Function at 0x43497b
Capabilities:
Get keyboard layout
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2a0
and dword [esp + 0x48], 0
push esi
push edi
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0xf0]
push 2
mov dword [esp + 0x50], edx
call fcn.0041796c
xor eax, eax
mov dword [esp + 0xc], 0x9bdba76a
mov dword [esp + 0x10], eax
jmp 0x4349ca
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xf0]
mov dword [ecx + edx*4], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x4349b4
xor esi, esi
mov dword [esp + 0xc], eax
inc esi
jmp 0x434a69
mov dword [esp + 0x10], eax
jmp 0x4349f6
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x244], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x4349e3
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xf0]
push 0
cmp dword [edx + esi*4], ecx
pop ecx
sete cl
mov dword [esp + 0x248], ecx
mov esi, dword [esp + 0xc]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xf0]
push 0
mov ecx, dword [edx + ecx*4]
cmp ecx, dword [edx + esi*4]
pop ecx
setl cl
cmp ecx, dword [esp + 0x20]
je 0x434aab
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x434a62
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
xor eax, eax
xor esi, esi
inc esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x4349dd
lea ecx, [esp + 0xf0]
call fcn.00417a3e
mov dword [esp + 0x18], 0xfffffffc
xor eax, eax
mov dword [esp + 0x14], 0x65786371
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], 5
mov dword [esp + 0x1c], 4
mov dword [esp + 0x10], eax
jmp 0x434af1
xor esi, esi
inc esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], eax
jmp 0x434ad8
mov dword [esp + 0x20], 0x7f451d52
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
cmp edx, ecx
push 0
pop ecx
setle cl
mov dword [esp + 0x20], ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x10
jne 0x434ab8
jmp 0x434a65
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x34], 0xc3099cf
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x434ae1
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x434b15
push 0x1690
push eax
push eax
push 0x3d3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x434b3d
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], 3
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
jmp 0x434b3f
mov esi, eax
xor ecx, ecx
cmp esi, 0xe7ad53a3
push 0
setne cl
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
cmp ecx, edx
mov edi, dword [esp + 0x1c]
pop ecx
setne cl
mov dword [esp + 0x34], edi
sub ecx, 0x711db608
neg ecx
push 0
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x24], ecx
setge dl
xor ecx, ecx
cmp edx, 0x95f7
setle cl
cmp edi, ecx
jg 0x434c37
mov dword [esp + 0x28], 0x9b95520
xor edx, edx
mov dword [esp + 0x18], 0x4b13b106
mov dword [esp + 0x24], 7
mov dword [esp + 0x14], 4
dec dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
imul ecx, dword [esp + 0x28]
cmp ecx, 8
mov ecx, dword [esp + 0x28]
setge dl
mov dword [esp + 0x18], edx
xor edx, edx
cmp ecx, dword [esp + 0x18]
setge dl
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
cmp ecx, edx
mov ecx, dword [esp + 0x24]
pop edx
setge dl
sub edx, ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
xor edx, edx
cmp dword [esp + 0x20], ecx
setg dl
cmp dword [esp + 0x34], edx
jl 0x434c29
cmp dword [esp + 0x14], eax
je 0x434c29
xor edi, edi
inc edi
mov ecx, edi
jmp 0x434c2e
xor edi, edi
mov ecx, eax
inc edi
mov dword [esp + 0x10], ecx
jmp 0x434ce5
mov dword [esp + 0x10], 0xbbb30732
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
pop ecx
setl cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x20], ecx
sete dl
neg edx
mov dword [esp + 0x34], edx
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
mov ecx, dword [esp + 0x10]
sete dl
mov dword [esp + 0x20], edx
xor edx, edx
cmp dword [esp + 0x20], ecx
setle dl
xor edi, edi
mov dword [esp + 0x1c], edx
inc edi
mov ecx, dword [esp + 0xc]
xor edx, edx
cmp ecx, edi
setge dl
mov dword [esp + 0xc], edx
mov dword [esp + 0xc], 0x19
jmp 0x434cde
mov dword [esp + 0x18], eax
jmp 0x434cd4
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x34], 6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x434cc4
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffffb
jl 0x434cbe
mov ecx, dword [0xa6f0e8]
test cl, 1
jne 0x434d6f
push eax
or ecx, edi
mov dword [0xa6f0f0], eax
push eax
mov dword [0xa6f0e8], ecx
mov dword [0xa6f0f4], eax
call fcn.00418f8f
mov ecx, eax
mov dword [0xa6f10c], 0x3f800000
mov dword [0xa6f0f0], ecx
xor eax, eax
mov dword [esp + 0xa8], ecx
lea ecx, [esp + 0xa8]
push ecx
push 0x10
push eax
mov dword [0xa6f0f8], eax
mov ecx, 0xa6f0f8
mov dword [0xa6f100], eax
mov dword [0xa6f0fc], eax
lea eax, [esp + 0xc4]
push eax
call fcn.00418cc5
push 0x47b376
mov dword [0xa6f104], 7
mov dword [0xa6f108], 8
call fcn.0046ef6f
pop ecx
push 2
lea ecx, [esp + 0xd0]
call fcn.0041796c
mov dword [esp + 0xc], edi
lea ecx, [esp + 0x170]
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0x68da
push edi
call fcn.0041796c
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x434dc0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xcc]
mov dword [ecx + edx*4], 0xfffffffe
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x434daa
mov dword [esp + 0xc], eax
jmp 0x434de3
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x170]
mov dword [ecx + edx*4], 3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x434dcd
mov dword [esp + 0xc], eax
jmp 0x434f42
push dword [esp + 0xb8]
movdqa xmm0, xmmword [0xa6cc80]
lea ecx, [esp + 0x228]
push ecx
lea ecx, [esp + 0x21c]
mov dword [esp + 0xe0], eax
push ecx
push eax
lea ecx, [esp + 0xe8]
mov dword [esp + 0xec], eax
movdqu xmmword [esp + 0x224], xmm0
mov dword [esp + 0xf0], eax
call fcn.00419199
mov dword [esp + 0x10], 0xea5d
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0xcc]
cmp dword [edi + eax*4], 0x7ab6dad8
mov edx, dword [edi + edx*4]
setne cl
add edx, 0xfffd
sub edx, ecx
mov ecx, dword [esp + 0x20]
neg edx
sbb edx, edx
xor eax, eax
add edx, 5
imul edx, dword [edi + esi*4]
cmp dword [edi + ecx*4], edx
setl al
xor edx, edx
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xcc]
cmp dword [ecx + esi*4], eax
mov eax, 0x9e3d3b0c
sete dl
cmp eax, edx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x5d76270
mov eax, dword [esp + 0xcc]
setg cl
add ecx, dword [eax + edi*4]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xd8]
mov dword [eax], ecx
imul eax, dword [esp + 0xc], 0x2d5f
test eax, eax
jne 0x434eeb
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor eax, eax
cmp dword [esp + 0x1c], eax
jne 0x434f04
cmp dword [esp + 0x14], eax
jne 0x434f04
xor edi, edi
mov edx, eax
inc edi
jmp 0x434f09
xor edi, edi
inc edi
mov edx, edi
mov ecx, dword [esp + 0x170]
mov dword [ecx], edx
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x434f2f
push eax
push 0x20bd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
lea ecx, [esp + 0xd8]
call fcn.00417a3e
inc dword [esp + 0xc]
push 0
pop eax
cmp dword [esp + 0xc], edi
jle 0x434df2
lea ecx, [esp + 0x170]
call fcn.00417a3e
lea ecx, [esp + 0xcc]
call fcn.00417a3e
imul eax, dword [esp + 0x38], 0x2710
add eax, dword [esp + 0x4c]
mov dword [esp + 0x54], eax
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], 0xece3051e
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x20], 0x1521fafb
mov dword [esp + 0x10], eax
jmp 0x434fab
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x264], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x434f98
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], eax
jne 0x434fe5
mov ecx, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0xc]
cmp ecx, 0x6178
mov ecx, 0xc299e885
setg dl
cmp ecx, edx
mov edx, eax
sbb ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
je 0x434fe7
mov edx, edi
mov ecx, dword [esp + 0xc]
sub edx, ecx
je 0x434ff7
mov esi, edi
cmp dword [esp + 0x1c], eax
jne 0x434ff9
mov esi, eax
mov ecx, dword [esp + 0xc]
xor edx, edx
cmp ecx, esi
setne dl
cmp edx, dword [esp + 0x1c]
je 0x43500e
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
xor edx, edx
test ecx, ecx
setns dl
mov dword [esp + 0xc], edx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x20], ecx
mov dword [esp + 0xc], eax
jmp 0x43505f
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x43505b
push eax
push 0x1147
push 0x134d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x43502f
lea eax, [esp + 0x54]
push eax
call fcn.00436d3f
mov eax, dword [eax]
mov dword [esp + 0xc], 3
mov dword [esp + 0x2c], 0xbe7e5505
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], 0xbab59342
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x24], 4
mov dword [esp + 0x18], 0xf9020c5a
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x30], 0xc0d6813f
mov dword [esp + 0x10], 0xfffffffb
mov dword [esp + 0x10], eax
jmp 0x4350d9
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x3c], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x4350c9
mov ecx, dword [esp + 0x40]
neg ecx
jne 0x435112
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
neg esi
sbb esi, esi
xor edx, edx
neg esi
sub esi, ecx
imul esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
neg esi
cmp esi, ecx
mov ecx, eax
setne dl
sub edx, dword [esp + 0x1c]
je 0x435114
mov ecx, edi
mov edx, dword [esp + 0x40]
imul edx, ecx
mov ecx, dword [esp + 0x2c]
push 0
add ecx, edx
imul ecx, dword [esp + 0x44]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x40]
cmp ecx, edx
pop ecx
setl cl
cmp ecx, dword [esp + 0x3c]
jl 0x435150
mov esi, eax
cmp dword [esp + 0x40], eax
je 0x435152
mov esi, edi
mov ecx, dword [esp + 0x2c]
xor edx, edx
cmp ecx, esi
mov ecx, dword [esp + 0x24]
setg dl
inc dword [esp + 0x24]
cmp ecx, edx
jg 0x435177
cmp dword [esp + 0x20], eax
jne 0x435177
mov ecx, eax
cmp dword [esp + 0x40], eax
je 0x435179
mov ecx, edi
cmp ecx, dword [esp + 0x3c]
jne 0x43524c
mov dword [esp + 0x14], 0xc3cb8784
mov dword [esp + 0x24], 0x29123eba
mov dword [esp + 0x10], eax
jmp 0x4351a5
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x48], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x435199
mov dword [esp + 0x14], 0xc66b3191
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
sub edx, ecx
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
mov edx, dword [esp + 0x14]
push 0
pop ecx
setle cl
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x30]
cmp edx, ecx
push 0
pop ecx
setge cl
xor edx, edx
cmp dword [esp + 0x20], ecx
setle dl
sub edx, dword [esp + 0x48]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x48], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x2c], 0x1ba8
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x24]
sub edx, 0x72090f9c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
test edx, edx
setle cl
xor edx, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x30], ecx
setl dl
mov dword [esp + 0x24], edx
mov dword [esp + 0x48], 0xb8492355
jmp 0x43526d
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x43526d
push 0xf20
push 0x2356
push 0x1fd
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4354ea
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], 0xfe2cf45
mov dword [esp + 0x10], eax
jmp 0x43529e
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x27c], 0x1a6e483b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x43528b
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x4352bf
push eax
push 0x1d16
push eax
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor eax, eax
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
sub ecx, dword [esp + 0xc]
cmp ecx, dword [esp + 0xc]
je 0x4352dd
cmp dword [esp + 0xc], eax
jne 0x4352dd
mov edi, eax
xor eax, eax
cmp edi, 0x33e3
setg al
cmp eax, dword [esp + 0xc]
jl 0x4352f2
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
xor ecx, ecx
push 3
pop edi
cmp eax, edi
mov dword [esp + 0xac], esi
mov eax, dword [esp + 0x28]
setl cl
xor edx, edx
cmp ecx, 0xfffffffe
push edi
setle dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x10]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp edx, eax
mov eax, 0x70a6e8d3
setg cl
sub eax, ecx
lea ecx, [esp + 0x90]
mov dword [esp + 0x288], eax
call fcn.0041796c
mov dword [esp + 0x24], 0xf57a7c20
lea ecx, [esp + 0xfc]
push 4
call fcn.0041796c
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x435384
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x8c]
mov dword [ecx + edx*4], 0x77862fd4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x43536e
mov dword [esp + 0xc], eax
jmp 0x4353a6
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xfc]
mov dword [ecx + edx*4], 0x39ba095a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x435390
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x4353bf
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
mov dword [esp + 0x24], eax
jmp 0x4354c2
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], eax
jmp 0x4353e9
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x98], 0xc62e0897
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x4353d6
mov dword [esp + 0xa0], eax
cmp dword [esp + 0xa0], 2
jg 0x435443
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x28], ecx
mov edi, dword [esp + 0xa0]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x8c]
mov esi, dword [esp + 0x8c]
mov ecx, dword [ecx + edx*4]
mov edx, dword [esp + 0x28]
mov dword [esi + edi*4], ecx
mov dword [edx + 0xc], ecx
inc dword [esp + 0xa0]
cmp dword [esp + 0xa0], 2
jle 0x43540c
mov dword [esp + 0x1c], 0xffffffec
cmp dword [esp + 0x1c], 0xffffffe4
jle 0x4354be
mov ecx, dword [esp + 0x8c]
lea edi, [ecx + 4]
imul edx, dword [ecx], 0x1bbb
mov ecx, dword [esp + 0xfc]
push 0
sub edx, dword [ecx]
neg edx
sbb edx, edx
inc edx
imul ecx, edx, 0x3dc9
xor edx, edx
cmp dword [edi], ecx
mov ecx, dword [esp + 0xa4]
setne dl
cmp edx, ecx
pop ecx
setl cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x28]
setne dl
imul ecx, edx, 0x14ad
mov dword [esp + 0xa0], ecx
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe4
jle 0x4354be
mov ecx, dword [esp + 0x8c]
jmp 0x43545c
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jle 0x4353c8
lea ecx, [esp + 0xfc]
call fcn.00417a3e
lea ecx, [esp + 0x8c]
call fcn.00417a3e
jmp 0x436c3f
mov ecx, dword [0xa6f0e8]
push 2
pop esi
test cl, 2
jne 0x435571
push eax
or ecx, esi
mov dword [0xa6f110], eax
push eax
mov dword [0xa6f0e8], ecx
mov dword [0xa6f114], eax
call fcn.00418f8f
mov ecx, eax
mov dword [0xa6f12c], 0x3f800000
mov dword [0xa6f110], ecx
xor eax, eax
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x50]
push ecx
push 0x10
push eax
mov dword [0xa6f118], eax
mov ecx, 0xa6f118
mov dword [0xa6f120], eax
mov dword [0xa6f11c], eax
lea eax, [esp + 0xd4]
push eax
call fcn.00418cc5
push 0x47b371
mov dword [0xa6f124], 7
mov dword [0xa6f128], 8
call fcn.0046ef6f
pop ecx
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x1a0]
mov dword [esp + 0x2c], 0xd72d7671
mov dword [esp + 0x14], 0xfffffffa
push edi
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0xc], eax
jmp 0x4355ae
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x74], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x4355a2
mov dword [esp + 0xc], eax
jmp 0x4355cc
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1a0]
mov dword [ecx + edx*4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x4355ba
mov dword [esp + 0x24], edi
cmp dword [esp + 0x24], eax
jl 0x4356ff
push dword [esp + 0xc8]
lea ecx, [esp + 0x248]
mov dword [esp + 0x20], 0x4f402e31
push ecx
lea ecx, [esp + 0x23c]
mov dword [esp + 0x30], 0xf7e7308
push ecx
xorps xmm0, xmm0
mov dword [esp + 0xc8], eax
push eax
lea ecx, [esp + 0xcc]
mov dword [esp + 0xd0], eax
movdqu xmmword [esp + 0x244], xmm0
mov dword [esp + 0xd4], eax
call fcn.00419199
mov dword [esp + 0x1c], 0
jmp 0x4356c8
mov dword [esp + 0x28], 0xbedcc590
lea ecx, [esp + 0x188]
mov dword [esp + 0x28], 7
mov dword [esp + 0x28], 0x889a278c
push 3
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x435686
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x188]
mov dword [ecx + edx*4], 0x189f42c6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x435670
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x4356af
push eax
push 0xe86
push 0x1e55
push 0x1e2d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov eax, dword [esp + 0x188]
lea ecx, [esp + 0x188]
inc dword [eax]
call fcn.00417a3e
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x435642
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0xbc]
cmp dword [esp + eax*4 + 0x74], 0
jne 0x4356f8
call fcn.00417a3e
dec dword [esp + 0x24]
push 0
pop eax
jns 0x4355e0
jmp 0x4356fd
call fcn.00417a3e
xor eax, eax
mov dword [esp + 0x2c], edi
cmp dword [esp + 0x2c], eax
jl 0x4357fb
mov dword [esp + 0x10], 0x89ced66e
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], eax
jl 0x43578f
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x435733
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
mov ecx, dword [esp + 0x2c]
cmp dword [esp + ecx*4 + 0x74], eax
je 0x43577b
mov ecx, dword [esp + 0x2c]
push 0
mov edx, dword [esp + ecx*4 + 0x78]
mov ecx, dword [esp + 0x78]
cmp ecx, edx
pop ecx
setge cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
neg ecx
jne 0x435761
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1a0]
xor edx, edx
cmp dword [ecx], eax
setne dl
imul ecx, edx, 0x7304
mov edx, edi
test ecx, ecx
jne 0x43577d
mov edx, eax
xor ecx, ecx
cmp edx, 0xfffffff7
sete cl
mov dword [esp + 0x1c], ecx
dec dword [esp + 0x14]
jns 0x43571f
mov dword [esp + 0x1c], eax
jmp 0x4357ea
mov dword [esp + 0x14], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], 0xffffffff
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp edx, ecx
push 0
pop ecx
setl cl
cmp ecx, 0xffffffff
jne 0x4357c6
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], eax
jne 0x4357e0
mov ecx, eax
cmp dword [esp + 0x10], eax
je 0x4357e2
mov ecx, edi
mov dword [esp + 0x10], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x18
jge 0x435795
dec dword [esp + 0x2c]
jns 0x43570d
lea ecx, [esp + 0x1a0]
call fcn.00417a3e
xorps xmm0, xmm0
lea ecx, [esp + 0x68]
push esi
movdqu xmmword [esp + 0x80], xmm0
call fcn.0041796c
mov dword [esp + 0xc], 0x193e0566
xor eax, eax
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x18], 0xfffffffc
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], 0xe91cb64b
mov dword [esp + 0x1c], 0x121a
mov dword [esp + 0x10], 0xb4f12b15
mov dword [esp + 0x10], eax
jmp 0x43586c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x68]
mov dword [ecx + edx*4], 0x849f845d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x435859
mov ecx, dword [esp + 0x68]
cmp dword [ecx], 0xe048
jle 0x435884
cmp dword [ecx], eax
mov ecx, eax
jne 0x435886
mov ecx, edi
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], eax
jne 0x43589b
mov ecx, dword [esp + 0x68]
mov edx, eax
cmp dword [ecx + 4], eax
je 0x43589d
mov edx, edi
xor ecx, ecx
cmp edx, 0xb0f7
mov edx, 0xfffb
sete cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x68]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x24]
cmp edx, ecx
mov dword [esp + 0x30], esi
sbb ecx, ecx
inc ecx
sub ecx, dword [esi + 4]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub edx, ecx
je 0x435902
mov edx, edi
cmp dword [esp + 0x2c], eax
jne 0x435904
mov edx, eax
xor ecx, ecx
cmp edx, 0xc010
setge cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x28], ecx
setle dl
cmp edx, 0xfffffffb
ja 0x435a50
mov dword [esp + 0x1c], 0xc0c7
or ecx, 0xffffffff
mov dword [esp + 0x20], edi
mov dword [esp + 0x1d4], ecx
mov dword [esp + 0x1d8], ecx
mov dword [esp + 0x1dc], ecx
mov dword [esp + 0x1e0], ecx
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x10], eax
jmp 0x435975
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x224], 0xd1f73e70
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x435962
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], eax
jne 0x435992
mov ecx, eax
cmp dword [esp + 0x1c], eax
je 0x435994
mov ecx, edi
cmp ecx, 0xe972f33b
sbb ecx, ecx
neg ecx
cmp ecx, dword [esp + 0x1c]
jle 0x4359a8
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x228], ecx
mov dword [esp + 0x1dc], ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x230]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x68]
mov esi, dword [esi + 4]
cmp dword [ecx], 0xffffffff
mov ecx, dword [esp + 0x20]
setne dl
sub esi, edx
xor edx, edx
add esi, 0x707d8eb7
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, 0x161dbfa2
setg cl
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x24], eax
je 0x435a10
mov ecx, edi
cmp dword [esp + 0xc], eax
jne 0x435a12
mov ecx, eax
neg ecx
mov dword [esp + 0x28], ecx
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x435b24
push 0x34
push 0x196d
push 0xb24
push 0x1963
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x435b24
mov dword [esp + 0x24], 0xa880e1b4
mov dword [esp + 0x20], 0xfffffff7
mov dword [esp + 0x20], 9
mov dword [esp + 0x14], 0x7a74
mov dword [esp + 0x28], edi
inc dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x68]
mov ecx, dword [ecx]
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], eax
je 0x435a94
mov esi, edi
cmp dword [esp + 0x24], eax
jne 0x435a96
mov esi, eax
dec dword [esp + 0x1c]
jne 0x435ab3
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
cmp dword [edx + 4], ecx
mov edx, edi
jle 0x435ab5
mov edx, eax
xor ecx, ecx
cmp edx, 3
setle cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x28], ecx
setg dl
cmp edx, dword [esp + 0x14]
jl 0x435adc
mov ecx, edi
cmp dword [esp + 0x14], eax
jne 0x435ade
mov ecx, eax
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
cmp ecx, edx
push 0
pop ecx
setle cl
imul ecx, esi
add ecx, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
imul ecx, dword [esp + 0xc]
test ecx, ecx
je 0x435b18
cmp dword [esp + 0x24], eax
je 0x435b18
cmp dword [esp + 0x2c], eax
je 0x435b18
mov eax, edi
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x68]
call fcn.00417a3e
lea eax, [esp + 0x38]
push eax
call fcn.00436da1
mov eax, dword [eax]
mov dword [esp + 0x24], eax
xor eax, eax
mov dword [esp + 0x2c], 0x70a5
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], eax
jmp 0x435b61
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x58], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x435b51
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x64]
sub ecx, dword [esp + 0x64]
jne 0x435b82
mov ecx, dword [esp + 0x64]
mov ecx, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
mov ecx, dword [esp + 0x64]
mov ecx, dword [esp + 0x58]
mov ecx, dword [esp + 0x58]
mov esi, dword [esp + 0x64]
mov ecx, dword [esp + 0x64]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
sete dl
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], 0xfffffff3
jmp 0x435c04
mov dword [esp + 0x1c], eax
jmp 0x435bf9
mov dword [esp + 0x14], 0xdb74a71a
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], eax
jl 0x435bf5
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x435bef
push 0xf20
push 0x2356
push 0x1fd
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
dec dword [esp + 0x14]
jns 0x435bcd
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x12
jge 0x435bb7
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x29
jl 0x435bb1
cmp byte [ebp + 0xc], 0
jne 0x435c1d
mov esi, dword [esp + 0x24]
test esi, esi
jne 0x4361e3
push 2
lea ecx, [esp + 0x20c]
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x10], 7
mov dword [esp + 0x10], eax
jmp 0x435c4e
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x208]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x435c3b
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], eax
jl 0x435d22
mov dword [esp + 0x1c], 0x4f402e31
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], eax
jl 0x435d18
mov dword [esp + 0x14], 0x144ad72d
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], eax
jl 0x435d0a
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x435ce6
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xbc0
push 0x2324
push 0xe67
push eax
push 0x118d
push 0x870
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1a2b
push 0xf34
push 0x1ad3
push 0x2272
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x435d04
push 0x363
push 0x2242
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor eax, eax
dec dword [esp + 0x14]
jns 0x435c8b
mov ecx, dword [esp + 0x10]
dec dword [esp + 0x1c]
jns 0x435c79
dec dword [esp + 0x10]
jns 0x435c63
lea ecx, [esp + 0x208]
call fcn.00417a3e
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x298]
mov ecx, dword [esp + 0x38]
push eax
call fcn.00424f76
mov esi, eax
lea edi, [esp + 0x80]
pop ecx
push 3
lea ecx, [esp + 0x150]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], 0x245f1dbe
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x24], 0xad4351cd
call fcn.0041796c
xor edi, edi
mov dword [esp + 0x20], 0
inc edi
mov dword [esp + 0x2c], 0x221e9c96
mov dword [esp + 0x1c], 0x8373b2c
lea ecx, [esp + 0x1b8]
push edi
call fcn.0041796c
push 0xfffffffffffffff8
pop eax
mov dword [esp + 0x1c4], eax
mov dword [esp + 0x1c8], eax
mov dword [esp + 0x1cc], eax
mov dword [esp + 0x1d0], eax
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x435ddb
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14c]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x435dc5
mov dword [esp + 0xc], eax
jmp 0x435dfe
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1b8]
mov dword [ecx + edx*4], 9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x435de8
dec dword [esp + 0x1c]
jne 0x435ea0
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], eax
je 0x435e20
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x14c]
xor ecx, ecx
cmp dword [edx + 4], edi
setge cl
neg ecx
mov dword [edx + 4], ecx
mov dword [esp + 0x14], edi
mov esi, dword [esp + 0x10]
sub esi, dword [esp + 0x14]
sub esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
setg dl
sub edx, dword [esp + 0x2c]
je 0x435e74
mov ecx, edi
cmp dword [esp + 0x14], eax
jne 0x435e76
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], eax
mov ecx, dword [esp + 0x1b8]
je 0x435e8d
mov edx, edi
cmp dword [ecx], eax
jne 0x435e8f
mov edx, eax
mov ecx, dword [ecx]
imul ecx, edx
imul ecx, ecx, 0xffff
test ecx, ecx
mov ecx, eax
je 0x435ea2
mov ecx, edi
xor eax, eax
cmp ecx, 0x14487183
lea ecx, [esp + 0x1b8]
setge al
mov dword [esp + 0x1d0], eax
call fcn.00417a3e
lea ecx, [esp + 0x14c]
call fcn.00417a3e
cmp byte [ebp + 0xc], 0
je 0x4361df
cmp dword [esp + 0x84], 0
je 0x4361df
mov dword [esp + 0x28], 0xfffffffe
xor eax, eax
mov dword [esp + 0x28], 0xefa9d19a
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x28], 0xfffffff7
mov dword [esp + 0x28], 2
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 0xd0289a69
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x18], eax
jmp 0x435f3f
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x250], 0x7a4a12b5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x435f2c
mov dword [esp + 0x18], eax
jmp 0x435f5f
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x28c], 0xb5f0b10
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x435f4c
mov dword [esp + 0x18], eax
jmp 0x435f7f
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x194], 0xa75a592c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x435f6c
dec dword [esp + 0x198]
mov eax, dword [esp + 0x198]
mov ecx, dword [esp + 0x258]
imul ecx, eax
mov eax, dword [esp + 0x88]
push edi
mov dword [esp + 0xb4], eax
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x138]
mov dword [esp + 0x30], 0xd327cb3f
mov dword [esp + 0x2c], 0xfffffff8
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x14], 0x8781562e
mov dword [esp + 0xc], eax
jmp 0x435ff3
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x134]
mov dword [ecx + edx*4], 0xeca1aea0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x435fdd
mov dword [esp + 0xc], eax
jmp 0x436012
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x26c], 0x1eb6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x435fff
dec dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
jmp 0x4361ba
mov dword [esp + 0x18], 0x558bac04
mov dword [esp + 0x20], 0xbc906383
mov dword [esp + 0x28], 6
mov dword [esp + 0x18], eax
jmp 0x4361ab
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
jmp 0x436157
mov dword [esp + 0xc], 0xfffffff8
mov dword [esp + 0xc], 0xfffffff5
cmp dword [esp + 0xc], 0xfffffff2
jl 0x436136
mov dword [esp + 0x14], 0xfffffffc
lea ecx, [esp + 0x164]
push 3
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4360af
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x164]
mov dword [ecx + edx*4], 0xa61940c9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x436099
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x14], eax
je 0x4360c8
mov dword [esp + 0x10], eax
jmp 0x43614c
cmp dword [esp + 0x2c], eax
jne 0x436153
cmp dword [esp + 0x20], eax
jne 0x436153
cmp dword [esp + 0x10], 0xffffffea
jge 0x43613c
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffe
jle 0x436060
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x134]
mov esi, dword [ecx]
mov ecx, dword [esp + 0x14]
sub esi, edx
add ecx, esi
xor edx, edx
cmp ecx, edi
setg dl
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x26c]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x28], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jge 0x436047
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x26
jl 0x436026
lea ecx, [esp + 0x134]
call fcn.00417a3e
mov eax, dword [esp + 0x84]
mov dword [esp + 0xb4], eax
mov esi, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x14], eax
jmp 0x436202
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x25c], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x4361f3
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], eax
jl 0x436254
mov dword [esp + 0x20], 0x210b999f
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x43624a
push eax
push eax
push eax
push 0x1ae9
push 0xd15
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
dec dword [esp + 0x20]
dec dword [esp + 0x14]
jns 0x436213
test esi, esi
jne 0x436866
cmp dword [esp + 0x7c], esi
jle 0x436866
mov dword [esp + 0x10], 0xc08901f2
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
sub ecx, eax
je 0x436376
push 2
pop esi
mov dword [esp + 0x2c], 5
lea ecx, [esp + 0x1f0]
push esi
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x4362c4
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1f0]
mov dword [ecx + edx*4], 0x47cd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x4362ae
cmp dword [esp + 0x2c], eax
jne 0x4362e2
cmp dword [esp + 0x1c], eax
je 0x4362de
mov ecx, dword [esp + 0x1c]
add ecx, esi
jne 0x4362e2
mov esi, eax
jmp 0x4362e4
mov esi, edi
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
add ecx, esi
add edx, ecx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp ecx, edx
mov ecx, dword [esp + 0x10]
push 0
pop edx
setg dl
cmp edx, ecx
push 0
pop ecx
setg cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x28], ecx
setge dl
add edx, 6
mov dword [esp + 0x10], edx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x2c], edi
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x436361
push 0x12dc
push eax
push eax
push 0x10b8
push 0x1c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
lea ecx, [esp + 0x1f0]
call fcn.00417a3e
mov esi, dword [esp + 0x24]
jmp 0x436401
mov dword [esp + 0x28], 0x684593f6
lea ecx, [esp + 0x1fc]
push 3
call fcn.0041796c
push 3
lea ecx, [esp + 0x1e8]
call fcn.0041796c
push 3
mov dword [esp + 0x10], 0
pop edx
jmp 0x4363b9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1fc]
mov dword [eax + ecx*4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x4363a7
mov dword [esp + 0xc], 0
jmp 0x4363df
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1e4]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x4363c9
dec dword [esp + 0x20]
lea ecx, [esp + 0x1e4]
call fcn.00417a3e
lea ecx, [esp + 0x1fc]
call fcn.00417a3e
push 2
lea ecx, [esp + 0xe8]
call fcn.0041796c
mov dword [esp + 0x14], 0
jmp 0x43642c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xe4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x436419
mov eax, dword [esp + 0xe4]
and dword [eax], 0
mov dword [esp + 0x28], 0xe8c9
mov dword [esp + 0x30], 0xfffffffa
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xe4]
inc dword [eax]
cmp dword [eax], 0xb
jle 0x43643d
lea ecx, [esp + 0xe4]
call fcn.00417a3e
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x1ac]
push 3
call fcn.0041796c
push 2
lea ecx, [esp + 0x180]
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0xc], eax
jmp 0x4364b5
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1ac]
mov dword [ecx + edx*4], 0x1b61
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x43649f
mov dword [esp + 0xc], eax
jmp 0x4364d4
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x17c]
mov dword [ecx + edx*4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x4364c2
cmp dword [esp + 0x28], eax
je 0x43651c
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x4364f4
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor eax, eax
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x436543
push eax
push 0xb09
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x436543
mov eax, dword [esp + 0x1ac]
xor ecx, ecx
mov edx, dword [eax]
test edx, edx
setne cl
xor eax, eax
cmp ecx, edx
setne al
imul ecx, eax, 0x7937
mov eax, dword [esp + 0x17c]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x17c]
call fcn.00417a3e
lea ecx, [esp + 0x1ac]
call fcn.00417a3e
push 2
lea ecx, [esp + 0x144]
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], eax
jmp 0x43658b
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x140]
mov dword [ecx + edx*4], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x436575
mov ecx, dword [esp + 0x140]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x140]
call fcn.00417a3e
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x4365c3
xor eax, eax
mov dword [esp + 0x18], 0x8a61928c
mov dword [esp + 0x2c], 0x14b81230
mov dword [esp + 0x1c], edi
push 0xfffffffffffffff9
pop ecx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x118], ecx
mov dword [esp + 0x11c], ecx
mov dword [esp + 0x120], ecx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0x19
jne 0x4369c6
mov dword [esp + 0x10], 0xdb6084ed
xor edx, edx
mov dword [esp + 0x14], 0xdfe9f48
mov dword [esp + 0x20], 2
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 0x10]
cmp ecx, 0xba25
mov ecx, dword [esp + 0x18]
push 0
setge dl
cmp edx, ecx
pop ecx
setne cl
xor edx, edx
imul ecx, dword [esp + 0x18]
push 0
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x18]
setne dl
cmp edx, ecx
mov ecx, dword [esp + 0x1c]
pop edx
setge dl
cmp edx, ecx
mov ecx, dword [esp + 0x18]
push 0
pop edx
setl dl
cmp ecx, edx
push 0
pop ecx
setge cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x28], ecx
push 0
setle dl
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
pop ecx
setg cl
sub ecx, dword [esp + 0x14]
imul ecx, dword [esp + 0x18]
inc ecx
je 0x436958
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
cmp ecx, 0x67f5
mov ecx, dword [esp + 0x1c]
setle dl
cmp edx, ecx
push 0
pop ecx
setge cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x28], ecx
setge dl
sub edx, 0x24b13b10
cmp dword [esp + 0x18], edx
jge 0x4369ab
mov ecx, eax
cmp dword [esp + 0x114], eax
je 0x4369ad
mov ecx, edi
neg ecx
mov dword [esp + 0x14], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x19
je 0x4368aa
mov esi, dword [esp + 0x24]
mov dword [esp + 0x18], 0xfffffffd
jmp 0x436a67
mov dword [esp + 0x20], 0xa24e
xor edx, edx
mov dword [esp + 0x28], edi
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
cmp ecx, 0x2b293353
setg dl
sub edx, 0xb0debf62
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp ecx, edx
sbb ecx, ecx
neg ecx
dec ecx
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], 0xdb602708
ja 0x436a1c
mov ecx, edi
cmp dword [esp + 0x1c], eax
jne 0x436a1e
mov ecx, eax
mov dword [esp + 0x1c], ecx
mov edx, edi
cmp dword [esp + 0x1c], eax
jne 0x436a2c
mov edx, eax
mov ecx, dword [esp + 0x114]
imul ecx, edx
cmp ecx, 0xffffffff
jbe 0x436a43
mov ecx, edi
cmp dword [esp + 0x20], eax
jne 0x436a45
mov ecx, eax
mov dword [esp + 0x28], ecx
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x436a63
push 0xc52
push eax
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
xor eax, eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xa
jge 0x4369d3
lea ecx, [esp + 0x7c]
call fcn.00426ad1
test esi, esi
je 0x436c03
mov dword [esp + 0x18], 0xfffffff8
lea ecx, [esp + 0x158]
mov dword [esp + 0x28], 0xedfc3e8c
push 4
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 4
jge 0x436ad1
push dword [esp + 0x14]
lea ecx, [esp + 0x15c]
call fcn.00417a5a
mov dword [eax], 0x9fa5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x436aae
xor eax, eax
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x436ae9
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0x1b
je 0x436b9a
push 2
lea ecx, [esp + 0x15c]
call fcn.00417a5a
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], 0x9226c312
cmp dword [esp + 0x18], eax
jne 0x436b34
mov ecx, dword [esp + 0x18]
xor edx, edx
neg ecx
mov esi, eax
cmp ecx, 0xfffffff8
setge dl
cmp edx, dword [esp + 0x18]
jle 0x436b36
mov esi, edi
mov ecx, dword [esp + 0x18]
xor edx, edx
cmp esi, ecx
setg dl
imul edx, dword [esp + 0x20]
test edx, edx
je 0x436b4e
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], 0x2978d8ef
jne 0x436b70
mov esi, edi
cmp dword [esp + 0x18], eax
jne 0x436b72
mov esi, eax
mov ecx, dword [esp + 0x20]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x28]
setge dl
mov dword [esp + 0x20], edx
inc dword [ecx]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1b
jne 0x436b0c
mov esi, dword [esp + 0x24]
lea ecx, [esp + 0x158]
call fcn.00417a3e
mov edx, dword [esp + 0x4c]
mov ecx, esi
call fcn.00434971
mov dword [esp + 0x28], 0xfffffffe
mov esi, eax
mov byte [esp + 0xb], 0
cmp byte [esp + 0xb], 0
mov dword [esp + 0xac], esi
je 0x436be0
push 0x1684
push 0x1557
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
mov byte [esp + 0xb], 0
cmp byte [esp + 0xb], 0
je 0x436bf7
push 0x4fa
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
lea eax, [esp + 0x54]
push eax
call fcn.00436d3f
mov dword [eax], esi
mov dword [esp + 0x28], 7
mov byte [esp + 0xb], 0
cmp byte [esp + 0xb], 0
je 0x436c28
push 0
push 0x4f4
push 0x53
push 0
call dword [sym.imp.GDI32.dll_GetPaletteEntries]
mov byte [esp + 0xb], 0
cmp byte [esp + 0xb], 0
je 0x436c3f
push 0x239e
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov eax, dword [ebp + 8]
lea esi, [esp + 0xac]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret