Function at 0x434bde
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d0
push ebx
push esi
push edi
push 2
pop ebx
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x9c]
push ebx
mov byte [ebp - 0x29], dl
call fcn.0043486b
mov dword [ebp - 8], 0xb02971c1
xor eax, eax
push 1
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x14], eax
pop edi
jmp 0x434c26
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x9c]
mov dword [ecx + edx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x434c17
mov dword [ebp - 8], edi
cmp dword [ebp - 8], eax
jl 0x434cd7
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x9c]
cmp dword [ecx + edx*4], eax
je 0x434c48
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 8]
cmp ecx, dword [edx + esi*4]
jge 0x434c77
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x434cb5
push 0xe8d
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor eax, eax
jmp 0x434cb5
mov dword [ebp - 0x18], 0x58efa97f
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x10], 0xd2ae857b
jbe 0x434c9f
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x434cce
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
xor eax, eax
dec dword [ebp - 8]
jns 0x434c37
mov dword [ebp - 0x10], 0x1b
jmp 0x434cfe
mov dword [ebp - 0x24], 0x50c19791
mov ecx, 0x14898d08
mov dword [ebp - 0x1c], 0xdb956746
mov eax, dword [ebp - 0x24]
sub ecx, eax
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 9
jg 0x434ce0
lea ecx, [ebp - 0x9c]
call fcn.0043493d
push 3
lea ecx, [ebp - 0xcc]
call fcn.0043486b
push edi
lea ecx, [ebp - 0x88]
call fcn.0043486b
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x434d42
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xcc]
mov dword [ecx + edx*4], 0x10c93b4e
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x434d2f
mov dword [ebp - 8], eax
jmp 0x434d5c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x88]
mov dword [ecx + edx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x434d4d
mov ecx, dword [ebp - 0x88]
mov dword [ecx], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 8], eax
jmp 0x434dff
mov dword [ebp - 0x10], 0xe3e63e31
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x434db1
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x434dac
push 0x1d6a
push 0x241b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x434d83
mov dword [ebp - 0x10], eax
jmp 0x434df7
mov dword [ebp - 0x18], 0xc40ed3c1
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x434df4
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x434def
push eax
push 0xa08
push 0xa3c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x434dc5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x434db6
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x434d74
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], eax
jl 0x434e48
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x434e30
push 0x146
push 0x2510
push 0x1b53
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor eax, eax
mov esi, dword [ebp - 0x88]
mov ecx, dword [ebp - 0xcc]
mov edx, dword [esi]
cmp dword [ecx + edx*4], eax
jne 0x434e4e
dec dword [ebp - 8]
jns 0x434e10
mov esi, dword [ebp - 0x88]
dec dword [esi]
jns 0x434d69
lea ecx, [ebp - 0x88]
call fcn.0043493d
lea ecx, [ebp - 0xcc]
call fcn.0043493d
xor eax, eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffe6
je 0x434f51
mov dword [ebp - 8], 8
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 0x9ea5d840
mov dword [ebp - 0x18], 0xb63e91c
mov dword [ebp - 8], eax
jmp 0x434f37
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
jmp 0x434f2a
mov dword [ebp - 0x18], 0x2f5a260d
mov dword [ebp - 0x24], 0x9e1f9531
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, edi
mov ecx, dword [ebp - 8]
setle dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x10]
setge bl
neg ecx
xor edx, edx
cmp ecx, ebx
setne dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov esi, dword [ebp - 0x18]
add esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp esi, ecx
setge dl
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffea
jne 0x434ead
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1c
je 0x434ea2
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe6
jne 0x434e82
push 2
pop ebx
mov dword [ebp - 0x10], 7
lea ecx, [ebp - 0xc0]
push 4
call fcn.0043486b
mov dword [ebp - 0x1c], 0xbf495e3b
lea ecx, [ebp - 0xf0]
push 3
call fcn.0043486b
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x1c], 0x6aac8953
mov dword [ebp - 0x18], 0xfff7
mov dword [ebp - 0x24], edi
push ebx
call fcn.0043486b
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x434fba
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc0]
mov dword [ecx + edx*4], 0x6a715cc4
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x434fa7
mov dword [ebp - 8], eax
jmp 0x434fd8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xf0]
mov dword [ecx + edx*4], 0x3a79cc09
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x434fc5
mov dword [ebp - 8], eax
jmp 0x434ff6
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x108]
mov dword [ecx + edx*4], 0xa2589d38
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x434fe3
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x43500b
call dword [sym.imp.USER32.dll_GetCapture]
xor eax, eax
cmp dword [ebp - 0x10], eax
jne 0x435021
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc0]
mov dword [ecx], edx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
mov edx, 0x2b82
sub edx, ecx
mov ecx, dword [ebp - 0x10]
cmp ecx, edx
mov ecx, dword [ebp - 0xf0]
setg bl
xor edx, edx
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
setle dl
mov dword [ebp - 0x1c], edx
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
cmp ecx, edi
setge dl
xor ecx, ecx
cmp edx, 0xfffffff6
setge cl
add ecx, 0xe982
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x108]
mov dword [ecx], eax
lea ecx, [ebp - 0x108]
call fcn.0043493d
lea ecx, [ebp - 0xf0]
call fcn.0043493d
lea ecx, [ebp - 0xc0]
call fcn.0043493d
push dword [ebp + 8]
mov edi, dword [0x4b35ec]
lea ecx, [ebp - 0x18c]
movdqa xmm0, xmmword [0xaa4d40]
xor eax, eax
push ecx
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x1c], 6
push ecx
mov dword [ebp - 8], 0x65e08ccc
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x18], 0x9b857552
push eax
mov dword [ebp - 0x48], edi
movdqu xmmword [ebp - 0x19c], xmm0
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
call fcn.004349ae
mov dword [ebp - 0x24], 0xe55b65ab
xor eax, eax
mov dword [ebp - 0x24], 0x1043
cmp dword [ebp - 8], eax
je 0x43513b
mov ecx, dword [ebp - 8]
add ecx, 0x6b180fba
je 0x43511c
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x18]
je 0x43513b
xor ecx, ecx
lea esi, [ecx + 1]
jmp 0x43513d
mov esi, eax
mov dword [ebp - 0x1c], eax
xor ebx, ebx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
setne bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 8]
setl dl
xor ebx, ebx
test esi, esi
mov dword [ebp - 0x24], edx
setns bl
xor edx, edx
cmp ebx, ecx
setge dl
xor ecx, ecx
cmp dword [ebp - 0x24], edx
setle cl
add ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 8]
jg 0x43519a
mov dword [ebp - 8], eax
jmp 0x435192
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ecx + edx*4]
mov dword [ebp - 0x24], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x435183
jmp 0x4351ac
mov ecx, dword [ebp - 0x7c]
xor edx, edx
cmp dword [ecx + 4], 0x35a7ab5b
setl dl
mov dword [ebp - 0x24], edx
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4351ce
push 0x5cd
push 0x1ba9
push 0x14f5
push 0x262e
call dword [sym.imp.GDI32.dll_CreateRectRgn]
lea ecx, [ebp - 0x7c]
call fcn.0043493d
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 8], 0xf3f6
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x24], 0x5cc7c44d
mov dword [ebp - 0x1c], 0x7440271d
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [ebp - 0x10], eax
jmp 0x43521b
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x17c], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x43520e
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x435234
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, dword [ebp - 0x14]
jl 0x435253
cmp dword [ebp - 0x18], eax
jne 0x435253
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
cmp dword [ebp - 8], 3
mov ecx, dword [ebp - 0x14]
sbb edx, edx
xor ebx, ebx
neg edx
cmp ecx, edx
mov ecx, dword [ebp - 0x24]
setge bl
xor edx, edx
cmp ebx, ecx
setne dl
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x178]
mov byte [ebp - 9], al
jg 0x4352a2
cmp byte [ebp - 9], 0
je 0x4352b2
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x4352b2
cmp byte [ebp - 9], 0
je 0x4352b2
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor ebx, ebx
inc ebx
cmp byte [ebp - 0x29], 0
je 0x435434
cmp edi, ebx
jne 0x435434
push ebx
lea ecx, [ebp - 0x148]
call fcn.0043486b
mov dword [ebp - 0x14], 0
jmp 0x4352ef
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x148]
mov dword [eax + ecx*4], 0xac8b13ec
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x4352dc
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x435306
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x43531d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
lea ecx, [ebp - 0x148]
call fcn.0043493d
mov dword [ebp - 0x18], 7
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x1c], 0x2f76ec75
mov dword [ebp - 0x20], 0x6c902da
mov dword [ebp - 0x1c], 0x7084bc9c
mov dword [ebp - 0x20], 0xfffffff6
push ebx
mov dword [esi + 8], 4
call fcn.0043486b
mov dword [ebp - 0x1c], 0x934b0b4e
mov eax, 0xbdd7
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x118], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 8], eax
jmp 0x43539c
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xe4]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x43538c
mov dword [ebp - 8], eax
jmp 0x4353b3
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x130], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4353a6
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4353d1
push 0xc6c
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor eax, eax
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jne 0x4353e5
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x130]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
inc eax
cmp eax, 9
mov eax, dword [ebp - 0x11c]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0xe4]
setne cl
mov dword [eax], ecx
lea ecx, [ebp - 0xe4]
call fcn.0043493d
mov dword [esi + 0xc], 0x4b35ec
mov dword [ebp - 0x70], ebx
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x14], 0xe7ed6f18
mov dword [ebp - 0x28], 0xaea381e1
push ebx
call fcn.0043486b
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x435475
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1bc], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x435468
mov dword [ebp - 8], eax
jmp 0x435493
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xfc]
mov dword [ecx + edx*4], 0xf8a4198f
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x435480
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], eax
jmp 0x435591
push 3
mov dword [ebp - 8], 0xe39e3cf9
lea ecx, [ebp - 0x15c]
pop ebx
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], ebx
push ebx
call fcn.0043486b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4354e3
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x15c]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x4354d4
mov ecx, dword [ebp - 0x64]
xor ebx, ebx
mov ecx, dword [ebp - 0x64]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
cmp ecx, edx
setle bl
mov dword [ebp - 0x14], ebx
xor ebx, ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x64]
cmp ecx, edx
mov ecx, dword [ebp - 8]
setle bl
imul ecx, ebx
xor ebx, ebx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x1b4]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1b4]
cmp edx, ecx
setge bl
cmp ebx, dword [ebp - 0x1c]
jg 0x435550
cmp dword [ebp - 0x64], eax
jne 0x435550
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x435555
xor ebx, ebx
inc ebx
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffffa
setle al
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x1f17
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0xfc]
setle cl
mov dword [eax], ecx
lea ecx, [ebp - 0x15c]
call fcn.0043493d
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff0
jl 0x4354a6
lea ecx, [ebp - 0xfc]
call fcn.0043493d
cmp dword [ebp - 0x34], edi
jge 0x435ff4
push 3
lea ecx, [ebp - 0x60]
call fcn.0043486b
mov dword [ebp - 8], 0xfffffff8
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x24], 0xfbf68593
push 4
call fcn.0043486b
xor eax, eax
mov dword [ebp - 0x28], 0x5e60d1f
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], eax
jmp 0x4355f5
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
mov dword [ecx + edx*4], 0x7571177e
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4355e5
mov dword [ebp - 8], eax
jmp 0x435613
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + edx*4], 0x49ec71cb
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x435600
push 2
mov dword [ebp - 8], eax
pop edi
jmp 0x435756
mov dword [ebp - 0x18], 0xfffe
mov dword [ebp - 0x1c], 0x81d4b4ea
mov dword [ebp - 0x10], eax
jmp 0x435645
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x40], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x435637
mov dword [ebp - 0x10], eax
jmp 0x435660
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x8c], 0x872a60d4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x43564f
mov dword [ebp - 0x40], edi
cmp dword [ebp - 0x40], eax
jl 0x435753
mov esi, dword [ebp - 0x114]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], 0xb2c57e71
xor ebx, ebx
mov dword [ebp - 0x10], 0xb1d6a56c
mov ecx, dword [ebp - 0x40]
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x60]
cmp dword [ecx + edx*4], eax
mov ecx, dword [ebp - 0x40]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setg dl
mov dword [esi + 4], edx
cmp dword [ebp - 0x40], eax
je 0x4356c2
mov ecx, dword [ebp - 0x60]
cmp dword [ecx], eax
je 0x4356c2
xor ecx, ecx
lea esi, [ecx + 1]
jmp 0x4356c4
mov esi, eax
mov ecx, dword [ebp - 0x28]
xor edx, edx
cmp esi, ecx
setg dl
cmp edx, dword [ebp - 0x3c]
jl 0x4356d6
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x8c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
dec dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x3c]
dec edx
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
add edx, ecx
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
setge bl
mov ecx, dword [ecx + edx*4]
mov dword [ebp - 0x1c], ecx
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edi, dword [ebp - 0x1c]
add edi, dword [ebp - 8]
mov ecx, dword [ebp - 0x60]
imul edi, dword [ecx + edx*4]
mov ecx, dword [ecx + esi*4]
mov edx, dword [ebp - 8]
imul ecx, ebx
mov esi, dword [ebp - 0x30]
sub edi, ecx
mov ecx, dword [ebp - 0x60]
neg edi
sbb edi, edi
inc edi
mov dword [ecx + edx*4], edi
mov ecx, dword [ebp - 0x10]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x40]
jns 0x43567a
xor ebx, ebx
push 2
inc ebx
pop edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x435624
lea ecx, [ebp - 0x114]
call fcn.0043493d
lea ecx, [ebp - 0x60]
call fcn.0043493d
mov dword [ebp - 0x10], 0xbac64a68
lea ecx, [ebp - 0x168]
push 3
mov ebx, 0x4b35f0
call fcn.0043486b
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4357a5
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x168]
mov dword [ecx + edx*4], 0xa3399244
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x435792
mov dword [ebp - 0x10], eax
jmp 0x4357c5
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4357c2
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff5
jge 0x4357b0
mov dword [ebp - 0x10], eax
jmp 0x4357f5
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4357f2
push eax
push 0x542
push eax
push 0x2305
push 0x1c5e
call dword [sym.imp.GDI32.dll_ExtCreatePen]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x4357d0
lea ecx, [ebp - 0x168]
call fcn.0043493d
cmp dword [ebp - 0x34], 0
jle 0x435d0b
xor esi, esi
xor eax, eax
inc esi
jmp 0x435819
push 2
pop edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xc8094a18
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], 0xfe5f36f6
mov dword [ebp - 0x20], 0x34d0069
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x20], 0x923607a9
mov dword [ebp - 0x20], 0xcef054a2
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0x868bb4a
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xc3837ace
mov dword [ebp - 0x20], 0x82ca9683
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xe637c5b1
mov dword [ebp - 0x20], 0xd13d8c53
mov dword [ebp - 0x20], 0xea7eb8e1
mov dword [ebp - 0x20], 0x20c4365d
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], 0x2a42bbd4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], 0x6a37bd55
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x14], eax
jmp 0x4358ca
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x1c4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x4358b9
inc dword [ebp - 0x1c]
mov ecx, dword [ebx]
mov dword [ebp - 0x44], 0x3185
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x14], 0xdc4b4e12
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x18], 0x921ded68
mov dword [ebp - 0x30], 0x9a130dfd
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], eax
jmp 0x43590f
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xb4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x435902
inc dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jmp 0x4359a8
mov dword [ebp - 8], 0xfffffffc
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
test ecx, ecx
sets dl
imul edx, dword [ebp - 8]
sub edx, dword [ebp - 8]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 8], edx
mov dword [ebp - 8], eax
jmp 0x4359a0
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x435974
push 0x1d6a
push 0x241b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0xb4], eax
jne 0x435991
mov ecx, dword [ebp - 8]
mov edx, eax
mov ecx, dword [ebp + ecx*4 - 0xb4]
cmp ecx, dword [ebp - 0x30]
jg 0x435993
mov edx, esi
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xb4], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jle 0x43594b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jl 0x435920
add ebx, 4
mov dword [ebp - 0x18], ebx
mov edi, dword [ebx]
mov dword [ebp - 8], 0xfffffffe
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 9
je 0x435a5a
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
setl bl
cmp ebx, 0xa7b7
jl 0x4359f2
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jne 0x435a02
cmp dword [ebp - 0x10], eax
jne 0x435a02
mov esi, eax
mov ecx, dword [ebp - 0x14]
xor edx, edx
cmp ecx, esi
mov ecx, dword [ebp - 0x10]
setl dl
xor ebx, ebx
cmp edx, ecx
setl bl
add ebx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
sub edx, ebx
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setne bl
xor edx, edx
add ebx, 0x5bed647b
cmp ebx, ecx
setle dl
sub edx, dword [ebp - 0x10]
mov dword [ebp - 0x30], edx
cmp dword [ebp - 8], eax
jne 0x435a54
inc dword [ebp - 8]
cmp dword [ebp - 8], 9
push 1
pop esi
jne 0x4359d4
mov ebx, dword [ebp - 0x18]
xor esi, esi
inc esi
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x435a84
push eax
push 0xa08
push 0xa3c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
xor eax, eax
add ebx, 4
mov dword [ebp - 0x10], eax
push esi
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x18], ebx
call fcn.0043486b
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
jmp 0x435ab6
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xd8]
mov dword [ecx + edx*4], 0xa733e34b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x435aa3
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffec
je 0x435b65
mov dword [ebp - 0x14], 0x101a
mov dword [ebp - 0x1c], 0x1a1f0506
mov dword [ebp - 0x1c], 0xb66efe0c
mov dword [ebp - 0x30], 0x80bfe737
cmp dword [ebp - 0x10], eax
je 0x435b4a
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
neg edx
mov ecx, dword [ebp - 0xd8]
sbb edx, edx
xor ebx, ebx
neg edx
mov dword [ecx], esi
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
cmp esi, ecx
mov ecx, dword [ebp - 0x14]
setle bl
xor edx, edx
cmp ebx, ecx
setge dl
add edx, dword [ebp - 0x10]
cmp edx, 0x56574b60
jg 0x435b34
cmp dword [ebp - 0x14], eax
jne 0x435b34
xor esi, esi
mov edx, eax
inc esi
jmp 0x435b39
xor esi, esi
inc esi
mov edx, esi
xor ecx, ecx
cmp edx, esi
setne cl
cmp ecx, 0xffff
mov ecx, esi
jae 0x435b4c
mov ecx, eax
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffec
jne 0x435ac8
mov ebx, dword [ebp - 0x18]
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x435b81
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
lea ecx, [ebp - 0xd8]
call fcn.0043493d
test edi, edi
jne 0x435b93
add ebx, 8
mov dword [ebp - 0x14], 0x13b91020
xor eax, eax
mov dword [ebp - 0x28], 0x7d8e6e83
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x44], 0x20859495
mov dword [ebp - 0x30], 0x452a2c7a
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffffb
je 0x435cff
push 3
pop edi
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa4d30]
lea ecx, [ebp - 0x17c]
push ecx
lea ecx, [ebp - 0x18c]
mov dword [ebp - 0x10], 0xe55059b8
push ecx
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa8], eax
movdqu xmmword [ebp - 0x18c], xmm0
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
call fcn.004349ae
mov dword [ebp - 0x30], 0x4dbf0cf
mov dword [ebp - 0x1c], 0x84cbed56
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x28], 0xfc353271
mov dword [ebp - 0x28], 0x4d91b059
mov dword [ebp - 0x24], 0xd070
inc dword [ebp - 0x10]
mov dword [ebp - 0x10], 0
jmp 0x435cdb
mov dword [ebp - 0x18], 0x63069be5
mov dword [ebp - 0x28], 0xa218f0ed
mov dword [ebp - 0x28], 0xb91300d
mov dword [ebp - 0x28], 6
mov dword [ebp - 8], 0
jmp 0x435c80
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1d0], 0xe35fe57b
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x435c6f
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setne dl
mov dword [ebp - 0x1c], edx
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp eax, 0xbec0
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x44]
sub eax, 0xbb75da2c
neg eax
sbb eax, eax
add eax, 0xc3ddaeac
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xfffffffc
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x24]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x435c4a
lea ecx, [ebp - 0xa8]
call fcn.0043493d
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffb
push 0
pop eax
jne 0x435bcb
add ebx, dword [ebp - 0x20]
dec dword [ebp - 0x34]
jne 0x435816
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x24], 0x1d976ff5
mov dword [ebp - 0x14], 8
jmp 0x435d2b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jg 0x435d22
xor eax, eax
cmp dword [ebp - 0x24], eax
mov byte [ebp - 9], al
je 0x435d5d
cmp byte [ebp - 9], al
je 0x435d76
push 0x1ed3
push 0x1274
push 0xa50
push 0x23f
push eax
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x435d74
cmp byte [ebp - 9], al
je 0x435d76
push 0x1e8c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
mov edi, dword [ebx]
xor esi, esi
inc esi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], 0x6b903cfc
mov dword [ebp - 0x24], 0x402095d7
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x14], eax
jmp 0x435db0
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x38], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x435da2
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x38], ecx
test ecx, ecx
je 0x435de5
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x38], 0x87a912e7
mov ecx, dword [ebp - 0x38]
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setl dl
xor esi, esi
inc esi
cmp edx, dword [ebp - 0x10]
jl 0x435de5
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
sub ecx, 0x63f76313
jne 0x435dfd
mov ecx, eax
cmp dword [ebp - 0x10], eax
je 0x435dff
mov ecx, esi
mov dword [ebp - 0x24], ecx
mov edx, 0xfffa
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x38]
add ecx, dword [ebp - 0x10]
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
je 0x435e2a
cmp dword [ebp - 0x38], eax
je 0x435e2a
mov eax, esi
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x13c]
push 2
call fcn.0043486b
mov dword [ebp - 0x34], 0x2236432a
mov dword [ebp - 0x20], esi
push 3
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x8bd4dfbd
mov dword [ebp - 0x20], 0xe5e81a7e
mov dword [ebp - 0x20], 0xac46ddcd
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], 0x564c7b7f
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x94e8fe75
mov dword [ebp - 0x20], 0xb0ad8ea5
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], 0
jmp 0x435ea4
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], 0x9b55bb2c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x435e91
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x34], 0
jl 0x435f07
mov dword [ebp - 0x20], 0
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x20], 0xffffffff
push 2
call fcn.0043486b
mov dword [ebp - 0x24], 0xef51ae9a
mov dword [ebp - 0x14], 0
jmp 0x435eee
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x174]
and dword [eax + ecx*4], 0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x435ede
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x174]
call fcn.0043493d
dec dword [ebp - 0x34]
jns 0x435eb3
lea ecx, [ebp - 0x13c]
call fcn.0043493d
mov eax, dword [ebx + 4]
test eax, eax
jne 0x435ff1
cmp byte [ebp - 0x29], al
je 0x435f30
cmp dword [ebp - 0x48], esi
jne 0x435f30
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebx + 0xc]
add ebx, 0x10
push edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], ebx
call fcn.0048caeb
mov dword [ebp - 0x24], eax
xor eax, eax
pop ecx
mov dword [ebp - 0x90], eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x90]
push eax
push edi
call fcn.0046eb48
xor ecx, ecx
mov esi, ecx
test edi, edi
jle 0x435fcb
mov eax, esi
and eax, 0x80000001
jns 0x435f83
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x48]
add eax, esi
add eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0x20]
cdq
idiv edi
mov eax, dword [ebp - 0x54]
cmp word [eax + edx*2], cx
je 0x435fb3
mov ebx, eax
lea eax, [edx + 1]
cdq
idiv edi
cmp word [ebx + edx*2], cx
jne 0x435fa1
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
xor edi, edi
inc edi
mov word [eax + edx*2], di
mov al, byte [edx + ebx]
mov edx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x44]
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x435f75
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x54]
mov dword [esi], edi
test eax, eax
je 0x435ff6
push eax
call fcn.0048dfd6
pop ecx
xor ecx, ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
jmp 0x435ff6
mov esi, dword [ebp + 8]
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], ecx
jmp 0x436012
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x150], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x436001
mov dword [ebp - 8], edx
cmp dword [ebp - 8], ecx
jne 0x436080
xor esi, esi
inc esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], ecx
jmp 0x43603b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1ac], 0x5db34e6d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x43602a
mov dword [ebp - 0x18], ecx
jmp 0x436072
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], ecx
jmp 0x436069
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x1ac]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1ac], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x436052
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe7
jle 0x436046
dec dword [ebp - 8]
je 0x436022
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
pop esi
mov dword [ebp - 0x14c], ecx
pop ebx
mov esp, ebp
pop ebp
ret