Function at 0x401010
Capabilities:
Check for unmoving mouse cursor
Compare security identifiers
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffff80
push esi
push edi
push ebx
mov eax, 0x7774
call fcn.00424e80
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x17fc], eax
push 3
call fcn.00435d00
add esp, 4
stmxcsr dword [esp + 0x80]
or dword [esp + 0x80], 0x8000
ldmxcsr dword [esp + 0x80]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov dword [esp], 4
call fcn.00422ba0
add esp, 0xfffffff0
mov ecx, 0x44a610
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], eax
call fcn.00423600
add esp, 4
call fcn.00423370
lea ecx, [esp + 0x635c]
call fcn.0040fcc0
xor eax, eax
mov dword [esp + 0x6a3c], eax
push dword [0x44a650]
push dword [0x44a654]
push eax
push eax
push 0x33
push 1
push dword [0x44a658]
push eax
push dword [0x44a65c]
push dword [0x44a650]
push eax
mov esi, dword [ebp + 8]
mov dword [0x44a64c], esi
call dword [sym.imp.MSIMG32.dll_TransparentBlt]
mov dword [esp + 0x6a7c], eax
mov edi, dword [0x439540]
mov ecx, dword [esp + 0x6a3c]
imul ecx, dword [0x44a660]
mov dword [esp + 0x1b2c], ecx
lea edx, [edi + eax]
mov dword [0x44a65c], edx
lea ebx, [ecx + 0x1f8]
mov edx, dword [0x439544]
imul edx, eax
imul ecx, edx, 0x64
add ecx, 0xffffff9c
imul ecx, dword [esp + 0x17fc]
mov edi, dword [0x439548]
mov dword [esp + 0x1b28], ebx
push eax
mov esi, dword [0x44a650]
add edi, edx
add edi, ecx
add edi, eax
xor eax, eax
push eax
push esi
mov dword [0x44a650], edx
push eax
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
mov dword [esp + 0x88], eax
mov eax, dword [0x44a650]
mov edx, dword [0x44a65c]
mov esi, dword [esp + 0x88]
mov dword [esp + 0x84], eax
mov dword [esp + 0x80], edx
mov dword [0x44a654], esi
mov esi, dword [0x44a660]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x6a3c], eax
call dword [sym.imp.USER32.dll_CreateMenu]
mov ebx, eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov edx, dword [0x43954c]
mov ecx, dword [esp + 0x17fc]
mov eax, dword [0x44a65c]
add eax, eax
sub eax, dword [esp + 0x6a7c]
add eax, 0xfffffffc
mov dword [0x44a65c], eax
lea eax, [edx + ecx + 0x96]
mov dword [0x44a650], eax
call dword [sym.imp.USER32.dll_CreatePopupMenu]
push ebx
push esi
call dword [sym.imp.USER32.dll_SetMenu]
mov eax, dword [0x439550]
imul eax, dword [esp + 0x1b28]
mov edx, dword [esp + 0x6a3c]
add edx, dword [esp + 0x6a7c]
add edx, eax
mov dword [esp + 0x6a3c], edx
mov dword [0x44a65c], 1
push esi
call dword [sym.imp.USER32.dll_SetCapture]
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
lea eax, [esp + 0x25fc]
push eax
push 0x43ad2c
push edx
push 0x96
push edx
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov dword [esp + 0x1b38], eax
mov eax, dword [esp + 0x6a7c]
test eax, eax
mov edx, dword [0x44a650]
lea ecx, [eax + eax*4]
lea edx, [edx + ecx*2]
lea ecx, [edi + edi*2]
lea edx, [edx + ecx*2]
mov ecx, dword [esp + 0x17fc]
lea edx, [edx + ecx + 0x1fb]
mov dword [0x44a650], edx
je 0x40fc5d
lea eax, [esp + 0x76c8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
xor eax, eax
push eax
push esi
push eax
push dword [esp + 0x76d8]
push dword [esp + 0x76d8]
push eax
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
call dword [sym.imp.USER32.dll_GetCapture]
test eax, eax
je 0x4012c6
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov dword [0x44a65c], 0x97
lea ebx, [esp + 0x6700]
push ebx
push esi
call dword [sym.imp.USER32.dll_BeginPaint]
push ebx
push esi
call dword [sym.imp.USER32.dll_EndPaint]
mov eax, dword [esp + 0x6a3c]
mov dword [0x44a658], eax
push dword [esp + 0x80]
push dword [esp + 0x88]
push dword [esp + 0x90]
push esi
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
lea edx, [esp + 0x677c]
mov dword [esp + 0x677c], eax
lea ebx, [esp + 0x73b8]
lea ecx, [esp + 0x73c8]
push edx
push ecx
push 7
push eax
push ebx
call dword [sym.imp.ole32.dll_CoCreateInstance]
lea eax, [esp + 0x7678]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0x7688]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0x7698]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0x76a8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
lea eax, [esp + 0x76b8]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
xor eax, eax
mov esi, 2
mov word [esp + 0x7678], ax
mov word [esp + 0x7688], ax
mov word [esp + 0x7698], ax
mov word [esp + 0x76a8], si
mov word [esp + 0x76b8], ax
mov word [esp + 0x76b0], ax
cmp dword [0x44a658], 0
je 0x4013ca
cmp dword [0x44a660], 0
je 0x4024f8
mov eax, dword [pe_dos_header]
push 0
call dword [eax + 8]
mov eax, dword [0x4395f0]
movzx edx, word [0x4395f4]
mov dword [esp + 0x76d8], eax
mov word [esp + 0x76dc], dx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
lea ebx, [esp + 0x67bc]
push ebx
push 0
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
test eax, eax
jne 0x40141d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push ebx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov edx, dword [esp + 0x6a7c]
lea esi, [esp + 0x67fc]
mov eax, 0x1000
mov dword [esp + 0x67fc], eax
lea ecx, [edx + edx]
lea ebx, [ecx + edi*2 + 3]
mov dword [0x44a65c], ebx
lea edi, [esp + 0x80]
push esi
push eax
push edi
push 2
push dword [esp + 0x67cc]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
xor eax, eax
lea esi, [esp + 0x683c]
lea edx, [esp + 0x76d8]
push esi
push eax
push eax
push eax
push eax
push eax
push eax
push 0x220
push 0x20
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40156f
mov eax, dword [esp + 0x6a7c]
mov esi, eax
shr esi, 0x1f
add esi, eax
sar esi, 1
mov ecx, dword [0x44a65c]
mov edx, ecx
cmp esi, 0xfffffff0
jle 0x40155e
add esi, 0x10
cmp esi, 4
lea ebx, [eax + 0x13]
mov dword [esp + 0x1b34], ebx
jl 0x40250a
mov ebx, eax
mov eax, esi
neg ebx
and eax, 3
add ebx, 0x64
neg eax
imul ebx, dword [esp + 0x1b34]
add eax, esi
movd xmm1, ecx
add ebx, 5
xor ecx, ecx
movd xmm0, ebx
pshufd xmm0, xmm0, 0
add ecx, 4
paddd xmm1, xmm0
cmp ecx, eax
jb 0x4014ed
movdqa xmm0, xmm1
psrldq xmm0, 8
paddd xmm1, xmm0
movdqa xmm2, xmm1
psrldq xmm2, 4
paddd xmm1, xmm2
movd ecx, xmm1
pxor xmm1, xmm1
pshufd xmm3, xmm1, 0
psrldq xmm3, 0xc
mov dword [0x44a65c], ecx
movd ebx, xmm3
cmp eax, esi
jae 0x40158b
mov edi, dword [esp + 0x6a7c]
mov ebx, edi
neg ebx
add ebx, 0x64
imul ebx, edi
imul edi, edi, 0xffffffed
add ecx, ebx
inc eax
cmp eax, esi
lea ecx, [ecx + edi + 0x771]
jb 0x401546
mov dword [0x44a65c], ecx
xor ebx, ebx
jmp 0x40158b
mov ebx, 1
lea ecx, [eax + 0x13]
mov dword [esp + 0x1b34], ecx
jmp 0x40158b
mov eax, dword [esp + 0x6a7c]
mov ebx, 1
mov edx, dword [0x44a650]
lea ecx, [eax + 0x13]
mov dword [esp + 0x1b34], ecx
push dword [esp + 0x84]
push dword [esp + 0x6840]
lea eax, [edx + ebx + 1]
mov dword [0x44a650], eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov dword [0x44a660], eax
mov eax, dword [esp + 0x6a3c]
add eax, dword [esp + 0x6a7c]
mov dword [esp + 0x15f8], eax
mov dword [0x44a65c], 0
push dword [esp + 0x683c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
push dword [esp + 0x67bc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp + 8]
mov eax, pe_nt_image_headers32
pxor xmm0, xmm0
movaps xmmword [esp + eax + 0x1070], xmm0
movaps xmmword [esp + eax + 0x1060], xmm0
movaps xmmword [esp + eax + 0x1050], xmm0
movaps xmmword [esp + eax + 0x1040], xmm0
sub eax, 0x40
jne 0x4015f2
mov eax, dword [0x439554]
mov edx, dword [0x439558]
pxor xmm0, xmm0
mov ecx, dword [0x43955c]
mov esi, dword [0x439560]
mov dword [esp + 0x12f4], eax
mov dword [esp + 0x12f8], edx
mov dword [esp + 0x12fc], ecx
mov dword [esp + 0x1300], esi
mov eax, dword [0x439564]
mov edx, dword [0x439568]
mov ecx, dword [0x43956c]
mov esi, dword [0x439570]
mov dword [esp + 0x1304], eax
mov dword [esp + 0x1308], edx
mov dword [esp + 0x130c], ecx
mov dword [esp + 0x1310], esi
mov eax, dword [0x439574]
mov edx, dword [0x439578]
mov ecx, dword [0x43957c]
mov esi, dword [0x439580]
mov dword [esp + 0x1314], eax
mov eax, 0x200
mov dword [esp + 0x1318], edx
mov dword [esp + 0x131c], ecx
mov dword [esp + 0x1320], esi
movq qword [esp + 0x1280], xmm0
movaps xmmword [esp + eax + 0x1070], xmm0
movaps xmmword [esp + eax + 0x1060], xmm0
movaps xmmword [esp + eax + 0x1050], xmm0
movaps xmmword [esp + eax + 0x1040], xmm0
sub eax, 0x40
jne 0x4016c2
mov eax, 0x78787879
mov ecx, dword [esp + 0x131c]
imul ecx
sar edx, 4
sar ecx, 0x1f
sub edx, ecx
sub edx, dword [esp + 0x1304]
mov esi, dword [esp + 0x1300]
cmp esi, edx
jl 0x40171f
mov eax, dword [esp + 0x1318]
sub esi, eax
mov dword [esp + 0x1304], esi
cvtsi2sd xmm4, ebx
cvtsi2sd xmm0, edi
movsd xmm5, qword [0x4397a0]
lea eax, [esp + 0x2658]
andps xmm5, xmm4
movaps xmm3, xmm5
movsd xmm2, qword [0x4397a8]
pxor xmm3, xmm4
shr edi, 0x1f
cmpltsd xmm3, xmm2
addsd xmm0, qword [edi*8 + 0x4396e0]
andps xmm3, xmm2
orps xmm3, xmm5
movaps xmm1, xmm3
movzx eax, al
addsd xmm1, xmm4
cvtsi2sd xmm2, dword [0x44a664]
subsd xmm1, xmm3
cvtsi2sd xmm3, dword [esp + 0x1308]
subsd xmm0, xmm2
movaps xmm7, xmm1
addsd xmm0, xmm3
subsd xmm7, xmm4
cvtsi2sd xmm4, eax
cmpnlesd xmm7, xmm5
movsd xmm6, qword [0x4397b0]
andps xmm7, xmm6
mov edi, dword [esp + 0x1b2c]
subsd xmm1, xmm7
mulsd xmm4, xmm1
lea edx, [edi + 0x240]
cvtsi2sd xmm1, edx
divsd xmm4, xmm1
movsd xmm5, qword [0x439798]
subsd xmm0, xmm4
movaps xmm1, xmm5
movaps xmm6, xmm0
cmplesd xmm1, xmm0
cmpnltsd xmm6, xmm5
andps xmm1, xmm5
movd ecx, xmm6
subsd xmm0, xmm1
cvttsd2si edi, xmm0
and ecx, 0x80000000
add edi, ecx
cmp dword [0x44a654], 0
je 0x40181d
cmp dword [0x44a660], 0
je 0x40181d
xor eax, eax
push eax
push eax
push 2
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor edx, edx
push edx
push edx
push edx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call dword [sym.imp.USER32.dll_GetMenuCheckMarkDimensions]
call dword [sym.imp.USER32.dll_GetFocus]
mov edx, dword [esp + 0x6a3c]
test eax, eax
mov eax, dword [esp + 0x17fc]
mov esi, dword [0x44a650]
cmove ebx, esi
imul eax, edx
cmp ebx, eax
jb 0x401850
xor eax, eax
jmp 0x401907
cvtsi2ss xmm0, dword [esp + 0x15f8]
movss dword [esp], xmm0
mov dword [esp + 0x1080], edx
call fcn.004105f0
mov eax, 0x78787879
mov edx, dword [esp + 0x1080]
mov ecx, dword [esp + 0x6a7c]
imul ecx
mov eax, dword [esp + 0x17fc]
cvtsi2sd xmm0, eax
shr eax, 0x1f
sar edx, 3
sar ecx, 0x1f
mov dword [esp + 0x12e8], ebx
sub edx, ecx
movzx ebx, bl
addsd xmm0, qword [eax*8 + 0x4396e0]
cvtsd2ss xmm0, xmm0
sub ebx, edx
fstp dword [esp + 0x23f8]
cvtsi2ss xmm5, ebx
movss xmm1, dword [esp + 0x23f8]
mulss xmm0, xmm1
movss xmm2, dword [0x4397b8]
addss xmm5, xmm0
movaps xmm4, xmm2
movaps xmm3, xmm5
mov ebx, dword [esp + 0x12e8]
cmpless xmm4, xmm5
cmpnltss xmm3, xmm2
andps xmm4, xmm2
movd ecx, xmm3
subss xmm5, xmm4
cvttss2si eax, xmm5
and ecx, 0x80000000
mov edx, dword [esp + 0x1080]
add eax, ecx
neg esi
mov ecx, dword [esp + 0x1304]
add esi, ecx
cmp esi, dword [esp + 0x1320]
jle 0x401962
cvtsi2sd xmm0, ecx
cvtsi2sd xmm1, dword [esp + 0x1308]
cvtsi2sd xmm2, ebx
imul eax, dword [esp + 0x12f8]
sqrtsd xmm0, xmm0
mov ecx, edi
and ecx, 0xff
addsd xmm0, xmm1
sub eax, ecx
addsd xmm0, xmm2
cvtsi2sd xmm3, eax
shr eax, 0x1f
addsd xmm3, qword [eax*8 + 0x4396e0]
addsd xmm0, xmm3
cvttsd2si ebx, xmm0
mov eax, dword [esp + 0x6a7c]
mov dword [esp + 0x12f0], 0
lea ecx, [eax + 3]
imul edx, ecx
test edx, edx
jle 0x401cd2
movzx esi, byte [esp + 0x6a7c]
mov edx, 1
xor eax, eax
mov dword [esp + 0x12ec], edi
mov dword [esp + 0x12e8], ebx
mov dword [esp + 0x1330], esi
mov dword [esp + 0x132c], eax
mov dword [esp + 0x1328], edx
mov dword [esp + 0x1324], ecx
mov edi, dword [esp + 0x15f8]
mov eax, dword [esp + 0x1330]
add eax, dword [esp + 0x12ec]
jne 0x4019e5
mov eax, dword [esp + 0x1328]
mov dword [esp + 0x12ec], eax
jmp 0x401a69
cvtsi2ss xmm0, dword [esp + 0x12e8]
movss dword [esp], xmm0
call fcn.004105f0
mov eax, dword [esp + 0x1328]
cvtsi2sd xmm0, eax
cvtsi2ss xmm5, dword [0x44a654]
shr eax, 0x1f
fstp dword [esp + 0x23f8]
movss xmm1, dword [esp + 0x23f8]
movss xmm2, dword [0x4397b8]
movaps xmm4, xmm2
addsd xmm0, qword [eax*8 + 0x4396e0]
cvtsd2ss xmm0, xmm0
addss xmm5, xmm0
addss xmm5, xmm1
movaps xmm3, xmm5
cmpless xmm4, xmm5
cmpnltss xmm3, xmm2
andps xmm4, xmm2
movd edx, xmm3
subss xmm5, xmm4
cvttss2si ecx, xmm5
and edx, 0x80000000
add ecx, edx
mov dword [esp + 0x12f0], ecx
push 0
call sub.WINTRUST.dll_CryptCATHandleFromStore
mov esi, eax
mov ebx, dword [esp + 0x6a3c]
movzx edx, word [0x44a664]
neg ebx
movzx eax, word [0x44a65c]
add ebx, edi
mov ecx, dword [esp + 0x1328]
add edx, dword [esp + 0x12e8]
cmp eax, ecx
cmovae ecx, edx
cmovb edi, ebx
xor eax, eax
mov dword [esp + 0x1328], ecx
push eax
push eax
call sub.WINTRUST.dll_CryptCATGetMemberInfo
mov dword [esp + 0x1334], eax
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea edx, [esp + 0x770c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleScreenBufferInfo]
xor eax, eax
push eax
push eax
call sub.WINTRUST.dll_CryptCATGetCatAttrInfo
mov ebx, eax
mov eax, dword [0x439584]
mov dword [esp + 0x76e0], eax
mov eax, dword [0x439590]
mov edx, dword [0x439588]
mov ecx, dword [0x43958c]
mov dword [esp + 0x76ec], eax
mov eax, dword [0x43959c]
mov dword [esp + 0x76e4], edx
mov dword [esp + 0x76e8], ecx
mov edx, dword [0x439594]
mov ecx, dword [0x439598]
mov dword [esp + 0x76f8], eax
movzx eax, byte [0x44a608]
test al, 1
mov dword [esp + 0x76f0], edx
mov dword [esp + 0x76f4], ecx
jne 0x401b51
or eax, 1
mov byte [0x44a608], al
mov eax, dword [esp + 0x6a7c]
mov dword [0x44a600], eax
mov edx, 1
push edx
lea eax, [esp + 0x76e4]
push eax
push edx
push 0
call dword [sym.imp.USER32.dll_SetScrollInfo]
lea eax, [esp + 0x76e0]
push eax
push 1
push 0
call dword [sym.imp.USER32.dll_GetScrollInfo]
test ebx, ebx
jne 0x401b9d
cmp esi, dword [0x44a654]
jne 0x401b9d
mov eax, dword [esp + 0x1334]
cmp eax, dword [0x44a660]
jne 0x401b9d
mov esi, dword [0x44a664]
jmp 0x401ba1
xor eax, eax
xor esi, esi
mov edx, dword [esp + 0x76f4]
mov ecx, dword [0x44a600]
cmp edx, ecx
je 0x401bda
sub ecx, edx
lea edx, [ecx + ecx*4]
xor ecx, ecx
push ecx
push ecx
push edx
push ecx
push ecx
call dword [sym.imp.USER32.dll_ScrollWindow]
cmp dword [esp + 0x6a7c], 0
je 0x401bda
push dword [0x44a660]
call dword [sym.imp.USER32.dll_UpdateWindow]
cvtsi2sd xmm0, dword [esp + 0x1308]
mov ebx, dword [0x44a658]
call fcn.00423ed0
movzx ecx, byte [esp + 0x1300]
xor edx, edx
cvtsi2sd xmm1, ecx
cvtsi2sd xmm3, dword [esp + 0x131c]
subsd xmm0, xmm1
mov eax, 1
lea ecx, [ebx + 0x43]
div ecx
cvtsi2sd xmm2, eax
shr eax, 0x1f
add ebx, 0x33
addsd xmm2, qword [eax*8 + 0x4396e0]
mov eax, edi
cdq
subsd xmm0, xmm2
idiv ebx
cvtsi2sd xmm4, eax
addsd xmm0, xmm3
test esi, esi
addsd xmm0, xmm4
cvttsd2si ebx, xmm0
mov dword [esp + 0x12e8], ebx
jbe 0x40fbad
xor eax, eax
lea ebx, [esp + 0x772c]
mov dword [esp + 0x15f8], edi
xor esi, esi
mov edi, 2
push edi
mov eax, dword [0x4395a0]
push edi
mov dword [ebx], eax
mov edx, dword [0x4395a4]
mov ecx, dword [0x4395a8]
mov eax, dword [0x4395ac]
push ebx
mov dword [ebx + 4], edx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], eax
push 0
call dword [sym.imp.USER32.dll_DrawFrameControl]
inc esi
cmp esi, 7
jl 0x401c65
mov edi, dword [esp + 0x15f8]
mov edx, dword [esp + 0x6a3c]
imul edx, dword [esp + 0x1324]
mov eax, dword [esp + 0x132c]
inc eax
mov dword [esp + 0x132c], eax
cmp eax, edx
jl 0x4019c2
mov dword [esp + 0x15f8], edi
mov ebx, dword [esp + 0x12e8]
lea ecx, [esp + 0x739c]
call fcn.0040ff00
mov eax, dword [0x44a660]
mov byte [esp + 0x69fc], al
add esp, 0xfffffff0
lea ecx, [esp + 0x73ac]
lea edi, [esp + 0x6a0c]
mov dword [esp], edi
call fcn.0040ff50
add esp, 0xc
mov eax, dword [esp + 0x6a3c]
imul eax, dword [0x44a658]
imul eax, dword [0x44a654]
mov dword [esp + 0x687c], eax
lea edx, [eax + 2]
mov dword [esp + 0x68bc], edx
mov byte [esp + 0x69fc], 1
add esp, 0xfffffff0
lea ecx, [esp + 0x73ac]
mov dword [esp], edi
call fcn.00410530
add esp, 0xc
lea ecx, [esp + 0x739c]
call fcn.00410500
mov byte [esp + 0x69fc], bl
add esp, 0xfffffff0
lea ecx, [esp + 0x73ac]
mov dword [esp], edi
call fcn.00410530
add esp, 0xc
lea ecx, [esp + 0x739c]
call fcn.00410590
mov ecx, dword [ebp + 8]
test ebx, ebx
mov edx, dword [0x44a654]
jle 0x401dae
movzx eax, byte [esp + 0x1608]
movzx esi, word [esp + 0x15bc]
add esi, eax
add esi, dword [esp + 0x15f8]
and esi, edx
mov dword [esp + 0x1b30], esi
jmp 0x401db9
mov dword [esp + 0x1b30], 1
mov esi, dword [esp + 0x15f8]
xor eax, eax
neg esi
cmp edx, dword [esp + 0x1b38]
mov edi, dword [0x44a664]
cmovl esi, eax
mov eax, dword [esp + 0x1b30]
mov dword [esp + 0x15f8], esi
mov dword [esp + 0x15f4], edi
cmp eax, dword [esp + 0x6a7c]
jge 0x401e50
mov edi, dword [esp + 0x1b38]
mov ecx, dword [esp + 0x15f4]
sub ecx, edx
mov esi, eax
lea eax, [edi - 0x3f]
imul eax, dword [esp + 0x17fc]
sub ecx, eax
imul ebx, ecx, 0xfffffff2
shr esi, 0x10
movzx ecx, word [esp + 0x68bc]
mov dword [esp + 0x12e8], 0
lea edi, [ebx + esi - 0xbba]
mov dword [esp + 0x12ec], edi
imul edi, dword [esp + 0x12f0], 0x72
mov ebx, dword [0x44a650]
sub edi, ecx
mov esi, dword [0x44a658]
jmp 0x401ebf
mov esi, dword [0x44a658]
lea eax, [esp + 0x12e8]
cmp eax, dword [esp + 0x15f4]
jle 0x401ea7
mov edi, esi
neg ebx
shr edi, 8
and edi, 0xff
imul eax, edi, 0xffffff91
add ebx, dword [esp + 0x1b28]
lea edi, [ecx + eax - 0xb]
movzx ecx, word [esp + 0x1628]
xor eax, eax
neg ecx
mov dword [esp + 0x12e8], edi
xor edi, edi
sar ebx, cl
mov dword [0x44a650], ebx
mov dword [esp + 0x12ec], edi
jmp 0x401ebf
xor eax, eax
xor edi, edi
mov dword [esp + 0x12e8], edi
mov dword [esp + 0x12ec], edi
mov ebx, dword [0x44a650]
mov dword [0x44a604], 0
cmp dword [esp + 0x6a7c], 0
jge 0x401eed
imul esi, dword [esp + 0x1b38]
xor eax, eax
xor edi, edi
add edx, esi
mov eax, dword [0x44a65c]
xor esi, esi
jmp 0x401f8b
imul esi, dword [esp + 0x1b38]
mov ecx, dword [esp + 0x15f4]
add edx, esi
shr ecx, 8
movzx ecx, cl
movzx esi, word [esp + 0x6a3c]
sub ecx, esi
mov esi, dword [esp + 0x6a7c]
shr esi, 0x10
imul esi, esi, 0xffffff04
mov dword [esp + 0x12fc], esi
mov eax, dword [0x44a65c]
movzx esi, byte [esp + 0x1cbe]
sub esi, eax
add esi, 0x96
mov dword [esp + 0x12f8], 0
mov dword [esp + 0x12f4], esi
mov dword [esp + 0x1300], edx
mov dword [esp + 0x12f0], eax
mov eax, edi
mov edx, dword [esp + 0x12fc]
mov esi, dword [esp + 0x12f8]
add eax, edx
mov edi, ecx
inc esi
and edi, eax
cmp esi, 0x79
jb 0x401f6a
mov esi, dword [esp + 0x12f4]
mov edx, dword [esp + 0x1300]
mov eax, dword [esp + 0x12f0]
movzx eax, al
movzx ebx, bl
shl eax, 8
or ebx, eax
push ebx
mov dword [esp + 0x1304], edx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov edx, dword [esp + 0x1300]
mov dword [esp + 0x1308], eax
mov ecx, dword [esp + 0x1b38]
neg ecx
pxor xmm0, xmm0
cmp dword [esp + 0x68bc], 0
mov dword [esp + 0x130c], ecx
mov ecx, 0x5e3b
cmovns ecx, dword [esp + 0x17fc]
mov dword [esp + 0x1314], ecx
mov ecx, 0
cmovs edx, ecx
mov ecx, pe_nt_image_headers32
movaps xmmword [esp + ecx + 0x17f0], xmm0
movaps xmmword [esp + ecx + 0x17e0], xmm0
movaps xmmword [esp + ecx + 0x17d0], xmm0
movaps xmmword [esp + ecx + 0x17c0], xmm0
sub ecx, 0x40
jne 0x401fef
mov ecx, dword [0x44a604]
test ecx, ecx
mov dword [esp + 0x12f0], ecx
je 0x402055
movzx ecx, word [ecx]
test ecx, ecx
je 0x402055
xor ebx, ebx
mov eax, dword [0x44a650]
xor esi, esi
mov edx, dword [0x44a654]
mov dword [esp + 0x6abc], esi
mov dword [esp + 0x1318], eax
mov dword [esp + 0x1310], edx
jmp 0x4021c7
mov ecx, dword [0x44a654]
mov dword [esp + 0x1310], ecx
cmp dword [esp + 0x12ec], 0
jne 0x402084
sub ecx, dword [esp + 0x1b38]
mov dword [0x44a65c], ecx
mov dword [esp + 0x1314], 0
cmp dword [esp + 0x6a7c], 0
jge 0x4020bd
mov ecx, dword [esp + 0x12e8]
mov eax, esi
add dword [esp + 0x17fc], ecx
mov ecx, dword [0x44a664]
shl eax, cl
imul ecx, eax, 0x8e
sub edi, dword [esp + 0x15f8]
mov dword [esp + 0x1b30], ecx
add edi, 0xffffffd8
mov ecx, dword [0x44a650]
xor ebx, ebx
mov dword [esp + 0x12e8], edi
xor eax, eax
mov dword [esp + 0x6abc], ebx
mov dword [esp + 0x1318], ecx
mov dword [esp + 0x1300], edx
mov edi, dword [esp + 0x130c]
mov edx, ebx
inc eax
mov ecx, dword [esp + 0x1318]
shl edx, cl
lea ecx, [esp + 0x1900]
cmp esi, ecx
cmovl ebx, edx
xor edx, edx
cmp ebx, dword [esp + 0x1300]
cmovl edi, edx
cmp eax, 0x6b
jl 0x4020ea
mov dword [esp + 0x130c], edi
mov edi, dword [esp + 0x12e8]
push 0x43ad10
lea edx, [esp + 0x13f0]
push edx
call fcn.00424eab
add esp, 8
test eax, eax
jne 0x402194
cmp dword [esp + 0x1314], 0xffffd57b
jge 0x402162
movsx ebx, byte [esp + 0x2758]
xor eax, eax
shr ebx, 8
xor esi, esi
movsx edx, byte [esp + 0x268c]
sub ebx, edx
jmp 0x402164
xor ebx, ebx
cmp edi, dword [esp + 0x1b30]
jle 0x402184
shr esi, 0x10
movzx ebx, word [esp + 0x175a]
add esi, 6
add ebx, dword [esp + 0x1310]
jmp 0x402188
xor eax, eax
xor esi, esi
imul ecx, dword [0x44a65c], 0x2d60
jmp 0x40219c
xor eax, eax
xor esi, esi
xor ebx, ebx
xor ecx, ecx
mov edi, dword [esp + 0x1318]
shr ecx, 8
mov edx, dword [esp + 0x12f0]
movzx ecx, cl
add edx, 2
mov dword [0x44a604], edx
lea edx, [edi + ecx + 0x8f]
mov dword [esp + 0x1b30], edx
mov edx, dword [0x4395bc]
mov dword [esp + 0x12f4], edx
mov edx, dword [0x4395c4]
mov dword [esp + 0x12fc], edx
mov edx, dword [0x4395c8]
mov dword [esp + 0x1300], edx
mov edx, dword [0x4395cc]
mov dword [esp + 0x1304], edx
mov edi, dword [0x4395b4]
mov dword [esp + 0x12ec], edi
mov edi, dword [0x4395b8]
and esi, 0xff
mov dword [esp + 0x12f0], edi
imul edi, esi
mov ecx, dword [0x4395b0]
mov edx, dword [esp + 0x1b2c]
mov dword [esp + 0x12e8], ecx
mov ecx, dword [0x4395c0]
mov dword [esp + 0x12f8], ecx
lea edi, [edi + edx + 0x1f8]
mov ecx, dword [0x44a660]
xor edx, edx
add ecx, 0x57
movzx eax, byte [esp + 0x1318]
idiv ecx
imul edx, eax, 0xffffd57b
lea eax, [esp + 0x1800]
imul edx, dword [esp + 0x1314]
movzx ecx, bl
sub edi, edx
mov edx, dword [esp + 0x1310]
lea esi, [edx + ecx + 0xc2]
movzx ecx, si
lea edx, [esp + 0x15f4]
imul ecx, edx
add ecx, eax
cmp ecx, dword [esp + 0x1b38]
jge 0x4022cf
mov dword [esp + 0x69bc], 0xffffd57b
lea edx, [esp + 0x2658]
movzx edx, dl
sub eax, edx
add eax, dword [esp + 0x1b30]
sub eax, dword [esp + 0x17fc]
lea ecx, [eax + 0x2a85]
mov dword [esp + 0x1b30], ecx
jmp 0x40230f
mov edx, dword [esp + 0x6abc]
cvtsi2sd xmm0, edx
shr edx, 0x1f
addsd xmm0, qword [edx*8 + 0x4396e0]
cvtsd2ss xmm0, xmm0
movss dword [esp], xmm0
call fcn.004105f0
fstp dword [esp + 0x23f8]
movss xmm0, dword [esp + 0x23f8]
cvttss2si edx, xmm0
mov dword [esp + 0x69bc], edx
mov eax, 0x2aaaaaab
movzx ecx, byte [esp + 0x6a7c]
sub ecx, esi
mov esi, dword [esp + 0x1b28]
imul esi
sar edx, 3
sar esi, 0x1f
sub edx, esi
add ecx, edx
sub ecx, dword [esp + 0x69bc]
mov dword [0x44a650], ecx
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [esp + 0x68fc], eax
mov esi, dword [0x44a654]
cmp dword [esp + 0x1b28], 0
jns 0x402386
mov edx, dword [0x44a660]
imul edx, dword [esp + 0x68bc]
cmp esi, edx
jle 0x402386
mov eax, dword [esp + 0x130c]
add eax, dword [esp + 0x12f0]
mov dword [esp + 0x130c], eax
jmp 0x4023c2
mov ecx, dword [esp + 0x1b38]
mov eax, 0x1948b0fd
imul ecx, dword [esp + 0x69bc]
imul esi, dword [esp + 0x1304]
imul ecx
movzx ebx, bx
imul esi, ebx
sar edx, 3
sar ecx, 0x1f
sub edx, ecx
imul esi, edx
lea esi, [esi + 0x8000]
mov dword [esp + 0x130c], esi
mov eax, 0x55555556
mov ecx, dword [esp + 0x69bc]
imul ecx
mov ebx, dword [0x44a650]
mov eax, ebx
shr eax, 0x1f
mov esi, edx
add ebx, eax
mov eax, dword [esp + 0x1314]
sar ecx, 0x1f
sub esi, ecx
sar ebx, 1
lea ecx, [eax + eax]
mov eax, 0x55555556
imul ecx
sar ecx, 0x1f
sub edx, ecx
push edx
push ebx
push esi
push 0
call dword [sym.imp.GDI32.dll_CreateEllipticRgn]
mov ecx, dword [esp + 0x6a7c]
xor eax, eax
xor edx, edx
xor esi, esi
xor ebx, ebx
lea ecx, [ecx + 0x5c]
idiv ecx
imul eax, dword [esp + 0x1b30]
movzx ecx, di
cmp eax, dword [esp + 0x1b38]
je 0x402446
mov dword [esp + 0x12ec], ecx
mov dword [esp + 0x12f0], eax
mov edi, dword [esp + 0x1b38]
jmp 0x4024b9
mov dword [esp + 0x12e8], ebx
mov dword [esp + 0x12f0], eax
mov ebx, dword [esp + 0x6abc]
mov eax, 0x2fa0be83
mov edi, dword [esp + 0x6a3c]
imul edi
sar edx, 4
sar edi, 0x1f
sub edx, edi
imul edx, ecx
add ebx, edx
mov dword [esp + 0x6abc], ebx
mov dword [esp + 0x12ec], ecx
mov ebx, dword [esp + 0x12e8]
mov edi, dword [esp + 0x1b38]
cmp ebx, 3
jle 0x4024b9
mov eax, dword [0x44a65c]
mov ecx, ebx
imul eax, dword [esp + 0x6a7c]
mov edx, dword [0x44a654]
shl ecx, 4
add edx, 5
add ecx, eax
cmp ebx, edx
cmovl esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [0x44a604]
inc ebx
cmp ebx, 0x27
lea edx, [eax + 2]
mov dword [0x44a604], edx
jge 0x402516
cmp edi, dword [esp + 0x12f0]
jne 0x402492
mov dword [esp + 0x12e8], ebx
mov ebx, dword [esp + 0x6abc]
mov ecx, dword [esp + 0x12ec]
jmp 0x40245b
cmp dword [0x44a654], 0
je 0x4013d5
jmp 0x4013ca
mov ebx, 1
xor eax, eax
jmp 0x40152e
push dword [0x44a658]
push dword [esp + 0x6900]
mov edi, eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
push edi
lea edx, [esp + 0x13f0]
push edx
call fcn.00410610
add esp, 8
push 0xffff
push 1
push 0x101e
push dword [0x44a660]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x68fc]
call dword [sym.imp.GDI32.dll_BeginPath]
cmp dword [esp + 0x1308], 0
je 0x402575
push 0
call dword [sym.imp.USER32.dll_DestroyWindow]
lea ecx, [esp + 0x737c]
call fcn.00410630
add esp, 0xfffffff0
lea ecx, [esp + 0x738c]
mov dword [esp], 0x44a650
call fcn.004106c0
add esp, 0xc
lea ecx, [esp + 0x737c]
call fcn.00410670
add esp, 0xfffffff0
lea ecx, [esp + 0x738c]
lea edx, [esp + 0x6a4c]
mov dword [esp], edx
call fcn.004106c0
add esp, 0xc
lea ecx, [esp + 0x737c]
call fcn.00410be0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
test ebx, ebx
je 0x4025f8
push dword [esp + 0x68fc]
call dword [sym.imp.GDI32.dll_GetMapMode]
push eax
push dword [esp + 0x6900]
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x4025ff
inc dword [esp + 0x1314]
push esi
push 0x3000
push dword [esp + 0x1314]
push 0
mov edi, dword [0x44a660]
mov ebx, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x693c], eax
movzx eax, word [esp + 0x69bc]
push eax
push ebx
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, 0x76b981db
mov esi, dword [esp + 0x6a3c]
imul esi
mov ecx, dword [esp + 0x6abc]
xor eax, eax
mov edi, dword [0x44a664]
sar edx, 5
sar esi, 0x1f
sub edx, esi
lea ebx, [ecx + edi]
add edi, edx
cmp edi, dword [esp + 0x1314]
cmovge ecx, ebx
mov dword [esp + 0x6abc], ecx
push eax
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor edx, edx
push edx
push edx
push 0x800
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
lea ecx, [esp + 0x737c]
call fcn.00410c20
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [esp + 0x1300], esi
push eax
push eax
mov edi, dword [0x44a650]
neg edi
mov dword [0x44a65c], edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov ebx, eax
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateWaitableTimerA]
mov dword [esp + 0x1310], eax
mov dword [esp + 0x7750], ebx
xor eax, eax
push str.LTZEXYEvent
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esp + 0x12f8], eax
mov eax, dword [0x4395e8]
xor ecx, ecx
mov edx, dword [0x4395ec]
mov esi, dword [0x4395e0]
mov edi, dword [0x4395e4]
mov dword [esp + 0x7744], eax
lea eax, [esp + 0x773c]
mov dword [esp + 0x773c], esi
mov dword [esp + 0x7740], edi
mov dword [esp + 0x7748], edx
mov dword [esp + 0x7754], ecx
mov dword [esp + 0x7758], ecx
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x44a65c]
xor edx, edx
mov dword [esp + 0x12e8], ecx
imul ecx, dword [esp + 0x6a7c], 0x64
xor esi, esi
mov dword [esp + 0x12fc], ecx
mov edi, 0xa
mov ecx, dword [esp + 0x1314]
neg ecx
dec ecx
imul ecx, dword [esp + 0x6abc]
add ecx, 4
mov dword [esp + 0x12ec], edx
mov dword [0x44a650], 0
mov dword [esp + 0x1308], edx
mov dword [esp + 0x1304], esi
mov dword [esp + 0x130c], ecx
mov dword [esp + 0x1318], edx
mov dword [esp + 0x12f0], ebx
lea ebx, [esp + 0x7724]
mov edx, dword [esp + 0x12e8]
mov ecx, dword [esp + 0x69bc]
add edx, ecx
lea edx, [edx + ecx + 4]
mov dword [0x44a65c], edx
mov edx, dword [0x44a650]
mov ecx, dword [esp + 0x1304]
neg ecx
add edx, dword [esp + 0x12fc]
lea edx, [edx + ecx + 0x771]
mov dword [0x44a650], edx
lea edx, [esp + 0x76fc]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea edx, [esp + 0x7744]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [0x44a65c]
dec edi
imul ecx, dword [0x44a658]
xor eax, eax
add ecx, dword [0x44a650]
add ecx, dword [0x44a658]
movzx edx, word [esp + 0x7704]
mov dword [0x44a650], ecx
mov ecx, 8
mov word [esp + 0x7704], cx
mov ecx, dword [esp + 0x773c]
mov word [esp + 0x7706], ax
mov word [esp + 0x7708], ax
cmp ecx, dword [esp + 0x7744]
jne 0x4028c4
mov ecx, dword [esp + 0x7740]
cmp ecx, dword [esp + 0x7748]
jne 0x4028c4
push ebx
lea ecx, [esp + 0x7700]
push ecx
mov dword [esp + 0x12f0], edx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov edx, dword [esp + 0x12e8]
cmp edx, 8
jle 0x4028b5
add dword [esp + 0x7724], 0x2a69c000
adc dword [esp + 0x7728], 0xc9
mov edx, dword [esp + 0x1314]
add dword [0x44a65c], edx
jmp 0x402907
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
xor edx, edx
inc dword [esp + 0x1318]
push edx
push edx
push edx
push 0x5265c00
push ebx
push dword [esp + 0x1304]
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
mov edx, dword [esp + 0x7744]
mov ecx, dword [esp + 0x7748]
mov dword [esp + 0x773c], edx
mov dword [esp + 0x7740], ecx
mov dword [esp + 0x12f4], edi
mov edi, dword [esp + 0x12ec]
push 1
push dword [0x44a654]
push 0
lea edx, [esp + 0x7758]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
mov ebx, eax
xor edx, edx
push edx
push edx
push edx
push 0x3e8
lea ecx, [esp + 0x7764]
push ecx
push dword [esp + 0x1324]
call dword [sym.imp.KERNEL32.dll_SetWaitableTimer]
cmp dword [esp + 0x1318], 0
je 0x40299d
mov edi, dword [esp + 0x1314]
mov edx, dword [0x44a650]
mov eax, dword [esp + 0x1308]
inc eax
lea ecx, [edi + edi*4]
shl ecx, 2
neg ecx
mov dword [esp + 0x1308], eax
cmp eax, dword [esp + 0x130c]
lea edi, [edx + ecx + 0x7d5]
mov edx, 0
mov dword [0x44a650], edi
mov edi, edx
ja 0x4029b6
jmp 0x4029cc
mov ecx, dword [esp + 0x1308]
cmp ecx, dword [esp + 0x130c]
jbe 0x4029cc
cmp edi, 0xa
je 0x40ee7c
mov ecx, dword [esp + 0x1304]
inc esi
add ecx, dword [esp + 0x1b34]
mov dword [esp + 0x1304], ecx
cmp ebx, 0xc0
jne 0x402a0b
mov ecx, esi
inc edi
mov eax, dword [esp + 0x1300]
imul ecx, eax
add eax, ecx
mov ecx, dword [esp + 0x1314]
add ecx, 0xf
imul ecx, esi
shr ecx, 1
add dword [0x44a650], ecx
mov ecx, 2
mov dword [esp + 0x1300], eax
mov dword [esp + 0x1314], ecx
cmp dword [esp + 0x1318], 2
jne 0x402a45
push dword [esp + 0x12f0]
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
mov ecx, dword [esp + 0x1304]
inc esi
add ecx, dword [esp + 0x1b34]
mov dword [esp + 0x1304], ecx
push dword [esp + 0x1310]
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
cmp dword [esp + 0x6a7c], 0
je 0x402a57
test ebx, ebx
jne 0x402915
mov dword [esp + 0x12ec], edi
lea ebx, [esp + 0x7724]
mov edi, dword [esp + 0x12f4]
test esi, esi
jne 0x402aae
push 0xba1
push dword [esp + 0x12fc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [0x44a65c]
mov ecx, dword [esp + 0x69bc]
lea eax, [ecx + edx]
mov ecx, dword [esp + 0x1300]
lea ecx, [ecx - 1]
imul ecx, eax
mov dword [esp + 0x1314], ecx
test edi, edi
jne 0x4027c4
mov ebx, dword [esp + 0x12f0]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esp + 0x1310]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [0x44a654]
mov ecx, dword [0x44a658]
test ecx, ecx
mov dword [esp + 0x15f4], ebx
mov dword [esp + 0x12e8], ecx
je 0x402af1
mov dword [0x44a650], 0
xor edx, edx
lea esi, [ebx + 0x51]
xor eax, eax
lea edi, [esp + 0x15f4]
idiv esi
and edi, 0xff
cmp eax, edi
jg 0x402b1b
lea eax, [esp + 0x12e8]
movzx edx, ax
add dword [0x44a650], edx
pxor xmm0, xmm0
mov dword [esp + 0x275c], ecx
movaps xmmword [esp + 0x1600], xmm0
movaps xmmword [esp + 0x1610], xmm0
movq qword [esp + 0x1620], xmm0
mov dword [esp + 0x1600], 8
mov dword [esp + 0x1624], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x161c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1618], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1614], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1620], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1614], eax
cmp dword [0x44a654], 0
jne 0x402bca
xor eax, eax
xor esi, esi
jmp 0x402bf8
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x164c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x73d8]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
mov edi, 0x140
push edx
push edx
push 0x7c
push esi
push edi
push edi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x275c]
movzx ecx, dx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov edx, dword [0x44a658]
test edx, edx
je 0x402cd5
mov dword [0x44a650], 0
xor eax, eax
jmp 0x402cda
mov eax, dword [0x44a650]
mov edi, dword [0x44a654]
lea ecx, [edi + 1]
mov ebx, ecx
shr ebx, 0x1f
imul eax, ecx
imul ecx, dword [0x44a65c]
lea esi, [ebx + edi + 1]
sar esi, 1
mov dword [esp + 0x15f4], esi
mov dword [esp + 0x1600], esi
lea ebx, [esi - 1]
mov dword [esp + 0x15f8], ebx
mov dword [esp + 0x1604], ebx
mov esi, dword [esp + edx*4 + 0x15f4]
lea esi, [eax + esi - 3]
mov eax, dword [esp + edx*4 + 0x1600]
lea edx, [ecx + eax + 3]
mov dword [esp + 0x15fc], edx
push 0
lea ebx, [ecx + eax - 3]
push ebx
push esi
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [esi - 3]
mov dword [esp + 0x13e8], eax
push ebx
push eax
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push ebx
push esi
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
add ebx, 0xfffffffd
push ebx
push esi
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1600]
push esi
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
push dword [esp + 0x15fc]
push dword [esp + 0x13ec]
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1600]
push esi
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x15fc]
add eax, 3
push eax
push esi
push edi
call dword [sym.imp.GDI32.dll_LineTo]
mov edx, dword [0x44a658]
mov eax, dword [0x44a650]
cmp eax, 1
mov dword [esp + 0x285c], edx
mov esi, dword [0x44a660]
je 0x40fb65
cmp eax, 0x111
je 0x402e42
cmp eax, 0x203
je 0x402e42
cmp eax, 0xf
je 0x402e42
cmp eax, 0x100
je 0x402e42
cmp eax, 5
jne 0x402e42
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x6420]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x642c]
mov ecx, 0xa
mov edx, dword [esp + 0x6428]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
pxor xmm0, xmm0
movaps xmmword [esp + 0x1600], xmm0
movaps xmmword [esp + 0x1610], xmm0
movq qword [esp + 0x1620], xmm0
mov dword [esp + 0x1600], 8
mov dword [esp + 0x1624], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x161c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1618], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1614], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1620], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1614], eax
cmp dword [0x44a654], 0
jne 0x402eea
xor eax, eax
xor esi, esi
jmp 0x402f18
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x164c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x73e8]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x285c]
movzx ecx, dx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6740], xmm0
movaps xmmword [esp + 0x6750], xmm0
movaps xmmword [esp + 0x6760], xmm0
movq qword [esp + 0x6770], xmm0
movd dword [esp + 0x6778], xmm0
mov edx, dword [0x44a6a4]
lea eax, [esi + 1]
mov dword [esp + 0x6740], 0x3c
mov dword [esp + 0x6744], eax
mov dword [esp + 0x674c], 0x44a668
mov dword [esp + 0x6758], edx
mov dword [esp + 0x6754], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6740]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x674c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6758]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [0x44a654]
mov eax, dword [0x44a658]
test eax, eax
mov dword [esp + 0x15f4], ecx
mov dword [esp + 0x295c], eax
je 0x4030bd
mov dword [0x44a650], 0
xor edx, edx
add ecx, 0x51
xor eax, eax
lea edi, [esp + 0x295c]
idiv ecx
movzx edi, di
lea ecx, [esp + 0x15f4]
movzx ecx, cl
cmp eax, ecx
jg 0x4030e4
add dword [0x44a650], edi
pxor xmm0, xmm0
movaps xmmword [esp + 0x1600], xmm0
movaps xmmword [esp + 0x1610], xmm0
movq qword [esp + 0x1620], xmm0
mov dword [esp + 0x1600], 8
mov dword [esp + 0x1624], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x161c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1618], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1614], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1620], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1614], eax
cmp dword [0x44a654], 0
jne 0x40318a
xor ebx, ebx
jmp 0x4031b8
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x164c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
lea eax, [esp + 0x73f8]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
mov edx, 0x12c
push eax
push eax
push 0x7b
push ebx
push edx
push edx
mov ecx, 0xa
push ecx
push ecx
push 0x5080000e
push eax
push str.static
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
xor eax, eax
mov edx, 0x140
push eax
push eax
push 0x7c
push ebx
push edx
push edx
push 0xa
push 0x15e
push 0x50000080
push eax
push str.Button
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov ebx, dword [0x44a654]
mov edi, dword [0x44a658]
mov dword [esp + 0x2a5c], edi
mov dword [esp + 0x15f4], ebx
lea eax, [ebx + 1]
mov esi, eax
shr esi, 0x1f
lea edx, [esi + ebx + 1]
mov esi, dword [0x44a650]
sar edx, 1
imul esi, eax
imul eax, dword [0x44a65c]
mov dword [esp + 0x17f4], edx
lea ecx, [edx - 1]
mov dword [esp + 0x17f8], ecx
mov dword [esp + 0x1800], edx
mov dword [esp + 0x1804], ecx
mov edx, dword [esp + edi*4 + 0x17f4]
mov edi, dword [esp + edi*4 + 0x1800]
lea esi, [esi + edx - 3]
lea ecx, [eax + edi - 3]
mov dword [esp + 0x17fc], ecx
push 0
push ecx
push esi
push ebx
lea edi, [eax + edi + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [esi - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x17fc]
push eax
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1800]
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x17fc]
add eax, 0xfffffffd
push eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x13ec]
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
xor edx, edx
lea ebx, [esp + 0x15f4]
mov ecx, dword [0x44a654]
xor eax, eax
add ecx, 0x51
idiv ecx
movzx ebx, bl
cmp eax, ebx
jg 0x403391
lea eax, [esp + 0x2a5c]
movzx edx, ax
add dword [0x44a650], edx
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6780], xmm0
movaps xmmword [esp + 0x6790], xmm0
movaps xmmword [esp + 0x67a0], xmm0
movq qword [esp + 0x67b0], xmm0
movd dword [esp + 0x67b8], xmm0
mov edx, dword [0x44a6e4]
lea eax, [esi + 1]
mov dword [esp + 0x6780], 0x3c
mov dword [esp + 0x6784], eax
mov dword [esp + 0x678c], 0x44a6a8
mov dword [esp + 0x6798], edx
mov dword [esp + 0x6794], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6780]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x678c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6798]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x44a654]
mov edx, dword [0x44a658]
pxor xmm0, xmm0
mov dword [esp + 0x15f4], eax
mov dword [esp + 0x2b5c], edx
mov esi, dword [0x44a660]
movaps xmmword [esp + 0x67c0], xmm0
movaps xmmword [esp + 0x67d0], xmm0
movaps xmmword [esp + 0x67e0], xmm0
movq qword [esp + 0x67f0], xmm0
movd dword [esp + 0x67f8], xmm0
mov edx, dword [0x44a724]
lea eax, [esi + 1]
mov dword [esp + 0x67c0], 0x3c
mov dword [esp + 0x67c4], eax
mov dword [esp + 0x67cc], 0x44a6e8
mov dword [esp + 0x67d8], edx
mov dword [esp + 0x67d4], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x67c0]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x67cc]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x67d8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edi, dword [0x44a654]
xor edx, edx
xor eax, eax
lea ebx, [esp + 0x15f4]
movzx ebx, bl
lea ecx, [edi + 0x51]
idiv ecx
cmp eax, ebx
jg 0x403549
lea eax, [esp + 0x2b5c]
movzx edx, ax
add dword [0x44a650], edx
mov ebx, dword [0x44a65c]
cvtsi2sd xmm0, ebx
mov esi, dword [0x44a658]
mov dword [esp + 0x15f4], edi
mov dword [esp + 0x2c5c], esi
call fcn.00424100
mov eax, dword [esp + 0x2d41]
lea edx, [esp + 0x15f4]
cvtsi2sd xmm5, eax
shr eax, 0x1f
movzx ecx, dx
cvtsi2sd xmm1, ecx
addsd xmm5, qword [eax*8 + 0x4396e0]
movsd xmm2, qword [0x439798]
addsd xmm5, xmm1
movaps xmm4, xmm2
addsd xmm5, xmm0
movaps xmm3, xmm5
cmplesd xmm4, xmm5
cmpnltsd xmm3, xmm2
andps xmm4, xmm2
movd eax, xmm3
subsd xmm5, xmm4
cvttsd2si edx, xmm5
and eax, 0x80000000
add edx, eax
mov dword [esp + 0x13e8], edx
test esi, esi
je 0x4035dc
mov dword [0x44a650], 0
cvtsi2ss xmm0, ebx
movss dword [esp], xmm0
call fcn.0040fca0
mov eax, dword [0x44a660]
add esi, 0x49
cdq
idiv esi
add eax, edi
cvtsi2ss xmm1, eax
fstp dword [esp + 0x23f8]
pxor xmm5, xmm5
movss xmm0, dword [esp + 0x23f8]
movsd xmm2, qword [0x439798]
addss xmm1, xmm0
cvtss2sd xmm1, xmm1
movaps xmm4, xmm2
movaps xmm3, xmm1
movaps xmmword [esp + 0x1800], xmm5
cmplesd xmm4, xmm1
cmpnltsd xmm3, xmm2
andps xmm4, xmm2
movd ecx, xmm3
subsd xmm1, xmm4
cvttsd2si edi, xmm1
and ecx, 0x80000000
movaps xmmword [esp + 0x1810], xmm5
add edi, ecx
movq qword [esp + 0x1820], xmm5
mov dword [esp + 0x1800], 8
mov dword [esp + 0x1824], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x181c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1818], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1814], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1820], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1814], eax
cmp dword [0x44a654], 0
jne 0x4036e8
xor ebx, ebx
jmp 0x403716
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x184c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
lea eax, [esp + 0x7408]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
mov edx, 0x12c
push eax
push eax
push 0x7b
push ebx
push edx
push edx
mov ecx, 0xa
push ecx
push ecx
push 0x5080000e
push eax
push str.static
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
xor eax, eax
mov edx, 0x140
push eax
push eax
push 0x7c
push ebx
push edx
push edx
push 0xa
push 0x15e
push 0x50000080
push eax
push str.Button
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x2c5c]
movzx ebx, dx
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [0x44a654]
xor edx, edx
xor eax, eax
lea ecx, [esi + 0x51]
idiv ecx
lea edx, [esp + 0x15f4]
movzx edx, dl
cmp eax, edx
jg 0x40381b
mov eax, 0xba2e8ba3
mul edi
mov ecx, dword [0x44a650]
add ecx, ebx
add ecx, dword [esp + 0x13e8]
shr edx, 3
sub ecx, edx
mov dword [0x44a650], ecx
jmp 0x403821
mov ecx, dword [0x44a650]
lea edi, [esi + 1]
mov ebx, edi
shr ebx, 0x1f
imul ecx, edi
imul edi, dword [0x44a65c]
lea eax, [ebx + esi + 1]
sar eax, 1
mov dword [esp + 0x17f4], eax
mov dword [esp + 0x1800], eax
lea edx, [eax - 1]
mov eax, dword [0x44a658]
mov dword [esp + 0x17f8], edx
mov dword [esp + 0x1804], edx
mov ebx, dword [esp + eax*4 + 0x17f4]
lea ebx, [ecx + ebx - 3]
mov ecx, dword [esp + eax*4 + 0x1800]
lea eax, [edi + ecx - 3]
mov dword [esp + 0x17fc], eax
push 0
push eax
push ebx
push esi
lea edi, [edi + ecx + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [ebx - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x17fc]
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1800]
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x17fc]
add eax, 0xfffffffd
push eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x13ec]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6800], xmm0
movaps xmmword [esp + 0x6810], xmm0
movaps xmmword [esp + 0x6820], xmm0
movq qword [esp + 0x6830], xmm0
movd dword [esp + 0x6838], xmm0
mov edx, dword [0x44a764]
lea eax, [esi + 1]
mov dword [esp + 0x6800], 0x3c
mov dword [esp + 0x6804], eax
mov dword [esp + 0x680c], 0x44a728
mov dword [esp + 0x6818], edx
mov dword [esp + 0x6814], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6800]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x680c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6818]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x44a654]
mov edx, dword [0x44a658]
mov dword [esp + 0x17f4], eax
mov eax, dword [0x44a650]
cmp eax, 1
mov dword [esp + 0x2d5c], edx
mov esi, dword [0x44a660]
je 0x40fb1d
cmp eax, 0x111
je 0x403a47
cmp eax, 0x203
je 0x403a47
cmp eax, 0xf
je 0x403a47
cmp eax, 0x100
je 0x403a47
cmp eax, 5
jne 0x403a47
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x6430]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x643c]
mov ecx, 0xa
mov edx, dword [esp + 0x6438]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
pxor xmm0, xmm0
movaps xmmword [esp + 0x1a00], xmm0
movaps xmmword [esp + 0x1a10], xmm0
movq qword [esp + 0x1a20], xmm0
mov dword [esp + 0x1a00], 8
mov dword [esp + 0x1a24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1a1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1a18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1a14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1a20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1a14], eax
cmp dword [0x44a654], 0
jne 0x403aef
xor eax, eax
xor esi, esi
jmp 0x403b1d
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1a4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x7418]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x2d5c]
movzx ebx, dx
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
xor edx, edx
lea esi, [esp + 0x17f4]
mov ecx, dword [0x44a654]
xor eax, eax
add ecx, 0x51
idiv ecx
and esi, 0xff
cmp eax, esi
jg 0x403c08
add dword [0x44a650], ebx
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6840], xmm0
movaps xmmword [esp + 0x6850], xmm0
movaps xmmword [esp + 0x6860], xmm0
movq qword [esp + 0x6870], xmm0
movd dword [esp + 0x6878], xmm0
mov edx, dword [0x44a7a4]
lea eax, [esi + 1]
mov dword [esp + 0x6840], 0x3c
mov dword [esp + 0x6844], eax
mov dword [esp + 0x684c], 0x44a768
mov dword [esp + 0x6858], edx
mov dword [esp + 0x6854], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6840]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x684c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6858]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ebx, dword [0x44a654]
xor edx, edx
mov dword [esp + 0x17f4], ebx
add ebx, 0x51
xor eax, eax
lea esi, [esp + 0x17f4]
idiv ebx
and esi, 0xff
mov ecx, dword [0x44a658]
cmp eax, esi
mov dword [esp + 0x2e5c], ecx
jg 0x403d05
lea eax, [esp + 0x2e5c]
movzx edx, ax
add dword [0x44a650], edx
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6880], xmm0
movaps xmmword [esp + 0x6890], xmm0
movaps xmmword [esp + 0x68a0], xmm0
movq qword [esp + 0x68b0], xmm0
movd dword [esp + 0x68b8], xmm0
mov edx, dword [0x44a7e4]
lea eax, [esi + 1]
mov dword [esp + 0x6880], 0x3c
mov dword [esp + 0x6884], eax
mov dword [esp + 0x688c], 0x44a7a8
mov dword [esp + 0x6898], edx
mov dword [esp + 0x6894], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6880]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x688c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6898]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x44a650]
cmp eax, 1
mov esi, dword [0x44a660]
je 0x40fad5
cmp eax, 0x111
je 0x403e42
cmp eax, 0x203
je 0x403e42
cmp eax, 0xf
je 0x403e42
cmp eax, 0x100
je 0x403e42
cmp eax, 5
jne 0x403e42
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x6440]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x644c]
mov ecx, 0xa
mov edx, dword [esp + 0x6448]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esi, dword [0x44a660]
mov eax, dword [0x44a654]
mov edx, dword [0x44a658]
pxor xmm0, xmm0
mov dword [esp + 0x17f4], eax
mov dword [esp + 0x2f5c], edx
movaps xmmword [esp + 0x68c0], xmm0
movaps xmmword [esp + 0x68d0], xmm0
movaps xmmword [esp + 0x68e0], xmm0
movq qword [esp + 0x68f0], xmm0
movd dword [esp + 0x68f8], xmm0
mov edx, dword [0x44a824]
lea eax, [esi + 1]
mov dword [esp + 0x68c0], 0x3c
mov dword [esp + 0x68c4], eax
mov dword [esp + 0x68cc], 0x44a7e8
mov dword [esp + 0x68d8], edx
mov dword [esp + 0x68d4], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x68c0]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x68cc]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x68d8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [0x44a650]
cmp ecx, 1
mov esi, dword [0x44a660]
je 0x40fa8d
cmp ecx, 0x111
je 0x403f96
cmp ecx, 0x203
je 0x403f96
cmp ecx, 0xf
je 0x403f96
cmp ecx, 0x100
je 0x403f96
cmp ecx, 5
jne 0x403f96
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x6450]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x645c]
mov ecx, 0xa
mov edx, dword [esp + 0x6458]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [0x44a650]
mov esi, dword [0x44a654]
xor edx, edx
xor eax, eax
lea edi, [esp + 0x17f4]
and edi, 0xff
lea ebx, [esi + 0x51]
idiv ebx
cmp eax, edi
jg 0x403fc8
lea eax, [esp + 0x2f5c]
movzx edx, ax
add ecx, edx
mov dword [0x44a650], ecx
lea edi, [esi + 1]
mov ebx, edi
shr ebx, 0x1f
imul ecx, edi
imul edi, dword [0x44a65c]
lea eax, [ebx + esi + 1]
sar eax, 1
mov dword [esp + 0x17f4], eax
mov dword [esp + 0x1800], eax
lea edx, [eax - 1]
mov eax, dword [0x44a658]
mov dword [esp + 0x17f8], edx
mov dword [esp + 0x1804], edx
mov ebx, dword [esp + eax*4 + 0x17f4]
lea ebx, [ecx + ebx - 3]
mov ecx, dword [esp + eax*4 + 0x1800]
lea eax, [edi + ecx - 3]
mov dword [esp + 0x17fc], eax
push 0
push eax
push ebx
push esi
lea edi, [edi + ecx + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [ebx - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x17fc]
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1800]
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x17fc]
add eax, 0xfffffffd
push eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x13ec]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov edx, dword [0x44a658]
pxor xmm0, xmm0
mov dword [esp + 0x305c], edx
movaps xmmword [esp + 0x1800], xmm0
movaps xmmword [esp + 0x1810], xmm0
movq qword [esp + 0x1820], xmm0
mov dword [esp + 0x1800], 8
mov dword [esp + 0x1824], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x181c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1818], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1814], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1820], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1814], eax
cmp dword [0x44a654], 0
jne 0x404153
xor eax, eax
xor esi, esi
jmp 0x404181
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x184c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x7428]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x305c]
movzx ecx, dx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [0x44a654]
mov ecx, dword [0x44a650]
lea edi, [esi + 1]
mov ebx, edi
shr ebx, 0x1f
imul ecx, edi
imul edi, dword [0x44a65c]
lea eax, [ebx + esi + 1]
sar eax, 1
mov dword [esp + 0x17f4], eax
mov dword [esp + 0x1800], eax
lea edx, [eax - 1]
mov eax, dword [0x44a658]
mov dword [esp + 0x17f8], edx
mov dword [esp + 0x1804], edx
mov ebx, dword [esp + eax*4 + 0x17f4]
mov edx, dword [esp + eax*4 + 0x1800]
lea ebx, [ecx + ebx - 3]
lea ecx, [edi + edx - 3]
mov dword [esp + 0x17fc], ecx
push 0
push ecx
push ebx
push esi
lea edi, [edi + edx + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [ebx - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x17fc]
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1800]
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x17fc]
add eax, 0xfffffffd
push eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x13ec]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, 0x2e8ba2e9
mov ecx, dword [0x44a65c]
imul ecx
mov dword [esp + 0x1a08], ecx
sar edx, 3
sar ecx, 0x1f
mov edi, dword [0x44a650]
sub edx, ecx
movzx eax, di
mov esi, dword [0x44a654]
sub edx, eax
mov ebx, dword [0x44a658]
mov dword [esp + 0x17f4], esi
mov dword [esp + 0x315c], ebx
jge 0x404376
xor eax, eax
mov dword [esp + 0x13e8], eax
jmp 0x4043a8
push 0
call fcn.0040fca0
fstp dword [esp + 0x23fc]
movss xmm0, dword [esp + 0x23fc]
add esp, 4
cvtsi2ss xmm1, dword [esp + 0x1a08]
subss xmm1, xmm0
cvttss2si eax, xmm1
mov dword [esp + 0x13e8], eax
lea eax, [esi + 1]
mov edx, eax
shr edx, 0x1f
imul edi, eax
imul eax, dword [esp + 0x1a08]
lea ecx, [edx + esi + 1]
sar ecx, 1
mov dword [esp + 0x1a00], ecx
mov dword [esp + 0x19f4], ecx
lea edx, [ecx - 1]
mov dword [esp + 0x1a04], edx
mov dword [esp + 0x19f8], edx
mov edx, dword [esp + ebx*4 + 0x1a00]
mov ecx, dword [esp + ebx*4 + 0x19f4]
lea ebx, [eax + edx - 3]
lea eax, [eax + edx + 3]
mov dword [esp + 0x19fc], eax
push 0
push ebx
lea edi, [edi + ecx - 3]
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [edi - 3]
mov dword [esp + 0x19f4], eax
push ebx
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add ebx, 0xfffffffd
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1a00]
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push dword [esp + 0x19fc]
push dword [esp + 0x19f8]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1a00]
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x19fc]
add eax, 3
push eax
push edi
push esi
call dword [sym.imp.GDI32.dll_LineTo]
cmp dword [0x44a658], 0
je 0x404495
mov eax, dword [esp + 0x13e8]
mov dword [0x44a650], eax
xor edx, edx
lea ebx, [esp + 0x17f4]
mov ecx, dword [0x44a654]
xor eax, eax
add ecx, 0x51
lea edi, [esp + 0x315c]
idiv ecx
movzx ebx, bl
movzx edi, di
cmp eax, ebx
jg 0x4044c2
add dword [0x44a650], edi
pxor xmm0, xmm0
movaps xmmword [esp + 0x1800], xmm0
movaps xmmword [esp + 0x1810], xmm0
movq qword [esp + 0x1820], xmm0
mov dword [esp + 0x1800], 8
mov dword [esp + 0x1824], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x181c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1818], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1814], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1820], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1814], eax
cmp dword [0x44a654], 0
jne 0x404568
xor ebx, ebx
jmp 0x404596
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x184c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebx, eax
lea eax, [esp + 0x7438]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
xor eax, eax
mov edx, 0x12c
push eax
push eax
push 0x7b
push ebx
push edx
push edx
mov ecx, 0xa
push ecx
push ecx
push 0x5080000e
push eax
push str.static
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
xor eax, eax
mov edx, 0x140
push eax
push eax
push 0x7c
push ebx
push edx
push edx
push 0xa
push 0x15e
push 0x50000080
push eax
push str.Button
push eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov edx, dword [0x44a658]
pxor xmm0, xmm0
mov dword [esp + 0x325c], edx
movaps xmmword [esp + 0x1800], xmm0
movaps xmmword [esp + 0x1810], xmm0
movq qword [esp + 0x1820], xmm0
mov dword [esp + 0x1800], 8
mov dword [esp + 0x1824], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x181c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1818], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1814], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1820], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1814], eax
cmp dword [0x44a654], 0
jne 0x404706
xor eax, eax
xor esi, esi
jmp 0x404734
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x184c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x7448]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x325c]
movzx ecx, dx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov ecx, dword [0x44a658]
test ecx, ecx
je 0x404811
mov dword [0x44a650], 0
xor eax, eax
jmp 0x404816
mov eax, dword [0x44a650]
mov ebx, dword [0x44a660]
cmp eax, 1
je 0x40fa45
cmp eax, 0x111
je 0x40489a
cmp eax, 0x203
je 0x40489a
cmp eax, 0xf
je 0x40489a
cmp eax, 0x100
je 0x40489a
cmp eax, 5
jne 0x40489a
push 0x7b
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [esp + 0x6460]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x646c]
mov ecx, 0xa
mov edx, dword [esp + 0x6468]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x44a650]
mov ecx, dword [0x44a658]
mov edi, dword [0x44a654]
lea edx, [edi + 1]
mov ebx, edx
shr ebx, 0x1f
imul eax, edx
imul edx, dword [0x44a65c]
lea esi, [ebx + edi + 1]
sar esi, 1
mov dword [esp + 0x17f4], esi
mov dword [esp + 0x1800], esi
lea ebx, [esi - 1]
mov dword [esp + 0x17f8], ebx
mov dword [esp + 0x1804], ebx
mov esi, dword [esp + ecx*4 + 0x17f4]
lea ebx, [eax + esi - 3]
mov eax, dword [esp + ecx*4 + 0x1800]
lea ecx, [edx + eax + 3]
mov dword [esp + 0x17fc], ecx
push 0
lea esi, [edx + eax - 3]
push esi
push ebx
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [ebx - 3]
mov dword [esp + 0x13e8], eax
push esi
push eax
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push esi
push ebx
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
add esi, 0xfffffffd
push esi
push ebx
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1800]
push ebx
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
push dword [esp + 0x17fc]
push dword [esp + 0x13ec]
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1800]
push ebx
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x17fc]
add eax, 3
push eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_LineTo]
mov edi, dword [0x44a650]
cmp edi, 1
mov esi, dword [0x44a660]
je 0x40f9fd
cmp edi, 0x111
je 0x404a05
cmp edi, 0x203
je 0x404a05
cmp edi, 0xf
je 0x404a05
cmp edi, 0x100
je 0x404a05
cmp edi, 5
jne 0x404a05
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x6470]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x647c]
mov ecx, 0xa
mov edx, dword [esp + 0x6478]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edi, dword [0x44a650]
mov esi, dword [0x44a660]
mov ebx, dword [0x44a654]
cmp edi, 1
mov ecx, dword [0x44a658]
mov dword [esp + 0x17f4], ebx
mov dword [esp + 0x335c], ecx
je 0x40f9b5
cmp edi, 0x111
je 0x404aa7
cmp edi, 0x203
je 0x404aa7
cmp edi, 0xf
je 0x404aa7
cmp edi, 0x100
je 0x404aa7
cmp edi, 5
jne 0x404aa7
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x6480]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x648c]
mov ecx, 0xa
mov edx, dword [esp + 0x6488]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edi, dword [0x44a650]
mov ecx, dword [0x44a658]
mov ebx, dword [0x44a654]
xor edx, edx
lea esi, [esp + 0x335c]
movzx eax, si
lea esi, [ebx + 0x51]
mov dword [esp + 0x13e8], eax
xor eax, eax
idiv esi
lea edx, [esp + 0x17f4]
movzx edx, dl
cmp eax, edx
jg 0x404adc
add edi, dword [esp + 0x13e8]
mov dword [0x44a650], edi
lea eax, [ebx + 1]
mov esi, eax
shr esi, 0x1f
imul edi, eax
imul eax, dword [0x44a65c]
lea edx, [esi + ebx + 1]
sar edx, 1
mov dword [esp + 0x17f4], edx
mov dword [esp + 0x1800], edx
lea esi, [edx - 1]
mov dword [esp + 0x17f8], esi
mov dword [esp + 0x1804], esi
mov edx, dword [esp + ecx*4 + 0x17f4]
mov ecx, dword [esp + ecx*4 + 0x1800]
lea esi, [edi + edx - 3]
lea edi, [eax + ecx - 3]
lea eax, [eax + ecx + 3]
mov dword [esp + 0x17fc], eax
push 0
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [esi - 3]
mov dword [esp + 0x17f4], eax
push edi
push eax
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 0xfffffffd
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1800]
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
push dword [esp + 0x17fc]
push dword [esp + 0x17f8]
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1800]
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x17fc]
add eax, 3
push eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
pxor xmm0, xmm0
movaps xmmword [esp + 0x1800], xmm0
movaps xmmword [esp + 0x1810], xmm0
movq qword [esp + 0x1820], xmm0
mov dword [esp + 0x1800], 8
mov dword [esp + 0x1824], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x181c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1818], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1814], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1820], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1814], eax
cmp dword [0x44a654], 0
jne 0x404c5b
xor eax, eax
xor esi, esi
jmp 0x404c89
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x184c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x7458]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [esp + 0x13e8]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov ebx, dword [0x44a654]
mov edx, dword [0x44a658]
mov eax, dword [0x44a650]
cmp eax, 1
mov dword [esp + 0x17f4], ebx
mov dword [esp + 0x345c], edx
mov esi, dword [0x44a660]
je 0x40f96d
cmp eax, 0x111
je 0x404df3
cmp eax, 0x203
je 0x404df3
cmp eax, 0xf
je 0x404df3
cmp eax, 0x100
je 0x404df3
cmp eax, 5
jne 0x404df3
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x6490]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x649c]
mov ecx, 0xa
mov edx, dword [esp + 0x6498]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x44a650]
mov edx, dword [0x44a658]
mov ebx, dword [0x44a654]
lea ecx, [ebx + 1]
mov esi, ecx
shr esi, 0x1f
imul eax, ecx
imul ecx, dword [0x44a65c]
lea edi, [esi + ebx + 1]
sar edi, 1
mov dword [esp + 0x19f4], edi
mov dword [esp + 0x1a00], edi
lea esi, [edi - 1]
mov dword [esp + 0x19f8], esi
mov dword [esp + 0x1a04], esi
mov edi, dword [esp + edx*4 + 0x19f4]
lea edi, [eax + edi - 3]
mov eax, dword [esp + edx*4 + 0x1a00]
lea edx, [ecx + eax + 3]
mov dword [esp + 0x19fc], edx
push 0
lea esi, [ecx + eax - 3]
push esi
push edi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [edi - 3]
mov dword [esp + 0x13e8], eax
push esi
push eax
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push esi
push edi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
add esi, 0xfffffffd
push esi
push edi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1a00]
push edi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
push dword [esp + 0x19fc]
push dword [esp + 0x13ec]
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1a00]
push edi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x19fc]
add eax, 3
push eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
pxor xmm0, xmm0
movaps xmmword [esp + 0x1a00], xmm0
movaps xmmword [esp + 0x1a10], xmm0
movq qword [esp + 0x1a20], xmm0
mov dword [esp + 0x1a00], 8
mov dword [esp + 0x1a24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1a1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1a18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1a14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1a20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1a14], eax
cmp dword [0x44a654], 0
jne 0x404f72
xor eax, eax
xor esi, esi
jmp 0x404fa0
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1a4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x7468]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x345c]
movzx ebx, dx
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [0x44a654]
xor edx, edx
xor eax, eax
lea edi, [esp + 0x17f4]
and edi, 0xff
lea ecx, [esi + 0x51]
idiv ecx
cmp eax, edi
jg 0x405095
mov edi, dword [0x44a650]
add edi, ebx
mov dword [0x44a650], edi
jmp 0x40509b
mov edi, dword [0x44a650]
mov eax, dword [0x44a65c]
cvtsi2sd xmm0, eax
mov ebx, dword [0x44a658]
mov dword [esp + 0x17f4], esi
mov dword [esp + 0x355c], ebx
mov dword [esp + 0x1a08], eax
call fcn.00424100
mov edx, dword [esp + 0x3641]
lea ecx, [esp + 0x17f4]
cvtsi2sd xmm5, edx
shr edx, 0x1f
movzx eax, cx
cvtsi2sd xmm1, eax
addsd xmm5, qword [edx*8 + 0x4396e0]
movsd xmm2, qword [0x439798]
addsd xmm5, xmm1
movaps xmm4, xmm2
addsd xmm5, xmm0
movaps xmm3, xmm5
cmplesd xmm4, xmm5
cmpnltsd xmm3, xmm2
andps xmm4, xmm2
movd edx, xmm3
subsd xmm5, xmm4
cvttsd2si eax, xmm5
and edx, 0x80000000
add eax, edx
mov dword [esp + 0x13e8], eax
lea eax, [esi + 1]
mov ecx, eax
shr ecx, 0x1f
imul edi, eax
imul eax, dword [esp + 0x1a08]
lea edx, [ecx + esi + 1]
sar edx, 1
mov dword [esp + 0x19f4], edx
mov dword [esp + 0x1a00], edx
lea ecx, [edx - 1]
mov dword [esp + 0x19f8], ecx
mov dword [esp + 0x1a04], ecx
mov edx, dword [esp + ebx*4 + 0x19f4]
mov ebx, dword [esp + ebx*4 + 0x1a00]
lea edi, [edi + edx - 3]
lea ecx, [eax + ebx - 3]
mov dword [esp + 0x19fc], ecx
push 0
push ecx
push edi
push esi
lea ebx, [eax + ebx + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [edi - 3]
mov dword [esp + 0x19f4], eax
push dword [esp + 0x19fc]
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1a00]
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x19fc]
add eax, 0xfffffffd
push eax
push edi
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push ebx
push dword [esp + 0x19f8]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add ebx, 3
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_LineTo]
xor edx, edx
lea ebx, [esp + 0x17f4]
mov ecx, dword [0x44a654]
xor eax, eax
add ecx, 0x51
idiv ecx
movzx ebx, bl
cmp eax, ebx
jg 0x405234
lea eax, [esp + 0x355c]
movzx eax, ax
add eax, dword [0x44a650]
add eax, dword [esp + 0x13e8]
mov dword [0x44a650], eax
jmp 0x405239
mov eax, dword [0x44a650]
mov esi, dword [0x44a660]
cmp eax, 1
je 0x40f925
cmp eax, 0x111
je 0x4052b8
cmp eax, 0x203
je 0x4052b8
cmp eax, 0xf
je 0x4052b8
cmp eax, 0x100
je 0x4052b8
cmp eax, 5
jne 0x4052b8
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x64a0]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x64ac]
mov ecx, 0xa
mov edx, dword [esp + 0x64a8]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6900], xmm0
movaps xmmword [esp + 0x6910], xmm0
movaps xmmword [esp + 0x6920], xmm0
movq qword [esp + 0x6930], xmm0
movd dword [esp + 0x6938], xmm0
mov edx, dword [0x44a864]
lea eax, [esi + 1]
mov dword [esp + 0x6900], 0x3c
mov dword [esp + 0x6904], eax
mov dword [esp + 0x690c], 0x44a828
mov dword [esp + 0x6918], edx
mov dword [esp + 0x6914], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6900]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x690c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6918]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [0x44a658]
mov eax, dword [0x44a650]
cmp eax, 1
mov dword [esp + 0x365c], edx
mov esi, dword [0x44a660]
je 0x40f8dd
cmp eax, 0x111
je 0x4053f6
cmp eax, 0x203
je 0x4053f6
cmp eax, 0xf
je 0x4053f6
cmp eax, 0x100
je 0x4053f6
cmp eax, 5
jne 0x4053f6
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x64b0]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x64bc]
mov ecx, 0xa
mov edx, dword [esp + 0x64b8]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
pxor xmm0, xmm0
movaps xmmword [esp + 0x1a00], xmm0
movaps xmmword [esp + 0x1a10], xmm0
movq qword [esp + 0x1a20], xmm0
mov dword [esp + 0x1a00], 8
mov dword [esp + 0x1a24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1a1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1a18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1a14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1a20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1a14], eax
cmp dword [0x44a654], 0
jne 0x40549e
xor eax, eax
xor esi, esi
jmp 0x4054cc
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1a4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x7478]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x365c]
movzx ecx, dx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [0x44a654]
mov ecx, dword [0x44a650]
lea edi, [esi + 1]
mov ebx, edi
shr ebx, 0x1f
imul ecx, edi
imul edi, dword [0x44a65c]
lea eax, [ebx + esi + 1]
sar eax, 1
mov dword [esp + 0x19f4], eax
mov dword [esp + 0x1a00], eax
lea edx, [eax - 1]
mov eax, dword [0x44a658]
mov dword [esp + 0x19f8], edx
mov dword [esp + 0x1a04], edx
mov ebx, dword [esp + eax*4 + 0x19f4]
mov edx, dword [esp + eax*4 + 0x1a00]
lea ebx, [ecx + ebx - 3]
lea ecx, [edi + edx - 3]
mov dword [esp + 0x19fc], ecx
push 0
push ecx
push ebx
push esi
lea edi, [edi + edx + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [ebx - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x19fc]
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1a00]
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x19fc]
add eax, 0xfffffffd
push eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x13ec]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov esi, dword [0x44a654]
mov ebx, dword [0x44a658]
test ebx, ebx
mov dword [esp + 0x19f4], esi
mov dword [esp + 0x375c], ebx
je 0x4056a1
xor eax, eax
mov dword [0x44a650], 0
xor edi, edi
jmp 0x4056a7
mov edi, dword [0x44a650]
mov ecx, dword [0x44a65c]
cvtsi2ss xmm0, ecx
mov edx, dword [0x44a660]
mov dword [esp + 0x13e8], ecx
mov dword [esp + 0x1bf8], edx
movss dword [esp], xmm0
call fcn.0040fca0
mov eax, dword [esp + 0x1bf8]
lea ecx, [ebx + 0x49]
cdq
idiv ecx
add eax, esi
cvtsi2ss xmm1, eax
fstp dword [esp + 0x23f8]
movss xmm0, dword [esp + 0x23f8]
movsd xmm2, qword [0x439798]
addss xmm1, xmm0
cvtss2sd xmm1, xmm1
movaps xmm4, xmm2
movaps xmm3, xmm1
cmplesd xmm4, xmm1
cmpnltsd xmm3, xmm2
andps xmm4, xmm2
movd edx, xmm3
subsd xmm1, xmm4
cvttsd2si ecx, xmm1
and edx, 0x80000000
add ecx, edx
mov dword [esp + 0x1bf4], ecx
cmp edi, 1
je 0x40f889
cmp edi, 0x111
je 0x4057dd
cmp edi, 0x203
je 0x4057dd
cmp edi, 0xf
je 0x4057dd
cmp edi, 0x100
je 0x4057dd
cmp edi, 5
jne 0x4057dd
push 0x7b
push dword [esp + 0x1bfc]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x64c0]
push eax
push dword [esp + 0x1bfc]
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x64cc]
mov ecx, 0xa
mov edx, dword [esp + 0x64c8]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [0x44a65c]
mov edi, dword [0x44a650]
mov dword [esp + 0x13e8], edx
mov ebx, dword [0x44a658]
mov esi, dword [0x44a654]
xor edx, edx
lea ecx, [esi + 0x51]
xor eax, eax
idiv ecx
lea edx, [esp + 0x19f4]
movzx edx, dl
cmp eax, edx
jg 0x405817
mov eax, 0xba2e8ba3
lea ecx, [esp + 0x375c]
movzx edx, cx
add edi, edx
mul dword [esp + 0x1bf4]
shr edx, 3
sub edi, edx
mov dword [0x44a650], edi
lea eax, [esi + 1]
mov edx, eax
shr edx, 0x1f
imul edi, eax
imul eax, dword [esp + 0x13e8]
lea ecx, [edx + esi + 1]
sar ecx, 1
mov dword [esp + 0x19f4], ecx
mov dword [esp + 0x1a00], ecx
lea edx, [ecx - 1]
mov dword [esp + 0x19f8], edx
mov dword [esp + 0x1a04], edx
mov ecx, dword [esp + ebx*4 + 0x19f4]
mov ebx, dword [esp + ebx*4 + 0x1a00]
lea edi, [edi + ecx - 3]
lea edx, [eax + ebx - 3]
mov dword [esp + 0x19fc], edx
push 0
push edx
push edi
push esi
lea ebx, [eax + ebx + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [edi - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x19fc]
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1a00]
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x19fc]
add eax, 0xfffffffd
push eax
push edi
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push ebx
push dword [esp + 0x13ec]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add ebx, 3
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6940], xmm0
movaps xmmword [esp + 0x6950], xmm0
movaps xmmword [esp + 0x6960], xmm0
movq qword [esp + 0x6970], xmm0
movd dword [esp + 0x6978], xmm0
mov edx, dword [0x44a8a4]
lea eax, [esi + 1]
mov dword [esp + 0x6940], 0x3c
mov dword [esp + 0x6944], eax
mov dword [esp + 0x694c], 0x44a868
mov dword [esp + 0x6958], edx
mov dword [esp + 0x6954], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6940]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x694c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6958]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ebx, dword [0x44a654]
mov edi, dword [0x44a658]
mov dword [esp + 0x385c], edi
lea eax, [ebx + 1]
mov esi, eax
shr esi, 0x1f
lea edx, [esi + ebx + 1]
mov esi, dword [0x44a650]
sar edx, 1
imul esi, eax
imul eax, dword [0x44a65c]
mov dword [esp + 0x19f4], edx
lea ecx, [edx - 1]
mov dword [esp + 0x19f8], ecx
mov dword [esp + 0x1a00], edx
mov dword [esp + 0x1a04], ecx
mov edx, dword [esp + edi*4 + 0x19f4]
mov edi, dword [esp + edi*4 + 0x1a00]
lea esi, [esi + edx - 3]
lea ecx, [eax + edi - 3]
mov dword [esp + 0x19fc], ecx
push 0
push ecx
push esi
push ebx
lea edi, [eax + edi + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [esi - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x19fc]
push eax
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1a00]
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x19fc]
add eax, 0xfffffffd
push eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x13ec]
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
cmp dword [0x44a658], 0
je 0x405aa3
mov dword [0x44a650], 0
xor eax, eax
jmp 0x405aa8
mov eax, dword [0x44a650]
mov esi, dword [0x44a660]
cmp eax, 1
je 0x40f841
cmp eax, 0x111
je 0x405b21
cmp eax, 0x203
je 0x405b21
cmp eax, 0xf
je 0x405b21
cmp eax, 0x100
je 0x405b21
cmp eax, 5
jne 0x405b21
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x64d0]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x64dc]
mov ecx, 0xa
mov edx, dword [esp + 0x64d8]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
pxor xmm0, xmm0
movaps xmmword [esp + 0x1a00], xmm0
movaps xmmword [esp + 0x1a10], xmm0
movq qword [esp + 0x1a20], xmm0
mov dword [esp + 0x1a00], 8
mov dword [esp + 0x1a24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1a1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1a18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1a14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1a20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1a14], eax
cmp dword [0x44a654], 0
jne 0x405bc9
xor eax, eax
xor esi, esi
jmp 0x405bf7
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1a4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x7488]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x385c]
movzx ecx, dx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6980], xmm0
movaps xmmword [esp + 0x6990], xmm0
movaps xmmword [esp + 0x69a0], xmm0
movq qword [esp + 0x69b0], xmm0
movd dword [esp + 0x69b8], xmm0
mov edx, dword [0x44a8e4]
lea eax, [esi + 1]
mov dword [esp + 0x6980], 0x3c
mov dword [esp + 0x6984], eax
mov dword [esp + 0x698c], 0x44a8a8
mov dword [esp + 0x6998], edx
mov dword [esp + 0x6994], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6980]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x698c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6998]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov esi, dword [0x44a654]
mov ebx, dword [0x44a658]
mov dword [esp + 0x395c], ebx
mov dword [esp + 0x19f4], esi
lea eax, [esi + 1]
mov edi, eax
shr edi, 0x1f
lea edx, [edi + esi + 1]
mov edi, dword [0x44a650]
sar edx, 1
imul edi, eax
imul eax, dword [0x44a65c]
mov dword [esp + 0x1c00], edx
lea ecx, [edx - 1]
mov dword [esp + 0x1c04], ecx
mov dword [esp + 0x1bf8], ecx
mov ecx, dword [esp + ebx*4 + 0x1c00]
mov dword [esp + 0x1bf4], edx
mov edx, dword [esp + ebx*4 + 0x1bf4]
lea ebx, [eax + ecx - 3]
lea eax, [eax + ecx + 3]
mov dword [esp + 0x1bfc], eax
push 0
push ebx
lea edi, [edi + edx - 3]
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [edi - 3]
mov dword [esp + 0x13e8], eax
push ebx
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add ebx, 0xfffffffd
push ebx
push edi
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push dword [esp + 0x1bfc]
push dword [esp + 0x13ec]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push edi
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x1bfc]
add eax, 3
push eax
push edi
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov eax, dword [0x44a650]
cmp eax, 1
mov esi, dword [0x44a660]
je 0x40f7f9
cmp eax, 0x111
je 0x405eea
cmp eax, 0x203
je 0x405eea
cmp eax, 0xf
je 0x405eea
cmp eax, 0x100
je 0x405eea
cmp eax, 5
jne 0x405eea
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x64e0]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x64ec]
mov ecx, 0xa
mov edx, dword [esp + 0x64e8]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
pxor xmm0, xmm0
movaps xmmword [esp + 0x1c00], xmm0
movaps xmmword [esp + 0x1c10], xmm0
movq qword [esp + 0x1c20], xmm0
mov dword [esp + 0x1c00], 8
mov dword [esp + 0x1c24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1c1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1c18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1c20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
cmp dword [0x44a654], 0
jne 0x405f92
xor eax, eax
xor esi, esi
jmp 0x405fc0
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1c4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x7498]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x395c]
movzx ebx, dx
push ebx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov edi, dword [0x44a654]
xor edx, edx
xor eax, eax
lea esi, [esp + 0x19f4]
and esi, 0xff
lea ecx, [edi + 0x51]
idiv ecx
cmp eax, esi
jg 0x4060b3
mov eax, dword [0x44a650]
add eax, ebx
mov dword [0x44a650], eax
jmp 0x4060b8
mov eax, dword [0x44a650]
mov ebx, dword [0x44a658]
lea edx, [edi + 1]
mov esi, edx
shr esi, 0x1f
imul eax, edx
imul edx, dword [0x44a65c]
lea ecx, [esi + edi + 1]
sar ecx, 1
mov dword [esp + 0x19f4], ecx
mov dword [esp + 0x1a00], ecx
lea esi, [ecx - 1]
mov dword [esp + 0x19f8], esi
mov dword [esp + 0x1a04], esi
mov ecx, dword [esp + ebx*4 + 0x19f4]
lea esi, [eax + ecx - 3]
mov eax, dword [esp + ebx*4 + 0x1a00]
lea ebx, [edx + eax - 3]
lea eax, [edx + eax + 3]
mov dword [esp + 0x19fc], eax
push 0
push ebx
push esi
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [esi - 3]
mov dword [esp + 0x13e8], eax
push ebx
push eax
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push ebx
push esi
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
add ebx, 0xfffffffd
push ebx
push esi
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1a00]
push esi
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
push dword [esp + 0x19fc]
push dword [esp + 0x13ec]
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1a00]
push esi
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x19fc]
add eax, 3
push eax
push esi
push edi
call dword [sym.imp.GDI32.dll_LineTo]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x69c0], xmm0
movaps xmmword [esp + 0x69d0], xmm0
movaps xmmword [esp + 0x69e0], xmm0
movq qword [esp + 0x69f0], xmm0
movd dword [esp + 0x69f8], xmm0
mov edx, dword [0x44a924]
lea eax, [esi + 1]
mov dword [esp + 0x69c0], 0x3c
mov dword [esp + 0x69c4], eax
mov dword [esp + 0x69cc], 0x44a8e8
mov dword [esp + 0x69d8], edx
mov dword [esp + 0x69d4], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x69c0]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x69cc]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x69d8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ebx, dword [0x44a654]
mov edi, dword [0x44a658]
mov dword [esp + 0x3a5c], edi
mov dword [esp + 0x19f4], ebx
lea eax, [ebx + 1]
mov esi, eax
shr esi, 0x1f
lea edx, [esi + ebx + 1]
mov esi, dword [0x44a650]
sar edx, 1
imul esi, eax
imul eax, dword [0x44a65c]
mov dword [esp + 0x1bf4], edx
lea ecx, [edx - 1]
mov dword [esp + 0x1bf8], ecx
mov dword [esp + 0x1c00], edx
mov dword [esp + 0x1c04], ecx
mov edx, dword [esp + edi*4 + 0x1bf4]
mov edi, dword [esp + edi*4 + 0x1c00]
lea esi, [esi + edx - 3]
lea ecx, [eax + edi - 3]
mov dword [esp + 0x1bfc], ecx
push 0
push ecx
push esi
push ebx
lea edi, [eax + edi + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [esi - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x1bfc]
push eax
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x1bfc]
add eax, 0xfffffffd
push eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x13ec]
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
cvtsi2sd xmm0, dword [0x44a65c]
call fcn.00424100
mov eax, dword [esp + 0x3b41]
lea edx, [esp + 0x19f4]
cvtsi2sd xmm5, eax
shr eax, 0x1f
pxor xmm6, xmm6
movzx ecx, dx
movsd xmm2, qword [0x439798]
movaps xmm4, xmm2
cvtsi2sd xmm1, ecx
addsd xmm5, qword [eax*8 + 0x4396e0]
addsd xmm5, xmm1
addsd xmm5, xmm0
movaps xmm3, xmm5
cmplesd xmm4, xmm5
cmpnltsd xmm3, xmm2
andps xmm4, xmm2
movd ebx, xmm3
subsd xmm5, xmm4
cvttsd2si esi, xmm5
and ebx, 0x80000000
add esi, ebx
mov dword [esp + 0x1bf8], esi
movaps xmmword [esp + 0x1c00], xmm6
movaps xmmword [esp + 0x1c10], xmm6
movq qword [esp + 0x1c20], xmm6
mov dword [esp + 0x1c00], 8
mov dword [esp + 0x1c24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1c1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1c18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1c20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
cmp dword [0x44a654], 0
jne 0x406457
xor eax, eax
xor esi, esi
jmp 0x406485
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1c4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x74a8]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x3a5c]
movzx ecx, dx
mov dword [esp + 0x1bf4], ecx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov edx, dword [0x44a658]
test edx, edx
mov eax, dword [0x44a660]
mov edi, dword [0x44a65c]
cvtsi2ss xmm0, edi
mov dword [esp + 0x1bfc], edx
mov esi, dword [0x44a654]
mov dword [esp + 0x1c00], eax
je 0x40658c
mov dword [0x44a650], 0
xor ebx, ebx
jmp 0x406592
mov ebx, dword [0x44a650]
xor edx, edx
lea ecx, [esi + 0x51]
xor eax, eax
idiv ecx
lea edx, [esp + 0x19f4]
movzx edx, dl
cmp eax, edx
jg 0x40664a
movss dword [esp], xmm0
movss dword [esp + 0x13e8], xmm0
call fcn.0040fca0
mov ecx, dword [esp + 0x1bfc]
mov eax, dword [esp + 0x1c00]
cdq
fstp dword [esp + 0x23f8]
lea ecx, [ecx + 0x49]
idiv ecx
add eax, esi
cvtsi2ss xmm2, eax
movss xmm1, dword [esp + 0x23f8]
mov eax, 0xba2e8ba3
movsd xmm3, qword [0x439798]
addss xmm2, xmm1
cvtss2sd xmm2, xmm2
movaps xmm5, xmm3
movaps xmm4, xmm2
add ebx, dword [esp + 0x1bf4]
cmplesd xmm5, xmm2
cmpnltsd xmm4, xmm3
andps xmm5, xmm3
movd edx, xmm4
subsd xmm2, xmm5
cvttsd2si ecx, xmm2
and edx, 0x80000000
add ecx, edx
mul ecx
add ebx, dword [esp + 0x1bf8]
shr edx, 3
sub ebx, edx
movss xmm0, dword [esp + 0x13e8]
mov dword [0x44a650], ebx
mov eax, 0x2e8ba2e9
imul edi
sar edx, 3
sar edi, 0x1f
movzx ebx, bx
sub edx, edi
sub edx, ebx
jge 0x406666
xor eax, eax
xor esi, esi
jmp 0x40669a
push 0
movss dword [esp + 0x13ec], xmm0
call fcn.0040fca0
fstp dword [esp + 0x23fc]
movss xmm0, dword [esp + 0x13ec]
movss xmm1, dword [esp + 0x23fc]
add esp, 4
subss xmm0, xmm1
cvttss2si esi, xmm0
pxor xmm0, xmm0
movaps xmmword [esp + 0x6a00], xmm0
movaps xmmword [esp + 0x6a10], xmm0
movaps xmmword [esp + 0x6a20], xmm0
movq qword [esp + 0x6a30], xmm0
movd dword [esp + 0x6a38], xmm0
mov ebx, dword [esp + 0x1c00]
mov ecx, dword [0x44a964]
mov dword [esp + 0x6a00], 0x3c
mov dword [esp + 0x6a0c], 0x44a928
lea edx, [ebx + 1]
mov dword [esp + 0x6a04], edx
mov dword [esp + 0x6a18], ecx
mov dword [esp + 0x6a14], 0x101
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea edx, [esp + 0x6a00]
push edx
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x6a0c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push dword [esp + 0x1c0c]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6a18]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [0x44a658]
test edx, edx
je 0x40676a
mov dword [0x44a650], esi
pxor xmm0, xmm0
mov dword [esp + 0x3b5c], edx
movaps xmmword [esp + 0x1c00], xmm0
movaps xmmword [esp + 0x1c10], xmm0
movq qword [esp + 0x1c20], xmm0
mov dword [esp + 0x1c00], 8
mov dword [esp + 0x1c24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1c1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1c18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1c20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
cmp dword [0x44a654], 0
jne 0x406819
xor eax, eax
xor esi, esi
jmp 0x406847
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1c4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x74b8]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x3b5c]
movzx ecx, dx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [0x44a654]
mov ecx, dword [0x44a650]
lea eax, [esi + 1]
mov ebx, eax
shr ebx, 0x1f
imul ecx, eax
imul eax, dword [0x44a65c]
lea edi, [ebx + esi + 1]
sar edi, 1
mov dword [esp + 0x1bf4], edi
mov dword [esp + 0x1c00], edi
lea edx, [edi - 1]
mov edi, dword [0x44a658]
mov dword [esp + 0x1c04], edx
mov dword [esp + 0x1bf8], edx
mov edx, dword [esp + edi*4 + 0x1c00]
mov ebx, dword [esp + edi*4 + 0x1bf4]
lea edi, [eax + edx - 3]
lea eax, [eax + edx + 3]
mov dword [esp + 0x1bfc], eax
push 0
push edi
lea ebx, [ecx + ebx - 3]
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [ebx - 3]
mov dword [esp + 0x13e8], eax
push edi
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 0xfffffffd
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push dword [esp + 0x1bfc]
push dword [esp + 0x13ec]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x1bfc]
add eax, 3
push eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6a40], xmm0
movaps xmmword [esp + 0x6a50], xmm0
movaps xmmword [esp + 0x6a60], xmm0
movq qword [esp + 0x6a70], xmm0
movd dword [esp + 0x6a78], xmm0
mov edx, dword [0x44a9a4]
lea eax, [esi + 1]
mov dword [esp + 0x6a40], 0x3c
mov dword [esp + 0x6a44], eax
mov dword [esp + 0x6a4c], 0x44a968
mov dword [esp + 0x6a58], edx
mov dword [esp + 0x6a54], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6a40]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x6a4c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6a58]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, 0x2e8ba2e9
mov ebx, dword [0x44a65c]
mov ecx, ebx
imul ebx
sar edx, 3
sar ecx, 0x1f
mov edi, dword [0x44a650]
sub edx, ecx
movzx esi, di
sub edx, esi
jge 0x406ad6
xor eax, eax
jmp 0x406afc
push 0
call fcn.0040fca0
cvtsi2ss xmm1, ebx
fstp dword [esp + 0x23fc]
movss xmm0, dword [esp + 0x23fc]
add esp, 4
subss xmm1, xmm0
cvttss2si eax, xmm1
mov edx, dword [0x44a658]
test edx, edx
je 0x406b0d
mov dword [0x44a650], eax
mov edi, eax
cmp edi, 1
mov dword [esp + 0x3c5c], edx
mov esi, dword [0x44a660]
je 0x40f7b1
cmp edi, 0x111
je 0x406b90
cmp edi, 0x203
je 0x406b90
cmp edi, 0xf
je 0x406b90
cmp edi, 0x100
je 0x406b90
cmp edi, 5
jne 0x406b90
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x64f0]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x64fc]
mov ecx, 0xa
mov edx, dword [esp + 0x64f8]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
pxor xmm0, xmm0
movaps xmmword [esp + 0x1c00], xmm0
movaps xmmword [esp + 0x1c10], xmm0
movq qword [esp + 0x1c20], xmm0
mov dword [esp + 0x1c00], 8
mov dword [esp + 0x1c24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1c1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1c18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1c20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
cmp dword [0x44a654], 0
jne 0x406c38
xor eax, eax
xor esi, esi
jmp 0x406c66
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1c4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x74c8]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x3c5c]
movzx ecx, dx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6a80], xmm0
movaps xmmword [esp + 0x6a90], xmm0
movaps xmmword [esp + 0x6aa0], xmm0
movq qword [esp + 0x6ab0], xmm0
movd dword [esp + 0x6ab8], xmm0
mov edx, dword [0x44a9e4]
lea eax, [esi + 1]
mov dword [esp + 0x6a80], 0x3c
mov dword [esp + 0x6a84], eax
mov dword [esp + 0x6a8c], 0x44a9a8
mov dword [esp + 0x6a98], edx
mov dword [esp + 0x6a94], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6a80]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x6a8c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6a98]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [0x44a658]
test edx, edx
je 0x406df8
mov dword [0x44a650], 0
pxor xmm0, xmm0
mov dword [esp + 0x3d5c], edx
movaps xmmword [esp + 0x1c00], xmm0
movaps xmmword [esp + 0x1c10], xmm0
movq qword [esp + 0x1c20], xmm0
mov dword [esp + 0x1c00], 8
mov dword [esp + 0x1c24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1c1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1c18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1c20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
cmp dword [0x44a654], 0
jne 0x406ea7
xor eax, eax
xor esi, esi
jmp 0x406ed5
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1c4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x74d8]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x3d5c]
movzx ecx, dx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6ac0], xmm0
movaps xmmword [esp + 0x6ad0], xmm0
movaps xmmword [esp + 0x6ae0], xmm0
movq qword [esp + 0x6af0], xmm0
movd dword [esp + 0x6af8], xmm0
mov edx, dword [0x44aa24]
lea eax, [esi + 1]
mov dword [esp + 0x6ac0], 0x3c
mov dword [esp + 0x6ac4], eax
mov dword [esp + 0x6acc], 0x44a9e8
mov dword [esp + 0x6ad8], edx
mov dword [esp + 0x6ad4], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6ac0]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x6acc]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6ad8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x44a650]
cmp eax, 1
mov esi, dword [0x44a660]
je 0x40f769
cmp eax, 0x111
je 0x4070d6
cmp eax, 0x203
je 0x4070d6
cmp eax, 0xf
je 0x4070d6
cmp eax, 0x100
je 0x4070d6
cmp eax, 5
jne 0x4070d6
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x6500]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x650c]
mov ecx, 0xa
mov edx, dword [esp + 0x6508]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x44a650]
mov edi, dword [0x44a654]
lea edx, [edi + 1]
mov ebx, edx
shr ebx, 0x1f
imul eax, edx
imul edx, dword [0x44a65c]
lea esi, [ebx + edi + 1]
sar esi, 1
mov dword [esp + 0x1bf4], esi
mov dword [esp + 0x1c00], esi
lea ecx, [esi - 1]
mov esi, dword [0x44a658]
mov dword [esp + 0x1bf8], ecx
mov dword [esp + 0x1c04], ecx
mov ebx, dword [esp + esi*4 + 0x1bf4]
lea ebx, [eax + ebx - 3]
mov eax, dword [esp + esi*4 + 0x1c00]
lea esi, [edx + eax - 3]
lea eax, [edx + eax + 3]
mov dword [esp + 0x1bfc], eax
push 0
push esi
push ebx
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [ebx - 3]
mov dword [esp + 0x13e8], eax
push esi
push eax
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push esi
push ebx
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
add esi, 0xfffffffd
push esi
push ebx
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push ebx
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
push dword [esp + 0x1bfc]
push dword [esp + 0x13ec]
push edi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push ebx
push edi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x1bfc]
add eax, 3
push eax
push ebx
push edi
call dword [sym.imp.GDI32.dll_LineTo]
mov esi, dword [0x44a654]
mov edx, dword [0x44a658]
test edx, edx
je 0x4071d7
mov dword [0x44a650], 0
xor eax, eax
jmp 0x4071dc
mov eax, dword [0x44a650]
lea edi, [esi + 1]
mov ebx, edi
shr ebx, 0x1f
imul eax, edi
imul edi, dword [0x44a65c]
lea ecx, [ebx + esi + 1]
sar ecx, 1
mov dword [esp + 0x1bf4], ecx
mov dword [esp + 0x1c00], ecx
lea ebx, [ecx - 1]
mov dword [esp + 0x1bf8], ebx
mov dword [esp + 0x1c04], ebx
mov ecx, dword [esp + edx*4 + 0x1bf4]
lea ebx, [eax + ecx - 3]
mov eax, dword [esp + edx*4 + 0x1c00]
lea edx, [edi + eax - 3]
mov dword [esp + 0x1bfc], edx
push 0
push edx
push ebx
push esi
lea edi, [edi + eax + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [ebx - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x1bfc]
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x1bfc]
add eax, 0xfffffffd
push eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x13ec]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6b00], xmm0
movaps xmmword [esp + 0x6b10], xmm0
movaps xmmword [esp + 0x6b20], xmm0
movq qword [esp + 0x6b30], xmm0
movd dword [esp + 0x6b38], xmm0
mov edx, dword [0x44aa64]
lea eax, [esi + 1]
mov dword [esp + 0x6b00], 0x3c
mov dword [esp + 0x6b04], eax
mov dword [esp + 0x6b0c], 0x44aa28
mov dword [esp + 0x6b18], edx
mov dword [esp + 0x6b14], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6b00]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x6b0c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6b18]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov eax, dword [0x44a654]
mov edx, dword [0x44a658]
pxor xmm0, xmm0
mov dword [esp + 0x1bf4], eax
mov dword [esp + 0x3e5c], edx
movaps xmmword [esp + 0x1e00], xmm0
movaps xmmword [esp + 0x1e10], xmm0
movq qword [esp + 0x1e20], xmm0
mov dword [esp + 0x1e00], 8
mov dword [esp + 0x1e24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1e1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1e18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1e14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1e20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1e14], eax
cmp dword [0x44a654], 0
jne 0x407427
xor eax, eax
xor esi, esi
jmp 0x407455
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1e4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x74e8]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x3e5c]
movzx ecx, dx
mov dword [esp + 0x13e8], ecx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov eax, dword [0x44a650]
cmp eax, 1
mov esi, dword [0x44a660]
je 0x40f721
cmp eax, 0x111
je 0x4075a5
cmp eax, 0x203
je 0x4075a5
cmp eax, 0xf
je 0x4075a5
cmp eax, 0x100
je 0x4075a5
cmp eax, 5
jne 0x4075a5
push 0x7b
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [esp + 0x6510]
push eax
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esp + 0x651c]
mov ecx, 0xa
mov edx, dword [esp + 0x6518]
add eax, 0xffffffec
push 1
push eax
add edx, 0xffffffec
push edx
push ecx
push ecx
push ebx
call dword [sym.imp.USER32.dll_MoveWindow]
push 1
push 0
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6b40], xmm0
movaps xmmword [esp + 0x6b50], xmm0
movaps xmmword [esp + 0x6b60], xmm0
movq qword [esp + 0x6b70], xmm0
movd dword [esp + 0x6b78], xmm0
mov edx, dword [0x44aaa4]
lea eax, [esi + 1]
mov dword [esp + 0x6b40], 0x3c
mov dword [esp + 0x6b44], eax
mov dword [esp + 0x6b4c], 0x44aa68
mov dword [esp + 0x6b58], edx
mov dword [esp + 0x6b54], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6b40]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x6b4c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6b58]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [0x44a654]
xor edx, edx
xor eax, eax
lea esi, [esp + 0x1bf4]
and esi, 0xff
lea ebx, [ecx + 0x51]
idiv ebx
cmp eax, esi
jg 0x407685
mov eax, dword [esp + 0x13e8]
add dword [0x44a650], eax
mov eax, dword [0x44a658]
test eax, eax
je 0x407698
mov dword [0x44a650], 0
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6b80], xmm0
movaps xmmword [esp + 0x6b90], xmm0
movaps xmmword [esp + 0x6ba0], xmm0
movq qword [esp + 0x6bb0], xmm0
movd dword [esp + 0x6bb8], xmm0
mov edx, dword [0x44aae4]
lea eax, [esi + 1]
mov dword [esp + 0x6b80], 0x3c
mov dword [esp + 0x6b84], eax
mov dword [esp + 0x6b8c], 0x44aaa8
mov dword [esp + 0x6b98], edx
mov dword [esp + 0x6b94], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6b80]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x6b8c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6b98]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ebx, dword [0x44a654]
mov edi, dword [0x44a658]
lea eax, [ebx + 1]
mov esi, eax
shr esi, 0x1f
lea edx, [esi + ebx + 1]
mov esi, dword [0x44a650]
sar edx, 1
imul esi, eax
imul eax, dword [0x44a65c]
mov dword [esp + 0x1bf4], edx
lea ecx, [edx - 1]
mov dword [esp + 0x1bf8], ecx
mov dword [esp + 0x1c00], edx
mov dword [esp + 0x1c04], ecx
mov edx, dword [esp + edi*4 + 0x1bf4]
mov edi, dword [esp + edi*4 + 0x1c00]
lea esi, [esi + edx - 3]
lea ecx, [eax + edi - 3]
mov dword [esp + 0x1bfc], ecx
push 0
push ecx
push esi
push ebx
lea edi, [eax + edi + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [esi - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x1bfc]
push eax
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x1bfc]
add eax, 0xfffffffd
push eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x13ec]
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push esi
push ebx
call dword [sym.imp.GDI32.dll_LineTo]
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6bc0], xmm0
movaps xmmword [esp + 0x6bd0], xmm0
movaps xmmword [esp + 0x6be0], xmm0
movq qword [esp + 0x6bf0], xmm0
movd dword [esp + 0x6bf8], xmm0
mov edx, dword [0x44ab24]
lea eax, [esi + 1]
mov dword [esp + 0x6bc0], 0x3c
mov dword [esp + 0x6bc4], eax
mov dword [esp + 0x6bcc], 0x44aae8
mov dword [esp + 0x6bd8], edx
mov dword [esp + 0x6bd4], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6bc0]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x6bcc]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6bd8]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [0x44a658]
test edx, edx
mov dword [esp + 0x3f5c], edx
je 0x407908
mov dword [0x44a650], 0
mov esi, dword [0x44a660]
pxor xmm0, xmm0
movaps xmmword [esp + 0x6c00], xmm0
movaps xmmword [esp + 0x6c10], xmm0
movaps xmmword [esp + 0x6c20], xmm0
movq qword [esp + 0x6c30], xmm0
movd dword [esp + 0x6c38], xmm0
mov edx, dword [0x44ab64]
lea eax, [esi + 1]
mov dword [esp + 0x6c00], 0x3c
mov dword [esp + 0x6c04], eax
mov dword [esp + 0x6c0c], 0x44ab28
mov dword [esp + 0x6c18], edx
mov dword [esp + 0x6c14], 0x101
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [0x44a654]
lea eax, [esp + 0x6c00]
push eax
inc ebx
call dword [sym.imp.COMDLG32.dll_ChooseFontA]
push dword [esp + 0x6c0c]
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov edi, eax
push edi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 1
push edi
push 0x30
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esp + 0x6c18]
push ebx
call dword [sym.imp.GDI32.dll_SetTextColor]
pxor xmm0, xmm0
movaps xmmword [esp + 0x1c00], xmm0
movaps xmmword [esp + 0x1c10], xmm0
movq qword [esp + 0x1c20], xmm0
mov dword [esp + 0x1c00], 8
mov dword [esp + 0x1c24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1c1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1c18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1c20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
cmp dword [0x44a654], 0
jne 0x407a69
xor eax, eax
xor esi, esi
jmp 0x407a97
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1c4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x74f8]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea edx, [esp + 0x3f5c]
movzx ecx, dx
push ecx
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov eax, dword [0x44a650]
cmp eax, 1
mov esi, dword [0x44a660]
je 0x40f6d9
cmp eax, 0x111
je 0x407bdf
cmp eax, 0x203
je 0x407bdf
cmp eax, 0xf
je 0x407bdf
cmp eax, 0x100
je 0x407bdf
cmp eax, 5
jne 0x407bdf
mov eax, dword [0x44a650]
mov esi, dword [0x44a654]
lea edi, [esi + 1]
mov ebx, edi
shr ebx, 0x1f
imul eax, edi
imul edi, dword [0x44a65c]
lea edx, [ebx + esi + 1]
sar edx, 1
mov dword [esp + 0x1bf4], edx
mov dword [esp + 0x1c00], edx
lea ecx, [edx - 1]
mov edx, dword [0x44a658]
mov dword [esp + 0x1bf8], ecx
mov dword [esp + 0x1c04], ecx
mov ebx, dword [esp + edx*4 + 0x1bf4]
lea ebx, [eax + ebx - 3]
mov eax, dword [esp + edx*4 + 0x1c00]
lea edx, [edi + eax - 3]
mov dword [esp + 0x1bfc], edx
push 0
push edx
push ebx
push esi
lea edi, [edi + eax + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [ebx - 3]
mov dword [esp + 0x13e8], eax
push dword [esp + 0x1bfc]
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x1bfc]
add eax, 0xfffffffd
push eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x13ec]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
mov esi, dword [0x44a654]
lea ebx, [esp + 0x405c]
xor edx, edx
movzx edi, bx
xor eax, eax
mov ecx, dword [0x44a658]
lea ebx, [esi + 0x51]
idiv ebx
mov dword [esp + 0x1bf4], esi
lea edx, [esp + 0x1bf4]
movzx edx, dl
mov dword [esp + 0x405c], ecx
cmp eax, edx
mov dword [esp + 0x13e8], edi
jg 0x407d11
mov eax, dword [0x44a650]
add eax, dword [esp + 0x13e8]
mov dword [0x44a650], eax
jmp 0x407d16
mov eax, dword [0x44a650]
lea edi, [esi + 1]
mov ebx, edi
shr ebx, 0x1f
imul eax, edi
imul edi, dword [0x44a65c]
lea edx, [ebx + esi + 1]
sar edx, 1
mov dword [esp + 0x1bf4], edx
mov dword [esp + 0x1c00], edx
lea ebx, [edx - 1]
mov dword [esp + 0x1bf8], ebx
mov dword [esp + 0x1c04], ebx
mov edx, dword [esp + ecx*4 + 0x1bf4]
lea ebx, [eax + edx - 3]
mov eax, dword [esp + ecx*4 + 0x1c00]
lea ecx, [edi + eax - 3]
mov dword [esp + 0x1bfc], ecx
push 0
push ecx
push ebx
push esi
lea edi, [edi + eax + 3]
call dword [sym.imp.GDI32.dll_MoveToEx]
lea eax, [ebx - 3]
mov dword [esp + 0x1bf4], eax
push dword [esp + 0x1bfc]
push eax
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push dword [esp + 0x1c00]
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x1bfc]
add eax, 0xfffffffd
push eax
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
push edi
push dword [esp + 0x1bf8]
push esi
call dword [sym.imp.GDI32.dll_LineTo]
push 0
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_MoveToEx]
add edi, 3
push edi
push ebx
push esi
call dword [sym.imp.GDI32.dll_LineTo]
pxor xmm0, xmm0
movaps xmmword [esp + 0x1c00], xmm0
movaps xmmword [esp + 0x1c10], xmm0
movq qword [esp + 0x1c20], xmm0
mov dword [esp + 0x1c00], 8
mov dword [esp + 0x1c24], 0x43ab84
push 0x14c8c8
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov dword [esp + 0x1c1c], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [esp + 0x1c18], eax
push 0x7f02
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
movzx eax, word [0x44a650]
mov dword [esp + 0x1c20], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movzx edx, word [0x44a650]
push edx
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c14], eax
cmp dword [0x44a654], 0
jne 0x407e8f
xor eax, eax
xor esi, esi
jmp 0x407ebd
xor eax, eax
push eax
push eax
push eax
push eax
push 0x1f4
push 0x2ee
push 0x1e
push 0xa
push 0x12cf0000
push str.Main
push dword [esp + 0x1c4c]
push eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
lea edx, [esp + 0x7508]
push edx
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
xor ecx, ecx
mov edi, 0x12c
push ecx
push ecx
push 0x7b
push esi
push edi
push edi
mov edx, 0xa
push edx
push edx
push 0x5080000e
push ecx
push str.static
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
xor edx, edx
push edx
push edx
push 0x7c
push esi
mov esi, 0x140
push esi
push esi
push 0xa
push 0x15e
push 0x50000080
push edx
push str.Button
push edx
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x43abb0
push 0
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
push 0
push 0x172
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [esp + 0x13e8]
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push 0x43abb4
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
push 0x10
mov esi, 0x12c
xor eax, eax
push esi
push esi
push eax
push str.MARBLES
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov ebx, dword [0x44a654]
xor edx, edx
mov dword [esp + 0x1bf4], ebx
add ebx, 0x51
xor eax, eax
lea esi, [esp + 0x1bf4]
idiv ebx
mov edi, dword [0x44a658]
lea ecx, [esp + 0x415c]
and esi, 0xff
mov dword [esp + 0x415c], edi
movzx edi, cx
cmp eax, esi
jg 0x407fca
mov eax, dword [0x44a650]
add eax, edi
mov dword [0x44a650], eax
jmp 0x407fcf
mov eax, dword [0x44a650]
mov esi, dword [0x44a660]
cmp eax, 1
je 0x40f691
push dword [esp + 0x1310]
call dword [sym.imp.KERNEL32.dll_CancelWaitableTimer]
jmp 0x4029b6
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x407bda
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40759f
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4070d1
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x406b90
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x405eea
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x405b21
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push dword [esp + 0x1c04]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push dword [esp + 0x1c04]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4057be
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4053f6
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4052b2
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x404de2
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x404a95
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x4049f9
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push ebx
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40488f
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x403f90
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x403e3c
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x403a47
xor eax, eax
push eax
push eax
push 0x172
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x43abc0
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
push eax
push 0
push 0x80
push esi
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x402e42
pxor xmm0, xmm0
movaps xmmword [esp + 0x2600], xmm0
movaps xmmword [esp + 0x2610], xmm0
movaps xmmword [esp + 0x2620], xmm0
movaps xmmword [esp + 0x2630], xmm0
movaps xmmword [esp + 0x2640], xmm0
movq qword [esp + 0x2650], xmm0
xor edx, edx
lea esi, [esp + 0x11e4]
mov dword [esp + 0x2600], 0x58
lea ecx, [esp + 0x2600]
mov dword [esp + 0x2604], edx
lea eax, [esp + 0x1080]
mov dword [esp + 0x261c], esi
mov byte [esi], dl
mov dword [esp + 0x2620], 0x104
mov dword [esp + 0x260c], eax
mov dword [esp + 0x2618], 1
mov dword [esp + 0x2624], edx
mov dword [esp + 0x2628], edx
mov dword [esp + 0x262c], edx
mov dword [esp + 0x2634], 0x1800
push ecx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
jmp 0x401c9e
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
xor eax, eax
push eax
push eax
call sub.Secur32.dll_QuerySecurityPackageInfoA
mov dword [0x44a664], eax
mov eax, dword [0x44a650]
mov edx, dword [esp + 0x17fc]
lea ecx, [eax + edx + 0x1fb]
mov dword [0x44a650], ecx
jmp 0x4012a7