Function at 0x434ca1
Capabilities:
Create thread
Enumerate gui resources
Get common file path
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x3c], ecx
push edi
inc ebx
mov byte [ebp - 0x2d], dl
push ebx
lea ecx, [ebp - 0xe4]
call fcn.0043492e
push 2
pop esi
mov dword [ebp - 0x20], 0xfffffffb
lea ecx, [ebp - 0x140]
push esi
call fcn.0043492e
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x434cf2
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xe4]
mov dword [ecx + edx*4], 9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x434cdf
mov dword [ebp - 0xc], eax
jmp 0x434d0d
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xb8], 0x585b7f3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x434cfc
push 0xffffffffffffffff
mov dword [ebp - 0xc], eax
pop edi
jmp 0x434d29
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x140]
mov dword [ecx + edx*4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x434d1a
push 3
mov dword [ebp - 0xc], eax
pop edi
jmp 0x434d43
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x208], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x434d36
mov ecx, dword [ebp - 0xe4]
cmp dword [ecx], eax
jne 0x434d8b
mov dword [ebp - 0x20], 9
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x140]
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 0xe4]
mov edx, dword [ecx]
xor ecx, ecx
cmp edx, ebx
mov dword [ebp - 0xb8], edx
setle cl
sub ecx, edx
neg ecx
sbb ecx, ecx
neg ecx
imul edx, ecx
mov ecx, eax
test edx, edx
je 0x434d8d
mov ecx, ebx
xor eax, eax
cmp ecx, 0x1023
lea ecx, [ebp - 0x140]
setg al
sub eax, 4
mov dword [ebp - 0x208], eax
call fcn.00434a00
lea ecx, [ebp - 0xe4]
call fcn.00434a00
mov dword [ebp - 0xc], 0xfffffffa
lea ecx, [ebp - 0x158]
mov dword [ebp - 8], 6
push edi
call fcn.0043492e
mov dword [ebp - 0x20], 0xfffffffd
lea ecx, [ebp - 0x128]
push 4
call fcn.0043492e
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x434dff
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x158]
mov dword [ecx + edx*4], 0xad901516
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x434dec
mov dword [ebp - 0x1c], eax
jmp 0x434e1c
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x128]
mov dword [ecx + edx*4], 0xdf2ab2bc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x434e09
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0xc]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
je 0x434e37
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp - 0xc]
cmp ecx, 0xfff7
setne dl
imul edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0xc]
je 0x434e56
cmp dword [ebp - 0xc], eax
je 0x434e58
mov eax, ebx
xor edx, edx
cmp eax, ebx
sete dl
xor ecx, ecx
imul edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp edx, eax
mov eax, dword [ebp - 0xc]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x158]
setle dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0xc]
test eax, eax
setns cl
neg ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
imul ecx, dword [ebp - 8], 0xfffffff6
mov eax, dword [ebp - 0x128]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x128]
call fcn.00434a00
lea ecx, [ebp - 0x158]
call fcn.00434a00
mov edi, dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
mov dword [ebp - 0x1c], ebx
mov edx, 0xe3f2f34e
mov dword [ebp - 0xc], 0xfffffffd
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 7
jg 0x435099
mov dword [ebp - 0x14], 4
mov dword [ebp - 8], eax
jmp 0x434ef4
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x74], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x434eea
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x70]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
sbb edx, edx
neg edx
mov dword [ebp - 0x74], edx
mov ecx, dword [ebp - 0x1c]
add ecx, edx
jne 0x434f32
mov ecx, eax
cmp dword [ebp - 0x14], eax
je 0x434f34
mov ecx, ebx
mov dword [ebp - 0x24], ecx
xor ebx, ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
setne bl
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x435084
mov dword [ebp - 0x38], 0x7f2bac41
mov dword [ebp - 0x28], 0xd7d9c74e
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], eax
jl 0x435010
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], eax
jl 0x435007
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x434fe5
mov ecx, dword [ebp - 0xc]
cmp dword [ebp + ecx*4 - 0x74], eax
je 0x434f9c
mov dword [ebp - 0x20], 0xfff9
inc dword [ebp - 0x20]
jmp 0x434fad
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x74]
mov dword [ebp - 0x74], ecx
mov dword [ebp - 8], 0x8968f25c
mov dword [ebp - 8], eax
jmp 0x434fdb
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x434fd8
push eax
push 0x4a9
push 0x201b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x434fb2
dec dword [ebp - 0x10]
jns 0x434f87
mov dword [ebp - 0x10], eax
jmp 0x434ff8
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x74], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x434fea
dec dword [ebp - 0xc]
jns 0x434f79
dec dword [ebp - 0x14]
jns 0x434f6d
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], eax
jl 0x43507b
mov dword [ebp - 0x28], 0xa9a1
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x43503d
mov ecx, dword [ebp - 0x24]
cmp dword [ebp + ecx*4 - 0x74], eax
je 0x43503d
cmp dword [ebp - 0x1c], eax
je 0x43503d
xor esi, esi
inc esi
jmp 0x43503f
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x74]
cmp ecx, esi
mov ecx, dword [ebp - 0x38]
setg dl
xor ebx, ebx
cmp edx, 0x95c3
setg bl
xor edx, edx
cmp ebx, ecx
setl dl
sub edx, 0xac29ba1f
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x28]
mov dword [ebp - 0x28], edx
dec dword [ebp - 0xc]
jns 0x435018
push 2
pop esi
dec dword [ebp - 0x24]
jns 0x434f53
inc dword [ebp - 0x1c]
mov edx, 0xe3f2f34e
cmp dword [ebp - 0x1c], 7
push 1
pop ebx
jle 0x434ede
mov esi, dword [0x4af5ec]
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 5
mov dword [ebp - 0x38], esi
je 0x43515b
or edi, 0xffffffff
mov dword [ebp - 8], 0xe9c96c79
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x24], edi
push 4
call fcn.0043492e
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4350e9
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x110]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4350da
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
cmp ecx, edx
mov ecx, dword [ebp - 0x20]
setl bl
xor edx, edx
test ecx, ecx
setg dl
xor ecx, ecx
cmp ebx, edx
setg cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 8], eax
jne 0x43512e
cmp dword [ebp - 0x14], eax
jne 0x43512e
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x435133
xor ebx, ebx
inc ebx
mov ecx, ebx
mov eax, dword [ebp - 0x110]
mov dword [eax], ecx
lea ecx, [ebp - 0x110]
call fcn.00434a00
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jne 0x4350bc
mov edi, dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
xor eax, eax
mov ebx, dword [ebp + 8]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], 0xfffffffd
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 7
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
jg 0x435350
mov dword [ebp - 0x14], 4
mov dword [ebp - 8], eax
jmp 0x43519c
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x80], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x435192
mov ecx, dword [ebp - 0x1c]
mov edx, 0xe3f2f34e
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
sbb edx, edx
neg edx
mov dword [ebp - 0x80], edx
mov ecx, dword [ebp - 0x1c]
add ecx, edx
jne 0x4351e1
cmp dword [ebp - 0x14], eax
jne 0x4351e1
mov ecx, eax
jmp 0x4351e4
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
xor ebx, ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
push 2
setne bl
mov dword [ebp - 0x14], ebx
pop ebx
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], eax
jl 0x43533d
mov dword [ebp - 0x28], 0x7f2bac41
mov dword [ebp - 0x20], 0xd7d9c74e
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x4352c3
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x4352ba
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x435298
mov ecx, dword [ebp - 0xc]
cmp dword [ebp + ecx*4 - 0x80], eax
je 0x43524f
mov dword [ebp - 0x20], 0xfff9
inc dword [ebp - 0x20]
jmp 0x435260
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x80]
mov dword [ebp - 0x80], ecx
mov dword [ebp - 8], 0x8968f25c
mov dword [ebp - 8], eax
jmp 0x43528e
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x43528b
push eax
push 0x4a9
push 0x201b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x435265
dec dword [ebp - 0x10]
jns 0x43523a
mov dword [ebp - 0x10], eax
jmp 0x4352ab
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x80], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x43529d
dec dword [ebp - 0xc]
jns 0x43522c
dec dword [ebp - 0x14]
jns 0x435220
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x435334
xor edi, edi
mov dword [ebp - 0x20], 0xa9a1
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4352f0
mov ecx, dword [ebp - 0x24]
cmp dword [ebp + ecx*4 - 0x80], eax
je 0x4352f0
lea esi, [edi + 1]
cmp dword [ebp - 0x1c], eax
jne 0x4352f2
mov esi, eax
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x80]
cmp ecx, esi
mov ecx, dword [ebp - 0x28]
setg dl
xor ebx, ebx
cmp edx, 0x95c3
setg bl
xor edx, edx
cmp ebx, ecx
setl dl
sub edx, 0xac29ba1f
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x20], edx
dec dword [ebp - 0xc]
jns 0x4352cd
mov edi, dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
push 2
pop ebx
dec dword [ebp - 0x24]
jns 0x435206
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 7
jle 0x435186
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x38]
xor edi, edi
inc edi
cmp byte [ebp - 0x2d], 0
je 0x435409
cmp esi, edi
jne 0x435409
mov dword [ebp - 8], 4
mov dword [ebp - 0x2c], 0xc558
mov dword [ebp - 8], eax
jmp 0x43538e
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x43538b
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe6
jge 0x435378
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
push 3
mov dword [ebp - 0x84], eax
mov dword [ebx + 8], 4
mov dword [ebp - 8], eax
pop edx
jmp 0x4353cc
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1d8], 0x93b4e1a3
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x4353bb
mov dword [ebp - 0x88], eax
jmp 0x4353f0
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x1d8], 0xc17633ef
inc dword [ebp - 0x88]
cmp dword [ebp - 0x88], edx
jl 0x4353d9
mov dword [ebp - 0x88], 0xfffffffd
mov dword [ebx + 0xc], 0x4af5ec
mov dword [ebp - 0x28], 8
lea ecx, [ebp - 0x104]
push edi
call fcn.0043492e
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x435436
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x104]
mov dword [ecx + edx*4], 0xfffffffe
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x435423
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x43544f
push 0x149a
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
lea ecx, [ebp - 0x104]
call fcn.00434a00
mov ebx, dword [ebp - 0x3c]
cmp ebx, esi
jge 0x436269
push 4
lea ecx, [ebp - 0x190]
mov edi, 0x4af5f0
call fcn.0043492e
xor esi, esi
mov dword [ebp - 0x10], 0xdada439b
inc esi
mov dword [ebp - 8], 0x307e4a90
push esi
lea ecx, [ebp - 0x134]
call fcn.0043492e
xor eax, eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0xc], eax
jmp 0x4354bc
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x190]
mov dword [ecx + edx*4], 0xbbca
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x4354a9
mov dword [ebp - 0xc], eax
jmp 0x4354d8
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x1f0], 0x39f3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4354c7
mov dword [ebp - 0xc], eax
jmp 0x4354f6
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x134]
mov dword [ecx + edx*4], 4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x4354e3
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], eax
jl 0x435564
mov dword [ebp - 0x14], 0x4d9edbda
mov dword [ebp - 0x28], 0x2d7af2c9
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x435528
push eax
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor eax, eax
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 8], 0x45c8
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1ec], ecx
mov edx, dword [ebp - 0x14]
imul edx, ecx
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
mov ecx, dword [ebp - 0x134]
setl bl
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x10]
jns 0x435507
mov ebx, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffe3
je 0x435623
or ebx, 0xffffffff
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x1a0]
push 3
call fcn.0043492e
push 4
lea ecx, [ebp - 0x11c]
call fcn.0043492e
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4355ab
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx + edx*4], 0xb62b2faa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x435598
mov dword [ebp - 0x10], eax
jmp 0x4355c9
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + edx*4], 0xe62699ff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x4355b6
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff8
jge 0x4355fa
mov edx, dword [ebp - 0x11c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x20], esi
mov ecx, dword [ebp - 0x20]
mov dword [edx + 4], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff8
jl 0x4355de
lea ecx, [ebp - 0x11c]
call fcn.00434a00
lea ecx, [ebp - 0x1a0]
call fcn.00434a00
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe3
push 0
pop eax
jne 0x435574
mov ebx, dword [ebp - 0x3c]
lea ecx, [ebp - 0x134]
call fcn.00434a00
lea ecx, [ebp - 0x190]
call fcn.00434a00
xor eax, eax
mov dword [ebp - 0x28], eax
test ebx, ebx
jle 0x435c61
push 4
lea ecx, [ebp - 0x170]
call fcn.0043492e
push esi
lea ecx, [ebp - 0x14c]
call fcn.0043492e
xor eax, eax
mov dword [ebp - 8], 5
mov dword [ebp - 0x10], eax
jmp 0x435680
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x170]
mov dword [ecx + edx*4], 0x1647c2c9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x43566d
mov dword [ebp - 0x10], eax
jmp 0x43569e
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14c]
mov dword [ecx + edx*4], 0x223b16aa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x43568b
mov ecx, dword [ebp - 0x14c]
mov dword [ecx], eax
mov dword [ebp - 8], eax
jmp 0x4356d2
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x4356cf
push eax
push 0x1ce
push eax
push eax
push 0x1227
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x13
jge 0x4356b0
lea ecx, [ebp - 0x14c]
call fcn.00434a00
lea ecx, [ebp - 0x170]
call fcn.00434a00
mov eax, dword [edi]
push 3
mov dword [ebp - 0x2c], eax
xor eax, eax
pop edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 8], eax
jmp 0x43570d
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1cc], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x435700
push 2
pop ebx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x435774
push ebx
lea ecx, [ebp - 0x17c]
call fcn.0043492e
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 8], 0
jmp 0x435748
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x435739
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x1c8]
inc eax
cmp eax, 0xffffffff
setle cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x17c]
call fcn.00434a00
dec dword [ebp - 0x14]
jns 0x43571d
xor eax, eax
mov dword [ebp - 0x14], 0x2733582f
add edi, 4
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 5
mov dword [ebp - 0x10], edi
je 0x43582f
or edi, 0xffffffff
mov dword [ebp - 8], 0xe9c96c79
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x24], edi
push 4
call fcn.0043492e
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4357c8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x164]
mov dword [ecx + edx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4357b9
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
cmp ecx, edx
mov ecx, dword [ebp - 0x20]
setl bl
xor edx, edx
test ecx, ecx
setg dl
xor ecx, ecx
cmp ebx, edx
setg cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 8], eax
jne 0x435808
mov ecx, eax
cmp dword [ebp - 0x14], eax
je 0x43580a
mov ecx, esi
mov eax, dword [ebp - 0x164]
mov dword [eax], ecx
lea ecx, [ebp - 0x164]
call fcn.00434a00
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jne 0x43579b
mov edi, dword [ebp - 0x10]
xor eax, eax
mov ebx, dword [edi]
mov dword [ebp - 0x14], 0xbd97a888
mov dword [ebp - 8], 0xfffffffb
mov dword [ebp - 0x20], 0xf1d8987f
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], eax
jmp 0x43585f
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1e4], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x43584e
mov dword [ebp - 0x10], eax
jmp 0x43587b
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xc0], 0xefa20bd0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x43586a
mov ecx, dword [ebp - 0xbc]
mov edx, dword [ebp - 0x1dc]
inc dword [ebp - 0xbc]
sub edx, ecx
je 0x4358ad
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x4358d1
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
xor eax, eax
jmp 0x4358d1
mov dword [ebp - 8], 4
mov dword [ebp - 8], 0xa
jmp 0x4358c5
cmp dword [ebp - 0x20], eax
jne 0x4358cb
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffb
jg 0x4358bd
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 8], 0xfffffff8
add edi, 4
mov dword [ebp - 0x1c], 0x12a30a4c
or ecx, 0xffffffff
mov dword [ebp - 0x14], 0xd0cd8a6c
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], eax
jmp 0x435908
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xf8], 0x7b59
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4358f7
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffff4
jge 0x435b62
push dword [ebp + 8]
movdqa xmm0, xmmword [str._b_b_b_b]
lea ecx, [ebp - 0x1b0]
push ecx
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x24], 0x9ecf4a41
push ecx
push eax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x4c], eax
movdqu xmmword [ebp - 0x1c0], xmm0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], eax
call fcn.00434a71
xor eax, eax
mov dword [ebp - 0xd0], 0x5b292197
mov dword [ebp - 0x14], eax
jmp 0x435977
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x184], 0x9e61979b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x435966
mov dword [ebp - 0xc], 0xfffffff8
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x14], 0x9ed994ad
mov dword [ebp - 0x14], 0x8f3b1ad3
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0xc]
je 0x4359a4
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], 0xfff9
mov ecx, dword [ebp - 0x4c]
sbb edx, edx
neg edx
mov dword [ecx], edx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jg 0x435b41
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x14], 0xe48991cd
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x14], 0x7127
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], 0x879a2734
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [esi + edi*4]
setge dl
xor esi, esi
mov dword [ebp - 0x14], edx
inc esi
cmp dword [ebp - 0x14], esi
ja 0x435a14
mov edx, eax
cmp dword [ebp - 0x24], eax
je 0x435a16
mov edx, esi
xor ecx, ecx
cmp edx, 2
sete cl
xor ebx, ebx
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
setl bl
cmp ebx, dword [ebp - 0x1c]
jg 0x435a3a
mov edi, esi
cmp dword [ebp - 0x20], eax
jne 0x435a3c
mov edi, eax
mov esi, dword [ebp - 0xc]
xor edx, edx
mov ecx, dword [ebp - 0xc]
cmp edi, ecx
setg dl
xor ebx, ebx
test edx, edx
setns bl
sub ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x4c]
neg ebx
sbb ebx, ebx
inc ebx
cmp dword [ecx + esi*4], ebx
jne 0x435a7d
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x4c]
cmp dword [ecx + edx*4], eax
je 0x435a7d
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x4c]
cmp dword [ecx + edx*4], eax
je 0x435a7d
xor esi, esi
inc esi
mov ecx, esi
jmp 0x435a82
xor esi, esi
mov ecx, eax
inc esi
mov edx, dword [ebp - 0xc]
xor ebx, ebx
cmp ecx, 0xffffffff
setle bl
sub ebx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x4c]
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, dword [ecx + edx*4]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
xor ebx, ebx
cmp dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0xc]
setle bl
xor edx, edx
cmp ebx, ecx
setl dl
imul edx, dword [ebp - 8]
mov dword [ebp - 0x20], edx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x4c]
cmp dword [ecx + edx*4], eax
je 0x435ae4
mov edx, dword [ebp - 0xc]
xor ebx, ebx
mov ecx, dword [ebp - 0x4c]
mov edi, esi
cmp dword [ecx + edx*4], 3
setg bl
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0xd0]
jg 0x435ae6
mov edi, eax
mov esi, dword [ebp - 0xc]
xor ebx, ebx
mov ecx, dword [ebp - 0x4c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0xc]
add ecx, edi
cmp edx, ecx
setle bl
sub ebx, edx
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, 0x40c5
setg cl
xor ebx, ebx
cmp ecx, 7
mov ecx, dword [ebp - 0x5c]
setne bl
xor edx, edx
imul ebx, dword [ecx + 8]
mov ecx, dword [ebp - 0x4c]
add ebx, dword [ecx + esi*4]
mov ecx, dword [ebp - 0xc]
cmp ebx, ecx
setne dl
add edx, dword [ebp - 0x184]
mov dword [ebp - 0x14], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x4359d6
lea ecx, [ebp - 0x4c]
call fcn.00434a00
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff4
push 0
pop eax
jl 0x43591b
mov edi, dword [ebp - 0x10]
xor esi, esi
mov ebx, dword [ebp - 0x34]
inc esi
mov dword [ebp - 0x1c], eax
jmp 0x435b7e
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + ecx*4 - 0xf8]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0xf8], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x435b67
test ebx, ebx
jne 0x435b8a
add edi, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x14], 0xfffe
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x435bc3
push 0x2677
push 0xc38
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x435bdd
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
jne 0x435be1
cmp dword [ebp - 0x24], eax
jne 0x435be1
mov edx, eax
jmp 0x435be3
mov edx, esi
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov ecx, 0xfc6088b9
cmp ecx, edx
mov ecx, dword [ebp - 0x24]
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x24]
setl bl
xor edx, edx
cmp ebx, ecx
setg dl
xor ebx, ebx
mov dword [ebp - 0x34], edx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
cmp ecx, edx
mov ecx, dword [ebp - 0x34]
setne bl
imul ecx, ebx
test ecx, ecx
jne 0x435c28
cmp dword [ebp - 0x14], eax
jne 0x435c28
mov esi, eax
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
imul edx, esi
push 1
pop esi
cmp edx, ecx
setge bl
add edi, dword [ebp - 0x2c]
add ebx, 0x67f5
imul ebx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ebx
mov ebx, dword [ebp - 0x28]
inc ebx
mov dword [ebp - 0x28], ebx
cmp ebx, dword [ebp - 0x3c]
jl 0x435646
push 0xfffffffffffffffb
mov dword [ebp - 0x34], 0xbd97a888
pop ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x2c], 0xf1d8987f
mov dword [ebp - 0x10], eax
jmp 0x435c8b
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x214], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x435c7a
mov dword [ebp - 0x10], eax
jmp 0x435ca7
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xd8], 0xefa20bd0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x435c96
mov ecx, dword [ebp - 0xd4]
mov edx, dword [ebp - 0x20c]
inc dword [ebp - 0xd4]
sub edx, ecx
je 0x435cd7
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x435cfa
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
jmp 0x435cfa
mov dword [ebp - 0x5c], 4
mov dword [ebp - 8], 0xa
jmp 0x435cef
cmp dword [ebp - 0x2c], eax
jne 0x435cf4
dec dword [ebp - 8]
cmp dword [ebp - 8], ebx
jg 0x435ce7
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x5c], eax
mov ebx, dword [edi]
lea ecx, [ebp - 0xa8]
add edi, 4
mov dword [ebp - 0x24], 0x3ae35568
push 2
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], edi
call fcn.0043492e
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa0ac0]
lea ecx, [ebp - 0x1a0]
push ecx
xor eax, eax
mov dword [ebp - 0x3c], 0xfff8
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0xcc], eax
push ecx
push eax
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xc8], eax
movdqu xmmword [ebp - 0x1b0], xmm0
mov dword [ebp - 0xc4], eax
call fcn.00434a71
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x2c], 0x4475678d
mov dword [ebp - 8], eax
jmp 0x435d81
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xa8]
mov dword [ecx + edx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x435d72
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xfffffff6
je 0x435f56
mov edi, dword [ebp - 0xa8]
mov esi, dword [ebp - 0xcc]
mov dword [ebp - 8], 0x9d56
xor edx, edx
mov dword [ebp - 0x28], 6
inc edx
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x34], 0xf43a
mov dword [ebp - 0x14], eax
jmp 0x435dd2
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x40], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x435dc4
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xa8]
cmp edx, dword [ecx]
mov ecx, dword [ebp - 0x3c]
setl bl
xor edx, edx
cmp ebx, ecx
setne dl
xor ecx, ecx
cmp edx, dword [edi + 4]
setl cl
cmp ecx, 0xffff
ja 0x435e16
cmp dword [ebp - 0x40], eax
je 0x435e16
xor ebx, ebx
inc ebx
mov ecx, ebx
jmp 0x435e1b
xor ebx, ebx
mov ecx, eax
inc ebx
xor edx, edx
cmp ecx, 0x1c23
mov ecx, dword [ebp - 8]
setle dl
imul ecx, edx
mov dword [esi + 0xc], edx
or edx, 0xffffffff
add ecx, 0xfff9
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ecx]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x28]
sub ecx, 4
mov dword [esi + 8], 0xe2e
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x7d6446bd
mov ecx, 0xcb407cb0
setl dl
cmp ecx, edx
mov dword [ebp - 0x40], edx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
jne 0x435e90
mov ecx, dword [ebp - 0xa8]
mov edx, eax
cmp dword [ecx], eax
je 0x435e92
mov edx, ebx
mov ecx, dword [ebp - 0x20]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setne bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setg dl
add ecx, 8
add ecx, edx
je 0x435ece
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x435f43
push eax
push 0x21ec
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor eax, eax
jmp 0x435f43
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
jne 0x435edf
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
dec ecx
jne 0x435ef7
mov ecx, dword [ebp - 0x3c]
cmp dword [ebp - 0x14], 0xfff6
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x34]
cmp edx, dword [esi + 8]
setne cl
cmp ecx, 0x1c18a1c1
je 0x435f3b
mov dword [ebp - 8], eax
jmp 0x435f2a
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x224], 0xb12b2c9d
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x435f19
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x14], ecx
jmp 0x435f43
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], eax
jne 0x435f50
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff6
jne 0x435da0
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x10]
lea ecx, [ebp - 0xcc]
call fcn.00434a00
lea ecx, [ebp - 0xa8]
call fcn.00434a00
mov esi, dword [edi]
lea ecx, [ebp - 0xf0]
push 2
call fcn.0043492e
mov dword [ebp - 0x20], 0x919adb82
xor eax, eax
mov dword [ebp - 0x28], 0x49c23edb
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], eax
jmp 0x435fa6
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xf0]
mov dword [ecx + edx*4], 0x65683c8f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x435f93
push 3
mov dword [ebp - 0x10], eax
pop ecx
jmp 0x435fc1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1fc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x435fb4
mov edx, dword [ebp - 0xf0]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp dword [edx + 4], eax
setl cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
test eax, eax
mov eax, dword [ebp - 0xf0]
setns cl
sub ecx, dword [eax]
sub ecx, dword [edx + 4]
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0xf0]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1f4], eax
mov dword [ebp - 0x2c], 0x5a61940c
call fcn.00434a00
mov dword [ebp - 0xc], 0xfffffff8
xor ecx, ecx
mov dword [ebp - 0x28], 9
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 3
jge 0x436039
or edx, 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x68], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x436029
xor edx, edx
mov dword [ebp - 0xc], ecx
inc edx
jmp 0x43604f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x58], 0x1b4415e4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x436041
mov dword [ebp - 0xc], ecx
jmp 0x43606a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x194], 0x208
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x436059
mov dword [ebp - 0xc], 2
cmp dword [ebp - 0xc], ecx
jl 0x43610d
or ebx, 0xffffffff
mov dword [ebp - 8], ecx
jmp 0x436098
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb4], 0xf3d37a5b
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x436087
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x68]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0xb0], edx
mov eax, dword [ebp - 0xc]
neg eax
cmp edx, eax
jg 0x4360d6
mov eax, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xb0]
sub edx, eax
jne 0x4360d6
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x68]
mov edx, dword [ebp - 0x60]
sub edx, eax
mov eax, dword [ebp - 0x64]
neg edx
sbb edx, edx
inc edx
add eax, edx
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0xb4], ecx
jne 0x43610a
dec dword [ebp - 0xc]
jns 0x436082
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], 0xffffffe7
cmp dword [ebp - 0xc], 0xd
jg 0x436186
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x2c], 0x2f1e73e4
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x20]
sub edx, 0x99c826ff
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x20]
sub edx, 0x31a2
neg edx
sbb edx, edx
inc edx
imul eax, edx
cmp eax, dword [ebp - 0xc]
jge 0x436160
mov eax, ebx
cmp dword [ebp - 0x58], ecx
jne 0x436162
mov eax, ecx
cmp eax, dword [ebp - 0x20]
je 0x43616e
mov edx, ebx
cmp dword [ebp - 0x58], ecx
jne 0x436170
mov edx, ecx
xor eax, eax
cmp edx, ebx
sete al
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xd
jle 0x43611d
mov ebx, dword [ebp - 0x1c]
test esi, esi
jne 0x436270
cmp byte [ebp - 0x2d], cl
je 0x4361a2
cmp dword [ebp - 0x38], 1
jne 0x4361a2
mov ecx, dword [ebp + 8]
lea eax, [ebx + 0x10]
add dword [ecx + 8], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x2c], eax
mov eax, dword [edi + 8]
add edi, 0xc
push ebx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], edi
call fcn.00488069
mov dword [ebp - 0x38], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xac], eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
lea eax, [ebp - 0xac]
push eax
push ebx
call fcn.0046f1f7
mov edi, dword [ebp - 0x9c]
xor ecx, ecx
mov esi, ecx
test ebx, ebx
jle 0x43623d
mov eax, esi
and eax, 0x80000001
jns 0x436207
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x2c]
add eax, esi
add eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x34]
jmp 0x43621c
lea eax, [edx + 1]
cdq
idiv ebx
cmp word [edi + edx*2], cx
jne 0x436219
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov eax, dword [ebp - 0x10]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x38]
mov byte [esi + edx], al
inc esi
cmp esi, ebx
jl 0x4361f9
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x38]
mov dword [esi], ebx
mov dword [esi + 4], eax
test edi, edi
je 0x436273
push edi
call fcn.00489556
pop ecx
xor ecx, ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
jmp 0x436273
mov esi, dword [ebp + 8]
xor ecx, ecx
jmp 0x436276
mov esi, dword [ebp + 8]
xor edi, edi
inc edi
mov dword [ebp + 8], 0xe2bf35dd
mov dword [ebp - 0x38], 0xa8d7d2a7
mov dword [ebp - 0x2c], 0x1639956a
mov dword [ebp - 0x28], 0x2452
mov dword [ebp + 8], 0xd3b51ad5
mov dword [ebp + 8], 0xfffffff9
mov dword [ebp + 8], 0xa69eed08
mov dword [ebp + 8], ecx
jmp 0x4362b6
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x54], edi
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x4362ac
mov eax, dword [ebp - 0x50]
xor edx, edx
cmp eax, edi
mov eax, dword [ebp - 0x54]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x50]
sete bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x54]
cmp ebx, eax
mov eax, dword [ebp - 0x54]
setne dl
xor ebx, ebx
imul eax, edx
imul edx, eax, 5
mov eax, dword [ebp - 0x50]
cmp edx, eax
setne bl
xor eax, eax
cmp ebx, 0xe1b1b552
setne al
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ecx
je 0x436312
mov eax, edi
cmp dword [ebp - 0x50], ecx
jne 0x436314
mov eax, ecx
cmp eax, 0xe1abe8f2
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x54]
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
imul edx, eax, 0xffff
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setg bl
imul ebx, dword [ebp - 0x28]
neg ebx
jne 0x436342
cmp dword [ebp + 8], ecx
je 0x436344
mov ecx, edi
imul ecx, ecx, 0x598
mov eax, esi
pop edi
pop esi
pop ebx
sub ecx, dword [ebp - 0x28]
mov dword [ebp + 8], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov esp, ebp
pop ebp
ret