Function at 0x4405b4
Capabilities:
Check if file exists
Encode data using base64
Encrypt data using rc4 ksa
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x740]
sub esp, 0xbd0
mov eax, dword [0x488548]
xor eax, ebp
mov dword [ebp + 0x73c], eax
mov eax, dword [ebp + 0x748]
or dword [ebp + 0x48], 0xffffffff
push ebx
push esi
mov esi, ecx
mov ecx, dword [ebp + 0x74c]
mov dword [ebp + 0x6c], ecx
mov ecx, dword [ebp + 0x750]
mov dword [ebp + 0x1c], ecx
xor ecx, ecx
inc ecx
mov dword [ebp + 0x60], ecx
mov dword [ebp + 0x20], ecx
movzx ecx, byte [eax + 2]
mov dword [ebp + 0x5c], edx
mov edx, dword [esi + 0x2284]
imul ecx, edx
push edi
movzx edi, byte [eax + 1]
mov al, byte [eax + 3]
imul edi, dword [esi + 0x2280]
xor ebx, ebx
mov dword [ebp + 0x7c], ebx
mov dword [ebp + 0x70], 0x64
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x44], ebx
mov dword [ebp + 0x80], ecx
cmp al, bl
je 0x440637
cmp al, 2
jne 0x44063d
sub dword [ebp + 0x80], edx
mov eax, dword [0x487144]
cmp edi, eax
jg 0x440655
cmp dword [ebp + 0x80], eax
jg 0x440655
mov dword [ebp + 0x70], 0xfffffc17
cmp dword [ebp + 0x6c], ebx
jne 0x440a3b
push 0x1400000
push ebx
push str.X_wsiz
mov dword [ebp - 0x490], ebx
mov dword [ebp - 0x480], ebx
mov dword [ebp - 0x488], ebx
mov dword [ebp - 0x484], ebx
call fcn.004254c4
mov ecx, dword [ebp + 0x5c]
cmp byte [ecx + 0xf], 2
jb 0x4406a2
test byte [ecx + 0x274], 3
jne 0x4406a2
cmp dword [ecx + 0x40], ebx
jne 0x4406a2
cmp dword [ecx + 0x44], eax
jbe 0x4406a5
mov dword [ebp + 0x60], ebx
mov ecx, dword [ebp + 0x5c]
lea eax, [esi + 0xa34]
push eax
add ecx, 0x50
push ecx
lea eax, [ebp + 0x84]
push eax
call dword [sym.imp.PPLIB32W.DLL__VFSFullPath_12]
test eax, eax
jne 0x4406c7
mov dword [ebp + 0x60], ebx
cmp dword [ebp + 0x60], ebx
je 0x440a56
cmp dword [esi + 0x1d20], 3
jne 0x4406fc
lea eax, [ebp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4406fc
lea eax, [ebp + 0x84]
push eax
push eax
push dword [esi + 0xc]
call dword [sym.imp.PPLIB32W.DLL__VFSGetRealPath_12]
lea eax, [ebp + 0x84]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x440705
sub eax, edx
sar eax, 1
mov ecx, str.:thumbnail.jpg
lea edx, [ebp + eax*2 + 0x84]
mov dword [ebp + 0x3c], eax
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
inc ecx
inc ecx
cmp ax, bx
jne 0x440724
lea eax, [ebp + 0x84]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x44073b
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x440778
lea eax, [ebp + 0x84]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x440759
sub eax, edx
sar eax, 1
add eax, 0x88000000
push eax
push 0xbffb
call dword [sym.imp.PPLIB32W.DLL__PPxCommonExtCommand_8]
mov eax, dword [esi + 0x1d20]
cmp eax, 0x60
je 0x440899
cmp eax, 0x40
je 0x440899
cmp eax, 0x3d
je 0x440899
cmp eax, 0x3e
je 0x440899
cmp eax, 0x3f
je 0x440899
push dword [ebp + 0x70]
lea eax, [ebp + 0x84]
push eax
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.PPLIB32W.DLL__LoadBMP_12]
test eax, eax
jne 0x440a56
mov eax, dword [ebp + 0x3c]
xor ecx, ecx
cmp dword [0x487134], 2
lea eax, [ebp + eax*2 + 0x84]
mov word [eax], cx
je 0x4407eb
cmp dword [0x487130], 4
jne 0x440806
push dword [ebp + 0x70]
lea eax, [ebp + 0x84]
push eax
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.PPLIB32W.DLL__LoadBMP_12]
test eax, eax
jne 0x44086b
cmp dword [0x487134], 1
jge 0x440818
cmp dword [0x487130], 3
jl 0x44083b
mov eax, dword [ebp + 0x80]
cmp edi, eax
cmovg eax, edi
push eax
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp + 0x84]
push eax
call fcn.0043fdc4
test eax, eax
jne 0x44086b
cmp dword [0x487134], 2
je 0x440868
cmp dword [0x487130], 4
je 0x440868
push dword [ebp + 0x70]
lea eax, [ebp + 0x84]
push eax
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.PPLIB32W.DLL__LoadBMP_12]
test eax, eax
jne 0x44086b
mov dword [ebp + 0x60], ebx
cmp dword [ebp + 0x60], ebx
je 0x440a56
cmp dword [0x48713c], ebx
je 0x440a56
mov eax, dword [ebp + 0x5c]
test byte [eax + 0x24], 0x10
jne 0x440a56
mov dword [ebp + 0x7c], 1
jmp 0x440a56
cmp dword [0x487138], ebx
je 0x440a36
mov eax, dword [ebp + 0x5c]
test byte [eax + 0x24], 0x10
jne 0x440a36
cmp dword [eax + 0x44], ebx
jne 0x4408c0
cmp dword [eax + 0x40], ebx
je 0x440a36
lea eax, [esi + 0xa34]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4408c9
sub eax, edx
sar eax, 1
mov dword [ebp + 0x3c], eax
lea eax, [ebp + eax*2 + 0x84]
cmp word [eax], 0x5c
mov dword [ebp + 0x78], eax
jne 0x44091b
push 0x3a
jmp 0x4408f3
push 0x5f
mov dword [ebp + 0x78], eax
pop ecx
mov word [eax], cx
add eax, 2
push eax
call dword [sym.imp.PPLIB32W.DLL__FindPathSeparator_4]
cmp eax, ebx
jne 0x4408ee
mov eax, dword [ebp + 0x78]
add eax, 2
push 0x3a
push eax
call fcn.0046891a
pop ecx
pop ecx
push 0x5f
pop ecx
mov word [eax], cx
push dword [ebp + 0x70]
lea eax, [ebp + 0x84]
push eax
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.PPLIB32W.DLL__LoadBMP_12]
test eax, eax
jne 0x440a56
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
lea eax, [esi + 0xa34]
push eax
call dword [sym.imp.PPLIB32W.DLL__CreateFileL_28]
mov dword [ebp + 0x34], eax
cmp eax, 0xffffffff
jne 0x44096d
mov eax, dword [ebp + 0x5c]
or dword [eax + 0x1c], 0xffffffff
xor eax, eax
jmp 0x4413b5
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x40]
push eax
mov eax, dword [ebp + 0x5c]
add eax, 0x50
push eax
lea eax, [esi + 0xa34]
push eax
push dword [ebp + 0x34]
push dword [esi + 0xc]
call dword [sym.imp.PPLIB32W.DLL__VFSGetArchivefileImage_32]
test eax, eax
jne 0x440a25
push dword [ebp + 0x40]
push ebx
push dword [0x48b040]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push dword [ebp + 0x40]
mov dword [ebp - 0x490], eax
push dword [ebp + 0x64]
push eax
call fcn.00468fa0
add esp, 0xc
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp + 0x70]
mov eax, dword [ebp + 0x5c]
push dword [ebp + 0x40]
or dword [ebp - 0x480], 0xffffffff
add eax, 0x50
push eax
lea eax, [ebp - 0x490]
push eax
mov dword [ebp - 0x488], ebx
mov dword [ebp - 0x484], ebx
call dword [sym.imp.PPLIB32W.DLL__InitBMP_16]
test eax, eax
je 0x440a1b
mov dword [ebp + 0x40], ebx
cmp dword [0x48713c], ebx
je 0x440a1e
mov dword [ebp + 0x7c], 1
jmp 0x440a1e
mov dword [ebp + 0x60], ebx
call fcn.0042717f
jmp 0x440a2b
mov dword [ebp + 0x40], ebx
mov dword [ebp + 0x60], ebx
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x440a56
mov dword [ebp + 0x60], ebx
jmp 0x440a56
push dword [ebp + 0x70]
lea eax, [ebp - 0x490]
push dword [ebp + 0x6c]
push eax
call dword [sym.imp.PPLIB32W.DLL__LoadBMP_12]
test eax, eax
je 0x44095f
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetDC]
push eax
mov dword [ebp + 0x64], eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp + 0x74], eax
mov eax, dword [ebp + 0x80]
mov dword [ebp - 0xc], eax
xor eax, eax
inc eax
cmp dword [0x48aa04], 6
mov word [ebp - 8], ax
sbb eax, eax
and eax, 0xfffffff8
push ebx
add eax, 0x20
push ebx
mov word [ebp - 6], ax
lea eax, [ebp + 0x30]
push eax
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x64]
mov dword [ebp - 0x14], 0x28
mov dword [ebp - 0x10], edi
mov dword [ebp - 4], ebx
mov dword [ebp], ebx
mov dword [ebp + 0xc], ebx
mov dword [ebp + 0x10], ebx
call dword [sym.imp.GDI32.dll_CreateDIBSection]
push ebx
push 1
push 1
push dword [ebp + 0x80]
mov dword [ebp + 0x38], eax
push edi
call dword [sym.imp.GDI32.dll_CreateBitmap]
push dword [ebp + 0x38]
mov dword [ebp + 0x34], eax
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_SelectObject]
push 4
push dword [ebp + 0x74]
mov dword [ebp + 0x18], eax
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov dword [ebp + 0x28], eax
cmp dword [ebp + 0x60], ebx
je 0x440f2e
cmp dword [ebp - 0x47c], ebx
jle 0x441108
mov eax, dword [ebp - 0x478]
cmp eax, ebx
jle 0x441108
mov ecx, dword [ebp - 0x48c]
cmp ecx, ebx
je 0x441108
cmp dword [ebp + 0x30], ebx
je 0x441108
mov edx, dword [ebp - 0x474]
cmp word [edx + 0xe], 0x20
mov dword [ebp + 0x2c], ebx
mov dword [ebp + 0x24], ebx
jne 0x440ba8
cmp eax, 2
jle 0x440ba8
inc eax
imul eax, dword [ebp - 0x47c]
cdq
sub eax, edx
mov dl, byte [ecx + 3]
sar eax, 1
cmp dl, byte [ecx + eax*4 + 3]
je 0x440ba8
mov eax, dword [ebp - 0x478]
imul eax, dword [ebp - 0x47c]
mov dword [ebp + 0x78], eax
mov eax, ecx
add eax, 3
mov dword [ebp + 0x70], eax
mov eax, dword [0x4895e0]
mov ecx, eax
shr ecx, 0x10
movzx edx, al
and ecx, 0xff
shl edx, 0x10
or ecx, edx
and eax, 0xff00
or ecx, eax
cmp dword [ebp + 0x78], ebx
je 0x440ba8
mov eax, dword [ebp + 0x70]
cmp byte [eax], 0xa0
jae 0x440b9d
mov dword [eax - 3], ecx
dec dword [ebp + 0x78]
add eax, 4
cmp dword [ebp + 0x78], ebx
jne 0x440b95
mov eax, dword [ebp + 0x80]
mov ecx, dword [ebp - 0x47c]
mov dword [ebp + 0x68], eax
mov eax, dword [0x487148]
cmp eax, 2
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x48], ebx
jl 0x440be9
mov edx, eax
imul edx, dword [ebp - 0x478]
cmp ecx, edx
jge 0x440be6
imul eax, ecx
cmp eax, dword [ebp - 0x478]
jg 0x440cd1
xor eax, eax
inc eax
cmp eax, ebx
je 0x440cd1
cmp edi, ecx
mov eax, dword [ebp - 0x478]
jle 0x440c08
cmp dword [ebp + 0x80], eax
mov dword [ebp + 0x6c], ecx
jl 0x440c63
jmp 0x440c60
cmp dword [ebp + 0x80], eax
jl 0x440c15
mov dword [ebp + 0x6c], ecx
jmp 0x440c60
mov eax, dword [ebp + 0x80]
shl eax, 0xf
cdq
idiv dword [ebp - 0x478]
mov ecx, eax
mov eax, edi
shl eax, 0xf
cdq
idiv dword [ebp - 0x47c]
cmp eax, ecx
jge 0x440c50
mov eax, dword [ebp - 0x47c]
imul eax, dword [ebp + 0x80]
cdq
idiv dword [ebp - 0x478]
mov dword [ebp + 0x6c], eax
jmp 0x440c63
mov eax, dword [ebp - 0x478]
imul eax, edi
cdq
idiv dword [ebp - 0x47c]
mov dword [ebp + 0x68], eax
mov eax, edi
sub eax, dword [ebp + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 0x48], eax
jns 0x440c85
add dword [ebp - 0x47c], eax
mov ecx, eax
neg ecx
add dword [ebp + 0x6c], eax
mov dword [ebp + 0x2c], ecx
mov dword [ebp + 0x48], ebx
mov eax, dword [ebp + 0x80]
sub eax, dword [ebp + 0x68]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 0x70], eax
jns 0x440cab
add dword [ebp - 0x478], eax
mov ecx, eax
neg ecx
add dword [ebp + 0x68], eax
mov dword [ebp + 0x24], ecx
mov dword [ebp + 0x70], ebx
cmp dword [esi + 0x271c], ebx
jne 0x440e18
mov eax, dword [ebp + 0x80]
push dword [esi + 0x22a4]
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], edi
jmp 0x440e09
cmp edi, ecx
jl 0x440d0d
mov eax, dword [ebp + 0x80]
cmp eax, dword [ebp - 0x478]
jl 0x440d0d
mov eax, edi
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 0x48], eax
mov eax, dword [ebp + 0x80]
mov dword [ebp + 0x6c], ecx
mov ecx, dword [ebp - 0x478]
sub eax, ecx
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 0x68], ecx
mov dword [ebp + 0x70], eax
jmp 0x440cab
mov eax, dword [ebp + 0x80]
shl eax, 0xf
cdq
idiv dword [ebp - 0x478]
mov ecx, eax
mov eax, edi
shl eax, 0xf
cdq
idiv dword [ebp - 0x47c]
cmp eax, ecx
jle 0x440da1
mov eax, dword [ebp - 0x47c]
imul eax, dword [ebp + 0x80]
cdq
idiv dword [ebp - 0x478]
mov dword [ebp + 0x6c], eax
cmp edi, eax
je 0x440e18
mov eax, edi
sub eax, dword [ebp + 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 0x48], eax
cmp dword [esi + 0x271c], ebx
jne 0x440e18
push dword [esi + 0x22a4]
mov dword [ebp + 0x54], eax
mov eax, dword [ebp + 0x80]
mov dword [ebp + 0x58], eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x74]
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], ebx
call fcn.0045711f
mov eax, dword [ebp + 0x54]
mov ecx, dword [ebp + 0x6c]
push dword [esi + 0x22a4]
add eax, ecx
mov dword [ebp + 0x4c], eax
mov dword [ebp + 0x54], edi
jmp 0x440e0c
mov eax, dword [ebp - 0x478]
imul eax, edi
cdq
idiv dword [ebp - 0x47c]
mov dword [ebp + 0x68], eax
mov eax, dword [ebp + 0x80]
cmp eax, dword [ebp + 0x68]
je 0x440e18
sub eax, dword [ebp + 0x68]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 0x70], eax
cmp dword [esi + 0x271c], ebx
jne 0x440e18
push dword [esi + 0x22a4]
mov dword [ebp + 0x58], eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x74]
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], edi
call fcn.0045711f
mov ecx, dword [ebp + 0x68]
mov eax, dword [ebp + 0x58]
push dword [esi + 0x22a4]
add eax, ecx
mov ecx, dword [ebp + 0x80]
mov dword [ebp + 0x50], eax
add eax, ecx
mov dword [ebp + 0x58], eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x74]
call fcn.0045711f
push 0xcc0020
push ebx
push dword [ebp - 0x474]
push dword [ebp - 0x48c]
push dword [ebp - 0x478]
push dword [ebp - 0x47c]
push dword [ebp + 0x24]
push dword [ebp + 0x2c]
push dword [ebp + 0x68]
push dword [ebp + 0x6c]
push dword [ebp + 0x70]
push dword [ebp + 0x48]
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_StretchDIBits]
push dword [ebp + 0x64]
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_ReleaseDC]
push dword [ebp + 0x28]
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
cmp word [ebp - 6], 0x20
jne 0x440ef6
mov ecx, dword [ebp + 0x48]
cmp ecx, ebx
mov eax, dword [ebp + 0x6c]
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x64], ecx
jge 0x440e8e
add eax, ecx
xor ecx, ecx
mov dword [ebp + 0x78], eax
mov dword [ebp + 0x64], ecx
add eax, ecx
cmp eax, edi
jle 0x440e9b
mov eax, edi
sub eax, ecx
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x70]
cmp eax, ebx
mov ecx, dword [ebp + 0x68]
jge 0x440ea9
add ecx, eax
xor eax, eax
lea edx, [eax + ecx]
cmp edx, dword [ebp + 0x80]
jle 0x440ebc
mov ecx, dword [ebp + 0x80]
sub ecx, eax
mov edx, dword [ebp + 0x30]
imul eax, edi
add eax, dword [ebp + 0x64]
cmp ecx, ebx
lea eax, [edx + eax*4 + 3]
mov dword [ebp + 0x28], eax
jle 0x440ef6
mov edx, dword [ebp + 0x28]
mov eax, edi
sub eax, dword [ebp + 0x78]
mov dword [ebp + 0x64], ecx
shl eax, 2
cmp dword [ebp + 0x78], ebx
jle 0x440eef
mov ecx, dword [ebp + 0x78]
mov byte [edx], 0xff
add edx, 4
dec ecx
jne 0x440ee6
add edx, eax
dec dword [ebp + 0x64]
jne 0x440ede
cmp dword [ebp + 0x7c], ebx
je 0x441134
call fcn.0042644c
test eax, eax
je 0x441134
push dword [ebp + 0x30]
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0x3c]
lea eax, [ebp + 0x84]
push eax
push esi
mov dword [ebp + 8], ebx
mov dword [ebp + 4], ebx
call fcn.00440093
jmp 0x441134
cmp dword [0x487140], ebx
je 0x441108
mov eax, dword [ebp + 0x80]
push dword [esi + 0x22a4]
mov dword [ebp + 0x58], eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x74]
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x54], edi
call fcn.0045711f
mov eax, edi
cdq
idiv dword [esi + 0x2280]
mov ecx, eax
mov eax, dword [ebp + 0x80]
cdq
idiv dword [esi + 0x2284]
add ecx, 0x14
imul ecx, eax
add ecx, ecx
mov eax, 0x100
mov dword [ebp + 0x7c], ecx
cmp ecx, eax
jae 0x440f8f
mov ecx, eax
mov dword [ebp + 0x7c], ecx
push ecx
push ebx
push dword [0x48b040]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [ebp + 0x7c]
shr ecx, 1
xor edx, edx
mov dword [ebp + 0x78], eax
mov word [eax + ecx*2 - 0x10], dx
mov eax, dword [ebp + 0x40]
sub dword [ebp + 0x7c], 8
cmp eax, ebx
je 0x441006
cmp dword [ebp - 0x490], ebx
je 0x441006
cmp eax, dword [ebp + 0x7c]
jb 0x440fda
push dword [ebp + 0x7c]
push dword [ebp - 0x490]
push dword [ebp + 0x78]
call fcn.00468fa0
add esp, 0xc
jmp 0x44102c
push eax
push dword [ebp - 0x490]
push dword [ebp + 0x78]
call fcn.00468fa0
mov eax, dword [ebp + 0x40]
mov ecx, dword [ebp + 0x7c]
sub ecx, eax
push ecx
mov ecx, dword [ebp + 0x78]
shr eax, 1
lea eax, [ecx + eax*2]
push ebx
push eax
call fcn.00469850
add esp, 0x18
jmp 0x44102c
mov eax, dword [ebp + 0x6c]
cmp eax, ebx
jne 0x441013
lea eax, [ebp + 0x84]
push ebx
lea ecx, [ebp + 0x7c]
push ecx
lea ecx, [ebp + 0x78]
push ecx
push 0x20
push eax
call dword [sym.imp.PPLIB32W.DLL__LoadFileImage_20]
test eax, eax
je 0x44102c
mov dword [ebp + 0x7c], ebx
mov eax, dword [ebp + 0x7c]
cmp eax, ebx
je 0x4410fe
mov ecx, dword [ebp + 0x78]
shr eax, 1
lea eax, [ecx + eax*2]
mov dword [ebp + 0x64], eax
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x78]
push eax
push ebx
call dword [sym.imp.PPLIB32W.DLL__LoadTextImage_16]
mov eax, dword [ebp + 0x64]
sub eax, dword [ebp + 0x24]
sar eax, 1
mov dword [ebp + 0x2c], eax
cmp eax, dword [0x487140]
jb 0x4410dd
mov eax, dword [ebp + 0x7c]
shr eax, 3
cmp eax, dword [ebp + 0x2c]
jae 0x4410dd
push dword [0x4871f8]
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [esi + 0x229c]
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_SetBkColor]
push dword [esi + 0x227c]
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x4880
mov dword [ebp + 0x28], eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x2c]
push dword [ebp + 0x24]
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp + 0x28]
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp + 0x80]
or dword [ebp + 0x60], 0xffffffff
mov dword [ebp + 0x70], ebx
mov dword [ebp + 0x48], ebx
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], eax
cmp word [ebp - 6], 0x20
jne 0x4410fe
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x30]
add ecx, 3
cmp eax, ebx
je 0x4410fe
mov byte [ecx], 0xdf
add ecx, 4
dec eax
jne 0x4410f5
mov ecx, dword [ebp + 0x78]
call fcn.00424f83
jmp 0x441134
cmp dword [esi + 0x271c], ebx
jne 0x441134
mov eax, dword [ebp + 0x80]
push dword [esi + 0x22a4]
mov dword [ebp + 0x58], eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x74]
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x54], edi
call fcn.0045711f
cmp dword [ebp + 0x40], ebx
je 0x44114e
mov ecx, dword [ebp - 0x490]
cmp ecx, ebx
je 0x44114e
call fcn.00424f83
mov dword [ebp - 0x490], ebx
mov eax, dword [0x487130]
cmp eax, 1
je 0x44116a
cmp eax, 2
jl 0x4412a6
cmp dword [ebp + 0x60], ebx
jne 0x4412a6
mov eax, dword [ebp + 0x1c]
lea ecx, [eax + 0x20]
neg eax
sbb eax, eax
and eax, ecx
mov dword [ebp + 0x64], eax
cmp dword [ebp + 0x60], ebx
jne 0x441233
cmp word [ebp - 6], 0x20
jne 0x4411a5
cmp dword [ebp + 0x30], ebx
je 0x4411a5
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x10]
shl eax, 2
push eax
push ebx
push dword [ebp + 0x30]
call fcn.00469850
add esp, 0xc
push dword [ebp + 0x64]
push 5
push dword [esi + 0x4aa0]
push dword [ebp + 0x5c]
push esi
call fcn.0043f577
mov dword [ebp + 0x44], eax
cmp eax, ebx
jne 0x4411d2
push dword [esi + 0x4aa0]
mov dword [ebp + 0x20], ebx
push esi
call fcn.0043f29f
mov dword [ebp + 0x44], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x44]
call dword [sym.imp.USER32.dll_GetIconInfo]
lea eax, [ebp - 0x44]
push eax
push 0x18
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 0x40]
mov eax, dword [esi + 0x4aa0]
cmp ecx, eax
mov dword [ebp + 0x7c], ecx
jle 0x441201
mov dword [ebp + 0x7c], eax
push dword [ebp - 0x20]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x1c]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, edi
sub eax, dword [ebp + 0x7c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x80]
sub eax, dword [ebp + 0x7c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 0x3c], eax
jmp 0x44128a
cmp edi, 0x60
jle 0x441248
cmp dword [ebp + 0x80], 0x60
mov dword [ebp + 0x7c], 0x20
jg 0x44124f
mov dword [ebp + 0x7c], 0x10
push dword [ebp + 0x64]
mov eax, edi
sub eax, dword [ebp + 0x7c]
push 5
push dword [ebp + 0x7c]
mov dword [ebp + 0x78], eax
mov eax, dword [ebp + 0x80]
push dword [ebp + 0x5c]
sub eax, dword [ebp + 0x7c]
push esi
mov dword [ebp + 0x3c], eax
call fcn.0043f577
mov dword [ebp + 0x44], eax
cmp eax, ebx
jne 0x44128a
push dword [ebp + 0x7c]
mov dword [ebp + 0x20], ebx
push esi
call fcn.0043f29f
mov dword [ebp + 0x44], eax
push 3
push ebx
push ebx
push dword [ebp + 0x7c]
push dword [ebp + 0x7c]
push dword [ebp + 0x44]
push dword [ebp + 0x3c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [ebp + 0x34]
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_SelectObject]
mov eax, dword [ebp + 0x80]
mov dword [ebp + 0x54], edi
mov edi, dword [sym.imp.GDI32.dll_GetStockObject]
push ebx
mov dword [ebp + 0x4c], ebx
mov dword [ebp + 0x50], ebx
mov dword [ebp + 0x58], eax
call edi
push eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x74]
call fcn.0045711f
cmp dword [ebp + 0x44], ebx
je 0x441309
push 1
push ebx
push ebx
push dword [ebp + 0x7c]
push dword [ebp + 0x7c]
push dword [ebp + 0x44]
push dword [ebp + 0x3c]
push dword [ebp + 0x78]
push dword [ebp + 0x74]
call dword [sym.imp.USER32.dll_DrawIconEx]
cmp dword [ebp + 0x20], ebx
je 0x441309
push dword [ebp + 0x44]
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [ebp + 0x60], ebx
je 0x44133f
mov eax, dword [ebp + 0x48]
cmp eax, ebx
jl 0x44133f
mov edx, dword [ebp + 0x6c]
mov ecx, dword [ebp + 0x70]
add edx, eax
mov dword [ebp + 0x4c], eax
mov eax, dword [ebp + 0x68]
mov dword [ebp + 0x50], ecx
add ecx, eax
push 4
mov dword [ebp + 0x54], edx
mov dword [ebp + 0x58], ecx
call edi
push eax
lea eax, [ebp + 0x4c]
push eax
push dword [ebp + 0x74]
call fcn.0045711f
push dword [ebp + 0x18]
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 0x74]
call dword [sym.imp.GDI32.dll_DeleteDC]
lea edi, [esi + 0x64]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [ebp + 0x60], ebx
jne 0x441371
cmp dword [ebp + 0x44], ebx
jne 0x441371
mov eax, dword [ebp + 0x5c]
or dword [eax + 0x1c], 0xffffffff
jmp 0x441389
push dword [ebp + 0x34]
add esi, 0x4a70
push dword [ebp + 0x38]
push esi
call fcn.0043e19f
mov ecx, dword [ebp + 0x5c]
mov dword [ecx + 0x1c], eax
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push dword [ebp + 0x34]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [ebp + 0x38]
call esi
cmp dword [ebp + 0x60], ebx
jle 0x4413b2
lea eax, [ebp - 0x490]
push eax
call dword [sym.imp.PPLIB32W.DLL__FreeBMP_4]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x73c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0046890b
add ebp, 0x740
leave
ret 0xc