Function at 0x442364
Capabilities:
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1334
call fcn.00491f50
push esi
push edi
mov dword [ebp - 0x140], 9
push 3
lea ecx, [ebp - 0xda8]
call fcn.00410610
mov dword [ebp - 0xa48], 0x74da8628
mov dword [ebp - 0x50], 0
jmp 0x4423a4
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 4
jge 0x4423ba
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0xd8c], 0x10c9
jmp 0x44239d
mov dword [ebp - 0x50], 0
jmp 0x4423ca
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x4423e6
push dword [ebp - 0x50]
lea ecx, [ebp - 0xda8]
call fcn.004106b1
mov dword [eax], 0x9275
jmp 0x4423c3
mov dword [ebp - 0x140], 3
jmp 0x4423ff
mov eax, dword [ebp - 0x140]
dec eax
mov dword [ebp - 0x140], eax
cmp dword [ebp - 0x140], 0
jl 0x442590
mov dword [ebp - 0x78], 0xfffffffd
mov dword [ebp - 0xb8c], 0xa7a81a82
mov dword [ebp - 0x78], 0
jmp 0x44242d
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jg 0x442576
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xd8c]
mov dword [ebp - 0x598], eax
mov eax, dword [ebp - 0x140]
mov ecx, dword [ebp - 0x598]
mov dword [ebp + eax*4 - 0xd8c], ecx
cmp dword [ebp - 0x598], 0
jne 0x44253c
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0xd8c]
mov dword [ebp - 0xfe0], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp + ecx*4 - 0xd8c]
cmp dword [ebp + eax*4 - 0xd8c], ecx
jne 0x442499
mov dword [ebp - 0xa30], 1
jmp 0x4424a0
and dword [ebp - 0xa30], 0
imul eax, dword [ebp - 0xa30], 0x87a7
test eax, eax
je 0x4424cc
push 1
lea ecx, [ebp - 0xda8]
call fcn.004106b1
cmp dword [eax], 0
je 0x4424cc
mov dword [ebp - 0xa38], 1
jmp 0x4424d3
and dword [ebp - 0xa38], 0
cmp dword [ebp - 0xa38], 0x8ed4
je 0x4424eb
mov dword [ebp - 0xa40], 1
jmp 0x4424f2
and dword [ebp - 0xa40], 0
mov eax, dword [ebp - 0xa40]
mov dword [ebp - 0xa48], eax
mov esi, dword [ebp - 0xa48]
push 1
lea ecx, [ebp - 0xda8]
call fcn.004106b1
cmp esi, dword [eax]
jne 0x442521
mov dword [ebp - 0xa5c], 1
jmp 0x442528
and dword [ebp - 0xa5c], 0
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xa5c], eax
jl 0x44253c
and dword [ebp - 0xa64], 0
jmp 0x442546
mov dword [ebp - 0xa64], 1
cmp dword [ebp - 0xa64], 0x63e31551
jge 0x44255e
mov dword [ebp - 0xa6c], 1
jmp 0x442565
and dword [ebp - 0xa6c], 0
mov eax, dword [ebp - 0xa6c]
mov dword [ebp - 0xb8c], eax
jmp 0x442426
mov eax, dword [ebp - 0x140]
cmp dword [ebp + eax*4 - 0xd8c], 0
je 0x44258b
jmp 0x4423f2
jmp 0x4423f2
lea ecx, [ebp - 0xda8]
call fcn.004106ac
mov dword [ebp - 0x300], 0xe1757117
push 2
lea ecx, [ebp - 0x1160]
call fcn.00410610
mov dword [ebp - 0x1280], 0xbff1eb7e
mov dword [ebp - 0x204], 0
jmp 0x4425d5
mov eax, dword [ebp - 0x204]
inc eax
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 2
jge 0x4425f7
push dword [ebp - 0x204]
lea ecx, [ebp - 0x1160]
call fcn.004106b1
mov dword [eax], 1
jmp 0x4425c8
mov dword [ebp - 0x300], 0
jmp 0x442610
mov eax, dword [ebp - 0x300]
dec eax
mov dword [ebp - 0x300], eax
cmp dword [ebp - 0x300], 0xfffffff8
jge 0x4428e0
push 3
lea ecx, [ebp - 0xab4]
call fcn.00410610
mov dword [ebp - 0x2a0], 1
mov dword [ebp - 0x20c], 0
jmp 0x44264d
mov eax, dword [ebp - 0x20c]
inc eax
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 3
jge 0x44266f
push dword [ebp - 0x20c]
lea ecx, [ebp - 0xab4]
call fcn.004106b1
mov dword [eax], 0xe1e2c0d3
jmp 0x442640
push 0
lea ecx, [ebp - 0xab4]
call fcn.004106b1
and dword [eax], 0
jmp 0x4426a5
push 0
lea ecx, [ebp - 0xab4]
call fcn.004106b1
mov dword [ebp - 0xa74], eax
mov eax, dword [ebp - 0xa74]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xa74]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xab4]
call fcn.004106b1
cmp dword [eax], 1
jg 0x442814
mov dword [ebp - 0x148], 0xfffffffa
mov dword [ebp - 0x148], 1
jmp 0x4426de
mov eax, dword [ebp - 0x148]
dec eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
jl 0x44280f
mov dword [ebp - 0x3a4], 0
cmp dword [ebp - 0x3a4], 0x7fc0549e
jl 0x44270d
mov dword [ebp - 0xa7c], 1
jmp 0x442714
and dword [ebp - 0xa7c], 0
mov eax, dword [ebp - 0xa7c]
sub eax, 0x4bb489f7
cmp eax, dword [ebp - 0x148]
jl 0x442733
mov dword [ebp - 0xa84], 1
jmp 0x44273a
and dword [ebp - 0xa84], 0
mov eax, dword [ebp - 0x3a4]
cmp dword [ebp - 0xa84], eax
jge 0x442754
mov dword [ebp - 0xa8c], 1
jmp 0x44275b
and dword [ebp - 0xa8c], 0
cmp dword [ebp - 0xa8c], 0x3530
jge 0x442773
mov dword [ebp - 0xa94], 1
jmp 0x44277a
and dword [ebp - 0xa94], 0
push 0
lea ecx, [ebp - 0xab4]
call fcn.004106b1
mov ecx, dword [ebp - 0xa94]
cmp ecx, dword [eax]
jge 0x44279d
mov dword [ebp - 0xa9c], 1
jmp 0x4427a4
and dword [ebp - 0xa9c], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0xa9c], eax
jge 0x4427be
mov dword [ebp - 0xaa4], 1
jmp 0x4427c5
and dword [ebp - 0xaa4], 0
push 1
lea ecx, [ebp - 0xab4]
call fcn.004106b1
mov ecx, dword [ebp - 0xaa4]
cmp ecx, dword [eax]
jge 0x4427e8
mov dword [ebp - 0xacc], 1
jmp 0x4427ef
and dword [ebp - 0xacc], 0
push 0
lea ecx, [ebp - 0xab4]
call fcn.004106b1
mov ecx, dword [ebp - 0xacc]
add ecx, dword [eax]
mov dword [ebp - 0x3a4], ecx
jmp 0x4426d1
jmp 0x442681
mov dword [ebp - 0x2a0], 0x12
jmp 0x44282d
mov eax, dword [ebp - 0x2a0]
dec eax
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x2a0], 0xffffffe9
jge 0x4428d0
push 3
lea ecx, [ebp - 0xf10]
call fcn.00410610
mov dword [ebp - 0x214], 0
jmp 0x442860
mov eax, dword [ebp - 0x214]
inc eax
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 3
jge 0x442882
push dword [ebp - 0x214]
lea ecx, [ebp - 0xf10]
call fcn.004106b1
mov dword [eax], 7
jmp 0x442853
mov byte [ebp - 0xdf], 0
movzx eax, byte [ebp - 0xdf]
test eax, eax
je 0x44289c
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
push 2
lea ecx, [ebp - 0xf10]
call fcn.004106b1
mov dword [ebp - 0xad4], eax
mov eax, dword [ebp - 0xad4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xad4]
mov dword [ecx], eax
lea ecx, [ebp - 0xf10]
call fcn.004106ac
jmp 0x442820
lea ecx, [ebp - 0xab4]
call fcn.004106ac
jmp 0x442603
lea ecx, [ebp - 0x1160]
call fcn.004106ac
mov dword [ebp - 0xadc], 0x1d925b0e
push 1
lea ecx, [ebp - 0xde4]
call fcn.00410610
mov dword [ebp - 0x64], 0
jmp 0x442912
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x442928
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x11d8], 1
jmp 0x44290b
mov dword [ebp - 0x64], 0
jmp 0x442938
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x442954
push dword [ebp - 0x64]
lea ecx, [ebp - 0xde4]
call fcn.004106b1
mov dword [eax], 0xfffffff9
jmp 0x442931
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x11d8]
mov dword [ebp - 0xadc], eax
mov esi, dword [ebp - 0xadc]
push 0
lea ecx, [ebp - 0xde4]
call fcn.004106b1
mov dword [eax], esi
push 0
lea ecx, [ebp - 0xde4]
call fcn.004106b1
mov dword [eax], 9
lea ecx, [ebp - 0xde4]
call fcn.004106ac
mov dword [ebp - 0x160], 9
push 3
lea ecx, [ebp - 0xdb4]
call fcn.00410610
mov dword [ebp - 0x83c], 0x74da8628
mov dword [ebp - 0xe4], 0xfffffff8
mov dword [ebp - 0xcdc], 0xa5d732ad
mov dword [ebp - 0xe4], 0xfffffff7
jmp 0x4429e8
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x1b
jle 0x442b1c
mov dword [ebp - 0x170], 0x70cd
mov dword [ebp - 0x420], 0xffffffff
mov dword [ebp - 0x7c4], 0x7e6aa165
mov eax, dword [ebp - 0x420]
cmp dword [ebp - 0x170], eax
jne 0x442b01
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x7c4], eax
cmp dword [ebp - 0x7c4], 0
je 0x442a8c
mov eax, dword [ebp - 0x170]
sub eax, 0x3e52
cmp eax, 0x5d56974e
je 0x442a58
mov dword [ebp - 0x9f0], 1
jmp 0x442a5f
and dword [ebp - 0x9f0], 0
mov eax, dword [ebp - 0xe4]
cmp dword [ebp - 0x9f0], eax
jg 0x442a79
mov dword [ebp - 0xd24], 1
jmp 0x442a80
and dword [ebp - 0xd24], 0
cmp dword [ebp - 0xe4], 0x6b5b
jg 0x442a9e
cmp dword [ebp - 0x170], 0
jne 0x442a9e
and dword [ebp - 0xcd4], 0
jmp 0x442aa8
mov dword [ebp - 0xcd4], 1
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x10c8], eax
cmp dword [ebp - 0x170], 0xf86f25db
jae 0x442acc
mov dword [ebp - 0xd54], 1
jmp 0x442ad3
and dword [ebp - 0xd54], 0
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x11c4], eax
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x10d0], eax
xor eax, eax
inc eax
neg eax
cmp eax, dword [ebp - 0xe4]
jl 0x442b01
and dword [ebp - 0x48c], 0
jmp 0x442b0b
mov dword [ebp - 0x48c], 1
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0xcdc], eax
jmp 0x4429db
mov byte [ebp - 0x12b], 0
movzx eax, byte [ebp - 0x12b]
test eax, eax
je 0x442b36
push 0
call dword [sym.imp.USER32.dll_SetCursor]
mov dword [ebp - 0x2a4], 9
push 1
lea ecx, [ebp - 0x44c]
call fcn.00410610
mov dword [ebp - 0x8c], 0
jmp 0x442b66
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 3
jge 0x442b82
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0xb04], 1
jmp 0x442b59
mov dword [ebp - 0x8c], 0
jmp 0x442b9b
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x442bbd
push dword [ebp - 0x8c]
lea ecx, [ebp - 0x44c]
call fcn.004106b1
mov dword [eax], 1
jmp 0x442b8e
mov dword [ebp - 0x2a4], 0
jmp 0x442bd6
mov eax, dword [ebp - 0x2a4]
dec eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 0xffffffe8
jg 0x442fe0
mov dword [ebp - 0x24], 0x914d2edc
mov dword [ebp - 0xad0], 0
mov dword [ebp - 0x24], 2
jmp 0x442c04
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x442fdb
mov dword [ebp - 0x1b0], 0x162c9cc1
mov dword [ebp - 0x1cc], 0xb5c6f8b8
mov dword [ebp - 0x1b0], 2
jmp 0x442c3b
mov eax, dword [ebp - 0x1b0]
dec eax
mov dword [ebp - 0x1b0], eax
cmp dword [ebp - 0x1b0], 0
jl 0x442f48
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb04]
mov dword [ebp - 0x9f8], eax
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [ebp - 0x9f8]
mov dword [ebp + eax*4 - 0xb04], ecx
cmp dword [ebp - 0x9f8], 1
jne 0x442c80
mov dword [ebp - 0x494], 1
jmp 0x442c87
and dword [ebp - 0x494], 0
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
mov ecx, dword [ebp - 0x494]
mov dword [eax], ecx
mov dword [ebp - 0x1cc], 0
jmp 0x442cb5
mov eax, dword [ebp - 0x1cc]
inc eax
mov dword [ebp - 0x1cc], eax
cmp dword [ebp - 0x1cc], 2
jg 0x442f43
mov dword [ebp - 0x6c], 0xfffffffb
mov dword [ebp - 0xd2c], 0x2a4e6309
mov dword [ebp - 0x6c], 0
jmp 0x442ce3
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x442d02
mov dword [ebp - 0xa00], 0x5ab06c0e
mov eax, dword [ebp - 0xa00]
inc eax
mov dword [ebp - 0xa00], eax
jmp 0x442cdc
mov dword [ebp - 0x6c], 0
jmp 0x442d12
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x442f3e
mov dword [ebp - 0xbc], 1
mov dword [ebp - 0xbc], 0
jmp 0x442d3f
mov eax, dword [ebp - 0xbc]
dec eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0
jl 0x442d62
push dword [ebp - 0xbc]
lea ecx, [ebp - 0x44c]
call fcn.004106b1
cmp dword [eax], 0
je 0x442d60
jmp 0x442d62
jmp 0x442d32
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb04]
mov dword [ebp - 0x123c], eax
mov esi, dword [ebp - 0xd2c]
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
cmp esi, dword [eax]
je 0x442d9e
mov eax, 0x1832d748
test eax, eax
je 0x442d9e
mov dword [ebp - 0x49c], 1
jmp 0x442da5
and dword [ebp - 0x49c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x49c], eax
je 0x442dbc
mov dword [ebp - 0xa08], 1
jmp 0x442dc3
and dword [ebp - 0xa08], 0
mov eax, dword [ebp - 0xa08]
add eax, 0xeeb4
sub eax, dword [ebp - 0x24]
jne 0x442de5
cmp dword [ebp - 0xbc], 0
jne 0x442de5
and dword [ebp - 0x4a4], 0
jmp 0x442def
mov dword [ebp - 0x4a4], 1
cmp dword [ebp - 0x4a4], 0x44fb66c1
jle 0x442e07
mov dword [ebp - 0xa10], 1
jmp 0x442e0e
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xa10], eax
jne 0x442e25
mov dword [ebp - 0x4ac], 1
jmp 0x442e2c
and dword [ebp - 0x4ac], 0
cmp dword [ebp - 0x4ac], 0
jb 0x442e41
mov dword [ebp - 0xa18], 1
jmp 0x442e48
and dword [ebp - 0xa18], 0
cmp dword [ebp - 0xa18], 0x312b9482
jne 0x442e60
mov dword [ebp - 0x4b4], 1
jmp 0x442e67
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x4b4]
sub eax, 4
cmp eax, dword [ebp - 0xbc]
je 0x442e84
mov dword [ebp - 0xa20], 1
jmp 0x442e8b
and dword [ebp - 0xa20], 0
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
mov ecx, dword [ebp - 0xa20]
sub ecx, dword [eax]
je 0x442ec0
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
cmp dword [eax], 0
je 0x442ec0
mov dword [ebp - 0xa28], 1
jmp 0x442ec7
and dword [ebp - 0xa28], 0
cmp dword [ebp - 0xa28], 0xfffffffe
jne 0x442ee2
cmp dword [ebp - 0x1cc], 0
jne 0x442ee2
and dword [ebp - 0x4f0], 0
jmp 0x442eec
mov dword [ebp - 0x4f0], 1
cmp dword [ebp - 0x4f0], 7
ja 0x442f01
mov dword [ebp - 0xb90], 1
jmp 0x442f08
and dword [ebp - 0xb90], 0
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
cmp dword [eax], 5
je 0x442f26
mov dword [ebp - 0x4c4], 1
jmp 0x442f2d
and dword [ebp - 0x4c4], 0
mov eax, dword [ebp - 0x4c4]
mov dword [ebp - 0xbc], eax
jmp 0x442d0b
jmp 0x442ca8
jmp 0x442c2e
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xb04], 0
jne 0x442f7f
mov dword [ebp - 0xad0], 0xffff
mov eax, dword [ebp - 0xad0]
sub eax, 0xcfb9
mov ecx, dword [ebp - 0x24]
cmp eax, dword [ebp + ecx*4 - 0xb04]
jge 0x442f7f
and dword [ebp - 0x4cc], 0
jmp 0x442f89
mov dword [ebp - 0x4cc], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xb04]
add eax, dword [ebp - 0x4cc]
jne 0x442faa
cmp dword [ebp - 0x24], 0
jne 0x442faa
and dword [ebp - 0x7cc], 0
jmp 0x442fb4
mov dword [ebp - 0x7cc], 1
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0xb04]
add esi, dword [ebp - 0x7cc]
push 0
lea ecx, [ebp - 0x44c]
call fcn.004106b1
mov dword [eax], esi
jmp 0x442bfd
jmp 0x442bc9
lea ecx, [ebp - 0x44c]
call fcn.004106ac
mov dword [ebp - 0xac], 0
jmp 0x443004
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 4
jge 0x443020
mov eax, dword [ebp - 0xac]
mov dword [ebp + eax*4 - 0xd9c], 0x10c9
jmp 0x442ff7
push 2
lea ecx, [ebp - 0x1170]
call fcn.00410610
mov dword [ebp - 0x2ac], 0xc184c506
mov dword [ebp - 0x21c], 0
jmp 0x443050
mov eax, dword [ebp - 0x21c]
inc eax
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x21c], 2
jge 0x44306f
push dword [ebp - 0x21c]
lea ecx, [ebp - 0x1170]
call fcn.004106b1
and dword [eax], 0
jmp 0x443043
mov dword [ebp - 0x2ac], 1
jmp 0x443088
mov eax, dword [ebp - 0x2ac]
dec eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 0
jl 0x4430b7
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x4430b5
push 0x162f
push 0x1971
push 0
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x44307b
lea ecx, [ebp - 0x1170]
call fcn.004106ac
mov dword [ebp - 0xac], 0
jmp 0x4430db
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x4430fd
push dword [ebp - 0xac]
lea ecx, [ebp - 0xdb4]
call fcn.004106b1
mov dword [eax], 0x9275
jmp 0x4430ce
mov dword [ebp - 0x160], 3
jmp 0x443116
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jl 0x444400
mov dword [ebp - 0xcc], 0xec2e0cf5
mov dword [ebp - 0x7d4], 0xffff
mov byte [ebp - 0xd3], 0
movzx eax, byte [ebp - 0xd3]
test eax, eax
je 0x443151
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov dword [ebp - 0xcc], 0xffffffe4
jmp 0x44316a
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x1a
jge 0x443408
push 2
lea ecx, [ebp - 0xb88]
call fcn.00410610
mov dword [ebp - 0x94], 0xd86e52d8
mov dword [ebp - 0x7dc], 0xfffffffb
push 1
lea ecx, [ebp - 0xebc]
call fcn.00410610
mov dword [ebp - 0x74], 0
jmp 0x4431b5
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x4431d1
push dword [ebp - 0x74]
lea ecx, [ebp - 0xb88]
call fcn.004106b1
mov dword [eax], 0xfffffff9
jmp 0x4431ae
mov dword [ebp - 0x74], 0
jmp 0x4431e1
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x4431fd
push dword [ebp - 0x74]
lea ecx, [ebp - 0xebc]
call fcn.004106b1
mov dword [eax], 0x236728ad
jmp 0x4431da
mov dword [ebp - 0x94], 1
jmp 0x443216
mov eax, dword [ebp - 0x94]
dec eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jl 0x4433ed
push dword [ebp - 0x94]
lea ecx, [ebp - 0xb88]
call fcn.004106b1
cmp dword [eax], 0
je 0x4432e9
push dword [ebp - 0x94]
lea ecx, [ebp - 0xb88]
call fcn.004106b1
mov ecx, dword [ebp - 0xcc]
cmp dword [eax], ecx
jg 0x443264
mov dword [ebp - 0x4d4], 1
jmp 0x44326b
and dword [ebp - 0x4d4], 0
cmp dword [ebp - 0x4d4], 0xfffffffa
ja 0x443286
mov eax, 0x5671
test eax, eax
jne 0x443286
and dword [ebp - 0x94c], 0
jmp 0x443290
mov dword [ebp - 0x94c], 1
push dword [ebp - 0x94]
lea ecx, [ebp - 0xb88]
call fcn.004106b1
mov eax, dword [eax]
cmp eax, dword [ebp - 0x94c]
jge 0x4432b7
mov dword [ebp - 0x4dc], 1
jmp 0x4432be
and dword [ebp - 0x4dc], 0
mov eax, dword [ebp - 0x4dc]
mov dword [ebp - 0x7d4], eax
mov eax, dword [ebp - 0x7d4]
add eax, dword [ebp - 0xcc]
cmp eax, 0x3b37
jle 0x4432e9
mov dword [ebp - 0x4e4], 1
jmp 0x4432f0
and dword [ebp - 0x4e4], 0
mov eax, dword [ebp - 0x4e4]
dec eax
cmp eax, 0x6c71
jge 0x44330a
mov dword [ebp - 0xa0c], 1
jmp 0x443311
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xa0c], eax
jle 0x44332b
mov dword [ebp - 0x4ec], 1
jmp 0x443332
and dword [ebp - 0x4ec], 0
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x7dc], eax
cmp dword [ebp - 0x7dc], 0
je 0x44335c
mov eax, 0xc0e07525
test eax, eax
je 0x44335c
mov dword [ebp - 0x4f4], 1
jmp 0x443363
and dword [ebp - 0x4f4], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x4f4], eax
jl 0x44337d
mov dword [ebp - 0xb94], 1
jmp 0x443384
and dword [ebp - 0xb94], 0
push dword [ebp - 0x94]
lea ecx, [ebp - 0xb88]
call fcn.004106b1
mov eax, 0x7d0d
cmp eax, 0xffffffff
jg 0x4433ab
mov dword [ebp - 0x954], 1
jmp 0x4433b2
and dword [ebp - 0x954], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x954], eax
jg 0x4433cc
mov dword [ebp - 0x4fc], 1
jmp 0x4433d3
and dword [ebp - 0x4fc], 0
push 0
lea ecx, [ebp - 0xebc]
call fcn.004106b1
mov ecx, dword [ebp - 0x4fc]
mov dword [eax], ecx
jmp 0x443209
lea ecx, [ebp - 0xebc]
call fcn.004106ac
lea ecx, [ebp - 0xb88]
call fcn.004106ac
jmp 0x44315d
mov dword [ebp - 0x54], 0xfffffffd
mov dword [ebp - 0x46c], 0x5bb2c213
mov dword [ebp - 0x468], 0x5bb2c213
mov dword [ebp - 0x464], 0x5bb2c213
mov dword [ebp - 0x460], 0x5bb2c213
mov dword [ebp - 0xc4], 9
mov dword [ebp - 0xc4], 0
jmp 0x44345a
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 3
jg 0x4436c2
push 3
lea ecx, [ebp - 0xb1c]
call fcn.00410610
mov dword [ebp - 0x224], 0
jmp 0x44348d
mov eax, dword [ebp - 0x224]
inc eax
mov dword [ebp - 0x224], eax
cmp dword [ebp - 0x224], 3
jge 0x4434ac
push dword [ebp - 0x224]
lea ecx, [ebp - 0xb1c]
call fcn.004106b1
or dword [eax], 0xffffffff
jmp 0x443480
push 0
lea ecx, [ebp - 0xb1c]
call fcn.004106b1
and dword [eax], 0
jmp 0x4434e2
push 0
lea ecx, [ebp - 0xb1c]
call fcn.004106b1
mov dword [ebp - 0x7e4], eax
mov eax, dword [ebp - 0x7e4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x7e4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb1c]
call fcn.004106b1
cmp dword [eax], 3
jg 0x443695
mov dword [ebp - 0x2b4], 0
jmp 0x443511
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x44352d
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0x3d0], 6
jmp 0x443504
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x3d0], 3
jmp 0x44355b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x3d0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x3d0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x3d0], 0
jl 0x443690
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0x46c]
mov dword [ebp - 0x10d8], eax
push 4
pop eax
imul eax, eax, 3
imul eax, dword [ebp + eax - 0x46c], 0xf609
test eax, eax
je 0x443657
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d0], 0
je 0x443657
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp + eax*4 - 0x46c]
mov dword [ebp - 0xf94], eax
mov eax, dword [ebp - 0xc4]
cmp dword [ebp + eax*4 - 0x46c], 0x98d2
jg 0x4435e1
mov dword [ebp - 0xb9c], 1
jmp 0x4435e8
and dword [ebp - 0xb9c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x46c]
mov dword [ebp - 0xf9c], eax
mov eax, dword [ebp - 0xc4]
cmp dword [ebp + eax*4 - 0x46c], 0
je 0x443626
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d0], 0
je 0x443626
mov dword [ebp - 0x504], 1
jmp 0x44362d
and dword [ebp - 0x504], 0
imul eax, dword [ebp - 0x504], 0xfbeb
test eax, eax
je 0x443657
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x3d0], 0
je 0x443657
mov dword [ebp - 0xba4], 1
jmp 0x44365e
and dword [ebp - 0xba4], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x46c]
mov dword [ebp - 0xfa4], eax
push 0
lea ecx, [ebp - 0xb1c]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x46c], 0xbe3d0e72
jmp 0x443540
jmp 0x4434be
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x46c], 0
je 0x4436b2
lea ecx, [ebp - 0xb1c]
call fcn.004106ac
jmp 0x4436c2
lea ecx, [ebp - 0xb1c]
call fcn.004106ac
jmp 0x44344d
mov dword [ebp - 0xbe4], 0xa7a81a82
mov dword [ebp - 0x150], 0xfffffff8
mov dword [ebp - 0xa70], 0xfffffff9
mov dword [ebp - 0x50c], 0x466a
mov dword [ebp - 0x430], 0x813c27f3
mov dword [ebp - 0x428], 0x8bbd1883
mov dword [ebp - 0x22c], 0
jmp 0x443717
mov eax, dword [ebp - 0x22c]
inc eax
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 1
jge 0x443733
mov eax, dword [ebp - 0x22c]
mov dword [ebp + eax*4 - 0xb8], 0xffffffff
jmp 0x44370a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb8], 0
jne 0x443855
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0xfac], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
imul eax, dword [ebp - 0x150]
test eax, eax
jne 0x443787
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xb8], 0
je 0x443787
mov dword [ebp - 0xbac], 1
jmp 0x44378e
and dword [ebp - 0xbac], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
mov dword [ebp - 0xfb4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
mov dword [ebp - 0xfbc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
mov dword [ebp - 0xfc4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
sub eax, 0x6335
mov dword [ebp - 0xa70], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb8]
cmp dword [ebp - 0xa70], eax
jg 0x443800
mov dword [ebp - 0xbb4], 1
jmp 0x443807
and dword [ebp - 0xbb4], 0
mov dword [ebp - 0x50c], 0xfffd
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x430], eax
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x430], eax
jle 0x443837
mov dword [ebp - 0x7ec], 1
jmp 0x44383e
and dword [ebp - 0x7ec], 0
mov eax, dword [ebp - 0x150]
cmp dword [ebp - 0x7ec], eax
jl 0x443855
and dword [ebp - 0x514], 0
jmp 0x44385f
mov dword [ebp - 0x514], 1
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x514], eax
jge 0x443879
mov dword [ebp - 0x95c], 1
jmp 0x443880
and dword [ebp - 0x95c], 0
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x95c]
jge 0x44389a
mov dword [ebp - 0x51c], 1
jmp 0x4438a1
and dword [ebp - 0x51c], 0
mov eax, dword [ebp - 0x428]
cmp dword [ebp - 0x51c], eax
jne 0x4438b8
cmp dword [ebp - 0x430], 0
jne 0x4438ca
cmp dword [ebp - 0x150], 0
jne 0x4438ca
and dword [ebp - 0x7f4], 0
jmp 0x4438d4
mov dword [ebp - 0x7f4], 1
mov eax, dword [ebp - 0x7f4]
mov dword [ebp - 0x150], eax
mov dword [ebp - 0xfcc], 0
push 3
lea ecx, [ebp - 0x1180]
call fcn.00410610
mov dword [ebp - 0xfd4], 0xffffffff
mov dword [ebp - 0xfdc], 0x1a4e
mov dword [ebp - 0xfe4], 2
mov dword [ebp - 0xfec], 0xfa55
mov dword [ebp - 0x524], 0x9e56
mov dword [ebp - 0x7c], 0
jmp 0x443939
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x44394f
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0xff4], 0x4f01
jmp 0x443932
mov dword [ebp - 0x7c], 0
jmp 0x44395f
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x44397b
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x1180]
call fcn.004106b1
mov dword [eax], 0xa75c19c5
jmp 0x443958
mov eax, dword [ebp - 0x524]
inc eax
mov dword [ebp - 0x524], eax
lea ecx, [ebp - 0x1180]
call fcn.004106ac
mov dword [ebp - 0x54], 0
jmp 0x4439a3
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 3
jg 0x4443e6
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x534], 0x511ecbfc
push 2
lea ecx, [ebp - 0xdf0]
call fcn.00410610
mov dword [ebp - 0xa4], 0
jmp 0x4439e4
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x443a00
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0xc5c], 0xffffffff
jmp 0x4439d7
mov dword [ebp - 0xa4], 0
jmp 0x443a19
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x443a3b
push dword [ebp - 0xa4]
lea ecx, [ebp - 0xdf0]
call fcn.004106b1
mov dword [eax], 0x5adb
jmp 0x443a0c
mov dword [ebp - 0x10], 3
jmp 0x443a4b
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff3
jle 0x443a68
mov dword [ebp - 0xbbc], 0x83c8
cmp dword [ebp - 0xbbc], 0
je 0x443a66
jmp 0x443a68
jmp 0x443a44
mov dword [ebp - 0x10], 0
jmp 0x443a78
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jg 0x443d29
mov dword [ebp - 0x44], 0x22e6e7f7
mov dword [ebp - 0x52c], 0
mov dword [ebp - 0xbcc], 0
mov byte [ebp - 0xd5], 0
movzx eax, byte [ebp - 0xd5]
test eax, eax
je 0x443abc
push 0x644
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x44], 0
jmp 0x443acc
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x443d24
mov dword [ebp - 0x190], 0x86bdae89
mov dword [ebp - 0x544], 0xacdd1f66
mov dword [ebp - 0x96c], 0xfffffff6
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xc5c], 0
jne 0x443b10
cmp dword [ebp - 0x10], 0xffffffff
jg 0x443b10
and dword [ebp - 0xbc4], 0
jmp 0x443b1a
mov dword [ebp - 0xbc4], 1
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0xffc], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc5c]
mov dword [ebp - 0x1004], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc5c]
mov dword [ebp - 0x100c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1014], eax
cmp dword [ebp - 0x10], 2
jne 0x443b64
cmp dword [ebp - 0x44], 0
jne 0x443b64
and dword [ebp - 0xa14], 0
jmp 0x443b6e
mov dword [ebp - 0xa14], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xc5c]
mov dword [ebp - 0x101c], eax
mov eax, dword [ebp - 0x52c]
mov dword [ebp - 0x1024], eax
imul eax, dword [ebp - 0x52c], 0x5e4d
cmp eax, dword [ebp - 0x44]
jge 0x443ba5
mov dword [ebp - 0x7fc], 1
jmp 0x443bac
and dword [ebp - 0x7fc], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x7fc], eax
jg 0x443bbb
cmp dword [ebp - 0x10], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xc5c]
cmp dword [ebp - 0x534], eax
je 0x443be2
cmp dword [ebp - 0x534], 0
jne 0x443be2
and dword [ebp - 0x964], 0
jmp 0x443bec
mov dword [ebp - 0x964], 1
cmp dword [ebp - 0x964], 0x38d6
jge 0x443c04
mov dword [ebp - 0x53c], 1
jmp 0x443c0b
and dword [ebp - 0x53c], 0
mov eax, dword [ebp - 0x53c]
mov dword [ebp - 0x190], eax
mov esi, dword [ebp - 0x190]
push 1
lea ecx, [ebp - 0xdf0]
call fcn.004106b1
mov dword [eax], esi
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x102c], eax
push 1
lea ecx, [ebp - 0xdf0]
call fcn.004106b1
cmp dword [eax], 0
je 0x443c5f
cmp dword [ebp - 0x190], 0
je 0x443c5f
mov dword [ebp - 0x804], 1
jmp 0x443c66
and dword [ebp - 0x804], 0
cmp dword [ebp - 0x804], 0x737b
jg 0x443c7e
mov dword [ebp - 0x80c], 1
jmp 0x443c85
and dword [ebp - 0x80c], 0
mov dword [ebp - 0x544], 0xaca6
cmp dword [ebp - 0x544], 0xeef1
jle 0x443ca7
mov dword [ebp - 0xaa0], 1
jmp 0x443cae
and dword [ebp - 0xaa0], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xaa0], eax
jge 0x443cc5
mov dword [ebp - 0x54c], 1
jmp 0x443ccc
and dword [ebp - 0x54c], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x54c]
mov ecx, dword [ebp - 0x80c]
sub ecx, eax
mov dword [ebp - 0x190], ecx
cmp dword [ebp - 0x190], 4
ja 0x443cf8
mov dword [ebp - 0x554], 1
jmp 0x443cff
and dword [ebp - 0x554], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x554]
mov dword [ebp - 0x96c], eax
cmp dword [ebp - 0x96c], 0
mov dword [ebp - 0xbcc], 0xfffffffe
jmp 0x443ac5
jmp 0x443a71
lea ecx, [ebp - 0xdf0]
call fcn.004106ac
push 1
lea ecx, [ebp - 0x354]
call fcn.00410610
mov dword [ebp - 0x40], 0x81c2900
mov dword [ebp - 0x2c4], 0xe5411aa8
mov dword [ebp - 0x23c], 0xe0e3cec3
mov dword [ebp - 0x2bc], 0
jmp 0x443d75
mov eax, dword [ebp - 0x2bc]
inc eax
mov dword [ebp - 0x2bc], eax
cmp dword [ebp - 0x2bc], 1
jge 0x443d97
push dword [ebp - 0x2bc]
lea ecx, [ebp - 0x354]
call fcn.004106b1
mov dword [eax], 0x1713b910
jmp 0x443d68
mov dword [ebp - 0x40], 0
jmp 0x443da7
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jl 0x44429c
mov dword [ebp - 0x38], 0x26a056eb
mov dword [ebp - 0x2cc], 0x4b748abb
mov dword [ebp - 0x178], 0xd7582ba8
mov dword [ebp - 0x574], 0
push 3
lea ecx, [ebp - 0xed4]
call fcn.00410610
mov dword [ebp - 0x234], 0
jmp 0x443dfc
mov eax, dword [ebp - 0x234]
inc eax
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 3
jge 0x443e1e
push dword [ebp - 0x234]
lea ecx, [ebp - 0xed4]
call fcn.004106b1
mov dword [eax], 0x3fccfb42
jmp 0x443def
push dword [ebp - 0x40]
lea ecx, [ebp - 0x354]
call fcn.004106b1
cmp dword [eax], 0
je 0x443fa3
mov eax, 0x55467101
test eax, eax
je 0x443e9a
push 0
lea ecx, [ebp - 0x354]
call fcn.004106b1
push dword [ebp - 0x40]
lea ecx, [ebp - 0x354]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x354]
call fcn.004106b1
mov dword [ebp - 0x2c4], 0xfffffff8
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
mov esi, dword [ebp - 0x38]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x354]
call fcn.004106b1
imul esi, dword [eax]
test esi, esi
je 0x443e9a
mov dword [ebp - 0x55c], 1
jmp 0x443ea1
and dword [ebp - 0x55c], 0
mov eax, dword [ebp - 0x2cc]
cmp dword [ebp - 0x55c], eax
jl 0x443ecd
push 0
lea ecx, [ebp - 0x354]
call fcn.004106b1
cmp dword [eax], 0
je 0x443ecd
mov dword [ebp - 0x814], 1
jmp 0x443ed4
and dword [ebp - 0x814], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x814], eax
je 0x443eeb
mov dword [ebp - 0x564], 1
jmp 0x443ef2
and dword [ebp - 0x564], 0
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x2cc], eax
mov esi, dword [ebp - 0x2cc]
push 0
lea ecx, [ebp - 0x354]
call fcn.004106b1
cmp esi, dword [eax]
jg 0x443f21
mov dword [ebp - 0xa1c], 1
jmp 0x443f28
and dword [ebp - 0xa1c], 0
mov eax, dword [ebp - 0xa1c]
mov dword [ebp - 0x178], eax
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x178], eax
jl 0x443f4b
mov dword [ebp - 0x56c], 1
jmp 0x443f52
and dword [ebp - 0x56c], 0
cmp dword [ebp - 0x56c], 6
jb 0x443f67
mov dword [ebp - 0x81c], 1
jmp 0x443f6e
and dword [ebp - 0x81c], 0
mov eax, dword [ebp - 0x81c]
sub eax, 0x4cd021aa
mov dword [ebp - 0x574], eax
mov eax, dword [ebp - 0x574]
mov dword [ebp - 0x1034], eax
cmp dword [ebp - 0x2c4], 0x6522
je 0x443fa3
mov dword [ebp - 0x974], 1
jmp 0x443faa
and dword [ebp - 0x974], 0
push 0
lea ecx, [ebp - 0x354]
call fcn.004106b1
mov ecx, dword [ebp - 0x974]
cmp ecx, dword [eax]
je 0x444197
mov dword [ebp - 0xbd4], 0
mov dword [ebp - 0x103c], 0x5e2d
mov dword [ebp - 0x1044], 1
mov dword [ebp - 0xbdc], 1
mov dword [ebp - 0x38], 0
jmp 0x443ffd
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x444192
mov dword [ebp - 0x158], 0xffffffff
push 0
lea ecx, [ebp - 0x354]
call fcn.004106b1
cmp dword [eax], 1
jge 0x44402f
mov dword [ebp - 0x57c], 1
jmp 0x444036
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x2c4]
imul eax, dword [ebp - 0x57c]
test eax, eax
je 0x444059
cmp dword [ebp - 0x38], 0
je 0x444059
mov dword [ebp - 0x824], 1
jmp 0x444060
and dword [ebp - 0x824], 0
mov eax, dword [ebp - 0x824]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 0x23c]
dec ecx
mov dword [ebp - 0x23c], ecx
test eax, eax
je 0x4440c9
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x104c], eax
cmp dword [ebp - 0x158], 0
je 0x4440c9
push dword [ebp - 0x40]
lea ecx, [ebp - 0x354]
call fcn.004106b1
cmp dword [eax], 0
je 0x4440c9
cmp dword [ebp - 0x158], 0
je 0x4440c9
mov eax, 0x552e2968
test eax, eax
je 0x4440c9
mov dword [ebp - 0x584], 1
jmp 0x4440d0
and dword [ebp - 0x584], 0
mov eax, dword [ebp - 0x158]
cmp eax, dword [ebp - 0x584]
je 0x4440ea
mov dword [ebp - 0xa78], 1
jmp 0x4440f1
and dword [ebp - 0xa78], 0
mov eax, dword [ebp - 0x158]
cmp dword [ebp - 0xa78], eax
jg 0x44410b
mov dword [ebp - 0x58c], 1
jmp 0x444112
and dword [ebp - 0x58c], 0
mov eax, dword [ebp - 0xbd4]
cmp dword [ebp - 0x58c], eax
jg 0x44412c
mov dword [ebp - 0x82c], 1
jmp 0x444133
and dword [ebp - 0x82c], 0
mov eax, dword [ebp - 0x158]
sub eax, dword [ebp - 0x82c]
cmp dword [ebp - 0x158], eax
jge 0x444153
mov dword [ebp - 0x594], 1
jmp 0x44415a
and dword [ebp - 0x594], 0
mov eax, dword [ebp - 0x2cc]
imul eax, dword [ebp - 0x594]
cmp eax, 0x87c3cb87
ja 0x44417a
mov dword [ebp - 0x97c], 1
jmp 0x444181
and dword [ebp - 0x97c], 0
mov eax, dword [ebp - 0x97c]
mov dword [ebp - 0xbdc], eax
jmp 0x443ff6
jmp 0x44422f
mov dword [ebp - 0x1b4], 0xfffffffb
mov dword [ebp - 0x244], 0
jmp 0x4441ba
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 3
jge 0x4441d6
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x12a0], 8
jmp 0x4441ad
push 0
lea ecx, [ebp - 0xed4]
call fcn.004106b1
mov dword [ebp - 0x59c], eax
mov eax, dword [ebp - 0x59c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x59c]
mov dword [ecx], eax
mov dword [ebp - 0x1b4], 0
jmp 0x444213
mov eax, dword [ebp - 0x1b4]
inc eax
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 3
jge 0x44422f
mov eax, dword [ebp - 0x1b4]
mov dword [ebp + eax*4 - 0x12a0], 0x50227cdb
jmp 0x444206
mov dword [ebp - 0x38], 0
jmp 0x44423f
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jg 0x44428c
mov dword [ebp - 0x178], 0
jmp 0x44425e
mov eax, dword [ebp - 0x178]
dec eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jl 0x44428a
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x444288
push 0
push 0xdc3
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
jmp 0x444251
jmp 0x444238
lea ecx, [ebp - 0xed4]
call fcn.004106ac
jmp 0x443da0
lea ecx, [ebp - 0x354]
call fcn.004106ac
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xd9c]
mov dword [ebp - 0x834], eax
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x834]
mov dword [ebp + eax*4 - 0xd9c], ecx
cmp dword [ebp - 0x834], 0
jne 0x4443ac
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp + eax*4 - 0xd9c]
mov dword [ebp - 0x1054], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp + ecx*4 - 0xd9c]
cmp dword [ebp + eax*4 - 0xd9c], ecx
jne 0x444309
mov dword [ebp - 0x5a4], 1
jmp 0x444310
and dword [ebp - 0x5a4], 0
imul eax, dword [ebp - 0x5a4], 0x87a7
test eax, eax
je 0x44433c
push 1
lea ecx, [ebp - 0xdb4]
call fcn.004106b1
cmp dword [eax], 0
je 0x44433c
mov dword [ebp - 0xa24], 1
jmp 0x444343
and dword [ebp - 0xa24], 0
cmp dword [ebp - 0xa24], 0x8ed4
je 0x44435b
mov dword [ebp - 0x5ac], 1
jmp 0x444362
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x5ac]
mov dword [ebp - 0x83c], eax
mov esi, dword [ebp - 0x83c]
push 1
lea ecx, [ebp - 0xdb4]
call fcn.004106b1
cmp esi, dword [eax]
jne 0x444391
mov dword [ebp - 0x5b4], 1
jmp 0x444398
and dword [ebp - 0x5b4], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x5b4], eax
jl 0x4443ac
and dword [ebp - 0x984], 0
jmp 0x4443b6
mov dword [ebp - 0x984], 1
cmp dword [ebp - 0x984], 0x63e31551
jge 0x4443ce
mov dword [ebp - 0x5bc], 1
jmp 0x4443d5
and dword [ebp - 0x5bc], 0
mov eax, dword [ebp - 0x5bc]
mov dword [ebp - 0xbe4], eax
jmp 0x44399c
mov eax, dword [ebp - 0x160]
cmp dword [ebp + eax*4 - 0xd9c], 0
je 0x4443fb
jmp 0x443109
jmp 0x443109
lea ecx, [ebp - 0xdb4]
call fcn.004106ac
push 1
lea ecx, [ebp - 0x378]
call fcn.00410610
mov dword [ebp - 0x2d4], 0
jmp 0x444431
mov eax, dword [ebp - 0x2d4]
inc eax
mov dword [ebp - 0x2d4], eax
cmp dword [ebp - 0x2d4], 1
jge 0x444453
push dword [ebp - 0x2d4]
lea ecx, [ebp - 0x378]
call fcn.004106b1
mov dword [eax], 0xfb871c7b
jmp 0x444424
push 0
lea ecx, [ebp - 0x378]
call fcn.004106b1
mov esi, eax
push 0
lea ecx, [ebp - 0x378]
call fcn.004106b1
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x444481
mov dword [ebp - 0x844], 1
jmp 0x444488
and dword [ebp - 0x844], 0
push 0
lea ecx, [ebp - 0x378]
call fcn.004106b1
mov ecx, dword [ebp - 0x844]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x378]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x378]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x378]
call fcn.004106b1
cmp dword [eax], 0x85c9e53
je 0x4444d8
mov dword [ebp - 0x5c4], 1
jmp 0x4444df
and dword [ebp - 0x5c4], 0
imul eax, dword [ebp - 0x5c4], 0
cmp eax, 0xb21a35ca
jbe 0x444521
push 0
lea ecx, [ebp - 0x378]
call fcn.004106b1
cmp dword [eax], 0
je 0x444521
push 0
lea ecx, [ebp - 0x378]
call fcn.004106b1
mov esi, eax
push 0
lea ecx, [ebp - 0x378]
call fcn.004106b1
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x44455c
mov dword [ebp - 0xbec], 9
push 0
lea ecx, [ebp - 0x378]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0xbec], eax
mov byte [ebp - 0xd9], 0
movzx eax, byte [ebp - 0xd9]
test eax, eax
je 0x44455c
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
lea ecx, [ebp - 0x378]
call fcn.004106ac
mov dword [ebp - 0xaec], 0x57102d14
mov dword [ebp - 0xae8], 0x57102d14
mov dword [ebp - 0xae4], 0x57102d14
mov dword [ebp - 0xae0], 0x57102d14
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x24c], 0
jmp 0x4445bc
mov eax, dword [ebp - 0x24c]
inc eax
mov dword [ebp - 0x24c], eax
cmp dword [ebp - 0x24c], 1
jge 0x4445d5
mov eax, dword [ebp - 0x24c]
mov dword [ebp + eax*4 - 0x2c], 1
jmp 0x4445af
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x2c], 0
jmp 0x4445fa
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x2c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0x19
jge 0x444bf7
mov dword [ebp - 0xe34], 0xfffffffb
mov dword [ebp - 0xe30], 0xfffffffb
mov dword [ebp - 0xe2c], 0xfffffffb
mov dword [ebp - 0xe28], 0xfffffffb
lea ecx, [ebp - 0x3c1]
call fcn.004017e5
push eax
lea eax, [ebp - 0xe24]
push eax
lea eax, [ebp - 0xe34]
push eax
lea ecx, [ebp - 0x12e4]
call fcn.004106c0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1e8]
call fcn.00410686
mov dword [ebp - 0x47c], 0xe356ec7e
mov dword [ebp - 0x478], 0xe356ec7e
mov dword [ebp - 0x474], 0xe356ec7e
mov dword [ebp - 0x470], 0xe356ec7e
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
and dword [eax], 0
jmp 0x4446c6
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
mov dword [ebp - 0xac8], eax
mov eax, dword [ebp - 0xac8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xac8]
mov dword [ecx], eax
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
cmp dword [eax], 3
jg 0x4449ec
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
mov esi, dword [eax]
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
mov eax, dword [eax]
mov ecx, dword [ebp + esi*4 - 0xaec]
mov dword [ebp + eax*4 - 0xaec], ecx
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xaec], 0
jne 0x444837
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x2c]
cmp dword [eax], ecx
jl 0x444759
mov dword [ebp - 0x5cc], 1
jmp 0x444760
and dword [ebp - 0x5cc], 0
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xaec]
cmp dword [ebp - 0x5cc], eax
jg 0x44478a
mov dword [ebp - 0x84c], 1
jmp 0x444791
and dword [ebp - 0x84c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x84c], eax
jl 0x4447af
mov dword [ebp - 0x5d4], 1
jmp 0x4447b6
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x84]
cmp dword [ebp - 0x5d4], eax
jne 0x4447d0
mov dword [ebp - 0xbf4], 1
jmp 0x4447d7
and dword [ebp - 0xbf4], 0
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xaec]
mov dword [ebp - 0x105c], eax
mov eax, 0x20ea
test eax, eax
jne 0x444812
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
jne 0x444812
and dword [ebp - 0x438], 0
jmp 0x44481c
mov dword [ebp - 0x438], 1
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x438]
mov dword [ebp + eax - 0x47c], ecx
cmp dword [ebp - 0x438], 0
je 0x444867
mov byte [ebp - 0xdb], 0
movzx eax, byte [ebp - 0xdb]
test eax, eax
je 0x444854
push 0x4dd
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [ebp - 0x188], 0
je 0x444862
jmp 0x4446a2
jmp 0x4449e7
mov dword [ebp - 0x85c], 0xffffffff
mov dword [ebp - 0x84], 3
jmp 0x44488a
mov eax, dword [ebp - 0x84]
dec eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jl 0x4449e7
mov dword [ebp - 0xc04], 0x1e69d086
mov eax, dword [ebp - 0x84]
cmp dword [ebp + eax*4 - 0x47c], 0
je 0x4448b6
jmp 0x4449e7
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x2c], 0
je 0x4448d4
xor eax, eax
inc eax
je 0x4448d4
mov dword [ebp - 0x5dc], 1
jmp 0x4448db
and dword [ebp - 0x5dc], 0
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x47c], 0xd6cd5387
xor eax, eax
inc eax
cmp eax, 0xd6cd5387
ja 0x444902
mov dword [ebp - 0x98c], 1
jmp 0x444909
and dword [ebp - 0x98c], 0
mov esi, dword [ebp - 0x98c]
add esi, 0x39be
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
cmp esi, dword [eax]
jge 0x444932
mov dword [ebp - 0x854], 1
jmp 0x444939
and dword [ebp - 0x854], 0
mov eax, dword [ebp - 0x5dc]
cmp eax, dword [ebp - 0x854]
jge 0x444953
mov dword [ebp - 0xbfc], 1
jmp 0x44495a
and dword [ebp - 0xbfc], 0
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0xaec]
mov dword [ebp - 0x1064], eax
xor eax, eax
cmp eax, 0x32e0c280
jb 0x44498b
mov dword [ebp - 0x5e4], 1
jmp 0x444992
and dword [ebp - 0x5e4], 0
cmp dword [ebp - 0x5e4], 0xfffffffe
jle 0x4449a7
mov dword [ebp - 0xa2c], 1
jmp 0x4449ae
and dword [ebp - 0xa2c], 0
mov eax, dword [ebp - 0x85c]
cmp dword [ebp - 0xa2c], eax
je 0x4449c8
mov dword [ebp - 0x5ec], 1
jmp 0x4449cf
and dword [ebp - 0x5ec], 0
mov eax, dword [ebp - 0xc04]
imul eax, dword [ebp - 0x5ec]
mov dword [ebp - 0x85c], eax
jmp 0x44487d
jmp 0x4446a2
mov dword [ebp - 0x188], 0
jmp 0x444a05
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jg 0x444be7
mov dword [ebp - 0x424], 0x77138bf9
mov dword [ebp - 0xc0c], 0
mov dword [ebp - 0x60c], 0xb5cfe74d
mov dword [ebp - 0xc14], 0x7fe6
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x47c], 1
je 0x444a55
mov dword [ebp - 0xa80], 1
jmp 0x444a5c
and dword [ebp - 0xa80], 0
push 3
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x84]
imul eax, dword [ebp - 0xc0c]
test eax, eax
jne 0x444a98
mov eax, 0xefc5446e
test eax, eax
jne 0x444a98
and dword [ebp - 0x5f4], 0
jmp 0x444aa2
mov dword [ebp - 0x5f4], 1
cmp dword [ebp - 0x5f4], 0
jne 0x444ac6
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0xaec], 0
je 0x444ac6
mov dword [ebp - 0x994], 1
jmp 0x444acd
and dword [ebp - 0x994], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x994], eax
jge 0x444aeb
mov dword [ebp - 0x5fc], 1
jmp 0x444af2
and dword [ebp - 0x5fc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x47c]
add eax, dword [ebp - 0x5fc]
jne 0x444b22
push 1
lea ecx, [ebp - 0x1e8]
call fcn.004106b1
cmp dword [eax], 0
jne 0x444b22
and dword [ebp - 0x864], 0
jmp 0x444b2c
mov dword [ebp - 0x864], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x864], eax
jg 0x444b4a
mov dword [ebp - 0x604], 1
jmp 0x444b51
and dword [ebp - 0x604], 0
mov eax, dword [ebp - 0x604]
mov dword [ebp - 0x60c], eax
mov eax, dword [ebp - 0xa80]
sub eax, dword [ebp - 0x60c]
cmp eax, dword [ebp - 0x424]
jne 0x444b7f
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x47c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x47c]
mov dword [ebp - 0x106c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
mov dword [ebp - 0x1074], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0xc14]
cmp dword [ebp + eax - 0x47c], ecx
jle 0x444bc2
mov dword [ebp - 0x86c], 1
jmp 0x444bc9
and dword [ebp - 0x86c], 0
mov eax, dword [ebp - 0x86c]
sub eax, dword [ebp - 0x424]
mov ecx, dword [ebp - 0x188]
mov dword [ebp + ecx*4 - 0x47c], eax
jmp 0x4449f8
lea ecx, [ebp - 0x1e8]
call fcn.004106ac
jmp 0x4445e5
mov dword [ebp - 0x107c], 9
mov dword [ebp - 0x1084], 0xffffffff
mov dword [ebp - 0x108c], 8
mov dword [ebp - 0x1094], 6
mov dword [ebp - 0x109c], 0xbac04ee7
mov dword [ebp - 0x10a4], 0x40194ddb
mov dword [ebp - 0x10ac], 1
mov dword [ebp - 0x10b4], 0x37a9a971
mov dword [ebp - 0x10bc], 0xffffffff
mov dword [ebp - 0x10c4], 0x2fdcba86
mov dword [ebp - 0x10cc], 1
mov dword [ebp - 0x10d4], 0xfffffffb
mov dword [ebp - 0x10dc], 0x831eb239
mov dword [ebp - 0x10e8], 1
mov dword [ebp - 0x10f0], 0x4ba8b35e
mov dword [ebp - 0x10f8], 6
mov dword [ebp - 0x614], 0x5f79
mov dword [ebp - 0x1100], 0x342f
mov dword [ebp - 0x2dc], 0
jmp 0x444cc4
mov eax, dword [ebp - 0x2dc]
inc eax
mov dword [ebp - 0x2dc], eax
cmp dword [ebp - 0x2dc], 4
jge 0x444ce0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp + eax*4 - 0x1334], 0x45c1d102
jmp 0x444cb7
mov byte [ebp - 0xdd], 0
movzx eax, byte [ebp - 0xdd]
test eax, eax
je 0x444cf8
call dword [sym.imp.USER32.dll_EndMenu]
mov eax, dword [ebp - 0x614]
dec eax
mov dword [ebp - 0x614], eax
push 1
lea ecx, [ebp - 0x360]
call fcn.00410610
mov dword [ebp - 0x41c], 4
mov dword [ebp - 0xa34], 0x45f5b1b6
mov dword [ebp - 0xc1c], 0xfffffffa
mov dword [ebp - 0x1108], 0x6e9f0866
mov dword [ebp - 0x1110], 0x5493e623
mov dword [ebp - 0x1118], 0x87a5eafb
mov dword [ebp - 0x1120], 0
mov dword [ebp - 0x1128], 0xc5530c4e
mov dword [ebp - 0x1130], 0xfffffffb
mov dword [ebp - 0x62c], 0xfffffffb
mov dword [ebp - 0x254], 0
jmp 0x444d8f
mov eax, dword [ebp - 0x254]
inc eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 2
jge 0x444dab
mov eax, dword [ebp - 0x254]
mov dword [ebp + eax*4 - 0x12d4], 1
jmp 0x444d82
push 4
pop eax
test eax, eax
je 0x444dc7
mov eax, 0x310c13fe
test eax, eax
je 0x444dc7
mov dword [ebp - 0x99c], 1
jmp 0x444dce
and dword [ebp - 0x99c], 0
cmp dword [ebp - 0x99c], 0x646b8d96
jne 0x444de6
mov dword [ebp - 0x61c], 1
jmp 0x444ded
and dword [ebp - 0x61c], 0
mov eax, 0x664dc9ed
sub eax, dword [ebp - 0x41c]
sub eax, dword [ebp - 0x61c]
cmp eax, 0xe446df3
jg 0x444e11
mov dword [ebp - 0x874], 1
jmp 0x444e18
and dword [ebp - 0x874], 0
mov eax, dword [ebp - 0x41c]
cmp dword [ebp - 0x874], eax
jge 0x444e38
cmp dword [ebp - 0x41c], 0
jne 0x444e38
and dword [ebp - 0x624], 0
jmp 0x444e42
mov dword [ebp - 0x624], 1
mov eax, dword [ebp - 0x624]
mov dword [ebp - 0xa34], eax
mov eax, dword [ebp - 0xa34]
mov dword [ebp - 0xc1c], eax
mov eax, dword [ebp - 0x62c]
inc eax
mov dword [ebp - 0x62c], eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x63c], 0xfbb9cf7d
mov dword [ebp - 0x884], 0xeadd5d
mov dword [ebp - 0x654], 1
mov dword [ebp - 0x9ac], 0xfffffffa
mov dword [ebp - 0x2e4], 0
jmp 0x444eaf
mov eax, dword [ebp - 0x2e4]
inc eax
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 2
jge 0x444ecb
mov eax, dword [ebp - 0x2e4]
mov dword [ebp + eax*4 - 0xe10], 0x609d70ca
jmp 0x444ea2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1138], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1140], eax
cmp dword [ebp - 0xc], 0
je 0x444f4c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1148], eax
cmp dword [ebp - 0xc], 2
jne 0x444efe
mov dword [ebp - 0x87c], 1
jmp 0x444f05
and dword [ebp - 0x87c], 0
cmp dword [ebp - 0x87c], 0x2092
jle 0x444f1d
mov dword [ebp - 0x3b0], 1
jmp 0x444f24
and dword [ebp - 0x3b0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x3b0]
mov dword [ebp + eax - 0xe10], ecx
cmp dword [ebp - 0x3b0], 0
je 0x444f4c
mov dword [ebp - 0x634], 1
jmp 0x444f53
and dword [ebp - 0x634], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x634], eax
jne 0x444f73
mov eax, 0xd02e889e
test eax, eax
je 0x444f73
mov dword [ebp - 0x9a4], 1
jmp 0x444f7a
and dword [ebp - 0x9a4], 0
mov eax, dword [ebp - 0x9a4]
mov dword [ebp - 0x63c], eax
mov eax, dword [ebp - 0x63c]
mov dword [ebp - 0x884], eax
cmp dword [ebp - 0x884], 0
jne 0x444fab
push 0xfffffffffffffffb
pop eax
test eax, eax
jne 0x444fab
and dword [ebp - 0x644], 0
jmp 0x444fb5
mov dword [ebp - 0x644], 1
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x644], eax
jle 0x444fcc
mov dword [ebp - 0xaa8], 1
jmp 0x444fd3
and dword [ebp - 0xaa8], 0
mov eax, dword [ebp - 0xaa8]
sub eax, 6
cmp eax, dword [ebp - 0xc]
jl 0x444fed
mov dword [ebp - 0x64c], 1
jmp 0x444ff4
and dword [ebp - 0x64c], 0
mov eax, dword [ebp - 0x64c]
sub eax, 0xe81d
cmp eax, 6
jne 0x445010
mov dword [ebp - 0x88c], 1
jmp 0x445017
and dword [ebp - 0x88c], 0
mov eax, dword [ebp - 0x88c]
mov dword [ebp - 0x654], eax
mov eax, dword [ebp - 0x654]
mov dword [ebp - 0x9ac], eax
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x9ac], eax
jne 0x445046
mov dword [ebp - 0x65c], 1
jmp 0x44504d
and dword [ebp - 0x65c], 0
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x65c]
add eax, dword [ebp - 0xc]
neg eax
imul eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0xc]
je 0x445073
mov dword [ebp - 0x894], 1
jmp 0x44507a
and dword [ebp - 0x894], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x894], eax
jne 0x445133
mov dword [ebp - 0x168], 0xce404d4
mov dword [ebp - 0xc24], 1
cmp dword [ebp - 0x168], 0
jne 0x4450bf
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xe10], 0
jne 0x4450bf
and dword [ebp - 0x664], 0
jmp 0x4450c9
mov dword [ebp - 0x664], 1
mov eax, dword [ebp - 0x664]
sub eax, dword [ebp - 0x168]
mov dword [ebp - 0xc24], eax
mov dword [ebp - 0x168], 0
jmp 0x4450f4
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 0x17
jl 0x445131
mov dword [ebp - 0xc], 0
jmp 0x44510d
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jg 0x44512f
mov byte [ebp - 0x133], 0
movzx eax, byte [ebp - 0x133]
test eax, eax
je 0x44512d
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
jmp 0x445106
jmp 0x4450e7
jmp 0x44514d
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x44514d
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
mov byte [ebp - 0x12d], 0
movzx eax, byte [ebp - 0x12d]
test eax, eax
je 0x445167
push 1
call dword [sym.imp.USER32.dll_ShowCursor]
mov dword [ebp - 0x25c], 0
jmp 0x445180
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 1
jge 0x4451a2
push dword [ebp - 0x25c]
lea ecx, [ebp - 0x360]
call fcn.004106b1
mov dword [eax], 0xfb871c7b
jmp 0x445173
push 0
lea ecx, [ebp - 0x360]
call fcn.004106b1
mov esi, eax
push 0
lea ecx, [ebp - 0x360]
call fcn.004106b1
mov ecx, dword [esi]
cmp ecx, dword [eax]
jg 0x4451d0
mov dword [ebp - 0xa3c], 1
jmp 0x4451d7
and dword [ebp - 0xa3c], 0
push 0
lea ecx, [ebp - 0x360]
call fcn.004106b1
mov ecx, dword [ebp - 0xa3c]
mov dword [eax], ecx
push 0
lea ecx, [ebp - 0x360]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x360]
call fcn.004106b1
push 0
lea ecx, [ebp - 0x360]
call fcn.004106b1
cmp dword [eax], 0x85c9e53
je 0x445227
mov dword [ebp - 0x66c], 1
jmp 0x44522e
and dword [ebp - 0x66c], 0
imul eax, dword [ebp - 0x66c], 0
cmp eax, 0xb21a35ca
jbe 0x44569a
push 0
lea ecx, [ebp - 0x360]
call fcn.004106b1
cmp dword [eax], 0
je 0x44569a
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x2ec], 0
jmp 0x445276
mov eax, dword [ebp - 0x2ec]
inc eax
mov dword [ebp - 0x2ec], eax
cmp dword [ebp - 0x2ec], 3
jge 0x445292
mov eax, dword [ebp - 0x2ec]
mov dword [ebp + eax*4 - 0xb4c], 0xffffffff
jmp 0x445269
mov dword [ebp - 0x20], 0
jmp 0x4452a2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jg 0x44564f
mov dword [ebp - 0x5c], 0xba339924
mov dword [ebp - 0x5c], 2
jmp 0x4452c3
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x44564a
mov dword [ebp - 0x1c4], 0x274bf90e
push 2
lea ecx, [ebp - 0xee0]
call fcn.00410610
mov dword [ebp - 0x694], 0
mov dword [ebp - 0xc3c], 0x5b5b06a8
mov dword [ebp - 0x264], 0
jmp 0x445311
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 2
jge 0x445333
push dword [ebp - 0x264]
lea ecx, [ebp - 0xee0]
call fcn.004106b1
mov dword [eax], 5
jmp 0x445304
mov dword [ebp - 0x1c4], 0
jmp 0x44534c
mov eax, dword [ebp - 0x1c4]
inc eax
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x1c4], 2
jg 0x44563a
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x4c], 2
jmp 0x445370
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x445635
mov dword [ebp - 0x26c], 0xdaab72b2
mov dword [ebp - 0x89c], 0xfffffff6
push 1
lea ecx, [ebp - 0xeec]
call fcn.00410610
mov dword [ebp - 0x2f4], 0
jmp 0x4453b4
mov eax, dword [ebp - 0x2f4]
inc eax
mov dword [ebp - 0x2f4], eax
cmp dword [ebp - 0x2f4], 1
jge 0x4453d3
push dword [ebp - 0x2f4]
lea ecx, [ebp - 0xeec]
call fcn.004106b1
or dword [eax], 0xffffffff
jmp 0x4453a7
mov dword [ebp - 0x26c], 2
jmp 0x4453ec
mov eax, dword [ebp - 0x26c]
dec eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 0
jl 0x445445
mov dword [ebp - 0x2fc], 1
mov dword [ebp - 0xc2c], 0xffffffff
mov dword [ebp - 0x2fc], 2
jmp 0x445422
mov eax, dword [ebp - 0x2fc]
dec eax
mov dword [ebp - 0x2fc], eax
cmp dword [ebp - 0x2fc], 0
jl 0x445443
mov dword [ebp - 0x89c], 8
mov eax, dword [ebp - 0x89c]
mov dword [ebp - 0xc2c], eax
jmp 0x445415
jmp 0x4453df
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0xb4c], 0
jne 0x445555
cmp dword [ebp - 0x20], 0
jne 0x4454fe
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp + eax*4 - 0xb4c]
cmp dword [ebp - 0x1c4], eax
jle 0x44547e
mov dword [ebp - 0x674], 1
jmp 0x445485
and dword [ebp - 0x674], 0
cmp dword [ebp - 0x674], 0xdaba
jge 0x44549d
mov dword [ebp - 0x9b4], 1
jmp 0x4454a4
and dword [ebp - 0x9b4], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x9b4], eax
jl 0x4454bb
mov dword [ebp - 0x67c], 1
jmp 0x4454c2
and dword [ebp - 0x67c], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x67c]
sub ecx, dword [ebp + eax*4 - 0xb4c]
cmp ecx, dword [ebp - 0x5c]
jne 0x4454e3
mov dword [ebp - 0x8a4], 1
jmp 0x4454ea
and dword [ebp - 0x8a4], 0
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x8a4]
jle 0x4454fe
and dword [ebp - 0x684], 0
jmp 0x445508
mov dword [ebp - 0x684], 1
mov esi, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x684]
add esi, eax
push 1
lea ecx, [ebp - 0xee0]
call fcn.004106b1
cmp esi, dword [eax]
jl 0x445533
mov dword [ebp - 0xa88], 1
jmp 0x44553a
and dword [ebp - 0xa88], 0
cmp dword [ebp - 0xa88], 0xe155
jle 0x445555
cmp dword [ebp - 0x4c], 0
jne 0x445555
and dword [ebp - 0x68c], 0
jmp 0x44555f
mov dword [ebp - 0x68c], 1
cmp dword [ebp - 0x68c], 9
jne 0x445574
mov dword [ebp - 0x8ac], 1
jmp 0x44557b
and dword [ebp - 0x8ac], 0
mov eax, dword [ebp - 0x8ac]
mov dword [ebp - 0x694], eax
mov eax, dword [ebp - 0x694]
mov dword [ebp - 0x1150], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1208], eax
mov eax, dword [ebp - 0x4c]
cmp dword [ebp + eax*4 - 0xb4c], 0
jb 0x4455b7
xor eax, eax
inc eax
jne 0x4455b7
and dword [ebp - 0x9bc], 0
jmp 0x4455c1
mov dword [ebp - 0x9bc], 1
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x9bc], eax
jle 0x4455d8
mov dword [ebp - 0x69c], 1
jmp 0x4455df
and dword [ebp - 0x69c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x69c], eax
jl 0x4455f6
mov dword [ebp - 0xc34], 1
jmp 0x4455fd
and dword [ebp - 0xc34], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4c]
mov dword [ebp - 0x1210], eax
push 0
lea ecx, [ebp - 0xeec]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0xc3c], eax
lea ecx, [ebp - 0xeec]
call fcn.004106ac
jmp 0x445369
jmp 0x44533f
lea ecx, [ebp - 0xee0]
call fcn.004106ac
jmp 0x4452bc
jmp 0x44529b
mov dword [ebp - 0x20], 0
jmp 0x44565f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x445675
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb4c], 0
jmp 0x445658
push 0
lea ecx, [ebp - 0x360]
call fcn.004106b1
mov esi, eax
push 0
lea ecx, [ebp - 0x360]
call fcn.004106b1
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x445e13
mov dword [ebp - 0xc4c], 9
mov dword [ebp - 0x48], 0xc7a00f47
mov dword [ebp - 0xc0], 2
mov dword [ebp - 0x6b4], 0x7eed050b
mov dword [ebp - 0x8c4], 0xe13c9534
mov dword [ebp - 0xe48], 5
mov dword [ebp - 0xe44], 5
mov dword [ebp - 0xe40], 5
mov dword [ebp - 0xe3c], 5
lea ecx, [ebp - 0x415]
call fcn.004017e5
push eax
lea eax, [ebp - 0xe38]
push eax
lea eax, [ebp - 0xe48]
push eax
lea ecx, [ebp - 0x12ec]
call fcn.004106c0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x12b8]
call fcn.00410686
mov dword [ebp - 0x1218], 0x34fd39ef
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x445754
push 0xc97
push 0x118d
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
cmp dword [ebp - 0x48], 1
jne 0x445766
mov dword [ebp - 0x8b4], 1
jmp 0x44576d
and dword [ebp - 0x8b4], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x8b4], eax
jg 0x445781
cmp dword [ebp - 0x48], 0
jne 0x445790
cmp dword [ebp - 0x48], 0
jne 0x445790
and dword [ebp - 0xc44], 0
jmp 0x44579a
mov dword [ebp - 0xc44], 1
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1220], eax
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x48], eax
jl 0x4457ba
mov dword [ebp - 0x6a4], 1
jmp 0x4457c1
and dword [ebp - 0x6a4], 0
cmp dword [ebp - 0x6a4], 0
jae 0x4457d6
mov dword [ebp - 0xa44], 1
jmp 0x4457dd
and dword [ebp - 0xa44], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0xa44], eax
je 0x4457f4
mov dword [ebp - 0x6ac], 1
jmp 0x4457fb
and dword [ebp - 0x6ac], 0
cmp dword [ebp - 0x6ac], 0x6848298b
jg 0x445813
mov dword [ebp - 0x8bc], 1
jmp 0x44581a
and dword [ebp - 0x8bc], 0
mov eax, dword [ebp - 0x8bc]
mov dword [ebp - 0x6b4], eax
mov eax, dword [ebp - 0xc0]
add eax, dword [ebp - 0x6b4]
cmp dword [ebp - 0x48], eax
jge 0x445843
mov dword [ebp - 0x9c4], 1
jmp 0x44584a
and dword [ebp - 0x9c4], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x9c4], eax
je 0x445861
mov dword [ebp - 0x6bc], 1
jmp 0x445868
and dword [ebp - 0x6bc], 0
mov eax, dword [ebp - 0x6bc]
mov dword [ebp - 0x8c4], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x8c4], eax
jge 0x44588b
mov dword [ebp - 0x6c4], 1
jmp 0x445892
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x48]
add eax, dword [ebp - 0x6c4]
je 0x4458b6
mov dword [ebp - 0xad8], 1
mov eax, dword [ebp - 0xad8]
dec eax
mov dword [ebp - 0xad8], eax
jmp 0x4458e5
mov dword [ebp - 0xc0], 0xb
jmp 0x4458cf
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x1f
jl 0x4458e5
cmp dword [ebp - 0xc0], 0
je 0x4458e3
jmp 0x4458e5
jmp 0x4458c2
lea ecx, [ebp - 0x12b8]
call fcn.004106ac
push 0
lea ecx, [ebp - 0x360]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0xc4c], eax
push 1
lea ecx, [ebp - 0xdc0]
call fcn.00410610
mov dword [ebp - 0x6ec], 0x90a3cfce
mov dword [ebp - 0xd48], 2
mov dword [ebp - 0xd5c], 0x3e93d0b5
mov dword [ebp - 0x1228], 0xeb9e
mov dword [ebp - 0x704], 0x215256ee
mov dword [ebp - 0x1230], 0x720348f4
mov dword [ebp - 0x1238], 0
mov dword [ebp - 0xd6c], 0x426a7609
mov dword [ebp - 0x8d4], 0x88e10e5e
mov dword [ebp - 0x9d4], 0xabc24891
mov dword [ebp - 0x1240], 0xf05f4326
mov dword [ebp - 0x8cc], 1
mov dword [ebp - 0x1248], 0xfffffff8
push 2
lea ecx, [ebp - 0xf40]
call fcn.00410610
mov dword [ebp - 0xd64], 0x5f992db7
mov dword [ebp - 0x6dc], 0
mov dword [ebp - 0x6fc], 0x8ce22955
mov dword [ebp - 0x1250], 0xffffffff
mov dword [ebp - 0x1258], 0x5de082ad
mov dword [ebp - 0x404], 0xfffffffe
mov dword [ebp - 0x60], 0
jmp 0x4459ed
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x445a09
push dword [ebp - 0x60]
lea ecx, [ebp - 0xdc0]
call fcn.004106b1
mov dword [eax], 1
jmp 0x4459e6
mov dword [ebp - 0x60], 0
jmp 0x445a19
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x445a32
push dword [ebp - 0x60]
lea ecx, [ebp - 0xf40]
call fcn.004106b1
and dword [eax], 0
jmp 0x445a12
cmp dword [ebp - 0x6ec], 1
jl 0x445a47
mov dword [ebp - 0x6cc], 1
jmp 0x445a4e
and dword [ebp - 0x6cc], 0
mov eax, dword [ebp - 0x6cc]
mov dword [ebp - 0x8cc], eax
cmp dword [ebp - 0x8cc], 0
jne 0x445a6c
cmp dword [ebp - 0xd48], 0
je 0x445a81
cmp dword [ebp - 0xd5c], 0
je 0x445a81
mov dword [ebp - 0x6d4], 1
jmp 0x445a88
and dword [ebp - 0x6d4], 0
mov eax, dword [ebp - 0x404]
inc eax
mov dword [ebp - 0x404], eax
mov eax, dword [ebp - 0x404]
cmp eax, dword [ebp - 0x6d4]
jg 0x445aaf
mov dword [ebp - 0x9cc], 1
jmp 0x445ab6
and dword [ebp - 0x9cc], 0
mov eax, dword [ebp - 0x9cc]
mov dword [ebp - 0x6dc], eax
mov eax, dword [ebp - 0x6dc]
mov dword [ebp - 0x8d4], eax
mov esi, dword [ebp - 0x8d4]
push 0
lea ecx, [ebp - 0xdc0]
call fcn.004106b1
cmp dword [eax], esi
jg 0x445af1
mov dword [ebp - 0x6e4], 1
jmp 0x445af8
and dword [ebp - 0x6e4], 0
cmp dword [ebp - 0x6e4], 0x8e1b8814
jne 0x445b10
mov dword [ebp - 0xa4c], 1
jmp 0x445b17
and dword [ebp - 0xa4c], 0
mov eax, dword [ebp - 0x6fc]
cmp dword [ebp - 0xa4c], eax
jne 0x445b31
mov dword [ebp - 0x8dc], 1
jmp 0x445b38
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x6ec]
cmp dword [ebp - 0x8dc], eax
jne 0x445b58
push 0
lea ecx, [ebp - 0xf40]
call fcn.004106b1
cmp dword [eax], 0
jne 0x445b68
push 4
pop eax
test eax, eax
jne 0x445b68
and dword [ebp - 0x6f4], 0
jmp 0x445b72
mov dword [ebp - 0x6f4], 1
mov eax, dword [ebp - 0x6f4]
inc eax
mov dword [ebp - 0x9d4], eax
mov eax, dword [ebp - 0xd64]
cmp dword [ebp - 0x9d4], eax
jl 0x445b9f
cmp dword [ebp - 0x6fc], 0
jne 0x445b9f
and dword [ebp - 0x8e4], 0
jmp 0x445ba9
mov dword [ebp - 0x8e4], 1
mov eax, dword [ebp - 0x8e4]
mov dword [ebp - 0x704], eax
mov esi, dword [ebp - 0x704]
push 0
lea ecx, [ebp - 0xdc0]
call fcn.004106b1
imul esi, dword [eax]
mov dword [ebp - 0xd6c], esi
lea ecx, [ebp - 0xf40]
call fcn.004106ac
lea ecx, [ebp - 0xdc0]
call fcn.004106ac
mov byte [ebp - 0xd8], 0
mov dword [ebp - 0xe70], 1
mov dword [ebp - 0xe6c], 1
mov dword [ebp - 0xe68], 1
mov dword [ebp - 0xe64], 1
lea ecx, [ebp - 0x40d]
call fcn.004017e5
push eax
lea eax, [ebp - 0xe60]
push eax
lea eax, [ebp - 0xe70]
push eax
lea ecx, [ebp - 0x12fc]
call fcn.004106c0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1190]
call fcn.00410686
mov dword [ebp - 0x274], 0
jmp 0x445c64
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 1
jge 0x445c80
mov eax, dword [ebp - 0x274]
mov dword [ebp + eax*4 - 0x304], 0xd4081c29
jmp 0x445c57
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x304], 0
jmp 0x445cae
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x304]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x304], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x304], 3
jg 0x445d2d
mov dword [ebp - 0x1a0], 1
mov dword [ebp - 0x1a0], 0
jmp 0x445ce1
mov eax, dword [ebp - 0x1a0]
inc eax
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 3
jg 0x445d28
mov byte [ebp - 0x137], 0
movzx eax, byte [ebp - 0x137]
test eax, eax
je 0x445d0e
push 0x580
push 0x26e5
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
push dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1190]
call fcn.004106b1
cmp dword [eax], 0
je 0x445d26
jmp 0x445cd4
jmp 0x445cd4
jmp 0x445c93
lea ecx, [ebp - 0x1190]
call fcn.004106ac
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x445e13
mov dword [ebp - 0xec], 0x79b69b2e
mov dword [ebp - 0xccc], 0x38b4b72b
mov dword [ebp - 0x27c], 0
jmp 0x445d74
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 3
jge 0x445d90
mov eax, dword [ebp - 0x27c]
mov dword [ebp + eax*4 - 0x1324], 0
jmp 0x445d67
cmp dword [ebp - 0xec], 1
jge 0x445da5
mov dword [ebp - 0xd50], 1
jmp 0x445dac
and dword [ebp - 0xd50], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1260], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xccc], eax
mov dword [ebp - 0xec], 0
jmp 0x445ddd
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 2
jg 0x445e09
mov byte [ebp - 0x12f], 0
movzx eax, byte [ebp - 0x12f]
test eax, eax
je 0x445e07
push 0x25f9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x445dd0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
lea ecx, [ebp - 0x360]
call fcn.004106ac
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xb98], 0
mov dword [ebp - 0x30c], 0
jmp 0x445e48
mov eax, dword [ebp - 0x30c]
inc eax
mov dword [ebp - 0x30c], eax
cmp dword [ebp - 0x30c], 3
jge 0x445e64
mov eax, dword [ebp - 0x30c]
mov dword [ebp + eax*4 - 0x1f4], 0xfffffff7
jmp 0x445e3b
mov dword [ebp - 8], 2
jmp 0x445e74
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x446164
mov dword [ebp - 0x3b8], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1f4], 0
jne 0x445ea3
mov dword [ebp - 0x8ec], 1
jmp 0x445eaa
and dword [ebp - 0x8ec], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp dword [ebp - 8], eax
je 0x445ec5
mov dword [ebp - 0xa90], 1
jmp 0x445ecc
and dword [ebp - 0xa90], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp dword [ebp - 0xa90], eax
je 0x445eea
mov dword [ebp - 0x70c], 1
jmp 0x445ef1
and dword [ebp - 0x70c], 0
mov eax, dword [ebp - 0x70c]
sub eax, 9
cmp eax, dword [ebp - 8]
je 0x445f0b
mov dword [ebp - 0x714], 1
jmp 0x445f12
and dword [ebp - 0x714], 0
mov eax, dword [ebp - 0x8ec]
imul eax, dword [ebp - 0x714]
add eax, 0xecaf
cmp eax, 0xfffffffc
jbe 0x445f35
mov dword [ebp - 0x9dc], 1
jmp 0x445f3c
and dword [ebp - 0x9dc], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp dword [ebp - 0x9dc], eax
je 0x445f5a
mov dword [ebp - 0x71c], 1
jmp 0x445f61
and dword [ebp - 0x71c], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp dword [ebp - 0x71c], eax
jl 0x445f7f
mov dword [ebp - 0x8f4], 1
jmp 0x445f86
and dword [ebp - 0x8f4], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x8f4], eax
jle 0x445fa6
mov eax, 0x8502
test eax, eax
je 0x445fa6
mov dword [ebp - 0x724], 1
jmp 0x445fad
and dword [ebp - 0x724], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp dword [ebp - 0x724], eax
jg 0x445fcb
mov dword [ebp - 0xa58], 1
jmp 0x445fd2
and dword [ebp - 0xa58], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp eax, dword [ebp - 0xa58]
jl 0x445ffa
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x1f4], 0
jne 0x445ffa
and dword [ebp - 0x72c], 0
jmp 0x446004
mov dword [ebp - 0x72c], 1
mov eax, dword [ebp - 0x72c]
mov dword [ebp - 0xb98], eax
mov eax, dword [ebp - 8]
imul eax, dword [ebp + eax*4 - 0x1f4], 0x8123
cmp dword [ebp - 8], eax
jge 0x44602f
mov dword [ebp - 0x8fc], 1
jmp 0x446036
and dword [ebp - 0x8fc], 0
mov eax, dword [ebp - 0x8fc]
mov dword [ebp - 0x3b8], eax
cmp dword [ebp - 0x3b8], 1
jl 0x446057
mov dword [ebp - 0x734], 1
jmp 0x44605e
and dword [ebp - 0x734], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1f4]
cmp eax, dword [ebp - 0x734]
jg 0x44607e
mov dword [ebp - 0x9e4], 1
jmp 0x446085
and dword [ebp - 0x9e4], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp eax, dword [ebp - 0x9e4]
jg 0x4460a3
mov dword [ebp - 0x73c], 1
jmp 0x4460aa
and dword [ebp - 0x73c], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp dword [ebp - 0x73c], eax
jle 0x4460c8
mov dword [ebp - 0x904], 1
jmp 0x4460cf
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp dword [ebp - 0x904], eax
jl 0x4460ed
mov dword [ebp - 0x744], 1
jmp 0x4460f4
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x1f4]
cmp dword [ebp - 0x744], eax
jle 0x44611c
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x1f4], 0
jne 0x44611c
and dword [ebp - 0xab8], 0
jmp 0x446126
mov dword [ebp - 0xab8], 1
mov eax, dword [ebp - 0xab8]
sub eax, 0xf11c
je 0x446140
cmp dword [ebp - 0x3b8], 0
je 0x44613e
jmp 0x446164
jmp 0x44615f
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x44615f
push 0
push 0xb84
call dword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x445e6d
mov byte [ebp - 0x135], 0
movzx eax, byte [ebp - 0x135]
test eax, eax
je 0x446183
push 0
push 0x415
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp - 0xba8], 0xa35f394a
mov dword [ebp - 0x127c], 2
mov dword [ebp - 0xce4], 0x7a4bedcc
mov dword [ebp - 0x1284], 0xfffffff8
mov dword [ebp - 0x90c], 0x660f7e73
mov dword [ebp - 0x128c], 1
mov dword [ebp - 0xe98], 0xfffffff7
mov dword [ebp - 0xe94], 0xfffffff7
mov dword [ebp - 0xe90], 0xfffffff7
mov dword [ebp - 0xe8c], 0xfffffff7
lea ecx, [ebp - 0x3fd]
call fcn.004017e5
push eax
lea eax, [ebp - 0xe88]
push eax
lea eax, [ebp - 0xe98]
push eax
lea ecx, [ebp - 0x130c]
call fcn.004106c0
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc6c]
call fcn.00410686
mov dword [ebp - 0x764], 8
mov dword [ebp - 0x1294], 0x6773
mov dword [ebp - 0x11f4], 0xfffffffb
mov dword [ebp - 0x42c], 0x6493
mov dword [ebp - 0xcec], 0xffffffff
mov dword [ebp - 0xbb0], 0x1ba1
push 2
lea ecx, [ebp - 0x11a0]
call fcn.00410610
mov dword [ebp - 0x284], 0
jmp 0x44627e
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 2
jge 0x4462a0
push dword [ebp - 0x284]
lea ecx, [ebp - 0x11a0]
call fcn.004106b1
mov dword [eax], 0x5aa9c4ad
jmp 0x446271
cmp dword [ebp - 0xce4], 0
je 0x4462c7
push 0
lea ecx, [ebp - 0xc6c]
call fcn.004106b1
cmp dword [eax], 0
je 0x4462c7
mov dword [ebp - 0x74c], 1
jmp 0x4462ce
and dword [ebp - 0x74c], 0
push 0
lea ecx, [ebp - 0xc6c]
call fcn.004106b1
mov eax, dword [eax]
cmp eax, dword [ebp - 0x74c]
jl 0x4462f1
mov dword [ebp - 0x754], 1
jmp 0x4462f8
and dword [ebp - 0x754], 0
push 0
lea ecx, [ebp - 0xc6c]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0x90c], eax
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0xba0], eax
mov eax, dword [ebp - 0x90c]
sub eax, dword [ebp - 0x754]
mov dword [ebp - 0xd60], eax
mov eax, dword [ebp - 0x42c]
inc eax
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp - 0xba0]
cmp eax, dword [ebp - 0xd60]
jl 0x446352
mov dword [ebp - 0x3c0], 1
jmp 0x446359
and dword [ebp - 0x3c0], 0
push 3
lea ecx, [ebp - 0xc6c]
call fcn.004106b1
mov ecx, dword [ebp - 0x3c0]
mov dword [eax], ecx
cmp dword [ebp - 0x3c0], 0x1e6
jg 0x446386
mov dword [ebp - 0x9ec], 1
jmp 0x44638d
and dword [ebp - 0x9ec], 0
cmp dword [ebp - 0x9ec], 0x2095d7c
jne 0x4463a5
mov dword [ebp - 0x75c], 1
jmp 0x4463ac
and dword [ebp - 0x75c], 0
mov eax, dword [ebp - 0xba8]
cmp eax, dword [ebp - 0x75c]
jne 0x4463c6
mov dword [ebp - 0x914], 1
jmp 0x4463cd
and dword [ebp - 0x914], 0
mov eax, dword [ebp - 0x914]
mov dword [ebp - 0x764], eax
mov eax, dword [ebp - 0xcec]
cmp dword [ebp - 0x764], eax
jne 0x4463f3
mov dword [ebp - 0xa60], 1
jmp 0x4463fa
and dword [ebp - 0xa60], 0
mov eax, dword [ebp - 0xa60]
mov dword [ebp - 0xbb0], eax
lea ecx, [ebp - 0x11a0]
call fcn.004106ac
lea ecx, [ebp - 0xc6c]
call fcn.004106ac
push 1
lea ecx, [ebp - 0xb58]
call fcn.00410610
mov dword [ebp - 0x314], 0
jmp 0x446442
mov eax, dword [ebp - 0x314]
inc eax
mov dword [ebp - 0x314], eax
cmp dword [ebp - 0x314], 1
jge 0x446464
push dword [ebp - 0x314]
lea ecx, [ebp - 0xb58]
call fcn.004106b1
mov dword [eax], 0x1928c176
jmp 0x446435
push 0
lea ecx, [ebp - 0xb58]
call fcn.004106b1
and dword [eax], 0
jmp 0x44649a
push 0
lea ecx, [ebp - 0xb58]
call fcn.004106b1
mov dword [ebp - 0x76c], eax
mov eax, dword [ebp - 0x76c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x76c]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xb58]
call fcn.004106b1
cmp dword [eax], 0xffffffea
jl 0x4464e2
mov dword [ebp - 0xd34], 0
mov dword [ebp - 0xbb8], 0x849f845d
cmp dword [ebp - 0xd34], 0
je 0x4464cb
jmp 0x4464e2
push 0
lea ecx, [ebp - 0xb58]
call fcn.004106b1
mov eax, dword [eax]
mov dword [ebp - 0xbb8], eax
jmp 0x446476
lea ecx, [ebp - 0xb58]
call fcn.004106ac
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x24ec2e0c
mov dword [ebp - 0x294], 0x4c7af5af
mov dword [ebp - 0x28c], 0
jmp 0x44651e
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x28c], 2
jge 0x44653a
mov eax, dword [ebp - 0x28c]
mov dword [ebp + eax*4 - 0x440], 1
jmp 0x446511
mov dword [ebp - 0x14], 0xb
jmp 0x44654a
mov eax, dword [ebp - 0x14]
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xfffffff5
jle 0x446597
mov byte [ebp - 0xdc], 0
movzx eax, byte [ebp - 0xdc]
test eax, eax
je 0x446595
push 0xffe
push 0xdc7
push 0x2430
push 0x15a9
push 0x23c
push 0x2506
push 0xac5
push 0x2433
push 0x85b
call dword [sym.imp.GDI32.dll_Arc]
jmp 0x446543
mov dword [ebp - 0x14], 0
jmp 0x4465a7
cmp dword [ebp - 0x14], 1
jg 0x4468f5
push 3
lea ecx, [ebp - 0xb34]
call fcn.00410610
mov dword [ebp - 0xcf4], 0x4d14b718
mov dword [ebp - 0x31c], 0
jmp 0x4465e1
cmp dword [ebp - 0x31c], 3
jge 0x446603
mov dword [ebp - 0xd3c], 0
mov dword [ebp - 0x29c], 0xdb3ae355
mov dword [ebp - 0x29c], 0
jmp 0x446922
cmp dword [ebp - 0x29c], 0xfffffff6
je 0x446965