Function at 0x433bf2
Capabilities:
Get graphical window text
Get session user name
Query or enumerate registry value
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
push ebx
push esi
push edi
push 3
pop esi
mov dword [ebp - 4], 0xffffffff
xor eax, eax
push 2
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x3d], dl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 4], eax
pop ebx
jmp 0x433c2c
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x210], 0xb9102071
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x433c1b
xor edi, edi
mov dword [ebp - 4], eax
inc edi
jmp 0x433c48
mov ecx, dword [ebp - 4]
cmp dword [ebp + ecx*4 - 0x210], eax
jne 0x433c4d
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jle 0x433c39
mov dword [ebp - 0x10], 0x730f94f3
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x20], 0x71865425
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], 0x3fa3a92b
mov dword [ebp - 0x20], 0xda2ae7b7
mov dword [ebp - 0x20], 0xffffffff
push ebx
call fcn.0043387f
mov dword [ebp - 0x14], 0xdbd3
xor eax, eax
mov dword [ebp - 0x1c], 0xab1a
mov dword [ebp - 0x10], eax
jmp 0x433cac
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x120], 0xec2e0cf5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x433c9b
mov dword [ebp - 0x10], eax
jmp 0x433cc9
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x19c]
mov dword [ecx + edx*4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x433cb6
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x433d67
push edi
lea ecx, [ebp - 0x1b4]
call fcn.0043387f
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
jmp 0x433d09
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x1b4]
mov dword [eax + ecx*4], 0xad86e52d
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x433cf6
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x120], 0
jne 0x433d4c
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
neg ecx
push 4
sbb ecx, ecx
inc ecx
neg ecx
pop eax
cmp eax, ecx
mov eax, dword [ebp - 0x1b4]
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
jne 0x433d4c
xor eax, eax
jmp 0x433d4e
mov eax, edi
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x1b4]
call fcn.00433951
dec dword [ebp - 0x10]
jns 0x433cda
xor eax, eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], eax
jl 0x433e2a
mov dword [ebp - 0x20], 0xe075257
mov dword [ebp - 0x20], 0xcbc21b07
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 4], edi
mov dword [ebp - 0x20], 0x77dfcc86
mov dword [ebp - 0x20], 0x4067bc62
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 0x4b71808a
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x20], 0xf9af3922
mov dword [ebp - 4], eax
jmp 0x433dd4
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x268], 0xf12afbc
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x433dc3
inc dword [ebp - 0x14]
mov dword [ebp - 4], eax
jmp 0x433e1c
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x20], 0xf3bc9fc2
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + ecx*4 - 0x120]
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x120], edx
test edx, edx
jne 0x433e06
mov ecx, dword [ebp - 0x28]
inc dword [ebp - 0x1c]
je 0x433e0e
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x19c]
mov dword [ecx], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jle 0x433de1
dec dword [ebp - 0x10]
jns 0x433d73
lea ecx, [ebp - 0x19c]
call fcn.00433951
mov dword [ebp - 0x1c], 6
lea ecx, [ebp - 0x190]
push ebx
call fcn.0043387f
push 4
pop eax
push eax
lea ecx, [ebp - 0x178]
call fcn.0043387f
push ebx
lea ecx, [ebp - 0x1cc]
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x50], 0x82f4e55
mov dword [ebp - 0x18], eax
jmp 0x433e84
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x190]
mov dword [ecx + edx*4], 0xa5f27a41
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x433e71
mov dword [ebp - 0x18], eax
jmp 0x433ea1
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x178]
mov dword [ecx + edx*4], 0x3997b09b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x433e8e
mov dword [ebp - 0x18], eax
jmp 0x433ebf
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1cc]
mov dword [ecx + edx*4], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x433eac
cmp dword [ebp - 0x1c], 0xa7b7e80d
sbb ecx, ecx
neg ecx
cmp ecx, 0xab89bdd7
jae 0x433ede
cmp dword [ebp - 0x1c], eax
je 0x433ede
mov eax, edi
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x190]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x178]
setne cl
xor edx, edx
cmp ecx, dword [eax + 8]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1cc]
setne dl
imul ecx, edx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x1cc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x50], edi
call fcn.00433951
lea ecx, [ebp - 0x178]
call fcn.00433951
lea ecx, [ebp - 0x190]
call fcn.00433951
mov dword [ebp - 4], 0x1897a4a1
lea ecx, [ebp - 0x208]
push edi
call fcn.0043387f
push ebx
lea ecx, [ebp - 0x1a8]
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x28], 0x4bae
mov dword [ebp - 0x10], eax
jmp 0x433f82
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x208]
mov dword [ecx + edx*4], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x433f6f
mov dword [ebp - 0x10], eax
jmp 0x433f9f
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1a8]
mov dword [ecx + edx*4], 4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x433f8c
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], eax
jmp 0x43404e
mov dword [ebp - 0x10], 0xefa9d19a
mov dword [ebp - 0x20], 0x50b5f0b1
mov dword [ebp - 0x20], 0x6eed1e12
mov dword [ebp - 0x10], eax
jmp 0x43403c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 0x64b5c6f8
mov dword [ebp - 0x20], edi
mov dword [ebp - 0xc], eax
jmp 0x434034
push esi
lea ecx, [ebp - 0x1e4]
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x43400c
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1e4]
mov dword [ecx + edx*4], 0xf9c71042
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x433ff9
inc dword [ebp - 0x28]
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x434024
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [ebp - 0x1e4]
call fcn.00433951
inc dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 0xc], eax
jle 0x433fe6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x433fcd
mov ecx, dword [ebp - 0x1a8]
cmp dword [ecx], eax
jne 0x434057
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x433fb3
lea ecx, [ebp - 0x1a8]
call fcn.00433951
lea ecx, [ebp - 0x208]
call fcn.00433951
mov esi, dword [0x4b09fc]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xc], 0x9b3198a8
mov dword [ebp - 0x50], esi
mov dword [ebp - 0xc], 0xffffffeb
jmp 0x43419c
push 3
lea ecx, [ebp - 0x16c]
call fcn.0043387f
mov dword [ebp - 4], edi
mov dword [ebp - 4], 0
jmp 0x4340bb
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], 0x6e60b0c
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4340a8
mov dword [ebp - 4], 0
jmp 0x43417d
push 2
lea ecx, [ebp - 0xe0]
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x1c], eax
jmp 0x4340f4
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xe0]
mov dword [ecx + edx*4], 0x693e9323
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x4340e1
mov ecx, dword [ebp - 0xe0]
mov dword [ecx], 2
mov dword [ebp - 0x2c], 0xab4456e3
mov dword [ebp - 0x1c], eax
jmp 0x434120
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x80], 0xf054a20a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x434112
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x43413b
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
xor eax, eax
mov dword [ebp - 0x80], eax
jmp 0x43415a
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x16c]
mov dword [ecx + edx*4], 0x37bb0086
mov dword [ebp - 0x2c], 0xffffffff
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], 2
jle 0x434140
mov ecx, dword [ebp - 0xe0]
dec dword [ecx]
jns 0x434106
cmp dword [ecx + 4], eax
lea ecx, [ebp - 0xe0]
jne 0x434189
call fcn.00433951
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x4340cd
jmp 0x43418e
call fcn.00433951
lea ecx, [ebp - 0x16c]
call fcn.00433951
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff5
jne 0x43408f
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x144]
xor eax, eax
push 4
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
pop eax
push eax
call fcn.0043387f
mov dword [ebp - 0x1c], 9
lea ecx, [ebp - 0x1c0]
push 3
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x2c], 0xbeb96916
mov dword [ebp - 0x10], eax
jmp 0x4341fa
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x144]
mov dword [ecx + edx*4], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x4341e7
mov dword [ebp - 0x10], eax
jmp 0x434218
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c0]
mov dword [ecx + edx*4], 0x5e1f6f08
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x434205
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], eax
jl 0x43424f
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x43423c
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x144]
cmp dword [ecx + edx*4], eax
jne 0x43424f
dec dword [ebp - 0x1c]
jns 0x43422a
mov dword [ebp - 0x1c], 0xb60e704f
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c0]
mov dword [ecx + 4], eax
xor ecx, ecx
mov eax, dword [ebp - 0x144]
cmp dword [eax + 8], 2
setg cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x1c0]
call fcn.00433951
lea ecx, [ebp - 0x144]
call fcn.00433951
cmp byte [ebp - 0x3d], 0
je 0x4345d7
cmp esi, 1
jne 0x4345d7
mov dword [ebp - 0x14], 0xce53
xor eax, eax
mov dword [ebp - 0x24], 0xc6fe
mov dword [ebp - 0x28], 0xc3203bd6
mov dword [ebp - 0x2c], 0xfffffffb
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x4342d6
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
xor eax, eax
cmp dword [ebp - 0x24], eax
jne 0x4342e7
cmp dword [ebp - 0x14], eax
jne 0x4342e7
xor esi, esi
mov ecx, eax
inc esi
jmp 0x4342ec
xor esi, esi
inc esi
mov ecx, esi
mov dword [ebp - 0x28], ecx
xor ebx, ebx
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
cmp ecx, edx
mov ecx, dword [ebp - 0x14]
setge bl
xor edx, edx
cmp ebx, ecx
setge dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0x24]
jle 0x43431a
cmp dword [ebp - 0x24], eax
je 0x43431a
mov eax, esi
xor edx, edx
cmp eax, 0xc668cc88
mov eax, dword [ebp - 0x14]
push 4
setge dl
xor ecx, ecx
cmp eax, edx
pop eax
setle cl
mov dword [edi + 8], eax
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x138]
push 3
pop ebx
mov dword [ebp - 0x1c], 0x5720e83c
mov dword [ebp - 4], 0xde9829cb
mov dword [ebp - 0x14], 0xfffffff6
push ebx
call fcn.0043387f
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x10], 0
jmp 0x43437b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf0], 0x31e4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x43436a
mov dword [ebp - 0x10], 0
jmp 0x434398
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x434389
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 2
jg 0x4345c5
mov eax, dword [ebp - 0x138]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], esi
push esi
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x10], eax
jmp 0x4343ee
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x4c], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4343e0
mov dword [ebp - 0x10], eax
jmp 0x43440b
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x114]
mov dword [ecx + edx*4], 0xbc9fc22f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4343f8
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, 0xda2a
setl dl
xor ecx, ecx
cmp edx, 0xffffffff
setne cl
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
sub edx, ecx
je 0x43443a
mov edi, esi
cmp dword [ebp - 0x18], eax
jne 0x43443c
mov edi, eax
mov esi, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x4c], esi
mov ecx, dword [ebp - 0x18]
cmp edi, ecx
setg dl
cmp esi, edx
jle 0x434453
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xec]
xor ebx, ebx
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
sub edx, ecx
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
mov ecx, dword [ebp - 0x28]
setge bl
xor edx, edx
cmp ebx, ecx
setge dl
xor ebx, ebx
dec edx
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0xf0]
mov ecx, dword [ebp - 0x24]
cmp edx, ecx
setg bl
cmp ebx, 8
jg 0x4344c3
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x434536
push eax
push 0xcf8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
jmp 0x434536
mov dword [ebp - 0x38], 0x72c95c8f
xor ebx, ebx
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xec]
mov ecx, dword [ebp - 0x114]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 8]
mov dword [ebp - 0x4c], ecx
mov ecx, dword [ebp - 0x34]
cmp ecx, 0xffffe0f1
mov ecx, dword [ebp - 0x38]
setl bl
sub ebx, 0xd1dc2cbf
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ecx, 0xd142
setle dl
xor ecx, ecx
cmp edx, ebx
setle cl
xor ebx, ebx
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
cmp edx, ecx
mov ecx, dword [ebp - 0x114]
setge bl
add ebx, dword [ecx]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], eax
xor edx, edx
mov dword [ebp - 0x34], 0xfffffffb
mov ebx, 0x8626
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xe8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x4c], ebx
mov ecx, dword [eax + 8]
mov eax, dword [ebp - 0x34]
sub ecx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x138]
setle dl
xor ecx, ecx
cmp edx, dword [eax]
setle cl
mov dword [ebp - 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x5d954113
setg cl
sub ecx, 0x890b
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0xffff
xor ecx, ecx
cmp eax, 0x49d5
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x114]
call fcn.00433951
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
push 1
pop esi
jle 0x4343bd
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x138]
call fcn.00433951
mov dword [edi + 0xc], 0x4b09fc
xor ebx, ebx
lea ecx, [ebp - 0x150]
inc ebx
push ebx
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x10], eax
push 2
mov dword [ebp - 0x18], eax
pop esi
mov dword [ebp - 4], esi
mov dword [ebp - 4], eax
jmp 0x43460c
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x150]
mov dword [ecx + edx*4], 0x75dc
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x4345f9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], eax
jl 0x434784
xor edi, edi
mov dword [ebp - 0x2c], 0xfc75dfcc
mov dword [ebp - 4], 0x67a4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x150]
mov ecx, dword [eax + ecx*4]
sub ecx, dword [eax + edx*4]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x150]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [ebp - 4], 0xfffffff1
jmp 0x434769
mov dword [ebp - 0x14], 0xe40
lea ecx, [ebp - 0x1d8]
push esi
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x34], 0x187d7a76
mov dword [ebp - 0x1c], eax
jmp 0x4346a2
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1d8]
mov dword [ecx + edx*4], 0x5aa9c4ad
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x43468f
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x4346c8
push eax
push 0x12b
push eax
push 0x250e
push 0x138
call dword [sym.imp.GDI32.dll_ExtCreatePen]
xor eax, eax
mov dword [ebp - 0x18], 0x16
cmp dword [ebp - 0x18], esi
jne 0x43475b
mov esi, dword [ebp - 0x1d8]
mov dword [ebp - 0x24], 5
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x18]
test ecx, ecx
jne 0x434714
mov edx, eax
cmp dword [ebp - 0x18], eax
je 0x434717
lea edx, [edi + 1]
xor ecx, ecx
cmp edx, 0x7672
setle cl
xor edx, edx
sub ecx, 0x201e9fd6
cmp ecx, dword [esi + 4]
mov ecx, dword [ebp - 0x18]
setg dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0x18]
setle bl
xor edx, edx
cmp ebx, ecx
setne dl
xor ecx, ecx
cmp edx, dword [esi + 4]
setle cl
mov dword [ebp - 0x34], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
je 0x4346de
push 2
pop esi
lea ecx, [ebp - 0x1d8]
call fcn.00433951
inc dword [ebp - 4]
push 4
pop eax
cmp dword [ebp - 4], eax
jne 0x43466e
dec dword [ebp - 0x10]
jns 0x43461f
mov edi, dword [ebp + 8]
xor ebx, ebx
inc ebx
lea ecx, [ebp - 0x150]
call fcn.00433951
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x44], eax
jge 0x435b75
mov dword [ebp - 0x1c], 0xdb34
or edi, 0xffffffff
mov dword [ebp - 0xc], edi
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 4], 0x2f3ccd24
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x3c], 6
mov dword [ebp - 0x28], 0xddbc75b1
mov dword [ebp - 0x2c], 0x9d90dc6c
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x1c], eax
je 0x4347e8
mov edx, dword [ebp - 0xc]
mov esi, ebx
mov ecx, dword [ebp - 0xc]
sub edx, 0xfffffffc
neg edx
sbb edx, edx
inc edx
sub ecx, edx
jne 0x4347ea
mov esi, eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
cmp esi, ecx
setl dl
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
cmp dword [ebp - 0x1c], eax
je 0x43480e
cmp dword [ebp - 4], eax
je 0x43480e
xor esi, esi
inc esi
mov edx, esi
jmp 0x434813
xor esi, esi
mov edx, eax
inc esi
xor ecx, ecx
cmp edx, 0xffff
sete cl
neg ecx
jne 0x434825
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 5
jmp 0x434a8f
mov dword [ebp - 0x14], 0x3631af66
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x5c], 0xfffc
mov dword [ebp - 0x34], 0xdd75
mov dword [ebp - 4], eax
jmp 0x43486b
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x48], 0x54d8142c
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x43485d
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x10], eax
jmp 0x434a83
mov dword [ebp - 0x1c], 0xfffffffc
mov ecx, dword [ebp - 0x10]
cmp dword [ebp + ecx*4 - 0x48], eax
je 0x4348c7
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp + ecx*4 - 0x48]
cmp ecx, 0xe4f
setle dl
xor ebx, ebx
mov dword [ebp - 0x38], edx
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x14]
cmp edx, ecx
mov ecx, dword [ebp - 0x38]
setge bl
sub ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, esi
jmp 0x4348c9
mov ecx, eax
mov dword [ebp - 4], ecx
xor ebx, ebx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp + ecx*4 - 0x48]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
cmp ecx, edx
mov ecx, dword [ebp - 0x10]
setge bl
xor edx, edx
cmp ebx, esi
setne dl
imul edx, dword [ebp + ecx*4 - 0x48]
test edx, edx
je 0x4349e9
xor esi, esi
mov dword [ebp - 0x38], edi
mov dword [ebp - 4], eax
inc esi
jmp 0x434922
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x78], 0xd5b1
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x434914
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x4349da
push 4
pop ebx
push ebx
lea ecx, [ebp - 0x238]
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x24], 0x11ee15d1
mov dword [ebp - 4], eax
jmp 0x434963
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x238]
mov dword [ecx + edx*4], 0xfffffff9
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x434950
cmp dword [ebp - 0x14], eax
je 0x434970
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, esi
mov ecx, dword [ebp + ecx*4 - 0x48]
mov ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jne 0x434986
mov edx, eax
mov ecx, dword [ebp - 0x2c]
add ecx, edx
xor edx, edx
cmp ecx, 0xe412
setle dl
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
je 0x4349a6
cmp dword [ebp - 0x78], eax
je 0x4349a6
mov ecx, dword [ebp - 0x34]
cmp dword [ebp - 0x38], edi
je 0x4349b2
mov edx, eax
cmp dword [ebp - 0x78], eax
je 0x4349b4
mov edx, esi
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x238]
call fcn.00433951
inc dword [ebp - 0x18]
xor eax, eax
cmp dword [ebp - 0x18], eax
jle 0x434936
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x48], edx
jmp 0x434a80
xor ebx, ebx
mov dword [ebp - 0x38], 0xade0f7f7
inc ebx
lea ecx, [ebp - 0x184]
push ebx
call fcn.0043387f
mov dword [ebp - 4], 0
jmp 0x434a1b
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x184]
mov dword [eax + ecx*4], 0xcf818a8d
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x434a08
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x18]
jne 0x434a44
cmp dword [ebp - 0x2c], 0xe87ca618
jne 0x434a44
mov ecx, ebx
jmp 0x434a46
xor ecx, ecx
mov esi, dword [ebp - 0x38]
cmp ecx, ebx
mov eax, dword [ebp - 0x184]
mov dword [eax], esi
sbb eax, eax
inc eax
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
lea ecx, [ebp - 0x184]
setle dl
xor eax, eax
cmp esi, edx
sete al
mov dword [ebp - 0x38], eax
call fcn.00433951
xor esi, esi
xor eax, eax
inc esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x43487b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1d
jle 0x434840
mov dword [ebp - 0xc], 6
xor edx, edx
mov dword [ebp - 4], 0x2fbb6bc3
mov edi, 0x4b0a00
mov dword [ebp - 0x18], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp ecx, 0xd83d
mov dword [ebp - 0x1c], edi
setg dl
xor ecx, ecx
cmp edx, 0x9892
setg cl
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0xc]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0xc]
neg edx
sbb edx, edx
inc edx
cmp edx, 4
jl 0x434b5a
mov dword [ebp - 0x14], eax
jmp 0x434b0d
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x224], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x434b00
mov dword [ebp - 0x18], eax
jmp 0x434b36
cmp byte [ebp - 5], 0
je 0x434b27
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
mov ecx, dword [ebp - 0x220]
mov dword [ebp - 0x220], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
mov byte [ebp - 5], al
jne 0x434b18
cmp byte [ebp - 5], 0
je 0x434cd1
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x434ccf
push esi
lea ecx, [ebp - 0xa8]
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x434b80
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xa8]
mov dword [ecx + edx*4], 3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x434b6d
mov dword [ebp - 0xc], 9
cmp dword [ebp - 0xc], 0xffffffea
jl 0x434cc4
mov dword [ebp - 0x2c], 0x700c0d35
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x434bb0
push eax
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x434ca6
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jl 0x434ca3
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x434c73
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xa8]
cmp dword [ecx + edx*4], eax
jne 0x434c06
mov edx, dword [ebp - 0x20]
xor ebx, ebx
mov ecx, dword [ebp - 0xa8]
cmp edx, dword [ecx]
setne bl
add ebx, 0x42b8
cmp ebx, dword [ebp - 0x10]
jg 0x434c09
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x2c]
cmp edx, ecx
mov ecx, dword [ebp - 0xa8]
setle bl
xor edx, edx
cmp dword [ecx + esi*4], ebx
mov ecx, dword [ebp - 0x2c]
sete dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x28]
sete bl
sub ebx, 0x349dda4a
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
mov ecx, dword [ebp - 0xa8]
setl dl
imul edx, dword [ecx + edi*4]
xor ecx, ecx
cmp edx, 0xef33
setge cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x434bdd
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x434c9a
push 0x1c2a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
xor eax, eax
dec dword [ebp - 0x18]
jns 0x434bcb
inc dword [ebp - 4]
cmp dword [ebp - 4], eax
jle 0x434bb8
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffea
jge 0x434b96
xor esi, esi
mov edi, 0x4b0a00
inc esi
lea ecx, [ebp - 0xa8]
call fcn.00433951
xor eax, eax
cmp dword [ebp - 0x44], 0
jle 0x4351d4
mov ecx, dword [edi]
mov dword [ebp - 4], 0x831713b9
mov dword [ebp - 0x20], 0xffffffff
push 2
pop ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x20], 0x2b74c38b
mov dword [ebp - 0x20], 0x8464d91b
mov dword [ebp - 0x20], 0x21c760fc
mov dword [ebp - 0x24], 0x739425a3
mov dword [ebp - 0x20], 0xe691
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], eax
jmp 0x434d2d
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x274], 0xf2465cd3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x434d1c
mov dword [ebp - 4], 0xfffffff6
cmp dword [ebp - 4], 0x1c
jne 0x434e5e
push 4
pop edx
mov dword [ebp - 0x1c], 0x7be7e550
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], 0x33c2251
mov dword [ebp - 0x14], 9
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x20], 0xa30b9130
mov dword [ebp - 0x34], 0xbc92
mov dword [ebp - 0xc], eax
jmp 0x434d82
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x284], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x434d75
mov dword [ebp - 0xc], eax
jmp 0x434d9d
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x240], 0xbe8f2100
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x434d8c
inc dword [ebp - 0x24]
mov dword [ebp - 0x1c], 9
cmp dword [ebp - 0x1c], 0x1d
jle 0x434e51
mov dword [ebp - 0x5c], 0x87c3cb87
xor ebx, ebx
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x24]
cmp ecx, edx
mov ecx, dword [ebp - 4]
setg bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x24]
setle dl
xor ebx, ebx
cmp edx, 0x1cc0
setg bl
xor edx, edx
cmp ebx, ecx
setg dl
xor ebx, ebx
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x240]
cmp edx, ecx
mov ecx, dword [ebp - 0x38]
setl bl
sub ecx, ebx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x5c]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0xffffffe8
jmp 0x434e38
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x434e35
push eax
push 0x80c
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffc
jle 0x434e1e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1d
jg 0x434db6
push 2
pop ebx
push 4
pop edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1c
je 0x434d47
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], 0x3e7ed6f1
mov dword [ebp - 0x14], eax
jmp 0x434e7e
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x218], 0x60d2f38
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x434e6d
cmp dword [ebp - 4], eax
jne 0x434e8e
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
xor edx, edx
add esi, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp esi, ecx
setne dl
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], eax
jmp 0x434eb7
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x218], 0x6fe6d39c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x434ea6
mov esi, dword [edi + 4]
mov dword [ebp - 0x24], 0x7a7c
mov dword [ebp - 0x14], 0x70ade21
mov dword [ebp - 0xc], 0x56dfc9b9
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
je 0x434ee7
mov ecx, dword [ebp - 0x24]
xor ecx, ecx
inc ecx
jmp 0x434ee9
mov ecx, eax
sub ecx, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x9cdf
mov ecx, dword [ebp - 0x24]
setle dl
xor ebx, ebx
cmp edx, ecx
mov ecx, 0xac3d6c1d
setl bl
cmp ecx, ebx
sbb ecx, ecx
inc ecx
cmp dword [ebp - 0x24], ecx
jge 0x434f19
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub ecx, 0x1466ac3a
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 2
jl 0x434f48
mov dword [ebp - 0xc], 5
jmp 0x434f40
cmp dword [ebp - 0xc], eax
jne 0x434f88
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x31
jg 0x434f38
jmp 0x434f88
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x434f64
push 0x242c
push 0x1597
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x434f88
push 0x10d0
push 0x38b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_GetMessageA]
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x434fb1
push 0xcd
push 0x1d3e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
mov dword [ebp - 0xc], 9
mov ecx, 0x7c0ce695
mov dword [ebp - 4], 0xf8d1
xor edx, edx
mov dword [ebp - 0x1c], 7
add edi, 8
mov dword [ebp - 0x28], eax
inc edx
mov dword [ebp - 0x20], 0x36ef6f0c
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x2c], 0xcb566e66
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], ecx
mov dword [ebp - 0x158], ecx
mov dword [ebp - 0x154], ecx
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x14], eax
jmp 0x43501a
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xe4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x43500d
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0xc], ecx
jne 0x43502a
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
add ecx, 0x16a2e3a8
imul ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp ecx, edx
setne bl
sub ebx, 0x40ee
neg ebx
sbb ebx, ebx
inc ebx
add ebx, dword [ebp - 4]
cmp ebx, 1
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x2c], eax
je 0x435083
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x158]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
inc dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x158], ecx
add ecx, 0x2123d641
mov dword [ebp - 0xe4], ecx
test esi, esi
jne 0x4350c9
add edi, 8
mov dword [ebp - 0x18], 0xfb0b0297
xor edx, edx
mov dword [ebp - 0x2c], 0xb8d8131d
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x3c], 0x4bd1a6f3
mov dword [ebp - 0x20], 0x34bd47cd
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
cmp ecx, 0x55cc
setg dl
cmp dword [ebp - 0x18], edx
jge 0x435221
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x435119
push 0x182e
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor eax, eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x43512f
push 0x212
call dword [sym.imp.USER32.dll_PostQuitMessage]
xor eax, eax
xor esi, esi
inc esi
cmp dword [ebp - 0x18], eax
je 0x435141
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x18]
mov ecx, esi
jl 0x435143
mov ecx, eax
add ecx, 0x2d50
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
dec ecx
add ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp ecx, 0x7ea1b148
mov ecx, dword [ebp - 0x1c]
setg bl
xor edx, edx
cmp ebx, ecx
setg dl
add edx, dword [ebp - 0x1c]
jne 0x435176
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x2f4fe10e
mov ecx, dword [ebp - 0x18]
setg dl
xor ebx, ebx
cmp edx, ecx
setle bl
xor ecx, ecx
add ebx, dword [ebp - 0x1c]
test ebx, ebx
setg cl
xor edx, edx
cmp ecx, 3
mov ecx, dword [ebp - 0x3c]
setg dl
xor ebx, ebx
cmp edx, esi
setl bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x18]
setg dl
mov dword [ebp - 0x20], edx
xor edx, edx
cmp dword [ebp - 0x20], ecx
setle dl
add edi, dword [ebp - 0x10]
dec dword [ebp - 0x44]
mov dword [ebp - 0x20], edx
jne 0x434cdb
mov dword [ebp - 0x1c], edi
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa52f0]
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x68], eax
push ecx
push eax
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x64], eax
movdqu xmmword [ebp - 0x250], xmm0
mov dword [ebp - 0x60], eax
call fcn.004339c2
mov dword [ebp - 4], 0xb2b534de
mov dword [ebp - 0x2c], 0xea6edad9
mov dword [ebp - 0x14], 0
jmp 0x4352c4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x11
jl 0x43512f
xor esi, esi
push 2
inc esi
pop ebx
push ebx
lea ecx, [ebp - 0x1fc]
call fcn.0043387f
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], 0
jmp 0x435263
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1fc]
mov dword [eax + ecx*4], 0xb64fda7e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x435250
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], 0
jl 0x43529b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 0x689351f2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x4352b6
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], 0
jl 0x43552f
mov dword [ebp - 0xc], 0x3ac9d73d
lea ecx, [ebp - 0x108]
push 3
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x20], 0xfadbacd6
mov dword [ebp - 0xc], eax
jmp 0x43530f
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x108]
mov dword [ecx + edx*4], 0x524be18a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x4352fc
mov dword [ebp - 0xc], eax
jmp 0x43532b
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x22c], 0xfffffff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x43531a
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x68]
cmp dword [edx + ecx*4], eax
jne 0x435379
mov ecx, dword [edx + 0xc]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x2c], ecx
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x30]
mov edx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x2c]
cmp dword [edx + esi*4], ecx
mov ecx, dword [ebp - 0x68]
setge bl
xor edx, edx
cmp dword [ecx + edi*4], ebx
setl dl
xor ecx, ecx
cmp edx, 8
mov edx, eax
setne cl
xor esi, esi
inc esi
cmp ecx, dword [ebp - 0x30]
jl 0x43537b
mov edx, esi
xor ecx, ecx
cmp edx, 0x5f34
setle cl
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 0x30]
jg 0x4353b1
mov dword [ebp - 0x20], 0x266d8ff8
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ecx + edx*4]
mov dword [ebp - 0x20], ecx
jmp 0x435515
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0x98], esi
mov dword [ebp - 0x94], esi
mov dword [ebp - 0x90], esi
mov dword [ebp - 0xc], 3
cmp dword [ebp - 0xc], eax
jl 0x435515
mov dword [ebp - 0x2c], 0x195c588c
mov dword [ebp - 0x3c], 0xd282
mov dword [ebp - 0x14], eax
jmp 0x4353f9
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xcc], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x4353ec
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x68]
cmp dword [ecx + edx*4], eax
je 0x43546f
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x68]
cmp dword [ecx + edx*4], eax
je 0x435468
mov ecx, dword [ebp - 0x30]
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
mov edi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x68]
mov edx, dword [esi + ecx*4]
mov ecx, dword [ebp - 0x108]
cmp edx, dword [ecx + 4]
mov edx, dword [ebp - 0xc]
setge bl
xor ecx, ecx
cmp dword [esi + edi*4], ebx
sete cl
xor ebx, ebx
imul edx, ecx
mov ecx, dword [ebp - 0x68]
cmp edx, dword [ecx + 4]
mov ecx, dword [ebp - 0x30]
setl bl
xor esi, esi
sub ebx, ecx
inc esi
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0x9c]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x30]
mov ecx, esi
jmp 0x435471
mov ecx, eax
mov esi, dword [ebp - 0x228]
xor edx, edx
imul esi, ecx
mov ecx, dword [ebp - 0x30]
cmp esi, ecx
setne dl
mov dword [ebp - 0x20], edx
mov edx, 0xd048
mov edi, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x9c]
neg edi
mov esi, dword [ebp - 0xc8]
sbb edi, edi
sub edx, ecx
mov ecx, dword [ebp - 0x3c]
neg edi
imul esi, edx
add ecx, esi
jne 0x4354bc
cmp dword [ebp - 0x94], eax
jne 0x4354bc
mov ecx, eax
jmp 0x4354bf
xor ecx, ecx
inc ecx
mov esi, dword [ebp - 0x30]
xor edx, edx
cmp edi, ecx
mov ecx, dword [ebp - 0xc8]
push 1
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x9c]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x68]
setl dl
xor ebx, ebx
mov esi, dword [ecx + esi*4]
mov ecx, dword [ebp - 0x30]
sub esi, edx
sub esi, ecx
mov dword [ebp - 4], esi
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp - 4]
cmp ecx, edx
pop esi
setne bl
mov dword [ebp - 0xc8], ebx
dec dword [ebp - 0xc]
jns 0x4353d9
cmp dword [ebp - 0x30], eax
lea ecx, [ebp - 0x108]
call fcn.00433951
dec dword [ebp - 0x30]
push 1
pop esi
jns 0x4352da
lea ecx, [ebp - 0x68]
call fcn.00433951
mov ebx, dword [ebp - 0x1c]
xor eax, eax
mov edi, dword [ebx]
mov dword [ebp - 0x28], esi
mov dword [ebp - 4], 0x2dafbbd
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], eax
jmp 0x43555a
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x74], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x435550
mov byte [ebp - 5], al
cmp byte [ebp - 5], al
je 0x435579
push esi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x74]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], eax
jne 0x435597
mov ecx, dword [ebp - 0x74]
mov edx, eax
imul ecx, dword [ebp - 0x74]
test ecx, ecx
je 0x435599
mov edx, esi
mov ecx, dword [ebp - 0x28]
dec dword [ebp - 0x28]
cmp ecx, edx
mov ecx, dword [ebp - 0x74]
cmovl esi, eax
xor edx, edx
cmp esi, ecx
setne dl
xor ecx, ecx
cmp edx, 0x6c218e99
setle cl
xor edx, edx
cmp ecx, 7
setl dl
mov dword [ebp - 0x6c], edx
test edx, edx
je 0x4355e3
push 2
pop esi
mov dword [ebp - 4], esi
cmp dword [ebp - 4], eax
jl 0x435618
mov ecx, dword [ebp - 4]
cmp dword [ebp + ecx*4 - 0x74], eax
jne 0x435618
dec dword [ebp - 4]
jns 0x4355d3
jmp 0x435618
mov dword [ebp - 0x20], 0xb89b
mov dword [ebp - 0x3c], 5
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x43560f
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [ebp - 0x20]
push 2
mov dword [ebp - 0x3c], eax
pop esi
push 4
pop eax
add ebx, eax
mov dword [ebp - 0x10], 0xbacd7953
push esi
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x1c], ebx
call fcn.0043387f
mov dword [ebp - 0x14], 0xfffffffa
lea ecx, [ebp - 0xc0]
mov dword [ebp - 4], 0xc017f215
mov dword [ebp - 0x28], 0xffffffff
push 3
call fcn.0043387f
mov dword [ebp - 0xc], 9
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x34], 0xe9e5a939
xor ebx, ebx
mov dword [ebp - 0x2c], 0x314d41bd
inc ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0xfffffff8
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x3c], 0xfffffffd
push ebx
call fcn.0043387f
xor eax, eax
mov dword [ebp - 0x18], eax
jmp 0x4356a3
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x12c]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x435694
mov dword [ebp - 0x18], eax
jmp 0x4356bc
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc0]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x4356ad
mov dword [ebp - 0x18], eax
jmp 0x4356d8
mov ecx, dword [ebp - 0x18]
mov dword [ebp + ecx*4 - 0xd4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x4356c7
mov dword [ebp - 0x18], eax
jmp 0x4356f5
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1f0]
mov dword [ecx + edx*4], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x4356e2
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
add esi, 0xffff29d1
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setle dl
xor ebx, ebx
mov dword [ebp - 4], edx
xor esi, esi
mov ecx, dword [ebp - 0x10]
mov edx, 0x2891ba80
sub edx, ecx
inc esi
add edx, dword [ebp - 4]
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x28]
cmp ecx, esi
mov ecx, dword [ebp - 0xc0]
setge bl
xor edx, edx
mov dword [ecx], ebx
mov ecx, dword [ebp - 0x10]
cmp ebx, ecx
sete dl
xor ebx, ebx
mov dword [ebp - 0xc], edx
mov edx, 0xffff
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x12c]
mov dword [ecx + 4], edx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
cmp edx, ecx
setne bl
xor ecx, ecx
cmp ebx, 0x1378
setne cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x12c]
cmp dword [ecx], eax
sete dl
cmp edx, dword [ebp - 0x28]
jg 0x4357aa
mov edx, esi
cmp dword [ebp - 4], eax
jne 0x4357ac
mov edx, eax
mov ecx, dword [ebp - 0x10]
xor ebx, ebx
sub edx, ecx
mov ecx, dword [ebp - 0x2c]
cmp edx, 0x7709c180
push 0xfffffffffffffff9
setl bl
xor edx, edx
cmp ecx, ebx
pop ecx
setge dl
cmp ecx, edx
mov ecx, dword [ebp - 0xc0]
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, dword [ecx]
setl bl
cmp ebx, dword [ebp - 0xc]
jne 0x4357e4
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xd4]
cmp edx, ecx
mov ecx, dword [ebp - 0xd0]
setle bl
xor edx, edx
cmp ebx, ecx
setle dl
dec edx
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0xc0]
xor ecx, ecx
cmp dword [edx + 8], eax
setge cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jne 0x435824
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ebp - 4]
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
inc ebx
mov ecx, dword [ebp - 0x34]
mov dword [edx + 8], eax
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x20], 0xac52cf4
mov dword [ebp - 0xc], 0xfffffff4
cmp dword [ebp - 0xc], 0xffffffe5
je 0x4358e8
mov edi, dword [ebp - 0xc0]
mov dword [ebp - 0x2c], ebx
xor edx, edx
mov dword [ebp - 0x14], 0x33c814b4
mov ecx, dword [ebp - 0x10]
mov dword [edi + 4], 0xe69a7eec
mov dword [ebp - 0x2c], 0xe69a7eec
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x3c]
add ecx, dword [ebp - 0x28]
cmp ecx, 0x6d4b
mov ecx, dword [ebp - 0x44]
setge dl
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 0xd4]
setge bl
xor edx, edx
cmp ecx, ebx
setl dl
xor ecx, ecx
test edx, edx
setg cl
cmp ecx, dword [ebp - 0x14]
je 0x4358b5
cmp dword [ebp - 0x14], eax
je 0x4358b5
xor ebx, ebx
mov esi, eax
inc ebx
mov ecx, dword [ebp - 0x44]
xor edx, edx
cmp ecx, esi
setne dl
cmp edx, dword [ebp - 0x44]
jle 0x4358d0
lea ecx, [ebp - 0x1f0]
call fcn.00433951
lea ecx, [ebp - 0xc0]
call fcn.00433951
lea ecx, [ebp - 0x12c]
call fcn.00433951
mov edx, dword [ebp - 0x1c]
xor ecx, ecx
mov esi, dword [edx]
mov dword [ebp - 0xc], 8
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x17
jl 0x435995
push 0xfffffffffffffff9
pop eax
mov dword [ebp - 4], 0xa3df603f
mov dword [ebp - 4], ecx
jmp 0x435966
mov dword [ebp - 0xc], 0xffffffe3
jmp 0x4359e0
xor ecx, ecx
jmp 0x435b80
xor ebx, ebx
inc ebx
mov dword [ebp + 8], 0xfffffffd
mov dword [ebp + 8], ecx
jmp 0x435ba0
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0xb4], 0xe3245f1d
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x435b8f
mov dword [ebp + 8], ecx
jmp 0x435c59
mov dword [ebp - 0x20], 0x4495
push 2
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0x24], ecx
pop edx
jmp 0x435bd2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x58], 0xd37ad43
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x435bc4
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x58], ecx
jl 0x435c4d
cmp dword [ebp - 0x58], ecx
je 0x435bf5
mov eax, dword [ebp - 0x58]
mov edx, ebx
mov eax, dword [ebp + eax*4 - 0xb4]
mov eax, dword [ebp - 0x20]
jmp 0x435bf7
mov edx, ecx
mov esi, dword [ebp - 0x58]
xor eax, eax
cmp edx, 0x6c37fc05
mov edx, dword [ebp - 0xac]
setl al
sub esi, eax
mov eax, dword [ebp - 0x58]
neg esi
sbb esi, esi
mov eax, dword [ebp + eax*4 - 0xb4]
inc esi
sub edx, esi
mov esi, dword [ebp - 0x58]
add eax, edx
add esi, eax
mov eax, dword [ebp - 0x58]
neg esi
sbb esi, esi
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xb4]
inc esi
cmp eax, esi
mov eax, dword [ebp - 0x58]
setne dl
mov dword [ebp + eax*4 - 0xb4], edx
mov dword [ebp - 0x3c], edx
dec dword [ebp - 0x58]
jns 0x435bdf
mov edx, dword [ebp + 8]
mov dword [ebp - 0xac], edx
inc dword [ebp + 8]
cmp dword [ebp + 8], 0x17
jle 0x435bae
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret