Function at 0x401bed
Capabilities:
Accept command line arguments
Check os version
Extract resource via kernel32 functions
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x67c
mov dword [esp + 4], 9
mov dword [esp + 0x34], 0x2d0da0bd
mov dword [esp + 0x2c], 0xde6f885e
push ebx
mov dword [esp + 0x30], 0xfffffffc
push esi
mov dword [esp + 0x34], 0x8cd3bed1
xor esi, esi
mov dword [esp + 0x34], 0x4c6f4446
inc esi
mov dword [esp + 0x34], 0xcae8ef33
push edi
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x394]
mov dword [esp + 0x38], 0x9d945ad3
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x38], esi
push esi
mov dword [esp + 0x54], edx
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x401c7a
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x394]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x401c68
push 2
mov dword [esp + 0x1c], eax
pop edi
jmp 0x401c98
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x224], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x401c89
push 3
mov dword [esp + 0x14], eax
pop ebx
jmp 0x401d7f
mov dword [esp + 0x34], 9
mov dword [esp + 0x38], 0x2443ac46
mov dword [esp + 0x38], 0xd95da228
mov dword [esp + 0x38], 0x28ace4b0
mov dword [esp + 0x48], 0xac842f88
mov dword [esp + 0x14], eax
jmp 0x401ceb
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x638], 0xf3ac9d73
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x401cd8
push 0xfffffffffffffffc
pop ecx
mov dword [esp + 0x34], ecx
cmp dword [esp + 0x34], ecx
jl 0x401d74
mov dword [esp + 0x40], 0x3d2d672a
mov dword [esp + 0x30], 0xce34aafb
mov dword [esp + 0x3c], 0x9a180452
mov dword [esp + 0x14], eax
jmp 0x401d2c
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x620], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x401d1d
mov ecx, dword [esp + 0x40]
inc dword [esp + 0x3c]
mov edx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
inc dword [esp + 0x30]
cmp ecx, edx
mov ecx, dword [esp + 0x10]
mov edx, esi
cmovne edx, eax
add ecx, edx
jne 0x401d61
mov ecx, dword [esp + 0x48]
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x40], 0x41824674
dec dword [esp + 0x34]
cmp dword [esp + 0x34], 0xfffffffc
jge 0x401cff
inc dword [esp + 0x224]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff7
jge 0x401caa
lea ecx, [esp + 0x394]
call fcn.004017b5
mov dword [esp + 0x18], 0x8e64
xor eax, eax
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x20], eax
jmp 0x401dc1
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x22c], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x401dae
mov dword [esp + 0x20], eax
jmp 0x401de0
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x578], 0xee01e6e8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jl 0x401dcd
cmp dword [esp + 0x18], eax
jne 0x401e0b
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x22c], 0x3046
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
xor ebx, ebx
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
mov ecx, dword [esp + 0x18]
setg bl
xor edx, edx
cmp ebx, ecx
setne dl
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x18]
jl 0x401e4b
mov ecx, esi
cmp dword [esp + 0x22c], eax
jne 0x401e4d
mov ecx, eax
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0xa601d0]
mov dword [esp + 0x580], ecx
lea ecx, [esp + 0x528]
push ecx
lea ecx, [esp + 0x51c]
mov dword [esp + 0xac], eax
push ecx
push eax
lea ecx, [esp + 0xb4]
mov dword [esp + 0xb8], eax
movdqu xmmword [esp + 0x524], xmm0
mov dword [esp + 0xbc], eax
call fcn.00401817
mov dword [esp + 0x18], 0x30f94f37
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0xc], 8
mov dword [esp + 0x38], 0x8884515f
mov dword [esp + 0x48], 0xe974a520
mov dword [esp + 0x34], 7
mov dword [esp + 0x38], 0x32883e73
mov dword [esp + 0x4c], 0xec51
mov dword [esp + 0x10], 0xa
cmp dword [esp + 0x10], edi
jne 0x401fe2
xor eax, eax
mov dword [esp + 0x3c], 0xfffffff6
mov dword [esp + 0x40], 0xfffffffa
mov dword [esp + 0xc], 0xfffffffa
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0xffff
mov dword [esp + 0x14], eax
jmp 0x401f34
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x554], 0x20985a95
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x401f21
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x10], eax
je 0x401f4d
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0xc]
mov dword [esp + 0x554], esi
inc dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x48]
cmp ecx, 0x3388
setge dl
xor ebx, ebx
sub edx, dword [esp + 0x2c]
add edx, dword [esp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x3c]
cmp edx, ecx
setne bl
xor ecx, ecx
cmp esi, ebx
setle cl
xor edx, edx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x40], ecx
setge dl
xor ebx, ebx
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
cmp ecx, edx
setl bl
mov dword [esp + 0xc], ebx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], edi
je 0x401eef
xor esi, esi
inc esi
inc dword [esp + 0x4c]
lea ecx, [esp + 0x2ec]
mov dword [esp + 0x30], esi
push edi
call fcn.004016e3
mov dword [esp + 0x14], 0x7a5b7d8c
mov dword [esp + 0x14], 0
jmp 0x40201f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x2ec]
mov dword [eax + ecx*4], 0xd4e06482
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x402009
mov eax, dword [esp + 0x2ec]
mov dword [eax], 0xffffffe2
mov dword [esp + 0x14], 0
jmp 0x40205c
mov dword [esp + 0x40], 0x13fe662d
mov dword [esp + 0x48], 0xfffffffb
mov eax, dword [esp + 0x40]
mov dword [esp + 0x48], 0xe9646b8d
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffee
jl 0x40203c
lea ecx, [esp + 0x2ec]
call fcn.004017b5
xor eax, eax
mov dword [esp + 0x10], 0xad313dd3
mov dword [esp + 0x40], eax
mov dword [esp + 0x10], eax
jmp 0x4020b6
mov dword [esp + 0x40], 0xfffffffb
xor ebx, ebx
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
cmp ecx, edx
setle bl
mov dword [esp + 0x40], ebx
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4020b2
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor eax, eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c
jl 0x402083
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x18], 3
cmp dword [esp + 0x18], eax
jl 0x403a20
mov dword [esp + 0x3c], 0xf2c29a3d
mov dword [esp + 0x14], eax
jmp 0x4020f6
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0xdc], 0x6af1124f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x4020e3
mov dword [esp + 0x3c], esi
cmp dword [esp + 0x3c], eax
jl 0x4021e3
push esi
lea ecx, [esp + 0x1c8]
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x402130
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x68], 0xfffffffd
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x402120
mov dword [esp + 0x20], eax
jmp 0x402152
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c4]
mov dword [ecx + edx*4], 0xdf82d83d
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x40213c
mov dword [esp + 0x68], eax
jmp 0x402194
mov dword [esp + 0x10], 0x9c9fb37b
mov dword [esp + 0x10], eax
jmp 0x40218a
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + ecx*4 + 0xdc]
mov ecx, dword [esp + 0x68]
mov dword [esp + ecx*4 + 0xdc], edx
mov ecx, dword [esp + 0x10]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x40216c
inc dword [esp + 0x68]
cmp dword [esp + 0x68], esi
jle 0x40215e
mov eax, dword [esp + 0x1c4]
mov dword [eax], esi
mov dword [esp + 0x40], 7
mov dword [esp + 0x68], 0xffffffff
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + eax*4 + 0xdc]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x1c4]
dec dword [eax]
jns 0x4021a3
lea ecx, [esp + 0x1c4]
call fcn.004017b5
dec dword [esp + 0x3c]
jns 0x40210b
mov eax, dword [esp + 0xe0]
lea ecx, [esp + 0x334]
mov dword [esp + 0x3c], eax
push 0xfffffffffffffffc
pop ebx
mov dword [esp + 0xc], esi
mov dword [esp + 0xc], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x14], 5
push 3
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x24], eax
jmp 0x40222b
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x58], 0x20a2
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x40221b
mov dword [esp + 0x24], eax
jmp 0x402246
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x4b4], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x402237
mov dword [esp + 0x24], eax
jmp 0x402269
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x334]
mov dword [ecx + edx*4], 7
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x402253
mov ecx, dword [esp + 0x58]
cmp dword [esp + 0x58], eax
je 0x4022a0
mov ecx, dword [esp + 0x58]
xor ebx, ebx
mov ecx, dword [esp + 0x58]
mov ecx, dword [esp + 0xc]
cmp ecx, esi
mov ecx, dword [esp + 0xc]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, esi
setne dl
cmp edx, dword [esp + 0x58]
jl 0x4022a2
mov ecx, eax
cmp ecx, dword [esp + 0x58]
jle 0x4022b0
mov edx, eax
cmp dword [esp + 0x58], eax
je 0x4022b2
mov edx, esi
xor ecx, ecx
cmp edx, 0xfffffffb
push 6
setg cl
pop edx
add ecx, edx
jne 0x4022c9
mov ecx, eax
cmp dword [esp + 0x58], eax
je 0x4022cb
mov ecx, esi
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0xc]
imul eax, ecx
lea ecx, [esp + 0x334]
mov dword [esp + 0x4b8], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x4bc]
mov eax, dword [esp + 0x334]
or dword [eax], 0xffffffff
call fcn.004017b5
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xa4]
mov eax, dword [eax + ecx*4]
add eax, 0x52d8cb4c
je 0x402ee2
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0xc], 8
mov dword [esp + 0x38], 0x8884515f
mov dword [esp + 0x48], 0xe974a520
mov dword [esp + 0x34], 7
mov dword [esp + 0x38], 0x32883e73
mov dword [esp + 0x4c], 0xec51
mov dword [esp + 0x10], 0xa
cmp dword [esp + 0x10], 2
jne 0x40247b
xor eax, eax
mov dword [esp + 0x3c], 0xfffffff6
push 0xfffffffffffffffa
pop ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], 0xffff
mov dword [esp + 0x14], eax
jmp 0x4023cc
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x584], 0x20985a95
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x4023b9
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x10], eax
je 0x4023e5
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0xc]
mov dword [esp + 0x584], esi
inc dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x48]
cmp ecx, 0x3388
setge dl
xor ebx, ebx
sub edx, dword [esp + 0x2c]
add edx, dword [esp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x3c]
cmp edx, ecx
setne bl
xor ecx, ecx
cmp esi, ebx
setle cl
xor edx, edx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x40], ecx
setge dl
xor ebx, ebx
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
cmp ecx, edx
setl bl
mov dword [esp + 0xc], ebx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 2
je 0x40238c
xor esi, esi
inc esi
inc dword [esp + 0x4c]
lea ecx, [esp + 0x1f4]
mov dword [esp + 0x30], 9
push 2
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x34], 0x9beb0647
mov dword [esp + 0x14], eax
jmp 0x4024bb
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1f4]
mov dword [ecx + edx*4], 0xbca63185
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x4024a5
mov dword [esp + 0x34], eax
jmp 0x402544
mov dword [esp + 0x10], 0xdb8faaae
cmp dword [esp + 0x10], eax
jne 0x40254e
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setl dl
cmp edx, 4
jb 0x4024fa
cmp dword [esp + 0x34], eax
jne 0x4024fa
mov edx, eax
jmp 0x4024ff
xor esi, esi
inc esi
mov edx, esi
mov ecx, dword [esp + 0x1f4]
mov esi, dword [ecx + 4]
sub esi, edx
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x1f4]
mov dword [ecx + edx*4], esi
xor edx, edx
mov ecx, dword [esp + 0x10]
imul ecx, dword [esp + 0x34], 0xf58a
cmp ecx, 0x9507
setl dl
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
xor esi, esi
inc edx
mov dword [esp + 0x10], edx
inc dword [esp + 0x34]
inc esi
cmp dword [esp + 0x34], esi
jle 0x4024c8
lea ecx, [esp + 0x1f4]
call fcn.004017b5
mov dword [esp + 0x30], 3
cmp dword [esp + 0x30], 0
jl 0x403067
push 0xfffffffffffffffc
pop ebx
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x268]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x10], 5
push 3
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x24], eax
jmp 0x4025ae
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x5c], 0x20a2
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x40259e
mov dword [esp + 0x24], eax
jmp 0x4025c9
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x3ac], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x4025ba
mov dword [esp + 0x24], eax
jmp 0x4025ec
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x268]
mov dword [ecx + edx*4], 7
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x4025d6
mov ecx, dword [esp + 0x5c]
cmp dword [esp + 0x5c], eax
je 0x402623
mov ecx, dword [esp + 0x5c]
xor ebx, ebx
mov ecx, dword [esp + 0x5c]
mov ecx, dword [esp + 0xc]
cmp ecx, esi
mov ecx, dword [esp + 0xc]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, esi
setne dl
cmp edx, dword [esp + 0x5c]
jl 0x402625
mov ecx, eax
cmp ecx, dword [esp + 0x5c]
jle 0x402633
mov edx, eax
cmp dword [esp + 0x5c], eax
je 0x402635
mov edx, esi
xor ecx, ecx
cmp edx, 0xfffffffb
push 6
setg cl
pop edx
add ecx, edx
jne 0x40264c
mov ecx, eax
cmp dword [esp + 0x5c], eax
je 0x40264e
mov ecx, esi
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0xc]
imul eax, ecx
lea ecx, [esp + 0x268]
mov dword [esp + 0x3b0], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x3b4]
mov eax, dword [esp + 0x268]
or dword [eax], 0xffffffff
call fcn.004017b5
push 2
lea ecx, [esp + 0x284]
call fcn.004016e3
mov dword [esp + 0x20], 0
lea ecx, [esp + 0x144]
push 2
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4026eb
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x144]
mov dword [ecx + edx*4], 0x871d976f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x4026d5
mov dword [esp + 0x20], eax
jmp 0x402702
cmp dword [esp + 0x20], eax
jne 0x402709
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe2
jg 0x4026f8
mov dword [esp + 0x20], eax
jmp 0x4027b7
mov dword [esp + 0x34], 0x67e307b5
mov dword [esp + 0x34], esi
cmp dword [esp + 0x34], eax
jl 0x4027b3
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x34]
cmp dword [esp + 0x34], eax
jle 0x402746
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x144]
cmp dword [ecx + edx*4], eax
jne 0x402748
mov esi, eax
mov edx, dword [esp + 0x34]
xor ebx, ebx
mov ecx, dword [esp + 0x144]
cmp ebx, dword [ecx + edx*4]
sbb ecx, ecx
neg ecx
sub ecx, esi
neg ecx
sbb ecx, ecx
xor esi, esi
inc ecx
inc esi
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x3c], eax
jmp 0x4027a3
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x10], eax
jmp 0x402794
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x144]
mov dword [ecx + edx*4], 0xb5c29478
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x40277e
mov ecx, dword [esp + 0x34]
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], esi
jle 0x402770
dec dword [esp + 0x34]
jns 0x402728
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jle 0x402712
lea ecx, [esp + 0x144]
call fcn.004017b5
push 4
pop ebx
xor eax, eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], eax
jmp 0x4027ee
mov dword [esp + 0x40], 0xffffffff
cmp dword [esp + 0x40], eax
jne 0x4027f5
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff0
jg 0x4027dc
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x402814
push 0x1d34
push 0x1cea
call edi
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x402830
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x280]
mov dword [ecx + edx*4], 0x3b16aac8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x40281a
mov dword [esp + 0x10], 0xb505
lea ecx, [esp + 0x470]
mov dword [esp + 0x3c], 0xfffffffb
mov dword [esp + 0x20], 0xfc558bac
mov dword [esp + 0x4c], 5
mov dword [esp + 0x38], 0xdb821342
mov dword [esp + 0x2c], 0x1ce3
mov dword [esp + 0x38], esi
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x38], 0xca3691f6
mov dword [esp + 0x40], eax
mov dword [esp + 0x38], 9
push ebx
call fcn.004016e3
mov dword [esp + 0xc], 0xc9ba5b04
mov dword [esp + 0x10], 0
jmp 0x4028bc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x470]
mov dword [eax + ecx*4], 0xc40a98ce
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x4028a6
mov dword [esp + 0x10], 0x8d327cb3
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
cmp eax, 0x4c38
setl cl
cmp ecx, 0xfffffffd
jne 0x4028f1
mov eax, dword [esp + 0x3c]
inc dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x34], 0
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
add eax, 0x7ba2e7b3
add ecx, eax
imul ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, esi
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [esp + 0x4c]
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x470]
call fcn.004017b5
mov edx, dword [esp + 0x18]
xor eax, eax
mov ecx, dword [esp + 0xa4]
cmp dword [ecx + edx*4], eax
je 0x402989
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xa4]
cmp dword [ecx], edx
mov edx, esi
jg 0x40298b
mov edx, eax
mov ecx, dword [esp + 0x280]
mov dword [ecx], edx
mov dword [esp + 0x38], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x38], 0x34fda0e6
mov dword [esp + 0x38], eax
mov dword [esp + 0x40], 0xfffffffa
mov dword [esp + 0x38], 0x708ef6b8
mov dword [esp + 0x38], esi
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x38], 0x729cf308
mov dword [esp + 0x38], 0x1dfd9475
mov dword [esp + 0x38], 0xefb6f65e
mov dword [esp + 0x38], 0x4896e6a3
mov dword [esp + 0x38], 0xd188047d
mov dword [esp + 0x38], eax
mov dword [esp + 0x38], 0x3589
mov dword [esp + 0x2c], 7
mov dword [esp + 0x40], eax
mov dword [esp + 0x14], eax
jmp 0x402a19
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x668], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x402a0a
dec dword [esp + 0x2c]
xor edx, edx
mov ecx, dword [esp + 0x40]
cmp ecx, 8
setle dl
mov dword [esp + 0x40], edx
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 3
jg 0x402ec7
mov dword [esp + 0x24], 0x1e559696
mov dword [esp + 0x2c], 0x1dfe936b
mov dword [esp + 0x10], 0x955205
mov dword [esp + 0x48], eax
mov dword [esp + 0x10], eax
jmp 0x402a74
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x64], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x402a64
mov dword [esp + 0x24], eax
jmp 0x402ad4
mov ecx, dword [esp + 0x24]
cmp dword [esp + ecx*4 + 0x64], eax
je 0x402a8e
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x64]
xor edx, edx
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + ecx*4 + 0x64]
mov ecx, dword [esp + 0x64]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + ecx*4 + 0x64]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + ecx*4 + 0x64]
test ecx, ecx
mov ecx, dword [esp + 0x64]
setg dl
xor ebx, ebx
cmp edx, 0xfffffffe
setl bl
xor edx, edx
cmp ebx, ecx
setl dl
mov dword [esp + 0x10], edx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], eax
jle 0x402a80
mov dword [esp + 0x10], 0x12
cmp dword [esp + 0x10], 0xfffffff0
jg 0x402c57
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0xa60220]
lea ecx, [esp + 0x508]
push ecx
lea ecx, [esp + 0x4fc]
mov dword [esp + 0x48], 0x1a93
push ecx
push eax
lea ecx, [esp + 0x174]
mov dword [esp + 0x174], eax
movdqu xmmword [esp + 0x504], xmm0
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
call fcn.00401817
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x24], 0x17
cmp dword [esp + 0x24], 0xffffffec
jge 0x402c25
mov esi, dword [esp + 0x164]
mov dword [esp + 0x3c], 0xfffb
mov dword [esp + 0xc], 0x315bfeb1
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, 0x49a5
setne cl
lea eax, [edx + 0xddbb]
imul ecx, eax
test ecx, ecx
je 0x402b9f
cmp dword [esp + 0x10], 0
je 0x402b9f
xor eax, eax
inc eax
jmp 0x402ba1
xor eax, eax
cmp eax, dword [esp + 0x64]
jle 0x402bb3
cmp dword [esp + 0x40], 0
je 0x402bb3
xor ecx, ecx
inc ecx
jmp 0x402bb5
xor ecx, ecx
mov eax, dword [esp + 0x64]
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x64]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0xfffffffb
setl al
xor edx, edx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x48]
cmp eax, ecx
setle dl
add edx, dword [esp + 0x3c]
mov eax, dword [esp + 0xc]
imul edx, eax
mov dword [esi + 8], edx
mov dword [esp + 0xc], edx
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
cmp eax, 1
mov eax, dword [esp + 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [esp + 0x2c], ecx
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffec
jl 0x402b5e
mov byte [esp + 0x1f], 0
cmp byte [esp + 0x1f], 0
je 0x402c39
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
lea ecx, [esp + 0x164]
call fcn.004017b5
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff0
push 0
pop eax
jle 0x402aed
mov dword [esp + 0x34], 0xa0c0e075
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0xc], 8
mov dword [esp + 0x38], 0x8884515f
mov dword [esp + 0x48], 0xe974a520
mov dword [esp + 0x24], 7
mov dword [esp + 0x38], 0x32883e73
mov dword [esp + 0x4c], 0xec51
mov dword [esp + 0x10], 0xa
jmp 0x402d85
mov dword [esp + 0x34], 0xfffffff6
push 0xfffffffffffffffa
pop ecx
mov dword [esp + 0x40], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x2c], eax
mov dword [esp + 0x20], 0xffff
mov dword [esp + 0x3c], eax
jmp 0x402ce4
mov ecx, dword [esp + 0x3c]
mov dword [esp + ecx*4 + 0x590], 0x20985a95
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], 3
jl 0x402cd1
mov ecx, dword [esp + 0x34]
cmp dword [esp + 0x10], eax
je 0x402cfd
mov ecx, dword [esp + 0x34]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov esi, dword [esp + 0xc]
mov dword [esp + 0x590], esi
inc dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x48]
cmp ecx, 0x3388
setge dl
xor ebx, ebx
sub edx, dword [esp + 0x2c]
add edx, dword [esp + 0x10]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x34]
cmp edx, ecx
setne bl
xor ecx, ecx
cmp esi, ebx
setle cl
xor edx, edx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x34]
cmp dword [esp + 0x40], ecx
setge dl
xor ebx, ebx
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
cmp ecx, edx
setl bl
mov dword [esp + 0xc], ebx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 2
je 0x402ca4
inc dword [esp + 0x4c]
mov dword [esp + 0x34], 3
cmp dword [esp + 0x34], eax
jl 0x402eb1
mov dword [esp + 0x40], eax
cmp dword [esp + 0x18], eax
jne 0x402eb1
xor ebx, ebx
mov dword [esp + 0x3c], 0x2a72
inc ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x40], 0x61d5
lea ecx, [esp + 0x244]
push ebx
call fcn.004016e3
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x2c], 0xffff
mov dword [esp + 0x4c], 0x3a0f0f5e
mov dword [esp + 0xc], 0xc62bb2c5
mov dword [esp + 0x10], 0
jmp 0x402e19
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x244]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x402e06
mov eax, dword [esp + 0x3c]
cmp eax, dword [esp + 0x3c]
jne 0x402e5a
mov eax, dword [esp + 0x3c]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x244]
mov dword [eax], ecx
je 0x402e5a
mov edx, ebx
jmp 0x402e5c
xor edx, edx
mov eax, dword [esp + 0x48]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x2c]
setg cl
xor edx, edx
cmp ecx, 0x6b9c
setl dl
xor ebx, ebx
cmp edx, eax
setle bl
xor ecx, ecx
add ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0x4c]
cmp ebx, eax
setle cl
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x244]
call fcn.004017b5
mov dword [esp + 0x40], 0xfffffffb
dec dword [esp + 0x34]
push 0
pop eax
jns 0x402da6
mov ecx, dword [esp + 0x34]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
push 1
pop esi
jle 0x402a42
lea ecx, [esp + 0x280]
call fcn.004017b5
dec dword [esp + 0x30]
jns 0x40256d
jmp 0x403067
mov dword [esp + 0x40], 0x7dfa860b
lea ecx, [esp + 0x3c4]
mov dword [esp + 0x48], 0x71c7bf0b
push 2
call fcn.004016e3
mov dword [esp + 0x14], 0
jmp 0x402f20
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x3c4]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x402f0a
mov byte [esp + 0x1f], 0
cmp byte [esp + 0x1f], 0
je 0x402f39
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0x3c4]
mov dword [esp + 0x48], eax
call fcn.004017b5
mov dword [esp + 0x4c], 0xfffffffa
xor eax, eax
mov dword [esp + 0x30], 8
mov dword [esp + 0x38], esi
mov dword [esp + 0x38], 0xfffffff6
mov dword [esp + 0x38], 0x1220985a
mov dword [esp + 0x38], 0xee41b66b
mov dword [esp + 0x38], 0xb090aec5
mov dword [esp + 0x14], eax
jmp 0x402f98
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x5c4], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x402f89
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x402fb6
push eax
push 0x73
push eax
push eax
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor eax, eax
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], eax
jne 0x40305f
push 3
lea ecx, [esp + 0x360]
call fcn.004016e3
mov dword [esp + 0x38], 0
lea ecx, [esp + 0x4a0]
push esi
call fcn.004016e3
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x20], 0
jmp 0x40300c
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x35c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x402ff9
mov dword [esp + 0x20], 0
jmp 0x403033
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x4a0]
mov dword [eax + ecx*4], 0x1b17d72b
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x40301d
dec dword [esp + 0x2c]
lea ecx, [esp + 0x4a0]
call fcn.004017b5
lea ecx, [esp + 0x35c]
call fcn.004017b5
inc dword [esp + 0x30]
je 0x402fc4
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x10], 0xdae8c9f3
lea ecx, [esp + 0x118]
push 4
call fcn.004016e3
mov dword [esp + 0x14], 0xa20bd035
xor eax, eax
mov dword [esp + 0x2c], 5
mov dword [esp + 0x4c], 0xffff
mov dword [esp + 0x30], 0x9132f4bb
mov dword [esp + 0x40], 0x34605dd8
mov dword [esp + 0x24], eax
jmp 0x4030c3
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x118]
mov dword [ecx + edx*4], 0xfffffffb
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 4
jl 0x4030ad
mov dword [esp + 0x24], eax
jmp 0x4030e3
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x380], 0xbc775623
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x4030d0
mov dword [esp + 0x24], eax
jmp 0x4030ff
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x1dc], eax
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x4030f0
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x118]
mov dword [esi + 0xc], ecx
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], eax
jne 0x403203
mov ecx, dword [esp + 0x118]
cmp dword [ecx], eax
je 0x403152
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
xor ecx, ecx
cmp dword [esi + 0xc], 0xfffffffc
setl cl
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], 0xffffffff
jg 0x403152
cmp dword [esp + 0x10], eax
je 0x403152
xor eax, eax
inc eax
xor ecx, ecx
cmp eax, dword [esi + 0xc]
setge cl
xor eax, eax
cmp ecx, 0x1cd25bb5
setle al
xor ecx, ecx
mov dword [esp + 0x380], eax
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, 0x7220b73
setl cl
xor eax, eax
add ecx, dword [esi + 0xc]
cmp ecx, 0x117a540f
mov ecx, dword [esi + 0xc]
setle al
xor edx, edx
cmp eax, 0x78b72129
mov eax, dword [esp + 0x10]
setl dl
imul eax, edx
xor edx, edx
add eax, ecx
cmp eax, ecx
mov eax, dword [esp + 0x118]
setl dl
xor ecx, ecx
add edx, 9
cmp edx, 0x8d92
setg cl
xor edx, edx
sub ecx, dword [eax]
mov eax, dword [esp + 0x1e4]
add ecx, eax
mov eax, dword [esp + 0x1e0]
cmp ecx, eax
mov eax, dword [esp + 0x1dc]
sete dl
mov dword [esi + 0xc], ecx
xor ebx, ebx
cmp edx, eax
mov eax, dword [esp + 0x4c]
setg bl
xor ecx, ecx
cmp ebx, eax
setne cl
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x1dc]
cmp ecx, eax
lea ecx, [esp + 0x118]
setg dl
mov dword [esp + 0x40], edx
call fcn.004017b5
mov dword [esp + 0xc], 3
xor eax, eax
cmp dword [esp + 0xc], eax
jl 0x403a13
mov dword [esp + 0x20], 0xa53d06ce
lea ecx, [esp + 0x488]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x14], 0xffffffff
push 2
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x403276
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0xfc], 0xf251d69f
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x403263
mov dword [esp + 0x20], eax
jmp 0x403299
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x488]
mov dword [ecx + edx*4], 0x337b27f9
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x403283
dec dword [esp + 0x3c]
xor ebx, ebx
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x20], 0x8932
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
cmp edx, ecx
setl bl
xor ecx, ecx
cmp ebx, 0xcbe9
setg cl
xor ebx, ebx
mov dword [esp + 0xfc], ecx
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
inc ecx
cmp ecx, 0xffffffff
mov ecx, dword [esp + 0x3c]
setge bl
xor edx, edx
cmp ebx, ecx
setge dl
imul edx, dword [esp + 0x3c]
cmp edx, dword [esp + 0x3c]
jg 0x403502
mov dword [esp + 0x34], 0x7a75
mov dword [esp + 0x40], eax
mov dword [esp + 0x20], 0xffffffee
jmp 0x4034f5
mov dword [esp + 0x10], 0xadeb9459
mov ecx, dword [esp + 0x20]
sub ecx, 0x3e2be8ca
neg ecx
sbb ecx, ecx
sub ecx, 7
add ecx, dword [esp + 0x3c]
neg ecx
sbb ecx, ecx
add ecx, 0xa903
cmp ecx, dword [esp + 0x10]
jle 0x40335b
cmp dword [esp + 0x34], eax
jne 0x40335b
mov ecx, eax
jmp 0x40335e
xor ecx, ecx
inc ecx
mov edx, dword [esp + 0x34]
xor ebx, ebx
imul edx, ecx
mov ecx, dword [esp + 0x3c]
cmp edx, ecx
setne bl
sub ebx, dword [esp + 0x34]
je 0x403381
cmp dword [esp + 0x10], eax
je 0x403381
xor esi, esi
inc esi
jmp 0x403383
mov esi, eax
mov dword [esp + 0xfc], esi
xor edx, edx
mov ecx, dword [esp + 0x34]
cmp esi, ecx
setg dl
xor ebx, ebx
imul edx, dword [esp + 0x20]
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
cmp edx, ecx
setge bl
sub ebx, dword [esp + 0x40]
sub ebx, dword [esp + 0x34]
mov ecx, dword [esp + 0x20]
imul edx, ebx, 0xd1cd
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x34]
setne bl
xor edx, edx
cmp ebx, ecx
setg dl
sub edx, dword [esp + 0x34]
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], 0xfffffff9
jmp 0x4034e6
mov dword [esp + 0x30], 0x45464cd0
mov dword [esp + 0x24], eax
jmp 0x403407
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x4ac], 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x4033f4
mov dword [esp + 0x24], eax
jmp 0x403427
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x124], 0x717f6c07
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 1
jl 0x403414
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x100], eax
je 0x40346c
mov ecx, dword [esp + 0xfc]
mov dword [esp + 0x30], 0xe7ce488d
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x4b0]
neg edx
sbb edx, edx
neg edx
imul ecx, edx
dec ecx
jne 0x403467
cmp dword [esp + 0x34], eax
je 0x40346c
xor edx, edx
inc edx
jmp 0x40346e
mov edx, eax
mov ecx, dword [esp + 0x124]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x10]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
sub edx, dword [esp + 0x34]
mov dword [esp + 0x40], edx
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4034e2
push 0x21f0
push 0xac9
push 0x15e3
push eax
push 0xc49
push 0x6fc
call edi
mov ebx, dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
push 0x13a3
push 0x171
push 0x18e4
push 0x1fb8
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffea
jl 0x4033e6
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe5
je 0x403324
jmp 0x40353c
mov dword [esp + 0x14], eax
jmp 0x403535
cmp dword [esp + 0xfc], eax
jne 0x40353c
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x403531
push 0x1d34
push 0x1cea
call edi
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
xor eax, eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffef
jle 0x403508
lea ecx, [esp + 0x488]
call fcn.004017b5
mov dword [esp + 0x3c], 0xda314325
lea ecx, [esp + 0x1a0]
push 4
call fcn.004016e3
mov dword [esp + 0x30], 5
xor eax, eax
mov dword [esp + 0x30], 0x7f4ea14c
mov dword [esp + 0x2c], eax
mov dword [esp + 0x38], 0x7276cc72
mov dword [esp + 0x20], eax
jmp 0x403595
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1a0]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x403582
xor ebx, ebx
mov dword [esp + 0x20], eax
inc ebx
jmp 0x4035b8
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x134], 0x8142c78e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jl 0x4035a5
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x4035d2
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
mov edi, dword [esp + 0x1a0]
xor edx, edx
mov eax, dword [edi]
sub eax, dword [edi + 0xc]
imul eax, dword [edi + 4]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x1a0]
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x30]
cmp eax, dword [esi + 8]
mov eax, dword [edi + 0xc]
setg dl
add ecx, 0x2737ae9f
add eax, ecx
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [esi + 8]
mov dword [esp + 0x134], ecx
lea ecx, [esp + 0x1a0]
call fcn.004017b5
mov dword [esp + 0x4c], 0x8ac507b3
xor eax, eax
mov dword [esp + 0x10], 0x1e559696
mov dword [esp + 0x2c], 0xfffffff6
mov dword [esp + 0x40], 0xbb101eb
mov dword [esp + 0x14], eax
jmp 0x403678
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x78], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x403668
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jg 0x4036ee
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4036e1
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x21f0
push 0xac9
push 0x15e3
push eax
push 0xc49
push 0x6fc
call ebx
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x13a3
push 0x171
push 0x18e4
push 0x1fb8
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor eax, eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x403688
xor ebx, ebx
inc ebx
mov ecx, dword [esp + 0x78]
mov ecx, dword [esp + 0x78]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x78]
add ecx, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x78]
mov ecx, dword [esp + 0x78]
mov ecx, dword [esp + 0x78]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x40], ecx
cmp dword [esp + 0x18], eax
jne 0x403728
mov ecx, eax
cmp dword [esp + 0x3c], eax
je 0x40372a
mov ecx, ebx
mov dword [esp + 0x3c], ecx
cmp dword [esp + 0x3c], eax
jne 0x403744
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xa4]
cmp dword [ecx + edx*4], eax
je 0x403746
mov eax, ebx
mov esi, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + 0x18]
add ecx, eax
mov eax, dword [esp + 0x4c]
cmp ecx, eax
mov eax, dword [esp + 0xa4]
push 4
setge dl
xor ecx, ecx
cmp dword [eax + esi*4], edx
setle cl
xor eax, eax
cmp ecx, 0x74db9bec
lea ecx, [esp + 0x12c]
setge al
cmp eax, 0xdbd3d38e
sbb eax, eax
inc eax
mov dword [esp + 0x34], eax
call fcn.004016e3
push 3
pop esi
push esi
lea ecx, [esp + 0xc0]
call fcn.004016e3
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], 0
jmp 0x4037c8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x128]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x4037b5
mov dword [esp + 0x20], 0
jmp 0x4037ef
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xbc]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x4037d9
mov eax, dword [esp + 0xbc]
mov dword [eax], esi
mov dword [esp + 0x20], 5
lea ecx, [esp + 0x1ac]
push 4
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x403832
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1ac]
mov dword [ecx + edx*4], 0xfffffffe
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x40381c
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], eax
jl 0x403992
mov ebx, dword [esp + 0xbc]
mov ecx, dword [esp + 0x128]
mov edi, dword [esp + 0x1ac]
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x40], ecx
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x403885
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
xor eax, eax
mov ecx, dword [esp + 0xbc]
mov dword [edi + 8], eax
mov dword [esp + 0x2c], eax
mov edx, dword [ecx]
sub edx, dword [ebx + 8]
mov ecx, dword [esp + 0x2c]
sub edx, ecx
mov ecx, dword [esp + 0xbc]
mov dword [esp + 0x2c], edx
xor edx, edx
mov esi, dword [ecx]
mov ecx, dword [esp + 0x2c]
cmp ecx, esi
mov ecx, dword [esp + 0x128]
setg dl
xor ebx, ebx
cmp edx, esi
mov edx, dword [ecx + esi*4]
setl bl
mov ecx, dword [esp + 0x40]
add edx, ebx
xor ebx, ebx
mov dword [ecx + 0xc], edx
mov ecx, dword [esp + 0x20]
cmp edx, ecx
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0xbc]
setge bl
xor edx, edx
cmp ebx, ecx
setl dl
cmp edx, 0xfbb9cf7d
ja 0x403908
mov edx, dword [esi]
mov ecx, dword [esp + 0x128]
cmp dword [ecx + edx*4], eax
je 0x403908
xor ecx, ecx
inc ecx
jmp 0x40390a
mov ecx, eax
cmp ecx, dword [esi]
je 0x403936
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x40397e
push eax
push eax
push 0xcac
push 0x15be
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
xor eax, eax
jmp 0x40397e
mov ecx, dword [edi + 8]
xor edx, edx
cmp ecx, dword [esi]
mov dword [esp + 0x48], 7
setg dl
mov dword [esp + 0x2c], 0xc8f9611c
mov ecx, dword [esp + 0x48]
xor ebx, ebx
imul edx, edx, 0xfff9
cmp edx, ecx
mov ecx, dword [esp + 0x1ac]
setl bl
xor edx, edx
cmp dword [ecx], ebx
sete dl
xor ecx, ecx
cmp edx, 0x6ea3
setge cl
mov dword [esp + 0x2c], ecx
dec dword [esp + 0x20]
mov ebx, dword [esp + 0x4c]
jns 0x403864
xor ebx, ebx
push 3
inc ebx
pop esi
mov dword [esp + 0x20], eax
jmp 0x4039b7
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4039b3
push eax
push ebx
push 0x99
push eax
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor eax, eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jle 0x403998
lea ecx, [esp + 0x1ac]
call fcn.004017b5
mov eax, dword [esp + 0xbc]
dec dword [eax]
jns 0x4037fe
lea ecx, [esp + 0xbc]
call fcn.004017b5
lea ecx, [esp + 0x128]
call fcn.004017b5
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x4c], eax
dec dword [esp + 0xc]
push 0
pop eax
jns 0x403239
dec dword [esp + 0x18]
push 1
pop esi
jns 0x4020d5
push dword [esp + 0x6c]
lea ecx, [esp + 0x548]
mov dword [esp + 0x18], 0xac64a684
push ecx
lea ecx, [esp + 0x53c]
mov dword [esp + 0x140], eax
push ecx
xorps xmm0, xmm0
mov dword [esp + 0x148], eax
push eax
lea ecx, [esp + 0x148]
mov dword [esp + 0x150], eax
movdqu xmmword [esp + 0x544], xmm0
call fcn.00401817
mov dword [esp + 0x30], 8
push 6
mov dword [esp + 0x44], 0xe708bee
pop eax
mov dword [esp + 0x38], eax
xor eax, eax
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x403aa0
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x403b7b
mov dword [esp + 0x2c], eax
mov dword [esp + 0xc], eax
jmp 0x403ac2
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x88], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x403ab3
mov dword [esp + 0x88], 3
cmp dword [esp + 0x88], eax
jl 0x403b77
mov esi, dword [esp + 0x138]
mov dword [esp + 0xc], eax
jmp 0x403afd
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x74], 0xf17e2f9d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x403aed
cmp dword [esi + 4], eax
je 0x403b11
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x74]
mov ecx, dword [esp + 0x74]
cmp dword [esp + 0x14], eax
jne 0x403b25
cmp dword [esp + 0x74], eax
jne 0x403b25
mov edx, eax
jmp 0x403b28
xor edx, edx
inc edx
mov ecx, dword [esp + 0x88]
xor ebx, ebx
add ecx, edx
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x74]
mov ecx, dword [esp + 0x2c]
cmp ecx, edx
mov ecx, dword [esp + 0x30]
setne bl
sub ecx, ebx
je 0x403b50
mov ecx, dword [esp + 0x74]
mov ecx, dword [esp + 0x74]
mov edx, dword [esp + 0x88]
sub edx, ecx
mov ecx, dword [esp + 0x40]
add ecx, edx
mov dword [esp + 0x30], ecx
dec dword [esp + 0x88]
jns 0x403ae7
xor esi, esi
inc esi
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff7
jne 0x403aa9
lea ecx, [esp + 0x138]
call fcn.004017b5
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xa4]
mov dword [esp + 0x18], eax
call fcn.004017b5
push 2
lea ecx, [esp + 0xb4]
call fcn.004016e3
mov dword [esp + 0x34], 0x18d4081c
mov dword [esp + 0xc], 0
jmp 0x403bdc
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xb0]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x403bc6
mov dword [esp + 0x34], 0
jmp 0x403df7
push 2
lea ecx, [esp + 0x154]
call fcn.004016e3
mov dword [esp + 0x14], 0x37a30b91
xor eax, eax
mov dword [esp + 0x10], 4
mov dword [esp + 0x10], 0x6e4944c1
mov dword [esp + 0xc], esi
mov dword [esp + 0x4c], 5
mov dword [esp + 0xc], eax
jmp 0x403c40
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x150]
mov dword [ecx + edx*4], 0x6e838462
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x403c2a
mov ecx, dword [esp + 0x150]
mov dword [esp + 0x2c], ecx
mov dword [ecx + 4], eax
mov dword [esp + 0x40], 0xf9052196
mov dword [esp + 0x48], 0xfffffffc
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], esi
jge 0x403c89
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x60], 0xb61bab59
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x403c6f
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x60], eax
cmp dword [esp + 0x60], esi
jg 0x403d73
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x60]
xor ebx, ebx
cmp dword [ecx + 4], eax
mov ecx, dword [esp + 0xb0]
setne bl
mov edx, dword [ecx + edx*4]
mov ecx, dword [esp + 0x60]
sub edx, ebx
add ecx, edx
jne 0x403cd4
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0xb0]
cmp dword [ecx + edx*4], eax
mov ecx, eax
je 0x403cd6
mov ecx, esi
mov dword [esp + 0x10], ecx
xor ebx, ebx
mov ecx, dword [esp + 0x60]
imul ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x60]
mov esi, dword [esp + 0x34]
mov edi, dword [esp + 0x34]
mov edx, dword [esp + 0xb0]
mov ecx, dword [esp + 0x60]
cmp ecx, dword [edx + esi*4]
mov ecx, dword [esp + 0xb0]
setg bl
xor edx, edx
cmp ebx, dword [ecx + edi*4]
mov ecx, dword [esp + 0x34]
setne dl
mov dword [esp + 0x48], edx
xor edx, edx
cmp dword [esp + 0x48], ecx
setl dl
mov dword [esp + 0x48], edx
mov dword [esp + 0x10], 0xfffffffb
jmp 0x403d53
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x403d4f
call dword [sym.imp.USER32.dll_DestroyCaret]
xor eax, eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffed
jg 0x403d3c
inc dword [esp + 0x60]
xor esi, esi
mov ecx, dword [esp + 0x30]
inc esi
cmp dword [esp + 0x60], esi
jle 0x403ca2
mov ecx, dword [esp + 0x2c]
dec dword [esp + 0x4c]
inc dword [ecx + 4]
cmp dword [ecx + 4], esi
jle 0x403c55
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0xb0]
cmp dword [ecx + edx*4], eax
jne 0x403de7
mov dword [esp + 0x10], eax
jmp 0x403de1
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xb0]
cmp dword [ecx + edx*4], eax
jne 0x403de7
mov dword [esp + 0xc], eax
jmp 0x403dd6
mov dword [esp + 0x14], eax
jmp 0x403dcb
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x150]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x403db5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x13
jge 0x403daf
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x403d99
lea ecx, [esp + 0x150]
call fcn.004017b5
inc dword [esp + 0x34]
cmp dword [esp + 0x34], esi
jle 0x403bf0
lea ecx, [esp + 0xb0]
call fcn.004017b5
mov dword [esp + 0x14], 0x52cb1363
xor eax, eax
mov dword [esp + 0x38], esi
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x30], 0x82f4e55b
mov dword [esp + 0x2c], 0xb83d
mov dword [esp + 0x18], eax
jmp 0x403e4c
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x234], 0x342e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x403e39
mov dword [esp + 0x18], eax
jmp 0x403e6c
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x23c], 9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x403e59
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x403e8c
push eax
push 0x134f
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
xor eax, eax
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], eax
jl 0x40402c
mov edi, 0x5a7a
mov dword [esp + 0x38], esi
lea ecx, [esp + 0x2e0]
mov dword [esp + 0x4c], 0xec7516a2
mov dword [esp + 0x40], esi
mov dword [esp + 0x38], eax
mov dword [esp + 0x38], 0xfffffffa
mov dword [esp + 0x38], 0xfffffffe
push 3
mov dword [esp + 0x4c], 0xfffffff8
pop ebx
mov dword [esp + 0x38], 4
mov dword [esp + 0x38], 0xfffffff9
mov dword [esp + 0x38], 0xb168f92
push ebx
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x403f11
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2e0]
mov dword [ecx + edx*4], 0xfffffffe
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x403efb
mov dword [esp + 0x18], eax
jmp 0x403f30
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x608], 0x88b1495d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x403f1d
mov ecx, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + ecx*4 + 0x234]
mov ecx, dword [esp + 0x40]
inc dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x234], edi
mov ecx, dword [esp + 0x48]
test ecx, ecx
mov ecx, dword [esp + 0x240]
setns dl
cmp edx, 0xffffffff
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [esp + 0x2e0]
setle bl
xor edx, edx
mov ecx, dword [ecx]
sub ecx, ebx
cmp ecx, 0x97a8
mov ecx, edi
setl dl
sub ecx, edx
cmp dword [esp + 0x30], 0xfffb
sbb edx, edx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [esp + 0x4c]
cmp ecx, edx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x240], ecx
mov dword [esp + 0x10], eax
jmp 0x40400c
mov dword [esp + 0x38], 0x630de2fd
lea ecx, [esp + 0x3f0]
mov dword [esp + 0x38], 0xa828c040
push esi
call fcn.004016e3
mov dword [esp + 0xc], 0
jmp 0x403ff2
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x3f0]
and dword [eax + ecx*4], 0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x403fdf
inc dword [esp + 0x2c]
lea ecx, [esp + 0x3f0]
call fcn.004017b5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x403fb8
lea ecx, [esp + 0x2e0]
call fcn.004017b5
dec dword [esp + 0x14]
push 0
pop eax
jns 0x403e9f
push 3
mov dword [esp + 0x44], 0x386cce57
mov dword [esp + 0x10], eax
pop ebx
jmp 0x404050
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x614], 0x53bc6e5c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x40403d
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x40406a
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_UnionRect]
mov dword [esp + 0x40], 0x714a0256
lea ecx, [esp + 0x448]
mov eax, 0x61928c17
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x38], 0xfffffff7
mov dword [esp + 0x38], 0x4cd45360
mov dword [esp + 0x38], 0x473e
mov dword [esp + 0x38], 0xa9831117
push esi
call fcn.004016e3
push 4
pop edi
mov dword [esp + 0x38], 0xbc1c234a
lea ecx, [esp + 0x298]
mov dword [esp + 0x38], 0x4f77722a
mov dword [esp + 0x38], esi
push edi
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x24], eax
jmp 0x4040ff
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x5fc], 0xfffffff7
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jl 0x4040ec
mov dword [esp + 0x24], eax
jmp 0x40411d
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x448]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x40410b
mov dword [esp + 0x24], eax
jmp 0x40413f
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x298]
mov dword [eax + ecx*4], 0xe213
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jl 0x404129
mov eax, dword [esp + 0x298]
lea ecx, [esp + 0x298]
dec dword [eax]
call fcn.004017b5
lea ecx, [esp + 0x448]
call fcn.004017b5
mov dword [esp + 0x3c], 0x3aa9ac70
xor eax, eax
mov dword [esp + 0x20], 0xfffffff6
mov dword [esp + 0x2c], 0x71ebdc59
mov dword [esp + 0xc], eax
jmp 0x404199
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x2b0], 0x42575e7e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x404186
push 6
mov dword [esp + 0x24], eax
pop edx
cmp dword [esp + 0x20], edx
jle 0x404432
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x31c]
push 2
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x34], 0xaf3922cb
mov dword [esp + 0xc], eax
jmp 0x4041e4
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x31c]
mov dword [ecx + edx*4], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x4041d2
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0xfffffffe
jle 0x404413
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x18], 0xd1d8475
mov dword [esp + 0x40], 2
mov dword [esp + 0xc], eax
jmp 0x40422f
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xc8], 0xd35da2a0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x40421c
mov ecx, dword [esp + 0x20]
xor edx, edx
mov ecx, dword [esp + 0x24]
cmp ecx, 0xffffffff
mov dword [esp + 0xc8], ecx
setg dl
mov dword [esp + 0x30], edx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
sub edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
neg edx
sbb edx, edx
inc edx
imul edx, ecx
mov ecx, dword [esp + 0x31c]
mov dword [ecx], edx
cmp edx, dword [esp + 0x24]
jl 0x40427f
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
cmp ecx, edx
setne bl
xor edx, edx
cmp ebx, 0x1949
setge dl
sub edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [esp + 0x10]
setl bl
xor edx, edx
cmp ebx, ecx
setl dl
xor ecx, ecx
cmp ecx, edx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x374c7af5
setle dl
xor ebx, ebx
add edx, dword [esp + 0x10]
add edx, dword [esp + 0x24]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
cmp edx, ecx
setg bl
cmp ebx, dword [esp + 0x10]
jle 0x40438a
mov dword [esp + 0x30], 0xa746c20b
cmp dword [esp + 0x20], eax
je 0x404314
mov ecx, dword [esp + 0xc8]
mov ecx, dword [esp + 0x20]
xor edx, edx
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
imul ecx, dword [esp + 0x20]
cmp ecx, 0x7eab
setle dl
imul ecx, edx, 0xfffb
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], eax
jne 0x404354
mov edx, eax
cmp dword [esp + 0x10], eax
je 0x404356
mov edx, esi
mov ecx, dword [esp + 0x30]
sub edx, ecx
add edx, dword [esp + 0x40]
mov dword [esp + 0x2b4], edx
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4043db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor eax, eax
jmp 0x4043db
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2b4], ecx
mov dword [esp + 0x34], esi
cmp dword [esp + 0x34], eax
jl 0x4043db
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], eax
jl 0x4043d5
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4043cf
push 0x2330
push 0x141
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor eax, eax
dec dword [esp + 0x18]
jns 0x4043b1
dec dword [esp + 0x34]
jns 0x4043a7
mov dword [esp + 0x18], eax
jmp 0x4043fa
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4043f6
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x10
jne 0x4043e1
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffffe
jg 0x4041fa
push 3
pop ebx
lea ecx, [esp + 0x31c]
call fcn.004017b5
inc dword [esp + 0x20]
push 6
pop edx
cmp dword [esp + 0x20], edx
jg 0x4041b0
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
mov dword [esp + 0x2b4], 0x2e653d3a
mov dword [esp + 0x3c], eax
jmp 0x404ee8
mov dword [esp + 0x24], 0x80849f84
mov dword [esp + 0x20], 0xfffffff6
mov dword [esp + 0x2c], 0x71ebdc59
mov dword [esp + 0xc], eax
jmp 0x40447d
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x2c8], 0x42575e7e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x40446a
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], edx
jle 0x404719
push 6
pop edi
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x304]
push 2
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x34], 0xaf3922cb
mov dword [esp + 0xc], eax
jmp 0x4044c8
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x304]
mov dword [ecx + edx*4], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x4044b6
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0xfffffffe
jle 0x4046f7
mov dword [esp + 0x10], eax
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x18], 0xd1d8475
mov dword [esp + 0x40], 2
mov dword [esp + 0xc], eax
jmp 0x404513
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xcc], 0xd35da2a0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x404500
mov ecx, dword [esp + 0x20]
xor edx, edx
mov ecx, dword [esp + 0x24]
cmp ecx, 0xffffffff
mov dword [esp + 0xcc], ecx
setg dl
mov dword [esp + 0x30], edx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
sub edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
neg edx
sbb edx, edx
inc edx
imul edx, ecx
mov ecx, dword [esp + 0x304]
mov dword [ecx], edx
cmp edx, dword [esp + 0x24]
jl 0x404563
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
cmp ecx, edx
setne bl
xor edx, edx
cmp ebx, 0x1949
setge dl
sub edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x34]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [esp + 0x10]
setl bl
xor edx, edx
cmp ebx, ecx
setl dl
xor ecx, ecx
cmp ecx, edx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x374c7af5
setle dl
xor ebx, ebx
add edx, dword [esp + 0x10]
add edx, dword [esp + 0x24]
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x24]
cmp edx, ecx
setg bl
cmp ebx, dword [esp + 0x10]
jle 0x40466e
mov dword [esp + 0x30], 0xa746c20b
cmp dword [esp + 0x20], eax
je 0x4045f8
mov ecx, dword [esp + 0xcc]
mov ecx, dword [esp + 0x20]
xor edx, edx
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x34]
imul ecx, dword [esp + 0x20]
cmp ecx, 0x7eab
setle dl
imul ecx, edx, 0xfffb
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], eax
jne 0x404638
mov edx, eax
cmp dword [esp + 0x10], eax
je 0x40463a
mov edx, esi
mov ecx, dword [esp + 0x30]
sub edx, ecx
add edx, dword [esp + 0x40]
mov dword [esp + 0x2cc], edx
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4046bf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor eax, eax
jmp 0x4046bf
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2cc], ecx
mov dword [esp + 0x34], esi
cmp dword [esp + 0x34], eax
jl 0x4046bf
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], eax
jl 0x4046b9
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4046b3
push 0x2330
push 0x141
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor eax, eax
dec dword [esp + 0x18]
jns 0x404695
dec dword [esp + 0x34]
jns 0x40468b
mov dword [esp + 0x18], eax
jmp 0x4046de
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4046da
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor eax, eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x10
jne 0x4046c5
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffffe
jg 0x4044de
push 3
pop ebx
lea ecx, [esp + 0x304]
call fcn.004017b5
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jg 0x404494
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
xor eax, eax
mov dword [esp + 0x2cc], 0x2e653d3a
mov dword [esp + 0x24], eax
jmp 0x404ed7
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x40], 0x9fb37b04
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x40474d
push eax
call edi
xor eax, eax
mov dword [esp + 0x14], 0xfffffff1
cmp dword [esp + 0x14], 0xffffffe3
jl 0x4047c0
mov dword [esp + 0x40], 0xfffffff9
mov dword [esp + 0xc], eax
jmp 0x40477d
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x3dc], 0x5912491e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x40476a
mov edx, dword [esp + 0x40]
xor ebx, ebx
mov ecx, dword [esp + 0x14]
cmp ecx, edx
setge bl
mov dword [esp + 0x3dc], ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x4047b2
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe3
jge 0x40475c
push 3
pop ebx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x14], 0xd4e06482
mov dword [esp + 0x38], esi
mov dword [esp + 0x38], 0xccc89593
mov dword [esp + 0x4c], 0x3785
mov dword [esp + 0x14], 0xffffffe3
cmp dword [esp + 0x14], 0xd
je 0x4048b5
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0xa601f0]
lea ecx, [esp + 0x4e8]
push ecx
lea ecx, [esp + 0x4dc]
mov dword [esp + 0x1c0], eax
push ecx
push eax
lea ecx, [esp + 0x1c8]
mov dword [esp + 0x1cc], eax
movdqu xmmword [esp + 0x4e4], xmm0
mov dword [esp + 0x1d0], eax
call fcn.00401817
mov dword [esp + 0xc], 0xffffffff
mov eax, 0x7412df3d
mov dword [esp + 0x38], 5
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x170], eax
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0xc], 0
jmp 0x404891
mov dword [esp + 0x2c], 0
dec dword [esp + 0x2c]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x404881
lea ecx, [esp + 0x1b8]
call fcn.004017b5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xd
push 0
pop eax
jne 0x4047f7
dec dword [esp + 0x4c]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jg 0x404ed3
lea ebx, [esp + 0x454]
lea edi, [esp + 0x464]
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0xa601e0]
lea ecx, [esp + 0x4f8]
push ecx
lea ecx, [esp + 0x4ec]
mov dword [esp + 0x110], eax
push ecx
push eax
lea ecx, [esp + 0x118]
mov dword [esp + 0x11c], eax
movdqu xmmword [esp + 0x4f4], xmm0
mov dword [esp + 0x120], eax
call fcn.00401817
mov dword [esp + 0x34], esi
xor eax, eax
mov dword [esp + 0x40], 0x97bc8b4
mov dword [esp + 0x34], 3
cmp dword [esp + 0x34], eax
jl 0x404ab4
push 3
pop ebx
mov dword [esp + 0x10], 0x4f402e31
mov dword [esp + 0x38], 0x711e7bff
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], 0x8cf1d65f
mov dword [esp + 0xc], eax
jmp 0x404974
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x648], 0xf5ef889a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x404961
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], eax
jl 0x404a5c
mov dword [esp + 0x14], 0x144ad72d
mov dword [esp + 0x38], 0x2189f42c
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jg 0x404a2e
mov dword [esp + 0x30], 8
lea ecx, [esp + 0x250]
push esi
call fcn.004016e3
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x4049da
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x250]
mov dword [ecx + edx*4], 0xf7e7308
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x4049c4
mov dword [esp + 0x30], ebx
cmp dword [esp + 0x30], eax
jl 0x404a04
mov dword [esp + 0x38], 0x9f5954e3
mov dword [esp + 0x2c], 0x4087a912
inc dword [esp + 0x2c]
dec dword [esp + 0x30]
jns 0x4049ea
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x108]
cmp dword [ecx + edx*4], eax
lea ecx, [esp + 0x250]
call fcn.004017b5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x4049a7
xor eax, eax
mov ecx, dword [esp + 0x34]
xor ebx, ebx
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x108]
push 1
mov ecx, dword [edx + ecx*4]
cmp ecx, dword [edx + esi*4]
pop esi
setge bl
mov dword [esp + 0x40], ebx
dec dword [esp + 0x10]
push 3
pop ebx
jns 0x404989
mov dword [esp + 0xc], eax
jmp 0x404a9d
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x404a84
push 0x1da9
push 0x2685
push 0x1436
call dword [sym.imp.KERNEL32.dll_HeapCreate]
xor eax, eax
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x404a99
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x404a62
dec dword [esp + 0x34]
jns 0x40493f
lea ebx, [esp + 0x454]
lea ecx, [esp + 0x108]
call fcn.004017b5
push 4
lea ecx, [esp + 0x40c]
call fcn.004016e3
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x404aec
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x408]
mov dword [ecx + edx*4], 0x327c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x404ad6
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], al
je 0x404b1e
push eax
push 0x2bb
push 0x13ed
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
xor eax, eax
mov byte [esp + 0x1f], al
cmp byte [esp + 0x1f], 0
je 0x404b31
push eax
push eax
call dword [sym.imp.USER32.dll_LoadCursorA]
lea ecx, [esp + 0x408]
call fcn.004017b5
movdqa xmm0, xmmword [0xa60210]
mov byte [esp + 0x2b], 0
mov dword [esp + 0x14], 0x324ec2e0
mov dword [esp + 0x38], 0x71865425
push ecx
mov dword [esp + 0x3c], esi
lea ecx, [esp + 0x564]
mov dword [esp + 0x3c], 0xffffffff
push edi
mov dword [esp + 0x40], 0xaf8b5131
mov dword [esp + 0x40], 0
mov dword [esp + 0x40], esi
push ebx
movdqu xmmword [esp + 0x460], xmm0
call fcn.0040178f
mov dword [esp + 0x2c], esi
mov dword [esp + 0x14], 0xd
jmp 0x404bde
mov dword [esp + 0xc], 0x3d9532bb
mov dword [esp + 0xc], 7
jmp 0x404bd3
mov byte [esp + 0x1f], 0
cmp byte [esp + 0x1f], 0
je 0x404bcf
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x10
je 0x404bb2
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffeb
jle 0x404ba0
dec dword [esp + 0x2c]
lea ecx, [esp + 0x560]
call fcn.004017b5
cmp byte [esp + 0x2b], 0
je 0x404d0d
movdqa xmm0, xmmword [0xa60230]
lea ecx, [esp + 0x504]
push ecx
lea eax, [esp + 0x518]
mov dword [esp + 0x1c], 8
push eax
push ecx
mov dword [esp + 0x4c], 2
lea ecx, [esp + 0x578]
mov dword [esp + 0x44], esi
movdqu xmmword [esp + 0x510], xmm0
call fcn.0040178f
mov dword [esp + 0x2c], 0xdd79339b
mov dword [esp + 0x18], 0
jmp 0x404ce8
mov dword [esp + 0x10], 0xfda0e60f
lea ecx, [esp + 0x464]
push 2
call fcn.004016e3
mov dword [esp + 0xc], 0
jmp 0x404c8d
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x464]
mov dword [eax + ecx*4], 0xfff7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x404c77
mov dword [esp + 0x10], 0xffffffe3
jmp 0x404cd1
cmp dword [esp + 0x18], 0
je 0x404cad
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x40], 0xcf041577
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xb
jle 0x404c9e
lea ecx, [esp + 0x464]
call fcn.004017b5
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff8
je 0x404c57
dec dword [esp + 0x2c]
lea ecx, [esp + 0x56c]
call fcn.004017b5
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 3
lea ecx, [esp + 0x260]
call fcn.004016e3
push esi
lea ecx, [esp + 0x424]
call fcn.004016e3
xor eax, eax
mov dword [esp + 0x38], 0xb055cc25
mov dword [esp + 0x18], eax
jmp 0x404d4e
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x25c]
mov dword [ecx + edx*4], 0x2e91a049
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x404d38
mov dword [esp + 0x18], eax
jmp 0x404d6e
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x420]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x404d5b
mov ecx, dword [esp + 0x25c]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x420]
call fcn.004017b5
lea ecx, [esp + 0x25c]
call fcn.004017b5
xor eax, eax
mov byte [esp + 0x1f], al
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0x9f7fd1e8
mov dword [esp + 0xc], eax
jmp 0x404dbd
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x5ec], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x404dae
cmp dword [esp + 0x10], 0xd149febb
sbb ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], eax
jmp 0x404e21
mov ecx, dword [esp + 0x10]
cmp dword [esp + ecx*4 + 0x5ec], eax
jne 0x404e28
mov dword [esp + 0x14], eax
jmp 0x404e16
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], 0
je 0x404e12
push 0x21e3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
xor eax, eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x404dec
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x404dd9
cmp byte [esp + 0x1f], 0
je 0x404eb8
push 2
lea ecx, [esp + 0x480]
call fcn.004016e3
xor eax, eax
mov dword [esp + 0xc], 0xfffffffe
mov dword [esp + 0xc], eax
jmp 0x404e67
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x47c]
mov dword [ecx + edx*4], 8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x404e51
mov dword [esp + 0xc], eax
jmp 0x404e88
cmp byte [esp + 0x2b], 0
je 0x404e84
push eax
call dword [sym.imp.USER32.dll_CharNextW]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
mov byte [esp + 0x2b], al
jle 0x404e74
cmp byte [esp + 0x2b], 0
je 0x404e9f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea ecx, [esp + 0x47c]
call fcn.004017b5
push 0x11fa
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
push 0
pop eax
jle 0x4048d5
mov edi, dword [sym.imp.USER32.dll_CharUpperW]
push 3
pop ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jle 0x40472d
inc dword [esp + 0x3c]
push 6
pop edx
cmp dword [esp + 0x3c], ebx
jle 0x40444c
push 6
pop ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
jmp 0x404f0e
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x160], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x404eff
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], 0
je 0x404f36
push eax
push 0x12
push eax
push eax
push 0xb19
push 0x1906
call dword [sym.imp.USER32.dll_ToAsciiEx]
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x404f4f
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x160], 0xade19d29
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x404f3c
mov ecx, dword [esp + 0x3c]
xor edx, edx
cmp ecx, 0x193e0566
setl dl
mov dword [esp + 0x3c], edx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x40], 0x9fb37b04
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], 0
je 0x404f88
push eax
call edi
xor eax, eax
mov dword [esp + 0x14], 0xfffffff1
cmp dword [esp + 0x14], 0xffffffe3
push 2
pop edi
jl 0x404ffd
mov dword [esp + 0x40], 0xfffffff9
mov dword [esp + 0xc], eax
jmp 0x404fbb
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x440], 0x5912491e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x404fa8
mov edx, dword [esp + 0x40]
xor ebx, ebx
mov ecx, dword [esp + 0x14]
cmp ecx, edx
setge bl
mov dword [esp + 0x440], ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], 0
je 0x404fef
push eax
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor eax, eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe3
jge 0x404f9a
push 3
pop ebx
lea ecx, [esp + 0x6c]
push ecx
push eax
push 0xeaf
push dword [esp + 0x5c]
push 0x6d7c
push dword [esp + 0x58]
call fcn.0040d4ba
mov dword [esp + 0x28], 0
lea ecx, [esp + 0x2bc]
mov dword [esp + 0x24], esi
add esp, 0x18
mov dword [esp + 0x30], 0x6edad94e
mov dword [esp + 0x2c], edi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x14], 0xfffffff8
mov dword [esp + 0x14], 0xfffe
push edi
call fcn.004016e3
mov dword [esp + 0x18], 0
jmp 0x405077
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x658], 0x88d96753
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x405064
mov dword [esp + 0x18], 0
jmp 0x4050a2
push dword [esp + 0x18]
lea ecx, [esp + 0x2a8]
call fcn.004012f8
mov dword [eax], 0xfffffff8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x405088
cmp dword [esp + 0x10], 0
jne 0x40511d
dec dword [esp + 0x14]
je 0x4050bd
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
push 0
lea ecx, [esp + 0x2a8]
call fcn.004012f8
mov esi, dword [esp + 0x10]
mov edi, eax
mov ecx, dword [esp + 0xc]
xor edx, edx
sub esi, dword [edi]
cmp esi, ecx
setle dl
xor eax, eax
mov dword [esp + 0x30], edx
mov ecx, dword [esp + 0x30]
cmp dword [edi], eax
sete al
xor ecx, ecx
cmp eax, 0x3a23fe5e
setne cl
xor eax, eax
cmp ecx, 0xebe6
setle al
xor ecx, ecx
cmp eax, dword [edi]
setne cl
xor eax, eax
cmp ecx, dword [edi]
setg al
xor esi, esi
mov dword [edi], eax
inc esi
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x14], 0
je 0x405199
mov dword [esp + 0x14], 0xf5f9
lea ecx, [esp + 0x274]
push esi
call fcn.004016e3
mov dword [esp + 0xc], 0
jmp 0x405156
push dword [esp + 0xc]
call fcn.004012f8
mov dword [eax], 0x758c9e43
inc dword [esp + 0xc]
lea ecx, [esp + 0x274]
cmp dword [esp + 0xc], esi
jl 0x405143
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
push 0
call fcn.004012f8
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
lea ecx, [esp + 0x274]
call fcn.004017b5
jmp 0x405281
mov dword [esp + 0x10], 0
jmp 0x40523d
mov dword [esp + 0x14], 0xffffffff
jmp 0x40522e
push esi
lea ecx, [esp + 0x290]
call fcn.004016e3
mov dword [esp + 0xc], 0
jmp 0x4051e1
push dword [esp + 0xc]
lea ecx, [esp + 0x290]
call fcn.004012f8
mov dword [eax], 0x76a90d26
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x4051c7
mov byte [esp + 0x2b], 0
cmp byte [esp + 0x2b], 0
je 0x40520a
push 0x1386
push 0x167e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0
lea ecx, [esp + 0x290]
call fcn.004012f8
lea ecx, [esp + 0x28c]
mov eax, dword [eax]
mov dword [esp + 0x30], eax
call fcn.004017b5
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe4
jge 0x4051b0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x14
jne 0x4051a6
mov dword [esp + 0xc], 0
jmp 0x40527b
mov byte [esp + 0x2b], 0
cmp byte [esp + 0x2b], 0
je 0x405277
push 0x21e3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x405252
lea ecx, [esp + 0x2a4]
call fcn.004017b5
lea eax, [esp + 0x534]
mov dword [esp + 0x14], 0xac64a684
push eax
lea eax, [esp + 0x528]
xorps xmm0, xmm0
push eax
lea ecx, [esp + 0x5bc]
movdqu xmmword [esp + 0x52c], xmm0
call fcn.004017d4
push ecx
lea ecx, [esp + 0x438]
push dword [eax + 4]
push dword [eax]
call fcn.0040178f
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x30], 8
push 6
mov dword [esp + 0x48], 0xe708bee
pop eax
mov dword [esp + 0x38], eax
xor eax, eax
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], al
je 0x40530b
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x4053f1
mov dword [esp + 0x2c], eax
mov dword [esp + 0xc], eax
jmp 0x40532a
cmp dword [esp + 0xc], esi
jl 0x40531e
cmp dword [esp + 0x14], 0xfffffff7
jne 0x405314
lea ecx, [esp + 0x434]
call fcn.004017b5
lea eax, [esp + 0x554]
mov dword [esp + 0x20], 0xe0648261
push eax
lea eax, [esp + 0x548]
mov dword [esp + 0x18], 0xac64a684
xorps xmm0, xmm0
lea ecx, [esp + 0x5c0]
push eax
movdqu xmmword [esp + 0x54c], xmm0
call fcn.004017d4
push ecx
lea ecx, [esp + 0x498]
push dword [eax + 4]
push dword [eax]
call fcn.0040178f
mov dword [esp + 0x30], 8
push 6
mov dword [esp + 0x48], 0xe708bee
pop eax
mov dword [esp + 0x38], eax
xor eax, eax
mov byte [esp + 0x2b], al
cmp byte [esp + 0x2b], al
je 0x405488
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x40556b