Function at 0x420a70
Capabilities:
Check if file exists
Create thread
Extract resource via kernel32 functions
Get common file path
Get graphical window text
Move file
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d754
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x11c8
call fcn.0048a320
mov eax, dword [0x4d7200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1194], esi
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x11a0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], 0
movq qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x34], 1
mov edi, dword [ebx + 0xc]
xor eax, eax
mov byte [ebp - 4], 1
movq qword [ebp - 0x54], xmm0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x118c], eax
test edi, edi
je 0x420b3e
cmp word [edi], ax
je 0x420b3e
inc eax
cmp word [edi + eax*2], 0
jne 0x420b30
mov dword [ebp - 0x118c], eax
mov dword [ebp - 0x50], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov ecx, dword [ebp - 0x118c]
add esp, 4
mov dword [ebp - 0x54], eax
test ecx, ecx
jle 0x420b8c
mov edx, eax
sub edi, eax
mov esi, ecx
nop
mov ax, word [edi + edx]
lea edx, [edx + 2]
mov word [edx - 2], ax
sub esi, 1
jne 0x420b70
mov esi, dword [ebp - 0x1194]
mov edi, dword [ebx + 0xc]
mov eax, dword [ebp - 0x54]
xor edx, edx
mov byte [ebp - 0x4c], 1
mov word [eax + ecx*2], dx
push edx
push 1
push 1
push edx
push str._PostUpdate
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.004025a0
test eax, eax
jne 0x421109
push ecx
mov ecx, esi
call fcn.0043fd40
cmp eax, 1
jne 0x421109
test edi, edi
je 0x420e53
xor eax, eax
cmp word [edi], ax
je 0x420e53
nop dword [eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x420be0
cmp eax, 1
jle 0x420e53
cmp dword [esi + 0x208], 0
jne 0x420c15
push 2
call fcn.0048a02b
add esp, 4
mov dword [esi + 0x208], eax
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x20c], ecx
mov byte [esi + 0x210], 1
xor edx, edx
mov ecx, dword [esi + 0x208]
mov esi, edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x11b4], eax
mov eax, 0x4c06c8
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x11a0], ecx
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x11b0], ecx
mov dword [ebp - 0x11a8], ecx
nop
inc edx
cmp word [edx*2 + 0x4c0008], 0
jne 0x420c60
mov edi, dword [ebp - 0x11a8]
test edi, edi
jne 0x420c96
mov dword [ebp - 0x11a8], edi
mov edi, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b4], edi
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x11a0], ecx
jmp 0x420ce8
cmp word [edi], 0
mov dword [ebp - 0x1190], 0
je 0x420ce0
mov dword [ebp - 0x11a8], edi
mov edi, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b4], edi
mov edi, dword [ebp - 0x1190]
mov dword [ebp - 0x11a0], ecx
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x1198], eax
inc edi
cmp word [ecx + edi*2], 0
jne 0x420cd0
mov ecx, dword [ebp - 0x11a0]
jmp 0x420ce6
mov edi, dword [ebp - 0x1190]
add edx, edi
mov edi, dword [ebx + 0xc]
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4c06c8], 0
jne 0x420cf0
add eax, edx
xor edx, edx
mov dword [ebp - 0x118c], eax
mov eax, dword [ebp - 0x1198]
cmp word [edi], dx
je 0x420d3f
mov edx, dword [ebp - 0x11a8]
mov dword [ebp - 0x11a8], edx
mov edx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b4], edx
xor edx, edx
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x11a0], ecx
inc edx
cmp word [edi + edx*2], 0
jne 0x420d37
mov eax, dword [ebp - 0x118c]
xor ecx, ecx
add eax, edx
mov edx, 2
mov dword [ebp - 0x118c], eax
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov edx, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x119c], eax
mov ecx, eax
test edx, edx
je 0x420d91
movzx eax, word [edx]
test ax, ax
je 0x420d91
nop
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x420d80
mov edi, 0x4c0008
mov edx, 0x22
sub edi, ecx
nop dword [eax]
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x420da0
mov eax, dword [ebp - 0x11a8]
mov edi, dword [ebx + 0xc]
test eax, eax
je 0x420de1
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x420de1
mov eax, dword [ebp - 0x11a0]
nop
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
add ecx, 2
test dx, dx
jne 0x420dd0
mov eax, dword [ebp - 0x1198]
mov edx, 0x22
nop dword [eax]
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
add ecx, 2
test dx, dx
jne 0x420df0
movzx eax, word [edi]
mov edx, eax
test ax, ax
je 0x420e21
nop dword [eax + eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x420e10
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x420e36
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x119c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x11b4]
jmp 0x42105e
cmp dword [esi + 0x208], 0
jne 0x420e77
push 2
call fcn.0048a02b
add esp, 4
mov dword [esi + 0x208], eax
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x20c], ecx
mov byte [esi + 0x210], 1
mov edx, str.___PostUpdate
mov edi, dword [esi + 0x208]
mov eax, edi
mov ecx, dword [ebp - 0x20]
xor esi, esi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11b4], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1198], ecx
mov dword [ebp - 0x11b0], edi
mov dword [ebp - 0x11a0], edi
inc esi
cmp word [esi*2 + 0x4c0008], 0
jne 0x420ec0
test edi, edi
jne 0x420eea
mov dword [ebp - 0x11a0], edi
mov dword [ebp - 0x1198], ecx
mov dword [ebp - 0x11b4], edx
mov dword [ebp - 0x11a8], eax
jmp 0x420f1f
xor eax, eax
cmp word [edi], ax
je 0x420f1d
mov dword [ebp - 0x1198], ecx
mov ecx, dword [ebp - 0x11a8]
mov dword [ebp - 0x11a8], ecx
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x11a0], edi
mov dword [ebp - 0x11b4], edx
inc eax
cmp word [ecx + eax*2], 0
jne 0x420f15
add esi, eax
xor eax, eax
inc eax
cmp word [eax*2 + str.___PostUpdate], 0
jne 0x420f21
add esi, eax
xor ecx, ecx
mov edx, 2
mov dword [ebp - 0x11b0], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov ecx, eax
mov dword [ebp - 0x118c], edi
mov eax, dword [ebp - 0x20]
add esp, 4
mov edi, dword [ebp - 0x11a8]
mov dword [ebp - 0x11ac], ecx
test eax, eax
je 0x420fc1
movzx edx, word [eax]
mov edi, dword [ebp - 0x11a0]
mov dword [ebp - 0x118c], edi
mov edi, dword [ebp - 0x11a8]
mov dword [ebp - 0x119c], edx
test dx, dx
je 0x420fc1
movzx edx, word [eax]
mov edi, dword [ebp - 0x11a0]
mov esi, edx
mov dword [ebp - 0x118c], edi
mov edi, dword [ebp - 0x11a8]
mov dword [ebp - 0x119c], edx
nop dword [eax]
mov word [ecx], si
lea eax, [eax + 2]
movzx esi, word [eax]
add ecx, 2
test si, si
jne 0x420fb0
mov edx, 0x4c0008
mov esi, 0x22
sub edx, ecx
nop dword [eax]
mov word [ecx], si
add ecx, 2
movzx eax, word [ecx + edx]
mov esi, eax
test ax, ax
jne 0x420fd0
mov eax, dword [ebp - 0x118c]
mov esi, dword [ebp - 0x11b0]
mov edx, dword [ebp - 0x11b4]
test eax, eax
je 0x421021
movzx eax, word [eax]
mov esi, eax
mov dword [ebp - 0x119c], esi
mov esi, dword [ebp - 0x11b0]
test ax, ax
je 0x421021
movzx eax, ax
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x421010
mov eax, 0x22
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
lea ecx, [ecx + 2]
test ax, ax
jne 0x421026
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42104c
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
test eax, eax
je 0x42106f
push eax
call fcn.00489c73
add esp, 4
mov esi, dword [ebp - 0x3c]
push 0x802
mov dword [ebp - 0x38], 0
call fcn.0048a02b
xor ecx, ecx
mov dword [ebp - 0x3c], eax
add esp, 4
mov word [eax + 0x800], cx
mov eax, dword [ebp - 0x3c]
mov word [eax], cx
test esi, esi
je 0x4210a5
push esi
call fcn.00489c73
add esp, 4
push dword [ebp - 0x3c]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [ebp - 0x3c]
test esi, esi
jne 0x4210d2
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x20]
mov byte [ebp - 0x34], 1
test edx, edx
jne 0x4210f5
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push 0
push dword [ebx + 0x10]
mov byte [ebp - 0x18], 1
push esi
call fcn.004082b0
jmp 0x426b7d
xor ecx, ecx
call fcn.00408800
test eax, eax
je 0x421e9a
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
movq qword [ebp - 0x48], xmm0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x40], 1
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x24], 1
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
push 0x402
mov dword [ebp - 0x119c], eax
mov dword [ebp - 0x1c], 0
call fcn.0048a02b
mov dword [ebp - 0x20], eax
xor ecx, ecx
add esp, 4
mov word [eax + 0x400], cx
mov eax, dword [ebp - 0x20]
mov word [eax], cx
mov eax, dword [ebp - 0x119c]
test eax, eax
je 0x42119d
push eax
call fcn.00489c73
add esp, 4
push dword [ebp - 0x20]
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ecx
lea ecx, [esi + 0x208]
call fcn.00401620
mov esi, eax
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x4211c9
push eax
call fcn.00489c73
add esp, 4
xor eax, eax
mov byte [ebp - 0x34], 0
test esi, esi
je 0x4211e0
cmp word [esi], ax
je 0x4211e0
inc eax
cmp word [esi + eax*2], 0
jne 0x4211d8
mov dword [ebp - 0x38], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov dword [ebp - 0x3c], edx
test eax, eax
jle 0x421223
nop dword [eax + eax]
mov ax, word [esi + ecx*2]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
cmp ecx, eax
jl 0x421210
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, 4
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov byte [ebp - 0x34], 1
test eax, eax
jne 0x421252
xor eax, eax
test esi, esi
je 0x42124f
cmp word [esi], ax
je 0x42124f
inc eax
cmp word [esi + eax*2], 0
jne 0x421247
mov dword [ebp - 0x38], eax
cmp eax, 4
mov byte [ebp - 0x34], 1
cmovle ecx, eax
test eax, eax
je 0x42126e
sub eax, ecx
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov word [esi + eax*2], cx
mov esi, dword [ebp - 0x3c]
test esi, esi
jne 0x42128a
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x118c], ecx
test ecx, ecx
jne 0x4212b9
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x118c], ecx
xor eax, eax
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
test ecx, ecx
je 0x4212e8
cmp word [ecx], ax
je 0x4212e8
nop word [eax + eax]
inc eax
cmp word [ecx + eax*2], 0
jne 0x4212e0
test esi, esi
je 0x4212fd
xor ecx, ecx
cmp word [esi], cx
je 0x4212fb
inc ecx
cmp word [esi + ecx*2], 0
jne 0x4212f3
add eax, ecx
xor ecx, ecx
nop
inc ecx
cmp word [ecx*2 + 0x4c0704], 0
jne 0x421300
add eax, ecx
mov edx, 2
mov dword [ebp - 0x119c], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov ecx, dword [ebp - 0x118c]
add esp, 4
mov dword [ebp - 0x11a4], eax
mov edx, eax
test ecx, ecx
je 0x421361
movzx ecx, word [ecx]
test cx, cx
je 0x421361
mov edi, dword [ebp - 0x118c]
sub edi, eax
mov word [edx], cx
add edx, 2
movzx eax, word [edi + edx]
mov ecx, eax
test ax, ax
jne 0x421350
test esi, esi
je 0x421382
movzx eax, word [esi]
mov ecx, eax
test ax, ax
je 0x421382
sub esi, edx
mov word [edx], cx
add edx, 2
movzx eax, word [edx + esi]
mov ecx, eax
test ax, ax
jne 0x421371
mov esi, 0x4c0704
mov ecx, 0x36
sub esi, edx
nop
mov word [edx], cx
lea edx, [edx + 2]
movzx eax, word [edx + esi]
mov ecx, eax
test ax, ax
jne 0x421390
xor eax, eax
mov byte [ebp - 0x40], 1
mov word [edx], ax
mov eax, dword [ebp - 0x11a4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x119c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x11a8], eax
test eax, eax
jne 0x4213e7
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x11a8], eax
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x118c], eax
test eax, eax
jne 0x421416
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x118c], eax
xor esi, esi
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
test eax, eax
je 0x42143f
cmp word [eax], si
je 0x42143f
inc esi
cmp word [eax + esi*2], 0
jne 0x421437
mov eax, dword [ebp - 0x11a8]
test eax, eax
je 0x42145a
xor ecx, ecx
cmp word [eax], cx
je 0x421458
inc ecx
cmp word [eax + ecx*2], 0
jne 0x421450
add esi, ecx
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4c0714], 0
jne 0x421460
add esi, eax
xor ecx, ecx
mov edx, 2
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov ecx, dword [ebp - 0x118c]
add esp, 4
mov dword [ebp - 0x11c0], eax
mov edx, eax
test ecx, ecx
je 0x4214c1
movzx ecx, word [ecx]
test cx, cx
je 0x4214c1
mov edi, dword [ebp - 0x118c]
sub edi, eax
nop dword [eax]
mov word [edx], cx
add edx, 2
movzx eax, word [edx + edi]
mov ecx, eax
test ax, ax
jne 0x4214b0
mov ecx, dword [ebp - 0x11a8]
test ecx, ecx
je 0x4214f1
movzx eax, word [ecx]
mov edi, eax
mov dword [ebp - 0x119c], edi
test ax, ax
je 0x4214f1
movzx edi, ax
sub ecx, edx
mov word [edx], di
add edx, 2
movzx eax, word [edx + ecx]
mov edi, eax
test ax, ax
jne 0x4214e0
mov edi, 0x4c0714
mov ecx, 0x36
sub edi, edx
nop dword [eax]
mov word [edx], cx
lea edx, [edx + 2]
movzx eax, word [edx + edi]
mov ecx, eax
test ax, ax
jne 0x421500
xor eax, eax
mov dword [ebp - 0x28], esi
mov word [edx], ax
mov eax, dword [ebp - 0x11c0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 0x24], 1
mov dword [ebp - 0x11b0], eax
test eax, eax
jne 0x421551
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x11b0], eax
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 0x34], 1
mov byte [ebp - 0x18], 0
test esi, esi
jne 0x42157b
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x421578
cmp word [ecx], si
je 0x421578
nop dword [eax]
inc esi
cmp word [ecx + esi*2], 0
jne 0x421570
mov dword [ebp - 0x1c], esi
test eax, eax
je 0x421590
xor ecx, ecx
cmp word [eax], cx
je 0x42158e
inc ecx
cmp word [eax + ecx*2], 0
jne 0x421586
add esi, ecx
xor eax, eax
inc eax
cmp word [eax*2 + 0x4c0724], 0
jne 0x421592
add esi, eax
xor ecx, ecx
mov edx, 2
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov edx, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x11ac], eax
mov ecx, eax
test edx, edx
je 0x4215e4
movzx eax, word [edx]
test ax, ax
je 0x4215e4
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x4215d3
mov edx, dword [ebp - 0x11b0]
test edx, edx
je 0x421614
movzx eax, word [edx]
mov edi, eax
mov dword [ebp - 0x119c], edi
test ax, ax
je 0x421614
sub edx, ecx
movzx edi, ax
mov word [ecx], di
add ecx, 2
movzx eax, word [edx + ecx]
mov edi, eax
test ax, ax
jne 0x421603
mov edi, 0x4c0724
mov edx, 0x36
sub edi, ecx
mov word [ecx], dx
lea ecx, [ecx + 2]
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x421620
mov edi, dword [ebx + 0xc]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x421649
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x11ac]
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 0x11ca], al
mov byte [ebp - 0x11c9], al
test al, al
je 0x4217ea
push 0xfc8
lea eax, [ebp - 0x1110]
push 0
push eax
call fcn.0048b770
mov eax, dword [ebp - 0x20]
add esp, 0xc
test eax, eax
jne 0x4216a9
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push eax
lea ecx, [ebp - 0x1110]
mov byte [ebp - 0x18], 1
call fcn.004063f0
sub esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1110]
call fcn.004064a0
cmp eax, 0x4c0734
je 0x42172d
test eax, eax
je 0x421799
mov ecx, 0x4c0734
sub eax, ecx
mov dword [ebp - 0x11ac], eax
nop word [eax + eax]
movzx esi, word [eax + ecx]
mov eax, esi
mov dword [ebp - 0x119c], eax
test si, si
jne 0x42170b
cmp word [ecx], si
je 0x42172d
movzx edx, word [ecx]
jmp 0x42171b
movzx eax, word [ecx]
mov edx, eax
cmp si, ax
je 0x421722
mov eax, dword [ebp - 0x119c]
cmp ax, dx
jb 0x421799
ja 0x421799
mov eax, dword [ebp - 0x11ac]
add ecx, 2
jmp 0x4216f0
mov esi, dword [ebp - 0x20]
test esi, esi
jne 0x42174c
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push 0xa
push 0xc9
push dword [ebp - 0x11a0]
mov byte [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42177c
push eax
push dword [ebp - 0x11a0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x11b0], eax
jmp 0x421786
mov dword [ebp - 0x11b0], 0
mov ecx, esi
call fcn.00409150
cmp eax, dword [ebp - 0x11b0]
jne 0x421799
test edx, edx
je 0x4217a0
mov byte [ebp - 0x11c9], 0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x154]
test eax, eax
je 0x4217b7
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x4217ca
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x16c]
test eax, eax
je 0x4217dd
push eax
call fcn.00489c73
add esp, 4
cmp byte [ebp - 0x11c9], 0
jne 0x421922
push 0
push SysReAllocString
push 2
push 0
push 1
push 0xc0000000
push dword [ebp - 0x11a4]
mov byte [ebp - 0x40], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x421922
cmp esi, 0xffffffff
je 0x421922
push 0xa
push 0xc9
push dword [ebp - 0x11a0]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x119c], eax
test eax, eax
je 0x4219c4
push eax
push dword [ebp - 0x11a0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x11ac], eax
test eax, eax
je 0x4219c4
push dword [ebp - 0x119c]
push dword [ebp - 0x11a0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4219c4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4219c4
push 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], 0
push ecx
push dword [ebp - 0x11ac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x42191f
cmp byte [ebp - 0x11ca], 0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
je 0x4218ed
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x4218da
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push 1
push dword [ebp - 0x11c0]
mov byte [ebp - 0x18], 1
push eax
mov byte [ebp - 0x24], 1
call esi
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0x40], 1
test eax, eax
jne 0x421910
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push 1
push eax
push dword [ebp - 0x11a4]
mov byte [ebp - 0x18], 1
call esi
mov edi, dword [ebx + 0xc]
mov esi, dword [ebp - 0x3c]
push 0x802
mov dword [ebp - 0x38], 0
call fcn.0048a02b
xor ecx, ecx
mov dword [ebp - 0x3c], eax
add esp, 4
mov word [eax + 0x800], cx
mov eax, dword [ebp - 0x3c]
mov word [eax], cx
test esi, esi
je 0x421958
push esi
call fcn.00489c73
add esp, 4
push dword [ebp - 0x3c]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test edi, edi
je 0x421c13
xor eax, eax
cmp word [edi], ax
je 0x421c13
nop dword [eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x421980
cmp eax, 1
jle 0x421c13
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x11a8], edx
test edx, edx
jne 0x4219d0
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x11a8], edx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], cl
mov dword [ebp - 0x1c], ecx
jmp 0x4219e2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x421922
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov eax, 0x4c075c
mov dword [ebp - 0x11b4], edx
mov ecx, edx
mov dword [ebp - 0x11c4], eax
mov esi, edi
mov dword [ebp - 0x1198], ecx
mov edi, dword [ebx + 0xc]
xor eax, eax
mov dword [ebp - 0x11b0], edx
nop dword [eax + eax]
inc eax
cmp word [eax*2 + 0x4c0008], 0
jne 0x421a10
mov dword [ebp - 0x118c], eax
mov eax, 0x4c075c
test edx, edx
jne 0x421a51
mov ecx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b4], ecx
mov ecx, dword [ebp - 0x1198]
mov dword [ebp - 0x11a8], edx
mov dword [ebp - 0x11c4], eax
mov dword [ebp - 0x1198], ecx
jmp 0x421aa4
cmp word [edx], 0
mov dword [ebp - 0x1190], 0
je 0x421a95
mov edi, dword [ebp - 0x11b0]
mov dword [ebp - 0x11a8], edx
mov edx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11c4], eax
xor eax, eax
mov dword [ebp - 0x11b4], edx
mov dword [ebp - 0x1198], ecx
inc eax
cmp word [edi + eax*2], 0
jne 0x421a87
mov dword [ebp - 0x1190], eax
mov ecx, dword [ebp - 0x1190]
add dword [ebp - 0x118c], ecx
mov edi, dword [ebx + 0xc]
mov eax, dword [ebp - 0x11c4]
xor ecx, ecx
nop dword [eax]
inc ecx
cmp word [ecx*2 + 0x4c075c], 0
jne 0x421ab0
add dword [ebp - 0x118c], ecx
cmp word [edi], 0
mov ecx, dword [ebp - 0x1198]
mov edx, dword [ebp - 0x11a8]
je 0x421afe
mov dword [ebp - 0x11a8], edx
mov edx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11c4], eax
xor eax, eax
mov dword [ebp - 0x11b4], edx
mov dword [ebp - 0x1198], ecx
inc eax
cmp word [edi + eax*2], 0
jne 0x421af4
jmp 0x421b00
xor eax, eax
mov ecx, dword [ebp - 0x118c]
mov edx, 2
add ecx, eax
mov dword [ebp - 0x118c], ecx
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov edx, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x119c], eax
mov ecx, eax
test edx, edx
je 0x421b52
movzx eax, word [edx]
test ax, ax
je 0x421b52
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x421b41
mov edi, 0x4c0008
mov edx, 0x22
sub edi, ecx
nop
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x421b60
mov eax, dword [ebp - 0x11a8]
mov edi, dword [ebx + 0xc]
test eax, eax
je 0x421ba1
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x421ba1
mov eax, dword [ebp - 0x1198]
nop
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
add ecx, 2
test dx, dx
jne 0x421b90
mov eax, dword [ebp - 0x11c4]
mov edx, 0x22
nop dword [eax]
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
add ecx, 2
test dx, dx
jne 0x421bb0
movzx eax, word [edi]
mov edx, eax
test ax, ax
je 0x421be1
nop dword [eax + eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x421bd0
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x421bf6
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x119c]
mov ecx, dword [ebp - 0x118c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x11b4]
mov dword [ebp - 0x1c], ecx
jmp 0x421e18
mov edi, dword [ebp - 0x20]
test edi, edi
jne 0x421c42
push 2
call fcn.0048a02b
mov dword [ebp - 0x20], eax
add esp, 4
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 0x20]
mov eax, edi
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x11a8], eax
jmp 0x421c5c
mov eax, edi
mov dword [ebp - 0x11a8], edi
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov edx, edi
mov dword [ebp - 0x11b0], edi
mov ecx, 0x4c0008
mov dword [ebp - 0x11b4], edx
mov dword [ebp - 0x11a0], ecx
xor esi, esi
nop word [eax + eax]
inc esi
cmp word [esi*2 + 0x4c0008], 0
jne 0x421c80
test edi, edi
jne 0x421ca4
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11a0], ecx
mov dword [ebp - 0x11b4], edx
jmp 0x421cda
xor eax, eax
cmp word [edi], ax
je 0x421cd8
mov edx, dword [ebp - 0x11a8]
mov dword [ebp - 0x11a8], edx
mov edx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11a0], ecx
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x11b4], edx
nop
inc eax
cmp word [ecx + eax*2], 0
jne 0x421cd0
add esi, eax
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4c0008], 0
jne 0x421ce0
add esi, eax
xor ecx, ecx
mov edx, 2
mov dword [ebp - 0x1190], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov ecx, dword [ebp - 0x20]
add esp, 4
mov edx, dword [ebp - 0x11a0]
mov dword [ebp - 0x11b0], ecx
mov ecx, eax
mov dword [ebp - 0x1198], eax
mov eax, dword [ebp - 0x11b0]
mov dword [ebp - 0x118c], edi
test eax, eax
je 0x421d77
movzx eax, word [eax]
mov dword [ebp - 0x11ac], eax
mov dword [ebp - 0x118c], edi
test ax, ax
je 0x421d77
movzx eax, ax
mov dword [ebp - 0x119c], eax
mov eax, dword [ebp - 0x11b0]
mov esi, dword [ebp - 0x119c]
mov dword [ebp - 0x118c], edi
mov word [ecx], si
lea eax, [eax + 2]
movzx esi, word [eax]
add ecx, 2
test si, si
jne 0x421d66
mov edi, 0x4c0008
mov esi, 0x22
sub edi, ecx
mov word [ecx], si
add ecx, 2
movzx eax, word [edi + ecx]
mov esi, eax
test ax, ax
jne 0x421d83
mov eax, dword [ebp - 0x118c]
mov esi, dword [ebp - 0x1190]
mov edi, dword [ebp - 0x11b4]
test eax, eax
je 0x421dd4
movzx eax, word [eax]
mov esi, eax
mov dword [ebp - 0x119c], esi
mov esi, dword [ebp - 0x1190]
test ax, ax
je 0x421dd4
movzx eax, ax
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x421dc3
mov eax, 0x22
nop dword [eax]
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
lea ecx, [ecx + 2]
test ax, ax
jne 0x421de0
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x421e06
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x11a8]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
test eax, eax
je 0x421e29
push eax
call fcn.00489c73
add esp, 4
mov esi, dword [ebp - 0x3c]
test esi, esi
jne 0x421e48
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x20], 0
mov byte [ebp - 0x34], 1
jne 0x421e67
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
push 1
push dword [ebx + 0x10]
mov byte [ebp - 0x18], 1
push esi
call fcn.004082b0
push dword [ebp - 0x11c0]
call fcn.00489c73
add esp, 4
push dword [ebp - 0x11a4]
call fcn.00489c73
add esp, 4
jmp 0x426b7d
mov eax, dword [ebp - 0x11a0]
push 0
mov dword [esi + 0x12c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call esi
push 0xa
push edi
mov dword [ebp - 0x11ac], eax
call esi
push edi
mov esi, eax
push 0
mov dword [ebp - 0x119c], esi
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 0x11ac], 0x400
mov eax, 0x352
mov edi, dword [ebp - 0x1194]
mov ecx, 0x2ee
cmovg ecx, eax
mov edx, 0x28a
push ecx
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
cmp esi, 0x384
mov dword [ebp - 0x11c4], ecx
push 0xffffffffffffffff
mov eax, 0x226
lea esi, [edi + 0x2a8]
cmovg eax, edx
push eax
push ecx
push 0x4c0764
push 0x4c0778
mov ecx, esi
call fcn.0040bf80
push ecx
push 8
push ecx
mov ecx, esi
mov dword [edi + 0x120], eax
call fcn.0040d460
push 0x101020
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [esi + 0x1e0]
mov edx, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x11ac], eax
test ecx, ecx
je 0x421f6c
push ecx
call edx
mov edx, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x1e0], 0
mov eax, dword [esi + 0x1fc]
test eax, eax
je 0x421f8c
cmp dword [esi + 0x204], 4
je 0x421f8c
push eax
call edx
mov eax, dword [ebp - 0x11ac]
movsd xmm0, qword [0x4cc768]
mov dword [esi + 0x1fc], eax
xor eax, eax
mov dword [esi + 0x204], 0
mov dword [esi + 0x1f0], 0x9400
mov dword [edi + 0x4cc], 0xffffff
movsd qword [esi + 0x170], xmm0
mov dword [esi + 0x178], 0x190
mov byte [esi + 0x17c], 1
mov byte [esi + 0x1be], 0
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x421fe0
inc eax
push eax
push 0x4bff50
lea eax, [esi + 0x17e]
push 0x20
push eax
call fcn.0048cf13
add esp, 0x10
lea esi, [edi + 0x2a8]
mov ecx, esi
call fcn.00416d40
test al, al
je 0x422091
mov eax, dword [esi + 0x40]
push 0
push dword [esi + 0x11c]
inc eax
push eax
push dword [esi + 0x234]
movzx eax, byte [esi + 0x248]
push 0x41
push dword [ebp - 0x11c4]
and eax, 1
push 0
push 0
shl eax, 0x11
add eax, 0x50000100
push eax
push 0
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x422091
push eax
push 0xd
mov ecx, esi
call fcn.00416ab0
mov ecx, dword [ebp - 0x11c4]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0
lea ecx, [eax + eax*8]
mov dword [ebp - 0x2c], 0
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x24], 0x41
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push 0x40
push 0xffffffffffffffff
lea ecx, [edi + 0x2a8]
call fcn.00414360
mov eax, dword [edi + 0x12c]
xor esi, esi
mov dword [ebp - 0x11ac], esi
mov byte [ebp - 4], 6
test eax, eax
je 0x4220ce
push esi
push 0x30
push 0x30
push 1
push 1
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
mov dword [ebp - 0x11ac], esi
sub esp, 8
push 0x30
push 0x30
push 0xa
push ecx
push esi
lea ecx, [edi + 0x2a8]
call fcn.00411f80
mov byte [ebp - 4], 2
test esi, esi
je 0x4220f3
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
movsd xmm0, qword [0x4cc790]
xor eax, eax
mov dword [edi + 0x4cc], 0xe0efff
movsd qword [edi + 0x418], xmm0
mov dword [edi + 0x420], 0x258
mov byte [edi + 0x424], 1
mov byte [edi + 0x466], 0
nop word [eax + eax]
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x422130
inc eax
push eax
push 0x4bff50
lea eax, [edi + 0x426]
push 0x20
push eax
call fcn.0048cf13
add esp, 0x10
lea ecx, [edi + 0x2a8]
call fcn.00416d40
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
test al, al
je 0x4221d2
mov eax, dword [edi + 0x2e8]
push 0
push dword [edi + 0x3c4]
inc eax
push eax
push dword [edi + 0x4dc]
movzx eax, byte [edi + 0x4f0]
push 0x19
push 0xc8
push 0xa
and eax, 1
push 0x44
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0764
push 0x4c018c
push 0
call esi
test eax, eax
je 0x4221d2
push eax
push 0xd
lea ecx, [edi + 0x2a8]
call fcn.00416ab0
movaps xmm0, xmmword [0x4ccda0]
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x2e4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
movsd xmm0, qword [0x4cc770]
xor eax, eax
movsd qword [edi + 0x418], xmm0
mov dword [edi + 0x420], 0x190
mov byte [edi + 0x424], 1
mov byte [edi + 0x466], 0
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x422200
inc eax
push eax
push 0x4bff50
lea eax, [edi + 0x426]
push 0x20
push eax
call fcn.0048cf13
add esp, 0x10
lea ecx, [edi + 0x2a8]
call fcn.00416d40
test al, al
je 0x42229c
mov eax, dword [edi + 0x2e8]
push 0
push dword [edi + 0x3c4]
inc eax
push eax
push dword [edi + 0x4dc]
movzx eax, byte [edi + 0x4f0]
push 0x12
push 0x15e
push 0x2d
and eax, 1
push 0x44
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c07a0
push 0x4c018c
push 0
call esi
test eax, eax
je 0x42229c
push eax
push 0xd
lea ecx, [edi + 0x2a8]
call fcn.00416ab0
movaps xmm0, xmmword [0x4ccbc0]
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x2e4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov esi, dword [ebp - 0x11c4]
lea ecx, [edi + 0x2a8]
sub esp, 0x10
mov dword [edi + 0x498], 0x400
lea eax, [esi - 0x3c]
push eax
call fcn.00411a70
push 0xffffffffffffffff
sub esp, 8
mov dword [edi + 0x3c], eax
lea eax, [esi - 0x1e]
lea ecx, [edi + 0x2a8]
push 6
push eax
call fcn.00411850
mov dword [edi + 0x40], eax
xor esi, esi
nop dword [eax]
inc esi
cmp byte [esi + 0x4c07f8], 0
jne 0x4222e0
mov ecx, dword [ebp - 0x20]
lea eax, [esi + 2]
mov dword [ebp - 0x11ac], ecx
mov edx, 2
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov dword [ebp - 0x20], eax
lea ecx, [esi + 1]
xor edx, edx
add esp, 4
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x20]
mov word [eax], dx
mov eax, dword [ebp - 0x11ac]
test eax, eax
je 0x42233e
push eax
call fcn.00489c73
add esp, 4
lea ecx, [esi + 1]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x422394
test esi, esi
jne 0x422350
xor ecx, ecx
mov word [eax], cx
jmp 0x422371
push ecx
push eax
push esi
push 0x4c07f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x20]
xor edx, edx
test eax, eax
mov word [ecx + eax*2], dx
setg byte [ebp - 0x18]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x422394
mov ecx, esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x11a8], ecx
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x4223ba
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], cl
mov dword [ebp - 0x1c], ecx
mov ecx, esi
mov dword [ebp - 0x11a8], esi
mov edx, 0x4c0800
mov dword [ebp - 0x11b4], esi
mov dword [ebp - 0x11a0], edx
xor eax, eax
mov dword [ebp - 0x11b0], esi
inc eax
cmp word [eax*2 + 0x4c080c], 0
jne 0x4223d3
test esi, esi
jne 0x4223fd
mov edi, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b4], edi
mov dword [ebp - 0x11a0], edx
mov dword [ebp - 0x11a8], ecx
jmp 0x422432
xor ecx, ecx
cmp word [esi], cx
je 0x422430
mov edi, dword [ebp - 0x11b4]
mov dword [ebp - 0x11a0], edx
mov edx, dword [ebp - 0x11a8]
mov dword [ebp - 0x11a8], edx
mov edx, dword [ebp - 0x11b0]
mov dword [ebp - 0x11b4], edi
inc ecx
cmp word [edx + ecx*2], 0
jne 0x422428
add eax, ecx
xor ecx, ecx
inc ecx
cmp word [ecx*2 + 0x4c0800], 0
jne 0x422434
add eax, ecx
mov edx, 2
mov dword [ebp - 0x1190], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov edx, dword [ebp - 0x20]
mov ecx, eax
mov dword [ebp - 0x11b0], eax
add esp, 4
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x11a4], eax
mov eax, dword [ebp - 0x11a8]
mov dword [ebp - 0x1198], esi
mov dword [ebp - 0x118c], eax
test edx, edx
je 0x4224f3
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x11a4], eax
mov eax, dword [ebp - 0x11a8]
mov dword [ebp - 0x118c], eax
movzx eax, word [edx]
mov dword [ebp - 0x1198], esi
test ax, ax
je 0x4224f3
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x1198], esi
mov esi, dword [ebp - 0x11a8]
mov dword [ebp - 0x11a4], eax
mov eax, dword [ebp - 0x11ac]
nop dword [eax]
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x4224e0
jmp 0x4224f9
mov esi, dword [ebp - 0x118c]
mov edi, 0x4c080c
mov edx, 0x3c
sub edi, ecx
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x422505
mov eax, dword [ebp - 0x1198]
mov edi, dword [ebp - 0x1194]
test eax, eax
je 0x422541
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x422541
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x422530
mov eax, dword [ebp - 0x11a4]
mov edx, 0x3c
nop dword [eax]
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
lea ecx, [ecx + 2]
test dx, dx
jne 0x422550
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x422576
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x1190]
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x11b4]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], 1
test eax, eax
je 0x4225a2
push eax
call fcn.00489c73
mov ecx, dword [ebp - 0x20]
add esp, 4
test ecx, ecx
jne 0x4225be
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x11c4]
sub esp, 8
mov byte [ebp - 0x18], 1
push 0xf
push 0x41
push 0x2d
lea eax, [esi - 0xc8]
push eax
push ecx
lea ecx, [edi + 0x2a8]
call fcn.00412060
sub esp, 8
mov dword [edi + 0x30], eax
lea ecx, [edi + 0x2a8]
push 0x4c0818
push 0xffffffffffffffff
call fcn.00415120
sub esp, 8
lea ecx, [edi + 0x2a8]
call fcn.00413380
sub esp, 8
lea eax, [esi - 0x82]
lea ecx, [edi + 0x2a8]
push 0xf
push 0x2d
push 0x2d
push eax
push 0x4c0864
call fcn.00412060
push 0x7f89
push 0
mov dword [edi + 0x34], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov edx, dword [edi + 0x2e4]
mov ecx, dword [edi + 0x2e8]
mov dword [ebp - 0x11ac], eax
test edx, edx
je 0x422669
cmp ecx, 1
jl 0x422669
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x422669
mov ecx, dword [ebp - 0x11ac]
mov dword [edx + eax*8 + 0x18], ecx
sub esp, 8
lea ecx, [edi + 0x2a8]
push 0x4c087c
push 0xffffffffffffffff
call fcn.00415120
sub esp, 8
lea ecx, [edi + 0x2a8]
call fcn.00413380
sub esp, 8
lea eax, [esi - 0x50]
lea ecx, [edi + 0x2a8]
push 0xf
push 0x32
push 0x2d
push eax
push 0x4c08b4
call fcn.00412060
push 0x7f89
push 0
mov dword [edi + 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov edx, dword [edi + 0x2e4]
mov ecx, dword [edi + 0x2e8]
mov dword [ebp - 0x11ac], eax
test edx, edx
je 0x4226e8
cmp ecx, 1
jl 0x4226e8
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x4226e8
mov ecx, dword [ebp - 0x11ac]
mov dword [edx + eax*8 + 0x18], ecx
sub esp, 8
lea ecx, [edi + 0x2a8]
push 0x4c08d0
push 0xffffffffffffffff
call fcn.00415120
sub esp, 8
lea ecx, [edi + 0x2a8]
call fcn.00413380
cmp dword [ebp - 0x119c], 0x384
mov ecx, 0x247
mov eax, 0x1e3
mov dword [edi + 0x4cc], 0
cmovg eax, ecx
mov dword [edi + 0x4d0], 0xfefefe
mov dword [ebp - 0x1190], eax
lea eax, [esi - 4]
lea esi, [edi + 0x2a8]
mov dword [ebp - 0x11b0], eax
mov ecx, esi
call fcn.00416d40
test al, al
jne 0x42275d
xor eax, eax
jmp 0x422815
mov eax, dword [esi + 0x40]
push 0
push dword [esi + 0x11c]
inc eax
push eax
push dword [esi + 0x234]
movzx eax, byte [esi + 0x248]
push dword [ebp - 0x1190]
and eax, 1
push dword [ebp - 0x11b0]
shl eax, 0x11
push 0x41
push 2
add eax, 0x50010200
push eax
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push 0x4c027c
push 0
call eax
mov dword [ebp - 0x118c], eax
test eax, eax
je 0x422815
push eax
push 0x19
mov ecx, esi
call fcn.00416ab0
mov ecx, dword [ebp - 0x118c]
mov dword [esi + 0x234], ecx
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x28], ecx
lea edx, [eax + eax*8]
mov ecx, dword [ebp - 0x1190]
mov dword [ebp - 0x24], ecx
mov ecx, dword [esi + 0x3c]
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], 0x41
movups xmm0, xmmword [ebp - 0x30]
mov dword [ebp - 0x11ac], eax
push esi
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov eax, dword [esi + 0x40]
inc eax
push eax
push 0x40b310
push dword [ebp - 0x118c]
call dword [sym.imp.COMCTL32.dll_SetWindowSubclass]
mov eax, dword [ebp - 0x11ac]
push 0x4c091c
push 0
push eax
lea ecx, [edi + 0x2a8]
mov dword [edi + 0x44], eax
call fcn.00412550
sub esp, 0xc
mov dword [edi + 0x48], eax
lea ecx, [edi + 0x2a8]
push 0x78
push dword [edi + 0x12c]
push 0
push eax
call fcn.00413c60
mov eax, dword [edi + 0x44]
xor ecx, ecx
mov dword [ebp - 0x11a0], ecx
mov dword [ebp - 0x11b0], ecx
cmp eax, 0xffffffff
jne 0x422867
mov eax, dword [edi + 0x2e8]
mov edx, eax
jmp 0x42286d
mov edx, dword [edi + 0x2e8]
mov esi, dword [edi + 0x2e4]
test esi, esi
je 0x4228dc
cmp eax, 1
jl 0x4228dc
cmp eax, edx
jg 0x4228dc
lea eax, [eax + eax*8]
cmp dword [esi + eax*8 + 0xc], ecx
je 0x4228dc
cmp dword [esi + eax*8], 0x19
jne 0x4228dc
mov esi, dword [esi + eax*8 + 4]
add edi, 0x3c8
push edi
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
push edi
push 0
push 0x1328
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x1194]
mov ecx, dword [ecx + 0x3d0]
sub ecx, dword [edi]
mov edi, dword [ebp - 0x1194]
mov dword [ebp - 0x11a0], ecx
mov eax, dword [edi + 0x3d4]
sub eax, dword [edi + 0x3cc]
mov dword [ebp - 0x11b0], eax
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x11b0]
cdq
sar ecx, 1
sub eax, edx
sar eax, 1
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x11c0], ecx
lea eax, [ecx - 0xa]
lea ecx, [edi + 0x2a8]
mov dword [ebp - 0x11a8], eax
call fcn.00416d40
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
test al, al
je 0x422983
mov eax, dword [edi + 0x2e8]
push 0
push dword [edi + 0x3c4]
inc eax
push eax
push dword [edi + 0x4dc]
movzx eax, byte [edi + 0x4f0]
push 0x12
push 0x96
push 5
and eax, 1
push 0xf
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0930
push 0x4c018c
push 0
call esi
test eax, eax
je 0x422983
push eax
push 0xd
lea ecx, [edi + 0x2a8]
call fcn.00416ab0
movaps xmm0, xmmword [0x4ccad0]
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x2e4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x1198]
mov ecx, dword [ebp - 0x11a8]
add eax, 0xffffffbf
push eax
push ecx
push 0x19
push ecx
mov ecx, edi
call fcn.00428200
mov dword [edi + 0x5c], eax
test eax, eax
jne 0x4229ad
mov eax, dword [edi + 0x4d8]
jmp 0x4229e7
cmp eax, 0xffffffff
jne 0x4229bc
mov eax, dword [edi + 0x2e8]
mov edx, eax
jmp 0x4229c2
mov edx, dword [edi + 0x2e8]
mov ecx, dword [edi + 0x2e4]
test ecx, ecx
je 0x4229e5
cmp eax, 1
jl 0x4229e5
cmp eax, edx
jg 0x4229e5
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x4229e5
mov eax, dword [ecx + eax*8 + 4]
jmp 0x4229e7
xor eax, eax
mov ecx, dword [ebp - 0x11c0]
mov dword [edi + 0x124], eax
lea eax, [ecx - 0x2d]
mov dword [edi + 0xa0], eax
lea eax, [ecx + 5]
lea ecx, [edi + 0x2a8]
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
test al, al
je 0x422aa3
mov eax, dword [edi + 0x2e8]
push 0
push dword [edi + 0x3c4]
inc eax
push eax
push dword [edi + 0x4dc]
movzx eax, byte [edi + 0x4f0]
push 0x12
push dword [ebp - 0x11a8]
and eax, 1
push 5
push dword [ebp - 0x11b0]
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0960
push 0x4c018c
push 0
call esi
test eax, eax
je 0x422aa3
push eax
push 0xd
lea ecx, [edi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x11a8]
mov dword [ebp - 0x28], ecx
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x2e4]
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x1198]
lea ecx, [edi + 0x2a8]
push 0x10024
push 0x1080400d
add eax, 0xffffffbf
push eax
push dword [ebp - 0x11a8]
mov eax, dword [ebp - 0x11c0]
push 0x19
add eax, 5
push eax
push 0x4c0188
push 0x4c09a0
call fcn.004120f0
mov ecx, eax
mov dword [ebp - 0x11ac], eax
mov dword [edi + 0x60], eax
test ecx, ecx
jne 0x422afb
mov eax, dword [edi + 0x4d8]
mov dword [ebp - 0x11b4], eax
jmp 0x422b43
cmp ecx, 0xffffffff
jne 0x422b0a
mov ecx, dword [edi + 0x2e8]
mov edx, ecx
jmp 0x422b10
mov edx, dword [edi + 0x2e8]
mov eax, dword [edi + 0x2e4]
test eax, eax
je 0x422b39
cmp ecx, 1
jl 0x422b39
cmp ecx, edx
jg 0x422b39
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x422b39
mov eax, dword [eax + ecx*8 + 4]
mov dword [ebp - 0x11b4], eax
jmp 0x422b43
mov dword [ebp - 0x11b4], 0
sub esp, 8
mov edx, 5
push 0xff203000
call fcn.004049b0
sub esp, 8
mov edx, 4
mov esi, eax
push 0xff005f00
call fcn.004049b0
mov ecx, dword [ebp - 0x1194]
mov edi, eax
push 0xe
push edi
push esi
push dword [ebp - 0x11ac]
add ecx, 0x2a8
call fcn.004165d0
test edi, edi
je 0x422b95
push edi
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
jmp 0x422b9b
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
test esi, esi
je 0x422ba2
push esi
call edi
mov esi, dword [ebp - 0x1194]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, word [esi + 0xa0]
push eax
push 0
push 0x101e
push dword [ebp - 0x11b4]
call edi
push 0
push 1
push 0x101e
push dword [ebp - 0x11b4]
call edi
push 0
push 2
push 0x101e
push dword [ebp - 0x11b4]
call edi
push 0
push 3
push 0x101e
push dword [ebp - 0x11b4]
call edi
push 0
push 4
push 0x101e
push dword [ebp - 0x11b4]
call edi
mov eax, dword [ebp - 0x1198]
lea ecx, [esi + 0x2a8]
add eax, 0xffffffdd
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
mov edi, dword [sym.imp.USER32.dll_CreateWindowExW]
test al, al
je 0x422cb9
mov eax, dword [esi + 0x2e8]
push 0
push dword [esi + 0x3c4]
inc eax
push eax
push dword [esi + 0x4dc]
movzx eax, byte [esi + 0x4f0]
push 3
push dword [ebp - 0x11a0]
and eax, 1
push dword [ebp - 0x11b0]
shl eax, 0x11
push 0
add eax, 0x50000100
push eax
push 0
push 0x4c018c
push 0
call edi
test eax, eax
je 0x422cb9
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x11a0]
mov dword [ebp - 0x28], ecx
lea ecx, [eax + eax*8]
mov eax, dword [esi + 0x2e4]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 3
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push 0x101020
push ecx
lea ecx, [esi + 0x2a8]
call fcn.004136f0
mov ecx, dword [ebp - 0x1198]
sub esp, 8
push 0xc
push 0x28
lea eax, [ecx - 0x21]
push eax
mov eax, dword [ebp - 0x11c0]
add eax, 0xffffffec
push eax
push ecx
push 0x76
push dword [esi + 0x12c]
lea ecx, [esi + 0x2a8]
call fcn.00412360
push 0xfffffffffffffffe
push ecx
lea ecx, [esi + 0x2a8]
call fcn.004136f0
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x11b8], eax
lea ecx, [eax - 0x5f]
mov dword [ebp - 0x11bc], ecx
lea ecx, [eax - 0x14]
mov dword [ebp - 0x118c], ecx
lea ecx, [esi + 0x2a8]
call fcn.00416d40
test al, al
je 0x422dc6
mov eax, dword [esi + 0x2e8]
lea ecx, [esi + 0x2a8]
push 0
push dword [ecx + 0x11c]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0x96
push dword [ebp - 0x118c]
and eax, 1
push 0xf
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c09ec
push 0x4c018c
push 0
call edi
test eax, eax
je 0x422dc6
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x118c]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0xf
lea ecx, [eax + eax*8]
mov dword [ebp - 0x28], 0x96
mov eax, dword [esi + 0x2e4]
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push dword [ebp - 0x11bc]
push dword [ebp - 0x11a8]
push dword [ebp - 0x11b8]
push ecx
mov ecx, esi
call fcn.00428200
mov dword [esi + 0x64], eax
test eax, eax
jne 0x422def
mov eax, dword [esi + 0x4d8]
jmp 0x422e29
cmp eax, 0xffffffff
jne 0x422dfe
mov eax, dword [esi + 0x2e8]
mov edx, eax
jmp 0x422e04
mov edx, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x422e27
cmp eax, 1
jl 0x422e27
cmp eax, edx
jg 0x422e27
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x422e27
mov eax, dword [ecx + eax*8 + 4]
jmp 0x422e29
xor eax, eax
mov ecx, dword [ebp - 0x11b8]
mov dword [esi + 0x128], eax
mov eax, dword [ebp - 0x11bc]
add eax, 0xc
add ecx, eax
mov eax, dword [ebp - 0x11c0]
add eax, 0xfffffeac
mov dword [ebp - 0x1190], ecx
cdq
lea ecx, [esi + 0x2a8]
sub eax, edx
sar eax, 1
mov dword [ebp - 0x11a4], eax
add eax, 5
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
test al, al
je 0x422f06
mov eax, dword [esi + 0x2e8]
push 0
push dword [esi + 0x3c4]
inc eax
push eax
push dword [esi + 0x4dc]
movzx eax, byte [esi + 0x4f0]
push 0x12
push 0xaa
push dword [ebp - 0x1190]
and eax, 1
push dword [ebp - 0x11b0]
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0a1c
push 0x4c018c
push 0
call edi
test eax, eax
je 0x422f06
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x1190]
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + eax*8]
mov eax, dword [esi + 0x2e4]
mov dword [ebp - 0x28], 0xaa
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x11a4]
lea ecx, [esi + 0x2a8]
add eax, 0xb9
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
test al, al
jne 0x422f2d
xor eax, eax
jmp 0x422ff3
mov eax, dword [esi + 0x2e8]
lea edx, [esi + 0x2a8]
mov esi, dword [ebp - 0x11b8]
inc eax
mov ecx, dword [ebp - 0x11bc]
add esi, 0xa
push 0
push dword [edx + 0x11c]
add ecx, esi
push eax
push dword [edx + 0x234]
movzx eax, byte [edx + 0x248]
push 0x12
push 0x32
push ecx
push dword [ebp - 0x11b0]
and eax, 1
shl eax, 0x11
add eax, 0x50010009
push eax
push 0x4c0a5c
push 0x4c019c
push 0
call edi
mov esi, dword [ebp - 0x1194]
test eax, eax
jne 0x422f94
xor eax, eax
jmp 0x422ff3
push eax
push 0x15
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov esi, dword [ebp - 0x11b8]
mov ecx, eax
mov eax, dword [ebp - 0x11b0]
add esi, 0xa
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x11bc]
add eax, esi
mov dword [ebp - 0x11ac], ecx
mov esi, dword [ebp - 0x1194]
lea edx, [ecx + ecx*8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x28], 0x32
mov ecx, dword [esi + 0x2e4]
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ecx + edx*8 + 0x24], xmm0
sub esp, 8
mov dword [esi + 0x6c], eax
lea ecx, [esi + 0x2a8]
push 0x4c0a68
push 0xffffffffffffffff
call fcn.00415120
mov eax, dword [ebp - 0x11a4]
lea ecx, [esi + 0x2a8]
add eax, 0xfa
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
test al, al
jne 0x423032
xor eax, eax
jmp 0x4230f8
mov eax, dword [esi + 0x2e8]
lea ecx, [esi + 0x2a8]
mov esi, dword [ebp - 0x11b8]
inc eax
push 0
push dword [ecx + 0x11c]
add esi, 0xa
push eax
push dword [ecx + 0x234]
mov eax, dword [ebp - 0x11bc]
push 0x12
push 0x32
add eax, esi
push eax
movzx eax, byte [ecx + 0x248]
push dword [ebp - 0x11b0]
and eax, 1
shl eax, 0x11
add eax, 0x50010009
push eax
push 0x4c0b34
push 0x4c019c
push 0
call edi
mov esi, dword [ebp - 0x1194]
test eax, eax
jne 0x423099
xor eax, eax
jmp 0x4230f8
push eax
push 0x15
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov esi, dword [ebp - 0x11b8]
mov ecx, eax
mov eax, dword [ebp - 0x11b0]
add esi, 0xa
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x11bc]
add eax, esi
mov dword [ebp - 0x11ac], ecx
mov esi, dword [ebp - 0x1194]
lea edx, [ecx + ecx*8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x28], 0x32
mov ecx, dword [esi + 0x2e4]
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ecx + edx*8 + 0x24], xmm0
sub esp, 8
mov dword [esi + 0x70], eax
lea ecx, [esi + 0x2a8]
push 0x4c0b40
push 0xffffffffffffffff
call fcn.00415120
mov edx, dword [ebp - 0x11b8]
lea ecx, [esi + 0x2a8]
mov eax, dword [ebp - 0x11bc]
sub esp, 8
add edx, 0x23
add eax, edx
push 0x12
push 0xfa
push eax
mov eax, dword [ebp - 0x11a4]
add eax, 5
push eax
push 0x4c0c00
call fcn.004117b0
mov edx, dword [ebp - 0x11b8]
push ecx
push 0xffffffffffffffff
mov dword [esi + 0x74], eax
lea ecx, [esi + 0x2a8]
mov eax, dword [ebp - 0x11bc]
add edx, 0x40
push 0x1c
push 0x64
add eax, edx
push eax
mov eax, dword [ebp - 0x11a4]
add eax, 0x1e
push eax
push 0x4c0c3c
call fcn.004116e0
mov edx, dword [ebp - 0x11b8]
push ecx
push 0xffffffffffffffff
mov dword [esi + 0x78], eax
lea ecx, [esi + 0x2a8]
mov eax, dword [ebp - 0x11bc]
add edx, 0x3c
push 0x20
push 0xa0
add eax, edx
push eax
mov eax, dword [ebp - 0x11a4]
add eax, 0xa0
push eax
push 0x4c0c54
call fcn.004116e0
mov dword [esi + 0x7c], eax
lea ecx, [esi + 0x2a8]
mov eax, dword [ebp - 0x11c0]
add eax, 0xf
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
test al, al
je 0x42326a
mov eax, dword [esi + 0x2e8]
push 0
push dword [esi + 0x3c4]
inc eax
push eax
push dword [esi + 0x4dc]
movzx eax, byte [esi + 0x4f0]
push 0x12
push 0xfa
push dword [ebp - 0x118c]
and eax, 1
push dword [ebp - 0x11b0]
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0c78
push 0x4c018c
push 0
call edi
test eax, eax
je 0x42326a
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x118c]
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + eax*8]
mov eax, dword [esi + 0x2e4]
mov dword [ebp - 0x28], 0xfa
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
sub esp, 8
lea ecx, [esi + 0x2a8]
push 0x4c0cb8
push 0xffffffffffffffff
call fcn.00415120
mov eax, dword [ebp - 0x11c0]
lea ecx, [esi + 0x2a8]
push 0x10024
push 0x1080400d
push dword [ebp - 0x11bc]
add eax, 5
push dword [ebp - 0x11a8]
push dword [ebp - 0x11b8]
push eax
push 0x4c0188
push 0x4c0d28
call fcn.004120f0
mov dword [esi + 0x68], eax
test eax, eax
jne 0x4232c9
mov edi, dword [esi + 0x4d8]
jmp 0x423303
cmp eax, 0xffffffff
jne 0x4232d8
mov eax, dword [esi + 0x2e8]
mov ecx, eax
jmp 0x4232de
mov ecx, dword [esi + 0x2e8]
mov edi, dword [esi + 0x2e4]
test edi, edi
je 0x423301
cmp eax, 1
jl 0x423301
cmp eax, ecx
jg 0x423301
lea eax, [eax + eax*8]
cmp dword [edi + eax*8 + 0xc], 0
je 0x423301
mov edi, dword [edi + eax*8 + 4]
jmp 0x423303
xor edi, edi
movzx eax, word [esi + 0xa0]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0
push 0x101e
push edi
call esi
push 0
push 1
push 0x101e
push edi
call esi
push 0
push 2
push 0x101e
push edi
call esi
push 0
push 3
push 0x101e
push edi
call esi
push 0
push 4
push 0x101e
push edi
call esi
sub esp, 0xc
mov edx, 1
call fcn.00404e60
mov edi, eax
mov dword [ebp - 0x11a8], edi
sub esp, 0xc
xor edx, edx
call fcn.00404e60
mov esi, eax
mov dword [ebp - 0x11b0], esi
mov eax, dword [ebp - 0x1194]
push 0xe
push esi
push edi
mov byte [ebp - 4], 8
lea ecx, [eax + 0x2a8]
push dword [eax + 0x68]
call fcn.004165d0
mov eax, dword [ebp - 0x11a4]
add eax, dword [ebp - 0x11c0]
mov ecx, dword [ebp - 0x11bc]
mov dword [ebp - 0x11a4], eax
add ecx, 0xe
add ecx, dword [ebp - 0x11b8]
add eax, 5
mov dword [ebp - 0x1190], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov dword [ebp - 0x11ac], ecx
mov ecx, eax
mov dword [ebp - 0x118c], eax
call fcn.00416d40
test al, al
je 0x423474
mov ecx, dword [ebp - 0x118c]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0x50
push dword [ebp - 0x11ac]
and eax, 1
push dword [ebp - 0x1190]
shl eax, 0x11
add eax, 0x50000100
push eax
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x4c0d7c
push 0x4c018c
push 0
call eax
test eax, eax
je 0x423474
mov ecx, dword [ebp - 0x118c]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x1190]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x28], 0x50
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11bc]
mov edx, dword [ebp - 0x11b8]
add ecx, 0xb
mov eax, dword [ebp - 0x11a4]
add edx, ecx
mov ecx, dword [ebp - 0x1194]
add eax, 0x55
push 0
add ecx, 0x2a8
mov dword [ebp - 0x11ac], eax
mov dword [ebp - 0x1190], edx
mov dword [ebp - 0x118c], ecx
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x19
push 0xa0
push edx
push dword [ebp - 0x11ac]
and eax, 1
shl eax, 0x11
add eax, 0x50011000
push eax
push 0
push 0x4c0258
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x42354d
mov ecx, dword [ebp - 0x118c]
push eax
push 0x17
call fcn.00416ab0
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x1190]
lea edx, [eax + eax*8]
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0xa0
mov dword [ebp - 0x24], 0x19
mov ecx, dword [eax + 0x3c]
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov eax, dword [eax + 0x3c]
mov dword [eax + edx*8 + 0x44], 0
mov eax, dword [ebp - 0x11c8]
mov edx, dword [ebp - 0x1194]
push 0x640000
push 1
push 0x406
mov dword [edx + 0x80], eax
mov eax, dword [edx + 0x2e8]
lea ecx, [eax + eax*8]
mov eax, dword [edx + 0x2e4]
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x11a4]
add eax, 0xfa
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
mov edx, 0x50022080
test al, al
jne 0x4235b7
xor ecx, ecx
jmp 0x42367d
mov eax, dword [ebp - 0x118c]
mov ecx, 0x50002080
push 0
test byte [eax + 0x248], 1
cmovne ecx, edx
mov edx, dword [ebp - 0x1190]
or ecx, 0x10000
push dword [edx + 0x11c]
mov eax, dword [edx + 0x40]
inc eax
push eax
push dword [edx + 0x234]
mov eax, dword [ebp - 0x11bc]
push 0x19
push 0x50
add eax, 0xa
add eax, dword [ebp - 0x11b8]
push eax
push dword [ebp - 0x11ac]
push ecx
push 0x4bfbd0
push 0x4c0220
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x423623
xor ecx, ecx
jmp 0x42367d
mov ecx, dword [ebp - 0x1190]
push eax
push 0xc
call fcn.00416ab0
mov ecx, eax
mov dword [ebp - 0x28], 0x50
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x11bc]
add eax, 0xa
mov dword [ebp - 0x11c8], ecx
add eax, dword [ebp - 0x11b8]
lea edx, [ecx + ecx*8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x24], 0x19
movups xmm0, xmmword [ebp - 0x30]
mov ecx, dword [eax + 0x3c]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11c8]
mov eax, dword [ebp - 0x1194]
sub esp, 8
push 0xffffffffffffffff
push 0
mov dword [eax + 0x84], ecx
push ecx
lea ecx, [eax + 0x2a8]
call fcn.00412800
mov ecx, dword [ebp - 0x1194]
mov esi, dword [ebp - 0x11b8]
add esi, 0x2c
mov dword [ecx + 0x88], eax
mov eax, dword [ebp - 0x11bc]
add eax, esi
mov dword [ebp - 0x118c], eax
mov eax, dword [ebp - 0x11a4]
add eax, 5
mov dword [ebp - 0x11ac], eax
lea eax, [ecx + 0x2a8]
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
mov esi, dword [ebp - 0x11b0]
test al, al
je 0x423784
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0x50
push dword [ebp - 0x118c]
and eax, 1
push dword [ebp - 0x11ac]
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0d98
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x423784
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x118c]
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x28], 0x50
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11bc]
mov edx, dword [ebp - 0x11b8]
add ecx, 0x29
mov eax, dword [ebp - 0x11a4]
add edx, ecx
mov ecx, dword [ebp - 0x1194]
add eax, 0x55
push 0
add ecx, 0x2a8
mov dword [ebp - 0x11ac], eax
mov dword [ebp - 0x11c8], edx
mov dword [ebp - 0x1190], ecx
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x19
push 0xa0
push edx
push dword [ebp - 0x11ac]
and eax, 1
shl eax, 0x11
add eax, 0x50011000
push eax
push 0
push 0x4c0258
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x42385d
mov ecx, dword [ebp - 0x1190]
push eax
push 0x17
call fcn.00416ab0
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x118c], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x11c8]
lea edx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0xa0
mov dword [ebp - 0x24], 0x19
mov ecx, dword [eax + 0x3c]
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov eax, dword [eax + 0x3c]
mov dword [eax + edx*8 + 0x44], 0
mov eax, dword [ebp - 0x118c]
mov edx, dword [ebp - 0x1194]
push 0x640000
push 1
push 0x406
mov dword [edx + 0x8c], eax
mov eax, dword [edx + 0x2e8]
lea ecx, [eax + eax*8]
mov eax, dword [edx + 0x2e4]
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x11b8]
mov eax, dword [ebp - 0x11bc]
add edx, 0x28
add eax, edx
mov dword [ebp - 0x118c], eax
mov eax, dword [ebp - 0x11a4]
add eax, 0xfa
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
jne 0x4238d9
xor ecx, ecx
jmp 0x423989
mov edx, dword [ebp - 0x1190]
mov eax, 0x50022080
push 0
mov ecx, 0x50002080
push dword [edx + 0x11c]
test byte [edx + 0x248], 1
cmovne ecx, eax
mov eax, dword [edx + 0x40]
inc eax
or ecx, 0x10000
push eax
push dword [edx + 0x234]
push 0x19
push 0x50
push dword [ebp - 0x118c]
push dword [ebp - 0x11ac]
push ecx
push 0x4bfbd0
push 0x4c0220
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x42393a
xor ecx, ecx
jmp 0x423989
mov ecx, dword [ebp - 0x1190]
push eax
push 0xc
call fcn.00416ab0
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x118c]
lea edx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0x50
mov dword [ebp - 0x24], 0x19
mov ecx, dword [eax + 0x3c]
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11c8]
mov eax, dword [ebp - 0x1194]
sub esp, 8
push 0xffffffffffffffff
push 0
mov dword [eax + 0x90], ecx
push ecx
lea ecx, [eax + 0x2a8]
call fcn.00412800
mov ecx, dword [ebp - 0x1194]
sub esp, 8
mov dword [ecx + 0x94], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11bc]
push 0x12
add eax, 0x4b
add eax, dword [ebp - 0x11b8]
push 0xfa
push eax
mov eax, dword [ebp - 0x11a4]
add eax, 5
push eax
push 0x4c0db0
call fcn.004117b0
mov ecx, dword [ebp - 0x1194]
push 4
push 0xffffffffffffffff
mov dword [ecx + 0x98], eax
add ecx, 0x2a8
call fcn.00414360
mov eax, dword [ebp - 0x1194]
push 0x4c0e14
push 1
push dword [eax + 0x44]
lea ecx, [eax + 0x2a8]
call fcn.00412550
mov ecx, dword [ebp - 0x1194]
sub esp, 0xc
push 0x77
mov dword [ecx + 0x4c], eax
push dword [ecx + 0x12c]
add ecx, 0x2a8
push 1
push eax
call fcn.00413c60
mov eax, dword [ebp - 0x11a0]
add eax, 0xfffffff6
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
mov edi, dword [ebp - 0x11a8]
test al, al
je 0x423b04
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x32
push dword [ebp - 0x11ac]
and eax, 1
push 0xf
push 5
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0e38
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x423b04
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 5
lea ecx, [eax + eax*8]
mov dword [ebp - 0x2c], 0xf
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x24], 0x32
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x423bb0
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 3
push dword [ebp - 0x11c4]
and eax, 1
push 0x50
push 0
shl eax, 0x11
add eax, 0x50000100
push eax
push 0
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x423bb0
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x11c4]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0
lea ecx, [eax + eax*8]
mov dword [ebp - 0x2c], 0x50
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x24], 3
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push 0x101020
push ecx
mov ecx, dword [ebp - 0x1194]
lea ecx, [ecx + 0x2a8]
call fcn.004136f0
cmp dword [ebp - 0x119c], 0x384
mov ecx, 0x140
mov eax, 0xdc
cmovg eax, ecx
mov dword [ebp - 0x118c], eax
mov eax, dword [ebp - 0x11c0]
add eax, 0xffffffec
mov dword [ebp - 0x119c], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x423ca2
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push dword [ebp - 0x119c]
and eax, 1
push 0x5a
push 0xf
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c1078
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x423ca2
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x119c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0xf
lea ecx, [eax + eax*8]
mov dword [ebp - 0x2c], 0x5a
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x11c0]
mov ecx, dword [ebp - 0x1194]
add eax, 0xffffffec
push 0x10024
push 0x1080400d
push dword [ebp - 0x118c]
lea ecx, [ecx + 0x2a8]
push eax
push 0x6e
push 5
push 0x4c0188
push 0x4c10b8
call fcn.004120f0
mov ecx, eax
mov eax, dword [ebp - 0x1194]
mov dword [eax + 0xa4], ecx
test ecx, ecx
jne 0x423cf5
mov ecx, dword [eax + 0x4d8]
jmp 0x423d29
cmp ecx, 0xffffffff
jne 0x423d00
mov ecx, dword [eax + 0x2e8]
mov edx, dword [eax + 0x2e4]
test edx, edx
je 0x423d27
cmp ecx, 1
jl 0x423d27
cmp ecx, dword [eax + 0x2e8]
jg 0x423d27
lea ecx, [ecx + ecx*8]
cmp dword [edx + ecx*8 + 0xc], 0
je 0x423d27
mov ecx, dword [edx + ecx*8 + 4]
jmp 0x423d29
xor ecx, ecx
movzx eax, word [eax + 0xa0]
push eax
push 0
push 0x101e
push ecx
mov dword [ebp - 0x11a4], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 2
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 3
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 4
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1194]
push 0
push esi
push edi
push dword [eax + 0xa4]
lea ecx, [eax + 0x2a8]
call fcn.004165d0
mov eax, dword [ebp - 0x118c]
sub esp, 8
shr eax, 1
add eax, 0x5a
push 0x28
push 0xc
push eax
mov eax, dword [ebp - 0x11c0]
add eax, 0xfffffff5
push eax
mov eax, dword [ebp - 0x1194]
push ecx
push 0x75
push dword [eax + 0x12c]
lea ecx, [eax + 0x2a8]
call fcn.00412360
push 0xfffffffffffffffe
push ecx
mov ecx, dword [ebp - 0x1194]
lea ecx, [ecx + 0x2a8]
call fcn.004136f0
mov eax, dword [ebp - 0x11c0]
lea ecx, [eax - 0x14]
add eax, 0xf
mov dword [ebp - 0x119c], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov dword [ebp - 0x11ac], ecx
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x423ecc
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push dword [ebp - 0x11ac]
and eax, 1
push 0x5a
push dword [ebp - 0x119c]
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c1100
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x423ecc
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x119c]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x28], ecx
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x2c], 0x5a
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11c0]
push 0x10024
push 0x1080400d
push dword [ebp - 0x118c]
lea eax, [ecx - 0x14]
push eax
push 0x6e
lea eax, [ecx + 5]
mov ecx, dword [ebp - 0x1194]
push eax
push 0x4c0188
push 0x4c10b8
lea ecx, [ecx + 0x2a8]
call fcn.004120f0
mov ecx, eax
mov eax, dword [ebp - 0x1194]
mov dword [eax + 0xa8], ecx
test ecx, ecx
jne 0x423f21
mov ecx, dword [eax + 0x4d8]
jmp 0x423f55
cmp ecx, 0xffffffff
jne 0x423f2c
mov ecx, dword [eax + 0x2e8]
mov edx, dword [eax + 0x2e4]
test edx, edx
je 0x423f53
cmp ecx, 1
jl 0x423f53
cmp ecx, dword [eax + 0x2e8]
jg 0x423f53
lea ecx, [ecx + ecx*8]
cmp dword [edx + ecx*8 + 0xc], 0
je 0x423f53
mov ecx, dword [edx + ecx*8 + 4]
jmp 0x423f55
xor ecx, ecx
movzx eax, word [eax + 0xa0]
push eax
push 0
push 0x101e
push ecx
mov dword [ebp - 0x11a4], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 2
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 3
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 4
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1194]
push 0
push esi
push edi
push dword [eax + 0xa8]
lea ecx, [eax + 0x2a8]
call fcn.004165d0
mov eax, dword [ebp - 0x11a0]
sub esp, 8
mov ecx, dword [ebp - 0x118c]
add eax, 0xfffffff6
add ecx, 0x8c
mov dword [ebp - 0x11a4], ecx
push 0x12
push eax
push ecx
mov ecx, dword [ebp - 0x1194]
push 0x14
push 0x4c1148
lea ecx, [ecx + 0x2a8]
call fcn.004117b0
mov ecx, dword [ebp - 0x1194]
mov dword [ecx + 0xac], eax
mov eax, dword [ebp - 0x11a4]
add eax, 0x19
cmp dword [ecx + 0x4d8], 0
mov dword [ebp - 0x119c], eax
lea eax, [ecx + 0x2a8]
mov dword [ebp - 0x118c], eax
je 0x4240fd
mov ecx, eax
call fcn.00416d40
test al, al
je 0x4240fd
mov ecx, dword [ebp - 0x118c]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0xfa
push dword [ebp - 0x119c]
and eax, 1
push 0x14
shl eax, 0x11
add eax, 0x50010003
push eax
push 0x4c1200
push 0x4c019c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4240fd
mov ecx, dword [ebp - 0x118c]
push eax
push 4
call fcn.00416ab0
mov ecx, dword [ebp - 0x119c]
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x2c], ecx
lea edx, [eax + eax*8]
mov dword [ebp - 0x30], 0x14
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x28], 0xfa
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov ecx, dword [eax + 0x3c]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11c8]
jmp 0x4240ff
xor ecx, ecx
mov eax, dword [ebp - 0x1194]
mov dword [eax + 0xb0], ecx
mov ecx, dword [ebp - 0x11a4]
add ecx, 0x32
mov dword [ebp - 0x119c], ecx
lea ecx, [eax + 0x2a8]
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x1190], ecx
cmp dword [eax + 0x230], 0
je 0x4241e6
call fcn.00416d40
test al, al
je 0x4241e6
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0xfa
push dword [ebp - 0x119c]
and eax, 1
push 0x14
shl eax, 0x11
add eax, 0x50010003
push eax
push 0x4c0db0
push 0x4c019c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4241e6
mov ecx, dword [ebp - 0x1190]
push eax
push 4
call fcn.00416ab0
mov ecx, dword [ebp - 0x119c]
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x2c], ecx
lea edx, [eax + eax*8]
mov dword [ebp - 0x30], 0x14
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x28], 0xfa
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov ecx, dword [eax + 0x3c]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11c8]
jmp 0x4241e8
xor ecx, ecx
mov eax, dword [ebp - 0x1194]
push 4
push 0xffffffffffffffff
mov dword [eax + 0x9c], ecx
lea ecx, [eax + 0x2a8]
call fcn.00414360
mov eax, dword [ebp - 0x11a4]
push ecx
mov ecx, dword [ebp - 0x1194]
add eax, 0x2c
push 0xffffffffffffffff
push 0x1c
push 0x96
push eax
mov eax, dword [ebp - 0x11a0]
lea ecx, [ecx + 0x2a8]
add eax, 0xfffffe8e
push eax
push 0x4c1250
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
mov dword [ecx + 0xb4], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11a4]
push 0xb4
add eax, 0x28
push eax
mov eax, dword [ebp - 0x11a0]
add eax, 0xffffff38
push eax
push 0x4c1274
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push 0x4c12a0
push 2
mov dword [ecx + 0xb8], eax
push dword [ecx + 0x44]
add ecx, 0x2a8
call fcn.00412550
mov ecx, dword [ebp - 0x1194]
sub esp, 0xc
push 0x7a
mov dword [ecx + 0x50], eax
push dword [ecx + 0x12c]
add ecx, 0x2a8
push 2
push eax
call fcn.00413c60
mov eax, dword [ebp - 0x11c0]
add eax, 0xfffffff6
mov dword [ebp - 0x11b8], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x424356
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0xc8
push 5
and eax, 1
push 0xf
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c12b4
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x424356
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
movaps xmm0, xmmword [0x4ccb70]
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x42440f
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
mov eax, dword [ebp - 0x1198]
push 0x12
push 0xc8
add eax, 6
push eax
movzx eax, byte [ecx + 0x248]
and eax, 1
push 0xf
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c12e8
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x42440f
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x1198]
add ecx, 6
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + eax*8]
mov dword [ebp - 0x28], 0xc8
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x1198]
lea eax, [ecx - 0x1f]
push eax
push dword [ebp - 0x11b8]
push 0x19
push ecx
mov ecx, dword [ebp - 0x1194]
call fcn.00428200
mov ecx, dword [ebp - 0x1194]
mov dword [ecx + 0xbc], eax
mov eax, dword [ebp - 0x1198]
lea eax, [eax - 0x49]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11b8]
cdq
and edx, 3
lea ecx, [edx + eax]
mov eax, dword [ebp - 0x11c0]
sar ecx, 2
add ecx, eax
cdq
push ecx
push 0xffffffffffffffff
push 0x20
sub eax, edx
mov dword [ebp - 0x11a4], ecx
sar eax, 1
push eax
push 0x1e
push ecx
mov ecx, dword [ebp - 0x1194]
push 0x4c1324
mov dword [ebp - 0x118c], eax
lea ecx, [ecx + 0x2a8]
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x118c]
mov dword [ecx + 0xc0], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11bc]
add eax, 0x1e
push eax
push dword [ebp - 0x11a4]
mov dword [ebp - 0x11a0], eax
push 0x4c1350
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x118c]
mov dword [ecx + 0xc4], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11a0]
add eax, dword [ebp - 0x11bc]
push eax
push dword [ebp - 0x11a4]
mov dword [ebp - 0x11a0], eax
push 0x4c136c
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x118c]
mov dword [ecx + 0xcc], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11a0]
add eax, dword [ebp - 0x11bc]
push eax
push dword [ebp - 0x11a4]
mov dword [ebp - 0x11a0], eax
push 0x4c1398
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x118c]
mov dword [ecx + 0xd0], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11a0]
add eax, dword [ebp - 0x11bc]
push eax
push dword [ebp - 0x11a4]
push 0x4c13bc
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
mov dword [ecx + 0xd4], eax
mov eax, dword [ebp - 0x1198]
dec eax
mov dword [ebp - 0x119c], eax
lea eax, [ecx + 0x2a8]
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x424656
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 3
push dword [ebp - 0x11c4]
and eax, 1
push dword [ebp - 0x119c]
shl eax, 0x11
push 0
add eax, 0x50000100
push eax
push 0
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x424656
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x119c]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x11c4]
mov dword [ebp - 0x28], ecx
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 3
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push 0x101020
push ecx
mov ecx, dword [ebp - 0x1194]
lea ecx, [ecx + 0x2a8]
call fcn.004136f0
mov eax, dword [ebp - 0x1198]
mov ecx, dword [ebp - 0x1194]
add eax, 0xffffffe1
push 0x10024
push 0x1080400d
push eax
push dword [ebp - 0x11b8]
add eax, 0x39
lea ecx, [ecx + 0x2a8]
push eax
push 5
push 0x4c0188
push 0x4c10b8
call fcn.004120f0
mov ecx, eax
mov eax, dword [ebp - 0x1194]
mov dword [eax + 0xd8], ecx
test ecx, ecx
jne 0x4246c2
mov ecx, dword [eax + 0x4d8]
jmp 0x4246f6
cmp ecx, 0xffffffff
jne 0x4246cd
mov ecx, dword [eax + 0x2e8]
mov edx, dword [eax + 0x2e4]
test edx, edx
je 0x4246f4
cmp ecx, 1
jl 0x4246f4
cmp ecx, dword [eax + 0x2e8]
jg 0x4246f4
lea ecx, [ecx + ecx*8]
cmp dword [edx + ecx*8 + 0xc], 0
je 0x4246f4
mov ecx, dword [edx + ecx*8 + 4]
jmp 0x4246f6
xor ecx, ecx
movzx eax, word [eax + 0xa0]
push eax
push 0
push 0x101e
push ecx
mov dword [ebp - 0x11a4], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 2
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 3
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 4
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1194]
push 0
push esi
push edi
push dword [eax + 0xd8]
lea ecx, [eax + 0x2a8]
call fcn.004165d0
mov eax, dword [ebp - 0x1198]
add eax, 0x1e
mov dword [ebp - 0x11b8], eax
mov eax, dword [ebp - 0x11c0]
lea esi, [eax + 5]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
sub ecx, 0xa
push ecx
push 0xffffffffffffffff
push 0x20
push ecx
push dword [ebp - 0x11b8]
mov dword [ebp - 0x1198], ecx
mov ecx, dword [ebp - 0x1194]
push esi
push 0x4c13e8
add ecx, 0x2a8
call fcn.004116e0
mov edx, dword [ebp - 0x1194]
push ecx
mov ecx, dword [ebp - 0x1198]
push 0xffffffffffffffff
push 0x20
push ecx
push dword [ebp - 0x11b8]
mov dword [edx + 0xdc], eax
lea eax, [ecx + 0xa]
add eax, esi
lea ecx, [edx + 0x2a8]
push eax
push 0x4c140c
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x1198]
mov dword [ecx + 0xe0], eax
mov eax, dword [ebp - 0x11b8]
add eax, dword [ebp - 0x11bc]
push eax
push esi
mov dword [ebp - 0x11b8], eax
push 0x4c1430
add ecx, 0x2a8
call fcn.004116e0
mov edx, dword [ebp - 0x1194]
push ecx
mov ecx, dword [ebp - 0x1198]
push 0xffffffffffffffff
push 0x20
push ecx
push dword [ebp - 0x11b8]
mov dword [edx + 0xe4], eax
lea eax, [ecx + 0xa]
add eax, esi
lea ecx, [edx + 0x2a8]
push eax
push 0x4c1454
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x1198]
mov dword [ecx + 0xe8], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11b8]
add eax, dword [ebp - 0x11bc]
push eax
push esi
push 0x4c1478
mov dword [ebp - 0x11b8], eax
call fcn.004116e0
mov edx, dword [ebp - 0x1194]
push ecx
mov ecx, dword [ebp - 0x1198]
push 0xffffffffffffffff
push 0x20
push ecx
push dword [ebp - 0x11b8]
mov dword [edx + 0xec], eax
lea eax, [ecx + 0xa]
add eax, esi
lea ecx, [edx + 0x2a8]
push eax
push 0x4c14b0
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x1198]
mov dword [ecx + 0xf0], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11b8]
add eax, dword [ebp - 0x11bc]
push eax
push esi
push 0x4c14d4
mov dword [ebp - 0x11b8], eax
call fcn.004116e0
mov edx, dword [ebp - 0x1194]
push ecx
mov ecx, dword [ebp - 0x1198]
push 0xffffffffffffffff
push 0x20
push ecx
push dword [ebp - 0x11b8]
mov dword [edx + 0xf4], eax
lea eax, [ecx + 0xa]
add eax, esi
lea ecx, [edx + 0x2a8]
push eax
push 0x4c14f4
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x1198]
mov dword [ecx + 0xf8], eax
mov eax, dword [ebp - 0x11b8]
add eax, dword [ebp - 0x11bc]
mov dword [ebp - 0x11b8], eax
push eax
push esi
push 0x4c1508
add ecx, 0x2a8
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
mov dword [ecx + 0xc8], eax
mov ecx, dword [ebp - 0x1198]
push ecx
push dword [ebp - 0x11b8]
lea eax, [ecx + 0xa]
add eax, esi
mov esi, dword [ebp - 0x1194]
push eax
push 0x4c1538
lea ecx, [esi + 0x2a8]
call fcn.004116e0
push 0x4c1564
push 3
mov dword [esi + 0xfc], eax
lea ecx, [esi + 0x2a8]
push dword [esi + 0x44]
call fcn.00412550
sub esp, 0xc
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x2a8]
push 0x79
push dword [esi + 0x12c]
push 3
push eax
call fcn.00413c60
mov eax, dword [esi + 0x12c]
xor esi, esi
mov dword [ebp - 0x11c8], esi
mov byte [ebp - 4], 9
test eax, eax
je 0x424a27
push esi
push 0x20
push 0x20
push 1
push 1
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
mov dword [ebp - 0x11c8], esi
sub esp, 8
push 0x20
push 0x20
push 0x32
push ecx
mov ecx, dword [ebp - 0x1194]
push esi
lea ecx, [ecx + 0x2a8]
call fcn.00411f80
mov byte [ebp - 4], 8
test esi, esi
je 0x424a52
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
xor esi, esi
inc esi
cmp byte [esi + 0x4c07f8], 0
jne 0x424a54
mov ecx, dword [ebp - 0x20]
lea eax, [esi + 2]
mov dword [ebp - 0x11c8], ecx
mov edx, 2
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov dword [ebp - 0x20], eax
lea ecx, [esi + 1]
xor edx, edx
add esp, 4
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x20]
mov word [eax], dx
mov eax, dword [ebp - 0x11c8]
test eax, eax
je 0x424ab2
push eax
call fcn.00489c73
add esp, 4
lea ecx, [esi + 1]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x424b08
test esi, esi
jne 0x424ac4
xor ecx, ecx
mov word [eax], cx
jmp 0x424ae5
push ecx
push eax
push esi
push 0x4c07f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x20]
xor edx, edx
test eax, eax
mov word [ecx + eax*2], dx
setg byte [ebp - 0x18]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x424b08
mov ecx, esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x11a0], ecx
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x424b2e
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], cl
mov dword [ebp - 0x1c], ecx
mov ecx, esi
mov dword [ebp - 0x11a0], esi
mov edx, 0x4c1584
mov dword [ebp - 0x11c0], esi
mov dword [ebp - 0x1198], edx
xor eax, eax
mov dword [ebp - 0x119c], esi
nop word [eax + eax]
inc eax
cmp word [eax*2 + 0x4c1590], 0
jne 0x424b50
test esi, esi
jne 0x424b7a
mov edi, dword [ebp - 0x11c0]
mov dword [ebp - 0x11c0], edi
mov dword [ebp - 0x1198], edx
mov dword [ebp - 0x11a0], ecx
jmp 0x424baf
xor ecx, ecx
cmp word [esi], cx
je 0x424bad
mov edi, dword [ebp - 0x11c0]
mov dword [ebp - 0x1198], edx
mov edx, dword [ebp - 0x11a0]
mov dword [ebp - 0x11a0], edx
mov edx, dword [ebp - 0x119c]
mov dword [ebp - 0x11c0], edi
inc ecx
cmp word [edx + ecx*2], 0
jne 0x424ba5
add eax, ecx
xor ecx, ecx
inc ecx
cmp word [ecx*2 + 0x4c1584], 0
jne 0x424bb1
add eax, ecx
mov edx, 2
mov dword [ebp - 0x119c], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a02b
mov edx, dword [ebp - 0x20]
mov ecx, eax
mov dword [ebp - 0x11b8], eax
add esp, 4
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x118c], esi
mov dword [ebp - 0x1190], eax
test edx, edx
je 0x424c69
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x1190], eax
movzx eax, word [edx]
mov dword [ebp - 0x118c], esi
test ax, ax
je 0x424c69
mov dword [ebp - 0x11c8], eax
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x118c], esi
mov esi, dword [ebp - 0x11a0]
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11c8]
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x424c56
jmp 0x424c6f
mov esi, dword [ebp - 0x1190]
mov edi, 0x4c1590
mov edx, 0x44
sub edi, ecx
nop dword [eax + eax]
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x424c80
mov eax, dword [ebp - 0x118c]
mov edi, dword [ebp - 0x11a8]
test eax, eax
je 0x424cc1
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x424cc1
nop dword [eax + eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x424cb0
mov eax, dword [ebp - 0x11bc]
mov edx, 0x20
nop dword [eax]
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
lea ecx, [ecx + 2]
test dx, dx
jne 0x424cd0
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x424cf6
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x11b8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x119c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x11c0]
mov byte [ebp - 0x18], 1
test eax, eax
je 0x424d2a
push eax
call fcn.00489c73
mov eax, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x11b8], eax
jmp 0x424d30
mov eax, dword [ebp - 0x11b8]
test eax, eax
jne 0x424d52
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x11b8], eax
mov esi, dword [ebp - 0x1194]
mov byte [ebp - 0x18], 1
lea ecx, [esi + 0x2a8]
call fcn.00416d40
test al, al
je 0x424de0
mov eax, dword [esi + 0x2e8]
lea ecx, [esi + 0x2a8]
push 0
push dword [ecx + 0x11c]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x19
push 0x190
push 0x37
and eax, 1
push 0x32
shl eax, 0x11
add eax, 0x50000100
push eax
mov eax, dword [ebp - 0x11b8]
push eax
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x424de0
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
movaps xmm0, xmmword [0x4cce30]
lea ecx, [eax + eax*8]
mov eax, dword [esi + 0x2e4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
movsd xmm0, qword [0x4cc788]
sub esp, 0x14
movsd qword [esp + 0xc], xmm0
push 0x2bc
push ecx
lea ecx, [esi + 0x2a8]
call fcn.00413b20
movsd xmm0, qword [0x4cc770]
xor eax, eax
movsd qword [esi + 0x418], xmm0
mov dword [esi + 0x420], 0x190
mov byte [esi + 0x424], 1
mov byte [esi + 0x466], 0
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x424e30
inc eax
push eax
push 0x4bff50
lea eax, [esi + 0x426]
push 0x20
push eax
call fcn.0048cf13
add esp, 0x10
lea ecx, [esi + 0x2a8]
call fcn.00416d40
test al, al
je 0x424ef7
mov eax, dword [esi + 0x2e8]
push 0
push dword [esi + 0x3c4]
inc eax
push eax
push dword [esi + 0x4dc]
mov eax, dword [ebp - 0x11c4]
push 0x32
add eax, 0xffffffec
push eax
movzx eax, byte [esi + 0x4f0]
push 0x7d
and eax, 1
push 0xa
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c15b8
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x424ef7
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x11c4]
add ecx, 0xffffffec
mov dword [ebp - 0x30], 0xa
mov dword [ebp - 0x28], ecx
lea ecx, [eax + eax*8]
mov dword [ebp - 0x2c], 0x7d
mov eax, dword [esi + 0x2e4]
mov dword [ebp - 0x24], 0x32
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x11c4]
lea ecx, [esi + 0x2a8]
sub esp, 8
add eax, 0xffffffec
push 0x23
push eax
push 0xaf
push 0xa
push 0x4c16b8
call fcn.00412060
sub esp, 8
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11c4]
lea ecx, [esi + 0x2a8]
add eax, 0xffffffec
push 0x14
push eax
push 0xcd
push 0xa
push 0x4c1768
call fcn.00412060
sub esp, 8
mov dword [ebp - 0x11d0], eax
mov eax, dword [ebp - 0x11c4]
lea ecx, [esi + 0x2a8]
add eax, 0xffffffec
push 0x14
push eax
push 0xeb
push 0xa
push 0x4c1818
call fcn.00412060
push ecx
push 0
push dword [esi + 0x64]
lea ecx, [esi + 0x2a8]
mov dword [ebp - 0x11d4], eax
push dword [esi + 0x60]
push ecx
lea ecx, [esi + 0x534]
call fcn.00417480
push ecx
push dword [esi + 0x78]
lea eax, [esi + 0x2a8]
push dword [esi + 0x98]
lea ecx, [esi + 0x554]
push dword [esi + 0x7c]
push eax
call fcn.00417480
push ecx
push dword [esi + 0xb4]
lea eax, [esi + 0x2a8]
push dword [esi + 0xb8]
lea ecx, [esi + 0x574]
push dword [esi + 0xac]
push eax
call fcn.00417480
mov eax, dword [esi + 0xc0]
mov dword [ebp - 0x11c8], eax
cmp eax, dword [esi + 0xfc]
jg 0x42502f
mov edi, dword [ebp - 0x11c8]
lea eax, [esi + 0x2a8]
nop word [eax + eax]
cmp edi, dword [esi + 0xd8]
je 0x425020
cmp edi, dword [esi + 0xd4]
je 0x425020
push 0x40
push edi
mov ecx, eax
call fcn.00414360
lea eax, [esi + 0x2a8]
inc edi
cmp edi, dword [esi + 0xfc]
jle 0x425000
mov edi, dword [ebp - 0x11a8]
push 7
push 5
lea ecx, [esi + 0x2a8]
call fcn.0040db40
nop
push 1
mov ecx, esi
call fcn.004284d0
test eax, eax
jne 0x425040
push eax
push 1
push eax
push dword [esi + 0x5c]
mov ecx, esi
call fcn.00428f70
push dword [esi + 0xa4]
mov ecx, esi
call fcn.00431450
xor eax, eax
mov dword [ebp - 0x11c0], 0xffffffff
mov dword [ebp - 0x11a0], eax
lea eax, [esi + 0x2a8]
mov dword [ebp - 0x11b8], 0xffffffff
mov dword [ebp - 0x1198], 0xffffffff
test eax, eax
je 0x4250c1
push 0
push 0
push dword [eax + 0x230]
push 0x40bb20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x4250c1
cmp eax, 0xffffffff
je 0x4250c1
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push 0x1c2
push 0xaa
push 0
push 4
push 0x4c18e0
mov ecx, esi
call fcn.00432b40
push 0
mov ecx, esi
call fcn.004284d0
test eax, eax
je 0x426b63
lea edx, [esi + 0x2a8]
lea ecx, [esi + 0xc4]
mov dword [ebp - 0x11ac], edx
nop
mov edi, dword [esi + 0x22c]
cmp edi, 0xfffffffa
je 0x426b5d
cmp dword [esi + 0x25c], edx
jne 0x426b40
cmp edi, 0xffffffd3
je 0x425129
cmp edi, 0xffffffd2
jne 0x425579
mov eax, dword [esi + 0x5c]
cmp dword [esi + 0x238], eax
jne 0x425579
cmp eax, 0xffffffff
jne 0x425143
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x425187
cmp eax, 1
jl 0x425187
cmp eax, dword [esi + 0x2e8]
jg 0x425187
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x425187
cmp dword [ecx + eax*8], 0xf
jne 0x425187
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
lea edx, [esi + 0x2a8]
jmp 0x42518a
or edi, 0xffffffff
mov dword [ebp - 0x1190], edi
cmp edi, dword [ebp - 0x11c0]
je 0x426b40
mov dword [ebp - 0x11c0], edi
test edi, edi
jns 0x425330
push ecx
push 0
push dword [esi + 0x64]
lea ecx, [esi + 0x534]
push dword [esi + 0x60]
push edx
call fcn.00417480
mov ecx, dword [esi + 0x68]
cmp ecx, 0xffffffff
jne 0x4251cf
mov ecx, dword [esi + 0x2e8]
jmp 0x4251f0
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x425210
cmp ecx, 1
jl 0x425210
cmp ecx, dword [esi + 0x2e8]
jg 0x425210
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x425210
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
jmp 0x425216
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x64]
cmp ecx, 0xffffffff
jne 0x425226
mov ecx, dword [esi + 0x2e8]
jmp 0x425247
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x42525f
cmp ecx, 1
jl 0x42525f
cmp ecx, dword [esi + 0x2e8]
jg 0x42525f
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x42525f
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
mov ecx, dword [esi + 0x60]
cmp ecx, 0xffffffff
jne 0x42526f
mov ecx, dword [esi + 0x2e8]
jmp 0x425290
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x4252a8
cmp ecx, 1
jl 0x4252a8
cmp ecx, dword [esi + 0x2e8]
jg 0x4252a8
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x4252a8
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
mov eax, dword [esi + 0x124]
lea ecx, [ebp - 0x114c]
push ecx
push 0xffffffffffffffff
xorps xmm0, xmm0
mov dword [ebp - 0x114c], 8
push 0x102b
push eax
mov dword [ebp - 0x1148], 0
mov dword [ebp - 0x1144], 0
mov dword [ebp - 0x1140], 0
mov dword [ebp - 0x113c], 3
movups xmmword [ebp - 0x1138], xmm0
mov dword [ebp - 0x1128], 0
mov dword [ebp - 0x1124], 0
mov dword [ebp - 0x1120], 0
mov dword [ebp - 0x111c], 0
movq qword [ebp - 0x1118], xmm0
call edi
jmp 0x426b40
push edi
mov ecx, esi
call fcn.0042b1d0
push 0
push edi
push dword [esi + 0x5c]
lea ecx, [esi + 0x2a8]
call fcn.00416470
mov edi, eax
mov eax, dword [ebp - 0x20]
test edi, edi
jne 0x4253a0
test eax, eax
je 0x42535f
push eax
call fcn.00489c73
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a02b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x425395
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x425382
xor ecx, ecx
mov word [edx + eax*2], cx
mov edi, dword [ebp - 0x20]
jmp 0x4253b7
test eax, eax
je 0x4253ad
push eax
call fcn.00489c73
add esp, 4
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test edi, edi
jne 0x4253d7
push 2
call fcn.0048a02b
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push edi
push 0
push 0
mov byte [ebp - 0x18], 1
mov ecx, esi
push dword [esi + 0x64]
call fcn.00428f70
push 1
push dword [ebp - 0x1190]
lea ecx, [esi + 0x2a8]
push dword [esi + 0x5c]
call fcn.00416470
mov edi, eax
mov eax, dword [ebp - 0x20]
test edi, edi
jne 0x42545b
test eax, eax
je 0x425416
push eax
call fcn.00489c73
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a02b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x425453
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x425440
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x425472
test eax, eax
je 0x425468
push eax
call fcn.00489c73
add esp, 4
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0
push 0
push 1
push 1
push 0
push 0x4c1920
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x18], 1
call fcn.004025a0
test eax, eax
je 0x4254d3
mov eax, dword [esi + 0x6c]
test eax, eax
jne 0x4254a1
mov ecx, dword [esi + 0x4d8]
jmp 0x42552f
cmp eax, 0xffffffff
jne 0x4254ac
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x42552d
cmp eax, 1
jl 0x42552d
cmp eax, dword [esi + 0x2e8]
jg 0x42552d
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x42552d
mov ecx, dword [ecx + eax*8 + 4]
jmp 0x42552f
push 0
push 1
push 1
push 0
push 0x4c1930
lea ecx, [ebp - 0x20]
call fcn.004025a0
test eax, eax
je 0x425537
mov eax, dword [esi + 0x70]
test eax, eax
jne 0x4254fb
mov ecx, dword [esi + 0x4d8]
jmp 0x42552f
cmp eax, 0xffffffff
jne 0x425506
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x42552d
cmp eax, 1
jl 0x42552d
cmp eax, dword [esi + 0x2e8]
jg 0x42552d
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x42552d
mov ecx, dword [ecx + eax*8 + 4]
jmp 0x42552f
xor ecx, ecx
sub esp, 0xc
call fcn.00409920
lea ecx, [esi + 0x534]
call fcn.004175b0
cmp dword [ebp - 0x11a0], 1
jge 0x426b40
push ecx
push 0x1c2
push 0xaa
push 0
push 4
push 0x4c1940
mov ecx, esi
call fcn.00432b40
mov dword [ebp - 0x11a0], 1
jmp 0x426b40
cmp edi, 0xffffffd3
je 0x425587
cmp edi, 0xffffffd2
jne 0x42573b
mov eax, dword [esi + 0x64]
cmp dword [esi + 0x238], eax
jne 0x42573b
cmp eax, 0xffffffff
jne 0x4255a1
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x4255df
cmp eax, 1
jl 0x4255df
cmp eax, dword [esi + 0x2e8]
jg 0x4255df
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x4255df
cmp dword [ecx + eax*8], 0xf
jne 0x4255df
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
jmp 0x4255e2
or edi, 0xffffffff
cmp edi, dword [ebp - 0x11b8]
je 0x426b40
push edi
mov ecx, esi
mov dword [ebp - 0x11b8], edi
call fcn.0042f860
test eax, eax
jns 0x42563e
push ecx
push dword [esi + 0x78]
lea edi, [esi + 0x2a8]
push dword [esi + 0x94]
lea ecx, [esi + 0x554]
push dword [esi + 0x7c]
push edi
call fcn.00417480
push ecx
push 0x15e
push 0x96
push edi
push 0
push 0x4c19b0
mov ecx, esi
call fcn.00432b40
jmp 0x426b40
test edi, edi
jns 0x425674
push ecx
push dword [esi + 0x78]
lea eax, [esi + 0x2a8]
push dword [esi + 0x94]
lea ecx, [esi + 0x554]
push dword [esi + 0x7c]
push eax
call fcn.00417480
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
jmp 0x426b40
push 4
push edi
push dword [esi + 0x64]
lea ecx, [esi + 0x2a8]
call fcn.00416470
mov dword [ebp - 0x11c8], eax
lea edi, [esi + 0x1e4]
test eax, eax
jne 0x42569f
push eax
mov ecx, edi
call fcn.00401860
jmp 0x4256c1
mov eax, dword [edi]
test eax, eax
je 0x4256ae
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x11c8]
mov dword [edi], eax
mov dword [edi + 4], 0
mov byte [edi + 8], 1
mov ecx, edi
call fcn.00401fd0
push ecx
mov dword [esi + 0x28], eax
lea edi, [esi + 0x2a8]
push 0
mov dword [esi + 0x2c], edx
lea ecx, [esi + 0x534]
push dword [esi + 0x60]
push dword [esi + 0x5c]
push edi
call fcn.00417480
push ecx
push 0
push dword [esi + 0x94]
lea ecx, [esi + 0x554]
push dword [esi + 0x80]
push edi
call fcn.00417480
cmp dword [ebp - 0x11a0], 2
jge 0x426b40
push ecx
push 0x1c2
push 0xaa
push 0
push 4
push 0x4c1a00
mov ecx, esi
call fcn.00432b40
mov dword [ebp - 0x11a0], 2
jmp 0x426b40
cmp edi, 0xffffffd3
je 0x425749
cmp edi, 0xffffffd2
jne 0x425b6b
mov eax, dword [esi + 0xbc]
cmp dword [esi + 0x238], eax
jne 0x425b6b
cmp eax, 0xffffffff
jne 0x425766
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x4257aa
cmp eax, 1
jl 0x4257aa
cmp eax, dword [esi + 0x2e8]
jg 0x4257aa
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x4257aa
cmp dword [ecx + eax*8], 0xf
jne 0x4257aa
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [ebp - 0x1190], eax
jmp 0x4257b3
or edi, 0xffffffff
mov dword [ebp - 0x1190], edi
cmp edi, dword [ebp - 0x1198]
je 0x426b40
mov dword [ebp - 0x1198], edi
test edi, edi
jns 0x425874
mov ecx, dword [esi + 0xd8]
cmp ecx, 0xffffffff
jne 0x4257e0
mov ecx, dword [esi + 0x2e8]
jmp 0x425801
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x42581d
cmp ecx, 1
jl 0x42581d
cmp ecx, dword [esi + 0x2e8]
jg 0x42581d
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x42581d
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [esi + 0xc0]
cmp edi, dword [esi + 0xfc]
jg 0x425857
nop dword [eax + eax]
cmp edi, dword [esi + 0xd8]
je 0x42584e
cmp edi, dword [esi + 0xd4]
je 0x42584e
push 0x40
push edi
lea ecx, [esi + 0x2a8]
call fcn.00414360
inc edi
cmp edi, dword [esi + 0xfc]
jle 0x425830
push 0
push 0x4c1aa0
push dword [esi + 0xc4]
lea ecx, [esi + 0x2a8]
call fcn.00414a80
jmp 0x426b40
push edi
mov ecx, esi
call fcn.0042cd20
push 7
push edi
push dword [esi + 0xbc]
lea ecx, [esi + 0x2a8]
call fcn.00416470
mov dword [ebp - 0x118c], eax
test eax, eax
jne 0x4258f4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4258aa
push eax
call fcn.00489c73
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a02b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x4258e3
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x4258d0
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x118c], eax
jmp 0x425914
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x42590a
push ecx
call fcn.00489c73
mov eax, dword [ebp - 0x118c]
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
cmp eax, 0x4bfc90
je 0x425947
test eax, eax
je 0x425a4a
mov edi, 0x4bfc90
nop dword [eax]
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x4259e8
cmp word [edi], ax
jne 0x4259ed
mov eax, 0x20
push eax
push dword [esi + 0xc0]
lea edi, [esi + 0xc0]
mov edx, 0x2a8
mov ecx, esi
add ecx, edx
call fcn.00414360
push 5
push dword [ebp - 0x1190]
lea ecx, [esi + 0x2a8]
push dword [esi + 0xbc]
call fcn.00416470
mov dword [ebp - 0x118c], eax
test eax, eax
jne 0x425a54
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42599e
push eax
call fcn.00489c73
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a02b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x4259d4
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x4259c1
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x118c], eax
jmp 0x425a74
cmp ax, word [edi]
je 0x425a33
xor edx, edx
cmp dx, ax
jne 0x4259fc
mov dword [ebp - 0x119c], edx
jmp 0x425a0e
push ecx
call fcn.0048dee4
movzx eax, ax
add esp, 4
mov dword [ebp - 0x119c], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x425a1e
xor eax, eax
jmp 0x425a2a
push ecx
call fcn.0048dee4
add esp, 4
movzx eax, ax
cmp word [ebp - 0x119c], ax
jne 0x425a4a
mov eax, dword [ebp - 0x118c]
add eax, 2
add edi, 2
mov dword [ebp - 0x118c], eax
jmp 0x425930
mov eax, 0x40
jmp 0x42594c
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x425a6a
push ecx
call fcn.00489c73
mov eax, dword [ebp - 0x118c]
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
cmp eax, 0x4c1abc
je 0x425a9f
test eax, eax
je 0x425b61
mov edi, 0x4c1abc
nop dword [eax]
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x425aff
cmp word [edi], ax
jne 0x425b04
mov eax, 0x4c1ae0
push 0
push eax
push dword [esi + 0xc4]
lea edi, [esi + 0xc4]
mov edx, 0x2a8
mov ecx, esi
add ecx, edx
call fcn.00414a80
push 0x20
push dword [esi + 0xc4]
lea ecx, [esi + 0x2a8]
call fcn.00414360
push 0x20
push dword [esi + 0xcc]
lea ecx, [esi + 0x2a8]
call fcn.00414360
push 0x20
push dword [esi + 0xd0]
lea ecx, [esi + 0x2a8]
call fcn.00414360
jmp 0x426b40
cmp ax, word [edi]
je 0x425b4a
xor edx, edx
cmp dx, ax
jne 0x425b13
mov eax, dword [ebp - 0x118c]
add eax, 2
add edi, 2
mov dword [ebp - 0x118c], eax
jmp 0x425a90
mov eax, 0x4c1ac0
jmp 0x425aa4
cmp edi, 0xffffffd3
je 0x425b7e
cmp edi, 0xffffffd1
je 0x425b7e
cmp edi, 0xffffffd0
jne 0x4260fc
mov ecx, dword [esi + 0xd8]
cmp dword [esi + 0x238], ecx
jne 0x4260f6
cmp edi, 0xffffffd0
je 0x425ba9
mov eax, dword [esi + 0x23c]
mov dword [ebp - 0x11c4], eax
test eax, eax
jns 0x425c2a
push ecx
push ecx
mov ecx, edx
call fcn.00416520
mov dword [ebp - 0x11c4], eax
test eax, eax
jns 0x425c2a
mov eax, dword [esi + 0xd8]
cmp eax, 0xffffffff
jne 0x425bcd
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x425bf4
cmp eax, 1
jl 0x425bf4
cmp eax, dword [esi + 0x2e8]
jg 0x425bf4
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x425bf4
cmp dword [ecx + eax*8], 0xf
je 0x425c11
push 0
push 0
push 0x1004
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x118c], eax
jmp 0x425c53
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x11c4], eax
push 0
push 0
push 0x1004
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x11c4]
mov dword [ebp - 0x118c], eax
test ecx, ecx
jns 0x425dc0
mov edi, dword [esi + 0xdc]
cmp edi, dword [esi + 0xfc]
jg 0x425c78
push 0x40
push edi
lea ecx, [esi + 0x2a8]
call fcn.00414360
inc edi
cmp edi, dword [esi + 0xfc]
jle 0x425c61
mov eax, dword [ebp - 0x118c]
mov ecx, dword [esi + 0xd8]
dec eax
mov dword [ebp - 0x1190], eax
cmp ecx, 0xffffffff
jne 0x425c96
mov ecx, dword [esi + 0x2e8]
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x426b40
cmp ecx, 1
jl 0x426b40
cmp ecx, dword [esi + 0x2e8]
jg 0x426b40
lea ecx, [ecx + ecx*8]
shl ecx, 3
mov dword [ebp - 0x119c], ecx
cmp dword [edx + ecx + 0xc], 0
je 0x426b40
cmp dword [edx + ecx], 0xf
jne 0x426b40
test eax, eax
jns 0x425dab
push 0
push 0
push 0x1004
push dword [edx + ecx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x119c]
dec eax
mov dword [ebp - 0x1190], eax
test eax, eax
js 0x426b40
jne 0x425d02
xor edi, edi
test eax, eax
jle 0x425e19
mov esi, dword [ebp - 0x118c]
nop dword [eax]
cmp edi, ecx
mov dword [ebp - 0xfc], 0xf000
mov ecx, 0x2000
mov eax, 0x1000
cmove eax, ecx
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x10c]
push eax
push edi
push 0x102b
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x11c4]
inc edi
cmp edi, esi
jl 0x425dd0
mov esi, dword [ebp - 0x1194]
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xc0], 2
push eax
push ecx
push 0x102b
push dword [ebp - 0x11a4]
mov dword [ebp - 0xc4], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x11c4]
lea ecx, [esi + 0x2a8]
push 4
push eax
push dword [esi + 0xd8]
call fcn.00416470
mov edi, eax
mov eax, dword [ebp - 0x20]
test edi, edi
jne 0x425ec1
test eax, eax
je 0x425e76
push eax
call fcn.00489c73
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a02b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x425eb3
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x425ea0
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
jmp 0x425ed6
test eax, eax
je 0x425ece
push eax
call fcn.00489c73
add esp, 4
xor eax, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
test edi, edi
je 0x425f64
test eax, eax
jne 0x425efd
cmp word [edi], ax
je 0x425ef8
nop dword [eax + eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x425ef0
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x425f64
push edi
mov byte [ebp - 0x18], 1
call fcn.0048ddfc
mov edi, eax
add esp, 4
mov eax, dword [ebp - 0x11c4]
test edi, edi
jns 0x425f70
push 0x20
push dword [esi + 0xe0]
lea ecx, [esi + 0x2a8]
call fcn.00414360
mov edi, dword [esi + 0xdc]
cmp edi, dword [esi + 0xfc]
jg 0x426b40
nop dword [eax]
cmp edi, dword [esi + 0xe0]
je 0x425f56
mov eax, dword [ebp - 0x11c4]
xor edi, edi
mov byte [ebp - 0x18], 0
push 0
push eax
push dword [esi + 0xd8]
lea ecx, [esi + 0x2a8]
call fcn.00416470
mov esi, eax
mov eax, dword [ebp - 0x20]
test esi, esi
jne 0x425fdb
test eax, eax
je 0x425f9a
push eax
call fcn.00489c73
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a02b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x425fd3
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x425fc0
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x425ff2
test eax, eax
je 0x425fe8
push eax
call fcn.00489c73
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
push 0
push 1
push 1
push 0
push 0x4c1b00
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x18], 1
call fcn.004025a0
mov esi, eax
mov ecx, 0x40
test esi, esi
mov eax, 0x20
cmovle ecx, eax
mov eax, dword [ebp - 0x1194]
push ecx
push dword [eax + 0xdc]
lea ecx, [eax + 0x2a8]
call fcn.00414360
mov eax, dword [ebp - 0x1194]
mov ecx, dword [ebp - 0x11ac]
push 0x40
push dword [eax + 0xe0]
call fcn.00414360
test esi, esi
mov ecx, 0x20
mov esi, dword [ebp - 0x1194]
mov eax, 0x40
cmovle eax, ecx
push eax
push dword [esi + 0xe4]
lea ecx, [esi + 0x2a8]
call fcn.00414360
cmp edi, 1
lea ecx, [esi + 0x2a8]
sbb eax, eax
and eax, 0x20
add eax, 0x20
push eax
push dword [esi + 0xe8]
call fcn.00414360
push 0x20
push dword [esi + 0xec]
lea edi, [esi + 0x2a8]
mov ecx, edi
call fcn.00414360
push 0x20
push dword [esi + 0xf0]
mov ecx, edi
call fcn.00414360
push 0x20
push dword [esi + 0xf4]
mov ecx, edi
call fcn.00414360
push 0x20
push dword [esi + 0xf8]
mov ecx, edi
call fcn.00414360
push 0x20
push dword [esi + 0xc8]
mov ecx, edi
call fcn.00414360
push 0x20
push dword [esi + 0xfc]
mov ecx, edi
call fcn.00414360
jmp 0x426b40
lea ecx, [esi + 0xc4]
cmp edi, dword [esi + 0x74]
jne 0x426162
mov eax, dword [esi + 0x64]
cmp eax, 0xffffffff
jne 0x42610f
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x426b35
cmp eax, 1
jl 0x426b35
cmp eax, dword [esi + 0x2e8]
jg 0x426b35
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x426b35
cmp dword [ecx + eax*8], 0xf
jne 0x426b35
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x426b38
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0x119c], eax
cmp edi, eax
je 0x4269aa
cmp edi, dword [esi + 0x70]
je 0x4269aa
cmp edi, dword [esi + 0x78]
jne 0x426308
push ecx
push 0
push dword [esi + 0x64]
lea ecx, [esi + 0x534]
push dword [esi + 0x60]
push edx
call fcn.00417480
push ecx
push dword [esi + 0x78]
lea eax, [esi + 0x2a8]
push dword [esi + 0x94]
lea ecx, [esi + 0x554]
push dword [esi + 0x7c]
push eax
call fcn.00417480
mov ecx, dword [esi + 0x5c]
cmp ecx, 0xffffffff
jne 0x4261c9
mov ecx, dword [esi + 0x2e8]
jmp 0x4261ea
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x42620a
cmp ecx, 1
jl 0x42620a
cmp ecx, dword [esi + 0x2e8]
jg 0x42620a
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x42620a
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
jmp 0x426210
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x60]
cmp ecx, 0xffffffff
jne 0x426220
mov ecx, dword [esi + 0x2e8]
jmp 0x426241
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x426259
cmp ecx, 1
jl 0x426259
cmp ecx, dword [esi + 0x2e8]
jg 0x426259
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x426259
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
mov ecx, dword [esi + 0x64]
cmp ecx, 0xffffffff
jne 0x426269
mov ecx, dword [esi + 0x2e8]
jmp 0x42628a
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x4262a2
cmp ecx, 1
jl 0x4262a2
cmp ecx, dword [esi + 0x2e8]
jg 0x4262a2
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
mov ecx, dword [esi + 0x68]
cmp ecx, 0xffffffff
jne 0x4262b2
mov ecx, dword [esi + 0x2e8]
jmp 0x4262d3
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x4262eb
mov eax, dword [esi + 0xb4]
cmp edi, eax
jne 0x426359
push ecx
push eax
push dword [esi + 0xb8]
lea ecx, [esi + 0x574]
push dword [esi + 0xac]
push edx
call fcn.00417480
mov ecx, esi
call fcn.0042eef0
push dword [esi + 0xa4]
mov ecx, esi
call fcn.00431450
mov dword [esi + 0x108], 0xffffffff
mov dword [esi + 0x104], 0xffffffff
jmp 0x426b40
cmp edi, 0xffffffd3
jne 0x426449
mov eax, dword [esi + 0x60]
cmp dword [esi + 0x238], eax
jne 0x426449
mov edi, dword [esi + 0x23c]
test edi, edi
js 0x426b40
test eax, eax
jne 0x42638b
mov eax, dword [esi + 0x4d8]
jmp 0x4263bf
cmp eax, 0xffffffff
jne 0x426396
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x4263bd
cmp eax, 1
jl 0x4263bd
xor eax, eax
push 0xf000
push edi
push 0x102c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
not eax
mov dword [ebp - 0x84], 0xf002
and eax, 1
inc eax
shl eax, 0xc
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 0x60]
test eax, eax
jne 0x4263fc
cmp edi, dword [esi + 0x7c]
jne 0x426463
mov ecx, esi
call fcn.00432dd0
cmp eax, 2
je 0x426b5d
jmp 0x426b40
cmp edi, dword [esi + 0xb8]
jne 0x426480
mov ecx, esi
call fcn.0043a420
cmp eax, 2
je 0x426b5d
jmp 0x426b40
mov eax, dword [esi + 0x80]
cmp edi, eax
jne 0x426497
push eax
mov ecx, esi
call fcn.00426d70
jmp 0x426b40
mov eax, dword [esi + 0x8c]
cmp edi, eax
jne 0x4264ae
push eax
mov ecx, esi
call fcn.00426d70
jmp 0x426b40
cmp edi, 0xffffffb4
jne 0x4264e9
mov eax, dword [esi + 0x84]
cmp dword [esi + 0x238], eax
jne 0x4264ce
cmp edi, dword [esi + 0xc0]
jne 0x42656e
push 0
push 0
push 0x1004
push dword [ebp - 0x11b4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x118c], ecx
mov dword [ebp - 0x1190], eax
test ecx, ecx
jle 0x426aeb
push 0
push eax
push dword [esi + 0x60]
lea ecx, [esi + 0x2a8]
call fcn.00416470
mov dword [ebp - 0x11c8], eax
test eax, eax
mov eax, dword [ebp - 0x20]
jne 0x426a40
test eax, eax
je 0x426a02
push eax
call fcn.00489c73
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a02b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x426a38
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x426a25
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x426a5d
test eax, eax
je 0x426a4d
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x11c8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
push 0
push 1
push 1
push 0
push 0x4c1b0c
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x18], 1
call fcn.004025a0
test eax, eax
jne 0x426a91
push eax
push 1
push 1
push eax
push 0x4c1b18
lea ecx, [ebp - 0x20]
call fcn.004025a0
test eax, eax
je 0x426ad2
cmp edi, dword [ebp - 0x119c]
mov ecx, 0x2000
mov eax, 0x1000
mov dword [ebp - 0x138], 0xf000
cmove eax, ecx
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x1190]
push 0x102b
push dword [ebp - 0x11b4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1190]
inc eax
mov dword [ebp - 0x1190], eax
cmp eax, dword [ebp - 0x118c]
jl 0x4269d7
mov eax, dword [esi + 0x64]
cmp eax, 0xffffffff
jne 0x426af9
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x426b35
cmp eax, 1
jl 0x426b35
cmp eax, dword [esi + 0x2e8]
jg 0x426b35
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x426b35
cmp dword [ecx + eax*8], 0xf
jne 0x426b35
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x426b38
or eax, 0xffffffff
push eax
mov ecx, esi
call fcn.0042f860
push 0
mov ecx, esi
call fcn.004284d0
lea edx, [esi + 0x2a8]
lea ecx, [esi + 0xc4]
test eax, eax
jne 0x425100
mov edi, dword [ebp - 0x11a8]
mov eax, dword [ebp - 0x11b0]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x426b76
push eax
call esi
test edi, edi
je 0x426b7d
push edi
call esi
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x426b8d
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x426b9d
push eax
call fcn.00489c73
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x426bad
push eax
call fcn.00489c73
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00489c65
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc