Function at 0x407cf0
Capabilities:
Create thread
Get common file path
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b061
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x3204
call fcn.00417000
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x3200], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x3218]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 0x1c], eax
push dword [eax + 0x434]
mov edi, dword [eax + 0x1494]
push dword [eax + 0x420]
mov dword [esp + 0x1e4], str.list_values_
mov dword [esp + 0x1e8], str.list_nameS_
mov dword [esp + 0x1ec], str.list_nameT_
mov dword [esp + 0x1f0], str.list_url_
mov dword [esp + 0x1f4], str.list_type_
mov dword [esp + 0x1f8], str.list_x_
mov dword [esp + 0x1fc], str.list_y_
mov dword [esp + 0x200], str.list_pg_
mov dword [esp + 0x204], str.list_mimelist_
mov dword [esp + 0x208], str.list_logo_
mov dword [esp + 0x20c], str.list_sleep_
mov dword [esp + 0x210], str.list_desc_
mov byte [esp + 0x33], 0
call dword [sym.imp.GDI32.dll_SelectObject]
lea esp, [esp]
push 0x1558
call fcn.00413312
add esp, 4
mov dword [esp + 0x18], eax
push 0x1558
push 0
push eax
call fcn.004164d0
lea esi, [esp + 0x1e8]
add esp, 0xc
xor ebx, ebx
mov dword [esp + 0x24], esi
mov edi, edi
push 0x400
lea eax, [esp + 0x210]
add eax, ebx
push 0
push eax
call fcn.004164d0
mov esi, dword [esi]
add esp, 0xc
push esi
push edi
call fcn.004133a0
mov edi, eax
add esp, 8
test edi, edi
je 0x4089ce
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x407e42
sub esi, ecx
add edi, esi
push 0x4346d4
push edi
call fcn.004133a0
mov edx, eax
add esp, 8
mov dword [esp + 0x10], edx
test edx, edx
jne 0x407f2c
test edi, edi
je 0x407f0f
mov esi, edi
mov dword [esp + 0x10], edi
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x407e80
sub esi, ecx
cmp esi, 0x3ff
jg 0x407eb0
push esi
lea eax, [esp + 0x210]
add eax, ebx
push edi
push eax
call fcn.004171d0
lea eax, [esi + ebx]
add esp, 0xc
mov byte [esp + eax + 0x20c], 0
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
add ebx, 0x400
add esi, 4
mov dword [esp + 0x24], esi
cmp ebx, 0x3000
jl 0x407e10
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x120c]
push eax
mov byte [edi + 0x1424], 1
call fcn.0041384b
mov byte [edi + 0x1425], al
add esp, 4
mov byte [edi + 0x142d], al
mov al, byte [edi + 0x1425]
cmp al, 3
je 0x407f6f
cmp al, 4
jne 0x407f6d
mov byte [edi + 0x1425], 2
jmp 0x407f76
push 0x434304
push 0
call fcn.004133a0
mov edx, eax
mov dword [esp + 0x18], eax
add esp, 8
test edx, edx
je 0x4089ce
mov esi, edx
sub esi, edi
cmp esi, 0x3ff
jg 0x407eb0
push esi
lea eax, [esp + 0x210]
add eax, ebx
push edi
push eax
call fcn.004171d0
add esp, 0xc
lea eax, [esi + ebx]
mov byte [esp + eax + 0x20c], 0
push edi
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
mov dword [esp + 0x10], edi
jmp 0x407eb4
jbe 0x407f76
mov byte [edi + 0x1425], 1
cmp byte [esp + 0x60c], 9
lea ecx, [esp + 0x60c]
jne 0x407f8d
inc ecx
cmp byte [ecx], 9
je 0x407f87
lea edx, [esp + 0x60c]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x407f96
lea ecx, [esp + 0x60c]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407fb0
sub ecx, edx
lea eax, [ecx - 1]
cmp byte [esp + eax + 0x60c], 9
jne 0x407fd5
test eax, eax
js 0x407fd5
dec eax
cmp byte [esp + eax + 0x60c], 9
je 0x407fc6
lea ecx, [esp + 0x60c]
mov byte [esp + eax + 0x60d], 0
push ecx
lea eax, [edi + 0x400]
push 0x400
push eax
call fcn.00412f77
add esp, 0xc
lea eax, [esp + 0xa0c]
lea ebx, [edi + 0x800]
push eax
push 0x400
push ebx
call fcn.00412f77
add esp, 0xc
lea eax, [esp + 0xe0c]
push eax
push 0x400
push edi
call fcn.00412f77
add esp, 0xc
lea ecx, [esp + 0x2e0c]
lea eax, [edi + 0x1444]
push 0x7f
push ecx
push 0x80
push eax
call fcn.00412fcc
add esp, 0x10
mov ecx, 0x4344e0
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408070
test dl, dl
je 0x40806c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408070
add eax, 2
add ecx, 2
test dl, dl
jne 0x408050
xor eax, eax
jmp 0x408075
sbb eax, eax
or eax, 1
test eax, eax
jne 0x408088
push edi
push eax
push 0x407cd0
call fcn.0041432b
add esp, 0xc
mov esi, ebx
lea ecx, [esi + 1]
lea ecx, [ecx]
mov al, byte [esi]
inc esi
test al, al
jne 0x408090
lea eax, [esp + 0x160c]
sub esi, ecx
push eax
mov dword [edi + 0x1400], esi
call fcn.0041384b
add esp, 4
mov edi, eax
lea eax, [esp + 0x1a0c]
push eax
call fcn.0041384b
add esp, 4
mov ebx, eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x430]
push dword [eax + 0x420]
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x5c]
push eax
mov eax, dword [esp + 0x1c]
push esi
add eax, 0x800
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x420]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x18]
lea esi, [ebx + 0x10]
push esi
lea eax, [edi + 0x14]
add ecx, 0x1404
push eax
push ebx
push edi
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esp + 0x18]
cmp byte [eax + 0x142d], 3
jne 0x408145
mov eax, dword [esp + 0x5c]
push esi
add eax, 0x14
add eax, edi
push eax
push ebx
mov ebx, dword [esp + 0x24]
push edi
lea eax, [ebx + 0x1414]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov edi, dword [esp + 0x1c]
jmp 0x4081b6
mov ebx, dword [esp + 0x18]
lea edi, [ebx + 0x1444]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x408154
mov eax, dword [esp + 0x1c]
sub esi, ecx
push dword [eax + 0x428]
push dword [eax + 0x420]
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x5c]
push eax
push esi
push edi
mov edi, dword [esp + 0x28]
push dword [edi + 0x420]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [ebx + 0x1408]
mov edx, dword [ebx + 0x1404]
lea eax, [ecx + 0x10]
push eax
mov eax, dword [esp + 0x60]
add eax, edx
push eax
lea eax, [ecx - 0x22]
push eax
lea eax, [edx - 0x32]
push eax
lea eax, [ebx + 0x1414]
push eax
call dword [sym.imp.USER32.dll_SetRect]
lea eax, [esp + 0x1e0c]
push eax
call fcn.0041384b
add esp, 4
mov byte [ebx + 0x142c], al
lea ecx, [esp + 0x220c]
lea eax, [ebx + 0xc00]
push ecx
push 0x400
push eax
call fcn.00412f77
add esp, 0xc
cmp byte [esp + 0x2a0c], 0
jne 0x4081fe
mov dword [ebx + 0x1554], 0
jmp 0x40821a
lea eax, [esp + 0x2a0c]
push eax
call fcn.0041384b
add esp, 4
imul eax, eax, 0x3e8
mov dword [ebx + 0x1554], eax
push dword [edi + 0x424]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x30
push 0x30
mov dword [ebx + 0x1544], eax
push dword [edi + 0x424]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
push esi
push dword [ebx + 0x1544]
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [0x48b218]
movdqa xmm0, xmmword [0x434f30]
lea eax, [esp + 0x1d0]
push eax
movdqu xmmword [esp + 0x1d4], xmm0
push dword [ebx + 0x1544]
call dword [sym.imp.USER32.dll_FillRect]
cmp byte [esp + 0x260c], 0
jne 0x408393
mov ecx, dword [edi + 0x618]
lea esi, [edi + 0x614]
lea eax, [esp + 0x18]
cmp eax, ecx
jae 0x408325
mov ebx, dword [esi]
cmp ebx, eax
ja 0x408325
mov edx, dword [esi + 8]
lea edi, [esp + 0x18]
sub edi, ebx
sar edi, 2
cmp ecx, edx
jne 0x40830a
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x40830a
sub ecx, ebx
mov eax, 0x3fffffff
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x4085f7
inc ecx
sub edx, ebx
sar edx, 2
mov eax, 0x3fffffff
mov dword [esp + 0x20], ecx
mov ecx, edx
shr ecx, 1
sub eax, ecx
cmp eax, edx
jae 0x4082f7
xor edx, edx
jmp 0x4082f9
add edx, ecx
cmp edx, dword [esp + 0x20]
mov ecx, esi
cmovb edx, dword [esp + 0x20]
push edx
call fcn.0040dac0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x408318
mov eax, dword [esi]
mov eax, dword [eax + edi*4]
mov dword [ecx], eax
add dword [esi + 4], 4
mov edi, dword [esp + 0x10]
jmp 0x407de0
mov edx, dword [esi + 8]
cmp ecx, edx
jne 0x408379
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x408379
mov edi, dword [esi]
mov eax, 0x3fffffff
sub ecx, edi
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x4085f7
sub edx, edi
lea ebx, [ecx + 1]
sar edx, 2
mov eax, 0x3fffffff
mov ecx, edx
shr ecx, 1
sub eax, ecx
cmp eax, edx
jae 0x40836a
xor edx, edx
jmp 0x40836c
add edx, ecx
cmp edx, ebx
mov ecx, esi
cmovb edx, ebx
push edx
call fcn.0040dac0
mov eax, dword [esi + 4]
test eax, eax
je 0x408386
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
add dword [esi + 4], 4
mov edi, dword [esp + 0x10]
jmp 0x407de0
lea ecx, [esp + 0x260c]
push ecx
lea eax, [ebx + 0x1000]
push 0x400
push eax
call fcn.00412f77
add esp, 0xc
cmp byte [esp + 0x2b], 0
jne 0x408566
mov esi, dword [0x489034]
push 0x340
mov byte [esp + 0x2f], 1
call fcn.00413312
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x4083f1
mov dword [ebx], 0
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x134], 0xffffffff
jmp 0x4083f3
xor ebx, ebx
cmp dword [ebx], 0
jne 0x408465
cmp dword [ebx + 4], 0xffffffff
jne 0x408465
lea edi, [ebx + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x408413
mov eax, dword [0x4344d8]
push 0x1c
mov dword [edi], eax
mov dword [esp + 0x68], 0
call fcn.00413312
add esp, 4
mov ecx, eax
mov word [eax], pe_nt_image_headers32
mov dword [eax + 0x10], 0x439374
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], 0
mov dword [eax + 0xc], 0
call fcn.00411400
mov dword [ebx], eax
mov eax, dword [0x48b20c]
jmp 0x40846a
mov eax, 0x1000000
mov dword [0x48b208], eax
test eax, eax
je 0x408480
push ebx
call fcn.00412a22
add esp, 4
xor esi, esi
jmp 0x408495
push 8
call fcn.00413312
mov esi, eax
add esp, 4
mov dword [esi], 1
mov dword [esi + 4], ebx
test esi, esi
je 0x4089ac
mov ebx, dword [esp + 0x1c]
xor edi, edi
add ebx, 0x838
lea esp, [esp]
cmp dword [esi], 1
jne 0x408550
mov ecx, dword [esi + 4]
lea eax, [esp + 0x9c]
push eax
push edi
call fcn.00412160
mov dword [0x48b208], eax
test eax, eax
jne 0x40855a
push 0x104
call fcn.00413388
add esp, 4
mov dword [ebx - 0x200], eax
lea ecx, [esp + 0xa0]
push ecx
push 0x104
push eax
call fcn.00412f77
add esp, 0xc
push dword [esp + 0x1c4]
call fcn.00413388
mov ecx, dword [esp + 0x1c8]
add esp, 4
mov dword [ebx], eax
mov dword [ebx + 0x200], ecx
cmp dword [esi], 1
je 0x408536
inc edi
mov dword [0x48b208], 0x80000
add ebx, 4
jmp 0x4084b0
push ecx
push ecx
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.00412830
inc edi
mov dword [0x48b208], eax
add ebx, 4
jmp 0x4084b0
mov dword [0x48b208], 0x80000
mov ebx, dword [esp + 0x1c]
mov dword [ebx + 0xc38], edi
jmp 0x40856a
mov ebx, dword [esp + 0x1c]
xor edi, edi
cmp dword [ebx + 0xc38], edi
jle 0x4085a7
lea esi, [ebx + 0x638]
lea ebx, [ebx]
mov eax, dword [esi]
test eax, eax
je 0x40859b
push eax
lea eax, [esp + 0x2610]
push eax
call fcn.00412e9b
add esp, 8
test eax, eax
je 0x408601
inc edi
add esi, 4
cmp edi, dword [ebx + 0xc38]
jl 0x408580
mov ecx, dword [ebx + 0x618]
lea esi, [ebx + 0x614]
lea eax, [esp + 0x18]
cmp eax, ecx
jae 0x4085c5
mov ebx, dword [esi]
cmp ebx, eax
jbe 0x4082a9
mov edx, dword [esi + 8]
cmp ecx, edx
jne 0x408379
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x408379
mov edi, dword [esi]
mov eax, 0x3fffffff
sub ecx, edi
sar ecx, 2
sub eax, ecx
cmp eax, 1
jae 0x40834f
push str.vector_T__too_long
call fcn.0042917e
mov eax, dword [0x48b258]
xorps xmm0, xmm0
mov dword [esp + 0x68], vtable.ATL::CImage.0
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov word [esp + 0x84], 0
mov dword [esp + 0x88], 0xffffffff
mov dword [esp + 0x8c], 0xffffffff
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
movdqu xmmword [esp + 0x6c], xmm0
test al, 1
jne 0x4086ca
push 0
or eax, 1
mov dword [0x48b234], 0
push 0x48b238
mov dword [0x48b258], eax
mov dword [0x48b250], 0
mov dword [0x48b254], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x4086bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4086b8
movzx eax, ax
or eax, 0x80070000
mov dword [0x48b254], eax
push 0x42b150
call fcn.00412dc5
add esp, 4
push 0x48b238
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x48b250]
push 0x48b238
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x14]
mov dword [esp + 0x3220], 0
push eax
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4089c5
mov eax, dword [ecx]
push 0
push 0
push 0
push 0
push ecx
call dword [eax + 0x14]
mov eax, dword [esp + 0x14]
push 0
push dword [ebx + edi*4 + 0xa38]
push dword [ebx + edi*4 + 0x838]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [0x48b258]
mov esi, dword [esp + 0x14]
test al, 1
jne 0x40879c
push 0
or eax, 1
mov dword [0x48b234], 0
push 0x48b238
mov dword [0x48b258], eax
mov dword [0x48b250], 0
mov dword [0x48b254], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x40878f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40878a
movzx eax, ax
or eax, 0x80070000
mov dword [0x48b254], eax
push 0x42b150
call fcn.00412dc5
add esp, 4
cmp dword [0x48b254], 0
jne 0x4089bb
push 0x48b238
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x48b234], 0
mov bl, 1
jne 0x4087fe
lea eax, [esp + 0x34]
mov dword [esp + 0x4c], 1
push eax
lea eax, [esp + 0x50]
mov dword [esp + 0x54], 0
push eax
push 0x48b234
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
push 0x48b238
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x4089bb
lea eax, [esp + 0x24]
mov dword [esp + 0x3c], vtable.Gdiplus::Bitmap.0
push eax
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 0
test eax, eax
jne 0x4089b4
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x6c]
call fcn.00401620
push dword [esp + 0x40]
mov esi, eax
mov dword [esp + 0x40], vtable.Gdiplus::Image.0
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
test esi, esi
jne 0x4089bb
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x18]
push ecx
push eax
sub esp, 8
push ecx
push eax
push esi
push esi
push dword [edi + 0x1544]
lea ecx, [esp + 0x8c]
call fcn.00406460
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x18]
add esi, 0x614
mov ecx, dword [esi + 4]
cmp eax, ecx
jae 0x40892a
mov ebx, dword [esi]
cmp ebx, eax
ja 0x40892a
mov edx, dword [esi + 8]
mov edi, eax
sub edi, ebx
sar edi, 2
cmp ecx, edx
jne 0x40891a
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x40891a
sub ecx, ebx
mov eax, 0x3fffffff
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x4085f7
inc ecx
sub edx, ebx
sar edx, 2
mov eax, 0x3fffffff
mov dword [esp + 0x20], ecx
mov ecx, edx
shr ecx, 1
sub eax, ecx
cmp eax, edx
jae 0x408907
xor edx, edx
jmp 0x408909
add edx, ecx
cmp edx, dword [esp + 0x20]
mov ecx, esi
cmovb edx, dword [esp + 0x20]
push edx
call fcn.0040dac0
mov ecx, dword [esi + 4]
mov eax, dword [esi]
test ecx, ecx
je 0x40898b
mov eax, dword [eax + edi*4]
mov dword [ecx], eax
jmp 0x40898b
mov edx, dword [esi + 8]
cmp ecx, edx
jne 0x408982
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x408982
mov edi, dword [esi]
mov eax, 0x3fffffff
sub ecx, edi
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x4085f7
sub edx, edi
lea ebx, [ecx + 1]
sar edx, 2
mov eax, 0x3fffffff
mov ecx, edx
shr ecx, 1
sub eax, ecx
cmp eax, edx
jae 0x40896f
xor edx, edx
jmp 0x408971
add edx, ecx
cmp edx, ebx
mov ecx, esi
cmovb edx, ebx
push edx
call fcn.0040dac0
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 4]
test eax, eax
je 0x40898b
mov dword [eax], edi
add dword [esi + 4], 4
lea ecx, [esp + 0x68]
mov dword [esp + 0x3220], 0xffffffff
call fcn.004013a0
mov edi, dword [esp + 0x10]
jmp 0x407de0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ecx
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [esp + 0x68]
call fcn.004013a0
mov edx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x44], eax
mov byte [edx + 0x60f], 1
mov dword [esp + 0x3220], 1
xor ecx, ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x54], ecx
mov byte [esp + 0x3220], 2
xor ebx, ebx
mov esi, dword [edx + 0x614]
xor edi, edi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], edi
cmp esi, dword [edx + 0x618]
je 0x408ebf
lea eax, [esi + 4]
mov dword [esp + 0x10], eax
mov edx, dword [esi]
mov dword [esp + 0x14], edx
mov dword [esp + 0x2c], edx
test edx, edx
je 0x408ea6
movzx eax, byte [edx + 0x142c]
mov dword [esp + 0x34], eax
cmp eax, 7
mov eax, dword [esp + 0x10]
jg 0x408cf8
mov eax, dword [esp + 0x34]
cmp eax, 7
je 0x408ce2
test eax, eax
je 0x408b9e
dec eax
cmp eax, 2
ja 0x408d90
lea eax, [esp + 0x2c]
cmp eax, edi
jae 0x408b21
cmp dword [esp + 0x4c], eax
ja 0x408b21
mov edx, dword [esp + 0x4c]
sub eax, edx
sar eax, 2
mov dword [esp + 0x14], eax
cmp edi, ecx
jne 0x408b00
mov eax, ecx
sub eax, edi
sar eax, 2
cmp eax, 1
jae 0x408afc
sub edi, edx
mov eax, 0x3fffffff
sar edi, 2
sub eax, edi
cmp eax, 1
jb 0x4085f7
sub ecx, edx
mov eax, 0x3fffffff
sar ecx, 2
inc edi
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x408adb
xor ecx, ecx
jmp 0x408add
add ecx, edx
cmp ecx, edi
cmovb ecx, edi
push ecx
lea ecx, [esp + 0x50]
call fcn.0040dac0
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
test edi, edi
je 0x408b8a
mov eax, dword [edx + eax*4]
add esi, 4
mov dword [edi], eax
add edi, 4
add dword [esp + 0x10], 4
mov dword [esp + 0x50], edi
jmp 0x408ea6
cmp edi, ecx
jne 0x408b84
mov eax, ecx
sub eax, edi
sar eax, 2
cmp eax, 1
jae 0x408b84
mov edx, dword [esp + 0x4c]
mov eax, 0x3fffffff
sub edi, edx
sar edi, 2
sub eax, edi
cmp eax, 1
jb 0x4085f7
sub ecx, edx
mov eax, 0x3fffffff
sar ecx, 2
inc edi
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x408b63
xor ecx, ecx
jmp 0x408b65
add ecx, edx
cmp ecx, edi
cmovb ecx, edi
push ecx
lea ecx, [esp + 0x50]
call fcn.0040dac0
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
test edi, edi
je 0x408b8a
mov dword [edi], edx
add edi, 4
add esi, 4
add dword [esp + 0x10], 4
mov dword [esp + 0x50], edi
jmp 0x408ea6
lea eax, [edx + 0x1404]
push eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov eax, dword [esp + 0x14]
add eax, 0x1414
push eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov byte [eax + 0x1424], 0
cmp ecx, ebx
jae 0x408c69
cmp edx, ecx
ja 0x408c69
mov eax, ecx
mov ecx, dword [esp + 0x30]
sub eax, edx
sar eax, 2
mov dword [esp + 0x14], eax
cmp ebx, ecx
jne 0x408c50
mov eax, ecx
sub eax, ebx
sar eax, 2
cmp eax, 1
jae 0x408c4c
sub ebx, edx
mov eax, 0x3fffffff
sar ebx, 2
sub eax, ebx
cmp eax, 1
jb 0x4085f7
sub ecx, edx
mov eax, 0x3fffffff
sar ecx, 2
inc ebx
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x408c2b
xor ecx, ecx
jmp 0x408c2d
add ecx, edx
cmp ecx, ebx
cmovb ecx, ebx
push ecx
lea ecx, [esp + 0x40]
call fcn.0040dac0
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
test ebx, ebx
je 0x408cd2
mov eax, dword [edx + eax*4]
mov dword [ebx], eax
add ebx, 4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x40], ebx
jmp 0x408e81
mov ecx, dword [esp + 0x30]
cmp ebx, ecx
jne 0x408ccc
mov eax, ecx
sub eax, ebx
sar eax, 2
cmp eax, 1
jae 0x408cc8
sub ebx, edx
mov eax, 0x3fffffff
sar ebx, 2
sub eax, ebx
cmp eax, 1
jb 0x4085f7
sub ecx, edx
mov eax, 0x3fffffff
sar ecx, 2
inc ebx
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x408cab
xor ecx, ecx
jmp 0x408cad
add ecx, edx
cmp ecx, ebx
cmovb ecx, ebx
push ecx
lea ecx, [esp + 0x40]
call fcn.0040dac0
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
test ebx, ebx
je 0x408cd2
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
add ebx, 4
mov dword [esp + 0x40], ebx
jmp 0x408e81
mov eax, dword [esp + 0x1c]
mov byte [edx + 0x1424], 0
mov dword [eax + 0x62c], edx
jmp 0x408e81
mov ecx, dword [esp + 0x34]
cmp ecx, 8
je 0x408e70
cmp ecx, 0xff
jne 0x408d94
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
add edx, 0x620
mov dword [esp + 0x20], edx
mov ecx, dword [edx + 4]
cmp eax, ecx
jae 0x408deb
cmp dword [edx], eax
ja 0x408deb
sub eax, dword [edx]
sar eax, 2
mov dword [esp + 0x5c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x34], eax
cmp ecx, eax
jne 0x408dbc
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x408dbc
sub ecx, dword [edx]
mov eax, 0x3fffffff
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x4085f7
inc ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x34]
sub ecx, dword [edx]
sar ecx, 2
mov eax, ecx
shr eax, 1
mov dword [esp + 0x34], eax
mov eax, 0x3fffffff
sub eax, dword [esp + 0x34]
cmp eax, ecx
jae 0x408da3
xor ecx, ecx
jmp 0x408da7
mov eax, dword [esp + 0x10]
add esi, 4
add eax, 4
mov dword [esp + 0x10], eax
jmp 0x408ea6
add ecx, dword [esp + 0x34]
cmp ecx, dword [esp + 0x14]
cmovb ecx, dword [esp + 0x14]
push ecx
mov ecx, edx
call fcn.0040dac0
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
mov dword [esp + 0x20], eax
test eax, eax
je 0x408e62
mov eax, dword [edx]
add esi, 4
mov ecx, dword [esp + 0x5c]
mov eax, dword [eax + ecx*4]
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
add dword [edx + 4], 4
add dword [esp + 0x10], 4
jmp 0x408ea6
mov eax, dword [edx + 8]
mov dword [esp + 0x5c], eax
cmp ecx, eax
jne 0x408e55
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x408e55
sub ecx, dword [edx]
mov eax, 0x3fffffff
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x4085f7
inc ecx
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x5c]
sub ecx, dword [edx]
sar ecx, 2
mov eax, ecx
shr eax, 1
mov dword [esp + 0x34], eax
mov eax, 0x3fffffff
sub eax, dword [esp + 0x34]
cmp eax, ecx
jae 0x408e3c
xor ecx, ecx
jmp 0x408e40
add ecx, dword [esp + 0x34]
cmp ecx, dword [esp + 0x64]
cmovb ecx, dword [esp + 0x64]
push ecx
mov ecx, edx
call fcn.0040dac0
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
test eax, eax
je 0x408e62
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
add dword [edx + 4], 4
add esi, 4
add dword [esp + 0x10], 4
jmp 0x408ea6
mov eax, dword [esp + 0x1c]
mov byte [edx + 0x1424], 0
mov dword [eax + 0x630], edx
mov eax, dword [eax + 0x618]
mov ecx, dword [esp + 0x10]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
push esi
call fcn.00414fb0
mov eax, dword [esp + 0x28]
add esp, 0xc
add dword [eax + 0x618], 0xfffffffc
mov ecx, dword [esp + 0x1c]
cmp esi, dword [ecx + 0x618]
je 0x408ebb
mov ecx, dword [esp + 0x24]
jmp 0x408a31
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
sub ebx, esi
sar ebx, 2
test ebx, ebx
je 0x408fb9
sub edi, eax
mov dword [esp + 0x24], 0
sar edi, 2
xor ecx, ecx
mov dword [esp + 0x30], ecx
test edi, edi
je 0x408fb9
cmp edi, ecx
jbe 0x408ffb
mov esi, dword [eax + ecx*4]
test esi, esi
je 0x408fa8
cmp byte [esi + 0x142c], 3
ja 0x408fa8
lea eax, [esi + 0xc00]
push eax
call fcn.0040c360
test al, al
je 0x408fa0
mov edx, dword [esp + 0x24]
cmp edx, ebx
jae 0x408fb5
cmp ebx, edx
jbe 0x408ffb
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + edx*4]
mov dword [esp + 0x20], ecx
test ecx, ecx
je 0x408f9b
mov al, byte [esi + 0x142c]
mov byte [ecx + 0x142c], al
mov al, byte [esi + 0x1424]
mov byte [ecx + 0x1424], al
lea eax, [esi + 0x1404]
push eax
lea eax, [ecx + 0x1404]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [esi + 0x1414]
push eax
mov eax, dword [esp + 0x24]
add eax, 0x1414
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push 0x1558
push dword [esp + 0x24]
push esi
call fcn.004171d0
mov edx, dword [esp + 0x30]
add esp, 0xc
inc edx
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
inc ecx
mov dword [esp + 0x30], ecx
cmp edi, ecx
ja 0x408ef3
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x408fca
push eax
call fcn.00412a22
add esp, 4
test esi, esi
je 0x408fd7
push esi
call fcn.00412a22
add esp, 4
mov ecx, dword [esp + 0x3218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3200]
xor ecx, esp
call fcn.00412a27
mov esp, ebp
pop ebp
ret
push str.invalid_vector_T__subscript
call fcn.004291ac
int3