Function at 0x41d011
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
push ebx
push esi
push edi
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x3c], 0
cmp dword [ebp + 0x18], 1
jge 0x41d049
mov dword [ebp + 0x18], 1
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x158], eax
jmp 0x41d163
mov dword [ebp - 0x78], 1
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x2c], 0xffffffff
je 0x41d129
lea eax, [ebp - 0xd8]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x2c]
push eax
push 0x65
mov eax, dword [ebp + 0xc]
push eax
call fcn.00476b89
add esp, 0x10
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0
jne 0x41d129
mov eax, dword [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 0x34]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
test byte [eax + 0xf4], 0x80
je 0x41d115
push 0
push 0x1000
mov eax, dword [ebp - 0x54]
add eax, 0x2c
push eax
call fcn.004e43fc
add esp, 0xc
mov eax, dword [ebp - 0x54]
mov dword [eax + 0xfc], 0
mov eax, dword [ebp - 0x54]
mov dword [eax + 0x100], 0
jmp 0x41d11c
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 0x78], 0
je 0x41d159
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x34], 0x13
jne 0x41d14f
mov eax, dword [ebp - 0x38]
mov dword [eax + 0x34], 0xe
jmp 0x41d159
mov eax, dword [ebp - 0x38]
mov dword [eax + 0x34], 0x21
jmp 0x41d182
cmp dword [ebp - 0x158], 0x13
je 0x41d067
cmp dword [ebp - 0x158], 0x1c
je 0x41d067
jmp 0x41d182
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa0]
add eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x8c]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x90]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x80]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x15c], eax
jmp 0x41d25f
mov dword [ebp - 0xf0], 6
mov dword [ebp - 0x118], 1
jmp case.0x41d281.5
mov dword [ebp - 0xf0], 0x10
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x3c], 1
jmp case.0x41d281.5
mov dword [ebp - 0xf0], 5
mov dword [ebp - 0x118], 1
mov dword [ebp - 0x3c], 1
jmp case.0x41d281.5
mov dword [ebp - 0xf0], 0x13
mov dword [ebp - 0x118], 1
jmp case.0x41d281.5
mov dword [ebp - 0xf0], 0xe
mov dword [ebp - 0x118], 1
jmp case.0x41d281.5
sub dword [ebp - 0x15c], 0x17
cmp dword [ebp - 0x15c], 0xa
ja case.0x41d281.5
mov eax, dword [ebp - 0x15c]
xor ecx, ecx
mov cl, byte [eax + 0x41d2a0]
jmp dword [ecx*4 + 0x41d288]
cmp dword [ebp - 0x3c], 0
je 0x41d2ee
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x8c]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
test eax, eax
jge 0x41d2ee
mov dword [ebp - 0x3c], 0
cmp dword [ebp + 0x18], 4
jne 0x41d35c
cmp dword [ebp - 0x50], 1
jne 0x41d35c
mov dword [ebp + 0x18], 2
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x160], eax
jmp 0x41d33d
mov dword [ebp - 0xf0], 5
jmp 0x41d35c
mov dword [ebp - 0xf0], 0xf
jmp 0x41d35c
cmp dword [ebp - 0x160], 3
je 0x41d31a
cmp dword [ebp - 0x160], 8
je 0x41d329
jmp 0x41d35c
mov eax, dword [ebp - 0x50]
cdq
idiv dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 0x18], 1
jle 0x41d37c
mov dword [ebp - 0xc], 2
jmp 0x41d383
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp + 0x18]
imul ecx, dword [ebp - 0x1c]
sub eax, ecx
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x41d39f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0xf0], 3
jne 0x41d3d6
mov dword [ebp - 0xc], 3
mov dword [ebp - 0x13c], 1
mov dword [ebp - 0x138], 2
mov dword [ebp - 0x134], 1
jmp 0x41d413
mov dword [ebp - 0x114], 0
jmp 0x41d3eb
inc dword [ebp - 0x114]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x114], eax
jge 0x41d413
mov eax, dword [ebp + 0x18]
cdq
idiv dword [ebp - 0xc]
mov ecx, dword [ebp - 0x114]
mov dword [ebp + ecx*4 - 0x13c], eax
jmp 0x41d3e5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x70]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx + 0x84]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx + 0x78]
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0xd0], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0xc8], 0
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x164], eax
jmp 0x41d64a
cmp dword [ebp - 0x50], 2
jle 0x41d4c0
mov dword [ebp - 0x68], 2
jmp 0x41d4d1
cmp dword [ebp - 0x50], 1
jle 0x41d4d1
mov dword [ebp - 0x68], 1
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
add eax, eax
add eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
jmp case.0x41d66c.12
mov dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x50]
add eax, eax
add eax, dword [ebp - 0x120]
dec eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
jmp case.0x41d66c.12
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x68], 1
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
jmp case.0x41d66c.12
mov dword [ebp - 0xcc], 1
mov dword [ebp - 0x68], 1
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x68]
add eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov dword [ebp - 0xd0], 1
jmp case.0x41d66c.12
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x40], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x64], eax
jmp case.0x41d66c.12
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], 2
mov dword [ebp - 0x120], 2
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x64], eax
jmp case.0x41d66c.12
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], 1
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x108], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x64], eax
jmp case.0x41d66c.12
mov dword [ebp - 0x110], 1
mov dword [ebp - 8], 1
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x108], 1
mov dword [ebp - 0x7c], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x88]
mov dword [ebp - 0x64], eax
jmp case.0x41d66c.12
sub dword [ebp - 0x164], 3
cmp dword [ebp - 0x164], 0x13
ja case.0x41d66c.12
mov eax, dword [ebp - 0x164]
xor ecx, ecx
mov cl, byte [eax + 0x41d6a7]
jmp dword [ecx*4 + 0x41d673]
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x2c], 0xffffffff
jne case.0x41d78f.5
cmp dword [ebp - 0x50], 1
jne case.0x41d78f.5
mov dword [ebp - 0x130], 1
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x168], eax
jmp 0x41d76d
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x8c]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41d72a
mov dword [ebp - 0x130], 0
jmp case.0x41d78f.5
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41d763
mov dword [ebp - 0x130], 0
jmp case.0x41d78f.5
sub dword [ebp - 0x168], 6
cmp dword [ebp - 0x168], 0x17
ja case.0x41d78f.5
mov eax, dword [ebp - 0x168]
xor ecx, ecx
mov cl, byte [eax + 0x41d7ae]
jmp dword [ecx*4 + 0x41d796]
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x9c], 0
je 0x41d7e3
cmp dword [ebp - 0x130], 0
je 0x41d7fb
mov dword [ebp - 8], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x120], 0
cmp dword [ebp - 0x4c], 0
je 0x41d85f
mov dword [ebp - 0x114], 0
jmp 0x41d81a
inc dword [ebp - 0x114]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x114], eax
jge 0x41d85a
xor eax, eax
mov ecx, dword [ebp - 0x114]
sub eax, dword [ebp + ecx*4 - 0x13c]
neg eax
sub dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jg 0x41d855
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x4c], eax
jmp 0x41d85a
jmp 0x41d814
jmp 0x41d866
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x114], 0
jmp 0x41d87b
inc dword [ebp - 0x114]
cmp dword [ebp - 0x114], 3
jge 0x41d8d1
mov dword [ebp - 0x10c], 0
jmp 0x41d89d
inc dword [ebp - 0x10c]
cmp dword [ebp - 0x10c], 4
jge 0x41d8cc
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x114]
shl ecx, 4
lea eax, [ecx + eax*4]
mov dword [ebp + eax - 0xac], 0
jmp 0x41d897
jmp 0x41d875
cmp dword [ebp - 0x110], 0
je 0x41d914
mov eax, dword [ebp - 0xf0]
sub eax, 0x13
cmp eax, 1
sbb eax, eax
neg eax
push eax
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xec]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.0041cdd0
add esp, 0x18
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x110], 0
je 0x41d936
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x18], eax
jmp 0x41d93d
mov dword [ebp - 0x18], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xf4], 0
jmp 0x41d95c
inc dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1c], eax
jle 0x41e052
mov dword [ebp - 0x14], 0x7fff
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0x128], 0
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x114], 0
jmp 0x41d9a5
inc dword [ebp - 0x114]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x114], eax
jge 0x41ddd4
cmp dword [ebp - 0x114], 0
je 0x41d9d4
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x140]
add dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x13c]
add eax, dword [ebp - 0x128]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x50]
jl 0x41da04
jmp 0x41ddd4
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jg 0x41da21
cmp dword [ebp - 0x118], 0
je 0x41dad6
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x50]
jg 0x41da83
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x124]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x128]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00421a80
add esp, 0x24
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x41da83
jmp 0x421688
cmp dword [ebp - 0xf0], 8
jne 0x41dad1
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x50]
jge 0x41dad1
push 1
push 0x4000
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x124]
add eax, dword [ebp - 0x120]
lea eax, [eax*4 - 4]
lea eax, [eax + eax*4]
add eax, dword [ebp - 4]
add eax, 0x10
push eax
call fcn.004e43fc
add esp, 0xc
jmp 0x41db27
cmp dword [ebp - 0x114], 0
jne 0x41db27
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00421a80
add esp, 0x24
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x41db27
jmp 0x421688
mov dword [ebp - 0x10c], 0
jmp 0x41db3c
inc dword [ebp - 0x10c]
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x10c]
cmp dword [ebp + eax*4 - 0x13c], ecx
jle 0x41dd50
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x128]
cmp eax, dword [ebp - 0x50]
jge 0x41db91
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x128]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
jmp 0x41db96
jmp 0x41dd50
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x10c], 0
jne 0x41dbba
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x40], 0
je 0x41dbd2
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x68]
mov dword [ebp - 0x14], eax
jmp 0x41dc69
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx + 4]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x74]
cmp dword [eax + 0xf0], 0
je 0x41dbfd
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0xf0]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x74]
cmp dword [eax + 0xe8], 0
je 0x41dc1d
xor eax, eax
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0xe8]
neg eax
sub dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x74]
test byte [eax + 0x2d], 0x20
jne 0x41dc3f
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x84]
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0x8c]
add dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0xe8]
add dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x78], eax
jge 0x41dc69
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x114], 0
jne 0x41dca7
mov eax, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 8]
cmp dword [ebp + eax*4 - 0xa8], ecx
jge 0x41dca2
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0x10c]
mov dword [ebp + ecx*4 - 0xa8], eax
jmp 0x41dd31
cmp dword [ebp - 0x10c], 1
jne 0x41dd31
cmp dword [ebp - 0xc], 3
jge 0x41dcf9
mov eax, dword [ebp - 0x114]
shl eax, 4
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
sub ecx, dword [ebp - 0x10]
cmp dword [ebp + eax - 0xa4], ecx
jge 0x41dcf4
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x114]
shl ecx, 4
mov dword [ebp + ecx - 0xa4], eax
jmp 0x41dd31
mov eax, dword [ebp - 0x114]
shl eax, 4
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 8]
sub ecx, dword [ebp - 0x10]
cmp dword [ebp + eax - 0xa4], ecx
jge 0x41dd31
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x114]
shl ecx, 4
mov dword [ebp + ecx - 0xa4], eax
cmp dword [ebp - 0x18], 0
jle 0x41dd4b
mov eax, dword [ebp - 0x18]
push eax
push 0
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x41db36
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jg 0x41dd7a
cmp dword [ebp - 0x118], 0
jne 0x41dd7a
cmp dword [ebp - 0x114], 0
jne 0x41dd86
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x24]
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x20]
cmp eax, dword [ebp - 0xb0]
jle 0x41ddb0
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x28]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x20]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x94]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa4]
add eax, dword [ebp - 0x38]
push eax
call fcn.00436768
add esp, 8
jmp 0x41d99f
cmp dword [ebp - 0x110], 0
je 0x41dde6
jmp 0x41dfc8
cmp dword [ebp - 0x5c], 0
je 0x41deee
cmp dword [ebp - 0xf4], 0
jne 0x41de3d
cmp dword [ebp - 0xc], 3
jge 0x41de3d
cmp dword [ebp - 0xcc], 0
jne 0x41de3d
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xb8]
push eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41dedd
cmp dword [ebp - 0xf0], 3
je 0x41de57
cmp dword [ebp - 0xcc], 0
je 0x41de75
cmp dword [ebp - 0xb8], 0
jne 0x41de75
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x84]
neg eax
mov dword [ebp - 0xb8], eax
push 0x2000
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
cmp dword [ebp - 0xc], 2
jle 0x41dedd
push 0
push 1
push 0
push 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0xb8], eax
jmp 0x41dfc8
cmp dword [ebp - 0x110], 0
jne 0x41dfc8
cmp dword [ebp - 0xf4], 0
jle 0x41df93
push 0x2000
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
cmp dword [ebp - 0xc], 2
jle 0x41df8e
push 0
push 1
push 0
push 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41dfbf
push 0x2001
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x7c]
neg eax
push eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xf4], 0
jne 0x41dfe1
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp + 0x18]
add dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xb0]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jle 0x41e01c
mov eax, dword [ebp - 0x64]
add dword [ebp - 0x18], eax
cmp dword [ebp - 0x5c], 0
jne 0x41e01c
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x84]
add dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x870
jg 0x41e033
cmp dword [ebp - 0x18], 0
jge 0x41e04d
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov dword [ebp - 0xd4], 0x67
jmp 0x421688
jmp 0x41d956
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0x1c], 1
jg 0x41e072
cmp dword [ebp - 0x118], 0
je 0x41e344
mov dword [ebp - 0xf4], 0
jmp 0x41e087
inc dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1c], eax
jle 0x41e33f
mov eax, dword [ebp + 0x18]
imul eax, dword [ebp - 0xf4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x58]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0x58]
add eax, 0x30
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0xd0], 0
jne 0x41e107
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx + 8]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x108], 0
je 0x41e102
mov dword [ebp - 0x78], 0
jmp 0x41e10e
mov dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0
je 0x41e249
xor eax, eax
sub eax, dword [ebp - 0x78]
neg eax
mov ecx, dword [ebp - 0x58]
sub dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x14], eax
push 0
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jne 0x41e15f
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x124], eax
jmp 0x41e16b
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x10c], 1
jmp 0x41e180
inc dword [ebp - 0x10c]
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x10c], eax
jge 0x41e249
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
push 0
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
cmp dword [ebp - 0x10c], 1
jne 0x41e1f5
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx + 8]
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jge 0x41e1f5
mov eax, dword [ebp - 0x6c]
neg eax
add dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x70]
sub ecx, dword [edx]
sub eax, ecx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jle 0x41e223
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
add dword [ebp - 0x6c], eax
jmp 0x41e22c
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x6c]
cmp dword [eax + 0x14], ecx
jge 0x41e244
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0x14], eax
jmp 0x41e17a
cmp dword [ebp - 0x5c], 0
jne 0x41e33a
mov eax, dword [ebp - 0x58]
add eax, 0x30
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x58]
test byte [eax + 0xf4], 4
je 0x41e2e2
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41e2e2
push 2
push 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0xf0]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx + 4]
sub eax, dword [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41e33a
push 2
push 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x58]
add eax, dword [ecx + 0xe8]
add eax, dword [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41e081
jmp 0x41e453
cmp dword [ebp - 0x5c], 0
jne 0x41e453
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
add eax, 0x30
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x58]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0x58]
test byte [eax + 0xf4], 4
je 0x41e3fe
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41e3fe
push 2
push 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0xf0]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx + 4]
sub eax, dword [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41e453
push 2
push 0
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x58]
add eax, dword [ecx + 0xe8]
add eax, dword [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
cmp dword [ebp - 0x13c], 1
jle 0x41e994
mov dword [ebp - 0xf4], 0
jmp 0x41e475
inc dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1c], eax
jle 0x41e994
mov eax, dword [ebp + 0x18]
imul eax, dword [ebp - 0xf4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
inc eax
cmp eax, dword [ebp - 0x50]
jge 0x41e98f
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x20]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x54]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x1c], 1
jle 0x41e505
mov eax, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx + 8]
mov dword [ebp - 0x78], eax
jmp 0x41e50c
mov dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0
jle 0x41e5f0
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jne 0x41e537
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x124], eax
jmp 0x41e543
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x10c], 1
jmp 0x41e558
inc dword [ebp - 0x10c]
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x10c], eax
jge 0x41e5f0
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
push 0
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x70]
sub ecx, dword [edx]
sub eax, ecx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jle 0x41e5ca
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
add dword [ebp - 0x6c], eax
jmp 0x41e5d3
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x6c]
cmp dword [eax + 0x14], ecx
jge 0x41e5eb
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0x14], eax
jmp 0x41e552
cmp dword [ebp - 0x110], 0
je 0x41e602
jmp 0x41e98f
cmp dword [ebp - 0x5c], 0
je 0x41e73f
cmp dword [ebp - 0xf4], 0
jne 0x41e630
cmp dword [ebp - 0xc], 3
jge 0x41e630
cmp dword [ebp - 0xcc], 0
je 0x41e63a
cmp dword [ebp - 8], 0
jne 0x41e648
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
mov dword [ebp - 0x14], eax
jmp 0x41e661
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x48]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x54]
test byte [eax + 0xf4], 4
je 0x41e70a
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41e70a
mov eax, dword [ebp - 0x54]
test byte [eax + 0xf5], 1
je 0x41e6cf
push 0
push 1
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41e705
push 0
push 1
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x54]
add eax, dword [ecx + 0x30]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41e73a
push 0
push 1
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41e98f
mov eax, dword [ebp - 0x54]
add eax, 0x30
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x54]
test byte [eax + 0xf4], 4
je 0x41e7cf
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41e7cf
push 2
push 0
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0xf0]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx + 4]
sub eax, dword [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41e828
push 2
push 0
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x54]
add eax, dword [ecx + 0xe8]
add eax, dword [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x58]
test byte [eax + 0xf4], 4
je 0x41e881
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41e881
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x60]
mov dword [ebp - 0x11c], eax
jmp 0x41e88d
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x64]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x54]
test byte [eax + 0xf4], 4
je 0x41e925
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41e925
push 0
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, dword [ebp - 0xf4]
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x54]
add eax, dword [ecx + 0x30]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0x11c]
sub eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41e98f
push 0
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, dword [ebp - 0xf4]
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x30]
mov ecx, dword [ebp - 0x54]
add eax, dword [ecx + 0x64]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0x11c]
sub eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41e46f
cmp dword [ebp - 0xc], 1
jle 0x41ebcd
cmp dword [ebp - 0x138], 1
jle 0x41ebcd
cmp dword [ebp - 0x1c], 1
jle 0x41ebcd
mov dword [ebp - 0xf4], 0
jmp 0x41e9ca
inc dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1c], eax
jle 0x41ebcd
mov eax, dword [ebp + 0x18]
imul eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x13c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x20], eax
jl 0x41e9fd
jmp 0x41ebcd
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jle 0x41ea44
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0x124], eax
jmp 0x41ea6a
mov eax, dword [ebp + 0x18]
imul eax, dword [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x10c], 1
jmp 0x41ea7f
inc dword [ebp - 0x10c]
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x10c], eax
jge 0x41ebc8
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x50]
jl 0x41eaa8
jmp 0x41ebc8
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x10c], 1
jne 0x41eb5a
cmp dword [ebp - 0xc], 3
jge 0x41eb1f
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jle 0x41eb04
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx]
mov dword [ebp - 0x78], eax
jmp 0x41eb1a
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
mov edx, dword [ebp - 0x54]
sub ecx, dword [edx + 0x30]
sub eax, ecx
mov dword [ebp - 0x78], eax
jmp 0x41eb5a
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jle 0x41eb43
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx + 8]
mov dword [ebp - 0x78], eax
jmp 0x41eb5a
mov eax, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x54]
sub ecx, dword [edx + 0x30]
sub eax, ecx
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jle 0x41ebc3
push 0
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x70]
sub ecx, dword [edx]
sub eax, ecx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jle 0x41eba2
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
add dword [ebp - 0x6c], eax
jmp 0x41ebab
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x6c]
cmp dword [eax + 0x14], ecx
jge 0x41ebc3
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0x14], eax
jmp 0x41ea79
jmp 0x41e9c4
mov dword [ebp - 0x128], 0
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x114], 0
jmp 0x41ebf6
inc dword [ebp - 0x114]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x114], eax
jge 0x41f2bc
cmp dword [ebp - 0xc], 1
jne 0x41ec64
cmp dword [ebp - 0xd0], 0
je 0x41ec2d
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
mov dword [ebp - 0xac], eax
jmp 0x41ec64
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xa8], eax
jle 0x41ec4b
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0x108], 0
jne 0x41ec64
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
add dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x13c]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x118], 0
je 0x41ec9c
cmp dword [ebp - 0x110], 0
jne 0x41ec9c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x60], eax
jmp 0x41eca3
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0xf4], 0
jmp 0x41ecb8
inc dword [ebp - 0xf4]
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xf4], eax
jge 0x41ef01
mov eax, dword [ebp + 0x18]
imul eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x128]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x20], eax
jl 0x41eceb
jmp 0x41ef01
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0xc], 1
jne 0x41edfe
cmp dword [ebp - 0xd0], 0
je 0x41ed73
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xb0], 0
je 0x41ed6e
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xbc], 0
jge 0x41ed6e
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xbc]
push eax
call fcn.00522431
add esp, 4
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x18], eax
jmp 0x41edd9
cmp dword [ebp - 0x108], 0
jne 0x41edd9
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xb0], 0
je 0x41edd9
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xbc], 0
jle 0x41edd9
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xbc]
push eax
call fcn.00522431
add esp, 4
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x14], eax
cmp dword [ebp - 0x110], 0
je 0x41edfe
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x14], eax
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x114]
shl eax, 4
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx + 0x14]
cmp dword [ebp + eax - 0xa0], ecx
jge 0x41ee30
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x114]
shl ecx, 4
mov dword [ebp + ecx - 0xa0], eax
cmp dword [ebp - 0x114], 0
jle 0x41ee54
mov eax, dword [ebp - 0x58]
cmp dword [eax + 0x18], 0
jge 0x41ee54
mov eax, dword [ebp - 0x58]
mov dword [eax + 0x18], 0
mov dword [ebp - 0x10c], 1
jmp 0x41ee69
inc dword [ebp - 0x10c]
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x10c], eax
jge 0x41eeca
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0x58]
cmp eax, dword [ecx + 0x18]
jle 0x41eec5
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0x18], eax
jmp 0x41ee63
mov eax, dword [ebp - 0x114]
shl eax, 4
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx + 0x18]
cmp dword [ebp + eax - 0xac], ecx
jge 0x41eefc
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x114]
shl ecx, 4
mov dword [ebp + ecx - 0xac], eax
jmp 0x41ecb2
mov eax, dword [ebp - 0x1c]
dec eax
imul eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x128]
add dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x13c]
add dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x20], eax
jge 0x41f292
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0xc], 1
jne 0x41f10a
cmp dword [ebp - 0xd0], 0
je 0x41f026
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x18], eax
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov dword [ebp - 0xbc], ecx
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xb0], 0
je 0x41eff2
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xbc], 0
jge 0x41eff2
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xbc]
push eax
call fcn.00522431
add esp, 4
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x18], eax
xor ebx, ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xbc]
push eax
call fcn.00522431
add esp, 4
sub ebx, eax
neg ebx
sub dword [ebp - 0xbc], ebx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x7c]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
cmp ecx, dword [ebp - 0xbc]
jle 0x41f021
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
add dword [ebp - 0xbc], eax
jmp 0x41f0e5
cmp dword [ebp - 0x108], 0
jne 0x41f0e5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x14], eax
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov dword [ebp - 0xbc], ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xb0], 0
je 0x41f0c7
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xbc], 0
jle 0x41f0c7
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xbc]
push eax
call fcn.00522431
add esp, 4
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x14], eax
xor ebx, ebx
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xbc]
push eax
call fcn.00522431
add esp, 4
sub ebx, eax
neg ebx
sub dword [ebp - 0xbc], ebx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xbc]
cmp dword [eax + 0x7c], ecx
jle 0x41f0e5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
add dword [ebp - 0xbc], eax
cmp dword [ebp - 0x110], 0
je 0x41f10a
mov eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x14], eax
mov eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x13c]
add eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x124], eax
jl 0x41f13a
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x124]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, dword [ebp - 0x114]
jle 0x41f1ac
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0x58]
sub eax, dword [ecx + 0x30]
mov ecx, dword [ebp - 0x114]
shl ecx, 4
cmp eax, dword [ebp + ecx - 0xa0]
jle 0x41f1a7
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0x58]
sub eax, dword [ecx + 0x30]
mov ecx, dword [ebp - 0x114]
shl ecx, 4
mov dword [ebp + ecx - 0xa0], eax
jmp 0x41f21b
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x70]
sub ecx, dword [edx]
sub eax, ecx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jle 0x41f1da
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
add dword [ebp - 0x6c], eax
jmp 0x41f1e3
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x114]
shl eax, 4
mov ecx, dword [ebp - 0x6c]
mov edx, dword [ebp - 0x58]
sub ecx, dword [edx + 0x30]
cmp dword [ebp + eax - 0xa0], ecx
jge 0x41f21b
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x58]
sub eax, dword [ecx + 0x30]
mov ecx, dword [ebp - 0x114]
shl ecx, 4
mov dword [ebp + ecx - 0xa0], eax
cmp dword [ebp - 0x114], 0
jle 0x41f286
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x30]
sub eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x58]
sub eax, dword [ecx + 0x18]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x7c]
add ecx, ecx
sub eax, ecx
mov ecx, dword [ebp - 0x114]
shl ecx, 4
cmp eax, dword [ebp + ecx - 0xac]
jle 0x41f286
mov eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx + 0x7c]
add ecx, ecx
sub eax, ecx
mov ecx, dword [ebp - 0x114]
shl ecx, 4
mov dword [ebp + ecx - 0xac], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x114], 0
jle 0x41f2b7
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
add eax, eax
mov ecx, dword [ebp - 0x114]
shl ecx, 4
add dword [ebp + ecx - 0xac], eax
jmp 0x41ebf0
cmp dword [ebp - 0x110], 0
je 0x41f321
mov eax, dword [ebp - 0xe0]
add dword [ebp - 0xb0], eax
cmp dword [ebp - 0xd0], 0
je 0x41f304
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov dword [ebp - 0xbc], ecx
jmp 0x41f321
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
cdq
sub eax, edx
sar eax, 1
sub ecx, eax
mov dword [ebp - 0xbc], ecx
cmp dword [ebp - 0xc], 1
jle 0x42017f
mov dword [ebp - 0xf4], 0
jmp 0x41f340
inc dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1c], eax
jle 0x42017f
mov dword [ebp - 0xb4], 0
mov eax, dword [ebp + 0x18]
imul eax, dword [ebp - 0xf4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x114], 1
jmp 0x41f38e
inc dword [ebp - 0x114]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x114], eax
jge 0x42017a
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x20], eax
jl 0x41f3ae
jmp 0x42017a
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x140]
add dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x140]
mov ecx, dword [ebp - 0x114]
dec ecx
shl ecx, 4
lea eax, [ecx + eax*4]
mov eax, dword [ebp + eax - 0xac]
add eax, dword [ebp - 0xb4]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x114]
dec eax
shl eax, 4
mov eax, dword [ebp + eax - 0xa0]
add eax, dword [ebp - 0xb4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x114]
shl eax, 4
mov eax, dword [ebp + eax - 0xac]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x20], eax
jge 0x41f5cc
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp + eax*4 - 0x13c]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jne 0x41f4d2
mov eax, dword [ebp - 0x50]
sub eax, dword [ebp - 0x20]
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
xor eax, eax
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0x30]
neg eax
sub dword [ebp - 0x78], eax
cmp dword [ebp - 0x20], 0
jle 0x41f4d2
mov eax, dword [ebp - 0x20]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
add eax, eax
mov ecx, dword [ebp - 0x54]
add eax, dword [ecx + 0x38]
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0x30]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x78], eax
jge 0x41f4d2
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jle 0x41f5c7
mov dword [ebp - 0x10c], 0
jmp 0x41f4f1
inc dword [ebp - 0x10c]
mov eax, dword [ebp - 0x124]
cmp dword [ebp - 0x10c], eax
jge 0x41f5c7
mov eax, dword [ebp - 0x10c]
add eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
push 0
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x70]
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
cmp dword [ebp - 0x78], 0
jle 0x41f5c2
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jne 0x41f5a3
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx + 8]
mov edx, dword [ebp - 0x70]
sub ecx, dword [edx]
sub eax, ecx
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jle 0x41f57d
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
add dword [ebp - 0x6c], eax
jmp 0x41f586
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x6c]
cmp dword [eax + 0x14], ecx
jge 0x41f59e
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0x14], eax
jmp 0x41f5c2
cmp dword [ebp - 0x10c], 0
jne 0x41f5c2
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x14]
add eax, dword [ebp - 0xb4]
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0x14], eax
jmp 0x41f4eb
jmp 0x41f61f
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x114], 1
jle 0x41f61f
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x1c]
dec ecx
imul ecx, dword [ebp + 0x18]
sub eax, ecx
cmp eax, 2
jne 0x41f61f
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x42017a
cmp dword [ebp - 0x110], 0
je 0x41f631
jmp 0x420175
cmp dword [ebp - 0x5c], 0
je 0x41faa7
cmp dword [ebp - 0xf4], 0
jne 0x41f65f
cmp dword [ebp - 0xc], 3
jge 0x41f65f
cmp dword [ebp - 0xcc], 0
je 0x41f669
cmp dword [ebp - 8], 0
jne 0x41f675
mov dword [ebp - 0x18], 0
jmp 0x41f68c
mov eax, dword [ebp - 0x114]
dec eax
imul eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x20], eax
jne 0x41f6e6
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, dword [ebp - 0x114]
jne 0x41f70f
cmp dword [ebp - 0x3c], 0
jne 0x41f70f
mov dword [ebp - 0x150], 1
jmp 0x41f719
mov dword [ebp - 0x150], 0
push 0x2000
mov eax, dword [ebp - 0x150]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x20]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0x74]
test byte [eax + 0xf4], 4
je 0x41f835
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41f835
mov eax, dword [ebp - 0x74]
test byte [eax + 0xf5], 1
je 0x41f7f0
push 0
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0x38]
add eax, dword [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41f830
push 0
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0x38]
mov ecx, dword [ebp - 0x74]
add eax, dword [ecx + 0x60]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41f869
push 1
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc0]
sub eax, dword [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x20], eax
jge 0x41f97f
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x54]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0x54]
test byte [eax + 0xf4], 4
je 0x41f94c
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41f94c
mov eax, dword [ebp - 0x54]
test byte [eax + 0xf5], 1
je 0x41f914
push 0
push 1
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x60]
add eax, eax
add eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41f947
push 0
push 1
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x60]
add eax, dword [ebp - 0xb4]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41f97f
push 2
push 1
mov eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0xb4]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x114]
cmp dword [ebp + eax*4 - 0x13c], 1
jle 0x41faa2
mov eax, dword [ebp - 0x20]
inc eax
cmp eax, dword [ebp - 0x50]
jge 0x41faa2
cmp dword [ebp - 0xc], 3
jge 0x41faa2
mov eax, dword [ebp - 0x20]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
test byte [eax + 0xf4], 4
je 0x41fa71
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41fa71
mov eax, dword [ebp - 0x74]
test byte [eax + 0xf5], 1
je 0x41fa35
push 0
push 1
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x60]
add eax, eax
mov ecx, dword [ebp - 0x74]
add eax, dword [ecx + 0x30]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41fa6c
push 0
push 1
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x74]
add eax, dword [ecx + 0x30]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41faa2
push 0
push 1
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x38]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x420175
mov dword [ebp - 0x78], 0
cmp dword [ebp - 0xf4], 0
jne 0x41face
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x78], 1
jmp 0x41fae5
mov eax, dword [ebp - 0x114]
dec eax
imul eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx]
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x20], eax
jne 0x41fb3f
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x78]
or eax, 0x2000
push eax
mov eax, dword [ebp - 0xc]
dec eax
sub eax, dword [ebp - 0x114]
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x20]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
cmp dword [ebp + 0x18], 2
je 0x41fbb1
cmp dword [ebp + 0x18], 4
jne 0x41fbd5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0
jmp 0x41fbdc
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x74]
test byte [eax + 0xf4], 4
je 0x41fcab
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41fcab
mov eax, dword [ebp - 0x74]
test byte [eax + 0xf5], 1
je 0x41fc5d
push 0
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, dword [ebp - 0xf4]
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
dec eax
add eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41fca6
push 0
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, dword [ebp - 0xf4]
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
sub eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
dec eax
add eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x41fcf4
push 0
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, dword [ebp - 0xf4]
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
sub eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
dec eax
add eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x20], eax
jge 0x420175
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x74]
test byte [eax + 0xf4], 4
je 0x41fe11
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41fe11
push 0
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, dword [ebp - 0xf4]
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
push 0
xor eax, eax
cmp dword [ebp - 0x114], 0
setg al
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0xf0]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx + 4]
sub eax, dword [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x60]
mov dword [ebp - 0x11c], eax
jmp 0x41fec5
push 0
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, dword [ebp - 0xf4]
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
push 2
xor eax, eax
cmp dword [ebp - 0x114], 0
setg al
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x74]
add eax, dword [ecx + 0xe8]
add eax, dword [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x64]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x114]
cmp dword [ebp + eax*4 - 0x13c], 1
jle 0x42013a
mov eax, dword [ebp - 0x20]
inc eax
cmp eax, dword [ebp - 0x50]
jge 0x42013a
mov eax, dword [ebp - 0x20]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x74]
test byte [eax + 0xf4], 4
je 0x41ffae
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x41ffae
push 0
xor eax, eax
cmp dword [ebp - 0x114], 1
setg al
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0xf0]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx + 4]
sub eax, dword [ebp - 0x140]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x420012
push 2
xor eax, eax
cmp dword [ebp - 0x114], 1
setg al
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x64]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x74]
add eax, dword [ecx + 0xe8]
add eax, dword [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 4]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x74]
test byte [eax + 0xf4], 4
je 0x4200ca
mov eax, dword [ebp - 0x74]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x4200ca
push 0
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, dword [ebp - 0xf4]
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x74]
add eax, dword [ecx + 0x30]
add eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x420135
push 0
mov eax, dword [ebp - 0x1c]
dec eax
sub eax, dword [ebp - 0xf4]
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x30]
mov ecx, dword [ebp - 0x74]
add eax, dword [ecx + 0x64]
add eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x34]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x84]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
inc eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x420175
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x50]
add ecx, dword [ebp - 0x120]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 4]
add dword [ecx + edx + 0xc], eax
jmp 0x41f388
jmp 0x41f33a
mov eax, dword [ebp - 0x1c]
dec eax
imul eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10c], eax
jmp 0x4201b1
inc dword [ebp - 0x10c]
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x10c], eax
jge 0x42020c
mov eax, dword [ebp - 0x10c]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0x58]
cmp eax, dword [ecx + 0x18]
jle 0x420207
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x18]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx]
mov ecx, dword [ebp - 0x58]
mov dword [ecx + 0x18], eax
jmp 0x4201ab
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xac]
cmp dword [eax + 0x18], ecx
jle 0x42022a
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0x1c], 1
jne 0x420282
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, dword [ebp - 0x4c]
jle 0x420282
mov eax, dword [ebp - 0x50]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0x38]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x78]
cmp dword [eax + 0x7c], ecx
jle 0x420282
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
sub eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x58]
add dword [ecx + 0x14], eax
cmp dword [ebp - 0xc], 1
jne 0x420715
mov dword [ebp - 0xf4], 0
jmp 0x4202a1
inc dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x1c], eax
jle 0x420715
mov eax, dword [ebp + 0x18]
imul eax, dword [ebp - 0xf4]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00421db4
add esp, 8
cmp dword [ebp - 0xf4], 0
jne 0x4202fd
cmp dword [ebp - 0xcc], 0
je 0x42031a
cmp dword [ebp - 0x110], 0
jne 0x42031a
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x9c], 0
jne 0x420326
mov dword [ebp - 0x18], 0
jmp 0x420332
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx]
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0x110], 0
je 0x420446
cmp dword [ebp - 0xc8], 0
je 0x4203e7
mov eax, dword [ebp - 0x50]
dec eax
cmp eax, dword [ebp - 0xf4]
jle 0x4203e7
mov eax, dword [ebp - 0x58]
add eax, 0x30
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x64]
cdq
sub eax, edx
sar eax, 1
add ecx, eax
mov dword [ebp - 0x14], ecx
push 0
push 0
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0xe4]
push eax
mov eax, dword [ebp - 0xac]
neg eax
add eax, dword [ebp - 0xec]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xf4]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x420441
cmp dword [ebp - 0xf0], 0x13
jne 0x420441
mov dword [ebp - 0x7c], 2
push 0
push 0
mov eax, dword [ebp - 0xa0]
sub eax, dword [ebp - 0xe4]
add eax, dword [ebp - 0xfc]
push eax
mov eax, dword [ebp - 0xac]
neg eax
add eax, dword [ebp - 0xec]
sub eax, dword [ebp - 0x104]
push eax
mov eax, dword [ebp - 0x7c]
neg eax
push eax
mov eax, dword [ebp - 0x7c]
neg eax
push eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x420710
cmp dword [ebp - 0xd0], 0
je 0x4205b4
mov eax, dword [ebp - 0x58]
add eax, 0x30
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x58]
test byte [eax + 0xf4], 4
je 0x42050e
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x42050e
mov eax, dword [ebp - 0x58]
test byte [eax + 0xf5], 1
je 0x4204d2
push 0
push 1
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
sub eax, dword [ebp - 0x144]
push eax
mov eax, dword [ebp - 0xbc]
neg eax
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x420509
push 0
push 1
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0xbc]
neg eax
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x420545
push 2
push 1
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
add eax, dword [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0xbc]
neg eax
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jne 0x42057b
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x78], 0
push 0
push 0
mov eax, dword [ebp - 0xbc]
neg eax
push eax
mov eax, dword [ebp - 0xbc]
neg eax
push eax
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x420710
mov eax, dword [ebp - 0x58]
add eax, 0x30
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x58]
test byte [eax + 0xf4], 4
je 0x42066a
mov eax, dword [ebp - 0x58]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x42066a
mov eax, dword [ebp - 0x58]
test byte [eax + 0xf5], 1
je 0x420630
push 0
push 1
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax]
sub eax, dword [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x420665
push 0
push 1
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 0x70]
add eax, dword [ecx]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x4206a0
push 1
push 1
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
sub eax, dword [ebp - 0x144]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x1c]
dec eax
cmp eax, dword [ebp - 0xf4]
jne 0x4206d6
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x78], 0
push 0x2000
cmp dword [ebp - 0x3c], 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x42029b
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x114], 1
jmp 0x420742
inc dword [ebp - 0x114]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x114], eax
jge 0x42077c
mov eax, dword [ebp - 0x114]
shl eax, 4
mov eax, dword [ebp + eax - 0xa0]
mov ecx, dword [ebp - 0x114]
shl ecx, 4
add eax, dword [ebp + ecx - 0xac]
add dword [ebp - 0xc4], eax
jmp 0x42073c
mov eax, dword [ebp - 0x1c]
dec eax
imul eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc4]
cmp dword [eax + 0x14], ecx
jle 0x4207b2
mov eax, dword [ebp - 0x58]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x50], eax
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x18], eax
cmp dword [ebp - 0xcc], 0
je 0x420980
mov eax, dword [ebp - 0xa8]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x14], eax
cmp dword [ebp - 8], 0
jle 0x42097b
push 0
mov eax, dword [ebp - 0xf0]
sub eax, 0xc
cmp eax, 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x84]
neg eax
push eax
mov eax, dword [ebp - 0x7c]
neg eax
push eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x6c], 0
cmp dword [ebp - 0xd0], 0
je 0x42089f
mov eax, dword [ebp - 0x48]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x38]
mov dword [eax + 0x58], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x78], 0
jmp 0x4208e9
mov eax, dword [ebp - 0x48]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x58], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x6c], 0
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x2c], 0xffffffff
jne 0x42093a
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x42097b
push 0x2000
push 0
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0x6c]
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x84]
neg eax
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x84]
neg eax
push eax
mov eax, dword [ebp - 8]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x421087
cmp dword [ebp - 0x108], 0
je 0x420a08
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x50]
cdq
sub eax, edx
sar eax, 1
sub eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x14], eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00421db4
add esp, 8
cmp dword [ebp - 0xf0], 0xe
jne 0x420a03
push 3
push 0
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x148]
push eax
mov eax, dword [ebp - 0x7c]
neg eax
push eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x421087
cmp dword [ebp - 0xd0], 0
je 0x420a28
mov eax, dword [ebp - 0xbc]
neg eax
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x14], eax
jmp 0x421087
cmp dword [ebp + 0x18], 1
jne 0x420a43
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x14], eax
jmp 0x421087
cmp dword [ebp - 0xc], 3
jge 0x420c8e
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
add eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x14], eax
cmp dword [ebp - 0x1c], 1
jne 0x420c89
cmp dword [ebp + 0x18], 2
je 0x420a7d
cmp dword [ebp - 0x50], 2
jge 0x420a93
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
jmp 0x420aa4
push 1
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx + 0x7c]
mov ecx, dword [ebp - 0x38]
cmp eax, dword [ecx + 0x14]
jle 0x420ace
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx + 0x7c]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa0]
add eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x9c], 0
je 0x420c89
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
cmp dword [ebp - 0x5c], 0
je 0x420bd5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
cmp dword [ebp - 0x50], 1
jle 0x420bd0
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
push 1
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x54]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x30]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 0x54]
test byte [eax + 0xf4], 4
je 0x420bc4
mov eax, dword [ebp - 0x54]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004385d2
add esp, 8
cmp eax, 0xffffffff
je 0x420bc4
mov eax, dword [ebp - 0x54]
test byte [eax + 0xf5], 1
je 0x420bb3
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x60]
add eax, eax
sub eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 4]
add dword [ecx + 0x34], eax
jmp 0x420bbf
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x60]
mov ecx, dword [ebp - 4]
add dword [ecx + 0x34], eax
jmp 0x420bd0
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 4]
add dword [ecx + 0x34], eax
jmp 0x420c89
cmp dword [ebp + 0x18], 2
jne 0x420c22
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx*4 + 4]
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 4]
mov dword [ecx + edx + 0xc], eax
cmp dword [ebp - 0x50], 1
jle 0x420c1d
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx*4 + 8]
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 4]
mov dword [ecx + edx + 4], eax
jmp 0x420c89
cmp dword [ebp - 0x50], 1
jne 0x420c4b
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx*4 + 4]
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 4]
mov dword [ecx + edx + 0xc], eax
jmp 0x420c89
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx*4 + 8]
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 4]
mov dword [ecx + edx + 0xc], eax
cmp dword [ebp - 0x50], 2
jle 0x420c89
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx*4 + 0xc]
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 4]
mov dword [ecx + edx + 4], eax
jmp 0x421087
mov eax, dword [ebp - 0x48]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x50], 2
jle 0x420d0b
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x48]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx + 4]
mov dword [ebp - 0xc0], eax
push 1
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
push 2
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0x30]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ecx + 0x30]
add ecx, eax
mov eax, dword [ebp - 0x38]
mov dword [eax + 0x14], ecx
jmp 0x420d63
cmp dword [ebp - 0x50], 2
jne 0x420d3d
push 1
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp - 0x38]
add eax, dword [ecx + 0x7c]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x14], eax
jmp 0x420d57
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x1c], 1
jne 0x420f1a
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x38]
sub eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x20], eax
cmp dword [ebp - 0x50], 1
jle 0x420dfe
push 1
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x34], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x48]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 4]
mov dword [ecx + edx + 4], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x48]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 4]
mov dword [ecx + edx + 0xc], eax
cmp dword [ebp - 0x50], 2
jle 0x420f1a
push 2
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x38]
sub eax, dword [ebp - 0x144]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x40], eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x48], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x48]
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0x50], 3
jle 0x420ee8
push 3
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00421db4
add esp, 8
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x54], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x30]
add eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x5c], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x48]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 4]
mov dword [ecx + edx + 4], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x48]
shl ecx, 2
lea ecx, [ecx + ecx*4]
mov edx, dword [ebp - 4]
mov dword [ecx + edx + 0xc], eax
push 0
xor eax, eax
cmp dword [ebp - 0x50], 2
setle al
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x84]
neg eax
push eax
mov eax, dword [ebp - 0x7c]
neg eax
push eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
cmp dword [ebp - 0x68], 0
jle 0x420fd5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x78], 0
push 0
push 0
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
add eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x84]
neg eax
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x84]
neg eax
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x68]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0x10]
add eax, 0xa
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x58], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x5c], eax
cmp dword [ebp - 0x68], 1
jle 0x42104e
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x78], 0
push 0x2000
push 0
mov eax, dword [ebp - 0x78]
add eax, dword [ebp - 0xc0]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x84]
neg eax
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x84]
neg eax
push eax
mov eax, dword [ebp - 8]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 0xc0]
sub eax, 0xa
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x5c], eax
mov eax, dword [ebp - 0x50]
cdq
xor eax, edx
sub eax, edx
and eax, 3
xor eax, edx
sub eax, edx
cmp eax, 1
jne 0x421087
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x1c]
add eax, eax
add eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
cmp dword [ebp - 0x110], 0
je 0x421270
cmp dword [ebp - 0x108], 0
jne 0x421270
mov eax, dword [ebp - 0x50]
dec eax
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x3c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x78]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x78], 0
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xb0], 0
je 0x421151
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xbc], 0
jge 0x421126
cmp dword [ebp - 0xd0], 0
je 0x421126
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xbc]
neg eax
mov dword [ebp - 0x78], eax
jmp 0x421151
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0xbc], 0
jle 0x421151
cmp dword [ebp - 0xd0], 0
jne 0x421151
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xbc]
neg eax
mov dword [ebp - 0x78], eax
push 1
cmp dword [ebp - 0xd0], 1
sbb eax, eax
neg eax
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
add eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
add eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0x7c]
neg eax
push eax
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
push 0
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x74]
push eax
call fcn.00421db4
add esp, 8
cmp dword [ebp - 0xd0], 0
je 0x4211ec
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
add eax, dword [ebp - 0x78]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x7c]
add eax, dword [ebp - 0x14c]
add eax, dword [ebp - 0x10]
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x6c], 2
jmp 0x421217
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x14]
add eax, dword [ebp - 0x78]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x7c]
sub eax, dword [ebp - 0x144]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x6c], 0x2001
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x2c], 0xffffffff
je 0x421256
mov eax, dword [ebp - 0x6c]
push eax
push 1
mov eax, dword [ebp - 0xc0]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xb8]
push eax
mov eax, dword [ebp - 0xb8]
push eax
push 1
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
jmp 0x421270
push 0
push 1
push 0
push 0
push 0
push 0
push 1
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436918
add esp, 0x20
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x98], eax
cmp dword [ebp - 0x110], 0
je 0x421437
push 0
mov eax, dword [ebp - 0x38]
push eax
push 0
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp - 0xc4]
push eax
mov eax, dword [ebp - 0x12c]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x94]
push eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa4]
add eax, dword [ebp - 0x38]
push eax
call fcn.004360fd
add esp, 0x20
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0xa4]
add eax, dword [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436bf7
add esp, 8
cmp dword [ebp - 0x108], 0
je 0x421432
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x24]
mov ecx, dword [ebp - 0x38]
sub eax, dword [ecx + 0x1c]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0xf4], 0
jmp 0x421312
inc dword [ebp - 0xf4]
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x50], eax
jle 0x421432
mov eax, dword [ebp - 0xf4]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0x18]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0xec], eax
jle 0x421361
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x74]
test byte [eax + 0xf5], 1
jne 0x42142d
mov eax, dword [ebp - 0x74]
mov eax, dword [eax + 0xa8]
mov dword [ebp - 0x16c], eax
jmp 0x42140e
push 0
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x42142d
push 0
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x24]
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0x14]
push eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x42142d
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0x14]
sub eax, dword [ebp - 0x11c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0x6c], eax
push 0
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x74]
sub eax, dword [ecx + 0x30]
add eax, dword [ebp - 0x11c]
push eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x42142d
cmp dword [ebp - 0x16c], 0
je 0x421385
cmp dword [ebp - 0x16c], 2
je 0x4213a6
jmp 0x4213c7
jmp 0x42130c
jmp 0x42149a
cmp dword [ebp + 0x18], 1
jne 0x42145d
cmp dword [ebp - 0xd0], 0
jne 0x42145d
mov dword [ebp - 0x154], 1
jmp 0x421467
mov dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x154]
push eax
mov eax, dword [ebp - 0xd0]
push eax
mov eax, dword [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0xb0]
add eax, dword [ebp - 0x7c]
push eax
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.00436eb0
add esp, 0x1c
mov eax, dword [ebp - 0x38]
add eax, 0x1c
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx + 4]
cmp eax, 0xb40
jg 0x4214d0
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx]
cmp eax, 0xb40
jle 0x4214e5
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x38]
mov ecx, dword [ebp + 0x1c]
mov dword [ecx], eax
mov dword [ebp - 0xd4], 0x67
cmp dword [ebp - 0x118], 0
je case.0x42164b.5
cmp dword [ebp - 0xd4], 0
jne case.0x42164b.5
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x38]
push eax
call fcn.004379c0
add esp, 8
mov dword [ebp - 0x74], eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x74]
add eax, 0x30
push eax
call dword [sym.imp.USER32.dll_SetRect]
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x74]
add eax, 0xe4
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x74]
mov dword [eax + 0x60], 0
mov eax, dword [ebp - 0x74]
mov dword [eax + 0x64], 0
mov eax, dword [ebp - 0x74]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x34]
mov dword [ebp - 0x170], eax
jmp 0x421629
cmp dword [ebp - 0x1c], 1
jne 0x421581
mov dword [ebp - 0x6c], 0
jmp 0x42158b
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x6c]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx + 8]
push eax
mov eax, dword [ebp - 0x6c]
shl eax, 2
lea eax, [eax + eax*4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + ecx + 4]
push eax
mov eax, dword [ebp - 0x74]
add eax, 0x30
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
jmp case.0x42164b.5
mov eax, dword [ebp - 0x38]
add eax, 0x1c
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 0x70]
mov eax, dword [eax + 8]
mov ecx, dword [ebp - 0x70]
sub eax, dword [ecx]
cdq
sub eax, edx
sar eax, 1
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ecx]
add ecx, eax
push ecx
mov eax, dword [ebp - 0x74]
add eax, 0x30
push eax
call dword [sym.imp.USER32.dll_OffsetRect]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x1c]
add eax, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x74]
mov dword [ecx + 0xe4], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 0x24]
sub eax, dword [ebp - 0xe4]
mov ecx, dword [ebp - 0x74]
mov dword [ecx + 0xec], eax
jmp case.0x42164b.5
sub dword [ebp - 0x170], 0x17
cmp dword [ebp - 0x170], 0xa
ja case.0x42164b.5
mov eax, dword [ebp - 0x170]
xor ecx, ecx
mov cl, byte [eax + 0x42166a]
jmp dword [ecx*4 + 0x421652]
push 0
push 2
mov eax, dword [ebp - 0x38]
add eax, 0x10
push eax
call fcn.004e43fc
add esp, 0xc
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
cmp dword [ebp - 0x118], 0
je 0x4216dc
cmp dword [ebp - 0xd4], 0
jne 0x4216dc
cmp dword [ebp - 0x78], 0xffffffff
je 0x4216dc
mov eax, dword [ebp + 0x20]
push eax
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 0x78]
push eax
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.004216ec
add esp, 0x18
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
jmp 0x4216e7
pop edi
pop esi
pop ebx
leave
ret