Function at 0x4017ed
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa20
push ebx
push esi
push edi
push 3
pop edi
mov dword [ebp - 0x54], ecx
lea ecx, [ebp - 0x3f4]
mov dword [ebp - 0x14], 9
push edi
mov byte [ebp - 0x41], dl
call fcn.00410610
mov esi, 0x74da8628
xor ebx, ebx
push 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x401838
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2d4], 0x10c9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x401827
mov dword [ebp - 0xc], ebx
jmp 0x401855
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x3f4]
mov dword [eax + ecx*4], 0x9275
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x401842
mov dword [ebp - 0x14], edi
push 1
pop edi
cmp dword [ebp - 0x14], ebx
jl 0x401923
mov dword [ebp - 0xc], 0xfffffffd
mov dword [ebp - 0x1c], 0xa7a81a82
mov dword [ebp - 0xc], ebx
jmp 0x401906
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x2d4]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2d4], ecx
test ecx, ecx
jne 0x4018f3
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x2d4]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + eax*4 - 0x2d4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x2d4]
cmp edx, eax
mov edx, dword [ebp - 0x3f4]
sete cl
imul eax, ecx, 0x87a7
test eax, eax
je 0x4018d1
mov ecx, edi
cmp dword [edx + 4], ebx
jne 0x4018d3
mov ecx, ebx
xor eax, eax
cmp ecx, 0x8ed4
mov ecx, ebx
setne al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [edx + 4]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0xc]
jge 0x4018f5
mov ecx, edi
xor eax, eax
cmp ecx, 0x63e31551
setl al
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x40187f
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x2d4]
dec dword [ebp - 0x14]
jns 0x401869
lea ecx, [ebp - 0x3f4]
call fcn.00410a53
mov dword [ebp - 0x24], 0xddc85f70
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x28], 0x962ee6d0
mov dword [ebp - 0x28], 0x3e86f8c7
mov dword [ebp - 0x28], 0xf3de0369
mov dword [ebp - 0x28], 0x80ca9f8d
mov dword [ebp - 0x28], 0xa9bacde9
mov dword [ebp - 0x28], 0x1e19e95d
mov dword [ebp - 0x28], 0xfffffffc
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0x13
jmp 0x4019a9
mov dword [ebp - 0x1c], 0xffffffff
cmp dword [ebp - 0x1c], ebx
jne 0x4019af
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff8
jle 0x40199a
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x58c]
push 3
call fcn.00410610
mov dword [ebp - 0xc], ebx
jmp 0x4019d5
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x7ec], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x4019c4
mov dword [ebp - 0xc], ebx
jmp 0x4019f3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x58c]
mov dword [eax + ecx*4], 0xf5c184c5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4019e0
mov ecx, dword [ebp - 0x58c]
mov dword [ecx + 8], ebx
mov eax, dword [ecx + 8]
inc dword [ecx + 8]
cmp dword [ecx + 8], 2
mov dword [ebp + eax*4 - 0x7ec], 0x82bd
jl 0x401a02
lea ecx, [ebp - 0x58c]
call fcn.00410a53
push 9
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0x824a8c6a
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0x18], eax
jmp 0x401a4c
mov dword [ebp - 0x1c], 8
cmp dword [ebp - 0x1c], ebx
jne 0x401a52
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 7
jl 0x401a3d
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 8
jl 0x401b01
push 2
lea ecx, [ebp - 0x40c]
call fcn.00410610
mov dword [ebp - 0x20], 0xa062b000
mov dword [ebp - 0x20], 0x5405732a
mov dword [ebp - 0x24], ebx
jmp 0x401a92
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40c]
mov dword [eax + ecx*4], 0x717b
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x401a7f
mov eax, dword [ebp - 0x18]
xor ebx, ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40c]
mov ecx, dword [eax + 4]
mov eax, ecx
mov dword [ebp - 0x20], ecx
neg eax
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
imul edx, ecx, 0x7392
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x40c]
call fcn.00410a53
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 8
push 0
pop ebx
jge 0x401a5f
push 3
lea ecx, [ebp - 0x43c]
call fcn.00410610
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x84c]
mov dword [ebp - 0xc], 0xe1757117
push 2
call fcn.00410610
mov dword [ebp - 0x28], 0xbff1eb7e
mov dword [ebp - 0x24], ebx
jmp 0x401b40
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x84c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x401b31
mov dword [ebp - 0xc], ebx
jmp 0x401c7f
push 3
lea ecx, [ebp - 0x1ac]
call fcn.00410610
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], ebx
jmp 0x401b76
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1ac]
mov dword [eax + ecx*4], 0xe1e2c0d3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x401b63
mov eax, dword [ebp - 0x1ac]
mov dword [eax], ebx
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x401c00
mov esi, dword [ebp - 0x1ac]
xor ecx, ecx
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
cmp eax, 0x7fc0549e
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
sub ecx, 0x4bb489f7
cmp ecx, eax
mov eax, dword [ebp - 0x20]
push 0
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1ac]
setl cl
xor edx, edx
cmp ecx, 0x3530
setl dl
xor ebx, ebx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x14]
setl bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1ac]
pop ebx
setl cl
xor edx, edx
cmp ecx, dword [esi + 4]
setl dl
add edx, dword [eax]
mov dword [ebp - 0x20], edx
dec dword [ebp - 0x14]
jns 0x401b99
mov eax, dword [ebp - 0x1ac]
inc dword [eax]
cmp dword [eax], edi
jle 0x401b84
mov dword [ebp - 0x30], 0x12
jmp 0x401c6b
push 3
lea ecx, [ebp - 0x694]
call fcn.00410610
mov dword [ebp - 0x24], ebx
jmp 0x401c3e
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x694]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x401c2b
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x401c54
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov eax, dword [ebp - 0x694]
lea ecx, [ebp - 0x694]
dec dword [eax + 8]
call fcn.00410a53
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe9
jl 0x401c19
lea ecx, [ebp - 0x1ac]
call fcn.00410a53
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff8
jl 0x401b4e
lea ecx, [ebp - 0x84c]
call fcn.00410a53
mov dword [ebp - 0x20], 0x1d925b0e
lea ecx, [ebp - 0x424]
push edi
call fcn.00410610
mov dword [ebp - 0xc], ebx
jmp 0x401cb9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x7f4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x401cac
mov dword [ebp - 0xc], ebx
jmp 0x401cd7
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x424]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x401cc4
mov eax, dword [ebp - 0x7f0]
lea ecx, [ebp - 0x424]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x424]
mov dword [eax], 9
call fcn.00410a53
push 4
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x401d18
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x2f4], 0x10c9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x401d07
push 3
mov dword [ebp - 0xc], ebx
pop edx
jmp 0x401d38
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x43c]
mov dword [eax + ecx*4], 0x9275
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x401d25
mov esi, dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x4023e7
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x1c], 0xa5d732ad
mov dword [ebp - 0x14], 0xfffffff7
jmp 0x401dbc
mov dword [ebp - 0xc], 0x70cd
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x38], 0x7e6aa165
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], eax
jne 0x401db4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
je 0x401d9d
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x6b5b
jg 0x401da0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x14], 0xffffffff
mov eax, ebx
jle 0x401db6
mov eax, edi
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1b
jg 0x401d66
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x401dd2
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0xc], 0xfffffffd
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 8], 9
push edi
call fcn.00410610
mov dword [ebp - 0xc], ebx
jmp 0x401dfe
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x194], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x401df1
mov dword [ebp - 0xc], ebx
jmp 0x401e18
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1d0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x401e09
mov dword [ebp - 8], ebx
jmp 0x401f99
mov dword [ebp - 0x2c], 0x914d2edc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], ebx
jl 0x401f96
mov dword [ebp - 0x30], 0x162c9cc1
mov dword [ebp - 0x24], 0xb5c6f8b8
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], ebx
jl 0x401f39
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x194]
cmp ecx, edi
mov eax, dword [ebp - 0x30]
sete dl
mov dword [ebp + eax*4 - 0x194], ecx
mov eax, dword [ebp - 0x1d0]
mov dword [eax], edx
mov dword [ebp - 0x24], ebx
jmp 0x401f26
mov dword [ebp - 0xc], 0xfffffffb
mov dword [ebp - 0x1c], 0x2a4e6309
mov dword [ebp - 0xc], ebx
jmp 0x401ea8
mov dword [ebp - 0x20], 0x5ab06c0e
inc dword [ebp - 0x20]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x401e9b
mov dword [ebp - 0xc], ebx
jmp 0x401f1d
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x401ed1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1d0]
cmp dword [eax + ecx*4], ebx
jne 0x401ed1
dec dword [ebp - 0x14]
jns 0x401ebe
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x194]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1d0]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 0x2c]
add ecx, 0xeeb4
jne 0x401f03
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1d0]
cmp dword [eax], 5
setne cl
mov dword [ebp - 0x14], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x401eb3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x401e88
dec dword [ebp - 0x30]
jns 0x401e5d
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x194], ebx
jne 0x401f64
mov dword [ebp - 0x20], 0xffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp + eax*4 - 0x194]
mov eax, dword [ebp - 0x20]
sub eax, 0xcfb9
cmp eax, ecx
mov ecx, ebx
jl 0x401f66
mov ecx, edi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp + eax*4 - 0x194]
add eax, ecx
jne 0x401f7b
mov eax, ebx
cmp dword [ebp - 0x2c], ebx
je 0x401f7d
mov eax, edi
mov ecx, dword [ebp - 0x190]
add ecx, eax
mov eax, dword [ebp - 0x1d0]
mov dword [eax], ecx
dec dword [ebp - 0x2c]
jns 0x401e3f
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe8
jle 0x401e25
lea ecx, [ebp - 0x1d0]
call fcn.00410a53
mov dword [ebp - 0x1c], 0xa7a81a82
lea ecx, [ebp - 0x864]
push 2
call fcn.00410610
mov dword [ebp - 8], 0xc184c506
mov dword [ebp - 8], ebx
jmp 0x401fdd
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x864]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x401fce
mov dword [ebp - 8], edi
cmp dword [ebp - 8], ebx
jl 0x40200a
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x402005
push 0x162f
push 0x1971
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
dec dword [ebp - 8]
jns 0x401feb
lea ecx, [ebp - 0x864]
call fcn.00410a53
mov dword [ebp - 0xc], ebx
jmp 0x4022a6
mov eax, 0x5bb2c213
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x14], ebx
jmp 0x402156
push 3
lea ecx, [ebp - 0x218]
call fcn.00410610
push 3
mov dword [ebp - 8], ebx
pop edx
jmp 0x40206e
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x218]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x40205e
mov eax, dword [ebp - 0x218]
mov dword [eax], ebx
mov dword [ebp - 8], ebx
jmp 0x402091
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd8], 6
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x402080
mov dword [ebp - 0xd4], edx
cmp dword [ebp - 0xd4], ebx
jl 0x402130
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x138]
imul eax, dword [ebp - 0x12c], 0xf609
test eax, eax
je 0x40210b
cmp dword [ebp - 0xd8], ebx
je 0x40210b
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x138]
mov eax, dword [ebp - 0x130]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x138], ebx
je 0x4020f9
mov eax, edi
cmp dword [ebp - 0xd8], ebx
jne 0x4020fb
mov eax, ebx
imul eax, eax, 0xfbeb
test eax, eax
je 0x40210b
mov eax, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x218]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x138], 0xbe3d0e72
dec dword [ebp - 0xd4]
jns 0x4020a9
mov eax, dword [ebp - 0x218]
inc dword [eax]
cmp dword [eax], edx
jle 0x40207b
lea ecx, [ebp - 0x218]
cmp dword [ebp - 0x12c], ebx
jne 0x402162
call fcn.00410a53
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x402049
jmp 0x402167
call fcn.00410a53
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x38], 0xfffffff9
mov dword [ebp - 0x38], 0x466a
mov dword [ebp - 0x38], 0x813c27f3
mov dword [ebp - 0x20], 0x8bbd1883
mov dword [ebp - 8], ebx
jmp 0x40219d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x50], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x40218f
cmp dword [ebp - 0x50], ebx
jne 0x4021f3
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x14]
test eax, eax
jne 0x4021b8
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sub eax, 0x6335
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x38], 0xfffd
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
cmp eax, ecx
mov ecx, ebx
setg dl
cmp edx, dword [ebp - 0x14]
jge 0x4021f5
mov ecx, edi
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x20]
jne 0x402213
cmp dword [ebp - 0x38], ebx
jne 0x40221a
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x40221c
mov eax, edi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x2f4]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2f4], ecx
test ecx, ecx
jne 0x402293
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x2f4]
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + eax*4 - 0x2f4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x2f4]
cmp edx, eax
mov edx, dword [ebp - 0x43c]
sete cl
imul eax, ecx, 0x87a7
test eax, eax
je 0x402271
mov ecx, edi
cmp dword [edx + 4], ebx
jne 0x402273
mov ecx, ebx
xor eax, eax
cmp ecx, 0x8ed4
mov ecx, ebx
setne al
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [edx + 4]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0xc]
jge 0x402295
mov ecx, edi
xor eax, eax
cmp ecx, 0x63e31551
setl al
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x40201d
mov dword [ebp - 0x2c], 0xec2e0cf5
mov dword [ebp - 0x20], 0xffff
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x4022ca
push ebx
call esi
mov dword [ebp - 0x2c], 0xffffffe4
jmp 0x4023ca
push 2
lea ecx, [ebp - 0x340]
call fcn.00410610
mov dword [ebp - 0x14], 0xd86e52d8
lea ecx, [ebp - 0x5a4]
mov dword [ebp - 0x20], 0xfffffffb
push edi
call fcn.00410610
mov dword [ebp - 0xc], ebx
jmp 0x402315
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x340]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x402302
mov dword [ebp - 0xc], ebx
jmp 0x402333
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x5a4]
mov dword [eax + ecx*4], 0x236728ad
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x402320
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x14], ebx
jl 0x4023b1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x340]
cmp dword [eax + ecx*4], ebx
je 0x402377
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x340]
cmp dword [eax + ecx*4], edi
setl dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x2c]
cmp eax, 0x3b37
mov eax, edi
jg 0x402379
mov eax, ebx
dec eax
xor edx, edx
cmp eax, 0x6c71
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
test eax, eax
mov eax, dword [ebp - 0x5a4]
setns cl
mov dword [eax], ecx
dec dword [ebp - 0x14]
jns 0x402340
lea ecx, [ebp - 0x5a4]
call fcn.00410a53
lea ecx, [ebp - 0x340]
call fcn.00410a53
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x1a
jl 0x4022d6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x2f4]
dec dword [ebp - 0x18]
jns 0x401d4f
lea ecx, [ebp - 0x43c]
call fcn.00410a53
push edi
lea ecx, [ebp - 0x6b8]
call fcn.00410610
mov dword [ebp - 8], ebx
jmp 0x402416
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x6b8]
mov dword [eax + ecx*4], 0xfb871c7b
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x402403
mov eax, dword [ebp - 0x6b8]
mov dword [eax], edi
mov eax, dword [eax]
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
mov ebx, dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
je 0x402446
xor edi, edi
push edi
push edi
call ebx
jmp 0x402448
xor edi, edi
lea ecx, [ebp - 0x6b8]
call fcn.00410a53
mov dword [ebp - 0x28], edi
lea ecx, [ebp - 0x740]
push 3
call fcn.00410610
mov dword [ebp - 0x28], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x28], 0x1a4e
inc ecx
mov dword [ebp - 0x28], 2
mov dword [ebp - 0x28], 0xfa55
mov dword [ebp - 0x20], 0x9e56
mov dword [ebp - 0xc], edi
jmp 0x40249f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x7b4], 0x4f01
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x40248e
mov dword [ebp - 0xc], edi
jmp 0x4024bc
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x740]
mov dword [eax + ecx*4], 0xa75c19c5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4024a9
inc dword [ebp - 0x20]
lea ecx, [ebp - 0x740]
call fcn.00410a53
push 1
lea ecx, [ebp - 0x454]
call fcn.00410610
mov dword [ebp - 0x40], 0x90a3cfce
lea ecx, [ebp - 0x890]
push 2
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], 0x3e93d0b5
mov dword [ebp - 0x28], 0xeb9e
mov dword [ebp - 0x20], 0x215256ee
mov dword [ebp - 0x28], 0x720348f4
mov dword [ebp - 0x28], edi
xor edi, edi
mov dword [ebp - 0x20], 0x426a7609
inc edi
mov dword [ebp - 0x20], 0x88e10e5e
mov dword [ebp - 0x20], 0xabc24891
mov dword [ebp - 0x28], 0xf05f4326
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], 0xfffffff8
push eax
call fcn.00410610
mov dword [ebp - 0x24], 0x5f992db7
xor edx, edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], 0x8ce22955
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0x5de082ad
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0xc], edx
jmp 0x40257a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x454]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x40256b
mov dword [ebp - 0xc], edx
jmp 0x402593
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x890]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x402584
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, edi
setge cl
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x38], edx
jne 0x4025b0
cmp dword [ebp - 0x1c], edx
je 0x4025b7
cmp dword [ebp - 0x3c], edx
je 0x4025b7
mov edx, edi
inc dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, edx
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], 2
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x20], eax
jl 0x4025ec
xor eax, eax
cmp dword [ebp - 8], eax
je 0x4025ee
mov eax, edi
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x454]
imul ecx, dword [eax]
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0x890]
call fcn.00410a53
lea ecx, [ebp - 0x454]
call fcn.00410a53
movdqa xmm0, xmmword [0xa9f6c0]
lea ecx, [ebp - 0x918]
push 4
pop eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x908]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x934]
movdqu xmmword [ebp - 0x918], xmm0
call fcn.00410686
xor ecx, ecx
mov dword [ebp - 8], ecx
jmp 0x40265b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x74], 0xd4081c29
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x40264d
mov dword [ebp - 0x74], ecx
jmp 0x402698
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], ecx
jmp 0x40268f
mov byte [ebp - 0x31], cl
cmp byte [ebp - 0x31], 0
je 0x402689
push 0x580
push 0x26e5
push ecx
call dword [sym.imp.GDI32.dll_PtInRegion]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x40266d
inc dword [ebp - 0x74]
cmp dword [ebp - 0x74], 3
jle 0x402665
lea ecx, [ebp - 0x934]
call fcn.00410a53
xor ecx, ecx
mov byte [ebp - 0x31], cl
cmp byte [ebp - 0x31], cl
je 0x402718
push edi
lea ecx, [ebp - 0x364]
call fcn.00410610
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4026d9
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x364]
mov dword [eax + ecx*4], 0x1928c176
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4026c6
mov eax, dword [ebp - 0x364]
mov dword [eax], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x3c], 0x849f845d
cmp dword [ebp - 0x1c], edx
jne 0x402707
mov ecx, dword [ebp - 0x364]
mov eax, dword [ecx]
dec dword [ecx]
cmp dword [ecx], 0xffffffea
mov dword [ebp - 0x3c], eax
jge 0x4026e6
lea ecx, [ebp - 0x364]
call fcn.00410a53
push 0
call esi
xor ecx, ecx
mov dword [ebp - 0x14], 0x79b69b2e
push 3
mov dword [ebp - 0x1c], 0x38b4b72b
mov dword [ebp - 8], ecx
pop edi
jmp 0x40273b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa00], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x40272e
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], ecx
jmp 0x40276c
mov byte [ebp - 0x31], cl
cmp byte [ebp - 0x31], 0
je 0x402769
push 0x25f9
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x402751
mov dword [ebp - 0x18], 0x24ec2e0c
xor esi, esi
mov dword [ebp - 8], 0x4c7af5af
inc esi
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 2
jge 0x40279b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe8], esi
inc dword [ebp - 8]
jmp 0x402786
mov dword [ebp - 0x18], 0xb
jmp 0x4027e5
mov byte [ebp - 0x31], cl
cmp byte [ebp - 0x31], 0
je 0x4027e2
push 0xffe
push 0xdc7
push 0x2430
push 0x15a9
push 0x23c
push 0x2506
push 0xac5
push 0x2433
push 0x85b
call dword [sym.imp.GDI32.dll_Arc]
xor ecx, ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff5
jg 0x4027a4
mov dword [ebp - 0x18], ecx
jmp 0x40297c
push edi
lea ecx, [ebp - 0x46c]
call fcn.00410610
xor ecx, ecx
mov dword [ebp - 0x1c], 0x4d14b718
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], edi
jge 0x402826
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x46c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x402810
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xe8]
add eax, 0x16db
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xe8]
imul eax, dword [ebp - 8]
test eax, eax
je 0x402961
mov dword [ebp - 0x24], 0xffff
lea ecx, [ebp - 0x5bc]
mov dword [ebp - 0x20], esi
push edi
call fcn.00410610
xor edi, edi
push 3
mov dword [ebp - 0xc], edi
pop edx
jmp 0x402881
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x5bc]
mov dword [eax + ecx*4], 0x2324
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x40286e
mov dword [ebp - 0xc], edi
jmp 0x40289c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x988], 0xc65a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x40288b
cmp dword [ebp - 0x24], edi
jne 0x4028db
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0xe8]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
mov dword [ebp + eax*4 - 0xe8], edx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], esi
cmp dword [ebp - 8], edi
jne 0x4028d8
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x46c]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp dword [ecx + 8], eax
mov esi, dword [ecx + 8]
mov eax, dword [ebp - 0x18]
setge dl
sub edx, 3
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 6
setle al
add eax, esi
jne 0x402910
test esi, esi
jne 0x402910
mov ecx, edi
jmp 0x402913
xor ecx, ecx
inc ecx
xor eax, eax
cmp esi, ecx
sete al
cmp eax, dword [ebp - 0x18]
je 0x40292e
cmp dword [ebp - 0xe4], edi
je 0x40292e
xor esi, esi
inc esi
mov ecx, esi
jmp 0x402933
xor esi, esi
mov ecx, edi
inc esi
mov eax, dword [ebp - 0x5bc]
xor edx, edx
cmp ecx, dword [eax + 8]
mov eax, dword [ebp - 0x984]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x5bc]
call fcn.00410a53
push 3
pop edi
jmp 0x40296e
mov byte [ebp - 0x31], cl
cmp byte [ebp - 0x31], 0
je 0x40296e
push ecx
push ecx
call ebx
lea ecx, [ebp - 0x46c]
call fcn.00410a53
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x4027f3
xor ebx, ebx
mov byte [ebp - 0xd], bl
mov dword [ebp - 8], 0xdb3ae355
mov dword [ebp - 8], ebx
jmp 0x4029bb
mov dword [ebp - 0x1c], 0x9ea
mov dword [ebp - 0x3c], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], bl
je 0x4029b8
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff6
jne 0x402996
cmp byte [ebp - 0xd], bl
je 0x4029e1
push 0x24f4
push 0x1808
push 0x178b
push 0xd3d
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x670]
mov dword [ebp - 0x38], 0x511ecbfc
push 2
call fcn.00410610
mov dword [ebp - 0xc], ebx
jmp 0x402a0e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x260], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x4029fd
mov dword [ebp - 0xc], ebx
jmp 0x402a2b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x670]
mov dword [eax + ecx*4], 0x5adb
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x402a18
mov dword [ebp - 0x18], edi
jmp 0x402a45
mov dword [ebp - 0x1c], 0x83c8
cmp dword [ebp - 0x1c], ebx
jne 0x402a4b
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
jg 0x402a36
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 2
jg 0x402b98
mov dword [ebp - 0xc], 0x22e6e7f7
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x402a79
push 0x644
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], 2
jg 0x402b88
mov edi, dword [ebp - 0x670]
mov dword [ebp - 0x14], 0x86bdae89
mov dword [ebp - 0x40], 0xacdd1f66
mov dword [ebp - 0x40], 0xfffffff6
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x260], ebx
jne 0x402ab0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x260]
mov eax, dword [ebp - 0x260]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x18], 2
jne 0x402acf
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x260]
mov eax, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x20], 0x5e4d
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setl dl
cmp edx, dword [ebp - 0x18]
jg 0x402af5
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x25c]
je 0x402b07
mov ecx, ebx
cmp dword [ebp - 0x38], ebx
je 0x402b09
mov ecx, esi
xor eax, eax
cmp ecx, 0x38d6
setl al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x14]
cmp dword [edi + 4], ebx
je 0x402b2a
cmp dword [ebp - 0x14], ebx
jne 0x402b2c
mov esi, ebx
mov dword [ebp - 0x40], 0xaca6
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp eax, 0xeef1
mov eax, dword [ebp - 0xc]
setg cl
xor edx, edx
cmp ecx, eax
push 4
setl dl
xor eax, eax
cmp esi, 0x737b
pop ecx
setle al
sub eax, edx
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
push 1
sbb eax, eax
inc eax
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x1c], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
pop esi
jle 0x402a8c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x402a58
push 3
pop edi
lea ecx, [ebp - 0x670]
call fcn.00410a53
push esi
lea ecx, [ebp - 0x118]
call fcn.00410610
mov dword [ebp - 0xc], 0x81c2900
mov dword [ebp - 0x24], 0xe5411aa8
mov dword [ebp - 0x30], 0xe0e3cec3
mov dword [ebp - 8], ebx
jmp 0x402bdc
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0x1713b910
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x402bc9
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jl 0x402e11
mov dword [ebp - 0x2c], 0x26a056eb
lea ecx, [ebp - 0x484]
mov dword [ebp - 0x18], 0x4b748abb
mov dword [ebp - 0x14], 0xd7582ba8
mov dword [ebp - 0x20], ebx
push edi
call fcn.00410610
mov dword [ebp - 8], ebx
jmp 0x402c29
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x484]
mov dword [eax + ecx*4], 0x3fccfb42
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x402c16
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x118]
cmp dword [eax + ecx*4], ebx
je 0x402cc1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], 0xfffffff8
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x118]
mov edx, dword [ebp - 0x2c]
imul edx, dword [eax + ecx*4]
neg edx
sbb edx, edx
neg edx
cmp edx, dword [ebp - 0x18]
jl 0x402c77
mov eax, dword [ebp - 0x118]
mov edx, esi
cmp dword [eax], ebx
jne 0x402c79
mov edx, ebx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x118]
cmp ecx, dword [eax]
setle dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov ecx, esi
setge dl
cmp edx, 6
sbb eax, eax
add eax, 0xb32fde57
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x24], 0x6522
jne 0x402cc3
mov ecx, ebx
mov eax, dword [ebp - 0x118]
cmp ecx, dword [eax]
je 0x402d89
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0x5e2d
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x402dce
mov eax, dword [ebp - 0x118]
xor ecx, ecx
mov dword [ebp - 0x14], 0xffffffff
cmp dword [eax], esi
mov eax, dword [ebp - 0x24]
setl cl
imul eax, ecx
test eax, eax
je 0x402d12
mov eax, esi
cmp dword [ebp - 0x2c], ebx
jne 0x402d14
mov eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x30]
test eax, eax
je 0x402d3e
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x14], ebx
je 0x402d3e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x118]
cmp dword [eax + ecx*4], ebx
je 0x402d3e
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
setle cl
sub edx, ecx
xor ecx, ecx
cmp eax, edx
mov eax, 0x87c3cb87
setl cl
imul ecx, dword [ebp - 0x18]
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x2c]
jns 0x402ced
jmp 0x402dce
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 8], ebx
jmp 0x402da6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x970], 8
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x402d95
mov eax, dword [ebp - 0x484]
dec dword [eax]
mov dword [ebp - 0x14], ebx
jmp 0x402dc9
cmp dword [ebp - 0x14], edi
jl 0x402db8
mov dword [ebp - 0x2c], ebx
jmp 0x402df8
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x402df5
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x402df0
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ebx
jle 0x402dd3
lea ecx, [ebp - 0x484]
call fcn.00410a53
dec dword [ebp - 0xc]
jns 0x402bed
lea ecx, [ebp - 0x118]
call fcn.00410a53
mov dword [ebp - 0x30], 9
mov eax, 0x57102d14
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], ebx
jmp 0x402e55
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4c], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x402e4b
mov dword [ebp - 0x4c], ebx
mov edi, 0xe356ec7e
cmp dword [ebp - 0x4c], 0x19
jge 0x402ff6
lea eax, [ebp - 0x724]
lea ecx, [ebp - 0x714]
movdqa xmm0, xmmword [0xa9f710]
push ecx
push ecx
push eax
lea ecx, [ebp - 0x5d4]
movdqu xmmword [ebp - 0x724], xmm0
call fcn.00410686
mov esi, dword [ebp - 0x5d4]
mov dword [ebp - 0x188], edi
mov dword [ebp - 0x184], edi
mov dword [ebp - 0x180], edi
mov dword [ebp - 0x17c], edi
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 0xc]
xor edi, edi
inc edi
mov ecx, dword [ebp + eax*4 - 0x238]
mov eax, dword [esi + 0xc]
mov dword [ebp + eax*4 - 0x238], ecx
mov eax, dword [esi + 0xc]
cmp dword [ebp + eax*4 - 0x238], ebx
jne 0x402efd
mov eax, dword [ebp - 0x4c]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x238]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x20]
mov eax, dword [esi + 0xc]
mov eax, dword [ebp + eax*4 - 0x238]
mov dword [ebp - 0x180], edi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x402f10
push 0x4dd
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [ebp - 0x14]
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 3
jle 0x402eb7
mov dword [ebp - 0x14], ebx
jmp 0x402fc0
mov dword [ebp - 0x38], 0x77138bf9
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x40], 0xb5cfe74d
mov dword [ebp - 0x3c], 0x7fe6
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
test eax, eax
mov eax, dword [ebp - 0x184]
setg cl
add eax, ecx
jne 0x402f69
cmp dword [ebp - 0x14], 3
jle 0x402f24
lea ecx, [ebp - 0x5d4]
call fcn.00410a53
inc dword [ebp - 0x4c]
lea eax, [ebp - 0x724]
cmp dword [ebp - 0x4c], 0x19
lea ecx, [ebp - 0x714]
mov edi, 0xe356ec7e
jl 0x402e78
push 3
lea ecx, [ebp - 0x55c]
call fcn.00410610
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 8
push 6
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 0xbac04ee7
mov dword [ebp - 0x28], 0x40194ddb
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 0x37a9a971
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 0x2fdcba86
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x28], 0x831eb239
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 0x4ba8b35e
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x5f79
push 4
mov dword [ebp - 0x28], 0x342f
mov dword [ebp - 8], ebx
pop edi
jmp 0x403089
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa10], 0x45c1d102
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x403078
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x40309c
call dword [sym.imp.USER32.dll_EndMenu]
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], 0x74da8628
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x38], 0x45f5b1b6
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x28], 0x6e9f0866
mov dword [ebp - 0x28], 0x5493e623
mov dword [ebp - 0x28], 0x87a5eafb
mov dword [ebp - 0x28], ebx
push 0xfffffffffffffffb
mov dword [ebp - 0x28], 0xc5530c4e
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 8], ebx
jmp 0x4030f1
cmp dword [ebp - 8], 2
jl 0x4030e4