Function at 0x4357b7
Capabilities:
Create pipe
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2f0
movdqa xmm0, xmmword [0xaa9580]
xor eax, eax
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, ecx
mov byte [ebp - 0x4d], dl
lea ecx, [ebp - 0x25c]
mov dword [ebp - 0x40], edi
push ecx
lea ecx, [ebp - 0x26c]
mov dword [ebp - 0x110], eax
push ecx
push eax
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x10c], eax
movdqu xmmword [ebp - 0x26c], xmm0
mov dword [ebp - 0x108], eax
call fcn.00435587
mov dword [ebp - 0x1c], 0x29000d4e
push 3
mov dword [ebp - 0x28], 0xe550
mov dword [ebp - 0x1c], 0
pop ebx
jmp 0x435838
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x110]
cmp dword [eax + ecx*4], 0
jne 0x43583d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x435826
lea ecx, [ebp - 0x110]
call fcn.00435516
push 2
lea ecx, [ebp - 0x1ac]
call fcn.00435444
mov dword [ebp - 0x24], 0xffffffff
xor esi, esi
mov dword [ebp - 0x1c], 0xa9c4c8d3
inc esi
mov dword [ebp - 0x20], 0x4bf8f0aa
xor eax, eax
mov dword [ebp - 0x2c], 0xbf2121f9
mov dword [ebp - 0x4c], esi
push 2
mov dword [ebp - 0x38], 0x15d7249a
pop ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ecx
jge 0x4358a3
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x43588e
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx], eax
lea ecx, [ebp - 0x1ac]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], 0x6d7d0454
call fcn.00435516
push 4
lea ecx, [ebp - 0x68]
call fcn.00435444
mov dword [ebp - 0xc], 0xfffffff7
xor eax, eax
mov dword [ebp - 0x20], 0xc6dd3ed2
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x10], eax
jmp 0x435911
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x68]
mov dword [ecx + edx*4], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x435901
mov dword [ebp - 0x10], eax
jmp 0x435929
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x204], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x43591c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jg 0x435a5c
mov dword [ebp - 0x4c], eax
xor ebx, ebx
mov dword [ebp - 0x4c], 0x14b11f38
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + edx*4]
mov dword [ebp - 0x4c], ecx
mov edx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x68]
cmp dword [ecx + edx*4], 0xae97
sete bl
xor ecx, ecx
cmp ebx, 0x9041
setge cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x4c]
cmp ecx, 0xf4f
mov ecx, dword [ebp - 0x68]
setl dl
xor ebx, ebx
cmp edx, dword [ebp - 0x20]
setl bl
xor edx, edx
cmp ebx, dword [ecx + esi*4]
setge dl
mov dword [ebp - 0x4c], edx
mov ecx, dword [ebp - 0x1f8]
cmp ecx, dword [ebp - 0x4c]
je 0x4359a9
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x38], ebx
mov ebx, dword [ebp - 0x68]
mov ecx, dword [ebx + ecx*4]
imul ecx, dword [ebx + edx*4]
xor ebx, ebx
mov edx, dword [ebp - 0x68]
cmp ecx, dword [edx + esi*4]
mov esi, edx
mov ecx, dword [ebp - 0x20]
setne bl
xor edx, edx
sub ebx, dword [esi + edi*4]
cmp ebx, dword [esi + ecx*4]
mov edi, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, dword [esi + edi*4]
setg cl
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], eax
je 0x435a06
mov ecx, dword [ebp - 0x68]
cmp dword [ecx + 4], eax
je 0x435a06
xor edi, edi
inc edi
jmp 0x435a08
mov edi, eax
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x68]
mov esi, dword [ecx + edx*4]
xor edx, edx
mov ecx, dword [ebp - 0x1f8]
imul esi, edi
cmp esi, ecx
setl dl
imul ecx, edx, 0x3b8c
test ecx, ecx
jne 0x435a33
cmp dword [ebp - 0x1f8], eax
je 0x435a42
cmp dword [ebp - 0x1f8], eax
je 0x435a42
xor esi, esi
inc esi
mov ecx, esi
jmp 0x435a47
xor esi, esi
mov ecx, eax
inc esi
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0xc]
push 3
pop ebx
cmp dword [ebp - 0xc], ebx
jle 0x43593b
mov edi, dword [ebp - 0x40]
lea ecx, [ebp - 0x68]
call fcn.00435516
mov eax, dword [0x4b75ec]
mov dword [ebp - 0x2c], 0x95751cfd
mov dword [ebp - 0x18], 0xb969b42c
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x4c], eax
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], eax
jmp 0x435a9b
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x44], 9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x435a8d
push 2
mov dword [ebp - 0xc], eax
pop edx
jmp 0x435ab9
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xb8], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x435aa8
mov dword [ebp - 0xc], eax
jmp 0x435ad4
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x228], 0xfa7ad11e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x435ac3
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
cmp edx, ecx
mov ecx, dword [ebp - 0x44]
setg bl
xor edx, edx
cmp ebx, 0x5734cb44
setl dl
xor ebx, ebx
add ecx, edx
mov edx, dword [ebp - 0x44]
imul edx, ecx
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x18]
cmp ecx, edx
setl bl
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
mov ecx, dword [ebp - 0x44]
mov edx, dword [ebp - 0x2c]
sub edx, ecx
mov ecx, dword [ebp - 0x44]
cmp edx, ecx
setle bl
xor edx, edx
mov dword [ebp - 0xb8], ebx
mov ecx, dword [ebp - 0x44]
sub ebx, ecx
mov ecx, dword [ebp - 0x44]
cmp ebx, ecx
setg dl
cmp edx, 0xffffffff
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x44]
je 0x435b4b
mov edx, esi
cmp dword [ebp - 8], eax
jne 0x435b4d
mov edx, eax
xor ecx, ecx
cmp edx, 0xfffffff8
setne cl
imul ecx, dword [ebp - 0x44]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0xb8]
mov edx, dword [ebp - 0x2c]
sub edx, ecx
mov dword [ebp - 0x2c], edx
jne 0x435b79
mov edx, eax
cmp dword [ebp - 0x44], eax
je 0x435b7b
mov edx, esi
dec edx
xor ebx, ebx
mov dword [ebp - 0x228], edx
mov ecx, dword [ebp - 0x44]
cmp ecx, edx
setg bl
xor edx, edx
add ebx, 0x47c21c83
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x2c]
cmp ecx, 0xe26
mov ecx, dword [ebp - 0x44]
setg dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x44]
setne bl
xor edx, edx
cmp ebx, ecx
setne dl
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x18], eax
jmp 0x435bea
mov ecx, dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], 0xde1f1717
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x435be7
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
jg 0x435bbf
mov esi, dword [ebp + 8]
push 2
pop edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x2c], 0x9fa85f8
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x20], 0xfaa23240
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [esi + 0xc], eax
mov dword [ebp - 8], eax
jmp 0x435c2c
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x70], 0xb26b
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x435c1e
mov dword [ebp - 0x34], eax
jmp 0x435c41
mov dword [ebp + ecx*4 - 0x70], 0xffff
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x34]
jl 0x435c36
cmp dword [ebp - 0x70], eax
je 0x435c51
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x6c]
xor ebx, ebx
mov ecx, dword [ebp - 0x70]
inc ebx
cmp byte [ebp - 0x4d], 0
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x34], 0xfff6
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x20], ebx
je 0x435e98
cmp dword [ebp - 0x4c], ebx
jne 0x435e98
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0x7f20bab1
mov dword [ebp - 0x28], 0x9783
mov dword [ebp - 0x28], 0xffffffff
mov dword [esi + 8], 4
mov dword [ebp - 8], eax
jmp 0x435cc2
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x2d4], 0xbf7935db
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x435cb1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1c
jne 0x435e69
mov dword [ebp - 0xc], 0x9bf3
mov dword [ebp - 0x24], 0xdc1094d0
mov dword [ebp - 0x18], 0x3e32
mov dword [ebp - 8], eax
jmp 0x435cfc
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xc4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x435cef
cmp dword [ebp - 0xc], eax
je 0x435d0a
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
sub esi, 0x703c
neg esi
sbb esi, esi
add esi, 0xfffffff8
sub esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setne dl
xor ecx, ecx
cmp edx, 0x11fc80ae
mov edx, dword [ebp - 0x10]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0x10]
jl 0x435d52
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x435e2f
mov dword [ebp - 0x28], 0x2ac30bca
mov dword [ebp - 0x28], 0xbab72157
mov dword [ebp - 0x28], 0x94fb389f
mov dword [ebp - 0x20], ebx
push 2
mov dword [ebp - 0x28], eax
pop edx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], eax
jl 0x435da6
mov dword [ebp - 0x2c], 0x8a0f8393
dec dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp + ecx*4 - 0x2d4]
dec dword [ebp - 0x18]
jns 0x435d8d
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edx
jg 0x435e59
mov dword [ebp - 0x2c], 0x5c00d4b
xor ebx, ebx
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
mov edx, dword [ebp - 0x24]
setle bl
sub edx, ebx
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0xc4]
neg edx
sbb edx, edx
inc edx
sub edx, ecx
cmp dword [ebp - 0xc0], edx
jle 0x435df7
cmp dword [ebp - 0x2c], eax
jne 0x435df7
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x435dfc
xor ebx, ebx
inc ebx
mov edx, ebx
xor ecx, ecx
cmp edx, 0x70c0f3ad
setle cl
sub ecx, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xfa0b
mov ecx, dword [ebp - 0xc]
setge dl
mov dword [ebp + ecx*4 - 0xc4], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x435db2
jmp 0x435e59
mov ecx, 0xf32651ef
mov dword [ebp - 0xc4], ecx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x435e59
push eax
push 0x1f37
push 0x523
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor eax, eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1c
je 0x435cd5
mov esi, dword [ebp + 8]
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x435e8e
push 0x19bc
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
push 2
mov dword [esi + 0xc], 0x4b75ec
pop edx
cmp edi, dword [ebp - 0x4c]
jge 0x43767b
mov dword [ebp - 0x1c], 0xca4f833f
mov dword [ebp - 0x20], 0x123d4a1c
mov dword [ebp - 8], eax
jmp 0x435ebe
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x7c], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x435eb4
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x435f45
jmp 0x435ed0
xor eax, eax
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa9580]
lea ecx, [ebp - 0x27c]
push ecx
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0xf8], eax
push ecx
push eax
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0xf4], eax
movdqu xmmword [ebp - 0x28c], xmm0
mov dword [ebp - 0xf0], eax
call fcn.00435587
mov esi, dword [ebp - 0xf8]
mov dword [esi + 8], 2
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x435f30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
dec dword [esi + 8]
jns 0x435f1c
lea ecx, [ebp - 0xf8]
call fcn.00435516
dec dword [ebp - 0x1c]
jns 0x435ece
mov eax, dword [ebp - 0x78]
xor ebx, ebx
mov eax, dword [ebp - 0x74]
mov edi, 0x4b75f0
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x1c], 0xa4d9c2e8
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x78]
cmp ecx, eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x74]
setl bl
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, ebx
setl al
xor edx, edx
imul ecx, eax, 0x31a
mov eax, dword [ebp - 0x7c]
cmp ecx, eax
mov eax, dword [ebp - 0x7c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor esi, esi
mov dword [ebp - 0x20], ecx
inc esi
push esi
lea ecx, [ebp - 0x120]
call fcn.00435444
xor eax, eax
mov dword [ebp - 0x34], 0x81c2900
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], eax
jmp 0x435fcb
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x120]
mov dword [ecx + edx*4], 0x1713b910
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x435fb8
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], eax
jl 0x4360a5
mov dword [ebp - 0x28], 0xbe54
lea ecx, [ebp - 0x194]
mov dword [ebp - 0x28], 0x30fc353
push 3
call fcn.00435444
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x436011
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x194]
mov dword [ecx + edx*4], 0x6a218f0e
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x435ffe
mov ecx, dword [ebp - 0x34]
xor ebx, ebx
mov ecx, dword [ebp - 0x120]
cmp dword [ecx], eax
mov ecx, dword [ebp - 0x34]
setne bl
xor edx, edx
cmp ebx, ecx
sete dl
mov dword [ebp - 0x2c], edx
xor edx, edx
mov edi, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x34]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x2c]
cmp ecx, esi
mov ecx, esi
mov esi, dword [ebp - 0x120]
setge dl
sub ecx, edx
xor edx, edx
cmp ecx, dword [esi + edi*4]
mov ecx, dword [ebp - 0x20]
setl dl
xor ebx, ebx
cmp edx, dword [esi + ecx*4]
mov ecx, dword [ebp - 0x38]
setg bl
mov ecx, dword [esi + ecx*4]
neg ecx
neg ecx
sbb ecx, ecx
inc ecx
add ebx, ecx
je 0x4360c0
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x436089
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor esi, esi
inc esi
lea ecx, [ebp - 0x194]
call fcn.00435516
dec dword [ebp - 0x34]
jns 0x435fdc
mov edi, 0x4b75f0
lea ecx, [ebp - 0x120]
call fcn.00435516
and dword [ebp - 0x20], 0
cmp dword [ebp - 0x40], 0
jle 0x436aaa
jmp 0x4360fd
xor esi, esi
mov dword [ebp - 0x28], 0x4dbf0cf8
inc esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 8], eax
jmp 0x4360ea
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x248], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4360d9
mov eax, dword [ebp - 0x194]
dec dword [eax + 8]
jmp 0x43608c
xor esi, esi
inc esi
push 2
lea ecx, [ebp - 0x8c]
call fcn.00435444
mov dword [ebp - 0x10], 0x36432a27
xor eax, eax
mov dword [ebp - 8], 0xfffffff9
mov dword [ebp - 0x2c], 8
mov dword [ebp - 0x1c], 0x5d177cce
mov dword [ebp - 0x24], 0xfff9
mov dword [ebp - 8], eax
jmp 0x436147
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x8c]
mov dword [ecx + edx*4], 0x55bb2c21
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x436134
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x4361f4
mov dword [ebp - 0x38], 0xc321a078
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x8c]
cmp dword [edx + ecx*4], eax
jne 0x436177
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x8c]
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], eax
je 0x4361b4
mov edx, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp - 0x8c]
cmp dword [ecx + edx*4], eax
setle bl
sub ebx, 0x7b30
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [ebp - 8]
jl 0x4361ab
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x10]
cmp dword [ecx], esi
mov ecx, dword [ebp - 0x8c]
setge bl
add ebx, 0x47d4
mov dword [ecx + edx*4], ebx
mov dword [ebp - 0x38], ebx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x4361eb
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor eax, eax
dec dword [ebp - 0x10]
jns 0x436159
push 3
mov dword [ebp - 0x1c], eax
pop ebx
cmp dword [ebp - 0x1c], 0xd
jge 0x43629e
push ebx
lea ecx, [ebp - 0x25c]
call fcn.00435444
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa95c0]
lea ecx, [ebp - 0x26c]
push ecx
xor eax, eax
mov dword [ebp - 0x28], 0xdeabfd09
lea ecx, [ebp - 0x27c]
mov dword [ebp - 0x138], eax
push ecx
push eax
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x134], eax
movdqu xmmword [ebp - 0x27c], xmm0
mov dword [ebp - 0x130], eax
call fcn.00435587
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 8], 0
jmp 0x436278
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x25c]
and dword [eax + ecx*4], 0
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x436268
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x138]
call fcn.00435516
lea ecx, [ebp - 0x25c]
call fcn.00435516
inc dword [ebp - 0x1c]
jmp 0x4361fa
lea ecx, [ebp - 0x8c]
call fcn.00435516
mov eax, dword [edi]
mov dword [ebp - 0x28], eax
xor eax, eax
mov dword [ebp - 0x10], 0x5540d7f8
mov dword [ebp - 0x3c], 0x57257ea0
mov dword [ebp - 0x10], eax
jmp 0x43630b
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], eax
jmp 0x436302
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 8], eax
jmp 0x4362df
cmp dword [ebp - 0x1c], eax
jne 0x4362e5
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe3
jl 0x4362d7
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x4362ff
push eax
push 0x3e4
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor eax, eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
jl 0x4362cb
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe7
jl 0x4362c3
cmp dword [ebp - 0x10], eax
jne 0x43631f
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
xor edx, edx
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa95b0]
test ecx, ecx
lea ecx, [ebp - 0x28c]
mov dword [ebp - 0x174], eax
setg dl
mov dword [ebp - 0x170], eax
mov dword [ebp - 0x10], edx
add edi, 4
mov dword [ebp - 0x24], 0x2c03342e
mov dword [ebp - 0x3c], 0x126ff23b
mov dword [ebp - 0x3c], 0x8cccddd
mov dword [ebp - 0x3c], 0x576c5165
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x3c], 0xfffffff7
push ecx
mov dword [ebp - 0x3c], 9
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x3c], 0x84bc9c3
mov dword [ebp - 0x220], ebx
push ecx
mov dword [ebp - 0x21c], ebx
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x218], ebx
mov dword [ebp - 0x214], ebx
push eax
mov dword [ebp - 0x34], edi
movdqu xmmword [ebp - 0x29c], xmm0
mov dword [ebp - 0x16c], eax
call fcn.00435587
push esi
lea ecx, [ebp - 0x1e8]
call fcn.00435444
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4363e7
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1e8]
mov dword [ecx + edx*4], 0x7aebb1bb
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4363d4
mov dword [ebp - 0x24], eax
jmp 0x436426
mov dword [ebp - 8], 0x38ecf54c
mov dword [ebp - 8], 0xffffffea
jmp 0x43641d
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x43641a
push 0x113f
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x10
jge 0x436401
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x4363f1
mov eax, dword [ebp - 0x1e8]
lea ecx, [ebp - 0x1e8]
dec dword [eax]
call fcn.00435516
lea ecx, [ebp - 0x174]
call fcn.00435516
mov edi, dword [edi]
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0x30], 0x8114768c
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x18], 0x8716b5b3
push 4
mov dword [ebp - 0x38], edi
call fcn.00435444
xor eax, eax
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 8], eax
jmp 0x436494
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x98]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x436485
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
je 0x4364c6
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x3c], 0x8ef544bd
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffeb
jg 0x43669e
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 8], eax
mov dword [ebp - 8], eax
jmp 0x436501
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x114], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4364f0
cmp dword [ebp - 0x54], eax
jne 0x43669b
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jg 0x43668e
mov dword [ebp - 0x1c], 0x7d594484
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], ebx
jg 0x43665e
push ebx
lea ecx, [ebp - 0x15c]
call fcn.00435444
xor eax, eax
mov dword [ebp - 0x5c], 0xfffffffb
mov dword [ebp - 8], eax
jmp 0x43655e
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x15c]
mov dword [ecx + edx*4], 0xf80453d4
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x43654b
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x436577
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
xor eax, eax
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], eax
jl 0x436645
mov edi, dword [ebp - 0x98]
xor edx, edx
mov dword [ebp - 0x2c], 0x1563cfeb
mov ecx, dword [ebp - 0x18]
cmp ecx, 0xa7bb
mov esi, dword [ebp - 0x15c]
setg dl
mov ecx, dword [esi]
add ecx, edx
xor edx, edx
cmp ecx, dword [esi]
mov dword [ebp - 0x114], ecx
setge dl
xor ecx, ecx
cmp edx, 0x2eae2646
setl cl
cmp ecx, 0xfffffffa
jge 0x4365c8
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
dec dword [ebp - 0x24]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ecx + edx*4]
cmp ecx, dword [edi + 8]
mov ecx, dword [ebp - 0x24]
setg bl
xor edx, edx
cmp ecx, 2
setne dl
cmp edx, ebx
jge 0x4365f4
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x1c]
xor esi, esi
mov ecx, dword [ebp - 0x15c]
inc esi
xor edx, edx
mov dword [edi + 0xc], esi
cmp dword [ecx], esi
mov ecx, dword [ebp - 0x10]
setne dl
xor ebx, ebx
imul ecx, edx
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x2c]
cmp ecx, edx
setl bl
add ebx, 0x1943ec3e
jne 0x43662f
mov edx, eax
cmp dword [ebp - 0x1c], eax
je 0x436631
mov edx, esi
mov ecx, dword [ebp - 0x3c]
add ecx, edx
mov dword [ebp - 8], ecx
dec dword [ebp - 0x30]
jns 0x436589
push 3
pop ebx
lea ecx, [ebp - 0x15c]
call fcn.00435516
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x436531
xor eax, eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x98]
cmp dword [ecx + edx*4], eax
je 0x436671
cmp dword [ebp - 0x1c], eax
jne 0x436673
mov esi, eax
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x98]
push 1
mov dword [ecx + edx*4], esi
inc dword [ebp - 0x10]
pop esi
cmp dword [ebp - 0x10], ebx
jle 0x43651b
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffeb
jle 0x4364e1
mov edi, dword [ebp - 0x38]
cmp dword [ebp - 0x30], eax
je 0x4366bb
mov ecx, dword [ebp - 0x98]
mov edx, eax
mov ecx, dword [ecx + 8]
add ecx, 3
neg ecx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x2c], ecx
jne 0x4366bd
mov edx, esi
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x98]
call fcn.00435516
mov ebx, dword [ebp - 0x34]
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x18], esi
add ebx, 4
mov dword [ebp - 0x10], 0x76c3a0b8
mov dword [ebp - 0xc], 0x84515fdc
push 2
mov dword [ebp - 0x34], ebx
call fcn.00435444
xor eax, eax
mov dword [ebp - 0x54], 0x4d7aeb8f
mov dword [ebp - 8], eax
jmp 0x43671d
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xdc]
mov dword [ecx + edx*4], 0x74a52027
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x43670a
mov dword [ebp - 0x18], 0x1a
cmp dword [ebp - 0x18], 0xfffffff2
jle 0x4367a5
push 3
lea ecx, [ebp - 0x1d0]
call fcn.00435444
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x436757
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1d0]
mov dword [ecx + edx*4], 0xfffd
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x436744
mov ecx, dword [ebp - 0x1d0]
mov ecx, dword [ecx]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], eax
je 0x436773
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0xc], 0x8f01ba02
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x43678f
push 0x16a3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
lea ecx, [ebp - 0x1d0]
call fcn.00435516
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff2
jg 0x436730
xor eax, eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], esi
jg 0x436936
push 6
pop edi
mov dword [ebp - 0x2c], 0x36a5b5cf
mov dword [ebp - 0x1c], 0xe834ab4
mov dword [ebp - 0x24], 0x5f14
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], eax
jl 0x436924
mov ecx, dword [ebp - 0xdc]
xor ebx, ebx
mov dword [ebp - 0x30], 0xb69c93e3
mov dword [ebp - 0x5c], 0x8d81
mov dword [ebp - 0x3c], 0xb924e19c
cmp dword [ecx], eax
mov ecx, dword [ebp - 0x10]
setne bl
xor edx, edx
cmp ebx, ecx
sete dl
mov dword [ebp - 0x2c], edx
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp edi, ecx
mov edx, dword [ebp - 0xdc]
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp dword [edx + esi*4], ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
setne bl
mov dword [ebp - 0x3c], ebx
xor ebx, ebx
cmp ecx, edx
setge bl
sub ebx, dword [ebp - 0x3c]
mov dword [ebp - 0x30], ebx
mov esi, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x1c], 0x3e73
mov edx, dword [ebp - 0xdc]
sub ecx, dword [edx + esi*4]
xor esi, esi
mov dword [ebp - 0x1c], ecx
inc esi
mov dword [ebp - 0x30], eax
jmp 0x436912
xor ebx, ebx
mov dword [ebp - 8], 0x239f
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], 0x494f
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 8]
inc edx
cmp edx, ecx
setne bl
sub ebx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
sub ecx, ebx
cmp ecx, 0xfffffffa
mov ecx, dword [ebp - 8]
setge dl
xor ebx, ebx
cmp edx, ecx
setle bl
xor ecx, ecx
imul ebx, dword [ebp - 0xc]
cmp ebx, 0xc1b23fe2
setne cl
sub ecx, 0x319b
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x3c], ecx
mov ecx, dword [ebp - 8]
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 0x1c]
setne dl
sub edx, dword [ebp - 0x3c]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
setle bl
sub ebx, 0x2b4c4143
sub ebx, dword [ebp - 8]
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, dword [ebp - 0x30]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x54], ebx
xor ebx, ebx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x54]
cmp ecx, edx
mov edx, dword [ebp - 0x18]
setge bl
sub edx, ebx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x1c]
cmp edx, 0xfffffff7
setne cl
imul ecx, dword [ebp - 0x24]
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jle 0x436855
dec dword [ebp - 0x10]
jns 0x4367d5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x4367b4
mov edi, dword [ebp - 0x38]
mov ebx, dword [ebp - 0x34]
lea ecx, [ebp - 0xdc]
call fcn.00435516
test edi, edi
jne 0x43694b
add ebx, 8
mov dword [ebp - 0x34], ebx
push esi
lea ecx, [ebp - 0x104]
call fcn.00435444
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa95d0]
lea ecx, [ebp - 0x2ac]
push ecx
xor eax, eax
lea ecx, [ebp - 0x2bc]
push ecx
push eax
lea ecx, [ebp - 0xec]
mov dword [ebp - 0xec], eax
movdqu xmmword [ebp - 0x2bc], xmm0
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
call fcn.00435587
xor eax, eax
mov dword [ebp - 0x38], 0x3f29c8dd
mov dword [ebp - 0x10], eax
jmp 0x4369b9
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x104]
mov dword [ecx + edx*4], 0x6847dfa8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4369a6
mov dword [ebp - 0x10], eax
jmp 0x4369d4
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x238], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x4369c3
mov edi, dword [ebp - 0xec]
mov dword [edi + 8], eax
mov esi, dword [edi + 8]
xor edx, edx
mov ebx, dword [ebp - 0x104]
mov ecx, dword [ebx + esi*4]
imul ecx, ecx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, 0xffffffff
sete cl
mov dword [ebp - 0x238], ecx
test ecx, ecx
je 0x436a1c
cmp dword [edi + 8], eax
je 0x436a1c
mov ecx, dword [ebp - 0x238]
mov ebx, dword [ebp - 0x104]
mov ecx, dword [edi + 8]
mov edx, dword [ebx + ecx*4]
add edx, dword [edi + 4]
mov ecx, dword [ebp - 0x238]
add ecx, edx
xor edx, edx
cmp ecx, 0xfffffffe
setl dl
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x104]
jne 0x436a4f
mov ecx, dword [edi + 8]
cmp dword [esi + ecx*4], eax
jne 0x436a4f
mov edx, eax
jmp 0x436a52
xor edx, edx
inc edx
mov ecx, dword [edi + 8]
mov dword [esi + ecx*4], edx
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x436a71
push 0x21fd
push eax
push eax
push eax
call dword [sym.imp.GDI32.dll_CombineRgn]
xor eax, eax
inc dword [edi + 8]
cmp dword [edi + 8], 0
jle 0x4369e3
lea ecx, [ebp - 0xec]
call fcn.00435516
lea ecx, [ebp - 0x104]
call fcn.00435516
mov edi, dword [ebp - 0x34]
mov ebx, dword [ebp - 0x20]
add edi, dword [ebp - 0x28]
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, dword [ebp - 0x40]
jl 0x4360fa
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x12c]
call fcn.00435444
xor eax, eax
xor esi, esi
mov dword [ebp - 0xc], eax
inc esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 8], eax
jmp 0x436ad8
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x12c]
mov dword [ecx + edx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x436ac9
mov edx, dword [ebp - 0x12c]
xor ecx, ecx
cmp dword [edx + 8], eax
setge cl
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], eax
je 0x436afa
mov ecx, esi
cmp dword [edx + 8], eax
jne 0x436afc
mov ecx, eax
xor eax, eax
cmp ecx, 0x3b9da4d0
setge al
sub eax, 0x1eca6c84
cmp dword [edx + 8], eax
jle 0x436be9
mov dword [ebp - 0x40], 0xfffffffc
mov dword [ebp - 0xc], 0xffffffe5
cmp dword [ebp - 0xc], 0xffffffe7
jle 0x436bd1
mov esi, dword [ebp - 0x12c]
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0x1a0]
push ebx
call fcn.00435444
mov dword [ebp - 8], 0
jmp 0x436b62
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1a0]
mov dword [eax + ecx*4], 0x4b52dd86
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x436b4f
mov eax, dword [ebp - 0x40]
xor ecx, ecx
mov edx, dword [esi + 0xc]
cmp edx, eax
setg cl
xor eax, eax
cmp edx, ecx
mov ecx, 0xaba9a984
setg al
cmp ecx, eax
mov eax, dword [ebp - 0x40]
sbb edx, edx
xor ecx, ecx
neg edx
add edx, 0x79dc8669
cmp edx, eax
setle cl
imul ecx, ecx, 0x758b
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1a0]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x1a0]
call fcn.00435516
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe7
jg 0x436b33
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
push 3
setle dl
mov dword [ebp - 0xc], edx
pop ebx
jmp 0x436c94
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x1c4]
call fcn.00435444
mov dword [ebp - 8], 0
jmp 0x436c14
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c4]
mov dword [eax + ecx*4], 0x4846e1d6
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x436c01
mov dword [ebp - 0xc], 0xffffffee
jmp 0x436c59
mov dword [ebp - 8], 0xfffffffe
mov dword [ebp - 8], 7
cmp dword [ebp - 8], 0
je 0x436c50
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x436c4b
push 0x827
call dword [sym.imp.USER32.dll_GetKeyState]
dec dword [ebp - 8]
jne 0x436c36
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffa
jg 0x436c22
push 6
mov dword [ebp - 0x1c], 0xffffffe8
pop edx
cmp dword [ebp - 0x1c], edx
jl 0x436c89
mov ecx, dword [ebp - 0x1c4]
mov eax, dword [ecx + 8]
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jge 0x436c74
lea ecx, [ebp - 0x1c4]
call fcn.00435516
lea ecx, [ebp - 0x12c]
call fcn.00435516
mov eax, dword [edi]
lea ecx, [ebp - 0x1dc]
push ebx
mov dword [ebp - 0x1c], eax
call fcn.00435444
push 4
lea ecx, [ebp - 0x150]
call fcn.00435444
mov dword [ebp - 0x40], 0x1d4595a2
xor eax, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], eax
jmp 0x436ce1
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1dc]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x436cd1
mov dword [ebp - 0x10], eax
jmp 0x436cfa
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x150]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x436ceb
mov edx, dword [ebp - 0x1dc]
xor ecx, ecx
mov eax, dword [ebp - 0x150]
cmp dword [edx + 4], 0x3a4d
setne cl
neg ecx
mov dword [eax + 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x40]
cmp dword [edx + 4], eax
mov eax, dword [ebp - 0x40]
setle cl
sub ecx, eax
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x40]
cmp dword [edx + 0xc], eax
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x150]
call fcn.00435516
lea ecx, [ebp - 0x1dc]
call fcn.00435516
push 4
pop eax
mov dword [ebp - 0x30], eax
add edi, eax
mov dword [ebp - 0x10], 0x12af048
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x28], 0xf9481f34
mov dword [ebp - 0x28], 0x10b4
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
dec edx
neg edx
mov dword [ebp - 0x34], edi
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x30]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xfffb
setg cl
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
je 0x436e00
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x436eea
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
jmp 0x436eea
mov dword [ebp - 0x38], 0xc1b16eb2
xor eax, eax
mov dword [ebp - 0x10], 0xfffffff8
cmp dword [ebp - 0x10], eax
je 0x436eea
mov dword [ebp - 0x5c], 0x1e80
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x20], esi
mov dword [ebp - 8], eax
jmp 0x436e40
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x188], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x436e2f
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 5
jne 0x436edb
mov dword [ebp - 0x28], 0xfaead221
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x3c], 0x96a604c9
mov dword [ebp - 8], eax
jmp 0x436e7a
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x2e0], 0xd5889e59
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x436e69
mov ecx, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x188], ecx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x54]
sub ecx, dword [ebp - 0x38]
neg ecx
push 3
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2e0]
mov ecx, dword [ebp - 0x3c]
mov edx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x5c]
cmp edx, ecx
setge bl
add ebx, 0xd022fbb
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 5
pop ebx
je 0x436e53
mov ecx, dword [ebp - 0x188]
inc dword [ebp - 0x10]
jne 0x436e19
mov eax, dword [edi]
lea ecx, [ebp - 0x168]
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], 0x49f2b782
mov dword [ebp - 0x18], 0xfffffff9
push esi
mov dword [ebp - 0x54], eax
call fcn.00435444
push ebx
lea ecx, [ebp - 0xd0]
call fcn.00435444
xor eax, eax
mov dword [ebp - 0x40], 0x2d206f84
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0xc], eax
jmp 0x436f37
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x48], 0xfbd3aeb5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x436f29
mov dword [ebp - 0xc], eax
jmp 0x436f54
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x168]
mov dword [ecx + edx*4], 0x3cbf
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x436f41
mov dword [ebp - 0xc], eax
jmp 0x436f71
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xd0]
mov dword [ecx + edx*4], 8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x436f5e
mov dword [ebp - 0xc], eax
jmp 0x436f8c
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x2c8], 0xfffffffd
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x436f7b
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov ecx, dword [ebp - 0x48]
test ecx, ecx
setg dl
xor ecx, ecx
cmp edx, 0x67ab
setge cl
cmp ecx, dword [ebp - 0x48]
je 0x436fb1
mov ecx, dword [ebp - 0x48]
mov edx, dword [ebp - 0x48]
xor ebx, ebx
mov ecx, dword [ebp - 0x48]
cmp edx, ecx
setge bl
xor ecx, ecx
cmp ebx, 0x2955f1bb
setne cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x28], ecx
sete dl
xor ebx, ebx
mov dword [ebp - 8], edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x48]
neg edx
cmp ecx, edx
mov ecx, dword [ebp - 0x48]
setl bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x48]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x48]
setle bl
xor edx, edx
cmp ebx, ecx
setge dl
mov dword [ebp - 0x48], edx
mov ecx, dword [ebp - 0x48]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xd0]
mov dword [ecx], 0x4bf7d69f
mov dword [ebp - 0x24], 7
mov dword [ebp - 0xc], 0xbeba6e32
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], 0xbbca57ef
mov dword [ebp - 8], eax
jmp 0x437050
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x250], 0xfffffffd
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x43703f
mov ecx, dword [ebp - 0xd0]
cmp dword [ecx], eax
je 0x4370cd
cmp dword [ebp - 0xc], eax
je 0x4370c5
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x20], eax
je 0x43708f
mov ecx, dword [ebp - 0x168]
cmp dword [ecx], eax
mov ecx, esi
jne 0x437091
mov ecx, eax
mov edx, dword [ebp - 0xc]
xor ebx, ebx
add edx, ecx
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
setne bl
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x48], ebx
xor ebx, ebx
cmp dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0xc]
sete bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0xd0]
setl dl
cmp edx, dword [ecx]
jge 0x4370c5
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
jmp 0x4370cf
mov esi, eax
mov ecx, dword [ebp - 0x2c8]
xor edx, edx
cmp esi, ecx
sete dl
cmp edx, 0xc0f60069
sbb ecx, ecx
neg ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x40]
imul ecx, ecx, 3
test ecx, ecx
jne 0x437109
cmp dword [ebp - 0xc], eax
jne 0x437109
xor esi, esi
mov edx, eax
inc esi
jmp 0x43710e
xor esi, esi
inc esi
mov edx, esi
mov ecx, dword [ebp - 0x24]
inc dword [ebp - 0x24]
cmp ecx, edx
mov ecx, esi
cmove ecx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffffffc
jl 0x4371de
push 6
pop edi
mov dword [ebp - 8], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], 0xec41c960
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0xc032
jl 0x437190
mov ecx, dword [ebp - 8]
mov edx, 0xd92dd8b1
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x48]
mov esi, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x168]
sub esi, 0x6f545111
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, dword [ecx]
setle dl
cmp edx, dword [ebp - 0xc]
jle 0x437183
mov ecx, dword [ebp - 0xc]
xor esi, esi
mov ecx, eax
inc esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
je 0x437192
mov ecx, esi
mov edx, dword [ebp - 8]
sub edx, ecx
neg edx
push 9
sbb edx, edx
xor ebx, ebx
inc edx
pop ecx
sub ecx, edx
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
cmp ecx, 0xcd71
mov ecx, dword [ebp - 0x24]
setle bl
xor edx, edx
cmp ebx, ecx
setg dl
mov dword [ebp - 0x250], edx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffc
jge 0x43712e
mov edi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x3c]
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x40], eax
call fcn.00435516
lea ecx, [ebp - 0x168]
call fcn.00435516
mov dword [ebp - 0x10], 0xa8eac8b
lea ecx, [ebp - 0x244]
mov dword [ebp - 0xc], 0xe1459f45
add edi, 4
mov dword [ebp - 0x18], 0x98072f25
mov dword [ebp - 8], 0xfe1f230b
mov dword [ebp - 0x30], 0xfffffffe
push esi
mov dword [ebp - 0x34], edi
call fcn.00435444
mov dword [ebp - 8], 0
jmp 0x437247
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x244]
mov dword [eax + ecx*4], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x437238
mov dword [ebp - 0x10], 0xffffffed
jmp 0x4373eb
mov dword [ebp - 0x24], 0x1fe77dd6
lea ecx, [ebp - 0x1b8]
push 3
call fcn.00435444
mov dword [ebp - 8], 0
jmp 0x437288
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1b8]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x437275
mov dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 0x1a
jg 0x4373dd
mov ebx, dword [ebp - 0x1b8]
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x180]
push 3
call fcn.00435444
push esi
lea ecx, [ebp - 0x1f4]
call fcn.00435444
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4372d9
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x2f0], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x4372cc
mov dword [ebp - 0xc], eax
jmp 0x4372f7
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x180]
mov dword [ecx + edx*4], 0x3ca4d9a5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4372e4
mov dword [ebp - 0xc], eax
jmp 0x437315
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1f4]
mov dword [eax + ecx*4], 0x3d4c4698
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x437302
mov edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg edx
mov edi, dword [ebp - 0x180]
sbb edx, edx
mov esi, dword [ebx + 8]
inc edx
xor ecx, ecx
imul edx, dword [edi + 4]
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, esi
setg al
xor edx, edx
cmp eax, esi
mov eax, dword [ebp - 0x180]
setl dl
xor ecx, ecx
cmp edx, dword [eax + 8]
setle cl
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebx + 4]
cmp eax, dword [ebx + 8]
mov dword [ebp - 0x2e8], eax
setge cl
dec dword [ebp - 0x40]
mov esi, dword [ebp - 0x10]
add ecx, 0x7de8dcb4
neg ecx
sbb ecx, ecx
inc ecx
add esi, ecx
mov dword [edi + 4], ecx
imul esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1f4]
sub esi, dword [eax]
mov eax, dword [ebp - 0x18]
inc esi
sub esi, dword [ebx + 8]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x1f4]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x30], eax
call fcn.00435516
lea ecx, [ebp - 0x180]
call fcn.00435516
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1a
push 1
pop esi
jle 0x4372a5
lea ecx, [ebp - 0x1b8]
call fcn.00435516
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jg 0x437258
mov dword [ebp - 8], 0xfffffff0
jmp 0x437577
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0x8c55279c
mov dword [ebp - 0xc], 0
jmp 0x437526
push esi
lea ecx, [ebp - 0x144]
call fcn.00435444
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x437441
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x144]
mov dword [ecx + edx*4], 3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x43742e
mov dword [ebp - 0x30], eax
jmp 0x437508
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa9590]
lea ecx, [ebp - 0x29c]
push ecx
lea ecx, [ebp - 0x2ac]
mov dword [ebp - 0xb0], eax
push ecx
push eax
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xac], eax
movdqu xmmword [ebp - 0x2ac], xmm0
mov dword [ebp - 0xa8], eax
call fcn.00435587
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x4374ed
mov edi, dword [ebp - 0xb0]
cmp dword [edi + 4], eax
jne 0x4374ab
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x18]
mov edx, dword [ebp - 0x144]
mov ecx, dword [ebp - 0x24]
cmp dword [edx + esi*4], ecx
je 0x4374c8
cmp dword [ebp - 0x30], eax
jne 0x4374c8
xor esi, esi
mov ecx, eax
inc esi
jmp 0x4374cd
xor esi, esi
inc esi
mov ecx, esi
mov edx, dword [ebp - 0x18]
xor ebx, ebx
cmp ecx, dword [edi + 4]
mov ecx, dword [ebp - 0x144]
setl bl
imul ebx, dword [ecx + edx*4]
mov dword [ebp - 0x28], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x4374a0
mov ecx, dword [ebp - 0xb0]
cmp dword [ecx + 4], eax
lea ecx, [ebp - 0xb0]
jne 0x437513
call fcn.00435516
inc dword [ebp - 0x30]
xor eax, eax
cmp dword [ebp - 0x30], eax
jle 0x43744e
jmp 0x437518
call fcn.00435516
lea ecx, [ebp - 0x144]
call fcn.00435516
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe4
jge 0x43741b
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0x158e5840
setge cl
cmp ecx, 0x9ea21f9f
jae 0x437554
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], eax
jl 0x437554
xor eax, eax
jmp 0x437556
mov eax, esi
mov ecx, dword [ebp - 0x24]
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x24]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 5
jge 0x437401
lea ecx, [ebp - 0x244]
call fcn.00435516
cmp dword [ebp - 0x54], 0
jne 0x437678
cmp byte [ebp - 0x4d], 0
mov edi, dword [ebp - 0x1c]
je 0x4375ad
cmp dword [ebp - 0x4c], esi
jne 0x4375ad
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov ecx, dword [ebp - 0x34]
push edi
mov eax, dword [ecx]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 4]
add ecx, 8
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], ecx
call fcn.00490519
mov ebx, eax
xor eax, eax
pop ecx
mov dword [ebp - 0xe0], eax
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0xe0]
push eax
push edi
call fcn.0046e0c9
xor ecx, ecx
test edi, edi
mov edi, dword [ebp - 0xa4]
mov esi, ecx
jle 0x43764c
mov eax, esi
and eax, 0x80000001
jns 0x437613
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
add eax, esi
add eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x3c]
jmp 0x437628
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x1c]
cmp word [edi + edx*2], cx
jne 0x437625
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov eax, dword [ebp - 0x34]
mov al, byte [edx + eax]
mov byte [esi + ebx], al
inc esi
mov eax, dword [ebp - 0x1c]
cmp esi, eax
jl 0x437605
jmp 0x43764f
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], ebx
test edi, edi
je 0x43767d
push edi
call fcn.00491a06
pop ecx
xor ecx, ecx
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
jmp 0x43767d
mov esi, dword [ebp + 8]
xor ecx, ecx
xor ebx, ebx
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp + 8], ecx
inc ebx
jmp 0x43769a
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x80], 0xa619
inc dword [ebp + 8]
cmp dword [ebp + 8], ebx
jl 0x43768c
mov dword [ebp - 0x10], ecx
jmp 0x4376b2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x80], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4376a4
mov dword [ebp - 0x10], ecx
jmp 0x43777b
push 4
lea ecx, [ebp - 0x210]
call fcn.00435444
xor eax, eax
mov dword [ebp + 8], eax
jmp 0x4376e1
mov ecx, dword [ebp + 8]
mov dword [ebp + ecx*4 - 0x58], 0xc3099cf
inc dword [ebp + 8]
cmp dword [ebp + 8], ebx
jl 0x4376d3
mov dword [ebp + 8], eax
jmp 0x4376fe
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 0x210]
mov dword [ecx + edx*4], 0x65786371
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jl 0x4376eb
mov dword [ebp - 0x58], eax
jmp 0x437767
mov dword [ebp + 8], 0x44ad
xor edx, edx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], ebx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp + 8]
mov ecx, dword [ebp - 0x80]
test ecx, ecx
setns dl
xor ecx, ecx
test edx, edx
setns cl
cmp dword [ebp + 8], ecx
jle 0x43774c
mov ecx, ebx
cmp dword [ebp - 0x10], eax
jne 0x43774e
mov ecx, eax
mov dword [ebp - 0x28], ecx
mov byte [ebp + 0xb], al
cmp byte [ebp + 0xb], 0
je 0x437764
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], 0x18
jge 0x437709
lea ecx, [ebp - 0x210]
call fcn.00435516
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffff
jle 0x4376bf
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret