994
and dword [ebp - 0x8c8], 0
jmp 0x41f99e
mov dword [ebp - 0x8c8], 1
mov eax, dword [ebp - 0x8c8]
mov dword [ebp - 0x984], eax
jmp 0x41fa48
push 1
lea ecx, [ebp - 0xc2c]
call fcn.0043324a
mov dword [ebp - 0x268], 0
jmp 0x41f9d5
mov eax, dword [ebp - 0x268]
inc eax
mov dword [ebp - 0x268], eax
cmp dword [ebp - 0x268], 1
jge 0x41f9f7
push dword [ebp - 0x268]
lea ecx, [ebp - 0xc2c]
call fcn.00433338
mov dword [eax], 0xfffffffa
jmp 0x41f9c8
mov dword [ebp - 8], 0
jmp 0x41fa07
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x41fa23
push dword [ebp - 8]
lea ecx, [ebp - 0xc2c]
call fcn.00433338
mov dword [eax], 6
jmp 0x41fa00
mov byte [ebp - 0x10d], 0
movzx eax, byte [ebp - 0x10d]
test eax, eax
je 0x41fa3d
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
lea ecx, [ebp - 0xc2c]
call fcn.0043331c
mov dword [ebp - 0x60], 0
jmp 0x41fa58
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jg 0x4200a7
mov dword [ebp - 0x4c], 8
mov dword [ebp - 0xb8], 0xffffffff
push 3
lea ecx, [ebp - 0xaf4]
call fcn.0043324a
mov dword [ebp - 0x31c], 0xc12bbf3a
mov dword [ebp - 0x1ec], 0
jmp 0x41faa3
mov eax, dword [ebp - 0x1ec]
inc eax
mov dword [ebp - 0x1ec], eax
cmp dword [ebp - 0x1ec], 3
jge 0x41fac5
push dword [ebp - 0x1ec]
lea ecx, [ebp - 0xaf4]
call fcn.00433338
mov dword [eax], 0x8af3
jmp 0x41fa96
mov dword [ebp - 8], 1
jmp 0x41fad5
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x41fd28
mov eax, 0xdb5a
test eax, eax
je 0x41fafd
cmp dword [ebp - 0xb8], 0
je 0x41fafd
mov dword [ebp - 0x8ec], 1
jmp 0x41fb04
and dword [ebp - 0x8ec], 0
push dword [ebp - 8]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
mov ecx, dword [ebp - 0x8ec]
cmp ecx, dword [eax]
jl 0x41fb28
mov dword [ebp - 0xa0c], 1
jmp 0x41fb2f
and dword [ebp - 0xa0c], 0
push dword [ebp - 8]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
mov esi, dword [ebp - 0xb8]
push 0
lea ecx, [ebp - 0x1d8]
call fcn.00433338
sub esi, dword [eax]
push dword [ebp - 8]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
cmp esi, dword [eax]
je 0x41fb70
mov dword [ebp - 0x8f4], 1
jmp 0x41fb77
and dword [ebp - 0x8f4], 0
push dword [ebp - 8]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
mov ecx, dword [ebp - 0x8f4]
cmp ecx, dword [eax]
je 0x41fb9b
mov dword [ebp - 0x8fc], 1
jmp 0x41fba2
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x8fc], eax
jl 0x41fbb9
mov dword [ebp - 0x904], 1
jmp 0x41fbc0
and dword [ebp - 0x904], 0
cmp dword [ebp - 0x904], 0xb56c
jg 0x41fbd8
mov dword [ebp - 0x3ec], 1
jmp 0x41fbdf
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x3ec], eax
jge 0x41fbf9
mov dword [ebp - 0x354], 1
jmp 0x41fc00
and dword [ebp - 0x354], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x354], eax
jge 0x41fc1a
mov dword [ebp - 0x820], 1
jmp 0x41fc21
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x820]
jg 0x41fc40
push dword [ebp - 8]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
push dword [ebp - 8]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
mov esi, eax
push dword [ebp - 8]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x41fc70
mov dword [ebp - 0x35c], 1
jmp 0x41fc77
and dword [ebp - 0x35c], 0
push 0
lea ecx, [ebp - 0x1d8]
call fcn.00433338
mov ecx, dword [ebp - 0x35c]
cmp ecx, dword [eax]
jle 0x41fc9a
mov dword [ebp - 0x828], 1
jmp 0x41fca1
and dword [ebp - 0x828], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x828], eax
jne 0x41fcbb
mov dword [ebp - 0x364], 1
jmp 0x41fcc2
and dword [ebp - 0x364], 0
push 1
lea ecx, [ebp - 0x1d8]
call fcn.00433338
mov ecx, dword [ebp - 0x364]
cmp ecx, dword [eax]
jne 0x41fce5
mov dword [ebp - 0x830], 1
jmp 0x41fcec
and dword [ebp - 0x830], 0
push dword [ebp - 8]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
mov ecx, dword [ebp - 0x830]
cmp ecx, dword [eax]
jge 0x41fd10
mov dword [ebp - 0x36c], 1
jmp 0x41fd17
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0xb8], eax
jmp 0x41face
mov dword [ebp - 0x4c], 0
jmp 0x41fd38
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x420097
mov dword [ebp - 0x2a8], 0xd2ca8e1f
mov dword [ebp - 0x270], 0xd2dc
mov dword [ebp - 0x1ac], 1
mov dword [ebp - 0x838], 0
mov dword [ebp - 0xa14], 0xfccf
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0
je 0x41fdfb
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0xd3c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xd44], eax
push 2
lea ecx, [ebp - 0xaf4]
call fcn.00433338
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x2a0]
mov eax, dword [eax]
add eax, dword [ebp - 0x4c]
add eax, dword [ebp - 8]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x838]
add eax, dword [ebp - 0x270]
mov ecx, dword [ebp - 0x2a0]
mov ecx, dword [ecx]
inc ecx
mov edx, dword [ebp - 0x2a0]
mov dword [edx], ecx
test eax, eax
je 0x41fdfb
mov dword [ebp - 0x374], 1
jmp 0x41fe02
and dword [ebp - 0x374], 0
cmp dword [ebp - 0x374], 0x12446b8c
jg 0x41fe23
mov eax, 0x878ff5f6
test eax, eax
je 0x41fe23
mov dword [ebp - 0x840], 1
jmp 0x41fe2a
and dword [ebp - 0x840], 0
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x840], eax
jl 0x41fe41
mov dword [ebp - 0x37c], 1
jmp 0x41fe48
and dword [ebp - 0x37c], 0
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x37c]
je 0x41fe68
cmp dword [ebp - 8], 0
je 0x41fe68
mov dword [ebp - 0x848], 1
jmp 0x41fe6f
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x848], eax
jne 0x41fe89
mov dword [ebp - 0x384], 1
jmp 0x41fe90
and dword [ebp - 0x384], 0
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
mov dword [ebp - 0x850], eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x1d8]
call fcn.00433338
mov ecx, dword [ebp - 0x850]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x384]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0x850]
add eax, dword [ecx]
je 0x41fef6
cmp dword [ebp - 0x1ac], 0
je 0x41fef6
mov eax, 0x675f
test eax, eax
je 0x41fef6
mov dword [ebp - 0x38c], 1
jmp 0x41fefd
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x38c]
mov dword [ebp - 0xa14], eax
mov dword [ebp - 0x31c], 0xaad1
cmp dword [ebp - 0x31c], 0xffffffff
je 0x420044
mov eax, dword [ebp - 0x31c]
mov dword [ebp - 0xd4c], eax
push 2
lea ecx, [ebp - 0xaf4]
call fcn.00433338
cmp dword [eax], 0
jae 0x41ff4a
mov dword [ebp - 0x858], 1
jmp 0x41ff51
and dword [ebp - 0x858], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x858], eax
je 0x41ff70
xor eax, eax
inc eax
je 0x41ff70
mov dword [ebp - 0x394], 1
jmp 0x41ff77
and dword [ebp - 0x394], 0
cmp dword [ebp - 0x394], 0xffffffff
jg 0x41ff8c
mov dword [ebp - 0x860], 1
jmp 0x41ff93
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x860]
mov dword [ebp - 0x140], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x140], eax
je 0x41ffbc
mov eax, 0x36f30335
test eax, eax
jne 0x41ffbc
and dword [ebp - 0x39c], 0
jmp 0x41ffc6
mov dword [ebp - 0x39c], 1
cmp dword [ebp - 0x39c], 0x498492e7
je 0x41ffde
mov dword [ebp - 0x868], 1
jmp 0x41ffe5
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x868], eax
jle 0x41ffff
mov dword [ebp - 0x3a4], 1
jmp 0x420006
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x1ac]
add eax, dword [ebp - 0x3a4]
cmp eax, dword [ebp - 0x270]
jl 0x420026
mov dword [ebp - 0x870], 1
jmp 0x42002d
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x870]
je 0x420044
mov dword [ebp - 0x3ac], 1
jmp 0x42004b
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0xb8], eax
mov esi, dword [ebp - 0xb8]
imul esi, dword [ebp - 0x3ac]
add esi, dword [ebp - 0x60]
push 2
lea ecx, [ebp - 0xaf4]
call fcn.00433338
cmp esi, dword [eax]
jle 0x420081
mov dword [ebp - 0xa1c], 1
jmp 0x420088
and dword [ebp - 0xa1c], 0
mov dword [ebp - 0x2a8], 0x6f817ea5
jmp 0x41fd31
lea ecx, [ebp - 0xaf4]
call fcn.0043331c
jmp 0x41fa51
lea ecx, [ebp - 0x1d8]
call fcn.0043331c
and dword [ebp - 0x64], 0
mov dword [ebp - 0x3c], 0x8ec0ae97
mov byte [ebp - 0xcb], 0
movzx eax, byte [ebp - 0xcb]
test eax, eax
je 0x4200d7
push 0
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov dword [ebp - 0x3c], 0xffffffe6
jmp 0x4200e7
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0x18
jge 0x420495
mov dword [ebp - 0x50], 0xdd9cd443
mov dword [ebp - 0xdc], 0xffffffff
mov dword [ebp - 0xe4], 0
mov dword [ebp - 0x194], 0
push 3
lea ecx, [ebp - 0xb5c]
call fcn.0043324a
mov dword [ebp - 0xab4], 0xc717898a
mov dword [ebp - 0x1f4], 0
jmp 0x420146
mov eax, dword [ebp - 0x1f4]
inc eax
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x1f4], 3
jge 0x420168
push dword [ebp - 0x1f4]
lea ecx, [ebp - 0xb5c]
call fcn.00433338
mov dword [eax], 0xe633
jmp 0x420139
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xd54], eax
cmp dword [ebp - 0xdc], 0
je 0x420194
mov eax, 0xffff
test eax, eax
je 0x420194
or eax, 0xffffffff
je 0x420194
mov dword [ebp - 0x878], 1
jmp 0x42019b
and dword [ebp - 0x878], 0
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x878]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
sub eax, 0x2d62
cmp eax, dword [ebp - 0x3c]
jge 0x4201c0
mov dword [ebp - 0x3b4], 1
jmp 0x4201c7
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
add eax, 0x4bcd
cmp eax, dword [ebp - 0x3c]
jl 0x4201e3
mov dword [ebp - 0x880], 1
jmp 0x4201ea
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x880]
neg eax
cmp eax, dword [ebp - 0x3c]
jge 0x420203
mov dword [ebp - 0x3bc], 1
jmp 0x42020a
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x3bc], eax
jl 0x420224
mov dword [ebp - 0x888], 1
jmp 0x42022b
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x888], eax
jle 0x420245
mov dword [ebp - 0x3c4], 1
jmp 0x42024c
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x3c4], eax
je 0x420263
mov dword [ebp - 0xa24], 1
jmp 0x42026a
and dword [ebp - 0xa24], 0
mov eax, dword [ebp - 0xdc]
cmp dword [ebp - 0x3c], eax
jge 0x420281
mov dword [ebp - 0xa8c], 1
jmp 0x420288
and dword [ebp - 0xa8c], 0
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x3c]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0xe4], 0
jmp 0x4202ae
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 2
jg 0x420485
mov dword [ebp - 0xa9c], 0xffffffff
mov dword [ebp - 0x8a0], 0x138
mov dword [ebp - 0x194], 0
jmp 0x4202e8
mov eax, dword [ebp - 0x194]
inc eax
mov dword [ebp - 0x194], eax
cmp dword [ebp - 0x194], 2
jg 0x420480
mov dword [ebp - 0x314], 0xb5d2
mov dword [ebp - 0x50], 2
jmp 0x42030f
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jl 0x42047b
mov dword [ebp - 0xaa4], 0xffffffff
mov dword [ebp - 0xdc], 2
jmp 0x42033c
mov eax, dword [ebp - 0xdc]
dec eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 0
jl 0x420476
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0xd5c], eax
cmp dword [ebp - 0x3c], 0
jne 0x420364
mov dword [ebp - 0x890], 1
jmp 0x42036b
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x890]
jl 0x42037a
cmp dword [ebp - 0x3c], 0
mov eax, 0x69f4
cmp eax, 0xf53c
jg 0x420392
mov dword [ebp - 0x3cc], 1
jmp 0x420399
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
inc eax
cmp dword [ebp - 0x50], eax
jl 0x4203b1
mov dword [ebp - 0xa94], 1
jmp 0x4203b8
and dword [ebp - 0xa94], 0
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0xd64], eax
mov eax, 0xb631114
sub eax, 0x69fbc0ae
cmp eax, dword [ebp - 0xa9c]
jle 0x4203e2
mov dword [ebp - 0x898], 1
jmp 0x4203e9
and dword [ebp - 0x898], 0
mov esi, dword [ebp - 0x314]
add esi, dword [ebp - 0x898]
push dword [ebp - 0xe4]
lea ecx, [ebp - 0xb5c]
call fcn.00433338
imul esi, dword [eax]
test esi, esi
jne 0x42041d
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x42041d
and dword [ebp - 0x3d4], 0
jmp 0x420427
mov dword [ebp - 0x3d4], 1
mov eax, dword [ebp - 0x3d4]
mov dword [ebp - 0x8a0], eax
mov eax, dword [ebp - 0xaa4]
cmp dword [ebp - 0x8a0], eax
jg 0x42044d
mov dword [ebp - 0xaac], 1
jmp 0x420454
and dword [ebp - 0xaac], 0
push dword [ebp - 0xe4]
lea ecx, [ebp - 0xb5c]
call fcn.00433338
mov eax, dword [ebp - 0x314]
mov dword [ebp - 0xab4], eax
jmp 0x42032f
jmp 0x420308
jmp 0x4202db
jmp 0x4202a1
lea ecx, [ebp - 0xb5c]
call fcn.0043331c
jmp 0x4200e0
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0xadc], 0x94784533
mov dword [ebp - 0x278], 0
jmp 0x4204bf
mov eax, dword [ebp - 0x278]
inc eax
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 1
jge 0x4204db
mov eax, dword [ebp - 0x278]
mov dword [ebp + eax*4 - 0xec], 0x8eac8b13
jmp 0x4204b2
mov dword [ebp - 0x1c], 0
jmp 0x4204eb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jg 0x42055b
mov dword [ebp - 0x1fc], 0xfe77dd68
mov byte [ebp - 0xc9], 0
movzx eax, byte [ebp - 0xc9]
test eax, eax
je 0x42051e
push 0
push 0
push 0x7c8
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov dword [ebp - 0x1fc], 0
jmp 0x420537
mov eax, dword [ebp - 0x1fc]
dec eax
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0x1fc], 0
jl 0x420559
mov dword [ebp - 0x3dc], 0x4210
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
jmp 0x42052a
jmp 0x4204e4
mov dword [ebp - 0x1c], 0x15
jmp 0x42056b
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 7
jle 0x42097a
mov dword [ebp - 0x44], 0xaf7f
mov dword [ebp - 0x40], 0x74e8
mov dword [ebp - 0x280], 0
jmp 0x42059c
mov eax, dword [ebp - 0x280]
inc eax
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 2
jge 0x4205b8
mov eax, dword [ebp - 0x280]
mov dword [ebp + eax*4 - 0x29c], 0xde2e510b
jmp 0x42058f
cmp dword [ebp - 0x44], 1
jb 0x4205ca
mov dword [ebp - 0xabc], 1
jmp 0x4205d1
and dword [ebp - 0xabc], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x44], eax
jle 0x4205e5
mov dword [ebp - 0x8a8], 1
jmp 0x4205ec
and dword [ebp - 0x8a8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
cmp dword [ebp - 0x8a8], eax
je 0x42060d
mov dword [ebp - 0xac4], 1
jmp 0x420614
and dword [ebp - 0xac4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
mov dword [ebp - 0xdc8], eax
imul eax, dword [ebp - 0x1c], 0xcc90
inc eax
imul eax, eax, 0x9d0
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0xec]
jg 0x420650
mov dword [ebp - 0x3e4], 1
jmp 0x420657
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x3e4], eax
jl 0x42066e
mov dword [ebp - 0x8b0], 1
jmp 0x420675
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x8b0], eax
jl 0x420686
cmp dword [ebp - 0x1c], 0
je 0x42069b
mov eax, 0x56bf
test eax, eax
je 0x42069b
mov dword [ebp - 0x8b8], 1
jmp 0x4206a2
and dword [ebp - 0x8b8], 0
cmp dword [ebp - 0x8b8], 0xffff
jb 0x4206c7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0
jne 0x4206c7
and dword [ebp - 0xacc], 0
jmp 0x4206d1
mov dword [ebp - 0xacc], 1
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xdd0], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xdd8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xde0], eax
mov eax, dword [ebp - 0x40]
add eax, dword [ebp - 0x1c]
jne 0x420703
cmp dword [ebp - 0x40], 0
jne 0x420703
and dword [ebp - 0x694], 0
jmp 0x42070d
mov dword [ebp - 0x694], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x694], eax
jle 0x420724
mov dword [ebp - 0xad4], 1
jmp 0x42072b
and dword [ebp - 0xad4], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xde8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xdf0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xec]
mov dword [ebp - 0xdf8], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xe00], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29c]
cmp dword [ebp - 0x44], eax
jg 0x420779
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
cmp dword [ebp - 0x1c], eax
jne 0x420797
mov dword [ebp - 0x3f4], 1
jmp 0x42079e
and dword [ebp - 0x3f4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp + eax - 0x29c], ecx
mov dword [ebp - 0x40], 0
jmp 0x4207c1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x420975
mov dword [ebp - 0x918], 0xffffffff
mov dword [ebp - 0x44], 0
jmp 0x4207e5
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jg 0x420970
mov dword [ebp - 0x3fc], 0xfffffffa
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x29c]
mov dword [ebp + ecx*4 - 0x29c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x29c]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x3fc], eax
cmp dword [ebp - 0x3fc], 0xfffffff7
jle 0x420841
mov dword [ebp - 0x6a4], 1
jmp 0x420848
and dword [ebp - 0x6a4], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xec], 0
jne 0x42086a
mov eax, 0xfad6770d
test eax, eax
jne 0x42086a
and dword [ebp - 0x69c], 0
jmp 0x420874
mov dword [ebp - 0x69c], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x69c], eax
jne 0x42088b
mov dword [ebp - 0x404], 1
jmp 0x420892
and dword [ebp - 0x404], 0
cmp dword [ebp - 0x404], 1
jle 0x4208a7
mov dword [ebp - 0x7ec], 1
jmp 0x4208ae
and dword [ebp - 0x7ec], 0
cmp dword [ebp - 0x7ec], 0
je 0x4208c3
mov dword [ebp - 0x40c], 1
jmp 0x4208ca
and dword [ebp - 0x40c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x29c]
cmp dword [ebp - 0x40c], eax
je 0x4208f4
mov eax, 0xffff
test eax, eax
je 0x4208f4
mov dword [ebp - 0x414], 1
jmp 0x4208fb
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x6a4]
cmp eax, dword [ebp - 0x414]
jge 0x42091e
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x29c], 0
jne 0x42091e
xor eax, eax
inc eax
je 0x420933
mov eax, 0x97151158
test eax, eax
je 0x420933
mov dword [ebp - 0x894], 1
jmp 0x42093a
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x29c]
cmp eax, dword [ebp - 0x894]
jne 0x420958
mov dword [ebp - 0x41c], 1
jmp 0x42095f
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x41c]
mov dword [ebp - 0xadc], eax
jmp 0x4207de
jmp 0x4207ba
jmp 0x420564
push 4
lea ecx, [ebp - 0xb1c]
call fcn.0043324a
mov dword [ebp - 0xe08], 1
mov dword [ebp - 0xe10], 0
mov dword [ebp - 0xe18], 0x4cdb8faa
mov dword [ebp - 0xe20], 1
mov dword [ebp - 0xe28], 0xdfe4d9ed
mov dword [ebp - 0xe30], 0x64fd9e2a
push 1
lea ecx, [ebp - 0xee8]
call fcn.0043324a
mov dword [ebp - 0x2c], 0
jmp 0x4209e0
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x4209f9
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xb1c]
call fcn.00433338
or dword [eax], 0xffffffff
jmp 0x4209d9
mov dword [ebp - 0x2c], 0
jmp 0x420a09
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x420a25
push dword [ebp - 0x2c]
lea ecx, [ebp - 0xee8]
call fcn.00433338
mov dword [eax], 0xc10977a1
jmp 0x420a02
mov dword [ebp - 0x2c], 0
jmp 0x420a35
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jge 0x420a4b
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xb88], 0
jmp 0x420a2e
push 2
lea ecx, [ebp - 0xb1c]
call fcn.00433338
and dword [eax], 0
jmp 0x420a81
push 2
lea ecx, [ebp - 0xb1c]
call fcn.00433338
mov dword [ebp - 0x6ac], eax
mov eax, dword [ebp - 0x6ac]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6ac]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0xb1c]
call fcn.00433338
cmp dword [eax], 0xfffffff9
je 0x420b2b
push 2
lea ecx, [ebp - 0xed8]
call fcn.0043324a
mov dword [ebp - 0xe38], 0x13d0bb94
mov dword [ebp - 0x6c], 0
jmp 0x420abe
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x420ada
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xed8]
call fcn.00433338
mov dword [eax], 0xfffffff7
jmp 0x420ab7
mov dword [ebp - 0x6c], 0
jmp 0x420aea
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x420b00
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0xe40], 0xfffffffa
jmp 0x420ae3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb88]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0xb88], eax
lea ecx, [ebp - 0xed8]
call fcn.0043331c
jmp 0x420a5d
mov byte [ebp - 0xd1], 0
movzx eax, byte [ebp - 0xd1]
test eax, eax
je 0x420b56
push 0x22a1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPolyFillMode]
lea ecx, [ebp - 0xee8]
call fcn.0043331c
lea ecx, [ebp - 0xb1c]
call fcn.0043331c
mov dword [ebp - 0x7c], 0xaeb9ae77
mov dword [ebp - 0xbc], 0
mov dword [ebp - 0x2b0], 0xfffffffa
mov dword [ebp - 0x8e8], 3
mov byte [ebp - 0xcd], 0
movzx eax, byte [ebp - 0xcd]
test eax, eax
je 0x420bc3
push 0xadd
push 0x1c60
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
mov eax, dword [ebp - 0x7c]
inc eax
inc eax
cmp dword [ebp - 0x7c], eax
jne 0x420bdd
push 5
pop eax
test eax, eax
jne 0x420bdd
and dword [ebp - 0x424], 0
jmp 0x420be7
mov dword [ebp - 0x424], 1
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
cmp eax, dword [ebp - 0x424]
jne 0x420c0a
mov dword [ebp - 0x7f4], 1
jmp 0x420c11
and dword [ebp - 0x7f4], 0
cmp dword [ebp - 0x7f4], 3
jne 0x420c26
mov dword [ebp - 0xae4], 1
jmp 0x420c2d
and dword [ebp - 0xae4], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xe48], eax
cmp dword [ebp - 0xbc], 0xfe64
jg 0x420c49
cmp dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xe50], eax
mov eax, dword [ebp - 0x7c]
sub eax, dword [ebp - 0x2b0]
cmp eax, dword [ebp - 0x7c]
jge 0x420c6f
mov dword [ebp - 0x42c], 1
jmp 0x420c76
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x7c]
add eax, dword [ebp - 0x42c]
cmp eax, dword [ebp - 0x2b0]
jg 0x420c93
mov dword [ebp - 0x6b4], 1
jmp 0x420c9a
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x2b0]
imul eax, dword [ebp - 0x6b4]
cmp eax, dword [ebp - 0x7c]
je 0x420d22
mov dword [ebp - 0xb30], 0xfffffffd
mov dword [ebp - 0x204], 0
jmp 0x420ccf
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 1
jge 0x420ceb
mov eax, dword [ebp - 0x204]
mov dword [ebp + eax*4 - 0x434], 0
jmp 0x420cc2
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x434], 0x6b37990
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x434]
neg eax
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xb30], eax
jmp 0x420db4
mov dword [ebp - 0x2f0], 0xffffffff
mov dword [ebp - 0x990], 0x649690b2
mov dword [ebp - 0x8e8], 1
cmp dword [ebp - 0x8e8], 1
ja 0x420d55
mov dword [ebp - 0xa04], 1
jmp 0x420d5c
and dword [ebp - 0xa04], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0xe58], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xe60], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xe68], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0xe70], eax
cmp dword [ebp - 0x2f0], 0xf81606dc
jbe 0x420da1
mov dword [ebp - 0x43c], 1
jmp 0x420da8
and dword [ebp - 0x43c], 0
mov eax, dword [ebp - 0x43c]
mov dword [ebp - 0x990], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x320], eax
mov dword [ebp - 0xf4], 0
push 4
lea ecx, [ebp - 0x914]
call fcn.0043324a
mov dword [ebp - 0x45c], 0x38770ce4
mov dword [ebp - 0xe78], 0x563ade45
mov dword [ebp - 0xe80], 0xffffffff
mov dword [ebp - 0xe88], 0
mov dword [ebp - 0xe90], 7
mov dword [ebp - 0xe98], 0xffffffff
mov dword [ebp - 0xea0], 0xffffffff
mov dword [ebp - 0xea8], 0xffffffff
mov dword [ebp - 0x288], 0
jmp 0x420e3d
mov eax, dword [ebp - 0x288]
inc eax
mov dword [ebp - 0x288], eax
cmp dword [ebp - 0x288], 4
jge 0x420e5c
push dword [ebp - 0x288]
lea ecx, [ebp - 0x914]
call fcn.00433338
or dword [eax], 0xffffffff
jmp 0x420e30
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x420e74
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0xf4], 0xfffffff3
jmp 0x420e8d
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0xfffffffd
je 0x4211fd
mov dword [ebp - 0xa4], 0x9febb674
mov dword [ebp - 0x464], 0
mov dword [ebp - 0x9a0], 0xfffffffa
mov dword [ebp - 0xeb0], 0x63e87122
mov dword [ebp - 0xeb8], 0x4ee00b46
mov dword [ebp - 0x47c], 0x7c08a59c
mov dword [ebp - 0xa4], 0
jmp 0x420eef
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jg 0x4211eb
mov dword [ebp - 0x6c4], 0x38b4b72b
mov dword [ebp - 0x290], 0
jmp 0x420f1f
mov eax, dword [ebp - 0x290]
inc eax
mov dword [ebp - 0x290], eax
cmp dword [ebp - 0x290], 1
jge 0x420f3b
mov eax, dword [ebp - 0x290]
mov dword [ebp + eax*4 - 0x148], 0xfffffffd
jmp 0x420f12
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x148], 0
jmp 0x420f69
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x148], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x148], 3
jg 0x4211e6
push 3
lea ecx, [ebp - 0x914]
call fcn.00433338
mov ecx, dword [ebp - 0x464]
cmp dword [eax], ecx
jl 0x420fa0
mov dword [ebp - 0xa88], 1
jmp 0x420fa7
and dword [ebp - 0xa88], 0
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x914]
call fcn.00433338
cmp dword [ebp - 0xf4], 0
jne 0x420fcf
xor eax, eax
inc eax
jne 0x420fcf
and dword [ebp - 0x998], 0
jmp 0x420fd9
mov dword [ebp - 0x998], 1
mov eax, 0xde81d534
cmp eax, 0xfffffffa
jae 0x420fef
mov dword [ebp - 0x6bc], 1
jmp 0x420ff6
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x6bc], eax
je 0x421010
mov dword [ebp - 0x444], 1
jmp 0x421017
and dword [ebp - 0x444], 0
imul esi, dword [ebp - 0x444], 3
push 1
lea ecx, [ebp - 0x914]
call fcn.00433338
cmp esi, dword [eax]
jg 0x42103b
mov dword [ebp - 0xaf8], 1
jmp 0x421042
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], eax
jle 0x42105c
mov dword [ebp - 0x7fc], 1
jmp 0x421063
and dword [ebp - 0x7fc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x7fc], eax
jl 0x421084
mov dword [ebp - 0x44c], 1
jmp 0x42108b
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x44c]
mov dword [ebp - 0x6c4], eax
cmp dword [ebp - 0x6c4], 0
je 0x4210b5
cmp dword [ebp - 0xf4], 0
je 0x4210b5
mov dword [ebp - 0x454], 1
jmp 0x4210bc
and dword [ebp - 0x454], 0
cmp dword [ebp - 0x454], 0x19d8
jne 0x4210d4
mov dword [ebp - 0x89c], 1
jmp 0x4210db
and dword [ebp - 0x89c], 0
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0x45c], eax
mov esi, dword [ebp - 0x45c]
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x914]
call fcn.00433338
cmp esi, dword [eax]
je 0x42110e
mov dword [ebp - 0x6cc], 1
jmp 0x421115
and dword [ebp - 0x6cc], 0
cmp dword [ebp - 0x6cc], 0x85ed
jle 0x42112d
mov dword [ebp - 0x804], 1
jmp 0x421134
and dword [ebp - 0x804], 0
mov eax, dword [ebp - 0x464]
cmp dword [ebp - 0x804], eax
je 0x42114e
mov dword [ebp - 0x46c], 1
jmp 0x421155
and dword [ebp - 0x46c], 0
push 1
lea ecx, [ebp - 0x914]
call fcn.00433338
mov ecx, dword [ebp - 0x46c]
cmp ecx, dword [eax]
jg 0x421178
mov dword [ebp - 0x6d4], 1
jmp 0x42117f
and dword [ebp - 0x6d4], 0
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x914]
call fcn.00433338
mov eax, dword [eax]
cmp eax, dword [ebp - 0x6d4]
je 0x4211a6
mov dword [ebp - 0x474], 1
jmp 0x4211ad
and dword [ebp - 0x474], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x148]
cmp dword [ebp - 0x474], eax
je 0x4211ce
mov dword [ebp - 0x908], 1
jmp 0x4211d5
and dword [ebp - 0x908], 0
mov eax, dword [ebp - 0x908]
mov dword [ebp - 0x9a0], eax
jmp 0x420f4e
jmp 0x420ee2
mov eax, dword [ebp - 0x47c]
dec eax
mov dword [ebp - 0x47c], eax
jmp 0x420e80
lea ecx, [ebp - 0x914]
call fcn.0043331c
mov eax, dword [ebp - 0x320]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x42175c
push 3
lea ecx, [ebp - 0xef8]
call fcn.0043324a
mov dword [ebp - 0x84], 0
jmp 0x421242
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x421264
push dword [ebp - 0x84]
lea ecx, [ebp - 0xef8]
call fcn.00433338
mov dword [eax], 0x3342eb90
jmp 0x421235
mov dword [ebp - 0x84], 0
jmp 0x42127d
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 2
jge 0x421299
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x954], 0xb13638ec
jmp 0x421270
mov byte [ebp - 0xcf], 0
movzx eax, byte [ebp - 0xcf]
test eax, eax
je 0x4212ba
push 0
push 0xa9c
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x954], 2
jmp 0x4212e8
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x954]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x954], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x954], 0
jl 0x42139a
mov dword [ebp - 0x254], 0
jmp 0x421315
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 3
jge 0x421331
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0xb68], 0
jmp 0x421308
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0xb68], 2
jmp 0x42135c
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb68]
dec eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0xb68], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xb68], 0
jl 0x421395
mov byte [ebp - 0xf5], 0
movzx eax, byte [ebp - 0xf5]
test eax, eax
je 0x421393
push 0
push 0
push 0x2019
push 0x1406
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x421343
jmp 0x4212cd
lea ecx, [ebp - 0xef8]
call fcn.0043331c
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x170], 0
mov dword [ebp - 0xa98], 0x7c525ac8
mov dword [ebp - 0xec0], 0xffffffff
mov dword [ebp - 0x214], 0
jmp 0x4213e3
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 4
jge 0x4213ff
mov eax, dword [ebp - 0x214]
mov dword [ebp + eax*4 - 0xb2c], 0xc64a6847
jmp 0x4213d6
mov dword [ebp - 0x10], 0
jmp 0x42140f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x421657
mov dword [ebp - 0x49c], 0x8858
mov dword [ebp - 0x6dc], 0x70512a30
mov dword [ebp - 0x48c], 0
mov dword [ebp - 0xbcc], 1
mov dword [ebp - 0xbc8], 1
mov dword [ebp - 0xbc4], 1
mov dword [ebp - 0xbc0], 1
lea ecx, [ebp - 0x309]
call fcn.00433347
push eax
lea eax, [ebp - 0xbbc]
push eax
lea eax, [ebp - 0xbcc]
push eax
lea ecx, [ebp - 0xfa8]
call fcn.0043334a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf08]
call fcn.004332f6
mov dword [ebp - 0x9a8], 1
push 0xfffffffffffffffe
pop eax
test eax, eax
je 0x42151b
mov eax, dword [ebp - 0x49c]
mov dword [ebp - 0x6dc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb2c]
cmp dword [ebp - 0x6dc], eax
jge 0x4214d2
mov dword [ebp - 0x484], 1
jmp 0x4214d9
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x170]
add eax, dword [ebp - 0x484]
js 0x4214f3
mov dword [ebp - 0x80c], 1
jmp 0x4214fa
and dword [ebp - 0x80c], 0
mov eax, dword [ebp - 0x80c]
mov dword [ebp - 0x48c], eax
cmp dword [ebp - 0x48c], 0
je 0x42151b
mov dword [ebp - 0x6e4], 1
jmp 0x421522
and dword [ebp - 0x6e4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb2c]
cmp dword [ebp - 0x6e4], eax
jge 0x421543
mov dword [ebp - 0x494], 1
jmp 0x42154a
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0xfffffffd
je 0x42155f
mov dword [ebp - 0x8a4], 1
jmp 0x421566
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x8a4]
add eax, 0xfffa
sub eax, dword [ebp - 0x49c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xb2c]
cmp dword [ebp - 0x10], eax
jne 0x421595
mov dword [ebp - 0x6ec], 1
jmp 0x42159c
and dword [ebp - 0x6ec], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb2c]
cmp dword [ebp - 0x6ec], eax
jl 0x4215bd
mov dword [ebp - 0x4a4], 1
jmp 0x4215c4
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0x4a4], eax
jge 0x4215de
mov dword [ebp - 0xa90], 1
jmp 0x4215e5
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xb2c]
mov dword [ebp - 0xec8], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xf6c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xf74], eax
cmp dword [ebp - 0x170], 1
jb 0x42161f
mov dword [ebp - 0x2b8], 1
jmp 0x421626
and dword [ebp - 0x2b8], 0
push 0
lea ecx, [ebp - 0xf08]
call fcn.00433338
mov ecx, dword [ebp - 0x2b8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x9a8], eax
lea ecx, [ebp - 0xf08]
call fcn.0043331c
jmp 0x421408
mov dword [ebp - 0x10], 0
jmp 0x421667
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x421755
mov dword [ebp - 0x294], 0xffffffff
mov dword [ebp - 0x9b0], 8
mov eax, dword [ebp - 0x294]
mov dword [ebp - 0xf7c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xf84], eax
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x294]
cmp eax, dword [ebp - 0x294]
jne 0x4216b8
mov dword [ebp - 0x814], 1
jmp 0x4216bf
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x814]
jne 0x4216dc
cmp dword [ebp - 0x294], 0
jne 0x4216dc
and dword [ebp - 0xae0], 0
jmp 0x4216e6
mov dword [ebp - 0xae0], 1
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xf8c], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0xf94], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xb2c]
mov dword [ebp - 0x4ac], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x4ac]
mov dword [ebp + eax*4 - 0xb2c], ecx
mov eax, dword [ebp - 0x4ac]
add eax, 0x1d9
cmp eax, dword [ebp - 0x9b0]
jne 0x42173d
mov dword [ebp - 0x6f4], 1
jmp 0x421744
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x6f4]
mov dword [ebp - 0xa98], eax
jmp 0x421660
xor eax, eax
jmp 0x426977
push 2
lea ecx, [ebp - 0x968]
call fcn.0043324a
mov dword [ebp - 0xfc], 0xa66fe7d8
mov dword [ebp - 0xf88], 0xb60e704f
mov dword [ebp - 0xefc], 0x7b568be1
mov dword [ebp - 0xf70], 3
push 3
lea ecx, [ebp - 0xc20]
call fcn.0043324a
mov dword [ebp - 0x4b4], 2
mov dword [ebp - 0xb4], 0
jmp 0x4217c1
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 2
jge 0x4217e3
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x968]
call fcn.00433338
mov dword [eax], 0xffff
jmp 0x4217b4
mov dword [ebp - 0xb4], 0
jmp 0x4217fc
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 3
jge 0x42181b
push dword [ebp - 0xb4]
lea ecx, [ebp - 0xc20]
call fcn.00433338
and dword [eax], 0
jmp 0x4217ef
mov dword [ebp - 0xfc], 0
jmp 0x421834
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jg 0x4219ae
push 3
lea ecx, [ebp - 0xc44]
call fcn.0043324a
mov dword [ebp - 0xca0], 2
mov dword [ebp - 0xe14], 2
mov dword [ebp - 0xca8], 0xfffffffd
mov dword [ebp - 0xeb4], 0xa0d018d3
mov dword [ebp - 0xcb0], 0x6b9c2d62
mov dword [ebp - 0xe1c], 1
mov dword [ebp - 0xcb8], 0xbec5ec62
mov dword [ebp - 0xf3c], 0xc86992f1
mov dword [ebp - 0x21c], 0
jmp 0x4218b7
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 3
jge 0x4218d9
push dword [ebp - 0x21c]
lea ecx, [ebp - 0xc44]
call fcn.00433338
mov dword [eax], 0xc027
jmp 0x4218aa
push 0
lea ecx, [ebp - 0xc44]
call fcn.00433338
mov dword [eax], 0xda4d073f
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x968]
call fcn.00433338
cmp dword [eax], 0xda4d073f
jge 0x421950
mov dword [ebp - 0xcc0], 0x4e5a945c
mov dword [ebp - 0xe24], 9
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x968]
call fcn.00433338
mov esi, eax
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x968]
call fcn.00433338
mov ecx, dword [esi]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
jmp 0x42197e
mov byte [ebp - 0x115], 0
movzx eax, byte [ebp - 0x115]
test eax, eax
je 0x42197e
push 0x2189
push 0x6f5
push 0xd96
push 0x132c
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 1
lea ecx, [ebp - 0x968]
call fcn.00433338
push 1
lea ecx, [ebp - 0xc20]
call fcn.00433338
mov dword [eax], 0xcca69919
lea ecx, [ebp - 0xc44]
call fcn.0043331c
jmp 0x421827
lea ecx, [ebp - 0xc20]
call fcn.0043331c
lea ecx, [ebp - 0x968]
call fcn.0043331c
mov eax, dword [ebp - 0x320]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0xcc8], 0x5fa3
mov dword [ebp - 0xebc], 0xffffffff
mov dword [ebp - 0xcd0], 1
mov dword [ebp - 0xe2c], 0x3adeb945
mov dword [ebp - 0xcd8], 0xffffffff
mov dword [ebp - 0xf90], 0x2fdd
push 1
lea ecx, [ebp - 0xc14]
call fcn.0043324a
push 1
lea ecx, [ebp - 0xbfc]
call fcn.0043324a
mov dword [ebp - 0x9b8], 0
mov dword [ebp - 4], 0
jmp 0x421a46
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x421a5c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa30], 0x39cb61d2
jmp 0x421a3f
mov dword [ebp - 4], 0
jmp 0x421a6c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x421a82
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xfdc], 3
jmp 0x421a65
mov dword [ebp - 4], 0
jmp 0x421a92
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x421aa8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xfc0], 0
jmp 0x421a8b
mov dword [ebp - 4], 0
jmp 0x421ab8
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x421ace
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x8f0], 0xfffffff8
jmp 0x421ab1
mov dword [ebp - 4], 0
jmp 0x421ade
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x421afa
push dword [ebp - 4]
lea ecx, [ebp - 0xc14]
call fcn.00433338
mov dword [eax], 0xfffffff9
jmp 0x421ad7
mov dword [ebp - 4], 0
jmp 0x421b0a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x421b26
push dword [ebp - 4]
lea ecx, [ebp - 0xbfc]
call fcn.00433338
mov dword [eax], 0x22591552
jmp 0x421b03
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x8f0], 1
jne 0x421b42
mov dword [ebp - 0x4bc], 1
jmp 0x421b49
and dword [ebp - 0x4bc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x8f0]
cmp dword [ebp - 0x4bc], eax
jle 0x421b6a
mov dword [ebp - 0x6fc], 1
jmp 0x421b71
and dword [ebp - 0x6fc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xa30]
cmp dword [ebp - 0x6fc], eax
jl 0x421b92
mov dword [ebp - 0x4c4], 1
jmp 0x421b99
and dword [ebp - 0x4c4], 0
push 0
lea ecx, [ebp - 0xc14]
call fcn.00433338
mov ecx, dword [ebp - 0x4c4]
cmp ecx, dword [eax]
jle 0x421bbc
mov dword [ebp - 0x81c], 1
jmp 0x421bc3
and dword [ebp - 0x81c], 0
cmp dword [ebp - 0x81c], 0x115e
je 0x421bdb
mov dword [ebp - 0x4cc], 1
jmp 0x421be2
and dword [ebp - 0x4cc], 0
mov eax, dword [ebp - 0x4cc]
add eax, 0xffff
mov dword [ebp - 0x310], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x310]
mov dword [ebp + eax - 0xa30], ecx
push 0
lea ecx, [ebp - 0xbfc]
call fcn.00433338
mov ecx, dword [ebp - 0x310]
mov dword [eax], ecx
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x9b8], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa30], 0x7d1d410a
lea ecx, [ebp - 0xbfc]
call fcn.0043331c
lea ecx, [ebp - 0xc14]
call fcn.0043331c
mov eax, dword [ebp - 0x198]
cmp dword [eax], 0x4550
je 0x4223c9
push 1
lea ecx, [ebp - 0x33c]
call fcn.0043324a
mov dword [ebp - 0xc0], 0
push 1
lea ecx, [ebp - 0xb74]
call fcn.0043324a
mov dword [ebp - 0x25c], 0x41dbc46d
mov dword [ebp - 0x4fc], 0x6fae7a48
mov dword [ebp - 0x30], 0
jmp 0x421ca8
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x421cc4
push dword [ebp - 0x30]
lea ecx, [ebp - 0x33c]
call fcn.00433338
mov dword [eax], 0x45db34e6
jmp 0x421ca1
mov dword [ebp - 0x30], 0
jmp 0x421cd4
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x421cf0
push dword [ebp - 0x30]
lea ecx, [ebp - 0xb74]
call fcn.00433338
mov dword [eax], 5
jmp 0x421ccd
mov dword [ebp - 0x30], 0
jmp 0x421d00
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x421d16
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x19c], 0xa14c5530
jmp 0x421cf9
push 0
lea ecx, [ebp - 0x33c]
call fcn.00433338
mov esi, eax
push 0
lea ecx, [ebp - 0x33c]
call fcn.00433338
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x421d44
mov dword [ebp - 0x4dc], 1
jmp 0x421d4b
and dword [ebp - 0x4dc], 0
push 0
lea ecx, [ebp - 0x33c]
call fcn.00433338
mov esi, eax
push 0
lea ecx, [ebp - 0x33c]
call fcn.00433338
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x421d79
mov dword [ebp - 0xafc], 1
jmp 0x421d80
and dword [ebp - 0xafc], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0xce0], eax
push 0
lea ecx, [ebp - 0x33c]
call fcn.00433338
mov esi, eax
push 0
lea ecx, [ebp - 0x33c]
call fcn.00433338
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x421dba
mov dword [ebp - 0x704], 1
jmp 0x421dc1
and dword [ebp - 0x704], 0
mov esi, dword [ebp - 0x704]
sub esi, dword [ebp - 0xc0]
push 0
lea ecx, [ebp - 0xb74]
call fcn.00433338
cmp esi, dword [eax]
jne 0x421dea
mov dword [ebp - 0x4d4], 1
jmp 0x421df1
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0xffffffff
jne 0x421e06
mov dword [ebp - 0x8ac], 1
jmp 0x421e0d
and dword [ebp - 0x8ac], 0
push 0
lea ecx, [ebp - 0x33c]
call fcn.00433338
imul ecx, dword [ebp - 0x8ac], 0x1600
add ecx, dword [ebp - 0x4dc]
cmp dword [eax], ecx
jle 0x421e3a
mov dword [ebp - 0x70c], 1
jmp 0x421e41
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x70c], eax
jl 0x421e5b
mov dword [ebp - 0x4e4], 1
jmp 0x421e62
and dword [ebp - 0x4e4], 0
push 0
lea ecx, [ebp - 0xb74]
call fcn.00433338
mov ecx, dword [ebp - 0x4e4]
cmp ecx, dword [eax]
jge 0x421e85
mov dword [ebp - 0x824], 1
jmp 0x421e8c
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x824], eax
je 0x421ea6
mov dword [ebp - 0x4ec], 1
jmp 0x421ead
and dword [ebp - 0x4ec], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x4ec]
mov dword [ebp + eax - 0x19c], ecx
mov dword [ebp - 0xc0], 0x13
jmp 0x421ed9
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 9
jne 0x42204d
mov dword [ebp - 0x1bc], 0x33631af
mov dword [ebp - 0x150], 0x5b167d3d
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1bc]
inc ecx
cmp dword [ebp + eax - 0x19c], ecx
jl 0x421f1c
mov dword [ebp - 0x714], 1
jmp 0x421f23
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x1bc]
imul eax, dword [ebp - 0x714]
neg eax
sub eax, dword [ebp - 0x1bc]
sub eax, 0x5c7d
mov dword [ebp - 0x25c], eax
jne 0x421f53
or eax, 0xffffffff
jne 0x421f53
and dword [ebp - 0x9c0], 0
jmp 0x421f5d
mov dword [ebp - 0x9c0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x19c]
mov dword [ebp - 0xe34], eax
cmp dword [ebp - 0x1bc], 0x64fe
jle 0x421f88
mov dword [ebp - 0x4f4], 1
jmp 0x421f8f
and dword [ebp - 0x4f4], 0
cmp dword [ebp - 0x4f4], 0x9727
jg 0x421fa7
mov dword [ebp - 0xaa0], 1
jmp 0x421fae
and dword [ebp - 0xaa0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x19c]
mov dword [ebp - 0xce8], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
sub eax, 0x3c7d7575
mov dword [ebp - 0x4fc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x19c]
mov dword [ebp - 0xec4], eax
mov dword [ebp - 0x150], 1
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xcf0], eax
mov dword [ebp - 0x25c], 0xfffffff7
mov dword [ebp - 0x150], 1
mov eax, dword [ebp - 0x25c]
sub eax, dword [ebp - 0x150]
je 0x422035
mov dword [ebp - 0x934], 1
jmp 0x42203c
and dword [ebp - 0x934], 0
mov eax, dword [ebp - 0x934]
mov dword [ebp - 0x4fc], eax
jmp 0x421ecc
lea ecx, [ebp - 0xb74]
call fcn.0043331c
lea ecx, [ebp - 0x33c]
call fcn.0043331c
push 1
lea ecx, [ebp - 0x930]
call fcn.0043324a
mov dword [ebp - 0x168], 3
mov dword [ebp - 0xe3c], 1
mov dword [ebp - 0x27c], 0x53312a7f
mov dword [ebp - 0x24], 0
jmp 0x42209e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x4220ba
push dword [ebp - 0x24]
lea ecx, [ebp - 0x930]
call fcn.00433338
mov dword [eax], 0x8d32
jmp 0x422097
mov dword [ebp - 0x24], 0
jmp 0x4220ca
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x4220e0
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xc80], 0xffffffff
jmp 0x4220c3
mov dword [ebp - 0x24], 0
jmp 0x4220f0
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x422106
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x9c8], 0xfd9a
jmp 0x4220e9
mov dword [ebp - 0x168], 0
jmp 0x42211f
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0
jg 0x4223b7
mov dword [ebp - 0x8b4], 4
mov dword [ebp - 0xcf8], 0x831eb239
mov dword [ebp - 0xf4c], 0xde0980db
mov dword [ebp - 0xd00], 0x2278213
mov dword [ebp - 0xc94], 0
mov dword [ebp - 0xd08], 0x2b5f7919
mov dword [ebp - 0x9d8], 0xffffffff
mov dword [ebp - 0xecc], 0x2e3ca369
mov dword [ebp - 0x9d0], 0xfffffff8
mov dword [ebp - 0xd10], 0xffffffff
mov dword [ebp - 0xe4c], 0xffffffff
mov dword [ebp - 0x224], 0
jmp 0x4221b3
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 4
jge 0x4221cf
mov eax, dword [ebp - 0x224]
mov dword [ebp + eax*4 - 0xff8], 0x3380ee91
jmp 0x4221a6
push dword [ebp - 0x168]
lea ecx, [ebp - 0x930]
call fcn.00433338
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c8], 0
jne 0x42220b
push 0
lea ecx, [ebp - 0x930]
call fcn.00433338
cmp dword [eax], 0
jne 0x42220b
and dword [ebp - 0xae8], 0
jmp 0x422215
mov dword [ebp - 0xae8], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc80], 0x6e0a
jne 0x422234
mov dword [ebp - 0x71c], 1
jmp 0x42223b
and dword [ebp - 0x71c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc80]
cmp dword [ebp - 0x71c], eax
jl 0x42225c
mov dword [ebp - 0x504], 1
jmp 0x422263
and dword [ebp - 0x504], 0
mov eax, dword [ebp - 0x9d0]
cmp eax, dword [ebp - 0x504]
jne 0x42227d
mov dword [ebp - 0xaa8], 1
jmp 0x422284
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0x9d8]
mov dword [ebp - 0xd18], eax
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x8b4]
cmp dword [ebp - 0x27c], eax
jne 0x4222b7
mov dword [ebp - 0x82c], 1
jmp 0x4222be
and dword [ebp - 0x82c], 0
cmp dword [ebp - 0x82c], 0xad50a0c
jle 0x4222e8
push 0
lea ecx, [ebp - 0x930]
call fcn.00433338
cmp dword [eax], 0
je 0x4222e8
mov dword [ebp - 0x50c], 1
jmp 0x4222ef
and dword [ebp - 0x50c], 0
cmp dword [ebp - 0x50c], 0x35e948ec
jne 0x422310
cmp dword [ebp - 0x27c], 0
je 0x422310
mov dword [ebp - 0x724], 1
jmp 0x422317
and dword [ebp - 0x724], 0
push 0
lea ecx, [ebp - 0x930]
call fcn.00433338
mov ecx, dword [ebp - 0x724]
cmp ecx, dword [eax]
jl 0x42233a
mov dword [ebp - 0x514], 1
jmp 0x422341
and dword [ebp - 0x514], 0
mov esi, dword [ebp - 0x514]
sub esi, dword [ebp - 0x8b4]
push dword [ebp - 0x168]
lea ecx, [ebp - 0x930]
call fcn.00433338
cmp esi, dword [eax]
jl 0x42236e
mov dword [ebp - 0x51c], 1
jmp 0x422375
and dword [ebp - 0x51c], 0
push 0
lea ecx, [ebp - 0x930]
call fcn.00433338
mov ecx, dword [ebp - 0x51c]
cmp ecx, dword [eax]
jle 0x422398
mov dword [ebp - 0x72c], 1
jmp 0x42239f
and dword [ebp - 0x72c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x72c]
mov dword [ebp + eax - 0xc80], ecx
jmp 0x422112
lea ecx, [ebp - 0x930]
call fcn.0043331c
xor eax, eax
jmp 0x426977
mov dword [ebp - 0x70], 3
mov dword [ebp - 0x18], 0xf251d69f
mov dword [ebp - 0x2f8], 0xffffffff
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x18], eax
jge 0x42252a
mov dword [ebp - 0x1b4], 0x439cb61d
mov dword [ebp - 0xab0], 0x28a062b0
mov dword [ebp - 0x534], 0x44198d72
mov dword [ebp - 0xf78], 0xfffffff6
mov dword [ebp - 0x2c0], 0xfaeb382e
mov dword [ebp - 0x18], 0
jmp 0x422435
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xf
jge 0x42246f
mov dword [ebp - 0xb04], 0x8561
cmp dword [ebp - 0x1b4], 1
jg 0x42245a
mov dword [ebp - 0x524], 1
jmp 0x422461
and dword [ebp - 0x524], 0
mov eax, dword [ebp - 0x524]
mov dword [ebp - 0xb04], eax
jmp 0x42242e
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0xfffffff6
jge 0x422491
mov dword [ebp - 0x9e0], 1
jmp 0x422498
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0xd20], eax
mov eax, dword [ebp - 0x1b4]
mov ecx, dword [ebp - 0x534]
sub ecx, 0x15ee56e3
sub eax, ecx
cmp eax, dword [ebp - 0x1b4]
jl 0x4224cc
mov dword [ebp - 0x834], 1
jmp 0x4224d3
and dword [ebp - 0x834], 0
cmp dword [ebp - 0x834], 0xe4ed
jne 0x4224eb
mov dword [ebp - 0x52c], 1
jmp 0x4224f2
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0x1b4]
cmp dword [ebp - 0x52c], eax
jle 0x42250c
mov dword [ebp - 0x734], 1
jmp 0x422513
and dword [ebp - 0x734], 0
mov eax, dword [ebp - 0xab0]
sub eax, dword [ebp - 0x734]
mov dword [ebp - 0x534], eax
jmp 0x422716
mov dword [ebp - 0x264], 0x1826
mov dword [ebp - 0x234], 0x5b0d6b1f
mov dword [ebp - 0x55c], 0xffffffff
mov dword [ebp - 0x22c], 0
jmp 0x422561
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 2
jge 0x42257d
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xd70], 0xfffffffe
jmp 0x422554
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xe54], eax
mov eax, dword [ebp - 0x264]
cmp dword [ebp - 0x18], eax
jl 0x42259d
mov dword [ebp - 0x83c], 1
jmp 0x4225a4
and dword [ebp - 0x83c], 0
cmp dword [ebp - 0x264], 1
jg 0x4225b9
mov dword [ebp - 0x8f8], 1
jmp 0x4225c0
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x8f8]
mov dword [ebp - 0x2f8], eax
cmp dword [ebp - 0x2f8], 0xffffffff
jl 0x4225e1
mov dword [ebp - 0x53c], 1
jmp 0x4225e8
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x53c]
cmp eax, dword [ebp - 0x18]
jg 0x422603
mov dword [ebp - 0x73c], 1
jmp 0x42260a
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 0x73c]
neg eax
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0xd28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xedc], eax
imul eax, dword [ebp - 0x2f8], 0xfffffff8
imul eax, dword [ebp - 0x264]
test eax, eax
je 0x422651
cmp dword [ebp - 0x70], 0
je 0x422651
mov dword [ebp - 0x544], 1
jmp 0x422658
and dword [ebp - 0x544], 0
imul eax, dword [ebp - 0x544], 0xe525
cmp eax, dword [ebp - 0x18]
jg 0x422673
mov dword [ebp - 0x54c], 1
jmp 0x42267a
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x83c]
imul eax, dword [ebp - 0x54c]
cmp eax, dword [ebp - 0x264]
jge 0x4226a1
cmp dword [ebp - 0x70], 0
je 0x4226a1
mov dword [ebp - 0x744], 1
jmp 0x4226a8
and dword [ebp - 0x744], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xd70]
cmp dword [ebp - 0x744], eax
jle 0x4226c9
mov dword [ebp - 0x554], 1
jmp 0x4226d0
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x70]
cmp eax, dword [ebp - 0x554]
jg 0x4226e7
mov dword [ebp - 0x8bc], 1
jmp 0x4226ee
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x55c]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x70], 0
jmp 0x422726
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x15
jg 0x42274e
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x422744
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
cmp dword [ebp - 0x18], 0
je 0x42274c
jmp 0x42271f
jmp 0x42271f
push 0x1aba
push 0x153b
push 1
push 1
push 0x5c94
push 1
lea eax, [ebp - 0x218]
push eax
push 1
push 0x4930
push 1
push 1
push 0x3bd8
push dword [ebp - 0x198]
call fcn.0041a6b2
add esp, 0x34
mov dword [ebp - 0x8c], 0x5b57fd54
mov dword [ebp - 0x564], 0
mov dword [ebp - 0x28c], 0
jmp 0x4227b5
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jge 0x4227d1
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0xd7c], 0xf219a6f
jmp 0x4227a8
mov dword [ebp - 0x8c], 0
jmp 0x4227ea
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 6
jg 0x422938
mov dword [ebp - 0x844], 0xc7c8a6b9
mov dword [ebp - 0x1a4], 0xbf2b2994
mov dword [ebp - 0x754], 0x6ae49a2f
mov eax, dword [ebp - 0x844]
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a4], 1
cmp dword [ebp - 0x1a4], 0
jne 0x42287c
cmp dword [ebp - 0x1a4], 0
je 0x422852
cmp dword [ebp - 0x8c], 0
je 0x422852
mov dword [ebp - 0x74c], 1
jmp 0x422859
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x74c]
mov dword [ebp - 0x564], eax
mov eax, dword [ebp - 0x564]
sub eax, dword [ebp - 0x8c]
jne 0x42287c
and dword [ebp - 0x574], 0
jmp 0x422886
mov dword [ebp - 0x574], 1
cmp dword [ebp - 0x844], 1
ja 0x42289b
mov dword [ebp - 0x56c], 1
jmp 0x4228a2
and dword [ebp - 0x56c], 0
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x754], eax
mov eax, dword [ebp - 0x754]
cmp dword [ebp - 0x574], eax
jge 0x4228c8
mov dword [ebp - 0x8d0], 1
jmp 0x4228cf
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8c]
add eax, dword [ebp - 0x8d0]
cmp eax, dword [ebp - 0x8c]
jl 0x4228ef
mov dword [ebp - 0x57c], 1
jmp 0x4228f6
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x57c], eax
jge 0x422916
cmp dword [ebp - 0x1a4], 0
jne 0x422916
and dword [ebp - 0x75c], 0
jmp 0x422920
mov dword [ebp - 0x75c], 1
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x75c]
mov dword [ebp + eax - 0xd7c], ecx
jmp 0x4227dd
cmp dword [ebp - 0x218], 0
jne 0x422e7a
mov dword [ebp - 0x20], 0x44182bd7
mov dword [ebp - 0x594], 1
mov dword [ebp - 0x2c8], 0xa0148014
mov dword [ebp - 0x318], 0x8a81d5f4
mov dword [ebp - 0x5a4], 0x95e1
mov dword [ebp - 0xac], 0
jmp 0x42298d
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x4229a9
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x1c4], 0x5f5c
jmp 0x422980
mov dword [ebp - 0xac], 0
jmp 0x4229c2
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jge 0x4229de
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0x58c], 0xfffffffd
jmp 0x4229b5
mov dword [ebp - 0x20], 0
jmp 0x4229ee
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x422a0a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x1c4]
mov dword [ebp + ecx*4 - 0x1c4], eax
jmp 0x4229e7
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x20]
cmp dword [ebp + eax - 0x1c4], ecx
jne 0x422a28
mov dword [ebp - 0x584], 1
jmp 0x422a2f
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x422b1b
mov dword [ebp - 0x594], 8
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x58c], 0xffb9
mov eax, 0xffb9
sub eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
jae 0x422a76
mov dword [ebp - 0x84c], 1
jmp 0x422a7d
and dword [ebp - 0x84c], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x84c], eax
jge 0x422a9d
cmp dword [ebp - 0x2c8], 0
je 0x422a9d
mov dword [ebp - 0x9e8], 1
jmp 0x422aa4
and dword [ebp - 0x9e8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x58c]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x20], eax
jge 0x422ace
mov dword [ebp - 0x764], 1
jmp 0x422ad5
and dword [ebp - 0x764], 0
mov eax, dword [ebp - 0x764]
sub eax, dword [ebp - 0x20]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x1c4]
je 0x422af9
mov dword [ebp - 0xa38], 1
jmp 0x422b00
and dword [ebp - 0xa38], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xd30], eax
cmp dword [ebp - 0x594], 0
jne 0x422b1b
and dword [ebp - 0x8c4], 0
jmp 0x422b25
mov dword [ebp - 0x8c4], 1
cmp dword [ebp - 0x8c4], 0xd7ba9668
ja 0x422b3d
mov dword [ebp - 0x59c], 1
jmp 0x422b44
and dword [ebp - 0x59c], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x59c], eax
jg 0x422b5e
mov dword [ebp - 0x76c], 1
jmp 0x422b65
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x318]
cmp dword [ebp - 0x76c], eax
jg 0x422b85
cmp dword [ebp - 0x5a4], 0
jne 0x422b85
and dword [ebp - 0x9f0], 0
jmp 0x422b8f
mov dword [ebp - 0x9f0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c4]
mov dword [ebp - 0xe5c], eax
mov eax, 0x29bfaead
test eax, eax
je 0x422bc0
mov eax, 0x259dba5c
test eax, eax
je 0x422bc0
mov dword [ebp - 0x854], 1
jmp 0x422bc7
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x5a4]
cmp dword [ebp - 0x854], eax
jg 0x422be1
mov dword [ebp - 0x5ac], 1
jmp 0x422be8
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x318], eax
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x2d0], 1
mov dword [ebp - 0x300], 0xf446cd5f
mov dword [ebp - 0x77c], 0x8451d77f
push 1
lea ecx, [ebp - 0xc74]
call fcn.0043324a
mov dword [ebp - 0x9f8], 2
mov dword [ebp - 0x94], 0
jmp 0x422c4c
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jge 0x422c68
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0xb90], 0
jmp 0x422c3f
mov dword [ebp - 0x94], 0
jmp 0x422c81
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 1
jge 0x422ca3
push dword [ebp - 0x94]
lea ecx, [ebp - 0xc74]
call fcn.00433338
mov dword [eax], 3
jmp 0x422c74
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb0]
mov dword [ebp + eax - 0xb90], ecx
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb90], 0x51efdb
mov eax, 0x51efdb
cmp eax, 0xb57a67d9
ja 0x422cdf
mov dword [ebp - 0x774], 1
jmp 0x422ce6
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x774]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
add eax, 0x105a83d8
cmp eax, dword [ebp - 0xb0]
jl 0x422d11
mov dword [ebp - 0x5b4], 1
jmp 0x422d18
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x5b4], eax
jg 0x422d32
mov dword [ebp - 0x8d4], 1
jmp 0x422d39
and dword [ebp - 0x8d4], 0
cmp dword [ebp - 0x8d4], 0
jne 0x422d4e
mov dword [ebp - 0x5bc], 1
jmp 0x422d55
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp - 0xb0]
sub eax, dword [ebp - 0x77c]
jne 0x422d8e
mov dword [ebp - 0x5c4], 1
jmp 0x422d95
and dword [ebp - 0x5c4], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x5c4], eax
je 0x422daf
mov dword [ebp - 0x85c], 1
jmp 0x422db6
and dword [ebp - 0x85c], 0
cmp dword [ebp - 0x85c], 0
jbe 0x422dcb
mov dword [ebp - 0xa3c], 1
jmp 0x422dd2
and dword [ebp - 0xa3c], 0
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0xd38], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x300], eax
je 0x422df8
mov dword [ebp - 0x2d8], 1
jmp 0x422dff
and dword [ebp - 0x2d8], 0
push 0
lea ecx, [ebp - 0xc74]
call fcn.00433338
mov ecx, dword [ebp - 0x2d8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x2d8], eax
jle 0x422e2e
mov dword [ebp - 0x5cc], 1
jmp 0x422e35
and dword [ebp - 0x5cc], 0
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x5cc], eax
jne 0x422e4f
mov dword [ebp - 0x784], 1
jmp 0x422e56
and dword [ebp - 0x784], 0
imul eax, dword [ebp - 0x784], 0x97a8
neg eax
mov dword [ebp - 0x9f8], eax
lea ecx, [ebp - 0xc74]
call fcn.0043331c
xor eax, eax
jmp 0x426977
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x23c], 0
jmp 0x422e9d
mov eax, dword [ebp - 0x23c]
inc eax
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 4
jge 0x422eb9
mov eax, dword [ebp - 0x23c]
mov dword [ebp + eax*4 - 0xfb8], 0xb6fe6d39
jmp 0x422e90
mov byte [ebp - 0xfd], 0
movzx eax, byte [ebp - 0xfd]
test eax, eax
je 0x422edf
push 0
push 0x249c
push 0xbd8
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x158], 0x1c
jmp 0x422ef8
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xfffffffc
jne 0x42301b
mov dword [ebp - 0x178], 0xfff8
mov dword [ebp - 0xa00], 0xfff8
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0xf5c], eax
mov eax, dword [ebp - 0x178]
cmp dword [ebp - 0x178], eax
je 0x422f3f
mov dword [ebp - 0x5d4], 1
jmp 0x422f46
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xd40], eax
cmp dword [ebp - 0x178], 0xffffffff
je 0x422f67
mov dword [ebp - 0x8cc], 1
jmp 0x422f6e
and dword [ebp - 0x8cc], 0
mov eax, dword [ebp - 0x5d4]
cmp eax, dword [ebp - 0x8cc]
jg 0x422f88
mov dword [ebp - 0xa44], 1
jmp 0x422f8f
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0xe64], eax
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xfb8]
cmp dword [ebp - 0x158], eax
jge 0x422fc2
cmp dword [ebp - 0x178], 0
jne 0x422fc2
and dword [ebp - 0x5dc], 0
jmp 0x422fcc
mov dword [ebp - 0x5dc], 1
cmp dword [ebp - 0x5dc], 0x176
je 0x422fe4
mov dword [ebp - 0x78c], 1
jmp 0x422feb
and dword [ebp - 0x78c], 0
cmp dword [ebp - 0x78c], 0x7e44
je 0x423003
mov dword [ebp - 0x5e4], 1
jmp 0x42300a
and dword [ebp - 0x5e4], 0
mov eax, dword [ebp - 0x5e4]
mov dword [ebp - 0xa00], eax
jmp 0x422eeb
push 0x5f3f
push 0x451d
push 1
lea eax, [ebp - 0xd48]
push eax
push 0x11d7
push dword [ebp - 0x320]
push 0x58bc
push 0x364a
push dword [ebp - 0x198]
push 0x73f3
push 1
push 1
lea eax, [ebp - 0x218]
push eax
push 1
push 0x107c
lea eax, [ebp - 0x64]
push eax
push 0x118c
push 0x7e25
push 1
push 0x833
push 0x3af7
push 0x2aef
push 1
push 0x3aaa
call fcn.0041ec11
add esp, 0x60
push 3
lea ecx, [ebp - 0x188]
call fcn.0043324a
mov dword [ebp - 0x48], 0xe2236432
push 3
lea ecx, [ebp - 0xbf0]
call fcn.0043324a
mov dword [ebp - 0x308], 0x48ec3df5
mov dword [ebp - 0xa5c], 0x7c8ceaaf
mov dword [ebp - 0x9c], 0
jmp 0x4230dc
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x4230fe
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x188]
call fcn.00433338
mov dword [eax], 0xb9b55bb2
jmp 0x4230cf
mov dword [ebp - 0x9c], 0
jmp 0x423117
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x423139
push dword [ebp - 0x9c]
lea ecx, [ebp - 0xbf0]
call fcn.00433338
mov dword [eax], 0x6c64e719
jmp 0x42310a
mov dword [ebp - 0x48], 0
jmp 0x423149
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 2
jg 0x4237bb
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x104], 1
mov dword [ebp - 0x190], 0
mov dword [ebp - 0x38], 2
jmp 0x42317e
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x4237b6
mov dword [ebp - 0xa54], 0
push 1
lea ecx, [ebp - 0xb80]
call fcn.0043324a
mov dword [ebp - 0x63c], 0x66aa6f69
mov dword [ebp - 0xa64], 0
mov dword [ebp - 0x1dc], 0
jmp 0x4231cc
mov eax, dword [ebp - 0x1dc]
inc eax
mov dword [ebp - 0x1dc], eax
cmp dword [ebp - 0x1dc], 1
jge 0x4231eb
push dword [ebp - 0x1dc]
lea ecx, [ebp - 0xb80]
call fcn.00433338
or dword [eax], 0xffffffff
jmp 0x4231bf
push dword [ebp - 0x48]
lea ecx, [ebp - 0x188]
call fcn.00433338
mov esi, eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x188]
call fcn.00433338
mov ecx, dword [esi]
imul ecx, dword [eax]
cmp ecx, 0xdbdf7cd9
jne 0x423222
mov dword [ebp - 0x864], 1
jmp 0x423229
and dword [ebp - 0x864], 0
mov esi, dword [ebp - 0x864]
neg esi
push 0
lea ecx, [ebp - 0x188]
call fcn.00433338
imul esi, dword [eax]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x188]
call fcn.00433338
cmp esi, dword [eax]
jg 0x42325f
mov dword [ebp - 0x5ec], 1
jmp 0x423266
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x5ec], eax
jg 0x42328f
push 0
lea ecx, [ebp - 0x188]
call fcn.00433338
cmp dword [eax], 0
je 0x42328f
mov dword [ebp - 0x794], 1
jmp 0x423296
and dword [ebp - 0x794], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x188]
call fcn.00433338
mov eax, dword [eax]
cmp eax, dword [ebp - 0x794]
jge 0x4232ba
mov dword [ebp - 0x5f4], 1
jmp 0x4232c1
and dword [ebp - 0x5f4], 0
mov eax, dword [ebp - 0x5f4]
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0
je 0x423489
mov dword [ebp - 0x18c], 0xbed162c5
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x423304
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp - 0x48], 0
je 0x423370
cmp dword [ebp - 0x18c], 0
je 0x423326
push dword [ebp - 0x38]
lea ecx, [ebp - 0x188]
call fcn.00433338
cmp dword [eax], 0
jne 0x423342
push dword [ebp - 0x48]
lea ecx, [ebp - 0x188]
call fcn.00433338
cmp dword [eax], 0
jne 0x423342
and dword [ebp - 0x8dc], 0
jmp 0x42334c
mov dword [ebp - 0x8dc], 1
mov eax, dword [ebp - 0x18c]
imul eax, dword [ebp - 0x8dc]
test eax, eax
jne 0x423364
push 4
pop eax
test eax, eax
je 0x423370
mov dword [ebp - 0x5fc], 1
jmp 0x423377
and dword [ebp - 0x5fc], 0
push dword [ebp - 0x48]
lea ecx, [ebp - 0x188]
call fcn.00433338
mov ecx, dword [ebp - 0x5fc]
cmp ecx, dword [eax]
je 0x4233a1
cmp dword [ebp - 0x104], 0
jne 0x4233a1
and dword [ebp - 0xa4c], 0
jmp 0x4233ab
mov dword [ebp - 0xa4c], 1
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xeec], eax
mov eax, dword [ebp - 0x18c]
imul ecx, dword [ebp - 0x18c], 0xffffffff
add eax, ecx
cmp eax, 0xfaa83fb1
jae 0x4233d6
mov dword [ebp - 0x79c], 1
jmp 0x4233dd
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x18c]
cmp dword [ebp - 0x79c], eax
jge 0x4233f7
mov dword [ebp - 0xa08], 1
jmp 0x4233fe
and dword [ebp - 0xa08], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x188]
call fcn.00433338
mov eax, dword [ebp - 0xa54]
mov dword [ebp - 0xd50], eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x188]
call fcn.00433338
cmp dword [eax], 0xfffffffa
jl 0x423437
mov dword [ebp - 0x604], 1
jmp 0x42343e
and dword [ebp - 0x604], 0
cmp dword [ebp - 0x604], 0
jb 0x423453
mov dword [ebp - 0x86c], 1
jmp 0x42345a
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x86c], eax
jg 0x423474
mov dword [ebp - 0x60c], 1
jmp 0x42347b
and dword [ebp - 0x60c], 0
mov eax, dword [ebp - 0x60c]
mov dword [ebp - 0x190], eax
jmp 0x42349f
cmp dword [ebp - 0x48], 0
je 0x42349f
lea ecx, [ebp - 0xb80]
call fcn.0043331c
jmp 0x4237b6
mov dword [ebp - 0x104], 0
jmp 0x4234b8
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jg 0x4237a6
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x614], 0x7f484382
mov dword [ebp - 0xa18], 0xfffffffb
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0xe6c], eax
push dword [ebp - 0x48]
lea ecx, [ebp - 0x188]
call fcn.00433338
cmp dword [eax], 0
jge 0x42351b
mov dword [ebp - 0x2e0], 1
jmp 0x423522
and dword [ebp - 0x2e0], 0
push 1
lea ecx, [ebp - 0xbf0]
call fcn.00433338
mov ecx, dword [ebp - 0x2e0]
mov dword [eax], ecx
cmp dword [ebp - 0x2e0], 0xa90d
jg 0x42354f
mov dword [ebp - 0x7a4], 1
jmp 0x423556
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0x614], eax
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x614], eax
jne 0x42357c
mov dword [ebp - 0x8e4], 1
jmp 0x423583
and dword [ebp - 0x8e4], 0
cmp dword [ebp - 0x8e4], 0x1d02
jne 0x42359b
mov dword [ebp - 0x61c], 1
jmp 0x4235a2
and dword [ebp - 0x61c], 0
push dword [ebp - 0x38]
lea ecx, [ebp - 0x188]
call fcn.00433338
mov ecx, dword [ebp - 0x61c]
cmp ecx, dword [eax]
jne 0x4235c6
mov dword [ebp - 0x7ac], 1
jmp 0x4235cd
and dword [ebp - 0x7ac], 0
mov esi, dword [ebp - 0x160]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x188]
call fcn.00433338
mov ecx, dword [ebp - 0x7ac]
sub ecx, dword [eax]
cmp esi, ecx
jl 0x4235f9
mov dword [ebp - 0x624], 1
jmp 0x423600
and dword [ebp - 0x624], 0
push 0
lea ecx, [ebp - 0x188]
call fcn.00433338
mov ecx, dword [ebp - 0x624]
cmp ecx, dword [eax]
jl 0x423623
mov dword [ebp - 0x874], 1
jmp 0x42362a
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x190]
cmp dword [ebp - 0x874], eax
jne 0x42364d
cmp dword [ebp - 0x160], 0
je 0x42364d
mov dword [ebp - 0x62c], 1
jmp 0x423654
and dword [ebp - 0x62c], 0
cmp dword [ebp - 0x62c], 8
jb 0x423669
mov dword [ebp - 0x7b4], 1
jmp 0x423670
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x308]
imul eax, dword [ebp - 0x7b4]
cmp eax, 0xc248bdd0
ja 0x423690
mov dword [ebp - 0x634], 1
jmp 0x423697
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x634], eax
jge 0x4236b1
mov dword [ebp - 0x8d8], 1
jmp 0x4236b8
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x8d8], eax
jge 0x4236e5
push dword [ebp - 0x38]
lea ecx, [ebp - 0x188]
call fcn.00433338
cmp dword [eax], 0
je 0x4236e5
mov dword [ebp - 0xa10], 1
jmp 0x4236ec
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0xa5c]
mov dword [ebp - 0xd58], eax
push 0
lea ecx, [ebp - 0xb80]
call fcn.00433338
mov dword [eax], 0x1e7d42a8
mov dword [ebp - 0x63c], 0x1e7d42a8
cmp dword [ebp - 0x63c], 0xffffffff
jne 0x42372a
mov dword [ebp - 0x7bc], 1
jmp 0x423731
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x308]
cmp dword [ebp - 0x7bc], eax
jge 0x42374b
mov dword [ebp - 0x644], 1
jmp 0x423752
and dword [ebp - 0x644], 0
cmp dword [ebp - 0x644], 0xfffffffc
jae 0x423767
mov dword [ebp - 0x87c], 1
jmp 0x42376e
and dword [ebp - 0x87c], 0
mov eax, dword [ebp - 0xa18]
add eax, dword [ebp - 0x87c]
cmp eax, dword [ebp - 0x190]
je 0x42378e
mov dword [ebp - 0x64c], 1
jmp 0x423795
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
mov dword [ebp - 0xa64], eax
jmp 0x4234ab
lea ecx, [ebp - 0xb80]
call fcn.0043331c
jmp 0x423177
jmp 0x423142
lea ecx, [ebp - 0xbf0]
call fcn.0043331c
lea ecx, [ebp - 0x188]
call fcn.0043331c
push 0x7517
push 0
push 0x4030
push 0
push 1
push dword [ebp - 0x64]
push 0x2619
push dword [ebp - 0x198]
push 0x69b
push dword [ebp + 8]
call fcn.00416247
add esp, 0x28
push 3
lea ecx, [ebp - 0x974]
call fcn.0043324a
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0x8e0], 0x5f7a0d7c
mov dword [ebp - 0xf60], 0xe3c1
mov dword [ebp - 0xd60], 0x78be
mov dword [ebp - 0xe74], 0x65bbd97
push 3
lea ecx, [ebp - 0xc68]
call fcn.0043324a
mov dword [ebp - 0xa28], 0
mov dword [ebp - 0x74], 0
jmp 0x423865
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x423881
push dword [ebp - 0x74]
lea ecx, [ebp - 0x974]
call fcn.00433338
mov dword [eax], 0xcff0
jmp 0x42385e
mov dword [ebp - 0x74], 0
jmp 0x423891
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x4238aa
push dword [ebp - 0x74]
lea ecx, [ebp - 0xc68]
call fcn.00433338
or dword [eax], 0xffffffff
jmp 0x42388a
mov dword [ebp - 0xc8], 0
jmp 0x4238c3
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 2
jg 0x423c14
mov dword [ebp - 0x3e8], 5
mov dword [ebp - 0xa6c], 0x4518073
mov dword [ebp - 0x26c], 0
jmp 0x4238fd
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 2
jge 0x423919
mov eax, dword [ebp - 0x26c]
mov dword [ebp + eax*4 - 0x1cc], 0xffffffff
jmp 0x4238f0
push 0
lea ecx, [ebp - 0x974]
call fcn.00433338
cmp dword [eax], 1
jne 0x423937
mov dword [ebp - 0x7c4], 1
jmp 0x42393e
and dword [ebp - 0x7c4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x7c4], eax
jge 0x42395f
mov dword [ebp - 0x654], 1
jmp 0x423966
and dword [ebp - 0x654], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x654], eax
jge 0x423987
mov dword [ebp - 0xa20], 1
jmp 0x42398e
and dword [ebp - 0xa20], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
mov dword [ebp - 0xd68], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1cc], 0xb51f0ef2
jae 0x4239c0
mov dword [ebp - 0x900], 1
jmp 0x4239c7
and dword [ebp - 0x900], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x900], eax
jg 0x4239e8
mov dword [ebp - 0x65c], 1
jmp 0x4239ef
and dword [ebp - 0x65c], 0
push 1
lea ecx, [ebp - 0x974]
call fcn.00433338
mov ecx, dword [ebp - 0x65c]
add ecx, dword [eax]
cmp ecx, dword [ebp - 0xc8]
jge 0x423a18
mov dword [ebp - 0x7cc], 1
jmp 0x423a1f
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x7cc], eax
jle 0x423a39
mov dword [ebp - 0x664], 1
jmp 0x423a40
and dword [ebp - 0x664], 0
mov eax, dword [ebp - 0x664]
sub eax, 5
je 0x423a67
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1cc], 0
je 0x423a67
mov dword [ebp - 0x884], 1
jmp 0x423a6e
and dword [ebp - 0x884], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x884], eax
jl 0x423a8f
mov dword [ebp - 0x66c], 1
jmp 0x423a96
and dword [ebp - 0x66c], 0
cmp dword [ebp - 0x66c], 0xdc0f1fa6
je 0x423aae
mov dword [ebp - 0x7d4], 1
jmp 0x423ab5
and dword [ebp - 0x7d4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
add eax, dword [ebp - 0x7d4]
cmp eax, 8
jle 0x423ad9
mov dword [ebp - 0x674], 1
jmp 0x423ae0
and dword [ebp - 0x674], 0
mov eax, dword [ebp - 0x674]
mov dword [ebp - 0x8e0], eax
cmp dword [ebp - 0x8e0], 0x77d7
jl 0x423b04
mov dword [ebp - 0x67c], 1
jmp 0x423b0b
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x67c], eax
je 0x423b25
mov dword [ebp - 0x7dc], 1
jmp 0x423b2c
and dword [ebp - 0x7dc], 0
cmp dword [ebp - 0x7dc], 0xfffffff6
jae 0x423b41
mov dword [ebp - 0x684], 1
jmp 0x423b48
and dword [ebp - 0x684], 0
cmp dword [ebp - 0x684], 0xba8d
je 0x423b60
mov dword [ebp - 0x88c], 1
jmp 0x423b67
and dword [ebp - 0x88c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
cmp dword [ebp - 0x88c], eax
jle 0x423b88
mov dword [ebp - 0x68c], 1
jmp 0x423b8f
and dword [ebp - 0x68c], 0
mov eax, dword [ebp - 0xc8]
cmp eax, dword [ebp - 0x68c]
jle 0x423ba9
mov dword [ebp - 0x7e4], 1
jmp 0x423bb0
and dword [ebp - 0x7e4], 0
mov eax, dword [ebp - 0x7e4]
mov dword [ebp - 0x3e8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cc]
mov dword [ebp - 0xd9c], eax
mov eax, dword [ebp - 0x3e8]
mov dword [ebp - 0xd74], eax
push 2
lea ecx, [ebp - 0x974]
call fcn.00433338
cmp dword [eax], 0x711f64db
je 0x423bfc
mov dword [ebp - 0x3f0], 1
jmp 0x423c03
and dword [ebp - 0x3f0], 0
mov eax, dword [ebp - 0x3f0]
mov dword [ebp - 0xa6c], eax
jmp 0x4238b6
push 0
lea ecx, [ebp - 0xc68]
call fcn.00433338
mov dword [eax], 1
push 5
pop esi
inc esi
push 1
lea ecx, [ebp - 0x974]
call fcn.00433338
cmp esi, dword [eax]
jne 0x423c48
mov dword [ebp - 0x3f8], 1
jmp 0x423c4f
and dword [ebp - 0x3f8], 0
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0xa28], eax
lea ecx, [ebp - 0xc68]
call fcn.0043331c
lea ecx, [ebp - 0x974]
call fcn.0043331c
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 0x218]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x478], ecx
mov dword [ebp - 0x54], 0xfffffff8
mov dword [ebp - 0xa74], 1
mov dword [ebp - 0xb0c], 0x4a53e8af
mov dword [ebp - 0xda0], 0x597fb6f8
push 3
lea ecx, [ebp - 0xf18]
call fcn.0043324a
mov dword [ebp - 0xd80], 4
mov dword [ebp - 0x470], 0xfff9
mov dword [ebp - 0x34], 0
jmp 0x423cdc
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x423cf2
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x348], 0x8114768c
jmp 0x423cd5
mov dword [ebp - 0x34], 0
jmp 0x423d02
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x423d1b
push dword [ebp - 0x34]
lea ecx, [ebp - 0xf18]
call fcn.00433338
or dword [eax], 0xffffffff
jmp 0x423cfb
mov dword [ebp - 0x34], 0
jmp 0x423d2b
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 4
jge 0x423d41
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1008], 1
jmp 0x423d24
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x348], 0
jne 0x423d68
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x348], 0
jne 0x423d68
and dword [ebp - 0x400], 0
jmp 0x423d72
mov dword [ebp - 0x400], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x348]
cmp dword [ebp - 0x400], eax
jl 0x423d92
mov dword [ebp - 0x408], 1
jmp 0x423d99
and dword [ebp - 0x408], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x348]
cmp dword [ebp - 0x408], eax
jne 0x423db9
mov dword [ebp - 0x410], 1
jmp 0x423dc0
and dword [ebp - 0x410], 0
mov eax, dword [ebp - 0x410]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x423de6
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x348]
mov dword [ebp - 0xa74], eax
jmp 0x42406c
mov dword [ebp - 0x2e8], 8
mov dword [ebp - 0x144], 0xf25db2b0
mov dword [ebp - 0x2a4], 0x5243b9c
mov dword [ebp - 0xab8], 0x942796a4
mov dword [ebp - 0xa48], 0xaabdc9a8
mov dword [ebp - 0x54], 2
jmp 0x423e28
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x423fcb
mov dword [ebp - 0xda8], 0xffffffff
mov dword [ebp - 0x430], 0x969ac54c
mov dword [ebp - 0xa34], 0x8018d9dc
cmp dword [ebp - 0x144], 1
jg 0x423e6e
cmp dword [ebp - 0xa34], 0
je 0x423e6e
mov dword [ebp - 0x418], 1
jmp 0x423e75
and dword [ebp - 0x418], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x418]
sub ecx, dword [ebp + eax - 0x348]
sub ecx, 0x7617c0ec
xor eax, eax
sub eax, ecx
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x144]
imul eax, dword [ebp - 0x2a4]
cmp eax, dword [ebp - 0x54]
jne 0x423eb5
mov dword [ebp - 0x420], 1
jmp 0x423ebc
and dword [ebp - 0x420], 0
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp + ecx*4 - 0x348]
imul ecx, dword [ebp - 0x420]
add ecx, dword [ebp - 0x54]
cmp dword [ebp + eax*4 - 0x348], ecx
jne 0x423ee8
mov dword [ebp - 0x428], 1
jmp 0x423eef
and dword [ebp - 0x428], 0
mov eax, dword [ebp - 0x428]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x144]
cmp dword [ebp - 0x430], eax
jne 0x423f15
mov dword [ebp - 0x438], 1
jmp 0x423f1c
and dword [ebp - 0x438], 0
mov eax, dword [ebp - 0x2e8]
mov dword [ebp - 0xa7c], eax
mov eax, dword [ebp - 0x438]
mov dword [ebp - 0xa84], eax
mov eax, dword [ebp - 0x2e8]
dec eax
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0xa7c]
cmp eax, dword [ebp - 0xa84]
je 0x423f5b
mov dword [ebp - 0xa40], 1
jmp 0x423f62
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0xd8c], eax
mov eax, 0xb0d5
cmp eax, 0x7ea1
jg 0x423f86
mov dword [ebp - 0x440], 1
jmp 0x423f8d
and dword [ebp - 0x440], 0
mov eax, dword [ebp - 0x440]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 0
je 0x423fb3
xor eax, eax
inc eax
je 0x423fb3
mov dword [ebp - 0x448], 1
jmp 0x423fba
and dword [ebp - 0x448], 0
mov eax, dword [ebp - 0x448]
mov dword [ebp - 0xab8], eax
jmp 0x423e21
xor eax, eax
inc eax
je 0x423fe5
cmp dword [ebp - 0xa48], 0
je 0x423fe5
mov dword [ebp - 0x450], 1
jmp 0x423fec
and dword [ebp - 0x450], 0
cmp dword [ebp - 0x450], 0x98ef
jl 0x424004
mov dword [ebp - 0x458], 1
jmp 0x42400b
and dword [ebp - 0x458], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x458]
cmp eax, 3
jl 0x424026
mov dword [ebp - 0x460], 1
jmp 0x42402d
and dword [ebp - 0x460], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xb0c]
add ecx, dword [ebp - 0x460]
imul ecx, ecx, 7
cmp dword [ebp + eax - 0x348], ecx
jl 0x424057
mov dword [ebp - 0x468], 1
jmp 0x42405e
and dword [ebp - 0x468], 0
mov eax, dword [ebp - 0x468]
neg eax
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x470]
inc eax
mov dword [ebp - 0x470], eax
lea ecx, [ebp - 0xf18]
call fcn.0043331c
cmp dword [ebp - 0x478], 0
je 0x4240bf
push 0
push dword [ebp - 0x478]
push 1
push dword [ebp - 0x64]
push 0x7860
push 0x2767
push 0x7871
push 0x75eb
push 0x671a
push 1
push 0
call fcn.0042e862
add esp, 0x2c
mov dword [ebp - 0xdb0], 0xfffffffd
mov dword [ebp - 0xd98], 0x833fcb50
push 1
lea ecx, [ebp - 0xf38]
call fcn.0043324a
push 3
lea ecx, [ebp - 0xf28]
call fcn.0043324a
mov dword [ebp - 0xdb8], 0xfffffff7
mov dword [ebp - 0xbb8], 0xfffffff6
mov dword [ebp - 0xbb4], 0xfffffff6
mov dword [ebp - 0xbb0], 0xfffffff6
mov dword [ebp - 0xbac], 0xfffffff6
lea ecx, [ebp - 0x301]
call fcn.00433347
push eax
lea eax, [ebp - 0xba8]
push eax
lea eax, [ebp - 0xbb8]
push eax
lea ecx, [ebp - 0xfd0]
call fcn.0043334a
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfa0]
call fcn.004332f6
mov dword [ebp - 0xdc0], 0xea0262b0
mov dword [ebp - 0xda4], 9
push 3
lea ecx, [ebp - 0xc08]
call fcn.0043324a
mov dword [ebp - 0x28], 0
jmp 0x424185
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x4241a1
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf38]
call fcn.00433338
mov dword [eax], 8
jmp 0x42417e
mov dword [ebp - 0x28], 0
jmp 0x4241b1
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x4241ca
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf28]
call fcn.00433338
or dword [eax], 0xffffffff
jmp 0x4241aa
mov dword [ebp - 0x28], 0
jmp 0x4241da
cmp dword [ebp - 0x28], 3
jge 0x4241f6
push dword [ebp - 0x28]
lea ecx, [ebp - 0xc08]
call fcn.00433338
mov dword [eax], 1
jmp 0x4241d3
push 0
lea ecx, [ebp - 0xc08]
call fcn.00433338
mov dword [ebp - 0x480], eax
mov eax, dword [ebp - 0x480]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x480]
mov dword [ecx], eax
mov byte [ebp - 0x125], 0
movzx eax, byte [ebp - 0x125]
test eax, eax
je 0x42423a
pop esi
mov esp, ebp
pop ebp
ret