Function at 0x428ec3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d8
push ebx
push esi
push edi
push 0xfffffffffffffff9
mov byte [ebp - 0x3d], dl
pop edx
push 1
mov dword [ebp - 0x20], 0x477862f
mov dword [ebp - 0x1c], 0xffffffff
pop edi
mov dword [ebp - 0x30], 0xe2ff5ff7
push 0
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x20], 0x16
pop eax
jmp 0x428f7e
mov dword [ebp - 0x30], 0xfffd
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x34], 0xa932da3b
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x955205
neg ecx
sbb ecx, ecx
inc ecx
jne 0x428f34
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x428f48
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x30], ecx
imul ecx, dword [ebp - 0x30], 0xfffffffb
test ecx, ecx
je 0x428f5c
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x34], eax
jne 0x428f71
mov ecx, eax
cmp dword [ebp - 0x30], eax
je 0x428f73
mov ecx, edi
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x1c], eax
jne 0x428f88
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe7
jg 0x428f03
mov dword [ebp - 0x2c], 0x137b1891
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x3c], 0xfffffffe
push 3
call fcn.00428b50
mov dword [ebp - 0x28], 0xb000cd9d
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0x7f8b4dfe
mov dword [ebp - 0x24], 0x7392715e
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0x156be823
mov dword [ebp - 0x1c], 0x1b9b9640
mov dword [ebp - 0x14], 0xd8d4885c
mov dword [ebp - 0x14], eax
jmp 0x428fe9
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x134]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x428fda
inc dword [ebp - 0x30]
xor ebx, ebx
mov ecx, dword [ebp - 0x34]
mov edx, 0xe34d1cd0
mov esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x134]
push 2
mov dword [ecx], esi
mov ecx, dword [ebp - 0x3c]
sub edx, ecx
mov ecx, dword [ebp - 0x2c]
cmp ecx, edx
setle bl
xor ecx, ecx
add ebx, dword [ebp - 0x34]
cmp ebx, 0x5a80
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x10]
dec ecx
imul ecx, dword [ebp - 0x28]
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 0x30]
cmp esi, ecx
pop esi
setge dl
xor ecx, ecx
cmp edx, dword [ebp - 0x3c]
setg cl
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x1c], eax
jmp 0x429095
mov dword [ebp - 0x24], edi
lea ecx, [ebp - 0x178]
push edi
call fcn.00428b50
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x14], 0
jmp 0x42907f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x429070
dec dword [ebp - 0x34]
lea ecx, [ebp - 0x178]
call fcn.00428c22
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x429051
lea ecx, [ebp - 0x134]
call fcn.00428c22
mov dword [ebp - 0x24], 0x60657976
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x4290bc
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x4290ce
push 0
call dword [sym.imp.GDI32.dll_GetObjectType]
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x90]
push 3
mov dword [ebp - 0x14], 0x3ee32743
pop ebx
mov dword [ebp - 0x24], 0xd9248e6b
mov dword [ebp - 0x10], 0xfffffff8
mov dword [ebp - 0x20], 0x191b
push ebx
call fcn.00428b50
mov dword [ebp - 0x2c], 0xfffffffc
xor eax, eax
mov dword [ebp - 0x48], 0xe3b6ea11
mov dword [ebp - 0x1c], eax
jmp 0x429125
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x90]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x429115
mov dword [ebp - 0x18], 0xa
jmp 0x429254
mov dword [ebp - 0x30], 0xfff7
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], eax
jmp 0x42915d
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x54], 0x2404
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x42914f
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 0x18], ecx
jge 0x42916d
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
cmp dword [ebp - 0x14], eax
je 0x4291e7
mov dword [ebp - 0x34], 0xe2e4ed3
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x3c], 0x24b83428
mov dword [ebp - 0x24], 8
dec dword [ebp - 0x50]
mov ecx, dword [ebp - 0x50]
je 0x42919b
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov esi, 0x3d478254
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x30]
sub esi, ecx
add esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
sub edx, ecx
mov ecx, dword [ebp - 0x34]
imul esi, edx
xor edx, edx
cmp ecx, esi
setle dl
add edx, 0x8a1b
cmp edx, dword [ebp - 8]
jl 0x4291db
mov ecx, edi
cmp dword [ebp - 0x28], eax
jne 0x4291dd
mov ecx, eax
mov dword [ebp - 0x3c], ecx
cmp dword [ebp - 0x10], eax
jne 0x42924e
jmp 0x429234
mov dword [ebp - 8], edi
cmp dword [ebp - 8], eax
jl 0x429234
dec dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x54]
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x54], eax
jne 0x42920d
cmp dword [ebp - 0x10], 0xddd0c6a3
mov ecx, eax
jbe 0x42920f
mov ecx, edi
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], eax
je 0x42921e
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x54]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x54]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x54], edx
dec dword [ebp - 8]
jns 0x4291ef
mov dword [ebp - 0x20], eax
jmp 0x429249
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x90]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jl 0x429239
inc dword [ebp - 0x18]
push 2
pop esi
cmp dword [ebp - 0x18], 0x16
je 0x429136
cmp dword [ebp - 0x20], eax
je 0x4292e7
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x18]
mov edx, dword [esi]
add edx, dword [esi + 4]
cmp edx, ecx
mov ecx, dword [ebp - 0x90]
setle bl
sub ebx, dword [ecx]
mov ecx, dword [ebp - 0x14]
neg ebx
sbb ebx, ebx
inc ebx
imul ecx, ebx
test ecx, ecx
je 0x4292a8
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x90]
imul edx, dword [ecx]
neg edx
sbb edx, edx
neg edx
cmp edi, edx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
test ecx, ecx
setns dl
xor ecx, ecx
cmp edx, dword [esi + 4]
setle cl
add ecx, 0x3b3be7b8
cmp ecx, dword [ebp - 0x14]
jne 0x4292e7
mov eax, edi
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
lea ecx, [ebp - 0x90]
call fcn.00428c22
mov ebx, dword [0x4ad9fc]
xor eax, eax
mov dword [ebp - 0x10], 0xac64a684
mov byte [ebp - 9], al
mov dword [ebp - 0x34], ebx
cmp byte [ebp - 9], al
je 0x429326
push 0x877
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x10], eax
jmp 0x42934f
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42934c
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
xor eax, eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jle 0x429331
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x110]
push 1
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
call fcn.00428b50
mov dword [ebp - 0x14], 0x8094a188
lea ecx, [ebp - 0x190]
push 4
call fcn.00428b50
mov dword [ebp - 0x24], 4
xor ecx, ecx
mov dword [ebp - 0x24], 0xe82ca968
inc ecx
mov dword [ebp - 0x24], 0x921b0ae2
mov dword [ebp - 0x24], 0x5b1510af
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xd99ea7eb
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x24], 0xfffffff8
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jge 0x4293f7
xor esi, esi
inc esi
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x110]
mov dword [ecx + edx*4], 0x3198
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x4293dc
mov esi, dword [ebp + 8]
mov dword [ebp - 0x18], eax
jmp 0x42940f
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x190]
mov dword [ecx + edx*4], 0x9ddcef98
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x4293fc
push 2
mov dword [ebp - 0x18], eax
pop edx
jmp 0x42942a
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x1b8], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x42941d
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x42946c
mov dword [ebp - 0x48], 1
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x110]
push 0xfffffffffffffff8
cmp dword [ecx + edx*4], 0xffff
pop ecx
sete bl
sub ecx, ebx
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x429437
mov ebx, dword [ebp - 0x34]
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0x190]
call fcn.00428c22
lea ecx, [ebp - 0x110]
call fcn.00428c22
cmp byte [ebp - 0x3d], 0
je 0x4295b6
xor edx, edx
inc edx
cmp ebx, edx
jne 0x4295b6
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4294b2
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x150], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4294a1
push 3
mov dword [ebp - 8], eax
pop ebx
jmp 0x4294d1
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x84], 0xfffffffd
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4294c0
mov dword [ebp - 0x84], ebx
cmp dword [ebp - 0x84], eax
jl 0x429559
mov dword [ebp - 0x10], 0x9f3690f1
mov ecx, dword [ebp - 0x84]
cmp dword [ebp + ecx*4 - 0x150], eax
jne 0x429556
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x42954e
mov dword [ebp - 0x14], 0x35c5735e
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x429525
mov ecx, dword [ebp - 0x84]
cmp dword [ebp + ecx*4 - 0x150], eax
jne 0x429525
dec dword [ebp - 0x14]
jns 0x429511
mov dword [ebp - 0x14], eax
jmp 0x429544
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + ecx*4 - 0x150]
mov ecx, dword [ebp - 0x84]
mov dword [ebp + ecx*4 - 0x150], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x42952a
dec dword [ebp - 0x10]
jns 0x429502
dec dword [ebp - 0x84]
jns 0x4294e4
xor edx, edx
inc edx
mov dword [ebp - 8], 0xac64a684
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], 0xba13b288
mov dword [esi + 8], 4
mov dword [ebp - 8], 0x1b
jmp 0x42958e
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x42958b
call dword [sym.imp.USER32.dll_ReleaseCapture]
xor eax, eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0x19
jg 0x42957a
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
neg dword [ebp - 8]
mov dword [esi + 0xc], 0x4ad9fc
mov dword [ebp - 0x1c], 0xfffffffa
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0x44adca1a
push 1
call fcn.00428b50
xor edx, edx
mov dword [ebp - 0x10], 0
inc edx
jmp 0x4295fe
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x184]
mov dword [eax + ecx*4], 0xe2cf4565
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x4295eb
mov eax, dword [ebp - 0x1c]
mov ecx, edx
mov dword [ebp - 0x10], eax
xor edx, edx
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
mov ecx, 0x4b9a733e
setl dl
xor ebx, ebx
cmp edx, 0xfffffffc
setl bl
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, ebx
setl al
xor ecx, ecx
cmp eax, 3
setle cl
xor eax, eax
sub ecx, dword [ebp - 0x1c]
cmp ecx, 0xfc36fe5
setg al
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, 0x32c5
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
sub edx, dword [ebp - 0x1c]
imul edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setl cl
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x184]
call fcn.00428c22
mov ebx, dword [ebp - 0x38]
cmp ebx, dword [ebp - 0x34]
jge 0x42a45d
xor esi, esi
mov dword [ebp - 0x14], 0x13638ecf
inc esi
xor eax, eax
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x10], eax
jmp 0x4296af
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x1d8], 0x4ef66b17
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x42969e
mov edx, esi
cmp dword [ebp - 0x14], eax
jne 0x4296be
mov edx, eax
mov ecx, dword [ebp - 0x14]
sub ecx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x20], eax
jmp 0x4296fa
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4296f7
call edi
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x4296e3
mov dword [ebp - 0x3c], eax
mov edi, 0x4ada00
mov dword [ebp - 0x1c], edi
test ebx, ebx
jle 0x429e5d
push 2
pop ebx
mov dword [ebp - 8], eax
jmp 0x42972c
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x158], 0xfd5464b5
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x42971b
mov dword [ebp - 8], eax
jmp 0x429740
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x4c], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x429736
mov dword [ebp - 0x4c], eax
jmp 0x42975b
mov ecx, dword [ebp - 0x4c]
mov dword [ebp + ecx*4 - 0x158], 0xffffffff
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], esi
jle 0x42974a
mov ecx, dword [edi]
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x1c], 0xdb3ae355
mov dword [ebp - 0x20], eax
push ebx
call fcn.00428b50
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x429795
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x16c]
mov dword [ecx + edx*4], 0xfffffffd
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x429782
mov dword [ebp - 8], eax
jmp 0x4297ad
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x58], 0x1307
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42979f
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xe
je 0x4298e5
jmp 0x4297c3
xor eax, eax
mov dword [ebp - 0x14], eax
mov ecx, 0x1b583dc0
mov dword [ebp - 0x1a0], ecx
mov dword [ebp - 0x19c], ecx
mov dword [ebp - 0x198], ecx
mov dword [ebp - 0x194], ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
jmp 0x4297fc
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xc8], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4297eb
cmp dword [ebp - 0x14], eax
jne 0x4298e2
mov edx, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
setle bl
mov dword [ebp - 0x20], ebx
mov esi, dword [ebp - 0x14]
sub esi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setne dl
cmp dword [ebp - 0x14], edx
je 0x42989f
xor esi, esi
lea ecx, [ebp - 0x128]
inc esi
push esi
call fcn.00428b50
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x10], 0
jmp 0x429862
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x429853
inc dword [ebp - 0x58]
xor edx, edx
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0xc8], ecx
cmp dword [eax], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
sete dl
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x20], eax
call fcn.00428c22
jmp 0x4298d5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff1
jne 0x4298d2
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4298cd
push 0x616
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
dec dword [ebp - 0x10]
jmp 0x4298a2
xor esi, esi
inc esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xe
jne 0x4297c1
push 2
pop ebx
lea ecx, [ebp - 0x16c]
call fcn.00428c22
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa8b70]
lea ecx, [ebp - 0x1a0]
push ecx
xor eax, eax
mov dword [ebp - 8], 0xffffffff
lea ecx, [ebp - 0x1b0]
mov dword [ebp - 0x18], ebx
push ecx
add edi, 4
mov dword [ebp - 0xb8], eax
push eax
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x1c], edi
movdqu xmmword [ebp - 0x1b0], xmm0
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
call fcn.00428c93
mov dword [ebp - 0x2c], 0xa9801335
mov eax, dword [ebp - 8]
xor eax, eax
cmp dword [ebp - 0x18], eax
je 0x42997c
mov ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x9cd3
jg 0x429965
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 8]
jne 0x429985
cmp dword [ebp - 8], eax
je 0x429a87
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x28], 0xa4fdaf0d
mov dword [ebp - 0x30], 0xebdc590c
mov dword [ebp - 0x10], eax
jmp 0x4299b0
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xa8], 0xbd77
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x42999f
mov ecx, dword [ebp - 0xa8]
xor ebx, ebx
mov edx, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa8]
cmp edx, ecx
push 0xfffffffffffffff9
setge bl
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xa8]
mov edx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x18]
cmp ecx, edx
setge bl
xor edx, edx
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0xa4]
cmp ecx, 0xa
mov ecx, dword [ebp - 0x18]
setl dl
imul ecx, edx
xor edx, edx
cmp ecx, 0xfff9
pop ecx
setne dl
sub edx, dword [ebp - 8]
sub edx, dword [ebp - 0x18]
cmp ecx, edx
mov ecx, dword [ebp - 0x18]
push 0xfffffffffffffff9
sbb edx, edx
xor ebx, ebx
neg edx
cmp ecx, edx
mov edx, 0xc9fc22f7
setge bl
sub ebx, 0x35a02a90
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
sbb edx, edx
xor ebx, ebx
inc edx
add edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xa0]
cmp edx, ecx
pop ecx
setle bl
mov edx, ecx
mov ecx, dword [ebp - 8]
sub edx, ebx
add ecx, edx
cmp ecx, dword [ebp - 0x30]
jle 0x429a72
mov edx, eax
cmp dword [ebp - 0x28], eax
je 0x429a74
mov edx, esi
mov ecx, dword [ebp - 8]
sub edx, ecx
mov ecx, dword [ebp - 0xb8]
mov dword [ecx + 0xc], edx
jmp 0x429bf0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x48], 0xe2f801b0
mov dword [ebp - 0x44], 5
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x3c
jge 0x429bf0
xor edi, edi
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x11c]
push 3
call fcn.00428b50
xor eax, eax
mov dword [ebp - 0x48], 0xa0a8e6c6
mov dword [ebp - 0x18], eax
jmp 0x429adc
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0x98], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x429acb
mov dword [ebp - 0x18], eax
jmp 0x429af9
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x11c]
mov dword [ecx + edx*4], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x429ae6
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x429b0f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor eax, eax
mov dword [ebp - 0x18], 0xffffffe5
cmp dword [ebp - 0x18], 0xffffffef
jg 0x429bcf
mov esi, dword [ebp - 0x11c]
mov dword [ebp - 0x14], 8
xor edx, edx
mov ecx, dword [ebp - 0x20]
test ecx, ecx
setg dl
sub edx, dword [ebp - 0x20]
jne 0x429b46
mov ecx, eax
cmp dword [ebp - 0x98], eax
je 0x429b49
lea ecx, [edi + 1]
mov dword [ebp - 0x30], ecx
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [esi + 8]
setle dl
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x28], eax
jne 0x429b86
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0x5ed7
jl 0x429ba2
mov edx, eax
cmp dword [ebp - 0x44], eax
je 0x429ba5
lea edx, [edi + 1]
mov dword [ebp - 0x30], 0x697e
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x10]
imul ecx, edx
add ecx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x48], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffef
jle 0x429b26
lea ecx, [ebp - 0x11c]
call fcn.00428c22
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x3c
push 0
pop eax
jl 0x429aad
mov edi, dword [ebp - 0x1c]
xor esi, esi
inc esi
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x429c06
push 0x1c67
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea ecx, [ebp - 0xb8]
call fcn.00428c22
mov eax, dword [edi]
mov dword [ebp - 0x44], eax
xor eax, eax
mov dword [ebp - 0x10], 0x5a136951
mov dword [ebp - 0x10], eax
jmp 0x429c35
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x160], 0x8ec0ae97
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x429c24
mov dword [ebp - 0x10], eax
jmp 0x429c5e
cmp byte [ebp - 9], 0
je 0x429c5b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
mov byte [ebp - 9], al
jle 0x429c3f
cmp byte [ebp - 9], 0
je 0x429c72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 3
lea ecx, [ebp - 0xf8]
add edi, 4
call fcn.00428b50
mov dword [ebp - 8], 0xdb74
lea ecx, [ebp - 0x140]
push 3
call fcn.00428b50
xor eax, eax
mov dword [ebp - 0x2c], 0x467bb1a8
mov dword [ebp - 8], eax
jmp 0x429cb7
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xf8]
mov dword [ecx + edx*4], 0xfff8
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x429ca4
mov dword [ebp - 8], eax
jmp 0x429cd1
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x140]
mov dword [ecx + edx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x429cc2
mov ebx, dword [ebp - 0xf8]
xor edx, edx
mov esi, dword [ebx + 4]
cmp esi, 8
setne dl
imul edx, dword [ebx]
imul edx, esi
sub edx, esi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, esi
setg cl
imul ecx, dword [ebx]
cmp esi, ecx
jle 0x429d0d
cmp dword [ebx + 8], eax
jne 0x429d0d
xor ecx, ecx
inc ecx
jmp 0x429d0f
mov ecx, eax
mov esi, dword [ebx + 4]
xor edx, edx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
imul ecx, esi
push 2
cmp ecx, esi
mov ecx, dword [ebp - 0x140]
setge dl
xor ebx, ebx
cmp edx, dword [ecx + 8]
setne bl
sub esi, ebx
mov dword [ebp - 0x2c], esi
xor esi, esi
pop ebx
mov dword [ebp - 8], ebx
inc esi
cmp dword [ebp - 8], eax
jl 0x429d88
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov esi, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xf8]
mov eax, dword [edx + eax*4]
cmp eax, dword [edx + ecx*4]
setle bl
xor eax, eax
cmp dword [edx + esi*4], 0x56a4
setg al
xor esi, esi
add ebx, eax
inc esi
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
dec dword [ebp - 8]
jns 0x429d43
push 2
pop ebx
lea ecx, [ebp - 0x140]
call fcn.00428c22
lea ecx, [ebp - 0xf8]
call fcn.00428c22
cmp dword [ebp - 0x44], 0
jne 0x429da7
add edi, 8
push esi
lea ecx, [ebp - 0x104]
call fcn.00428b50
mov dword [ebp - 8], 0
jmp 0x429dcd
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1c8], 0x9841
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x429dbc
mov dword [ebp - 8], 0
jmp 0x429def
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0xa32b1cec
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x429ddc
mov eax, dword [ebp - 0x104]
mov dword [eax], 3
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1c8], 0
jne 0x429e39
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x429e2f
push 0x12fa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov eax, dword [ebp - 0x104]
dec dword [eax]
jns 0x429e00
lea ecx, [ebp - 0x104]
call fcn.00428c22
add edi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x3c]
inc ecx
mov dword [ebp - 0x1c], edi
push 0
mov dword [ebp - 0x3c], ecx
pop eax
cmp ecx, dword [ebp - 0x38]
jl 0x429716
push 2
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x30], eax
pop ebx
mov dword [ebp - 8], 0xc8d4675
mov dword [ebp - 0x20], 0xec7e4343
push ebx
call fcn.00428b50
mov dword [ebp - 0x24], 0xd10caad9
xor eax, eax
mov dword [ebp - 0x18], 0x9d0863e8
mov dword [ebp - 0x24], 0xa5a14e9c
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x24], 0x36808710
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x10], eax
jmp 0x429eba
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx + edx*4], 0x920a6ff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x429eaa
inc dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x6c]
cmp dword [ecx + 4], eax
je 0x429ed5
mov ecx, dword [ebp - 0x14]
jmp 0x429ed7
mov esi, eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x6c]
push 2
setl dl
xor ebx, ebx
mov ecx, dword [ecx]
add ecx, 6
add edx, ecx
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0x6c]
setne bl
xor edx, edx
sub ebx, dword [ecx]
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 8]
cmp ecx, 0xfae3
setg dl
xor ecx, ecx
cmp edx, 0x98a97d63
setne cl
cmp ecx, 0xe9a03a1b
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x71f8b108
mov ecx, dword [ebp - 0x14]
setle dl
cmp edx, 0xffff
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setge bl
xor edx, edx
cmp ebx, ecx
pop ebx
setne dl
sub edx, dword [ebp - 0x14]
neg edx
push ebx
sbb edx, edx
inc edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x6c]
mov dword [ecx], 0x138bf9cc
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x28], eax
call fcn.00428b50
mov dword [ebp - 0x10], 0
jmp 0x429f99
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x429f89
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], ebx
js 0x42a019
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc4]
mov eax, dword [eax]
inc dword [ebp - 0x28]
cmp ecx, eax
jl 0x429fc2
mov edx, ebx
jmp 0x429fc4
xor edx, edx
mov esi, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp edx, eax
mov eax, dword [ebp - 0x6c]
setne cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
setl dl
xor eax, eax
cmp edx, ebx
setle al
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc4]
mov edx, dword [ebp - 0x6c]
add ecx, dword [eax]
xor eax, eax
cmp dword [edx + esi*4], ecx
setg al
xor ecx, ecx
cmp eax, 6
mov eax, dword [ebp - 0x18]
setge cl
sub ecx, eax
mov eax, dword [ebp - 0xc4]
mov dword [eax], ecx
dec dword [ebp - 0x20]
jns 0x429fa6
lea ecx, [ebp - 0xc4]
call fcn.00428c22
lea ecx, [ebp - 0x6c]
call fcn.00428c22
mov edi, dword [edi]
lea ecx, [ebp - 0xe0]
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0x9bf39019
push 4
call fcn.00428b50
mov dword [ebp - 0x24], 0xffffffff
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], 0xe6b93388
mov dword [ebp - 0x44], 0xfffffffd
mov dword [ebp - 0x10], 0
jmp 0x42a078
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x42a069
mov byte [ebp - 9], 0
cmp byte [ebp - 9], 0
je 0x42a08e
call dword [sym.imp.USER32.dll_EndMenu]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg eax
je 0x42a0cb
cmp dword [ebp - 0x14], 0
jne 0x42a0a1
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0xe0]
setne dl
sub edx, 5
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax]
setne cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + 4]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
je 0x42a0e0
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xe0]
imul eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
call fcn.00428c22
mov eax, dword [esi + 4]
lea ecx, [ebp - 0xd4]
push 3
mov dword [ebp - 0x44], eax
call fcn.00428b50
mov dword [ebp - 8], 0xfe4b2830
lea ecx, [ebp - 0xec]
push ebx
call fcn.00428b50
mov dword [ebp - 0x28], 0xfff8
xor eax, eax
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x1c], 0x5860
mov dword [ebp - 0x18], eax
jmp 0x42a14f
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx + edx*4], 0xfffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x42a13c
mov dword [ebp - 0x18], eax
jmp 0x42a169
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xec]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x42a15a
mov ecx, dword [ebp - 8]
push 2
pop edx
cmp edx, ecx
mov ecx, dword [ebp - 8]
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0xec]
setg bl
xor edx, edx
mov dword [ecx], ebx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xd4]
mov dword [ecx], 3
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ecx, 0x56e3
setne dl
xor ecx, ecx
cmp edx, 0xde46
setge cl
add ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x28]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xd4]
cmp dword [ecx], eax
je 0x42a2b5
mov dword [ebp - 0x3c], 0xb1b9b964
mov dword [ebp - 0x38], 0x830ae734
mov dword [ebp - 0x24], 0xfe605a42
mov dword [ebp - 0x1c], 0x11
jmp 0x42a231
mov dword [ebp - 0x28], 0xffffffff
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x3b
jl 0x42a209
xor ebx, ebx
inc ebx
mov dword [ebp - 8], 0x4cd0
cmp dword [ebp - 8], eax
je 0x42a249
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd4]
mov edx, dword [eax]
xor eax, eax
cmp edx, ebx
setl al
xor ecx, ecx
imul eax, eax, 5
cmp eax, edx
mov eax, dword [ebp - 0xec]
setg cl
mov dword [eax], ecx
lea ecx, [ebp - 0xec]
call fcn.00428c22
lea ecx, [ebp - 0xd4]
call fcn.00428c22
xor eax, eax
add esi, 8
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x14], eax
je 0x42a2df
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42a384
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x42a384
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x42a237
xor ebx, ebx
inc ebx
push ebx
push eax
push 0x2592
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
xor eax, eax
jmp 0x42a23a
mov dword [ebp - 0x28], 0xffffffff
push 2
mov dword [ebp - 0x24], 0x21210cbe
mov dword [ebp - 0x10], eax
pop edx
jmp 0x42a2ff
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x60], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x42a2f5
cmp dword [ebp - 0x14], eax
je 0x42a325
mov esi, dword [ebp - 0x14]
sub esi, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x14]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
sete dl
cmp edx, dword [ebp - 0x28]
mov edx, ebx
jne 0x42a327
mov edx, eax
mov ecx, 0x314a
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x60]
jne 0x42a351
mov ecx, eax
cmp dword [ebp - 0x14], eax
je 0x42a353
mov ecx, ebx
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], 0xfffd
jne 0x42a366
mov ecx, ebx
cmp dword [ebp - 0x5c], eax
jne 0x42a368
mov ecx, eax
mov eax, dword [ebp - 0x14]
sub ecx, eax
mov esi, dword [ebp - 0x1c]
xor eax, eax
sub ecx, 0x1701
cmp ecx, 0x4615
setle al
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x44], 0
jne 0x42a461
cmp byte [ebp - 0x3d], 0
je 0x42a3a2
cmp dword [ebp - 0x34], ebx
jne 0x42a3a2
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [esi]
mov dword [ebp - 0x24], eax
mov eax, dword [esi + 4]
add esi, 8
push edi
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], esi
call fcn.0047b122
mov dword [ebp - 0x38], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xac], eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0xac]
push eax
push edi
call fcn.0044ff85
mov ebx, dword [ebp - 0x78]
xor ecx, ecx
mov esi, ecx
test edi, edi
jle 0x42a42d
mov eax, esi
and eax, 0x80000001
jns 0x42a3f7
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x24]
add eax, esi
add eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x44]
jmp 0x42a40c
lea eax, [edx + 1]
cdq
idiv edi
cmp word [ebx + edx*2], cx
jne 0x42a409
xor eax, eax
inc eax
mov word [ebx + edx*2], ax
mov eax, dword [ebp - 0x1c]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x38]
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x42a3e9
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x38]
mov dword [esi], edi
mov dword [esi + 4], eax
test ebx, ebx
je 0x42a44e
push ebx
call fcn.0047dab6
pop ecx
xor ecx, ecx
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x74], ecx
mov dword [ebp - 0x70], ecx
xor ebx, ebx
inc ebx
mov dword [ebp - 0x14], 0xe83c7730
mov dword [ebp + 8], ecx
jmp 0x42a479
xor ecx, ecx
jmp 0x42a44e
mov esi, dword [ebp + 8]
xor ecx, ecx
jmp 0x42a451
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x15c], 0x4ec2
inc dword [ebp + 8]
cmp dword [ebp + 8], ebx
jl 0x42a468
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ecx
jl 0x42a49d
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x42a498
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
xor ecx, ecx
dec dword [ebp - 0x14]
jns 0x42a486
mov dword [ebp - 0x14], ecx
jmp 0x42a4b6
mov byte [ebp + 0xb], cl
cmp byte [ebp + 0xb], 0
je 0x42a4b3
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor ecx, ecx
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff1
jl 0x42a4a2
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret