Function at 0x407cf0
Capabilities:
Create thread
Get common file path
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x42b081
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x3204
call fcn.00417020
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x3200], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x3218]
mov dword fs:[0], eax
mov eax, ecx
mov dword [esp + 0x1c], eax
push dword [eax + 0x434]
mov edi, dword [eax + 0x1494]
push dword [eax + 0x420]
mov dword [esp + 0x1e4], str.list_values_
mov dword [esp + 0x1e8], str.list_nameS_
mov dword [esp + 0x1ec], str.list_nameT_
mov dword [esp + 0x1f0], str.list_url_
mov dword [esp + 0x1f4], str.list_type_
mov dword [esp + 0x1f8], str.list_x_
mov dword [esp + 0x1fc], str.list_y_
mov dword [esp + 0x200], str.list_pg_
mov dword [esp + 0x204], str.list_mimelist_
mov dword [esp + 0x208], str.list_logo_
mov dword [esp + 0x20c], str.list_sleep_
mov dword [esp + 0x210], str.list_desc_
mov byte [esp + 0x33], 0
call dword [sym.imp.GDI32.dll_SelectObject]
lea esp, [esp]
push 0x1558
call fcn.00413332
add esp, 4
mov dword [esp + 0x18], eax
push 0x1558
push 0
push eax
call fcn.004164f0
lea esi, [esp + 0x1e8]
add esp, 0xc
xor ebx, ebx
mov dword [esp + 0x24], esi
mov edi, edi
push 0x400
lea eax, [esp + 0x210]
add eax, ebx
push 0
push eax
call fcn.004164f0
mov esi, dword [esi]
add esp, 0xc
push esi
push edi
call fcn.004133c0
mov edi, eax
add esp, 8
test edi, edi
je 0x4089de
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x407e42
sub esi, ecx
add edi, esi
push 0x4346e4
push edi
call fcn.004133c0
mov edx, eax
add esp, 8
mov dword [esp + 0x10], edx
test edx, edx
jne 0x407f2c
test edi, edi
je 0x407f0f
mov esi, edi
mov dword [esp + 0x10], edi
lea ecx, [esi + 1]
lea ebx, [ebx]
mov al, byte [esi]
inc esi
test al, al
jne 0x407e80
sub esi, ecx
cmp esi, 0x3ff
jg 0x407eb0
push esi
lea eax, [esp + 0x210]
add eax, ebx
push edi
push eax
call fcn.004171f0
lea eax, [ebx + esi]
add esp, 0xc
mov byte [esp + eax + 0x20c], 0
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
add ebx, 0x400
add esi, 4
mov dword [esp + 0x24], esi
cmp ebx, 0x3000
jl 0x407e10
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x120c]
push eax
mov byte [edi + 0x1424], 1
call fcn.0041386b
mov byte [edi + 0x1425], al
add esp, 4
mov byte [edi + 0x142d], al
mov al, byte [edi + 0x1425]
cmp al, 3
je 0x407f6f
cmp al, 4
jne 0x407f6d
mov byte [edi + 0x1425], 2
jmp 0x407f76
push 0x434314
push 0
call fcn.004133c0
mov edx, eax
mov dword [esp + 0x18], eax
add esp, 8
test edx, edx
je 0x4089de
mov esi, edx
sub esi, edi
cmp esi, 0x3ff
jg 0x407eb0
push esi
lea eax, [esp + 0x210]
add eax, ebx
push edi
push eax
call fcn.004171f0
add esp, 0xc
lea eax, [ebx + esi]
mov byte [esp + eax + 0x20c], 0
push edi
call dword [sym.imp.USER32.dll_CharNextA]
mov edi, eax
mov dword [esp + 0x10], edi
jmp 0x407eb4
jbe 0x407f76
mov byte [edi + 0x1425], 1
cmp byte [esp + 0x60c], 9
lea ecx, [esp + 0x60c]
jne 0x407f8d
inc ecx
cmp byte [ecx], 9
je 0x407f87
lea edx, [esp + 0x60c]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [ecx + edx - 1], al
test al, al
jne 0x407f96
lea ecx, [esp + 0x60c]
lea edx, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407fb0
sub ecx, edx
lea eax, [ecx - 1]
cmp byte [esp + eax + 0x60c], 9
jne 0x407fd5
test eax, eax
js 0x407fd5
dec eax
cmp byte [esp + eax + 0x60c], 9
je 0x407fc6
lea ecx, [esp + 0x60c]
mov byte [esp + eax + 0x60d], 0
push ecx
lea eax, [edi + 0x400]
push 0x400
push eax
call fcn.00412f97
add esp, 0xc
lea eax, [esp + 0xa0c]
lea ebx, [edi + 0x800]
push eax
push 0x400
push ebx
call fcn.00412f97
add esp, 0xc
lea eax, [esp + 0xe0c]
push eax
push 0x400
push edi
call fcn.00412f97
add esp, 0xc
lea ecx, [esp + 0x2e0c]
lea eax, [edi + 0x1444]
push 0x7f
push ecx
push 0x80
push eax
call fcn.00412fec
add esp, 0x10
mov ecx, 0x4344f0
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x408070
test dl, dl
je 0x40806c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x408070
add eax, 2
add ecx, 2
test dl, dl
jne 0x408050
xor eax, eax
jmp 0x408075
sbb eax, eax
or eax, 1
test eax, eax
jne 0x408088
push edi
push eax
push 0x407cd0
call fcn.0041434b
add esp, 0xc
mov esi, ebx
lea ecx, [esi + 1]
lea ecx, [ecx]
mov al, byte [esi]
inc esi
test al, al
jne 0x408090
lea eax, [esp + 0x160c]
sub esi, ecx
push eax
mov dword [edi + 0x1400], esi
call fcn.0041386b
add esp, 4
mov edi, eax
lea eax, [esp + 0x1a0c]
push eax
call fcn.0041386b
add esp, 4
mov dword [esp + 0x5c], 0
mov ebx, eax
mov dword [esp + 0x60], 0
mov eax, dword [esp + 0x1c]
push dword [eax + 0x430]
push dword [eax + 0x420]
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x5c]
push eax
mov eax, dword [esp + 0x1c]
push esi
add eax, 0x800
push eax
mov eax, dword [esp + 0x28]
push dword [eax + 0x420]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [esp + 0x18]
lea esi, [ebx + 0x10]
push esi
lea eax, [edi + 0x14]
add ecx, 0x1404
push eax
push ebx
push edi
push ecx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esp + 0x18]
cmp byte [eax + 0x142d], 3
jne 0x408155
mov eax, dword [esp + 0x5c]
push esi
add eax, 0x14
add eax, edi
push eax
push ebx
mov ebx, dword [esp + 0x24]
push edi
lea eax, [ebx + 0x1414]
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov edi, dword [esp + 0x1c]
jmp 0x4081c6
mov ebx, dword [esp + 0x18]
lea edi, [ebx + 0x1444]
mov esi, edi
lea ecx, [esi + 1]
mov al, byte [esi]
inc esi
test al, al
jne 0x408164
mov eax, dword [esp + 0x1c]
sub esi, ecx
push dword [eax + 0x428]
push dword [eax + 0x420]
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x5c]
push eax
push esi
push edi
mov edi, dword [esp + 0x28]
push dword [edi + 0x420]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov ecx, dword [ebx + 0x1408]
mov edx, dword [ebx + 0x1404]
lea eax, [ecx + 0x10]
push eax
mov eax, dword [esp + 0x60]
add eax, edx
push eax
lea eax, [ecx - 0x22]
push eax
lea eax, [edx - 0x32]
push eax
lea eax, [ebx + 0x1414]
push eax
call dword [sym.imp.USER32.dll_SetRect]
lea eax, [esp + 0x1e0c]
push eax
call fcn.0041386b
add esp, 4
mov byte [ebx + 0x142c], al
lea ecx, [esp + 0x220c]
lea eax, [ebx + 0xc00]
push ecx
push 0x400
push eax
call fcn.00412f97
add esp, 0xc
cmp byte [esp + 0x2a0c], 0
jne 0x40820e
mov dword [ebx + 0x1554], 0
jmp 0x40822a
lea eax, [esp + 0x2a0c]
push eax
call fcn.0041386b
add esp, 4
imul eax, eax, 0x3e8
mov dword [ebx + 0x1554], eax
push dword [edi + 0x424]
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push 0x30
push 0x30
mov dword [ebx + 0x1544], eax
push dword [edi + 0x424]
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov esi, eax
push esi
push dword [ebx + 0x1544]
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [0x48b1f8]
movdqa xmm0, xmmword [0x434f40]
lea eax, [esp + 0x1d0]
push eax
movdqu xmmword [esp + 0x1d4], xmm0
push dword [ebx + 0x1544]
call dword [sym.imp.USER32.dll_FillRect]
cmp byte [esp + 0x260c], 0
jne 0x4083a3
mov ecx, dword [edi + 0x618]
lea esi, [edi + 0x614]
lea eax, [esp + 0x18]
cmp eax, ecx
jae 0x408335
mov ebx, dword [esi]
cmp ebx, eax
ja 0x408335
mov edx, dword [esi + 8]
lea edi, [esp + 0x18]
sub edi, ebx
sar edi, 2
cmp ecx, edx
jne 0x40831a
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x40831a
sub ecx, ebx
mov eax, 0x3fffffff
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x408607
inc ecx
sub edx, ebx
sar edx, 2
mov eax, 0x3fffffff
mov dword [esp + 0x20], ecx
mov ecx, edx
shr ecx, 1
sub eax, ecx
cmp eax, edx
jae 0x408307
xor edx, edx
jmp 0x408309
add edx, ecx
cmp edx, dword [esp + 0x20]
mov ecx, esi
cmovb edx, dword [esp + 0x20]
push edx
call fcn.0040dae0
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x408328
mov eax, dword [esi]
mov eax, dword [eax + edi*4]
mov dword [ecx], eax
add dword [esi + 4], 4
mov edi, dword [esp + 0x10]
jmp 0x407de0
mov edx, dword [esi + 8]
cmp ecx, edx
jne 0x408389
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x408389
mov edi, dword [esi]
mov eax, 0x3fffffff
sub ecx, edi
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x408607
sub edx, edi
lea ebx, [ecx + 1]
sar edx, 2
mov eax, 0x3fffffff
mov ecx, edx
shr ecx, 1
sub eax, ecx
cmp eax, edx
jae 0x40837a
xor edx, edx
jmp 0x40837c
add edx, ecx
cmp edx, ebx
mov ecx, esi
cmovb edx, ebx
push edx
call fcn.0040dae0
mov eax, dword [esi + 4]
test eax, eax
je 0x408396
mov ecx, dword [esp + 0x18]
mov dword [eax], ecx
add dword [esi + 4], 4
mov edi, dword [esp + 0x10]
jmp 0x407de0
lea ecx, [esp + 0x260c]
push ecx
lea eax, [ebx + 0x1000]
push 0x400
push eax
call fcn.00412f97
add esp, 0xc
cmp byte [esp + 0x2b], 0
jne 0x408576
mov esi, dword [0x489034]
push 0x340
mov byte [esp + 0x2f], 1
call fcn.00413332
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x408401
mov dword [ebx], 0
mov dword [ebx + 4], 0xffffffff
mov dword [ebx + 0x134], 0xffffffff
jmp 0x408403
xor ebx, ebx
cmp dword [ebx], 0
jne 0x408475
cmp dword [ebx + 4], 0xffffffff
jne 0x408475
lea edi, [ebx + 0x138]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x408423
mov eax, dword [0x4344e8]
push 0x1c
mov dword [edi], eax
mov dword [esp + 0x68], 0
call fcn.00413332
add esp, 4
mov ecx, eax
mov word [eax], 0x100
mov dword [eax + 0x10], 0x439374
mov dword [eax + 0x14], esi
mov dword [eax + 0x18], 0
mov dword [eax + 0xc], 0
call fcn.00411420
mov dword [ebx], eax
mov eax, dword [0x48b1ec]
jmp 0x40847a
mov eax, 0x1000000
mov dword [0x48b1e8], eax
test eax, eax
je 0x408490
push ebx
call fcn.00412a42
add esp, 4
xor esi, esi
jmp 0x4084a5
push 8
call fcn.00413332
mov esi, eax
add esp, 4
mov dword [esi], 1
mov dword [esi + 4], ebx
test esi, esi
je 0x4089bc
mov ebx, dword [esp + 0x1c]
xor edi, edi
add ebx, 0x838
lea esp, [esp]
cmp dword [esi], 1
jne 0x408560
mov ecx, dword [esi + 4]
lea eax, [esp + 0x9c]
push eax
push edi
call fcn.00412180
mov dword [0x48b1e8], eax
test eax, eax
jne 0x40856a
push 0x104
call fcn.004133a8
add esp, 4
mov dword [ebx - 0x200], eax
lea ecx, [esp + 0xa0]
push ecx
push 0x104
push eax
call fcn.00412f97
add esp, 0xc
push dword [esp + 0x1c4]
call fcn.004133a8
mov ecx, dword [esp + 0x1c8]
add esp, 4
mov dword [ebx], eax
mov dword [ebx + 0x200], ecx
cmp dword [esi], 1
je 0x408546
inc edi
mov dword [0x48b1e8], 0x80000
add ebx, 4
jmp 0x4084c0
push ecx
push ecx
mov ecx, dword [esi + 4]
push eax
push edi
call fcn.00412850
inc edi
mov dword [0x48b1e8], eax
add ebx, 4
jmp 0x4084c0
mov dword [0x48b1e8], 0x80000
mov ebx, dword [esp + 0x1c]
mov dword [ebx + 0xc38], edi
jmp 0x40857a
mov ebx, dword [esp + 0x1c]
xor edi, edi
cmp dword [ebx + 0xc38], edi
jle 0x4085b7
lea esi, [ebx + 0x638]
lea ebx, [ebx]
mov eax, dword [esi]
test eax, eax
je 0x4085ab
push eax
lea eax, [esp + 0x2610]
push eax
call fcn.00412ebb
add esp, 8
test eax, eax
je 0x408611
inc edi
add esi, 4
cmp edi, dword [ebx + 0xc38]
jl 0x408590
mov ecx, dword [ebx + 0x618]
lea esi, [ebx + 0x614]
lea eax, [esp + 0x18]
cmp eax, ecx
jae 0x4085d5
mov ebx, dword [esi]
cmp ebx, eax
jbe 0x4082b9
mov edx, dword [esi + 8]
cmp ecx, edx
jne 0x408389
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x408389
mov edi, dword [esi]
mov eax, 0x3fffffff
sub ecx, edi
sar ecx, 2
sub eax, ecx
cmp eax, 1
jae 0x40835f
push str.vector_T__too_long
call fcn.0042919e
mov eax, dword [0x48b238]
xorps xmm0, xmm0
mov dword [esp + 0x68], 0x434008
mov dword [esp + 0x7c], 0
mov dword [esp + 0x80], 0
mov word [esp + 0x84], 0
mov dword [esp + 0x88], 0xffffffff
mov dword [esp + 0x8c], 0xffffffff
mov dword [esp + 0x90], 0
mov dword [esp + 0x94], 0
mov dword [esp + 0x98], 0
movdqu xmmword [esp + 0x6c], xmm0
test al, 1
jne 0x4086da
push 0
or eax, 1
mov dword [0x48b214], 0
push 0x48b218
mov dword [0x48b238], eax
mov dword [0x48b230], 0
mov dword [0x48b234], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x4086cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x4086c8
movzx eax, ax
or eax, 0x80070000
mov dword [0x48b234], eax
push 0x42b170
call fcn.00412de5
add esp, 4
push 0x48b218
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [0x48b230]
push 0x48b218
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [esp + 0x14]
mov dword [esp + 0x3220], 0
push eax
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ecx, dword [esp + 0x14]
test ecx, ecx
je 0x4089d5
mov eax, dword [ecx]
push 0
push 0
push 0
push 0
push ecx
call dword [eax + 0x14]
mov eax, dword [esp + 0x14]
push 0
push dword [ebx + edi*4 + 0xa38]
push dword [ebx + edi*4 + 0x838]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov eax, dword [0x48b238]
mov esi, dword [esp + 0x14]
test al, 1
jne 0x4087ac
push 0
or eax, 1
mov dword [0x48b214], 0
push 0x48b218
mov dword [0x48b238], eax
mov dword [0x48b230], 0
mov dword [0x48b234], 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x40879f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x40879a
movzx eax, ax
or eax, 0x80070000
mov dword [0x48b234], eax
push 0x42b170
call fcn.00412de5
add esp, 4
cmp dword [0x48b234], 0
jne 0x4089cb
push 0x48b218
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x48b214], 0
mov bl, 1
jne 0x40880e
lea eax, [esp + 0x34]
mov dword [esp + 0x4c], 1
push eax
lea eax, [esp + 0x50]
mov dword [esp + 0x54], 0
push eax
push 0x48b214
mov dword [esp + 0x60], 0
mov dword [esp + 0x64], 0
call dword [sym.imp.gdiplus.dll_GdiplusStartup]
xor ecx, ecx
movzx ebx, bl
test eax, eax
cmovne ebx, ecx
push 0x48b218
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test bl, bl
je 0x4089cb
lea eax, [esp + 0x24]
mov dword [esp + 0x3c], 0x434010
push eax
push esi
mov dword [esp + 0x2c], 0
call dword [sym.imp.gdiplus.dll_GdipCreateBitmapFromStream]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x40], ecx
mov dword [esp + 0x44], 0
test eax, eax
jne 0x4089c4
lea eax, [esp + 0x3c]
push eax
lea ecx, [esp + 0x6c]
call fcn.00401620
push dword [esp + 0x40]
mov esi, eax
mov dword [esp + 0x40], 0x43401c
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
test esi, esi
jne 0x4089cb
mov ecx, dword [esp + 0x78]
mov eax, dword [esp + 0x74]
mov edi, dword [esp + 0x18]
push ecx
push eax
sub esp, 8
push ecx
push eax
push esi
push esi
push dword [edi + 0x1544]
lea ecx, [esp + 0x8c]
call fcn.00406460
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov esi, dword [esp + 0x1c]
lea eax, [esp + 0x18]
add esi, 0x614
mov ecx, dword [esi + 4]
cmp eax, ecx
jae 0x40893a
mov ebx, dword [esi]
cmp ebx, eax
ja 0x40893a
mov edx, dword [esi + 8]
mov edi, eax
sub edi, ebx
sar edi, 2
cmp ecx, edx
jne 0x40892a
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x40892a
sub ecx, ebx
mov eax, 0x3fffffff
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x408607
inc ecx
sub edx, ebx
sar edx, 2
mov eax, 0x3fffffff
mov dword [esp + 0x20], ecx
mov ecx, edx
shr ecx, 1
sub eax, ecx
cmp eax, edx
jae 0x408917
xor edx, edx
jmp 0x408919
add edx, ecx
cmp edx, dword [esp + 0x20]
mov ecx, esi
cmovb edx, dword [esp + 0x20]
push edx
call fcn.0040dae0
mov ecx, dword [esi + 4]
mov eax, dword [esi]
test ecx, ecx
je 0x40899b
mov eax, dword [eax + edi*4]
mov dword [ecx], eax
jmp 0x40899b
mov edx, dword [esi + 8]
cmp ecx, edx
jne 0x408992
mov eax, edx
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x408992
mov edi, dword [esi]
mov eax, 0x3fffffff
sub ecx, edi
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x408607
sub edx, edi
lea ebx, [ecx + 1]
sar edx, 2
mov eax, 0x3fffffff
mov ecx, edx
shr ecx, 1
sub eax, ecx
cmp eax, edx
jae 0x40897f
xor edx, edx
jmp 0x408981
add edx, ecx
cmp edx, ebx
mov ecx, esi
cmovb edx, ebx
push edx
call fcn.0040dae0
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 4]
test eax, eax
je 0x40899b
mov dword [eax], edi
add dword [esi + 4], 4
lea ecx, [esp + 0x68]
mov dword [esp + 0x3220], 0xffffffff
call fcn.004013a0
mov edi, dword [esp + 0x10]
jmp 0x407de0
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push ecx
call dword [sym.imp.gdiplus.dll_GdipDisposeImage]
mov eax, dword [esp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea ecx, [esp + 0x68]
call fcn.004013a0
mov edx, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x30], eax
mov dword [esp + 0x44], eax
mov byte [edx + 0x60f], 1
mov dword [esp + 0x3220], 1
xor ecx, ecx
mov dword [esp + 0x4c], eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x54], ecx
mov byte [esp + 0x3220], 2
xor ebx, ebx
mov esi, dword [edx + 0x614]
xor edi, edi
mov dword [esp + 0x40], ebx
mov dword [esp + 0x50], edi
cmp esi, dword [edx + 0x618]
je 0x408ecf
lea eax, [esi + 4]
mov dword [esp + 0x10], eax
mov edx, dword [esi]
mov dword [esp + 0x14], edx
mov dword [esp + 0x2c], edx
test edx, edx
je 0x408eb6
movzx eax, byte [edx + 0x142c]
mov dword [esp + 0x34], eax
cmp eax, 7
mov eax, dword [esp + 0x10]
jg 0x408d08
mov eax, dword [esp + 0x34]
cmp eax, 7
je 0x408cf2
test eax, eax
je 0x408bae
dec eax
cmp eax, 2
ja 0x408da0
lea eax, [esp + 0x2c]
cmp eax, edi
jae 0x408b31
cmp dword [esp + 0x4c], eax
ja 0x408b31
mov edx, dword [esp + 0x4c]
sub eax, edx
sar eax, 2
mov dword [esp + 0x14], eax
cmp edi, ecx
jne 0x408b10
mov eax, ecx
sub eax, edi
sar eax, 2
cmp eax, 1
jae 0x408b0c
sub edi, edx
mov eax, 0x3fffffff
sar edi, 2
sub eax, edi
cmp eax, 1
jb 0x408607
sub ecx, edx
mov eax, 0x3fffffff
sar ecx, 2
inc edi
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x408aeb
xor ecx, ecx
jmp 0x408aed
add ecx, edx
cmp ecx, edi
cmovb ecx, edi
push ecx
lea ecx, [esp + 0x50]
call fcn.0040dae0
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
test edi, edi
je 0x408b9a
mov eax, dword [edx + eax*4]
add esi, 4
mov dword [edi], eax
add edi, 4
add dword [esp + 0x10], 4
mov dword [esp + 0x50], edi
jmp 0x408eb6
cmp edi, ecx
jne 0x408b94
mov eax, ecx
sub eax, edi
sar eax, 2
cmp eax, 1
jae 0x408b94
mov edx, dword [esp + 0x4c]
mov eax, 0x3fffffff
sub edi, edx
sar edi, 2
sub eax, edi
cmp eax, 1
jb 0x408607
sub ecx, edx
mov eax, 0x3fffffff
sar ecx, 2
inc edi
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x408b73
xor ecx, ecx
jmp 0x408b75
add ecx, edx
cmp ecx, edi
cmovb ecx, edi
push ecx
lea ecx, [esp + 0x50]
call fcn.0040dae0
mov eax, dword [esp + 0x54]
mov edi, dword [esp + 0x50]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x24], eax
test edi, edi
je 0x408b9a
mov dword [edi], edx
add edi, 4
add esi, 4
add dword [esp + 0x10], 4
mov dword [esp + 0x50], edi
jmp 0x408eb6
lea eax, [edx + 0x1404]
push eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov eax, dword [esp + 0x14]
add eax, 0x1414
push eax
call dword [sym.imp.USER32.dll_SetRectEmpty]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x2c]
mov edx, dword [esp + 0x3c]
mov byte [eax + 0x1424], 0
cmp ecx, ebx
jae 0x408c79
cmp edx, ecx
ja 0x408c79
mov eax, ecx
mov ecx, dword [esp + 0x30]
sub eax, edx
sar eax, 2
mov dword [esp + 0x14], eax
cmp ebx, ecx
jne 0x408c60
mov eax, ecx
sub eax, ebx
sar eax, 2
cmp eax, 1
jae 0x408c5c
sub ebx, edx
mov eax, 0x3fffffff
sar ebx, 2
sub eax, ebx
cmp eax, 1
jb 0x408607
sub ecx, edx
mov eax, 0x3fffffff
sar ecx, 2
inc ebx
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x408c3b
xor ecx, ecx
jmp 0x408c3d
add ecx, edx
cmp ecx, ebx
cmovb ecx, ebx
push ecx
lea ecx, [esp + 0x40]
call fcn.0040dae0
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
test ebx, ebx
je 0x408ce2
mov eax, dword [edx + eax*4]
mov dword [ebx], eax
add ebx, 4
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x40], ebx
jmp 0x408e91
mov ecx, dword [esp + 0x30]
cmp ebx, ecx
jne 0x408cdc
mov eax, ecx
sub eax, ebx
sar eax, 2
cmp eax, 1
jae 0x408cd8
sub ebx, edx
mov eax, 0x3fffffff
sar ebx, 2
sub eax, ebx
cmp eax, 1
jb 0x408607
sub ecx, edx
mov eax, 0x3fffffff
sar ecx, 2
inc ebx
mov edx, ecx
shr edx, 1
sub eax, edx
cmp eax, ecx
jae 0x408cbb
xor ecx, ecx
jmp 0x408cbd
add ecx, edx
cmp ecx, ebx
cmovb ecx, ebx
push ecx
lea ecx, [esp + 0x40]
call fcn.0040dae0
mov eax, dword [esp + 0x44]
mov ebx, dword [esp + 0x40]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x14]
test ebx, ebx
je 0x408ce2
mov dword [ebx], eax
mov eax, dword [esp + 0x1c]
add ebx, 4
mov dword [esp + 0x40], ebx
jmp 0x408e91
mov eax, dword [esp + 0x1c]
mov byte [edx + 0x1424], 0
mov dword [eax + 0x62c], edx
jmp 0x408e91
mov ecx, dword [esp + 0x34]
cmp ecx, 8
je 0x408e80
cmp ecx, 0xff
jne 0x408da4
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
add edx, 0x620
mov dword [esp + 0x20], edx
mov ecx, dword [edx + 4]
cmp eax, ecx
jae 0x408dfb
cmp dword [edx], eax
ja 0x408dfb
sub eax, dword [edx]
sar eax, 2
mov dword [esp + 0x5c], eax
mov eax, dword [edx + 8]
mov dword [esp + 0x34], eax
cmp ecx, eax
jne 0x408dcc
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x408dcc
sub ecx, dword [edx]
mov eax, 0x3fffffff
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x408607
inc ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x34]
sub ecx, dword [edx]
sar ecx, 2
mov eax, ecx
shr eax, 1
mov dword [esp + 0x34], eax
mov eax, 0x3fffffff
sub eax, dword [esp + 0x34]
cmp eax, ecx
jae 0x408db3
xor ecx, ecx
jmp 0x408db7
mov eax, dword [esp + 0x10]
add esi, 4
add eax, 4
mov dword [esp + 0x10], eax
jmp 0x408eb6
add ecx, dword [esp + 0x34]
cmp ecx, dword [esp + 0x14]
cmovb ecx, dword [esp + 0x14]
push ecx
mov ecx, edx
call fcn.0040dae0
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
mov dword [esp + 0x20], eax
test eax, eax
je 0x408e72
mov eax, dword [edx]
add esi, 4
mov ecx, dword [esp + 0x5c]
mov eax, dword [eax + ecx*4]
mov ecx, dword [esp + 0x20]
mov dword [ecx], eax
add dword [edx + 4], 4
add dword [esp + 0x10], 4
jmp 0x408eb6
mov eax, dword [edx + 8]
mov dword [esp + 0x5c], eax
cmp ecx, eax
jne 0x408e65
sub eax, ecx
sar eax, 2
cmp eax, 1
jae 0x408e65
sub ecx, dword [edx]
mov eax, 0x3fffffff
sar ecx, 2
sub eax, ecx
cmp eax, 1
jb 0x408607
inc ecx
mov dword [esp + 0x64], ecx
mov ecx, dword [esp + 0x5c]
sub ecx, dword [edx]
sar ecx, 2
mov eax, ecx
shr eax, 1
mov dword [esp + 0x34], eax
mov eax, 0x3fffffff
sub eax, dword [esp + 0x34]
cmp eax, ecx
jae 0x408e4c
xor ecx, ecx
jmp 0x408e50
add ecx, dword [esp + 0x34]
cmp ecx, dword [esp + 0x64]
cmovb ecx, dword [esp + 0x64]
push ecx
mov ecx, edx
call fcn.0040dae0
mov edx, dword [esp + 0x20]
mov eax, dword [edx + 4]
test eax, eax
je 0x408e72
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
add dword [edx + 4], 4
add esi, 4
add dword [esp + 0x10], 4
jmp 0x408eb6
mov eax, dword [esp + 0x1c]
mov byte [edx + 0x1424], 0
mov dword [eax + 0x630], edx
mov eax, dword [eax + 0x618]
mov ecx, dword [esp + 0x10]
sub eax, ecx
and eax, 0xfffffffc
push eax
push ecx
push esi
call fcn.00414fd0
mov eax, dword [esp + 0x28]
add esp, 0xc
add dword [eax + 0x618], 0xfffffffc
mov ecx, dword [esp + 0x1c]
cmp esi, dword [ecx + 0x618]
je 0x408ecb
mov ecx, dword [esp + 0x24]
jmp 0x408a41
mov eax, dword [esp + 0x4c]
mov esi, dword [esp + 0x3c]
sub ebx, esi
sar ebx, 2
test ebx, ebx
je 0x408fc9
sub edi, eax
mov dword [esp + 0x24], 0
sar edi, 2
xor ecx, ecx
mov dword [esp + 0x30], ecx
test edi, edi
je 0x408fc9
cmp edi, ecx
jbe 0x40900b
mov esi, dword [eax + ecx*4]
test esi, esi
je 0x408fb8
cmp byte [esi + 0x142c], 3
ja 0x408fb8
lea eax, [esi + 0xc00]
push eax
call fcn.0040c3f0
test al, al
je 0x408fb0
mov edx, dword [esp + 0x24]
cmp edx, ebx
jae 0x408fc5
cmp ebx, edx
jbe 0x40900b
mov eax, dword [esp + 0x3c]
mov ecx, dword [eax + edx*4]
mov dword [esp + 0x20], ecx
test ecx, ecx
je 0x408fab
mov al, byte [esi + 0x142c]
mov byte [ecx + 0x142c], al
mov al, byte [esi + 0x1424]
mov byte [ecx + 0x1424], al
lea eax, [esi + 0x1404]
push eax
lea eax, [ecx + 0x1404]
push eax
call dword [sym.imp.USER32.dll_CopyRect]
lea eax, [esi + 0x1414]
push eax
mov eax, dword [esp + 0x24]
add eax, 0x1414
push eax
call dword [sym.imp.USER32.dll_CopyRect]
push 0x1558
push dword [esp + 0x24]
push esi
call fcn.004171f0
mov edx, dword [esp + 0x30]
add esp, 0xc
inc edx
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
inc ecx
mov dword [esp + 0x30], ecx
cmp edi, ecx
ja 0x408f03
mov esi, dword [esp + 0x3c]
mov eax, dword [esp + 0x4c]
test eax, eax
je 0x408fda
push eax
call fcn.00412a42
add esp, 4
test esi, esi
je 0x408fe7
push esi
call fcn.00412a42
add esp, 4
mov ecx, dword [esp + 0x3218]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x3200]
xor ecx, esp
call fcn.00412a47
mov esp, ebp
pop ebp
ret
push str.invalid_vector_T__subscript
call fcn.004291cc
int3