Function at 0x434610
Capabilities:
Check for time delay via queryperformancecounter
Clear file content
Compare security identifiers
Contain obfuscated stackstrings
Query environment variable
Set thread local storage value
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x21d4
call fcn.00479690
push esi
push edi
mov dword [ebp - 0x88], 0x31713b91
mov dword [ebp - 0x88], 0x10
jmp 0x434642
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xffffffea
jg 0x43481e
mov dword [ebp - 0x1244], 0x38b6b0e1
mov dword [ebp - 0x668], 0x7359b504
mov byte [ebp - 0x21a], 0
movzx eax, byte [ebp - 0x21a]
test eax, eax
je 0x434684
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x668], eax
cmp dword [ebp - 0x668], 0
jne 0x4346a5
mov dword [ebp - 0x8cc], 1
jmp 0x4346ac
and dword [ebp - 0x8cc], 0
cmp dword [ebp - 0x8cc], 0xffffffff
jne 0x4346c1
mov dword [ebp - 0x11ac], 1
jmp 0x4346c8
and dword [ebp - 0x11ac], 0
mov eax, dword [ebp - 0x88]
cmp eax, dword [ebp - 0x11ac]
je 0x4346e2
mov dword [ebp - 0x13d0], 1
jmp 0x4346e9
and dword [ebp - 0x13d0], 0
mov eax, dword [ebp - 0x1244]
cmp dword [ebp - 0x668], eax
jle 0x434703
mov dword [ebp - 0x11b4], 1
jmp 0x43470a
and dword [ebp - 0x11b4], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x11b4], eax
jl 0x434724
mov dword [ebp - 0x11bc], 1
jmp 0x43472b
and dword [ebp - 0x11bc], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x11bc], eax
jle 0x434745
mov dword [ebp - 0x11c4], 1
jmp 0x43474c
and dword [ebp - 0x11c4], 0
cmp dword [ebp - 0x11c4], 1
jl 0x434761
mov dword [ebp - 0x11cc], 1
jmp 0x434768
and dword [ebp - 0x11cc], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x11cc], eax
jle 0x43478b
cmp dword [ebp - 0x88], 0
je 0x43478b
mov dword [ebp - 0x11d4], 1
jmp 0x434792
and dword [ebp - 0x11d4], 0
cmp dword [ebp - 0x11d4], 0x8594
jg 0x4347aa
mov dword [ebp - 0x11dc], 1
jmp 0x4347b1
and dword [ebp - 0x11dc], 0
cmp dword [ebp - 0x11dc], 0xfffffffb
jne 0x4347c6
mov dword [ebp - 0x11e4], 1
jmp 0x4347cd
and dword [ebp - 0x11e4], 0
cmp dword [ebp - 0x11e4], 0x7d2a7e9f
jne 0x4347e5
mov dword [ebp - 0x1234], 1
jmp 0x4347ec
and dword [ebp - 0x1234], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x1234], eax
jle 0x434806
mov dword [ebp - 0x123c], 1
jmp 0x43480d
and dword [ebp - 0x123c], 0
mov eax, dword [ebp - 0x123c]
mov dword [ebp - 0x1244], eax
jmp 0x434635
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x125c], 0xffff
mov dword [ebp - 0x1264], 1
mov dword [ebp - 0x164], 0
jmp 0x434855
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 2
jge 0x434871
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x680], 0xfffffffb
jmp 0x434848
mov dword [ebp - 0x164], 0
jmp 0x43488a
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 1
jge 0x4348a6
mov eax, dword [ebp - 0x164]
mov dword [ebp + eax*4 - 0x1498], 5
jmp 0x43487d
cmp dword [ebp - 0xac], 0
je 0x4348d8
mov byte [ebp - 0x1a8], 0
movzx eax, byte [ebp - 0x1a8]
test eax, eax
je 0x4348d3
push 0x262e
push 0
push 0x14da
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x434a3b
mov dword [ebp - 0x1488], 0
mov byte [ebp - 0x1aa], 0
movzx eax, byte [ebp - 0x1aa]
test eax, eax
je 0x43490a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0xac], 0
jmp 0x434923
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 1
jg 0x434a3b
mov eax, dword [ebp - 0xac]
cmp dword [ebp + eax*4 - 0x680], 0xfffffff7
jg 0x43494c
mov dword [ebp - 0x124c], 1
jmp 0x434953
and dword [ebp - 0x124c], 0
mov eax, dword [ebp - 0x124c]
sub eax, dword [ebp - 0x1488]
je 0x434976
cmp dword [ebp - 0x125c], 0
je 0x434976
mov dword [ebp - 0x1254], 1
jmp 0x43497d
and dword [ebp - 0x1254], 0
cmp dword [ebp - 0x1254], 1
jne 0x434992
mov dword [ebp - 0x1490], 1
jmp 0x434999
and dword [ebp - 0x1490], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x680]
mov dword [ebp - 0x1d7c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x680]
add eax, dword [ebp - 0x125c]
mov dword [ebp - 0x1264], eax
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x680]
cmp dword [ebp - 0x1264], eax
je 0x4349e6
mov dword [ebp - 0x126c], 1
jmp 0x4349ed
and dword [ebp - 0x126c], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x680]
cmp eax, dword [ebp - 0x126c]
jg 0x434a0e
mov dword [ebp - 0x1274], 1
jmp 0x434a15
and dword [ebp - 0x1274], 0
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp + eax*4 - 0x680]
imul eax, dword [ebp - 0x1274]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1498], eax
jmp 0x434916
mov byte [ebp - 0x1ac], 0
movzx eax, byte [ebp - 0x1ac]
test eax, eax
je 0x434a6d
push 0
push 0x23b3
push 0x1f47
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov dword [ebp - 0x418], 4
mov dword [ebp - 0xe4], 1
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe4], 0
jmp 0x434aa6
mov eax, dword [ebp - 0xe4]
dec eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xfffffffb
je 0x434c4e
mov dword [ebp - 0x550], 0x948b
mov dword [ebp - 0x14a8], 1
mov dword [ebp - 0x14b8], 0xdc1094d0
mov dword [ebp - 0x310], 0
jmp 0x434aea
mov eax, dword [ebp - 0x310]
inc eax
mov dword [ebp - 0x310], eax
cmp dword [ebp - 0x310], 3
jge 0x434b06
mov eax, dword [ebp - 0x310]
mov dword [ebp + eax*4 - 0x208c], 0xffffffff
jmp 0x434add
mov byte [ebp - 0x1ae], 0
movzx eax, byte [ebp - 0x1ae]
test eax, eax
je 0x434b27
push 0x117f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [ebp - 0xe4], 0
jne 0x434b6f
cmp dword [ebp - 0x550], 0
je 0x434b4e
cmp dword [ebp - 0x418], 0
je 0x434b4e
mov dword [ebp - 0x14a0], 1
jmp 0x434b55
and dword [ebp - 0x14a0], 0
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x1c90], eax
xor eax, eax
inc eax
jne 0x434b6f
and dword [ebp - 0x127c], 0
jmp 0x434b79
mov dword [ebp - 0x127c], 1
mov eax, dword [ebp - 0x127c]
sub eax, dword [ebp - 0x14a8]
je 0x434b9c
cmp dword [ebp - 0xe4], 0
je 0x434b9c
mov dword [ebp - 0x1284], 1
jmp 0x434ba3
and dword [ebp - 0x1284], 0
cmp dword [ebp - 0x1284], 0xfffffff9
jne 0x434bb8
mov dword [ebp - 0x14b0], 1
jmp 0x434bbf
and dword [ebp - 0x14b0], 0
mov eax, dword [ebp - 0x550]
mov dword [ebp - 0x1ecc], eax
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x550], eax
je 0x434be5
mov dword [ebp - 0x128c], 1
jmp 0x434bec
and dword [ebp - 0x128c], 0
mov eax, dword [ebp - 0x128c]
sub eax, 0x7b1b0cad
cmp eax, dword [ebp - 0xe4]
jl 0x434c0b
mov dword [ebp - 0x1294], 1
jmp 0x434c12
and dword [ebp - 0x1294], 0
mov eax, dword [ebp - 0x418]
imul eax, dword [ebp - 0x1294]
add eax, 0x959303fc
mov dword [ebp - 0x129c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x129c]
mov dword [ebp + eax - 0x208c], ecx
mov eax, dword [ebp - 0x129c]
mov dword [ebp - 0x14b8], eax
jmp 0x434a99
mov dword [ebp - 0x90], 0x31713b91
mov dword [ebp - 0x318], 0xffffffff
push 1
lea ecx, [ebp - 0x1d48]
call fcn.0040809e
mov dword [ebp - 0x1c98], 0xc42206dd
mov dword [ebp - 0x1fd0], 0xffffffff
mov dword [ebp - 0x1ca0], 2
mov dword [ebp - 0x1edc], 0xc59458d8
mov dword [ebp - 0x6d4], 0xffffffff
mov dword [ebp - 0x134], 0
jmp 0x434cba
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x434cdc
push dword [ebp - 0x134]
lea ecx, [ebp - 0x1d48]
call fcn.0040818c
mov dword [eax], 1
jmp 0x434cad
mov dword [ebp - 0x134], 0
jmp 0x434cf5
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 1
jge 0x434d11
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0x1ca8], 1
jmp 0x434ce8
mov dword [ebp - 0x318], 0xc
jmp 0x434d2a
mov eax, dword [ebp - 0x318]
dec eax
mov dword [ebp - 0x318], eax
cmp dword [ebp - 0x318], 0xa
jge 0x434ded
mov dword [ebp - 0x203c], 1
mov dword [ebp - 0x1cb0], 0xc3a0b8ee
mov dword [ebp - 0x1eec], 0xafcb143e
mov dword [ebp - 0x1cb8], 0x9bf9f361
mov dword [ebp - 0x1fd8], 0xffffffff
mov dword [ebp - 0x1cc0], 1
mov dword [ebp - 0x1efc], 1
mov dword [ebp - 0x1cc8], 5
mov dword [ebp - 0x4a8], 0
jmp 0x434da0
mov eax, dword [ebp - 0x4a8]
inc eax
mov dword [ebp - 0x4a8], eax
cmp dword [ebp - 0x4a8], 1
jge 0x434dbc
mov eax, dword [ebp - 0x4a8]
mov dword [ebp + eax*4 - 0x207c], 0xdfba22e9
jmp 0x434d93
mov eax, dword [ebp - 0x6d4]
dec eax
mov dword [ebp - 0x6d4], eax
mov byte [ebp - 0x1b0], 0
movzx eax, byte [ebp - 0x1b0]
test eax, eax
je 0x434de8
push 0
push 0x1f91
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x434d1d
mov byte [ebp - 0x1b2], 0
movzx eax, byte [ebp - 0x1b2]
test eax, eax
je 0x434e13
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
lea ecx, [ebp - 0x1d48]
call fcn.00408170
mov dword [ebp - 0x90], 0x10
jmp 0x434e37
mov eax, dword [ebp - 0x90]
dec eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0xffffffea
jg 0x43597a
mov dword [ebp - 0x320], 0x91a049fe
mov dword [ebp - 0x2008], 0x170cd509
mov dword [ebp - 0x2004], 0x170cd509
mov dword [ebp - 0x2000], 0x170cd509
mov dword [ebp - 0x1ffc], 0x170cd509
mov dword [ebp - 0x320], 0xe
jmp 0x434e8f
mov eax, dword [ebp - 0x320]
inc eax
mov dword [ebp - 0x320], eax
cmp dword [ebp - 0x320], 0x1d
jl 0x43500d
mov dword [ebp - 0x420], 0xffffffff
mov dword [ebp - 0x420], 0xfffffff4
jmp 0x434ebf
mov eax, dword [ebp - 0x420]
inc eax
mov dword [ebp - 0x420], eax
cmp dword [ebp - 0x420], 0xfffffff6
jg 0x435008
mov dword [ebp - 0x16d8], 0x65653d42
mov dword [ebp - 0x16d4], 0x65653d42
mov dword [ebp - 0x16d0], 0x65653d42
mov dword [ebp - 0x16cc], 0x65653d42
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x16d8], 3
jmp 0x434f22
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x16d8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x16d8], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x16d8], 0
jl 0x435003
push 1
lea ecx, [ebp - 0x1654]
call fcn.0040809e
mov dword [ebp - 0x328], 0
jmp 0x434f5c
mov eax, dword [ebp - 0x328]
inc eax
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x328], 1
jge 0x434f7b
push dword [ebp - 0x328]
lea ecx, [ebp - 0x1654]
call fcn.0040818c
and dword [eax], 0
jmp 0x434f4f
push 0
lea ecx, [ebp - 0x1654]
call fcn.0040818c
mov dword [eax], 3
jmp 0x434fb4
push 0
lea ecx, [ebp - 0x1654]
call fcn.0040818c
mov dword [ebp - 0x1044], eax
mov eax, dword [ebp - 0x1044]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1044]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1654]
call fcn.0040818c
cmp dword [eax], 0
jl 0x434ff3
mov byte [ebp - 0x1b4], 0
movzx eax, byte [ebp - 0x1b4]
test eax, eax
je 0x434ff1
push 0x10dc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x434f90
lea ecx, [ebp - 0x1654]
call fcn.00408170
jmp 0x434f07
jmp 0x434eb2
jmp 0x434e82
mov dword [ebp - 0x774], 0x38b6b0e1
mov dword [ebp - 0x5fc], 0x7359b504
mov dword [ebp - 0x254], 0x57e8
mov dword [ebp - 0x6dc], 0x9c710427
mov dword [ebp - 0x5e8], 0xfffffff7
mov dword [ebp - 0x6e4], 7
mov dword [ebp - 0x1054], 0xe283bc1b
mov dword [ebp - 0x105c], 0xfffffff8
mov dword [ebp - 0x14c8], 1
cmp dword [ebp - 0x254], 9
jne 0x435161
mov eax, dword [ebp - 0x254]
add eax, dword [ebp - 0x254]
mov dword [ebp - 0x6dc], eax
imul eax, dword [ebp - 0x6dc], 0x5a59
mov dword [ebp - 0x5e8], eax
mov eax, dword [ebp - 0x5e8]
cmp dword [ebp - 0x254], eax
jne 0x4350b9
mov eax, 0xffff
test eax, eax
je 0x4350b9
mov dword [ebp - 0x104c], 1
jmp 0x4350c0
and dword [ebp - 0x104c], 0
mov eax, dword [ebp - 0x254]
mov eax, 0xe2632c5
cmp eax, 0xffffffff
jle 0x4350dc
mov dword [ebp - 0x14c0], 1
jmp 0x4350e3
and dword [ebp - 0x14c0], 0
mov eax, dword [ebp - 0x254]
mov dword [ebp - 0x1cd0], eax
mov eax, dword [ebp - 0x5e8]
mov dword [ebp - 0x6e4], eax
mov eax, dword [ebp - 0x6e4]
mov dword [ebp - 0x1054], eax
cmp dword [ebp - 0x1054], 0x574b
jge 0x43511f
mov dword [ebp - 0x6ec], 1
jmp 0x435126
and dword [ebp - 0x6ec], 0
mov eax, dword [ebp - 0x105c]
cmp dword [ebp - 0x6ec], eax
jne 0x435140
mov dword [ebp - 0x6f4], 1
jmp 0x435147
and dword [ebp - 0x6f4], 0
mov eax, dword [ebp - 0x105c]
cmp dword [ebp - 0x6f4], eax
jne 0x435161
mov dword [ebp - 0x1064], 1
jmp 0x435168
and dword [ebp - 0x1064], 0
mov eax, dword [ebp - 0x1064]
mov dword [ebp - 0x14c8], eax
mov byte [ebp - 0x1b6], 0
movzx eax, byte [ebp - 0x1b6]
test eax, eax
je 0x43519c
push 0
push 0x125e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov dword [ebp - 0xc0], 0xcff0ea75
mov dword [ebp - 0xc0], 0
jmp 0x4351bf
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0xb
jne 0x43550c
push 1
lea ecx, [ebp - 0x524]
call fcn.0040809e
mov dword [ebp - 0xd0], 4
mov dword [ebp - 0xec], 0
jmp 0x4351fc
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jge 0x43521b
push dword [ebp - 0xec]
lea ecx, [ebp - 0x524]
call fcn.0040818c
or dword [eax], 0xffffffff
jmp 0x4351ef
mov dword [ebp - 0xec], 0
jmp 0x435234
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 1
jge 0x435250
mov eax, dword [ebp - 0xec]
mov dword [ebp + eax*4 - 0x13e0], 0xe149cff2
jmp 0x435227
push 0
lea ecx, [ebp - 0x524]
call fcn.0040818c
mov dword [eax], 0x108f8256
mov dword [ebp - 0xd0], 0
jmp 0x43527c
mov eax, dword [ebp - 0xd0]
dec eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jl 0x4354fc
mov dword [ebp - 0x13d4], 0x6cd8
mov dword [ebp - 0x106c], 9
mov byte [ebp - 0x1b8], 0
movzx eax, byte [ebp - 0x1b8]
test eax, eax
je 0x4352bf
push 0x204e
push 0xd8f
call dword [sym.imp.KERNEL32.dll_Beep]
push 0
lea ecx, [ebp - 0x524]
call fcn.0040818c
cmp dword [eax], 0
je 0x435417
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x524]
call fcn.0040818c
mov eax, dword [eax]
mov dword [ebp - 0x13d4], eax
push 0
lea ecx, [ebp - 0x524]
call fcn.0040818c
mov esi, eax
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x524]
call fcn.0040818c
mov ecx, dword [ebp - 0xc0]
add ecx, dword [ebp - 0xc0]
mov eax, dword [eax]
sub eax, ecx
cmp dword [esi], eax
jl 0x43532e
mov dword [ebp - 0x6fc], 1
jmp 0x435335
and dword [ebp - 0x6fc], 0
mov eax, dword [ebp - 0x6fc]
mov dword [ebp - 0x106c], eax
mov eax, dword [ebp - 0x106c]
mov dword [ebp - 0x1f0c], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x1cd8], eax
push 0
lea ecx, [ebp - 0x524]
call fcn.0040818c
cmp dword [eax], 0
jne 0x435379
or eax, 0xffffffff
jne 0x435379
and dword [ebp - 0x704], 0
jmp 0x435383
mov dword [ebp - 0x704], 1
push 0
lea ecx, [ebp - 0x524]
call fcn.0040818c
mov ecx, dword [ebp - 0x704]
cmp ecx, dword [eax]
jne 0x4353a6
mov dword [ebp - 0x1074], 1
jmp 0x4353ad
and dword [ebp - 0x1074], 0
push 0
lea ecx, [ebp - 0x524]
call fcn.0040818c
mov ecx, dword [ebp - 0x1074]
cmp ecx, dword [eax]
jl 0x4353d0
mov dword [ebp - 0x70c], 1
jmp 0x4353d7
and dword [ebp - 0x70c], 0
cmp dword [ebp - 0x70c], 0x28033590
jge 0x4353ef
mov dword [ebp - 0x107c], 1
jmp 0x4353f6
and dword [ebp - 0x107c], 0
mov eax, dword [ebp - 0xc0]
imul eax, dword [ebp - 0x107c]
cmp eax, dword [ebp - 0xc0]
jg 0x435417
mov dword [ebp - 0x714], 1
jmp 0x43541e
and dword [ebp - 0x714], 0
cmp dword [ebp - 0x714], 0xffff
jb 0x435436
mov dword [ebp - 0x1084], 1
jmp 0x43543d
and dword [ebp - 0x1084], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x1084], eax
jne 0x435457
mov dword [ebp - 0x71c], 1
jmp 0x43545e
and dword [ebp - 0x71c], 0
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x524]
call fcn.0040818c
mov ecx, dword [ebp - 0x71c]
cmp ecx, dword [eax]
je 0x435485
mov dword [ebp - 0x13d8], 1
jmp 0x43548c
and dword [ebp - 0x13d8], 0
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x524]
call fcn.0040818c
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x13e0], 7
mov eax, 0x6367
imul esi, eax, 7
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x524]
call fcn.0040818c
cmp dword [eax], esi
jl 0x4354d7
mov dword [ebp - 0x108c], 1
jmp 0x4354de
and dword [ebp - 0x108c], 0
push dword [ebp - 0xd0]
lea ecx, [ebp - 0x524]
call fcn.0040818c
mov ecx, dword [ebp - 0x108c]
mov dword [eax], ecx
jmp 0x43526f
lea ecx, [ebp - 0x524]
call fcn.00408170
jmp 0x4351b2
mov byte [ebp - 0x1ba], 0
movzx eax, byte [ebp - 0x1ba]
test eax, eax
je 0x4355e9
and dword [ebp - 0x181c], 0
and dword [ebp - 0x1818], 0
and dword [ebp - 0x1814], 0
and dword [ebp - 0x1810], 0
lea ecx, [ebp - 0x5e1]
call fcn.0040819b
push eax
lea eax, [ebp - 0x180c]
push eax
lea eax, [ebp - 0x181c]
push eax
lea ecx, [ebp - 0x2120]
call fcn.0040819e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x20a4]
call fcn.0040814a
mov dword [ebp - 0x4fc], 0xffffffff
mov dword [ebp - 0x4fc], 3
jmp 0x435596
mov eax, dword [ebp - 0x4fc]
dec eax
mov dword [ebp - 0x4fc], eax
cmp dword [ebp - 0x4fc], 0
jl 0x4355cf
mov byte [ebp - 0x1bc], 0
movzx eax, byte [ebp - 0x1bc]
test eax, eax
je 0x4355cd
push 0x104e
push 0xbe3
push 0xf5f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x435589
lea ecx, [ebp - 0x20a4]
call fcn.00408170
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov dword [ebp - 0x558], 0xd00585b7
mov dword [ebp - 0x284], 0x9bacc5d9
mov dword [ebp - 0x72c], 0xf4326038
mov dword [ebp - 0x109c], 6
mov dword [ebp - 0x13f0], 0xfffffff8
mov dword [ebp - 0x330], 0
jmp 0x435634
mov eax, dword [ebp - 0x330]
inc eax
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x330], 2
jge 0x435650
mov eax, dword [ebp - 0x330]
mov dword [ebp + eax*4 - 0x11f0], 0xfff6
jmp 0x435627
push 8
pop eax
test eax, eax
je 0x435663
mov eax, dword [ebp - 0x284]
sub eax, dword [ebp - 0x284]
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11f0]
cmp dword [ebp - 0x284], eax
jl 0x435684
mov dword [ebp - 0x724], 1
jmp 0x43568b
and dword [ebp - 0x724], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11f0]
cmp dword [ebp - 0x724], eax
jge 0x4356ac
mov dword [ebp - 0x1094], 1
jmp 0x4356b3
and dword [ebp - 0x1094], 0
mov eax, dword [ebp - 0x1094]
mov dword [ebp - 0x72c], eax
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0x109c], eax
cmp dword [ebp - 0x109c], 0x2b8e
jne 0x4356e3
mov dword [ebp - 0x734], 1
jmp 0x4356ea
and dword [ebp - 0x734], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11f0]
cmp dword [ebp - 0x734], eax
jge 0x43570b
mov dword [ebp - 0x10a4], 1
jmp 0x435712
and dword [ebp - 0x10a4], 0
cmp dword [ebp - 0x10a4], 0xb611fb8e
ja 0x43572a
mov dword [ebp - 0x13e8], 1
jmp 0x435731
and dword [ebp - 0x13e8], 0
mov eax, dword [ebp - 0x13f0]
mov dword [ebp - 0x1fe0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x11f0], 0xfff8
jae 0x435762
mov eax, 0xfffd
test eax, eax
jne 0x435762
and dword [ebp - 0x73c], 0
jmp 0x43576c
mov dword [ebp - 0x73c], 1
mov eax, dword [ebp - 0x558]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x558]
mov ecx, dword [ebp - 0x284]
imul ecx, dword [ebp - 0x73c]
add eax, ecx
cmp eax, 0xffff
jb 0x4357a0
mov dword [ebp - 0x10ac], 1
jmp 0x4357a7
and dword [ebp - 0x10ac], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11f0]
cmp dword [ebp - 0x10ac], eax
jg 0x4357c8
mov dword [ebp - 0x744], 1
jmp 0x4357cf
and dword [ebp - 0x744], 0
mov eax, 0x8e56
sub eax, dword [ebp - 0x744]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x5fc], eax
cmp dword [ebp - 0x5fc], 0
jne 0x435801
mov dword [ebp - 0x10b4], 1
jmp 0x435808
and dword [ebp - 0x10b4], 0
cmp dword [ebp - 0x10b4], 0xffffffff
jne 0x43581d
mov dword [ebp - 0x74c], 1
jmp 0x435824
and dword [ebp - 0x74c], 0
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x74c]
je 0x43583e
mov dword [ebp - 0x13f8], 1
jmp 0x435845
and dword [ebp - 0x13f8], 0
mov eax, dword [ebp - 0x774]
cmp dword [ebp - 0x5fc], eax
jle 0x43585f
mov dword [ebp - 0x10bc], 1
jmp 0x435866
and dword [ebp - 0x10bc], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x10bc], eax
jl 0x435880
mov dword [ebp - 0x754], 1
jmp 0x435887
and dword [ebp - 0x754], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x754], eax
jle 0x4358a1
mov dword [ebp - 0x10c4], 1
jmp 0x4358a8
and dword [ebp - 0x10c4], 0
cmp dword [ebp - 0x10c4], 1
jl 0x4358bd
mov dword [ebp - 0x75c], 1
jmp 0x4358c4
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x75c], eax
jle 0x4358e7
cmp dword [ebp - 0x90], 0
je 0x4358e7
mov dword [ebp - 0x10cc], 1
jmp 0x4358ee
and dword [ebp - 0x10cc], 0
cmp dword [ebp - 0x10cc], 0x8594
jg 0x435906
mov dword [ebp - 0x764], 1
jmp 0x43590d
and dword [ebp - 0x764], 0
cmp dword [ebp - 0x764], 0xfffffffb
jne 0x435922
mov dword [ebp - 0x10d4], 1
jmp 0x435929
and dword [ebp - 0x10d4], 0
cmp dword [ebp - 0x10d4], 0x7d2a7e9f
jne 0x435941
mov dword [ebp - 0x76c], 1
jmp 0x435948
and dword [ebp - 0x76c], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x76c], eax
jle 0x435962
mov dword [ebp - 0x10dc], 1
jmp 0x435969
and dword [ebp - 0x10dc], 0
mov eax, dword [ebp - 0x10dc]
mov dword [ebp - 0x774], eax
jmp 0x434e2a
push 2
lea ecx, [ebp - 0x1d58]
call fcn.0040809e
mov dword [ebp - 0x338], 0
mov dword [ebp - 0x1ce0], 0
mov dword [ebp - 0x428], 0
jmp 0x4359b4
mov eax, dword [ebp - 0x428]
inc eax
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 2
jge 0x4359d6
push dword [ebp - 0x428]
lea ecx, [ebp - 0x1d58]
call fcn.0040818c
mov dword [eax], 0xfffffff9
jmp 0x4359a7
mov dword [ebp - 0x338], 0
jmp 0x4359ef
mov eax, dword [ebp - 0x338]
inc eax
mov dword [ebp - 0x338], eax
cmp dword [ebp - 0x338], 1
jg 0x435a5a
mov dword [ebp - 0x1f1c], 0x87f2fb5a
mov dword [ebp - 0x1ce8], 0xfffffffb
mov dword [ebp - 0x10e4], 0xe4b7834d
mov dword [ebp - 0x4ac], 0
jmp 0x435a2f
mov eax, dword [ebp - 0x4ac]
inc eax
mov dword [ebp - 0x4ac], eax
cmp dword [ebp - 0x4ac], 1
jge 0x435a4b
mov eax, dword [ebp - 0x4ac]
mov dword [ebp + eax*4 - 0x1f64], 6
jmp 0x435a22
mov eax, dword [ebp - 0x10e4]
inc eax
mov dword [ebp - 0x10e4], eax
jmp 0x4359e2
lea ecx, [ebp - 0x1d58]
call fcn.00408170
and dword [ebp - 0x186c], 0
and dword [ebp - 0x1868], 0
and dword [ebp - 0x1864], 0
and dword [ebp - 0x1860], 0
lea ecx, [ebp - 0x5e9]
call fcn.0040819b
push eax
lea eax, [ebp - 0x185c]
push eax
lea eax, [ebp - 0x186c]
push eax
lea ecx, [ebp - 0x21a0]
call fcn.0040819e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x20d4]
call fcn.0040814a
mov dword [ebp - 0x340], 0xffffffff
mov dword [ebp - 0x340], 3
jmp 0x435ad9
mov eax, dword [ebp - 0x340]
dec eax
mov dword [ebp - 0x340], eax
cmp dword [ebp - 0x340], 0
jl 0x435b12
mov byte [ebp - 0x1e1], 0
movzx eax, byte [ebp - 0x1e1]
test eax, eax
je 0x435b10
push 0x104e
push 0xbe3
push 0xf5f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x435acc
lea ecx, [ebp - 0x20d4]
call fcn.00408170
mov dword [ebp - 0x2c0], 0x24a8c6a5
mov dword [ebp - 0x25c], 0x29aa810d
mov dword [ebp - 0x4e4], 6
mov dword [ebp - 0x348], 0x7f8b4dfe
mov dword [ebp - 0x568], 0xe3f9150f
mov dword [ebp - 0x290], 0x9740826f
push 2
lea ecx, [ebp - 0x1758]
call fcn.0040809e
mov dword [ebp - 0x1520], 0x697
mov dword [ebp - 0x113c], 0xf3b720fa
mov dword [ebp - 0x3c], 0
jmp 0x435b8a
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 4
jge 0x435ba0
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1a3c], 0x5ee56e31
jmp 0x435b83
mov dword [ebp - 0x3c], 0
jmp 0x435bb0
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x435bcc
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x1758]
call fcn.0040818c
mov dword [eax], 0x4bf7a832
jmp 0x435ba9
mov dword [ebp - 0x3c], 0
jmp 0x435bdc
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x435bf2
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1530], 1
jmp 0x435bd5
mov dword [ebp - 0x2c0], 0
jmp 0x435c0b
mov eax, dword [ebp - 0x2c0]
inc eax
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x2c0], 0x17
jne 0x435e9a
mov dword [ebp - 0x5f0], 0xb283066c
mov dword [ebp - 0x1400], 5
mov dword [ebp - 0x794], 0xa3187110
mov dword [ebp - 0x1ab4], 0xfffffff9
mov dword [ebp - 0x1408], 0x8f1edd1e
mov dword [ebp - 0x560], 3
mov dword [ebp - 0x430], 0
jmp 0x435c6d
mov eax, dword [ebp - 0x430]
inc eax
mov dword [ebp - 0x430], eax
cmp dword [ebp - 0x430], 2
jge 0x435c89
mov eax, dword [ebp - 0x430]
mov dword [ebp + eax*4 - 0x1cf4], 1
jmp 0x435c60
mov eax, dword [ebp - 0x560]
dec eax
mov dword [ebp - 0x560], eax
je 0x435d3f
cmp dword [ebp - 0x794], 0
je 0x435cba
mov eax, 0xe456
test eax, eax
je 0x435cba
mov dword [ebp - 0x77c], 1
jmp 0x435cc1
and dword [ebp - 0x77c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1cf4]
mov dword [ebp - 0x1abc], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x77c]
add ecx, dword [ebp + eax - 0x1a3c]
mov dword [ebp - 0x10ec], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x10ec]
mov dword [ebp + eax - 0x1a3c], ecx
cmp dword [ebp - 0x10ec], 0xfffffffe
jl 0x435d14
mov dword [ebp - 0x784], 1
jmp 0x435d1b
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x4e4], eax
cmp dword [ebp - 0x4e4], 0xb323fa9d
je 0x435d3f
mov dword [ebp - 0x10f4], 1
jmp 0x435d46
and dword [ebp - 0x10f4], 0
mov eax, dword [ebp - 0x10f4]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
sub eax, 9
jne 0x435d69
mov dword [ebp - 0x78c], 1
jmp 0x435d70
and dword [ebp - 0x78c], 0
mov eax, dword [ebp - 0x25c]
add eax, dword [ebp - 0x78c]
cmp eax, dword [ebp - 0x290]
jge 0x435d90
mov dword [ebp - 0x10fc], 1
jmp 0x435d97
and dword [ebp - 0x10fc], 0
mov eax, dword [ebp - 0x10fc]
mov dword [ebp - 0x568], eax
cmp dword [ebp - 0x568], 0xffffffff
jge 0x435db8
mov dword [ebp - 0x1104], 1
jmp 0x435dbf
and dword [ebp - 0x1104], 0
mov eax, dword [ebp - 0x794]
cmp dword [ebp - 0x1104], eax
jl 0x435dd9
mov dword [ebp - 0x79c], 1
jmp 0x435de0
and dword [ebp - 0x79c], 0
mov eax, dword [ebp - 0x1400]
cmp eax, dword [ebp - 0x79c]
jl 0x435dfa
mov dword [ebp - 0x110c], 1
jmp 0x435e01
and dword [ebp - 0x110c], 0
mov eax, dword [ebp - 0x110c]
sub eax, dword [ebp - 0x1408]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x5f0]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x1518], eax
mov eax, dword [ebp - 0x5f0]
inc eax
mov dword [ebp - 0x5f0], eax
mov eax, dword [ebp - 0x1410]
cmp eax, dword [ebp - 0x1518]
je 0x435e52
mov dword [ebp - 0x7a4], 1
jmp 0x435e59
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x7a4], eax
jle 0x435e73
mov dword [ebp - 0x1114], 1
jmp 0x435e7a
and dword [ebp - 0x1114], 0
mov esi, dword [ebp - 0x1114]
sub esi, dword [ebp - 0x2c0]
push 1
lea ecx, [ebp - 0x1758]
call fcn.0040818c
mov dword [eax], esi
jmp 0x435bfe
mov eax, dword [ebp - 0x290]
mov dword [ebp - 0x1ac4], eax
mov eax, dword [ebp - 0x290]
cmp dword [ebp - 0x1520], eax
jne 0x435ec0
mov dword [ebp - 0x7ac], 1
jmp 0x435ec7
and dword [ebp - 0x7ac], 0
cmp dword [ebp - 0x7ac], 0xffffffff
jg 0x435edc
mov dword [ebp - 0x1134], 1
jmp 0x435ee3
and dword [ebp - 0x1134], 0
push 1
lea ecx, [ebp - 0x1758]
call fcn.0040818c
mov dword [eax], 1
xor eax, eax
inc eax
cmp eax, 0x283d3454
je 0x435f0c
mov dword [ebp - 0x111c], 1
jmp 0x435f13
and dword [ebp - 0x111c], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x111c], eax
jne 0x435f2d
mov dword [ebp - 0x7b4], 1
jmp 0x435f34
and dword [ebp - 0x7b4], 0
mov eax, dword [ebp - 0x568]
imul eax, dword [ebp - 0x7b4]
test eax, eax
je 0x435f4c
push 7
pop eax
test eax, eax
jne 0x435f5e
cmp dword [ebp - 0x290], 0
jne 0x435f5e
and dword [ebp - 0x1124], 0
jmp 0x435f68
mov dword [ebp - 0x1124], 1
cmp dword [ebp - 0x1124], 0x295d0c5f
jg 0x435f80
mov dword [ebp - 0x7bc], 1
jmp 0x435f87
and dword [ebp - 0x7bc], 0
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x7bc], eax
jge 0x435fa1
mov dword [ebp - 0x112c], 1
jmp 0x435fa8
and dword [ebp - 0x112c], 0
mov eax, dword [ebp - 0x4e4]
cmp dword [ebp - 0x112c], eax
jle 0x435fc2
mov dword [ebp - 0x7c4], 1
jmp 0x435fc9
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0x7c4]
mov dword [ebp - 0x25c], eax
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x1134], eax
jne 0x435ff8
mov eax, 0x131ac691
test eax, eax
je 0x435ff8
mov dword [ebp - 0x7cc], 1
jmp 0x435fff
and dword [ebp - 0x7cc], 0
mov eax, dword [ebp - 0x348]
cmp dword [ebp - 0x7cc], eax
jge 0x436019
mov dword [ebp - 0x1528], 1
jmp 0x436020
and dword [ebp - 0x1528], 0
mov eax, dword [ebp - 0x4e4]
mov dword [ebp - 0x1acc], eax
mov eax, dword [ebp - 0x113c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x1a3c]
add eax, dword [ebp - 0x113c]
mov dword [ebp - 0x7d4], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x7d4]
mov dword [ebp + eax - 0x1a3c], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x7d4]
mov dword [ebp + eax - 0x1530], ecx
lea ecx, [ebp - 0x1758]
call fcn.00408170
push 2
lea ecx, [ebp - 0x1d78]
call fcn.0040809e
mov dword [ebp - 0x7e4], 0xb903cfcb
mov dword [ebp - 0x60c], 1
push 2
lea ecx, [ebp - 0x1348]
call fcn.0040809e
mov dword [ebp - 0x804], 1
mov dword [ebp - 0x80c], 0xf50e16ff
push 3
lea ecx, [ebp - 0x1904]
call fcn.0040809e
mov dword [ebp - 0x10], 0
jmp 0x4360da
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x4360f0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2e8], 0xd7d490c4
jmp 0x4360d3
mov dword [ebp - 0x10], 0
jmp 0x436100
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x436116
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x13a8], 0
jmp 0x4360f9
mov dword [ebp - 0x10], 0
jmp 0x436126
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x436142
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1348]
call fcn.0040818c
mov dword [eax], 0x6fc75dfc
jmp 0x43611f
mov dword [ebp - 0x10], 0
jmp 0x436152
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x43616e
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1904]
call fcn.0040818c
mov dword [eax], 0x3333
jmp 0x43614b
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov eax, dword [ebp + eax - 0x2e8]
mov dword [ebp + ecx - 0x2e8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2e8]
mov dword [ebp - 0x1144], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1144]
mov dword [ebp + eax - 0x2e8], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13a8]
cmp dword [ebp - 0x1144], eax
jle 0x4361d5
mov eax, 0x5051acae
test eax, eax
jne 0x4361d5
and dword [ebp - 0x7dc], 0
jmp 0x4361df
mov dword [ebp - 0x7dc], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13a8]
cmp dword [ebp - 0x7dc], eax
jge 0x436200
mov dword [ebp - 0x114c], 1
jmp 0x436207
and dword [ebp - 0x114c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x13a8]
cmp dword [ebp - 0x114c], eax
jg 0x436227
mov dword [ebp - 0x1538], 1
jmp 0x43622e
and dword [ebp - 0x1538], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x13a8]
mov dword [ebp - 0x1ad4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x13a8]
mov dword [ebp - 0x1adc], eax
mov dword [ebp - 0x7e4], 3
cmp dword [ebp - 0x7e4], 0
je 0x436272
mov dword [ebp - 0x1540], 1
jmp 0x436279
and dword [ebp - 0x1540], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x13a8]
mov dword [ebp - 0x1ae4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2e8], 0
jne 0x4362ad
cmp dword [ebp - 0x60c], 0
jne 0x4362ad
and dword [ebp - 0x1154], 0
jmp 0x4362b7
mov dword [ebp - 0x1154], 1
cmp dword [ebp - 0x1154], 0x7bff
jg 0x4362d8
cmp dword [ebp - 0x60c], 0
je 0x4362d8
mov dword [ebp - 0x7ec], 1
jmp 0x4362df
and dword [ebp - 0x7ec], 0
push 1
lea ecx, [ebp - 0x1348]
call fcn.0040818c
mov ecx, dword [ebp - 0x7ec]
cmp ecx, dword [eax]
jg 0x436302
mov dword [ebp - 0x115c], 1
jmp 0x436309
and dword [ebp - 0x115c], 0
push 0
lea ecx, [ebp - 0x1348]
call fcn.0040818c
mov ecx, dword [ebp - 0x115c]
cmp ecx, dword [eax]
jge 0x43632c
mov dword [ebp - 0x7f4], 1
jmp 0x436333
and dword [ebp - 0x7f4], 0
mov eax, dword [ebp - 0x7f4]
add eax, 0x5ec8d9db
je 0x436345
xor eax, eax
inc eax
jne 0x436355
push 0xfffffffffffffff6
pop eax
test eax, eax
jne 0x436355
and dword [ebp - 0x1164], 0
jmp 0x43635f
mov dword [ebp - 0x1164], 1
cmp dword [ebp - 0x1164], 0x1cf6
jle 0x436377
mov dword [ebp - 0x7fc], 1
jmp 0x43637e
and dword [ebp - 0x7fc], 0
push 0
lea ecx, [ebp - 0x1348]
call fcn.0040818c
mov ecx, dword [ebp - 0x7fc]
cmp ecx, dword [eax]
jg 0x4363a1
mov dword [ebp - 0x116c], 1
jmp 0x4363a8
and dword [ebp - 0x116c], 0
push 1
lea ecx, [ebp - 0x1348]
call fcn.0040818c
mov ecx, dword [ebp - 0x116c]
imul ecx, dword [eax]
mov dword [ebp - 0x804], ecx
mov eax, dword [ebp - 0x60c]
cmp dword [ebp - 0x804], eax
jg 0x4363de
mov dword [ebp - 0x1174], 1
jmp 0x4363e5
and dword [ebp - 0x1174], 0
mov eax, dword [ebp - 0x1174]
mov dword [ebp - 0x80c], eax
mov esi, dword [ebp - 0x80c]
push 1
lea ecx, [ebp - 0x1904]
call fcn.0040818c
mov dword [eax], esi
lea ecx, [ebp - 0x1904]
call fcn.00408170
lea ecx, [ebp - 0x1348]
call fcn.00408170
mov dword [ebp - 0x358], 0
mov dword [ebp - 0x1aec], 0
mov dword [ebp - 0x350], 0
jmp 0x436449
mov eax, dword [ebp - 0x350]
inc eax
mov dword [ebp - 0x350], eax
cmp dword [ebp - 0x350], 2
jge 0x43646b
push dword [ebp - 0x350]
lea ecx, [ebp - 0x1d78]
call fcn.0040818c
mov dword [eax], 0xfffffff9
jmp 0x43643c
mov dword [ebp - 0x160], 9
mov dword [ebp - 0x1550], 9
mov dword [ebp - 0x570], 0xfffffff9
mov dword [ebp - 0x1564], 0x5cb81eca
mov dword [ebp - 0x438], 0
jmp 0x4364ac
mov eax, dword [ebp - 0x438]
inc eax
mov dword [ebp - 0x438], eax
cmp dword [ebp - 0x438], 1
jge 0x4364c8
mov eax, dword [ebp - 0x438]
mov dword [ebp + eax*4 - 0x1548], 0
jmp 0x43649f
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
mov eax, dword [ebp - 0x160]
add eax, dword [ebp - 0x160]
imul eax, dword [ebp - 0x160]
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1548], eax
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x160], eax
jl 0x43650f
mov dword [ebp - 0x117c], 1
jmp 0x436516
and dword [ebp - 0x117c], 0
mov eax, dword [ebp - 0x117c]
mov dword [ebp - 0x1550], eax
mov eax, dword [ebp - 0x570]
add eax, 9
cmp eax, dword [ebp - 0x570]
jl 0x43653f
mov dword [ebp - 0x814], 1
jmp 0x436546
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x160]
cmp eax, dword [ebp - 0x814]
jle 0x436560
mov dword [ebp - 0x1184], 1
jmp 0x436567
and dword [ebp - 0x1184], 0
mov eax, dword [ebp - 0x1184]
sub eax, dword [ebp - 0x570]
sub eax, 0x29de13df
cmp dword [ebp - 0x160], eax
jg 0x43658c
mov dword [ebp - 0x81c], 1
jmp 0x436593
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x81c]
mov dword [ebp - 0x1564], eax
mov dword [ebp - 0x358], 0
jmp 0x4365b8
cmp dword [ebp - 0x358], 1
jg 0x4374c2
mov dword [ebp - 0x54], 0x17059141
mov dword [ebp - 0x838], 7
mov dword [ebp - 0x1584], 0xffffffff
mov dword [ebp - 0x4b4], 0
jmp 0x4365f9
mov eax, dword [ebp - 0x4b4]
inc eax
mov dword [ebp - 0x4b4], eax
cmp dword [ebp - 0x4b4], 3
jge 0x436615
mov eax, dword [ebp - 0x4b4]
mov dword [ebp + eax*4 - 0x1d68], 0x86695cd1
jmp 0x4365ec
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1af4], eax
push 0xfffffffffffffffb
pop eax
test eax, eax
je 0x436637
cmp dword [ebp - 0x54], 0
je 0x436637
mov dword [ebp - 0x118c], 1
jmp 0x43663e
and dword [ebp - 0x118c], 0
mov eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x118c]
cmp dword [ebp - 0x54], eax
jne 0x436659
mov dword [ebp - 0x824], 1
jmp 0x436660
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x824], eax
jl 0x436677
mov dword [ebp - 0x156c], 1
jmp 0x43667e
and dword [ebp - 0x156c], 0
mov eax, 0x12a83a0f
test eax, eax
jne 0x436696
cmp dword [ebp - 0x54], 0
jne 0x436696
and dword [ebp - 0x1194], 0
jmp 0x4366a0
mov dword [ebp - 0x1194], 1
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x1194]
jg 0x4366b7
mov dword [ebp - 0x82c], 1
jmp 0x4366be
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x82c], eax
jne 0x4366d5
mov dword [ebp - 0x119c], 1
jmp 0x4366dc
and dword [ebp - 0x119c], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x119c], eax
je 0x4366f3
mov dword [ebp - 0x1574], 1
jmp 0x4366fa
and dword [ebp - 0x1574], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x54], eax
jl 0x43670e
mov dword [ebp - 0x11a4], 1
jmp 0x436715
and dword [ebp - 0x11a4], 0
mov eax, dword [ebp - 0x11a4]
mov dword [ebp - 0x838], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x838], eax
je 0x436738
mov dword [ebp - 0x157c], 1
jmp 0x43673f
and dword [ebp - 0x157c], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1afc], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1b04], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1d68], 0
je 0x43677d
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1d68], 0
je 0x43677d
mov dword [ebp - 0xdf4], 1
jmp 0x436784
and dword [ebp - 0xdf4], 0
cmp dword [ebp - 0xdf4], 0xfffc
jb 0x43679c
mov dword [ebp - 0x840], 1
jmp 0x4367a3
and dword [ebp - 0x840], 0
cmp dword [ebp - 0x840], 2
jae 0x4367b8
mov dword [ebp - 0xdbc], 1
jmp 0x4367bf
and dword [ebp - 0xdbc], 0
cmp dword [ebp - 0xdbc], 2
jae 0x4367d4
mov dword [ebp - 0x848], 1
jmp 0x4367db
and dword [ebp - 0x848], 0
mov eax, dword [ebp - 0x848]
mov dword [ebp - 0x1584], eax
mov byte [ebp - 0x1be], 0
movzx eax, byte [ebp - 0x1be]
test eax, eax
je 0x43680f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 1
lea ecx, [ebp - 0x1664]
call fcn.0040809e
mov dword [ebp - 0x1b0c], 1
mov dword [ebp - 0x1b14], 0xb3921ded
mov dword [ebp - 0x1b1c], 0xffffffff
mov dword [ebp - 0x1b24], 1
mov dword [ebp - 0x1b2c], 0x52733582
mov dword [ebp - 0x1b34], 0x4b58e17c
mov dword [ebp - 0x1b3c], 0x7e4a9061
mov dword [ebp - 0x850], 0xa7c6dd3e
mov dword [ebp - 0xf4], 0
jmp 0x436885
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 1
jge 0x4368a7
push dword [ebp - 0xf4]
lea ecx, [ebp - 0x1664]
call fcn.0040818c
mov dword [eax], 0x48bbca63
jmp 0x436878
mov dword [ebp - 0xf4], 0
jmp 0x4368c0
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 4
jge 0x4368dc
mov eax, dword [ebp - 0xf4]
mov dword [ebp + eax*4 - 0x21d4], 0xc67ee39f
jmp 0x4368b3
mov byte [ebp - 0x1c0], 0
movzx eax, byte [ebp - 0x1c0]
test eax, eax
je 0x4368f6
push 0
call dword [sym.imp.USER32.dll_SetCursor]
push 0
lea ecx, [ebp - 0x1664]
call fcn.0040818c
and dword [eax], 0
jmp 0x43692c
push 0
lea ecx, [ebp - 0x1664]
call fcn.0040818c
mov dword [ebp - 0x1158], eax
mov eax, dword [ebp - 0x1158]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1158]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1664]
call fcn.0040818c
cmp dword [eax], 7
jl 0x436a1a
mov dword [ebp - 0x1b44], 1
mov dword [ebp - 0x1b4c], 5
mov dword [ebp - 0x1b54], 0
mov dword [ebp - 0x1b5c], 0xda7fe64f
mov dword [ebp - 0x1b64], 8
mov dword [ebp - 0x1b6c], 0xffffffff
mov dword [ebp - 0x1b74], 0x301355ff
mov dword [ebp - 0x1b7c], 0x71a05132
mov dword [ebp - 0x1b84], 0xdfddae9
mov dword [ebp - 0x1b8c], 1
mov dword [ebp - 0x1b94], 0x813bf58a
mov dword [ebp - 0x1b9c], 0xfffffffe
mov dword [ebp - 0x1ba4], 0xfffffff8
mov dword [ebp - 0x1bac], 0xfffffff9
mov dword [ebp - 0x1bb4], 0xbebf3b8c
mov dword [ebp - 0x1bbc], 1
mov byte [ebp - 0x194], 0
movzx eax, byte [ebp - 0x194]
test eax, eax
je 0x436a08
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov eax, dword [ebp - 0x850]
dec eax
mov dword [ebp - 0x850], eax
jmp 0x436908
lea ecx, [ebp - 0x1664]
call fcn.00408170
mov dword [ebp - 0x1bc4], 0x87f2fb5a
or dword [ebp - 0x18bc], 0xffffffff
or dword [ebp - 0x18b8], 0xffffffff
or dword [ebp - 0x18b4], 0xffffffff
or dword [ebp - 0x18b0], 0xffffffff
lea ecx, [ebp - 0x5f1]
call fcn.0040819b
push eax
lea eax, [ebp - 0x18ac]
push eax
lea eax, [ebp - 0x18bc]
push eax
lea ecx, [ebp - 0x2198]
call fcn.0040819e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x20bc]
call fcn.0040814a
mov dword [ebp - 0x440], 1
mov dword [ebp - 0x1bcc], 0xe871d976
mov dword [ebp - 0x1bd4], 0xfe1ca296
mov dword [ebp - 0x1bdc], 0x67e307b5
mov dword [ebp - 0x1be4], 0xfffffff6
mov dword [ebp - 0x1bec], 0
mov dword [ebp - 0x1bf4], 9
mov dword [ebp - 0x1bfc], 0xd3aeb590
mov dword [ebp - 0x1c04], 0
mov dword [ebp - 0xda8], 0xfffe
mov dword [ebp - 0x360], 0
jmp 0x436afd
mov eax, dword [ebp - 0x360]
inc eax
mov dword [ebp - 0x360], eax
cmp dword [ebp - 0x360], 4
jge 0x436b19
mov eax, dword [ebp - 0x360]
mov dword [ebp + eax*4 - 0x21c4], 0x95751cfd
jmp 0x436af0
mov eax, dword [ebp - 0xda8]
inc eax
mov dword [ebp - 0xda8], eax
mov dword [ebp - 0x440], 0
jmp 0x436b3f
mov eax, dword [ebp - 0x440]
inc eax
mov dword [ebp - 0x440], eax
cmp dword [ebp - 0x440], 3
jg 0x436bbc
mov byte [ebp - 0x184], 0
movzx eax, byte [ebp - 0x184]
test eax, eax
je 0x436b8c
push 0x24f3
push 0x1f1a
push 0x6c
push 0x106e
push 0x1fce
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
mov byte [ebp - 0x196], 0
movzx eax, byte [ebp - 0x196]
test eax, eax
je 0x436bb7
push 0xf2e
push 0xa92
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
jmp 0x436b32
lea ecx, [ebp - 0x20bc]
call fcn.00408170
mov dword [ebp - 0x1c0c], 0xfffffffb
mov dword [ebp - 0x8d0], 0xe4b7834d
mov dword [ebp - 0x368], 7
mov dword [ebp - 0x16ec], 0xe19f
mov dword [ebp - 0x16e8], 0xe19f
mov dword [ebp - 0x16e4], 0xe19f
mov dword [ebp - 0x16e0], 0xe19f
mov dword [ebp - 0x5f8], 0xfffffffd
mov dword [ebp - 0x1020], 0xa97f51ef
push 2
lea ecx, [ebp - 0x1770]
call fcn.0040809e
mov dword [ebp - 0x159c], 7
mov dword [ebp - 0x13c], 0
jmp 0x436c51
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x436c6d
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x544], 2
jmp 0x436c44
mov dword [ebp - 0x13c], 0
jmp 0x436c86
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 2
jge 0x436ca8
push dword [ebp - 0x13c]
lea ecx, [ebp - 0x1770]
call fcn.0040818c
mov dword [eax], 0x169ff4ca
jmp 0x436c79
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x544]
push 4
pop edx
shl edx, 0
imul ecx, dword [ebp + edx - 0x544]
cmp dword [ebp + eax - 0x544], ecx
jge 0x436cde
mov dword [ebp - 0x158c], 1
jmp 0x436ce5
and dword [ebp - 0x158c], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x16ec], 0
je 0x436d11
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x16ec], 0
je 0x436d11
mov dword [ebp - 0x858], 1
jmp 0x436d18
and dword [ebp - 0x858], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x16ec]
imul eax, dword [ebp - 0x858]
sub eax, 3
mov dword [ebp - 0x5f8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x544]
cmp dword [ebp - 0x5f8], eax
jne 0x436d56
mov dword [ebp - 0x1594], 1
jmp 0x436d5d
and dword [ebp - 0x1594], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x544]
mov dword [ebp - 0x1c14], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x1020], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x544]
cmp dword [ebp - 0x1020], eax
jle 0x436d9d
mov dword [ebp - 0x860], 1
jmp 0x436da4
and dword [ebp - 0x860], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x860]
add ecx, dword [ebp + eax - 0x16ec]
mov dword [ebp - 0xdb0], ecx
push 1
lea ecx, [ebp - 0x1770]
call fcn.0040818c
mov ecx, dword [ebp - 0xdb0]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x544]
cmp eax, dword [ebp - 0xdb0]
jg 0x436df3
mov dword [ebp - 0x868], 1
jmp 0x436dfa
and dword [ebp - 0x868], 0
mov eax, dword [ebp - 0x368]
imul eax, dword [ebp - 0x868]
cmp dword [ebp - 0x368], eax
jge 0x436e1b
mov dword [ebp - 0x1200], 1
jmp 0x436e22
and dword [ebp - 0x1200], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x544]
cmp dword [ebp - 0x1200], eax
jne 0x436e43
mov dword [ebp - 0x870], 1
jmp 0x436e4a
and dword [ebp - 0x870], 0
mov eax, dword [ebp - 0x870]
mov dword [ebp - 0x159c], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x1c1c], eax
push 0
lea ecx, [ebp - 0x1770]
call fcn.0040818c
mov dword [eax], 1
mov dword [ebp - 0x5f8], 1
lea ecx, [ebp - 0x1770]
call fcn.00408170
push 1
lea ecx, [ebp - 0x278]
call fcn.0040809e
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x878], 0x7f6c
mov dword [ebp - 0x15b4], 0xfffe
mov dword [ebp - 0x15bc], 0xfffffff9
mov dword [ebp - 0x15cc], 0xfffffffe
mov dword [ebp - 0xfc], 0
jmp 0x436ee2
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 1
jge 0x436f04
push dword [ebp - 0xfc]
lea ecx, [ebp - 0x278]
call fcn.0040818c
mov dword [eax], 0x3fcb50bf
jmp 0x436ed5
mov dword [ebp - 0xfc], 0
jmp 0x436f1d
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 3
jge 0x436f39
mov eax, dword [ebp - 0xfc]
mov dword [ebp + eax*4 - 0x20ec], 0x50170a2c
jmp 0x436f10
push 0
lea ecx, [ebp - 0x278]
call fcn.0040818c
cmp dword [eax], 0
jne 0x436f95
push 0
lea ecx, [ebp - 0x278]
call fcn.0040818c
mov esi, eax
push 0
lea ecx, [ebp - 0x278]
call fcn.0040818c
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x436f79
mov dword [ebp - 0xdb8], 1
jmp 0x436f80
and dword [ebp - 0xdb8], 0
cmp dword [ebp - 0xdb8], 0x76e5
jle 0x436f95
and dword [ebp - 0x15a4], 0
jmp 0x436f9f
mov dword [ebp - 0x15a4], 1
push 0
lea ecx, [ebp - 0x278]
call fcn.0040818c
mov dword [ebp - 0x878], 1
mov esi, dword [ebp - 0x878]
push 0
lea ecx, [ebp - 0x278]
call fcn.0040818c
cmp esi, dword [eax]
jl 0x436fd9
mov dword [ebp - 0x1028], 1
jmp 0x436fe0
and dword [ebp - 0x1028], 0
push 0
lea ecx, [ebp - 0x278]
call fcn.0040818c
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1028]
je 0x437003
mov dword [ebp - 0x880], 1
jmp 0x43700a
and dword [ebp - 0x880], 0
mov esi, dword [ebp - 0x880]
neg esi
push 0
lea ecx, [ebp - 0x278]
call fcn.0040818c
imul esi, dword [eax]
imul esi, esi, 0xffffffff
push 0
lea ecx, [ebp - 0x278]
call fcn.0040818c
cmp esi, dword [eax]
jge 0x437049
push 9
pop eax
test eax, eax
je 0x437049
mov dword [ebp - 0xdc0], 1
jmp 0x437050
and dword [ebp - 0xdc0], 0
push 0
lea ecx, [ebp - 0x278]
call fcn.0040818c
mov eax, dword [eax]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0xdc0]
jg 0x4373e9
mov dword [ebp - 0x370], 0x9a54e587
mov dword [ebp - 0x890], 0x69e0cd1a
mov dword [ebp - 0xde0], 0x7afff16c
mov dword [ebp - 0x15c4], 0x3a43
mov dword [ebp - 0x50c], 0
jmp 0x4370b8
mov eax, dword [ebp - 0x50c]
inc eax
mov dword [ebp - 0x50c], eax
cmp dword [ebp - 0x50c], 4
jge 0x4370d4
mov eax, dword [ebp - 0x50c]
mov dword [ebp + eax*4 - 0x1a2c], 0xeeb3
jmp 0x4370ab
mov eax, dword [ebp - 0x370]
mov dword [ebp - 0x1c24], eax
cmp dword [ebp - 0x370], 0x9f13
jge 0x4370f8
mov dword [ebp - 0x888], 1
jmp 0x4370ff
and dword [ebp - 0x888], 0
mov eax, dword [ebp - 0x888]
sub eax, dword [ebp - 0xb8]
jne 0x437119
mov dword [ebp - 0x15d4], 0xa5dbdfdd
mov dword [ebp - 0xb8], 0xffffffe6
jmp 0x43740c
cmp dword [ebp - 0xb8], 3
jl 0x437437
mov dword [ebp - 0x15dc], 0
cmp dword [ebp - 0x15d4], 0
je 0x43742a
jmp 0x437437
cmp dword [ebp - 0x15dc], 0
je 0x437435
mov byte [ebp - 0x186], 0
movzx eax, byte [ebp - 0x186]
test eax, eax
je 0x437456
push 0x20c8
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov byte [ebp - 0x198], 0
movzx eax, byte [ebp - 0x198]
test eax, eax
je 0x437470
lea ecx, [ebp - 0x1d78]
call fcn.00408170
mov dword [ebp - 0x378], 1
mov dword [ebp - 0x1c34], 0
mov dword [ebp - 0x378], 7
jmp 0x4374fa
mov eax, dword [ebp - 0x378]
dec eax
mov dword [ebp - 0x378], eax
cmp dword [ebp - 0x378], 0xfffffff9
jl 0x437548
mov byte [ebp - 0x188], 0
movzx eax, byte [ebp - 0x188]
test eax, eax
je 0x43752e
push 0x1de3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov byte [ebp - 0x19a], 0
movzx eax, byte [ebp - 0x19a]
test eax, eax
je 0x437546
call dword [sym.imp.USER32.dll_GetMessageTime]
jmp 0x4374ed
mov dword [ebp - 0x1c8], 0
mov dword [ebp - 0x578], 0xffffffff
mov dword [ebp - 0x8f0], 0
mov dword [ebp - 0xdf8], 1
mov dword [ebp - 0x158], 0
jmp 0x437589
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x4375a5
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x228], 0xfffffffc
jmp 0x43757c
mov dword [ebp - 0x158], 0
jmp 0x4375be
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 1
jge 0x4375da
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x908], 0x7cdedfc3
jmp 0x4375b1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x1c8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
cmp dword [ebp - 0x1c8], eax
jge 0x43760e
mov dword [ebp - 0xde8], 1
jmp 0x437615
and dword [ebp - 0xde8], 0
mov eax, dword [ebp - 0xde8]
mov dword [ebp - 0x578], eax
push 4
pop eax
shl eax, 0
imul eax, dword [ebp + eax - 0x228], 0x478c
cmp dword [ebp - 0x578], eax
jg 0x437646
mov dword [ebp - 0x8d8], 1
jmp 0x43764d
and dword [ebp - 0x8d8], 0
cmp dword [ebp - 0x8d8], 0xffffffff
jne 0x437662
mov dword [ebp - 0x1040], 1
jmp 0x437669
and dword [ebp - 0x1040], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x228]
sub eax, dword [ebp - 0x1040]
cmp eax, 0x8e486aeb
jne 0x43768f
mov dword [ebp - 0x8e0], 1
jmp 0x437696
and dword [ebp - 0x8e0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
imul eax, dword [ebp - 0x8e0]
cmp eax, 0x978d
jg 0x4376bd
mov dword [ebp - 0xdf0], 1
jmp 0x4376c4
and dword [ebp - 0xdf0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xdf0]
sub ecx, dword [ebp + eax - 0x228]
jne 0x4376eb
cmp dword [ebp - 0x578], 0
jne 0x4376eb
and dword [ebp - 0x8e8], 0
jmp 0x4376f5
mov dword [ebp - 0x8e8], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
cmp dword [ebp - 0x8e8], eax
jg 0x437716
mov dword [ebp - 0x614], 1
jmp 0x43771d
and dword [ebp - 0x614], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x614]
mov dword [ebp + eax - 0x908], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
imul eax, dword [ebp - 0x614]
push 4
pop ecx
shl ecx, 0
cmp dword [ebp + ecx - 0x228], eax
jne 0x43775f
mov dword [ebp - 0x120c], 1
jmp 0x437766
and dword [ebp - 0x120c], 0
mov eax, dword [ebp - 0x8f0]
cmp dword [ebp - 0x120c], eax
jl 0x43777b
cmp dword [ebp - 0x8f0], 0
mov dword [ebp - 0xdf8], 0x6a08376f
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
mov dword [ebp - 0x1c3c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
cmp dword [ebp - 0xdf8], eax
jg 0x4377b9
mov dword [ebp - 0x8f8], 1
jmp 0x4377c0
and dword [ebp - 0x8f8], 0
mov eax, dword [ebp - 0x1c8]
add eax, dword [ebp - 0x8f8]
je 0x4377ea
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x228], 0
je 0x4377ea
mov dword [ebp - 0x1048], 1
jmp 0x4377f1
and dword [ebp - 0x1048], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x228]
cmp dword [ebp - 0x1048], eax
jge 0x437812
mov dword [ebp - 0x900], 1
jmp 0x437819
and dword [ebp - 0x900], 0
imul eax, dword [ebp - 0x1c8], 0
imul eax, dword [ebp - 0x900]
cmp eax, dword [ebp - 0x1c8]
jne 0x43783b
mov dword [ebp - 0xe00], 1
jmp 0x437842
and dword [ebp - 0xe00], 0
mov eax, dword [ebp - 0xe00]
mov dword [ebp - 0x1c8], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c8]
mov dword [ebp + eax - 0x908], ecx
and dword [ebp - 0x1894], 0
and dword [ebp - 0x1890], 0
and dword [ebp - 0x188c], 0
and dword [ebp - 0x1888], 0
lea ecx, [ebp - 0x63d]
call fcn.0040819b
push eax
lea eax, [ebp - 0x1884]
push eax
lea eax, [ebp - 0x1894]
push eax
lea ecx, [ebp - 0x2110]
call fcn.0040819e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2098]
call fcn.0040814a
mov dword [ebp - 0x4ec], 0xffffffff
mov dword [ebp - 0x1c44], 0xf75d
mov dword [ebp - 0x1c4c], 0
push 2
lea ecx, [ebp - 0x1d98]
call fcn.0040809e
push 2
lea ecx, [ebp - 0x1d88]
call fcn.0040809e
mov dword [ebp - 0x1c54], 0x660f7e73
mov dword [ebp - 0x1170], 0xffffffff
mov dword [ebp - 0x104], 0
jmp 0x437917
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x437939
push dword [ebp - 0x104]
lea ecx, [ebp - 0x1d98]
call fcn.0040818c
mov dword [eax], 4
jmp 0x43790a
mov dword [ebp - 0x104], 0
jmp 0x437952
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 2
jge 0x437974
push dword [ebp - 0x104]
lea ecx, [ebp - 0x1d88]
call fcn.0040818c
mov dword [eax], 0xfffffffc
jmp 0x437945
mov eax, dword [ebp - 0x1170]
inc eax
mov dword [ebp - 0x1170], eax
lea ecx, [ebp - 0x1d88]
call fcn.00408170
lea ecx, [ebp - 0x1d98]
call fcn.00408170
mov dword [ebp - 0x1d0], 1
push 1
lea ecx, [ebp - 0x1788]
call fcn.0040809e
mov dword [ebp - 0x918], 1
mov dword [ebp - 0x1c5c], 0
mov dword [ebp - 0x1c64], 0
mov dword [ebp - 0x4bc], 0
jmp 0x4379e5
mov eax, dword [ebp - 0x4bc]
inc eax
mov dword [ebp - 0x4bc], eax
cmp dword [ebp - 0x4bc], 1
jge 0x437a07
push dword [ebp - 0x4bc]
lea ecx, [ebp - 0x1788]
call fcn.0040818c
mov dword [eax], 0xfffffffe
jmp 0x4379d8
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
mov dword [ebp - 0x1d0], 0
jmp 0x437a2d
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 0
jg 0x437c6a
mov dword [ebp - 0x298], 0x9f7fd1e8
mov dword [ebp - 0x1c6c], 0x47d1afd0
mov dword [ebp - 0x298], 0
jmp 0x437a67
mov eax, dword [ebp - 0x298]
dec eax
mov dword [ebp - 0x298], eax
cmp dword [ebp - 0x298], 0
jl 0x437c51
mov dword [ebp - 0x450], 0xffffffff
mov dword [ebp - 0x1c74], 0x890fc520
mov dword [ebp - 0x380], 0
jmp 0x437aa1
mov eax, dword [ebp - 0x380]
inc eax
mov dword [ebp - 0x380], eax
cmp dword [ebp - 0x380], 2
jge 0x437abd
mov eax, dword [ebp - 0x380]
mov dword [ebp + eax*4 - 0x1f30], 0
jmp 0x437a94
mov byte [ebp - 0x18a], 0
movzx eax, byte [ebp - 0x18a]
test eax, eax
je 0x437ae3
push 0
push 0x183b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [ebp - 0x450], 0
jmp 0x437afc
mov eax, dword [ebp - 0x450]
dec eax
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 0
jl 0x437c4c
mov dword [ebp - 0x388], 0
jmp 0x437b22
mov eax, dword [ebp - 0x388]
inc eax
mov dword [ebp - 0x388], eax
cmp dword [ebp - 0x388], 2
jge 0x437b3e
mov eax, dword [ebp - 0x388]
mov dword [ebp + eax*4 - 0x1a68], 0xfffffffc
jmp 0x437b15
push dword [ebp - 0x298]
lea ecx, [ebp - 0x1788]
call fcn.0040818c
cmp dword [eax], 0xf257
jg 0x437b63
mov dword [ebp - 0x910], 1
jmp 0x437b6a
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0x1d0]
cmp dword [ebp - 0x910], eax
je 0x437b84
mov dword [ebp - 0xe08], 1
jmp 0x437b8b
and dword [ebp - 0xe08], 0
mov eax, dword [ebp - 0xe08]
mov dword [ebp - 0x918], eax
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0x1050], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1050]
mov dword [ebp + eax - 0x1f30], ecx
cmp dword [ebp - 0x1050], 0
je 0x437bfa
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1a68], 0xa519d814
mov byte [ebp - 0x19c], 0
movzx eax, byte [ebp - 0x19c]
test eax, eax
je 0x437bf8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
jmp 0x437c47
mov dword [ebp - 0x920], 0x920a6ff
mov byte [ebp - 0x18d], 0
movzx eax, byte [ebp - 0x18d]
test eax, eax
je 0x437c3a
push 0x1d75
push 0
push 0
push 0
push 0
push 0xd1a
push 0x1b4f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
mov eax, dword [ebp - 0x920]
dec eax
mov dword [ebp - 0x920], eax
jmp 0x437aef
jmp 0x437a5a
push 0
lea ecx, [ebp - 0x1788]
call fcn.0040818c
cmp dword [eax], 0
je 0x437c65
jmp 0x437c6a
jmp 0x437a20
lea ecx, [ebp - 0x1788]
call fcn.00408170
mov dword [ebp - 0x4ec], 3
jmp 0x437c8e
mov eax, dword [ebp - 0x4ec]
dec eax
mov dword [ebp - 0x4ec], eax
cmp dword [ebp - 0x4ec], 0
jl 0x4381b0
mov dword [ebp - 0x1d8], 0xfffffffb
push 4
lea ecx, [ebp - 0x1a00]
call fcn.0040809e
mov dword [ebp - 0x1c7c], 0xdf667985
mov dword [ebp - 0x390], 0
jmp 0x437cd5
mov eax, dword [ebp - 0x390]
inc eax
mov dword [ebp - 0x390], eax
cmp dword [ebp - 0x390], 4
jge 0x437cf7
push dword [ebp - 0x390]
lea ecx, [ebp - 0x1a00]
call fcn.0040818c
mov dword [eax], 5
jmp 0x437cc8
mov dword [ebp - 0x1d8], 0xfffffffe
jmp 0x437d10
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 0x12
jl 0x438035
push 1
lea ecx, [ebp - 0x1940]
call fcn.0040809e
mov dword [ebp - 0x2c8], 0xfffffffc
mov dword [ebp - 0x15e4], 1
mov dword [ebp - 0x1c84], 0xf3b0639e
mov dword [ebp - 0x1c8c], 0xd2e91c84
push 3
lea ecx, [ebp - 0x1dc8]
call fcn.0040809e
mov dword [ebp - 0x44], 0
jmp 0x437d6f
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x437d88
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1940]
call fcn.0040818c
and dword [eax], 0
jmp 0x437d68
mov dword [ebp - 0x44], 0
jmp 0x437d98
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x437db1
push dword [ebp - 0x44]
lea ecx, [ebp - 0x1dc8]
call fcn.0040818c
or dword [eax], 0xffffffff
jmp 0x437d91
mov dword [ebp - 0x44], 0
jmp 0x437dc1
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 3
jge 0x437dd7
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x1da8], 0x497c242e
jmp 0x437dba
mov dword [ebp - 0x2c8], 0
jmp 0x437df0
mov eax, dword [ebp - 0x2c8]
inc eax
mov dword [ebp - 0x2c8], eax
cmp dword [ebp - 0x2c8], 0
jg 0x43801a
mov dword [ebp - 0xe18], 0xfffd
mov dword [ebp - 0x61c], 0xffffffff
mov dword [ebp - 0x15ec], 0xfffffffb
mov dword [ebp - 0x1c94], 0xfffffff8
mov dword [ebp - 0x1c9c], 0xa8c98aac
mov dword [ebp - 0x1ca4], 0x4dfd9964
mov dword [ebp - 0x1cac], 0xfffffffe
mov dword [ebp - 0x1cb4], 0xb05ef135
mov dword [ebp - 0x1cbc], 0
mov dword [ebp - 0x1cc4], 0
mov dword [ebp - 0x1ccc], 1
mov dword [ebp - 0x1cd4], 0xf32afcb0
push 1
lea ecx, [ebp - 0x1db8]
call fcn.0040809e
mov dword [ebp - 0x458], 0
jmp 0x437e9b
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
cmp dword [ebp - 0x458], 1
jge 0x437ebd
push dword [ebp - 0x458]
lea ecx, [ebp - 0x1db8]
call fcn.0040818c
mov dword [eax], 0xa10f40bf
jmp 0x437e8e
mov dword [ebp - 0x61c], 8
cmp dword [ebp - 0x61c], 0
je 0x437f61
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1cdc], eax
push 4
pop eax
cmp eax, 0x1c5a3d7f
jl 0x437ef6
mov dword [ebp - 0xe10], 1
jmp 0x437efd
and dword [ebp - 0xe10], 0
mov eax, dword [ebp - 0x1d8]
cmp dword [ebp - 0xe10], eax
jle 0x437f17
mov dword [ebp - 0x580], 1
jmp 0x437f1e
and dword [ebp - 0x580], 0
push 0
lea ecx, [ebp - 0x1a00]
call fcn.0040818c
mov ecx, dword [ebp - 0x580]
mov dword [eax], ecx
mov eax, dword [ebp - 0x580]
add eax, 0xee49
imul eax, eax, 7
imul esi, eax, 0
push 0
lea ecx, [ebp - 0x1940]
call fcn.0040818c
add esi, dword [eax]
je 0x437f61
mov dword [ebp - 0x928], 1
jmp 0x437f68
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0xe18]
cmp eax, dword [ebp - 0x928]
jl 0x437f82
mov dword [ebp - 0x1288], 1
jmp 0x437f89
and dword [ebp - 0x1288], 0
mov eax, dword [ebp - 0x2c8]
cmp dword [ebp - 0x1288], eax
jle 0x437fa3
mov dword [ebp - 0x930], 1
jmp 0x437faa
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x930]
mov dword [ebp - 0x15e4], eax
mov eax, dword [ebp - 0x61c]
mov dword [ebp - 0x1ce4], eax
mov eax, dword [ebp - 0xe18]
cmp dword [ebp - 0x1d8], eax
jl 0x437fdc
mov dword [ebp - 0x938], 1
jmp 0x437fe3
and dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x938]
mov dword [ebp - 0x15ec], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1da8]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1da8], eax
lea ecx, [ebp - 0x1db8]
call fcn.00408170
jmp 0x437de3
lea ecx, [ebp - 0x1dc8]
call fcn.00408170
lea ecx, [ebp - 0x1940]
call fcn.00408170
jmp 0x437d03
lea ecx, [ebp - 0x1a00]
call fcn.00408170
mov dword [ebp - 0x4c4], 1
mov dword [ebp - 0x1cec], 0x32a27689
mov dword [ebp - 0x1cf8], 1
mov dword [ebp - 0x398], 0
jmp 0x438077
mov eax, dword [ebp - 0x398]
inc eax
mov dword [ebp - 0x398], eax
cmp dword [ebp - 0x398], 2
jge 0x438093
mov eax, dword [ebp - 0x398]
mov dword [ebp + eax*4 - 0x2170], 0x5260417b
jmp 0x43806a
mov dword [ebp - 0x4c4], 0xffffffef
jmp 0x4380ac
mov eax, dword [ebp - 0x4c4]
inc eax
mov dword [ebp - 0x4c4], eax
cmp dword [ebp - 0x4c4], 0x15
jl 0x43817d
mov dword [ebp - 0x1d00], 0
mov dword [ebp - 0x1d08], 0x3f0bc502
mov dword [ebp - 0x1d10], 0xfe5e81a7
push 1
lea ecx, [ebp - 0x1dd8]
call fcn.0040809e
mov dword [ebp - 0x1058], 0x9b2b534d
mov dword [ebp - 0x3a0], 0
jmp 0x438107
mov eax, dword [ebp - 0x3a0]
inc eax
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x3a0], 1
jge 0x438129
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x1dd8]
call fcn.0040818c
mov dword [eax], 1
jmp 0x4380fa
mov eax, dword [ebp - 0x1058]
dec eax
mov dword [ebp - 0x1058], eax
mov byte [ebp - 0x197], 0
movzx eax, byte [ebp - 0x197]
test eax, eax
je 0x43816d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x3fe
push 0x1239
push 0xeec
push 0xe16
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
lea ecx, [ebp - 0x1dd8]
call fcn.00408170
jmp 0x43809f
mov byte [ebp - 0x1b5], 0
movzx eax, byte [ebp - 0x1b5]
test eax, eax
je 0x4381ab
push 0x104e
push 0xbe3
push 0xf5f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x437c81
lea ecx, [ebp - 0x2098]
call fcn.00408170
mov dword [ebp - 0x2a0], 7
mov dword [ebp - 0x144], 0
jmp 0x4381de
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 2
jge 0x4381fa
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x11fc], 0xffffffff
jmp 0x4381d1
mov dword [ebp - 0x144], 0
jmp 0x438213
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 4
jge 0x43822f
mov eax, dword [ebp - 0x144]
mov dword [ebp + eax*4 - 0x2138], 0xf20920a6
jmp 0x438206
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11fc]
mov dword [ebp - 0x2a0], eax
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x11fc]
add ecx, 0xc174
cmp dword [ebp + eax - 0x11fc], ecx
je 0x438270
mov dword [ebp - 0x940], 1
jmp 0x438277
and dword [ebp - 0x940], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11fc]
mov ecx, dword [ebp - 0x2a0]
mov edx, dword [ebp - 0x940]
lea ecx, [ecx + edx - 0x689a]
imul ecx, ecx, 0x8807
add eax, ecx
cmp eax, 1
je 0x4382b0
mov dword [ebp - 0xe20], 1
jmp 0x4382b7
and dword [ebp - 0xe20], 0
mov eax, dword [ebp - 0xe20]
add eax, 0x5206
mov dword [ebp - 0x2a0], eax
je 0x4382df
cmp dword [ebp - 0x2a0], 0
je 0x4382df
mov dword [ebp - 0x948], 1
jmp 0x4382e6
and dword [ebp - 0x948], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11fc]
cmp dword [ebp - 0x948], eax
jl 0x438307
mov dword [ebp - 0x1178], 1
jmp 0x43830e
and dword [ebp - 0x1178], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1178]
mov dword [ebp + eax - 0x2138], ecx
push 2
lea ecx, [ebp - 0x1e08]
call fcn.0040809e
mov dword [ebp - 0x460], 0xb0647dc4
mov dword [ebp - 0x1d18], 4
mov dword [ebp - 0x1d20], 0x624cdb8f
mov dword [ebp - 0x1d28], 0xe77ab392
push 1
lea ecx, [ebp - 0x1df8]
call fcn.0040809e
mov dword [ebp - 0x1d30], 0x18e418a5
mov dword [ebp - 0x1830], 9
mov dword [ebp - 0x182c], 9
mov dword [ebp - 0x1828], 9
mov dword [ebp - 0x1824], 9
lea ecx, [ebp - 0x645]
call fcn.0040819b
push eax
lea eax, [ebp - 0x1820]
push eax
lea eax, [ebp - 0x1830]
push eax
lea ecx, [ebp - 0x2100]
call fcn.0040819e
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1de8]
call fcn.0040814a
mov dword [ebp - 0x10c], 0
jmp 0x4383e3
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 2
jge 0x438405
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x1e08]
call fcn.0040818c
mov dword [eax], 0xca631852
jmp 0x4383d6
mov dword [ebp - 0x10c], 0
jmp 0x43841e
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 1
jge 0x438440
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x1df8]
call fcn.0040818c
mov dword [eax], 1
jmp 0x438411
push 3
lea ecx, [ebp - 0x1de8]
call fcn.0040818c
mov dword [ebp - 0x950], eax
mov eax, dword [ebp - 0x950]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x950]
mov dword [ecx], eax
mov dword [ebp - 0x460], 0xffffffe2
jmp 0x43847d
mov eax, dword [ebp - 0x460]
inc eax
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0x15
jl 0x43849d
mov dword [ebp - 0x15f4], 0x5fff
cmp dword [ebp - 0x15f4], 0
je 0x43849b
jmp 0x43849d
jmp 0x438470
lea ecx, [ebp - 0x1de8]
call fcn.00408170
lea ecx, [ebp - 0x1df8]
call fcn.00408170
lea ecx, [ebp - 0x1e08]
call fcn.00408170
mov dword [ebp - 0x2e0], 0x5596960f
mov dword [ebp - 0x2a8], 0x924c0001
mov dword [ebp - 0x3a8], 0
jmp 0x4384eb
mov eax, dword [ebp - 0x3a8]
inc eax
mov dword [ebp - 0x3a8], eax
cmp dword [ebp - 0x3a8], 3
jge 0x438507
mov eax, dword [ebp - 0x3a8]
mov dword [ebp + eax*4 - 0x1e18], 0xffffffff
jmp 0x4384de
mov dword [ebp - 0x2e0], 0
jmp 0x438520
cmp dword [ebp - 0x2e0], 2
jg 0x438697
mov dword [ebp - 0x504], 0x7fa5c62e
mov dword [ebp - 0x504], 0
jmp 0x438550
cmp dword [ebp - 0x504], 2
jg 0x438660
mov eax, dword [ebp - 0x2e0]
mov eax, dword [ebp + eax*4 - 0x1e18]
mov dword [ebp - 0x2a8], eax
mov dword [ebp - 0x2a8], 2
jmp 0x438589
cmp dword [ebp - 0x2a8], 0
jl 0x43865b
mov byte [ebp - 0x191], 0
movzx eax, byte [ebp - 0x191]
test eax, eax
je 0x438692
push 0x220d
push 0x2410
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x438513
mov byte [ebp - 0x1b7], 0
movzx eax, byte [ebp - 0x1b7]
test eax, eax
je 0x4386b6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0xe30], 0xfffffffe
mov dword [ebp - 0x588], 0xd0289a69
mov dword [ebp - 0x15fc], 0x19570a50
mov dword [ebp - 0x1d38], 0x1aae4b9
push 1
lea ecx, [ebp - 0x12d4]
call fcn.0040809e
mov dword [ebp - 0x1f94], 0x4272
push 4
lea ecx, [ebp - 0x1e28]
call fcn.0040809e
push 1
lea ecx, [ebp - 0x1958]
call fcn.0040809e
mov dword [ebp - 0x4c], 0
jmp 0x43871f
cmp dword [ebp - 0x4c], 1
jge 0x438738
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x12d4]
call fcn.0040818c
or dword [eax], 0xffffffff
jmp 0x438718
mov dword [ebp - 0x4c], 0
jmp 0x438748