Function at 0x4209e0
Capabilities:
Check if file exists
Create thread
Extract resource via kernel32 functions
Get common file path
Get graphical window text
Move file
Resolve function by parsing pe exports
Write file on windows

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x49d9f4
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x11c8
call fcn.0048a5c0
mov eax, dword [0x4d7200]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x1194], esi
mov eax, dword [ebx + 8]
xorps xmm0, xmm0
movq qword [ebp - 0x20], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x11a0], eax
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], 0
movq qword [ebp - 0x3c], xmm0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov byte [ebp - 0x34], 1
mov edi, dword [ebx + 0xc]
xor eax, eax
mov byte [ebp - 4], 1
movq qword [ebp - 0x54], xmm0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x118c], eax
test edi, edi
je 0x420aae
cmp word [edi], ax
je 0x420aae
inc eax
cmp word [edi + eax*2], 0
jne 0x420aa0
mov dword [ebp - 0x118c], eax
mov dword [ebp - 0x50], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov ecx, dword [ebp - 0x118c]
add esp, 4
mov dword [ebp - 0x54], eax
test ecx, ecx
jle 0x420afc
mov edx, eax
sub edi, eax
mov esi, ecx
nop
mov ax, word [edi + edx]
lea edx, [edx + 2]
mov word [edx - 2], ax
sub esi, 1
jne 0x420ae0
mov esi, dword [ebp - 0x1194]
mov edi, dword [ebx + 0xc]
mov eax, dword [ebp - 0x54]
xor edx, edx
mov byte [ebp - 0x4c], 1
mov word [eax + ecx*2], dx
push edx
push 1
push 1
push edx
push str._PostUpdate
lea ecx, [ebp - 0x54]
mov byte [ebp - 4], 2
call fcn.004025a0
test eax, eax
jne 0x421079
push ecx
mov ecx, esi
call fcn.0043fc30
cmp eax, 1
jne 0x421079
test edi, edi
je 0x420dc3
xor eax, eax
cmp word [edi], ax
je 0x420dc3
nop dword [eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x420b50
cmp eax, 1
jle 0x420dc3
cmp dword [esi + 0x208], 0
jne 0x420b85
push 2
call fcn.0048a2cb
add esp, 4
mov dword [esi + 0x208], eax
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x20c], ecx
mov byte [esi + 0x210], 1
xor edx, edx
mov ecx, dword [esi + 0x208]
mov esi, edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x11b4], eax
mov eax, 0x4c06c8
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x11a0], ecx
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x11b0], ecx
mov dword [ebp - 0x11a8], ecx
nop
inc edx
cmp word [edx*2 + 0x4c0008], 0
jne 0x420bd0
mov edi, dword [ebp - 0x11a8]
test edi, edi
jne 0x420c06
mov dword [ebp - 0x11a8], edi
mov edi, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b4], edi
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x11a0], ecx
jmp 0x420c58
cmp word [edi], 0
mov dword [ebp - 0x1190], 0
je 0x420c50
mov dword [ebp - 0x11a8], edi
mov edi, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b4], edi
mov edi, dword [ebp - 0x1190]
mov dword [ebp - 0x11a0], ecx
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x1198], eax
inc edi
cmp word [ecx + edi*2], 0
jne 0x420c40
mov ecx, dword [ebp - 0x11a0]
jmp 0x420c56
mov edi, dword [ebp - 0x1190]
add edx, edi
mov edi, dword [ebx + 0xc]
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4c06c8], 0
jne 0x420c60
add eax, edx
xor edx, edx
mov dword [ebp - 0x118c], eax
mov eax, dword [ebp - 0x1198]
cmp word [edi], dx
je 0x420caf
mov edx, dword [ebp - 0x11a8]
mov dword [ebp - 0x11a8], edx
mov edx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b4], edx
xor edx, edx
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x11a0], ecx
inc edx
cmp word [edi + edx*2], 0
jne 0x420ca7
mov eax, dword [ebp - 0x118c]
xor ecx, ecx
add eax, edx
mov edx, 2
mov dword [ebp - 0x118c], eax
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov edx, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x119c], eax
mov ecx, eax
test edx, edx
je 0x420d01
movzx eax, word [edx]
test ax, ax
je 0x420d01
nop
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x420cf0
mov edi, 0x4c0008
mov edx, 0x22
sub edi, ecx
nop dword [eax]
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x420d10
mov eax, dword [ebp - 0x11a8]
mov edi, dword [ebx + 0xc]
test eax, eax
je 0x420d51
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x420d51
mov eax, dword [ebp - 0x11a0]
nop
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
add ecx, 2
test dx, dx
jne 0x420d40
mov eax, dword [ebp - 0x1198]
mov edx, 0x22
nop dword [eax]
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
add ecx, 2
test dx, dx
jne 0x420d60
movzx eax, word [edi]
mov edx, eax
test ax, ax
je 0x420d91
nop dword [eax + eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x420d80
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x420da6
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x119c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x11b4]
jmp 0x420fce
cmp dword [esi + 0x208], 0
jne 0x420de7
push 2
call fcn.0048a2cb
add esp, 4
mov dword [esi + 0x208], eax
xor ecx, ecx
mov word [eax], cx
mov dword [esi + 0x20c], ecx
mov byte [esi + 0x210], 1
mov edx, str.___PostUpdate
mov edi, dword [esi + 0x208]
mov eax, edi
mov ecx, dword [ebp - 0x20]
xor esi, esi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11b4], edx
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1198], ecx
mov dword [ebp - 0x11b0], edi
mov dword [ebp - 0x11a0], edi
inc esi
cmp word [esi*2 + 0x4c0008], 0
jne 0x420e30
test edi, edi
jne 0x420e5a
mov dword [ebp - 0x11a0], edi
mov dword [ebp - 0x1198], ecx
mov dword [ebp - 0x11b4], edx
mov dword [ebp - 0x11a8], eax
jmp 0x420e8f
xor eax, eax
cmp word [edi], ax
je 0x420e8d
mov dword [ebp - 0x1198], ecx
mov ecx, dword [ebp - 0x11a8]
mov dword [ebp - 0x11a8], ecx
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x11a0], edi
mov dword [ebp - 0x11b4], edx
inc eax
cmp word [ecx + eax*2], 0
jne 0x420e85
add esi, eax
xor eax, eax
inc eax
cmp word [eax*2 + str.___PostUpdate], 0
jne 0x420e91
add esi, eax
xor ecx, ecx
mov edx, 2
mov dword [ebp - 0x11b0], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov ecx, eax
mov dword [ebp - 0x118c], edi
mov eax, dword [ebp - 0x20]
add esp, 4
mov edi, dword [ebp - 0x11a8]
mov dword [ebp - 0x11ac], ecx
test eax, eax
je 0x420f31
movzx edx, word [eax]
mov edi, dword [ebp - 0x11a0]
mov dword [ebp - 0x118c], edi
mov edi, dword [ebp - 0x11a8]
mov dword [ebp - 0x119c], edx
test dx, dx
je 0x420f31
movzx edx, word [eax]
mov edi, dword [ebp - 0x11a0]
mov esi, edx
mov dword [ebp - 0x118c], edi
mov edi, dword [ebp - 0x11a8]
mov dword [ebp - 0x119c], edx
nop dword [eax]
mov word [ecx], si
lea eax, [eax + 2]
movzx esi, word [eax]
add ecx, 2
test si, si
jne 0x420f20
mov edx, 0x4c0008
mov esi, 0x22
sub edx, ecx
nop dword [eax]
mov word [ecx], si
add ecx, 2
movzx eax, word [ecx + edx]
mov esi, eax
test ax, ax
jne 0x420f40
mov eax, dword [ebp - 0x118c]
mov esi, dword [ebp - 0x11b0]
mov edx, dword [ebp - 0x11b4]
test eax, eax
je 0x420f91
movzx eax, word [eax]
mov esi, eax
mov dword [ebp - 0x119c], esi
mov esi, dword [ebp - 0x11b0]
test ax, ax
je 0x420f91
movzx eax, ax
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x420f80
mov eax, 0x22
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
lea ecx, [ecx + 2]
test ax, ax
jne 0x420f96
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x420fbc
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
test eax, eax
je 0x420fdf
push eax
call fcn.00489f13
add esp, 4
mov esi, dword [ebp - 0x3c]
push 0x802
mov dword [ebp - 0x38], 0
call fcn.0048a2cb
xor ecx, ecx
mov dword [ebp - 0x3c], eax
add esp, 4
mov word [eax + 0x800], cx
mov eax, dword [ebp - 0x3c]
mov word [eax], cx
test esi, esi
je 0x421015
push esi
call fcn.00489f13
add esp, 4
push dword [ebp - 0x3c]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [ebp - 0x3c]
test esi, esi
jne 0x421042
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov edx, dword [ebp - 0x20]
mov byte [ebp - 0x34], 1
test edx, edx
jne 0x421065
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push 0
push dword [ebx + 0x10]
mov byte [ebp - 0x18], 1
push esi
call fcn.004082b0
jmp 0x426aeb
xor ecx, ecx
call fcn.00408800
test eax, eax
je 0x421e0a
xorps xmm0, xmm0
mov dword [ebp - 0x40], 0
movq qword [ebp - 0x48], xmm0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x40], 1
movq qword [ebp - 0x2c], xmm0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x24], 1
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x20]
push 0x402
mov dword [ebp - 0x119c], eax
mov dword [ebp - 0x1c], 0
call fcn.0048a2cb
mov dword [ebp - 0x20], eax
xor ecx, ecx
add esp, 4
mov word [eax + 0x400], cx
mov eax, dword [ebp - 0x20]
mov word [eax], cx
mov eax, dword [ebp - 0x119c]
test eax, eax
je 0x42110d
push eax
call fcn.00489f13
add esp, 4
push dword [ebp - 0x20]
push 0x200
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ecx
lea ecx, [esi + 0x208]
call fcn.00401620
mov esi, eax
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x421139
push eax
call fcn.00489f13
add esp, 4
xor eax, eax
mov byte [ebp - 0x34], 0
test esi, esi
je 0x421150
cmp word [esi], ax
je 0x421150
inc eax
cmp word [esi + eax*2], 0
jne 0x421148
mov dword [ebp - 0x38], eax
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov dword [ebp - 0x3c], edx
test eax, eax
jle 0x421193
nop dword [eax + eax]
mov ax, word [esi + ecx*2]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x3c]
cmp ecx, eax
jl 0x421180
xor ecx, ecx
mov word [edx + eax*2], cx
mov ecx, 4
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov byte [ebp - 0x34], 1
test eax, eax
jne 0x4211c2
xor eax, eax
test esi, esi
je 0x4211bf
cmp word [esi], ax
je 0x4211bf
inc eax
cmp word [esi + eax*2], 0
jne 0x4211b7
mov dword [ebp - 0x38], eax
cmp eax, 4
mov byte [ebp - 0x34], 1
cmovle ecx, eax
test eax, eax
je 0x4211de
sub eax, ecx
xor ecx, ecx
mov dword [ebp - 0x38], eax
mov word [esi + eax*2], cx
mov esi, dword [ebp - 0x3c]
test esi, esi
jne 0x4211fa
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov ecx, dword [ebp - 0x20]
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x118c], ecx
test ecx, ecx
jne 0x421229
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x118c], ecx
xor eax, eax
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x48], 0
mov byte [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
test ecx, ecx
je 0x421258
cmp word [ecx], ax
je 0x421258
nop word [eax + eax]
inc eax
cmp word [ecx + eax*2], 0
jne 0x421250
test esi, esi
je 0x42126d
xor ecx, ecx
cmp word [esi], cx
je 0x42126b
inc ecx
cmp word [esi + ecx*2], 0
jne 0x421263
add eax, ecx
xor ecx, ecx
nop
inc ecx
cmp word [ecx*2 + 0x4c0704], 0
jne 0x421270
add eax, ecx
mov edx, 2
mov dword [ebp - 0x119c], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov ecx, dword [ebp - 0x118c]
add esp, 4
mov dword [ebp - 0x11a4], eax
mov edx, eax
test ecx, ecx
je 0x4212d1
movzx ecx, word [ecx]
test cx, cx
je 0x4212d1
mov edi, dword [ebp - 0x118c]
sub edi, eax
mov word [edx], cx
add edx, 2
movzx eax, word [edi + edx]
mov ecx, eax
test ax, ax
jne 0x4212c0
test esi, esi
je 0x4212f2
movzx eax, word [esi]
mov ecx, eax
test ax, ax
je 0x4212f2
sub esi, edx
mov word [edx], cx
add edx, 2
movzx eax, word [edx + esi]
mov ecx, eax
test ax, ax
jne 0x4212e1
mov esi, 0x4c0704
mov ecx, 0x36
sub esi, edx
nop
mov word [edx], cx
lea edx, [edx + 2]
movzx eax, word [edx + esi]
mov ecx, eax
test ax, ax
jne 0x421300
xor eax, eax
mov byte [ebp - 0x40], 1
mov word [edx], ax
mov eax, dword [ebp - 0x11a4]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x119c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x11a8], eax
test eax, eax
jne 0x421357
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x11a8], eax
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0x34], 1
mov dword [ebp - 0x118c], eax
test eax, eax
jne 0x421386
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x118c], eax
xor esi, esi
mov byte [ebp - 0x18], 1
mov dword [ebp - 0x2c], 0
mov byte [ebp - 0x24], 0
mov dword [ebp - 0x28], 0
test eax, eax
je 0x4213af
cmp word [eax], si
je 0x4213af
inc esi
cmp word [eax + esi*2], 0
jne 0x4213a7
mov eax, dword [ebp - 0x11a8]
test eax, eax
je 0x4213ca
xor ecx, ecx
cmp word [eax], cx
je 0x4213c8
inc ecx
cmp word [eax + ecx*2], 0
jne 0x4213c0
add esi, ecx
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4c0714], 0
jne 0x4213d0
add esi, eax
xor ecx, ecx
mov edx, 2
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov ecx, dword [ebp - 0x118c]
add esp, 4
mov dword [ebp - 0x11c0], eax
mov edx, eax
test ecx, ecx
je 0x421431
movzx ecx, word [ecx]
test cx, cx
je 0x421431
mov edi, dword [ebp - 0x118c]
sub edi, eax
nop dword [eax]
mov word [edx], cx
add edx, 2
movzx eax, word [edx + edi]
mov ecx, eax
test ax, ax
jne 0x421420
mov ecx, dword [ebp - 0x11a8]
test ecx, ecx
je 0x421461
movzx eax, word [ecx]
mov edi, eax
mov dword [ebp - 0x119c], edi
test ax, ax
je 0x421461
movzx edi, ax
sub ecx, edx
mov word [edx], di
add edx, 2
movzx eax, word [edx + ecx]
mov edi, eax
test ax, ax
jne 0x421450
mov edi, 0x4c0714
mov ecx, 0x36
sub edi, edx
nop dword [eax]
mov word [edx], cx
lea edx, [edx + 2]
movzx eax, word [edx + edi]
mov ecx, eax
test ax, ax
jne 0x421470
xor eax, eax
mov dword [ebp - 0x28], esi
mov word [edx], ax
mov eax, dword [ebp - 0x11c0]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x3c]
mov byte [ebp - 0x24], 1
mov dword [ebp - 0x11b0], eax
test eax, eax
jne 0x4214c1
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x11b0], eax
mov esi, dword [ebp - 0x1c]
mov byte [ebp - 0x34], 1
mov byte [ebp - 0x18], 0
test esi, esi
jne 0x4214eb
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x4214e8
cmp word [ecx], si
je 0x4214e8
nop dword [eax]
inc esi
cmp word [ecx + esi*2], 0
jne 0x4214e0
mov dword [ebp - 0x1c], esi
test eax, eax
je 0x421500
xor ecx, ecx
cmp word [eax], cx
je 0x4214fe
inc ecx
cmp word [eax + ecx*2], 0
jne 0x4214f6
add esi, ecx
xor eax, eax
inc eax
cmp word [eax*2 + 0x4c0724], 0
jne 0x421502
add esi, eax
xor ecx, ecx
mov edx, 2
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov edx, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x11ac], eax
mov ecx, eax
test edx, edx
je 0x421554
movzx eax, word [edx]
test ax, ax
je 0x421554
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x421543
mov edx, dword [ebp - 0x11b0]
test edx, edx
je 0x421584
movzx eax, word [edx]
mov edi, eax
mov dword [ebp - 0x119c], edi
test ax, ax
je 0x421584
sub edx, ecx
movzx edi, ax
mov word [ecx], di
add ecx, 2
movzx eax, word [edx + ecx]
mov edi, eax
test ax, ax
jne 0x421573
mov edi, 0x4c0724
mov edx, 0x36
sub edi, ecx
mov word [ecx], dx
lea ecx, [ecx + 2]
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x421590
mov edi, dword [ebx + 0xc]
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4215b9
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x11ac]
push eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov byte [ebp - 0x11ca], al
mov byte [ebp - 0x11c9], al
test al, al
je 0x42175a
push 0xfc8
lea eax, [ebp - 0x1110]
push 0
push eax
call fcn.0048ba10
mov eax, dword [ebp - 0x20]
add esp, 0xc
test eax, eax
jne 0x421619
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push eax
lea ecx, [ebp - 0x1110]
mov byte [ebp - 0x18], 1
call fcn.004063f0
sub esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1110]
call fcn.004064a0
cmp eax, 0x4c0734
je 0x42169d
test eax, eax
je 0x421709
mov ecx, 0x4c0734
sub eax, ecx
mov dword [ebp - 0x11ac], eax
nop word [eax + eax]
movzx esi, word [eax + ecx]
mov eax, esi
mov dword [ebp - 0x119c], eax
test si, si
jne 0x42167b
cmp word [ecx], si
je 0x42169d
movzx edx, word [ecx]
jmp 0x42168b
movzx eax, word [ecx]
mov edx, eax
cmp si, ax
je 0x421692
mov eax, dword [ebp - 0x119c]
cmp ax, dx
jb 0x421709
ja 0x421709
mov eax, dword [ebp - 0x11ac]
add ecx, 2
jmp 0x421660
mov esi, dword [ebp - 0x20]
test esi, esi
jne 0x4216bc
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push 0xa
push 0xc9
push dword [ebp - 0x11a0]
mov byte [ebp - 0x18], 1
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4216ec
push eax
push dword [ebp - 0x11a0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x11b0], eax
jmp 0x4216f6
mov dword [ebp - 0x11b0], 0
mov ecx, esi
call fcn.00409150
cmp eax, dword [ebp - 0x11b0]
jne 0x421709
test edx, edx
je 0x421710
mov byte [ebp - 0x11c9], 0
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x154]
test eax, eax
je 0x421727
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x160]
test eax, eax
je 0x42173a
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x16c]
test eax, eax
je 0x42174d
push eax
call fcn.00489f13
add esp, 4
cmp byte [ebp - 0x11c9], 0
jne 0x421892
push 0
push SysReAllocString
push 2
push 0
push 1
push 0xc0000000
push dword [ebp - 0x11a4]
mov byte [ebp - 0x40], 1
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x421892
cmp esi, 0xffffffff
je 0x421892
push 0xa
push 0xc9
push dword [ebp - 0x11a0]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x119c], eax
test eax, eax
je 0x421934
push eax
push dword [ebp - 0x11a0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x11ac], eax
test eax, eax
je 0x421934
push dword [ebp - 0x119c]
push dword [ebp - 0x11a0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x421934
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x421934
push 0
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], 0
push ecx
push dword [ebp - 0x11ac]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x42188f
cmp byte [ebp - 0x11ca], 0
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
je 0x42185d
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x42184a
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push 1
push dword [ebp - 0x11c0]
mov byte [ebp - 0x18], 1
push eax
mov byte [ebp - 0x24], 1
call esi
mov eax, dword [ebp - 0x20]
mov byte [ebp - 0x40], 1
test eax, eax
jne 0x421880
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push 1
push eax
push dword [ebp - 0x11a4]
mov byte [ebp - 0x18], 1
call esi
mov edi, dword [ebx + 0xc]
mov esi, dword [ebp - 0x3c]
push 0x802
mov dword [ebp - 0x38], 0
call fcn.0048a2cb
xor ecx, ecx
mov dword [ebp - 0x3c], eax
add esp, 4
mov word [eax + 0x800], cx
mov eax, dword [ebp - 0x3c]
mov word [eax], cx
test esi, esi
je 0x4218c8
push esi
call fcn.00489f13
add esp, 4
push dword [ebp - 0x3c]
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test edi, edi
je 0x421b83
xor eax, eax
cmp word [edi], ax
je 0x421b83
nop dword [eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x4218f0
cmp eax, 1
jle 0x421b83
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x11a8], edx
test edx, edx
jne 0x421940
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x11a8], edx
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], cl
mov dword [ebp - 0x1c], ecx
jmp 0x421952
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x421892
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov eax, 0x4c075c
mov dword [ebp - 0x11b4], edx
mov ecx, edx
mov dword [ebp - 0x11c4], eax
mov esi, edi
mov dword [ebp - 0x1198], ecx
mov edi, dword [ebx + 0xc]
xor eax, eax
mov dword [ebp - 0x11b0], edx
nop dword [eax + eax]
inc eax
cmp word [eax*2 + 0x4c0008], 0
jne 0x421980
mov dword [ebp - 0x118c], eax
mov eax, 0x4c075c
test edx, edx
jne 0x4219c1
mov ecx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b4], ecx
mov ecx, dword [ebp - 0x1198]
mov dword [ebp - 0x11a8], edx
mov dword [ebp - 0x11c4], eax
mov dword [ebp - 0x1198], ecx
jmp 0x421a14
cmp word [edx], 0
mov dword [ebp - 0x1190], 0
je 0x421a05
mov edi, dword [ebp - 0x11b0]
mov dword [ebp - 0x11a8], edx
mov edx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11c4], eax
xor eax, eax
mov dword [ebp - 0x11b4], edx
mov dword [ebp - 0x1198], ecx
inc eax
cmp word [edi + eax*2], 0
jne 0x4219f7
mov dword [ebp - 0x1190], eax
mov ecx, dword [ebp - 0x1190]
add dword [ebp - 0x118c], ecx
mov edi, dword [ebx + 0xc]
mov eax, dword [ebp - 0x11c4]
xor ecx, ecx
nop dword [eax]
inc ecx
cmp word [ecx*2 + 0x4c075c], 0
jne 0x421a20
add dword [ebp - 0x118c], ecx
cmp word [edi], 0
mov ecx, dword [ebp - 0x1198]
mov edx, dword [ebp - 0x11a8]
je 0x421a6e
mov dword [ebp - 0x11a8], edx
mov edx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11c4], eax
xor eax, eax
mov dword [ebp - 0x11b4], edx
mov dword [ebp - 0x1198], ecx
inc eax
cmp word [edi + eax*2], 0
jne 0x421a64
jmp 0x421a70
xor eax, eax
mov ecx, dword [ebp - 0x118c]
mov edx, 2
add ecx, eax
mov dword [ebp - 0x118c], ecx
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov edx, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x119c], eax
mov ecx, eax
test edx, edx
je 0x421ac2
movzx eax, word [edx]
test ax, ax
je 0x421ac2
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x421ab1
mov edi, 0x4c0008
mov edx, 0x22
sub edi, ecx
nop
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x421ad0
mov eax, dword [ebp - 0x11a8]
mov edi, dword [ebx + 0xc]
test eax, eax
je 0x421b11
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x421b11
mov eax, dword [ebp - 0x1198]
nop
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
add ecx, 2
test dx, dx
jne 0x421b00
mov eax, dword [ebp - 0x11c4]
mov edx, 0x22
nop dword [eax]
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
add ecx, 2
test dx, dx
jne 0x421b20
movzx eax, word [edi]
mov edx, eax
test ax, ax
je 0x421b51
nop dword [eax + eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x421b40
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x421b66
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x119c]
mov ecx, dword [ebp - 0x118c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x11b4]
mov dword [ebp - 0x1c], ecx
jmp 0x421d88
mov edi, dword [ebp - 0x20]
test edi, edi
jne 0x421bb2
push 2
call fcn.0048a2cb
mov dword [ebp - 0x20], eax
add esp, 4
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 0x20]
mov eax, edi
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], cl
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x11a8], eax
jmp 0x421bcc
mov eax, edi
mov dword [ebp - 0x11a8], edi
mov dword [ebp - 0x20], 0
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
mov edx, edi
mov dword [ebp - 0x11b0], edi
mov ecx, 0x4c0008
mov dword [ebp - 0x11b4], edx
mov dword [ebp - 0x11a0], ecx
xor esi, esi
nop word [eax + eax]
inc esi
cmp word [esi*2 + 0x4c0008], 0
jne 0x421bf0
test edi, edi
jne 0x421c14
mov dword [ebp - 0x11a8], eax
mov dword [ebp - 0x11a0], ecx
mov dword [ebp - 0x11b4], edx
jmp 0x421c4a
xor eax, eax
cmp word [edi], ax
je 0x421c48
mov edx, dword [ebp - 0x11a8]
mov dword [ebp - 0x11a8], edx
mov edx, dword [ebp - 0x11b4]
mov dword [ebp - 0x11a0], ecx
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x11b4], edx
nop
inc eax
cmp word [ecx + eax*2], 0
jne 0x421c40
add esi, eax
xor eax, eax
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4c0008], 0
jne 0x421c50
add esi, eax
xor ecx, ecx
mov edx, 2
mov dword [ebp - 0x1190], esi
lea eax, [esi + 1]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov ecx, dword [ebp - 0x20]
add esp, 4
mov edx, dword [ebp - 0x11a0]
mov dword [ebp - 0x11b0], ecx
mov ecx, eax
mov dword [ebp - 0x1198], eax
mov eax, dword [ebp - 0x11b0]
mov dword [ebp - 0x118c], edi
test eax, eax
je 0x421ce7
movzx eax, word [eax]
mov dword [ebp - 0x11ac], eax
mov dword [ebp - 0x118c], edi
test ax, ax
je 0x421ce7
movzx eax, ax
mov dword [ebp - 0x119c], eax
mov eax, dword [ebp - 0x11b0]
mov esi, dword [ebp - 0x119c]
mov dword [ebp - 0x118c], edi
mov word [ecx], si
lea eax, [eax + 2]
movzx esi, word [eax]
add ecx, 2
test si, si
jne 0x421cd6
mov edi, 0x4c0008
mov esi, 0x22
sub edi, ecx
mov word [ecx], si
add ecx, 2
movzx eax, word [edi + ecx]
mov esi, eax
test ax, ax
jne 0x421cf3
mov eax, dword [ebp - 0x118c]
mov esi, dword [ebp - 0x1190]
mov edi, dword [ebp - 0x11b4]
test eax, eax
je 0x421d44
movzx eax, word [eax]
mov esi, eax
mov dword [ebp - 0x119c], esi
mov esi, dword [ebp - 0x1190]
test ax, ax
je 0x421d44
movzx eax, ax
mov word [ecx], ax
lea edi, [edi + 2]
movzx eax, word [edi]
add ecx, 2
test ax, ax
jne 0x421d33
mov eax, 0x22
nop dword [eax]
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
lea ecx, [ecx + 2]
test ax, ax
jne 0x421d50
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x421d76
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x11a8]
mov dword [ebp - 0x1c], esi
mov byte [ebp - 0x18], 1
test eax, eax
je 0x421d99
push eax
call fcn.00489f13
add esp, 4
mov esi, dword [ebp - 0x3c]
test esi, esi
jne 0x421db8
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x20], 0
mov byte [ebp - 0x34], 1
jne 0x421dd7
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x20]
push 1
push dword [ebx + 0x10]
mov byte [ebp - 0x18], 1
push esi
call fcn.004082b0
push dword [ebp - 0x11c0]
call fcn.00489f13
add esp, 4
push dword [ebp - 0x11a4]
call fcn.00489f13
add esp, 4
jmp 0x426aeb
mov eax, dword [ebp - 0x11a0]
push 0
mov dword [esi + 0x12c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov edi, eax
push 8
push edi
call esi
push 0xa
push edi
mov dword [ebp - 0x11ac], eax
call esi
push edi
mov esi, eax
push 0
mov dword [ebp - 0x119c], esi
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [ebp - 0x11ac], 0x400
mov eax, 0x352
mov edi, dword [ebp - 0x1194]
mov ecx, 0x2ee
cmovg ecx, eax
mov edx, 0x28a
push ecx
push 0
push 0xffffffffffffffff
push 0xffffffffffffffff
push 0xffffffffffffffff
cmp esi, 0x384
mov dword [ebp - 0x11c4], ecx
push 0xffffffffffffffff
mov eax, 0x226
lea esi, [edi + 0x2a8]
cmovg eax, edx
push eax
push ecx
push 0x4c0764
push 0x4c0778
mov ecx, esi
call fcn.0040bf80
push ecx
push 8
push ecx
mov ecx, esi
mov dword [edi + 0x120], eax
call fcn.0040d460
push 0x101020
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ecx, dword [esi + 0x1e0]
mov edx, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 0x11ac], eax
test ecx, ecx
je 0x421edc
push ecx
call edx
mov edx, dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [esi + 0x1e0], 0
mov eax, dword [esi + 0x1fc]
test eax, eax
je 0x421efc
cmp dword [esi + 0x204], 4
je 0x421efc
push eax
call edx
mov eax, dword [ebp - 0x11ac]
movsd xmm0, qword [0x4cc760]
mov dword [esi + 0x1fc], eax
xor eax, eax
mov dword [esi + 0x204], 0
mov dword [esi + 0x1f0], 0x9400
mov dword [edi + 0x4cc], 0xffffff
movsd qword [esi + 0x170], xmm0
mov dword [esi + 0x178], 0x190
mov byte [esi + 0x17c], 1
mov byte [esi + 0x1be], 0
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x421f50
inc eax
push eax
push 0x4bff50
lea eax, [esi + 0x17e]
push 0x20
push eax
call fcn.0048d1b3
add esp, 0x10
lea esi, [edi + 0x2a8]
mov ecx, esi
call fcn.00416d40
test al, al
je 0x422001
mov eax, dword [esi + 0x40]
push 0
push dword [esi + 0x11c]
inc eax
push eax
push dword [esi + 0x234]
movzx eax, byte [esi + 0x248]
push 0x41
push dword [ebp - 0x11c4]
and eax, 1
push 0
push 0
shl eax, 0x11
add eax, 0x50000100
push eax
push 0
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x422001
push eax
push 0xd
mov ecx, esi
call fcn.00416ab0
mov ecx, dword [ebp - 0x11c4]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0
lea ecx, [eax + eax*8]
mov dword [ebp - 0x2c], 0
mov eax, dword [esi + 0x3c]
mov dword [ebp - 0x24], 0x41
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push 0x40
push 0xffffffffffffffff
lea ecx, [edi + 0x2a8]
call fcn.00414360
mov eax, dword [edi + 0x12c]
xor esi, esi
mov dword [ebp - 0x11ac], esi
mov byte [ebp - 4], 6
test eax, eax
je 0x42203e
push esi
push 0x30
push 0x30
push 1
push 1
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
mov dword [ebp - 0x11ac], esi
sub esp, 8
push 0x30
push 0x30
push 0xa
push ecx
push esi
lea ecx, [edi + 0x2a8]
call fcn.00411f80
mov byte [ebp - 4], 2
test esi, esi
je 0x422063
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
movsd xmm0, qword [0x4cc788]
xor eax, eax
mov dword [edi + 0x4cc], 0xe0efff
movsd qword [edi + 0x418], xmm0
mov dword [edi + 0x420], 0x258
mov byte [edi + 0x424], 1
mov byte [edi + 0x466], 0
nop word [eax + eax]
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x4220a0
inc eax
push eax
push 0x4bff50
lea eax, [edi + 0x426]
push 0x20
push eax
call fcn.0048d1b3
add esp, 0x10
lea ecx, [edi + 0x2a8]
call fcn.00416d40
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
test al, al
je 0x422142
mov eax, dword [edi + 0x2e8]
push 0
push dword [edi + 0x3c4]
inc eax
push eax
push dword [edi + 0x4dc]
movzx eax, byte [edi + 0x4f0]
push 0x19
push 0xc8
push 0xa
and eax, 1
push 0x44
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0764
push 0x4c018c
push 0
call esi
test eax, eax
je 0x422142
push eax
push 0xd
lea ecx, [edi + 0x2a8]
call fcn.00416ab0
movaps xmm0, xmmword [0x4ccda0]
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x2e4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
movsd xmm0, qword [0x4cc768]
xor eax, eax
movsd qword [edi + 0x418], xmm0
mov dword [edi + 0x420], 0x190
mov byte [edi + 0x424], 1
mov byte [edi + 0x466], 0
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x422170
inc eax
push eax
push 0x4bff50
lea eax, [edi + 0x426]
push 0x20
push eax
call fcn.0048d1b3
add esp, 0x10
lea ecx, [edi + 0x2a8]
call fcn.00416d40
test al, al
je 0x42220c
mov eax, dword [edi + 0x2e8]
push 0
push dword [edi + 0x3c4]
inc eax
push eax
push dword [edi + 0x4dc]
movzx eax, byte [edi + 0x4f0]
push 0x12
push 0x15e
push 0x2d
and eax, 1
push 0x44
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c07a0
push 0x4c018c
push 0
call esi
test eax, eax
je 0x42220c
push eax
push 0xd
lea ecx, [edi + 0x2a8]
call fcn.00416ab0
movaps xmm0, xmmword [0x4ccbc0]
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x2e4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov esi, dword [ebp - 0x11c4]
lea ecx, [edi + 0x2a8]
sub esp, 0x10
mov dword [edi + 0x498], 0x400
lea eax, [esi - 0x3c]
push eax
call fcn.00411a70
push 0xffffffffffffffff
sub esp, 8
mov dword [edi + 0x3c], eax
lea eax, [esi - 0x1e]
lea ecx, [edi + 0x2a8]
push 6
push eax
call fcn.00411850
mov dword [edi + 0x40], eax
xor esi, esi
nop dword [eax]
inc esi
cmp byte [esi + 0x4c07f8], 0
jne 0x422250
mov ecx, dword [ebp - 0x20]
lea eax, [esi + 2]
mov dword [ebp - 0x11ac], ecx
mov edx, 2
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov dword [ebp - 0x20], eax
lea ecx, [esi + 1]
xor edx, edx
add esp, 4
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x20]
mov word [eax], dx
mov eax, dword [ebp - 0x11ac]
test eax, eax
je 0x4222ae
push eax
call fcn.00489f13
add esp, 4
lea ecx, [esi + 1]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x422304
test esi, esi
jne 0x4222c0
xor ecx, ecx
mov word [eax], cx
jmp 0x4222e1
push ecx
push eax
push esi
push 0x4c07f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x20]
xor edx, edx
test eax, eax
mov word [ecx + eax*2], dx
setg byte [ebp - 0x18]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x422304
mov ecx, esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x11a8], ecx
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x42232a
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], cl
mov dword [ebp - 0x1c], ecx
mov ecx, esi
mov dword [ebp - 0x11a8], esi
mov edx, 0x4c0800
mov dword [ebp - 0x11b4], esi
mov dword [ebp - 0x11a0], edx
xor eax, eax
mov dword [ebp - 0x11b0], esi
inc eax
cmp word [eax*2 + 0x4c080c], 0
jne 0x422343
test esi, esi
jne 0x42236d
mov edi, dword [ebp - 0x11b4]
mov dword [ebp - 0x11b4], edi
mov dword [ebp - 0x11a0], edx
mov dword [ebp - 0x11a8], ecx
jmp 0x4223a2
xor ecx, ecx
cmp word [esi], cx
je 0x4223a0
mov edi, dword [ebp - 0x11b4]
mov dword [ebp - 0x11a0], edx
mov edx, dword [ebp - 0x11a8]
mov dword [ebp - 0x11a8], edx
mov edx, dword [ebp - 0x11b0]
mov dword [ebp - 0x11b4], edi
inc ecx
cmp word [edx + ecx*2], 0
jne 0x422398
add eax, ecx
xor ecx, ecx
inc ecx
cmp word [ecx*2 + 0x4c0800], 0
jne 0x4223a4
add eax, ecx
mov edx, 2
mov dword [ebp - 0x1190], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov edx, dword [ebp - 0x20]
mov ecx, eax
mov dword [ebp - 0x11b0], eax
add esp, 4
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x11a4], eax
mov eax, dword [ebp - 0x11a8]
mov dword [ebp - 0x1198], esi
mov dword [ebp - 0x118c], eax
test edx, edx
je 0x422463
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x11a4], eax
mov eax, dword [ebp - 0x11a8]
mov dword [ebp - 0x118c], eax
movzx eax, word [edx]
mov dword [ebp - 0x1198], esi
test ax, ax
je 0x422463
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x1198], esi
mov esi, dword [ebp - 0x11a8]
mov dword [ebp - 0x11a4], eax
mov eax, dword [ebp - 0x11ac]
nop dword [eax]
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x422450
jmp 0x422469
mov esi, dword [ebp - 0x118c]
mov edi, 0x4c080c
mov edx, 0x3c
sub edi, ecx
mov word [ecx], dx
add ecx, 2
movzx eax, word [edi + ecx]
mov edx, eax
test ax, ax
jne 0x422475
mov eax, dword [ebp - 0x1198]
mov edi, dword [ebp - 0x1194]
test eax, eax
je 0x4224b1
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x4224b1
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x4224a0
mov eax, dword [ebp - 0x11a4]
mov edx, 0x3c
nop dword [eax]
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
lea ecx, [ecx + 2]
test dx, dx
jne 0x4224c0
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4224e6
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x1190]
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x11b4]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], 1
test eax, eax
je 0x422512
push eax
call fcn.00489f13
mov ecx, dword [ebp - 0x20]
add esp, 4
test ecx, ecx
jne 0x42252e
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x11c4]
sub esp, 8
mov byte [ebp - 0x18], 1
push 0xf
push 0x41
push 0x2d
lea eax, [esi - 0xc8]
push eax
push ecx
lea ecx, [edi + 0x2a8]
call fcn.00412060
sub esp, 8
mov dword [edi + 0x30], eax
lea ecx, [edi + 0x2a8]
push 0x4c0818
push 0xffffffffffffffff
call fcn.00415120
sub esp, 8
lea ecx, [edi + 0x2a8]
call fcn.00413380
sub esp, 8
lea eax, [esi - 0x82]
lea ecx, [edi + 0x2a8]
push 0xf
push 0x2d
push 0x2d
push eax
push 0x4c0864
call fcn.00412060
push 0x7f89
push 0
mov dword [edi + 0x34], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov edx, dword [edi + 0x2e4]
mov ecx, dword [edi + 0x2e8]
mov dword [ebp - 0x11ac], eax
test edx, edx
je 0x4225d9
cmp ecx, 1
jl 0x4225d9
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x4225d9
mov ecx, dword [ebp - 0x11ac]
mov dword [edx + eax*8 + 0x18], ecx
sub esp, 8
lea ecx, [edi + 0x2a8]
push 0x4c087c
push 0xffffffffffffffff
call fcn.00415120
sub esp, 8
lea ecx, [edi + 0x2a8]
call fcn.00413380
sub esp, 8
lea eax, [esi - 0x50]
lea ecx, [edi + 0x2a8]
push 0xf
push 0x32
push 0x2d
push eax
push 0x4c08b4
call fcn.00412060
push 0x7f89
push 0
mov dword [edi + 0x38], eax
call dword [sym.imp.USER32.dll_LoadCursorW]
mov edx, dword [edi + 0x2e4]
mov ecx, dword [edi + 0x2e8]
mov dword [ebp - 0x11ac], eax
test edx, edx
je 0x422658
cmp ecx, 1
jl 0x422658
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x422658
mov ecx, dword [ebp - 0x11ac]
mov dword [edx + eax*8 + 0x18], ecx
sub esp, 8
lea ecx, [edi + 0x2a8]
push 0x4c08d0
push 0xffffffffffffffff
call fcn.00415120
sub esp, 8
lea ecx, [edi + 0x2a8]
call fcn.00413380
cmp dword [ebp - 0x119c], 0x384
mov ecx, 0x247
mov eax, 0x1e3
mov dword [edi + 0x4cc], 0
cmovg eax, ecx
mov dword [edi + 0x4d0], 0xfefefe
mov dword [ebp - 0x1190], eax
lea eax, [esi - 4]
lea esi, [edi + 0x2a8]
mov dword [ebp - 0x11b0], eax
mov ecx, esi
call fcn.00416d40
test al, al
jne 0x4226cd
xor eax, eax
jmp 0x422785
mov eax, dword [esi + 0x40]
push 0
push dword [esi + 0x11c]
inc eax
push eax
push dword [esi + 0x234]
movzx eax, byte [esi + 0x248]
push dword [ebp - 0x1190]
and eax, 1
push dword [ebp - 0x11b0]
shl eax, 0x11
push 0x41
push 2
add eax, 0x50010200
push eax
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push 0x4c027c
push 0
call eax
mov dword [ebp - 0x118c], eax
test eax, eax
je 0x422785
push eax
push 0x19
mov ecx, esi
call fcn.00416ab0
mov ecx, dword [ebp - 0x118c]
mov dword [esi + 0x234], ecx
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x28], ecx
lea edx, [eax + eax*8]
mov ecx, dword [ebp - 0x1190]
mov dword [ebp - 0x24], ecx
mov ecx, dword [esi + 0x3c]
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x2c], 0x41
movups xmm0, xmmword [ebp - 0x30]
mov dword [ebp - 0x11ac], eax
push esi
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov eax, dword [esi + 0x40]
inc eax
push eax
push 0x40b310
push dword [ebp - 0x118c]
call dword [sym.imp.COMCTL32.dll_SetWindowSubclass]
mov eax, dword [ebp - 0x11ac]
push 0x4c091c
push 0
push eax
lea ecx, [edi + 0x2a8]
mov dword [edi + 0x44], eax
call fcn.00412550
sub esp, 0xc
mov dword [edi + 0x48], eax
lea ecx, [edi + 0x2a8]
push 0x78
push dword [edi + 0x12c]
push 0
push eax
call fcn.00413c60
mov eax, dword [edi + 0x44]
xor ecx, ecx
mov dword [ebp - 0x11a0], ecx
mov dword [ebp - 0x11b0], ecx
cmp eax, 0xffffffff
jne 0x4227d7
mov eax, dword [edi + 0x2e8]
mov edx, eax
jmp 0x4227dd
mov edx, dword [edi + 0x2e8]
mov esi, dword [edi + 0x2e4]
test esi, esi
je 0x42284c
cmp eax, 1
jl 0x42284c
cmp eax, edx
jg 0x42284c
lea eax, [eax + eax*8]
cmp dword [esi + eax*8 + 0xc], ecx
je 0x42284c
cmp dword [esi + eax*8], 0x19
jne 0x42284c
mov esi, dword [esi + eax*8 + 4]
add edi, 0x3c8
push edi
push esi
call dword [sym.imp.USER32.dll_GetClientRect]
push edi
push 0
push 0x1328
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x1194]
mov ecx, dword [ecx + 0x3d0]
sub ecx, dword [edi]
mov edi, dword [ebp - 0x1194]
mov dword [ebp - 0x11a0], ecx
mov eax, dword [edi + 0x3d4]
sub eax, dword [edi + 0x3cc]
mov dword [ebp - 0x11b0], eax
mov eax, ecx
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x11b0]
cdq
sar ecx, 1
sub eax, edx
sar eax, 1
mov dword [ebp - 0x1198], eax
mov dword [ebp - 0x11c0], ecx
lea eax, [ecx - 0xa]
lea ecx, [edi + 0x2a8]
mov dword [ebp - 0x11a8], eax
call fcn.00416d40
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
test al, al
je 0x4228f3
mov eax, dword [edi + 0x2e8]
push 0
push dword [edi + 0x3c4]
inc eax
push eax
push dword [edi + 0x4dc]
movzx eax, byte [edi + 0x4f0]
push 0x12
push 0x96
push 5
and eax, 1
push 0xf
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0930
push 0x4c018c
push 0
call esi
test eax, eax
je 0x4228f3
push eax
push 0xd
lea ecx, [edi + 0x2a8]
call fcn.00416ab0
movaps xmm0, xmmword [0x4ccad0]
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x2e4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x1198]
mov ecx, dword [ebp - 0x11a8]
add eax, 0xffffffbf
push eax
push ecx
push 0x19
push ecx
mov ecx, edi
call fcn.00428170
mov dword [edi + 0x5c], eax
test eax, eax
jne 0x42291d
mov eax, dword [edi + 0x4d8]
jmp 0x422957
cmp eax, 0xffffffff
jne 0x42292c
mov eax, dword [edi + 0x2e8]
mov edx, eax
jmp 0x422932
mov edx, dword [edi + 0x2e8]
mov ecx, dword [edi + 0x2e4]
test ecx, ecx
je 0x422955
cmp eax, 1
jl 0x422955
cmp eax, edx
jg 0x422955
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x422955
mov eax, dword [ecx + eax*8 + 4]
jmp 0x422957
xor eax, eax
mov ecx, dword [ebp - 0x11c0]
mov dword [edi + 0x124], eax
lea eax, [ecx - 0x2d]
mov dword [edi + 0xa0], eax
lea eax, [ecx + 5]
lea ecx, [edi + 0x2a8]
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
test al, al
je 0x422a13
mov eax, dword [edi + 0x2e8]
push 0
push dword [edi + 0x3c4]
inc eax
push eax
push dword [edi + 0x4dc]
movzx eax, byte [edi + 0x4f0]
push 0x12
push dword [ebp - 0x11a8]
and eax, 1
push 5
push dword [ebp - 0x11b0]
shl eax, 0x11
add eax, 0x50000100
push eax
push section..data_1
push 0x4c018c
push 0
call esi
test eax, eax
je 0x422a13
push eax
push 0xd
lea ecx, [edi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x11a8]
mov dword [ebp - 0x28], ecx
lea ecx, [eax + eax*8]
mov eax, dword [edi + 0x2e4]
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x1198]
lea ecx, [edi + 0x2a8]
push 0x10024
push 0x1080400d
add eax, 0xffffffbf
push eax
push dword [ebp - 0x11a8]
mov eax, dword [ebp - 0x11c0]
push 0x19
add eax, 5
push eax
push 0x4c0188
push 0x4c09a0
call fcn.004120f0
mov ecx, eax
mov dword [ebp - 0x11ac], eax
mov dword [edi + 0x60], eax
test ecx, ecx
jne 0x422a6b
mov eax, dword [edi + 0x4d8]
mov dword [ebp - 0x11b4], eax
jmp 0x422ab3
cmp ecx, 0xffffffff
jne 0x422a7a
mov ecx, dword [edi + 0x2e8]
mov edx, ecx
jmp 0x422a80
mov edx, dword [edi + 0x2e8]
mov eax, dword [edi + 0x2e4]
test eax, eax
je 0x422aa9
cmp ecx, 1
jl 0x422aa9
cmp ecx, edx
jg 0x422aa9
lea ecx, [ecx + ecx*8]
cmp dword [eax + ecx*8 + 0xc], 0
je 0x422aa9
mov eax, dword [eax + ecx*8 + 4]
mov dword [ebp - 0x11b4], eax
jmp 0x422ab3
mov dword [ebp - 0x11b4], 0
sub esp, 8
mov edx, 5
push 0xff203000
call fcn.004049b0
sub esp, 8
mov edx, 4
mov esi, eax
push 0xff005f00
call fcn.004049b0
mov ecx, dword [ebp - 0x1194]
mov edi, eax
push 0xe
push edi
push esi
push dword [ebp - 0x11ac]
add ecx, 0x2a8
call fcn.004165d0
test edi, edi
je 0x422b05
push edi
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
call edi
jmp 0x422b0b
mov edi, dword [sym.imp.GDI32.dll_DeleteObject]
test esi, esi
je 0x422b12
push esi
call edi
mov esi, dword [ebp - 0x1194]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
movzx eax, word [esi + 0xa0]
push eax
push 0
push 0x101e
push dword [ebp - 0x11b4]
call edi
push 0
push 1
push 0x101e
push dword [ebp - 0x11b4]
call edi
push 0
push 2
push 0x101e
push dword [ebp - 0x11b4]
call edi
push 0
push 3
push 0x101e
push dword [ebp - 0x11b4]
call edi
push 0
push 4
push 0x101e
push dword [ebp - 0x11b4]
call edi
mov eax, dword [ebp - 0x1198]
lea ecx, [esi + 0x2a8]
add eax, 0xffffffdd
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
mov edi, dword [sym.imp.USER32.dll_CreateWindowExW]
test al, al
je 0x422c29
mov eax, dword [esi + 0x2e8]
push 0
push dword [esi + 0x3c4]
inc eax
push eax
push dword [esi + 0x4dc]
movzx eax, byte [esi + 0x4f0]
push 3
push dword [ebp - 0x11a0]
and eax, 1
push dword [ebp - 0x11b0]
shl eax, 0x11
push 0
add eax, 0x50000100
push eax
push 0
push 0x4c018c
push 0
call edi
test eax, eax
je 0x422c29
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x11a0]
mov dword [ebp - 0x28], ecx
lea ecx, [eax + eax*8]
mov eax, dword [esi + 0x2e4]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 3
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push 0x101020
push ecx
lea ecx, [esi + 0x2a8]
call fcn.004136f0
mov ecx, dword [ebp - 0x1198]
sub esp, 8
push 0xc
push 0x28
lea eax, [ecx - 0x21]
push eax
mov eax, dword [ebp - 0x11c0]
add eax, 0xffffffec
push eax
push ecx
push 0x76
push dword [esi + 0x12c]
lea ecx, [esi + 0x2a8]
call fcn.00412360
push 0xfffffffffffffffe
push ecx
lea ecx, [esi + 0x2a8]
call fcn.004136f0
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x11b8], eax
lea ecx, [eax - 0x5f]
mov dword [ebp - 0x11bc], ecx
lea ecx, [eax - 0x14]
mov dword [ebp - 0x118c], ecx
lea ecx, [esi + 0x2a8]
call fcn.00416d40
test al, al
je 0x422d36
mov eax, dword [esi + 0x2e8]
lea ecx, [esi + 0x2a8]
push 0
push dword [ecx + 0x11c]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0x96
push dword [ebp - 0x118c]
and eax, 1
push 0xf
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c09ec
push 0x4c018c
push 0
call edi
test eax, eax
je 0x422d36
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x118c]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0xf
lea ecx, [eax + eax*8]
mov dword [ebp - 0x28], 0x96
mov eax, dword [esi + 0x2e4]
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push dword [ebp - 0x11bc]
push dword [ebp - 0x11a8]
push dword [ebp - 0x11b8]
push ecx
mov ecx, esi
call fcn.00428170
mov dword [esi + 0x64], eax
test eax, eax
jne 0x422d5f
mov eax, dword [esi + 0x4d8]
jmp 0x422d99
cmp eax, 0xffffffff
jne 0x422d6e
mov eax, dword [esi + 0x2e8]
mov edx, eax
jmp 0x422d74
mov edx, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x422d97
cmp eax, 1
jl 0x422d97
cmp eax, edx
jg 0x422d97
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x422d97
mov eax, dword [ecx + eax*8 + 4]
jmp 0x422d99
xor eax, eax
mov ecx, dword [ebp - 0x11b8]
mov dword [esi + 0x128], eax
mov eax, dword [ebp - 0x11bc]
add eax, 0xc
add ecx, eax
mov eax, dword [ebp - 0x11c0]
add eax, 0xfffffeac
mov dword [ebp - 0x1190], ecx
cdq
lea ecx, [esi + 0x2a8]
sub eax, edx
sar eax, 1
mov dword [ebp - 0x11a4], eax
add eax, 5
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
test al, al
je 0x422e76
mov eax, dword [esi + 0x2e8]
push 0
push dword [esi + 0x3c4]
inc eax
push eax
push dword [esi + 0x4dc]
movzx eax, byte [esi + 0x4f0]
push 0x12
push 0xaa
push dword [ebp - 0x1190]
and eax, 1
push dword [ebp - 0x11b0]
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0a1c
push 0x4c018c
push 0
call edi
test eax, eax
je 0x422e76
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x1190]
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + eax*8]
mov eax, dword [esi + 0x2e4]
mov dword [ebp - 0x28], 0xaa
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x11a4]
lea ecx, [esi + 0x2a8]
add eax, 0xb9
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
test al, al
jne 0x422e9d
xor eax, eax
jmp 0x422f63
mov eax, dword [esi + 0x2e8]
lea edx, [esi + 0x2a8]
mov esi, dword [ebp - 0x11b8]
inc eax
mov ecx, dword [ebp - 0x11bc]
add esi, 0xa
push 0
push dword [edx + 0x11c]
add ecx, esi
push eax
push dword [edx + 0x234]
movzx eax, byte [edx + 0x248]
push 0x12
push 0x32
push ecx
push dword [ebp - 0x11b0]
and eax, 1
shl eax, 0x11
add eax, 0x50010009
push eax
push 0x4c0a5c
push 0x4c019c
push 0
call edi
mov esi, dword [ebp - 0x1194]
test eax, eax
jne 0x422f04
xor eax, eax
jmp 0x422f63
push eax
push 0x15
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov esi, dword [ebp - 0x11b8]
mov ecx, eax
mov eax, dword [ebp - 0x11b0]
add esi, 0xa
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x11bc]
add eax, esi
mov dword [ebp - 0x11ac], ecx
mov esi, dword [ebp - 0x1194]
lea edx, [ecx + ecx*8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x28], 0x32
mov ecx, dword [esi + 0x2e4]
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ecx + edx*8 + 0x24], xmm0
sub esp, 8
mov dword [esi + 0x6c], eax
lea ecx, [esi + 0x2a8]
push 0x4c0a68
push 0xffffffffffffffff
call fcn.00415120
mov eax, dword [ebp - 0x11a4]
lea ecx, [esi + 0x2a8]
add eax, 0xfa
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
test al, al
jne 0x422fa2
xor eax, eax
jmp 0x423068
mov eax, dword [esi + 0x2e8]
lea ecx, [esi + 0x2a8]
mov esi, dword [ebp - 0x11b8]
inc eax
push 0
push dword [ecx + 0x11c]
add esi, 0xa
push eax
push dword [ecx + 0x234]
mov eax, dword [ebp - 0x11bc]
push 0x12
push 0x32
add eax, esi
push eax
movzx eax, byte [ecx + 0x248]
push dword [ebp - 0x11b0]
and eax, 1
shl eax, 0x11
add eax, 0x50010009
push eax
push 0x4c0b34
push 0x4c019c
push 0
call edi
mov esi, dword [ebp - 0x1194]
test eax, eax
jne 0x423009
xor eax, eax
jmp 0x423068
push eax
push 0x15
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov esi, dword [ebp - 0x11b8]
mov ecx, eax
mov eax, dword [ebp - 0x11b0]
add esi, 0xa
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x11bc]
add eax, esi
mov dword [ebp - 0x11ac], ecx
mov esi, dword [ebp - 0x1194]
lea edx, [ecx + ecx*8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x28], 0x32
mov ecx, dword [esi + 0x2e4]
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ecx + edx*8 + 0x24], xmm0
sub esp, 8
mov dword [esi + 0x70], eax
lea ecx, [esi + 0x2a8]
push 0x4c0b40
push 0xffffffffffffffff
call fcn.00415120
mov edx, dword [ebp - 0x11b8]
lea ecx, [esi + 0x2a8]
mov eax, dword [ebp - 0x11bc]
sub esp, 8
add edx, 0x23
add eax, edx
push 0x12
push 0xfa
push eax
mov eax, dword [ebp - 0x11a4]
add eax, 5
push eax
push 0x4c0c00
call fcn.004117b0
mov edx, dword [ebp - 0x11b8]
push ecx
push 0xffffffffffffffff
mov dword [esi + 0x74], eax
lea ecx, [esi + 0x2a8]
mov eax, dword [ebp - 0x11bc]
add edx, 0x40
push 0x1c
push 0x64
add eax, edx
push eax
mov eax, dword [ebp - 0x11a4]
add eax, 0x1e
push eax
push 0x4c0c3c
call fcn.004116e0
mov edx, dword [ebp - 0x11b8]
push ecx
push 0xffffffffffffffff
mov dword [esi + 0x78], eax
lea ecx, [esi + 0x2a8]
mov eax, dword [ebp - 0x11bc]
add edx, 0x3c
push 0x20
push 0xa0
add eax, edx
push eax
mov eax, dword [ebp - 0x11a4]
add eax, 0xa0
push eax
push 0x4c0c54
call fcn.004116e0
mov dword [esi + 0x7c], eax
lea ecx, [esi + 0x2a8]
mov eax, dword [ebp - 0x11c0]
add eax, 0xf
mov dword [ebp - 0x11b0], eax
call fcn.00416d40
test al, al
je 0x4231da
mov eax, dword [esi + 0x2e8]
push 0
push dword [esi + 0x3c4]
inc eax
push eax
push dword [esi + 0x4dc]
movzx eax, byte [esi + 0x4f0]
push 0x12
push 0xfa
push dword [ebp - 0x118c]
and eax, 1
push dword [ebp - 0x11b0]
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0c78
push 0x4c018c
push 0
call edi
test eax, eax
je 0x4231da
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x11b0]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x118c]
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + eax*8]
mov eax, dword [esi + 0x2e4]
mov dword [ebp - 0x28], 0xfa
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
sub esp, 8
lea ecx, [esi + 0x2a8]
push 0x4c0cb8
push 0xffffffffffffffff
call fcn.00415120
mov eax, dword [ebp - 0x11c0]
lea ecx, [esi + 0x2a8]
push 0x10024
push 0x1080400d
push dword [ebp - 0x11bc]
add eax, 5
push dword [ebp - 0x11a8]
push dword [ebp - 0x11b8]
push eax
push 0x4c0188
push 0x4c0d28
call fcn.004120f0
mov dword [esi + 0x68], eax
test eax, eax
jne 0x423239
mov edi, dword [esi + 0x4d8]
jmp 0x423273
cmp eax, 0xffffffff
jne 0x423248
mov eax, dword [esi + 0x2e8]
mov ecx, eax
jmp 0x42324e
mov ecx, dword [esi + 0x2e8]
mov edi, dword [esi + 0x2e4]
test edi, edi
je 0x423271
cmp eax, 1
jl 0x423271
cmp eax, ecx
jg 0x423271
lea eax, [eax + eax*8]
cmp dword [edi + eax*8 + 0xc], 0
je 0x423271
mov edi, dword [edi + eax*8 + 4]
jmp 0x423273
xor edi, edi
movzx eax, word [esi + 0xa0]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0
push 0x101e
push edi
call esi
push 0
push 1
push 0x101e
push edi
call esi
push 0
push 2
push 0x101e
push edi
call esi
push 0
push 3
push 0x101e
push edi
call esi
push 0
push 4
push 0x101e
push edi
call esi
sub esp, 0xc
mov edx, 1
call fcn.00404e60
mov edi, eax
mov dword [ebp - 0x11a8], edi
sub esp, 0xc
xor edx, edx
call fcn.00404e60
mov esi, eax
mov dword [ebp - 0x11b0], esi
mov eax, dword [ebp - 0x1194]
push 0xe
push esi
push edi
mov byte [ebp - 4], 8
lea ecx, [eax + 0x2a8]
push dword [eax + 0x68]
call fcn.004165d0
mov eax, dword [ebp - 0x11a4]
add eax, dword [ebp - 0x11c0]
mov ecx, dword [ebp - 0x11bc]
mov dword [ebp - 0x11a4], eax
add ecx, 0xe
add ecx, dword [ebp - 0x11b8]
add eax, 5
mov dword [ebp - 0x1190], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov dword [ebp - 0x11ac], ecx
mov ecx, eax
mov dword [ebp - 0x118c], eax
call fcn.00416d40
test al, al
je 0x4233e4
mov ecx, dword [ebp - 0x118c]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0x50
push dword [ebp - 0x11ac]
and eax, 1
push dword [ebp - 0x1190]
shl eax, 0x11
add eax, 0x50000100
push eax
mov eax, dword [sym.imp.USER32.dll_CreateWindowExW]
push 0x4c0d7c
push 0x4c018c
push 0
call eax
test eax, eax
je 0x4233e4
mov ecx, dword [ebp - 0x118c]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x1190]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x28], 0x50
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11bc]
mov edx, dword [ebp - 0x11b8]
add ecx, 0xb
mov eax, dword [ebp - 0x11a4]
add edx, ecx
mov ecx, dword [ebp - 0x1194]
add eax, 0x55
push 0
add ecx, 0x2a8
mov dword [ebp - 0x11ac], eax
mov dword [ebp - 0x1190], edx
mov dword [ebp - 0x118c], ecx
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x19
push 0xa0
push edx
push dword [ebp - 0x11ac]
and eax, 1
shl eax, 0x11
add eax, 0x50011000
push eax
push 0
push 0x4c0258
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4234bd
mov ecx, dword [ebp - 0x118c]
push eax
push 0x17
call fcn.00416ab0
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x1190]
lea edx, [eax + eax*8]
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0xa0
mov dword [ebp - 0x24], 0x19
mov ecx, dword [eax + 0x3c]
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov eax, dword [eax + 0x3c]
mov dword [eax + edx*8 + 0x44], 0
mov eax, dword [ebp - 0x11c8]
mov edx, dword [ebp - 0x1194]
push 0x640000
push 1
push 0x406
mov dword [edx + 0x80], eax
mov eax, dword [edx + 0x2e8]
lea ecx, [eax + eax*8]
mov eax, dword [edx + 0x2e4]
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x11a4]
add eax, 0xfa
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
mov edx, 0x50022080
test al, al
jne 0x423527
xor ecx, ecx
jmp 0x4235ed
mov eax, dword [ebp - 0x118c]
mov ecx, 0x50002080
push 0
test byte [eax + 0x248], 1
cmovne ecx, edx
mov edx, dword [ebp - 0x1190]
or ecx, 0x10000
push dword [edx + 0x11c]
mov eax, dword [edx + 0x40]
inc eax
push eax
push dword [edx + 0x234]
mov eax, dword [ebp - 0x11bc]
push 0x19
push 0x50
add eax, 0xa
add eax, dword [ebp - 0x11b8]
push eax
push dword [ebp - 0x11ac]
push ecx
push 0x4bfbd0
push 0x4c0220
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x423593
xor ecx, ecx
jmp 0x4235ed
mov ecx, dword [ebp - 0x1190]
push eax
push 0xc
call fcn.00416ab0
mov ecx, eax
mov dword [ebp - 0x28], 0x50
mov eax, dword [ebp - 0x11ac]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x11bc]
add eax, 0xa
mov dword [ebp - 0x11c8], ecx
add eax, dword [ebp - 0x11b8]
lea edx, [ecx + ecx*8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x24], 0x19
movups xmm0, xmmword [ebp - 0x30]
mov ecx, dword [eax + 0x3c]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11c8]
mov eax, dword [ebp - 0x1194]
sub esp, 8
push 0xffffffffffffffff
push 0
mov dword [eax + 0x84], ecx
push ecx
lea ecx, [eax + 0x2a8]
call fcn.00412800
mov ecx, dword [ebp - 0x1194]
mov esi, dword [ebp - 0x11b8]
add esi, 0x2c
mov dword [ecx + 0x88], eax
mov eax, dword [ebp - 0x11bc]
add eax, esi
mov dword [ebp - 0x118c], eax
mov eax, dword [ebp - 0x11a4]
add eax, 5
mov dword [ebp - 0x11ac], eax
lea eax, [ecx + 0x2a8]
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
mov esi, dword [ebp - 0x11b0]
test al, al
je 0x4236f4
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0x50
push dword [ebp - 0x118c]
and eax, 1
push dword [ebp - 0x11ac]
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0d98
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4236f4
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x118c]
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x28], 0x50
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11bc]
mov edx, dword [ebp - 0x11b8]
add ecx, 0x29
mov eax, dword [ebp - 0x11a4]
add edx, ecx
mov ecx, dword [ebp - 0x1194]
add eax, 0x55
push 0
add ecx, 0x2a8
mov dword [ebp - 0x11ac], eax
mov dword [ebp - 0x11c8], edx
mov dword [ebp - 0x1190], ecx
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x19
push 0xa0
push edx
push dword [ebp - 0x11ac]
and eax, 1
shl eax, 0x11
add eax, 0x50011000
push eax
push 0
push 0x4c0258
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4237cd
mov ecx, dword [ebp - 0x1190]
push eax
push 0x17
call fcn.00416ab0
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x118c], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x11c8]
lea edx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0xa0
mov dword [ebp - 0x24], 0x19
mov ecx, dword [eax + 0x3c]
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov eax, dword [eax + 0x3c]
mov dword [eax + edx*8 + 0x44], 0
mov eax, dword [ebp - 0x118c]
mov edx, dword [ebp - 0x1194]
push 0x640000
push 1
push 0x406
mov dword [edx + 0x8c], eax
mov eax, dword [edx + 0x2e8]
lea ecx, [eax + eax*8]
mov eax, dword [edx + 0x2e4]
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, dword [ebp - 0x11b8]
mov eax, dword [ebp - 0x11bc]
add edx, 0x28
add eax, edx
mov dword [ebp - 0x118c], eax
mov eax, dword [ebp - 0x11a4]
add eax, 0xfa
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
jne 0x423849
xor ecx, ecx
jmp 0x4238f9
mov edx, dword [ebp - 0x1190]
mov eax, 0x50022080
push 0
mov ecx, 0x50002080
push dword [edx + 0x11c]
test byte [edx + 0x248], 1
cmovne ecx, eax
mov eax, dword [edx + 0x40]
inc eax
or ecx, 0x10000
push eax
push dword [edx + 0x234]
push 0x19
push 0x50
push dword [ebp - 0x118c]
push dword [ebp - 0x11ac]
push ecx
push 0x4bfbd0
push 0x4c0220
push 0x200
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
jne 0x4238aa
xor ecx, ecx
jmp 0x4238f9
mov ecx, dword [ebp - 0x1190]
push eax
push 0xc
call fcn.00416ab0
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x118c]
lea edx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], 0x50
mov dword [ebp - 0x24], 0x19
mov ecx, dword [eax + 0x3c]
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11c8]
mov eax, dword [ebp - 0x1194]
sub esp, 8
push 0xffffffffffffffff
push 0
mov dword [eax + 0x90], ecx
push ecx
lea ecx, [eax + 0x2a8]
call fcn.00412800
mov ecx, dword [ebp - 0x1194]
sub esp, 8
mov dword [ecx + 0x94], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11bc]
push 0x12
add eax, 0x4b
add eax, dword [ebp - 0x11b8]
push 0xfa
push eax
mov eax, dword [ebp - 0x11a4]
add eax, 5
push eax
push 0x4c0db0
call fcn.004117b0
mov ecx, dword [ebp - 0x1194]
push 4
push 0xffffffffffffffff
mov dword [ecx + 0x98], eax
add ecx, 0x2a8
call fcn.00414360
mov eax, dword [ebp - 0x1194]
push 0x4c0df4
push 1
push dword [eax + 0x44]
lea ecx, [eax + 0x2a8]
call fcn.00412550
mov ecx, dword [ebp - 0x1194]
sub esp, 0xc
push 0x77
mov dword [ecx + 0x4c], eax
push dword [ecx + 0x12c]
add ecx, 0x2a8
push 1
push eax
call fcn.00413c60
mov eax, dword [ebp - 0x11a0]
add eax, 0xfffffff6
mov dword [ebp - 0x11ac], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
mov edi, dword [ebp - 0x11a8]
test al, al
je 0x423a74
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x32
push dword [ebp - 0x11ac]
and eax, 1
push 0xf
push 5
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c0e18
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x423a74
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 5
lea ecx, [eax + eax*8]
mov dword [ebp - 0x2c], 0xf
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x24], 0x32
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x423b20
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 3
push dword [ebp - 0x11c4]
and eax, 1
push 0x50
push 0
shl eax, 0x11
add eax, 0x50000100
push eax
push 0
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x423b20
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x11c4]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0
lea ecx, [eax + eax*8]
mov dword [ebp - 0x2c], 0x50
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x24], 3
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push 0x101020
push ecx
mov ecx, dword [ebp - 0x1194]
lea ecx, [ecx + 0x2a8]
call fcn.004136f0
cmp dword [ebp - 0x119c], 0x384
mov ecx, 0x140
mov eax, 0xdc
cmovg eax, ecx
mov dword [ebp - 0x118c], eax
mov eax, dword [ebp - 0x11c0]
add eax, 0xffffffec
mov dword [ebp - 0x119c], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x423c12
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push dword [ebp - 0x119c]
and eax, 1
push 0x5a
push 0xf
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c105c
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x423c12
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x119c]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x30], 0xf
lea ecx, [eax + eax*8]
mov dword [ebp - 0x2c], 0x5a
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x11c0]
mov ecx, dword [ebp - 0x1194]
add eax, 0xffffffec
push 0x10024
push 0x1080400d
push dword [ebp - 0x118c]
lea ecx, [ecx + 0x2a8]
push eax
push 0x6e
push 5
push 0x4c0188
push 0x4c1098
call fcn.004120f0
mov ecx, eax
mov eax, dword [ebp - 0x1194]
mov dword [eax + 0xa4], ecx
test ecx, ecx
jne 0x423c65
mov ecx, dword [eax + 0x4d8]
jmp 0x423c99
cmp ecx, 0xffffffff
jne 0x423c70
mov ecx, dword [eax + 0x2e8]
mov edx, dword [eax + 0x2e4]
test edx, edx
je 0x423c97
cmp ecx, 1
jl 0x423c97
cmp ecx, dword [eax + 0x2e8]
jg 0x423c97
lea ecx, [ecx + ecx*8]
cmp dword [edx + ecx*8 + 0xc], 0
je 0x423c97
mov ecx, dword [edx + ecx*8 + 4]
jmp 0x423c99
xor ecx, ecx
movzx eax, word [eax + 0xa0]
push eax
push 0
push 0x101e
push ecx
mov dword [ebp - 0x11a4], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 2
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 3
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 4
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1194]
push 0
push esi
push edi
push dword [eax + 0xa4]
lea ecx, [eax + 0x2a8]
call fcn.004165d0
mov eax, dword [ebp - 0x118c]
sub esp, 8
shr eax, 1
add eax, 0x5a
push 0x28
push 0xc
push eax
mov eax, dword [ebp - 0x11c0]
add eax, 0xfffffff5
push eax
mov eax, dword [ebp - 0x1194]
push ecx
push 0x75
push dword [eax + 0x12c]
lea ecx, [eax + 0x2a8]
call fcn.00412360
push 0xfffffffffffffffe
push ecx
mov ecx, dword [ebp - 0x1194]
lea ecx, [ecx + 0x2a8]
call fcn.004136f0
mov eax, dword [ebp - 0x11c0]
lea ecx, [eax - 0x14]
add eax, 0xf
mov dword [ebp - 0x119c], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov dword [ebp - 0x11ac], ecx
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x423e3c
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push dword [ebp - 0x11ac]
and eax, 1
push 0x5a
push dword [ebp - 0x119c]
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c10e0
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x423e3c
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x119c]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x11ac]
mov dword [ebp - 0x28], ecx
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x2c], 0x5a
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11c0]
push 0x10024
push 0x1080400d
push dword [ebp - 0x118c]
lea eax, [ecx - 0x14]
push eax
push 0x6e
lea eax, [ecx + 5]
mov ecx, dword [ebp - 0x1194]
push eax
push 0x4c0188
push 0x4c1098
lea ecx, [ecx + 0x2a8]
call fcn.004120f0
mov ecx, eax
mov eax, dword [ebp - 0x1194]
mov dword [eax + 0xa8], ecx
test ecx, ecx
jne 0x423e91
mov ecx, dword [eax + 0x4d8]
jmp 0x423ec5
cmp ecx, 0xffffffff
jne 0x423e9c
mov ecx, dword [eax + 0x2e8]
mov edx, dword [eax + 0x2e4]
test edx, edx
je 0x423ec3
cmp ecx, 1
jl 0x423ec3
cmp ecx, dword [eax + 0x2e8]
jg 0x423ec3
lea ecx, [ecx + ecx*8]
cmp dword [edx + ecx*8 + 0xc], 0
je 0x423ec3
mov ecx, dword [edx + ecx*8 + 4]
jmp 0x423ec5
xor ecx, ecx
movzx eax, word [eax + 0xa0]
push eax
push 0
push 0x101e
push ecx
mov dword [ebp - 0x11a4], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 2
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 3
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 4
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1194]
push 0
push esi
push edi
push dword [eax + 0xa8]
lea ecx, [eax + 0x2a8]
call fcn.004165d0
mov eax, dword [ebp - 0x11a0]
sub esp, 8
mov ecx, dword [ebp - 0x118c]
add eax, 0xfffffff6
add ecx, 0x8c
mov dword [ebp - 0x11a4], ecx
push 0x12
push eax
push ecx
mov ecx, dword [ebp - 0x1194]
push 0x14
push 0x4c1128
lea ecx, [ecx + 0x2a8]
call fcn.004117b0
mov ecx, dword [ebp - 0x1194]
mov dword [ecx + 0xac], eax
mov eax, dword [ebp - 0x11a4]
add eax, 0x19
cmp dword [ecx + 0x4d8], 0
mov dword [ebp - 0x119c], eax
lea eax, [ecx + 0x2a8]
mov dword [ebp - 0x118c], eax
je 0x42406d
mov ecx, eax
call fcn.00416d40
test al, al
je 0x42406d
mov ecx, dword [ebp - 0x118c]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0xfa
push dword [ebp - 0x119c]
and eax, 1
push 0x14
shl eax, 0x11
add eax, 0x50010003
push eax
push 0x4c11e0
push 0x4c019c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x42406d
mov ecx, dword [ebp - 0x118c]
push eax
push 4
call fcn.00416ab0
mov ecx, dword [ebp - 0x119c]
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x2c], ecx
lea edx, [eax + eax*8]
mov dword [ebp - 0x30], 0x14
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x28], 0xfa
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov ecx, dword [eax + 0x3c]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11c8]
jmp 0x42406f
xor ecx, ecx
mov eax, dword [ebp - 0x1194]
mov dword [eax + 0xb0], ecx
mov ecx, dword [ebp - 0x11a4]
add ecx, 0x32
mov dword [ebp - 0x119c], ecx
lea ecx, [eax + 0x2a8]
mov eax, dword [ebp - 0x118c]
mov dword [ebp - 0x1190], ecx
cmp dword [eax + 0x230], 0
je 0x424156
call fcn.00416d40
test al, al
je 0x424156
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0xfa
push dword [ebp - 0x119c]
and eax, 1
push 0x14
shl eax, 0x11
add eax, 0x50010003
push eax
push 0x4c1230
push 0x4c019c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x424156
mov ecx, dword [ebp - 0x1190]
push eax
push 4
call fcn.00416ab0
mov ecx, dword [ebp - 0x119c]
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x2c], ecx
lea edx, [eax + eax*8]
mov dword [ebp - 0x30], 0x14
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x28], 0xfa
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov ecx, dword [eax + 0x3c]
movups xmmword [ecx + edx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x11c8]
jmp 0x424158
xor ecx, ecx
mov eax, dword [ebp - 0x1194]
push 4
push 0xffffffffffffffff
mov dword [eax + 0x9c], ecx
lea ecx, [eax + 0x2a8]
call fcn.00414360
mov eax, dword [ebp - 0x11a4]
push ecx
mov ecx, dword [ebp - 0x1194]
add eax, 0x2c
push 0xffffffffffffffff
push 0x1c
push 0x96
push eax
mov eax, dword [ebp - 0x11a0]
lea ecx, [ecx + 0x2a8]
add eax, 0xfffffe8e
push eax
push 0x4c1274
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
mov dword [ecx + 0xb4], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11a4]
push 0xb4
add eax, 0x28
push eax
mov eax, dword [ebp - 0x11a0]
add eax, 0xffffff38
push eax
push 0x4c1298
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push 0x4c12c4
push 2
mov dword [ecx + 0xb8], eax
push dword [ecx + 0x44]
add ecx, 0x2a8
call fcn.00412550
mov ecx, dword [ebp - 0x1194]
sub esp, 0xc
push 0x7a
mov dword [ecx + 0x50], eax
push dword [ecx + 0x12c]
add ecx, 0x2a8
push 2
push eax
call fcn.00413c60
mov eax, dword [ebp - 0x11c0]
add eax, 0xfffffff6
mov dword [ebp - 0x11b8], eax
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x4242c6
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x12
push 0xc8
push 5
and eax, 1
push 0xf
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c12d8
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4242c6
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
movaps xmm0, xmmword [0x4ccb70]
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x1194]
add eax, 0x2a8
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x42437f
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
mov eax, dword [ebp - 0x1198]
push 0x12
push 0xc8
add eax, 6
push eax
movzx eax, byte [ecx + 0x248]
and eax, 1
push 0xf
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c130c
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x42437f
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x1198]
add ecx, 6
mov dword [ebp - 0x30], 0xf
mov dword [ebp - 0x2c], ecx
lea ecx, [eax + eax*8]
mov dword [ebp - 0x28], 0xc8
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x24], 0x12
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov ecx, dword [ebp - 0x1198]
lea eax, [ecx - 0x1f]
push eax
push dword [ebp - 0x11b8]
push 0x19
push ecx
mov ecx, dword [ebp - 0x1194]
call fcn.00428170
mov ecx, dword [ebp - 0x1194]
mov dword [ecx + 0xbc], eax
mov eax, dword [ebp - 0x1198]
lea eax, [eax - 0x49]
cdq
and edx, 3
add eax, edx
sar eax, 2
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11b8]
cdq
and edx, 3
lea ecx, [edx + eax]
mov eax, dword [ebp - 0x11c0]
sar ecx, 2
add ecx, eax
cdq
push ecx
push 0xffffffffffffffff
push 0x20
sub eax, edx
mov dword [ebp - 0x11a4], ecx
sar eax, 1
push eax
push 0x1e
push ecx
mov ecx, dword [ebp - 0x1194]
push 0x4c1348
mov dword [ebp - 0x118c], eax
lea ecx, [ecx + 0x2a8]
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x118c]
mov dword [ecx + 0xc0], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11bc]
add eax, 0x1e
push eax
push dword [ebp - 0x11a4]
mov dword [ebp - 0x11a0], eax
push 0x4c1374
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x118c]
mov dword [ecx + 0xc4], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11a0]
add eax, dword [ebp - 0x11bc]
push eax
push dword [ebp - 0x11a4]
mov dword [ebp - 0x11a0], eax
push 0x4c1390
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x118c]
mov dword [ecx + 0xcc], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11a0]
add eax, dword [ebp - 0x11bc]
push eax
push dword [ebp - 0x11a4]
mov dword [ebp - 0x11a0], eax
push 0x4c13bc
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x118c]
mov dword [ecx + 0xd0], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11a0]
add eax, dword [ebp - 0x11bc]
push eax
push dword [ebp - 0x11a4]
push 0x4c13e0
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
mov dword [ecx + 0xd4], eax
mov eax, dword [ebp - 0x1198]
dec eax
mov dword [ebp - 0x119c], eax
lea eax, [ecx + 0x2a8]
mov ecx, eax
mov dword [ebp - 0x1190], eax
call fcn.00416d40
test al, al
je 0x4245c6
mov ecx, dword [ebp - 0x1190]
push 0
push dword [ecx + 0x11c]
mov eax, dword [ecx + 0x40]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 3
push dword [ebp - 0x11c4]
and eax, 1
push dword [ebp - 0x119c]
shl eax, 0x11
push 0
add eax, 0x50000100
push eax
push 0
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x4245c6
mov ecx, dword [ebp - 0x1190]
push eax
push 0xd
call fcn.00416ab0
mov ecx, dword [ebp - 0x119c]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x11c4]
mov dword [ebp - 0x28], ecx
lea ecx, [eax + eax*8]
mov eax, dword [ebp - 0x1190]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 3
movups xmm0, xmmword [ebp - 0x30]
mov eax, dword [eax + 0x3c]
movups xmmword [eax + ecx*8 + 0x24], xmm0
push 0x101020
push ecx
mov ecx, dword [ebp - 0x1194]
lea ecx, [ecx + 0x2a8]
call fcn.004136f0
mov eax, dword [ebp - 0x1198]
mov ecx, dword [ebp - 0x1194]
add eax, 0xffffffe1
push 0x10024
push 0x1080400d
push eax
push dword [ebp - 0x11b8]
add eax, 0x39
lea ecx, [ecx + 0x2a8]
push eax
push 5
push 0x4c0188
push 0x4c1098
call fcn.004120f0
mov ecx, eax
mov eax, dword [ebp - 0x1194]
mov dword [eax + 0xd8], ecx
test ecx, ecx
jne 0x424632
mov ecx, dword [eax + 0x4d8]
jmp 0x424666
cmp ecx, 0xffffffff
jne 0x42463d
mov ecx, dword [eax + 0x2e8]
mov edx, dword [eax + 0x2e4]
test edx, edx
je 0x424664
cmp ecx, 1
jl 0x424664
cmp ecx, dword [eax + 0x2e8]
jg 0x424664
lea ecx, [ecx + ecx*8]
cmp dword [edx + ecx*8 + 0xc], 0
je 0x424664
mov ecx, dword [edx + ecx*8 + 4]
jmp 0x424666
xor ecx, ecx
movzx eax, word [eax + 0xa0]
push eax
push 0
push 0x101e
push ecx
mov dword [ebp - 0x11a4], ecx
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 1
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 2
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 3
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 4
push 0x101e
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1194]
push 0
push esi
push edi
push dword [eax + 0xd8]
lea ecx, [eax + 0x2a8]
call fcn.004165d0
mov eax, dword [ebp - 0x1198]
add eax, 0x1e
mov dword [ebp - 0x11b8], eax
mov eax, dword [ebp - 0x11c0]
lea esi, [eax + 5]
cdq
sub eax, edx
mov ecx, eax
sar ecx, 1
sub ecx, 0xa
push ecx
push 0xffffffffffffffff
push 0x20
push ecx
push dword [ebp - 0x11b8]
mov dword [ebp - 0x1198], ecx
mov ecx, dword [ebp - 0x1194]
push esi
push 0x4c140c
add ecx, 0x2a8
call fcn.004116e0
mov edx, dword [ebp - 0x1194]
push ecx
mov ecx, dword [ebp - 0x1198]
push 0xffffffffffffffff
push 0x20
push ecx
push dword [ebp - 0x11b8]
mov dword [edx + 0xdc], eax
lea eax, [ecx + 0xa]
add eax, esi
lea ecx, [edx + 0x2a8]
push eax
push 0x4c1430
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x1198]
mov dword [ecx + 0xe0], eax
mov eax, dword [ebp - 0x11b8]
add eax, dword [ebp - 0x11bc]
push eax
push esi
mov dword [ebp - 0x11b8], eax
push 0x4c1454
add ecx, 0x2a8
call fcn.004116e0
mov edx, dword [ebp - 0x1194]
push ecx
mov ecx, dword [ebp - 0x1198]
push 0xffffffffffffffff
push 0x20
push ecx
push dword [ebp - 0x11b8]
mov dword [edx + 0xe4], eax
lea eax, [ecx + 0xa]
add eax, esi
lea ecx, [edx + 0x2a8]
push eax
push 0x4c1478
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x1198]
mov dword [ecx + 0xe8], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11b8]
add eax, dword [ebp - 0x11bc]
push eax
push esi
push 0x4c149c
mov dword [ebp - 0x11b8], eax
call fcn.004116e0
mov edx, dword [ebp - 0x1194]
push ecx
mov ecx, dword [ebp - 0x1198]
push 0xffffffffffffffff
push 0x20
push ecx
push dword [ebp - 0x11b8]
mov dword [edx + 0xec], eax
lea eax, [ecx + 0xa]
add eax, esi
lea ecx, [edx + 0x2a8]
push eax
push 0x4c14d4
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x1198]
mov dword [ecx + 0xf0], eax
add ecx, 0x2a8
mov eax, dword [ebp - 0x11b8]
add eax, dword [ebp - 0x11bc]
push eax
push esi
push 0x4c14f8
mov dword [ebp - 0x11b8], eax
call fcn.004116e0
mov edx, dword [ebp - 0x1194]
push ecx
mov ecx, dword [ebp - 0x1198]
push 0xffffffffffffffff
push 0x20
push ecx
push dword [ebp - 0x11b8]
mov dword [edx + 0xf4], eax
lea eax, [ecx + 0xa]
add eax, esi
lea ecx, [edx + 0x2a8]
push eax
push 0x4c1518
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
push dword [ebp - 0x1198]
mov dword [ecx + 0xf8], eax
mov eax, dword [ebp - 0x11b8]
add eax, dword [ebp - 0x11bc]
mov dword [ebp - 0x11b8], eax
push eax
push esi
push 0x4c152c
add ecx, 0x2a8
call fcn.004116e0
mov ecx, dword [ebp - 0x1194]
push ecx
push 0xffffffffffffffff
push 0x20
mov dword [ecx + 0xc8], eax
mov ecx, dword [ebp - 0x1198]
push ecx
push dword [ebp - 0x11b8]
lea eax, [ecx + 0xa]
add eax, esi
mov esi, dword [ebp - 0x1194]
push eax
push 0x4c155c
lea ecx, [esi + 0x2a8]
call fcn.004116e0
push 0x4c1588
push 3
mov dword [esi + 0xfc], eax
lea ecx, [esi + 0x2a8]
push dword [esi + 0x44]
call fcn.00412550
sub esp, 0xc
mov dword [esi + 0x54], eax
lea ecx, [esi + 0x2a8]
push 0x79
push dword [esi + 0x12c]
push 3
push eax
call fcn.00413c60
mov eax, dword [esi + 0x12c]
xor esi, esi
mov dword [ebp - 0x11c8], esi
mov byte [ebp - 4], 9
test eax, eax
je 0x424997
push esi
push 0x20
push 0x20
push 1
push 1
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
mov esi, eax
mov dword [ebp - 0x11c8], esi
sub esp, 8
push 0x20
push 0x20
push 0x32
push ecx
mov ecx, dword [ebp - 0x1194]
push esi
lea ecx, [ecx + 0x2a8]
call fcn.00411f80
mov byte [ebp - 4], 8
test esi, esi
je 0x4249c2
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
xor esi, esi
inc esi
cmp byte [esi + 0x4c07f8], 0
jne 0x4249c4
mov ecx, dword [ebp - 0x20]
lea eax, [esi + 2]
mov dword [ebp - 0x11c8], ecx
mov edx, 2
xor ecx, ecx
mov dword [ebp - 0x1c], 0
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov dword [ebp - 0x20], eax
lea ecx, [esi + 1]
xor edx, edx
add esp, 4
mov word [eax + ecx*2], dx
mov eax, dword [ebp - 0x20]
mov word [eax], dx
mov eax, dword [ebp - 0x11c8]
test eax, eax
je 0x424a22
push eax
call fcn.00489f13
add esp, 4
lea ecx, [esi + 1]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x424a78
test esi, esi
jne 0x424a34
xor ecx, ecx
mov word [eax], cx
jmp 0x424a55
push ecx
push eax
push esi
push 0x4c07f8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp - 0x20]
xor edx, edx
test eax, eax
mov word [ecx + eax*2], dx
setg byte [ebp - 0x18]
mov esi, dword [ebp - 0x20]
test esi, esi
je 0x424a78
mov ecx, esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x11a0], ecx
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
jmp 0x424a9e
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
mov byte [ebp - 0x18], cl
mov dword [ebp - 0x1c], ecx
mov ecx, esi
mov dword [ebp - 0x11a0], esi
mov edx, 0x4c15a8
mov dword [ebp - 0x11c0], esi
mov dword [ebp - 0x1198], edx
xor eax, eax
mov dword [ebp - 0x119c], esi
nop word [eax + eax]
inc eax
cmp word [eax*2 + 0x4c15b4], 0
jne 0x424ac0
test esi, esi
jne 0x424aea
mov edi, dword [ebp - 0x11c0]
mov dword [ebp - 0x11c0], edi
mov dword [ebp - 0x1198], edx
mov dword [ebp - 0x11a0], ecx
jmp 0x424b1f
xor ecx, ecx
cmp word [esi], cx
je 0x424b1d
mov edi, dword [ebp - 0x11c0]
mov dword [ebp - 0x1198], edx
mov edx, dword [ebp - 0x11a0]
mov dword [ebp - 0x11a0], edx
mov edx, dword [ebp - 0x119c]
mov dword [ebp - 0x11c0], edi
inc ecx
cmp word [edx + ecx*2], 0
jne 0x424b15
add eax, ecx
xor ecx, ecx
inc ecx
cmp word [ecx*2 + 0x4c15a8], 0
jne 0x424b21
add eax, ecx
mov edx, 2
mov dword [ebp - 0x119c], eax
xor ecx, ecx
inc eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0048a2cb
mov edx, dword [ebp - 0x20]
mov ecx, eax
mov dword [ebp - 0x11b8], eax
add esp, 4
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x118c], esi
mov dword [ebp - 0x1190], eax
test edx, edx
je 0x424bd9
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11a0]
mov dword [ebp - 0x1190], eax
movzx eax, word [edx]
mov dword [ebp - 0x118c], esi
test ax, ax
je 0x424bd9
mov dword [ebp - 0x11c8], eax
mov eax, dword [ebp - 0x1198]
mov dword [ebp - 0x118c], esi
mov esi, dword [ebp - 0x11a0]
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11c8]
mov word [ecx], ax
lea edx, [edx + 2]
movzx eax, word [edx]
add ecx, 2
test ax, ax
jne 0x424bc6
jmp 0x424bdf
mov esi, dword [ebp - 0x1190]
mov edi, 0x4c15b4
mov edx, 0x44
sub edi, ecx
nop dword [eax + eax]
mov word [ecx], dx
add ecx, 2
movzx eax, word [ecx + edi]
mov edx, eax
test ax, ax
jne 0x424bf0
mov eax, dword [ebp - 0x118c]
mov edi, dword [ebp - 0x11a8]
test eax, eax
je 0x424c31
movzx eax, word [eax]
mov edx, eax
test ax, ax
je 0x424c31
nop dword [eax + eax]
mov word [ecx], ax
lea esi, [esi + 2]
movzx eax, word [esi]
add ecx, 2
test ax, ax
jne 0x424c20
mov eax, dword [ebp - 0x11bc]
mov edx, 0x20
nop dword [eax]
mov word [ecx], dx
lea eax, [eax + 2]
movzx edx, word [eax]
lea ecx, [ecx + 2]
test dx, dx
jne 0x424c40
xor eax, eax
mov word [ecx], ax
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x424c66
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x11b8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x119c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x11c0]
mov byte [ebp - 0x18], 1
test eax, eax
je 0x424c9a
push eax
call fcn.00489f13
mov eax, dword [ebp - 0x20]
add esp, 4
mov dword [ebp - 0x11b8], eax
jmp 0x424ca0
mov eax, dword [ebp - 0x11b8]
test eax, eax
jne 0x424cc2
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x11b8], eax
mov esi, dword [ebp - 0x1194]
mov byte [ebp - 0x18], 1
lea ecx, [esi + 0x2a8]
call fcn.00416d40
test al, al
je 0x424d50
mov eax, dword [esi + 0x2e8]
lea ecx, [esi + 0x2a8]
push 0
push dword [ecx + 0x11c]
inc eax
push eax
push dword [ecx + 0x234]
movzx eax, byte [ecx + 0x248]
push 0x19
push 0x190
push 0x37
and eax, 1
push 0x32
shl eax, 0x11
add eax, 0x50000100
push eax
mov eax, dword [ebp - 0x11b8]
push eax
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x424d50
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
movaps xmm0, xmmword [0x4cce30]
lea ecx, [eax + eax*8]
mov eax, dword [esi + 0x2e4]
movups xmmword [eax + ecx*8 + 0x24], xmm0
movsd xmm0, qword [0x4cc780]
sub esp, 0x14
movsd qword [esp + 0xc], xmm0
push 0x2bc
push ecx
lea ecx, [esi + 0x2a8]
call fcn.00413b20
movsd xmm0, qword [0x4cc768]
xor eax, eax
movsd qword [esi + 0x418], xmm0
mov dword [esi + 0x420], 0x190
mov byte [esi + 0x424], 1
mov byte [esi + 0x466], 0
nop dword [eax]
inc eax
cmp word [eax*2 + 0x4bff50], 0
jne 0x424da0
inc eax
push eax
push 0x4bff50
lea eax, [esi + 0x426]
push 0x20
push eax
call fcn.0048d1b3
add esp, 0x10
lea ecx, [esi + 0x2a8]
call fcn.00416d40
test al, al
je 0x424e67
mov eax, dword [esi + 0x2e8]
push 0
push dword [esi + 0x3c4]
inc eax
push eax
push dword [esi + 0x4dc]
mov eax, dword [ebp - 0x11c4]
push 0x32
add eax, 0xffffffec
push eax
movzx eax, byte [esi + 0x4f0]
push 0x7d
and eax, 1
push 0xa
shl eax, 0x11
add eax, 0x50000100
push eax
push 0x4c15d8
push 0x4c018c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
test eax, eax
je 0x424e67
push eax
push 0xd
lea ecx, [esi + 0x2a8]
call fcn.00416ab0
mov ecx, dword [ebp - 0x11c4]
add ecx, 0xffffffec
mov dword [ebp - 0x30], 0xa
mov dword [ebp - 0x28], ecx
lea ecx, [eax + eax*8]
mov dword [ebp - 0x2c], 0x7d
mov eax, dword [esi + 0x2e4]
mov dword [ebp - 0x24], 0x32
movups xmm0, xmmword [ebp - 0x30]
movups xmmword [eax + ecx*8 + 0x24], xmm0
mov eax, dword [ebp - 0x11c4]
lea ecx, [esi + 0x2a8]
sub esp, 8
add eax, 0xffffffec
push 0x23
push eax
push 0xaf
push 0xa
push 0x4c16d8
call fcn.00412060
sub esp, 8
mov dword [ebp - 0x11bc], eax
mov eax, dword [ebp - 0x11c4]
lea ecx, [esi + 0x2a8]
add eax, 0xffffffec
push 0x14
push eax
push 0xcd
push 0xa
push 0x4c1788
call fcn.00412060
sub esp, 8
mov dword [ebp - 0x11d0], eax
mov eax, dword [ebp - 0x11c4]
lea ecx, [esi + 0x2a8]
add eax, 0xffffffec
push 0x14
push eax
push 0xeb
push 0xa
push 0x4c1838
call fcn.00412060
push ecx
push 0
push dword [esi + 0x64]
lea ecx, [esi + 0x2a8]
mov dword [ebp - 0x11d4], eax
push dword [esi + 0x60]
push ecx
lea ecx, [esi + 0x534]
call fcn.00417480
push ecx
push dword [esi + 0x78]
lea eax, [esi + 0x2a8]
push dword [esi + 0x98]
lea ecx, [esi + 0x554]
push dword [esi + 0x7c]
push eax
call fcn.00417480
push ecx
push dword [esi + 0xb4]
lea eax, [esi + 0x2a8]
push dword [esi + 0xb8]
lea ecx, [esi + 0x574]
push dword [esi + 0xac]
push eax
call fcn.00417480
mov eax, dword [esi + 0xc0]
mov dword [ebp - 0x11c8], eax
cmp eax, dword [esi + 0xfc]
jg 0x424f9f
mov edi, dword [ebp - 0x11c8]
lea eax, [esi + 0x2a8]
nop word [eax + eax]
cmp edi, dword [esi + 0xd8]
je 0x424f90
cmp edi, dword [esi + 0xd4]
je 0x424f90
push 0x40
push edi
mov ecx, eax
call fcn.00414360
lea eax, [esi + 0x2a8]
inc edi
cmp edi, dword [esi + 0xfc]
jle 0x424f70
mov edi, dword [ebp - 0x11a8]
push 7
push 5
lea ecx, [esi + 0x2a8]
call fcn.0040db40
nop
push 1
mov ecx, esi
call fcn.00428440
test eax, eax
jne 0x424fb0
push eax
push 1
push eax
push dword [esi + 0x5c]
mov ecx, esi
call fcn.00428ef0
push dword [esi + 0xa4]
mov ecx, esi
call fcn.004313d0
xor eax, eax
mov dword [ebp - 0x11c0], 0xffffffff
mov dword [ebp - 0x11a0], eax
lea eax, [esi + 0x2a8]
mov dword [ebp - 0x11b8], 0xffffffff
mov dword [ebp - 0x1198], 0xffffffff
test eax, eax
je 0x425031
push 0
push 0
push dword [eax + 0x230]
push 0x40bb20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x425031
cmp eax, 0xffffffff
je 0x425031
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push 0x1c2
push 0xaa
push 0
push 4
push 0x4c1900
mov ecx, esi
call fcn.00432ac0
push 0
mov ecx, esi
call fcn.00428440
test eax, eax
je 0x426ad1
lea edx, [esi + 0x2a8]
lea ecx, [esi + 0xc4]
mov dword [ebp - 0x11ac], edx
nop
mov edi, dword [esi + 0x22c]
cmp edi, 0xfffffffa
je 0x426acb
cmp dword [esi + 0x25c], edx
jne 0x426aae
cmp edi, 0xffffffd3
je 0x425099
cmp edi, 0xffffffd2
jne 0x4254e9
mov eax, dword [esi + 0x5c]
cmp dword [esi + 0x238], eax
jne 0x4254e9
cmp eax, 0xffffffff
jne 0x4250b3
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x4250f7
cmp eax, 1
jl 0x4250f7
cmp eax, dword [esi + 0x2e8]
jg 0x4250f7
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x4250f7
cmp dword [ecx + eax*8], 0xf
jne 0x4250f7
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
lea edx, [esi + 0x2a8]
jmp 0x4250fa
or edi, 0xffffffff
mov dword [ebp - 0x1190], edi
cmp edi, dword [ebp - 0x11c0]
je 0x426aae
mov dword [ebp - 0x11c0], edi
test edi, edi
jns 0x4252a0
push ecx
push 0
push dword [esi + 0x64]
lea ecx, [esi + 0x534]
push dword [esi + 0x60]
push edx
call fcn.00417480
mov ecx, dword [esi + 0x68]
cmp ecx, 0xffffffff
jne 0x42513f
mov ecx, dword [esi + 0x2e8]
jmp 0x425160
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x425180
cmp ecx, 1
jl 0x425180
cmp ecx, dword [esi + 0x2e8]
jg 0x425180
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x425180
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
jmp 0x425186
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x64]
cmp ecx, 0xffffffff
jne 0x425196
mov ecx, dword [esi + 0x2e8]
jmp 0x4251b7
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x4251cf
cmp ecx, 1
jl 0x4251cf
cmp ecx, dword [esi + 0x2e8]
jg 0x4251cf
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x4251cf
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
mov ecx, dword [esi + 0x60]
cmp ecx, 0xffffffff
jne 0x4251df
mov ecx, dword [esi + 0x2e8]
jmp 0x425200
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x425218
cmp ecx, 1
jl 0x425218
cmp ecx, dword [esi + 0x2e8]
jg 0x425218
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x425218
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
mov eax, dword [esi + 0x124]
lea ecx, [ebp - 0x114c]
push ecx
push 0xffffffffffffffff
xorps xmm0, xmm0
mov dword [ebp - 0x114c], 8
push 0x102b
push eax
mov dword [ebp - 0x1148], 0
mov dword [ebp - 0x1144], 0
mov dword [ebp - 0x1140], 0
mov dword [ebp - 0x113c], 3
movups xmmword [ebp - 0x1138], xmm0
mov dword [ebp - 0x1128], 0
mov dword [ebp - 0x1124], 0
mov dword [ebp - 0x1120], 0
mov dword [ebp - 0x111c], 0
movq qword [ebp - 0x1118], xmm0
call edi
jmp 0x426aae
push edi
mov ecx, esi
call fcn.0042b150
push 0
push edi
push dword [esi + 0x5c]
lea ecx, [esi + 0x2a8]
call fcn.00416470
mov edi, eax
mov eax, dword [ebp - 0x20]
test edi, edi
jne 0x425310
test eax, eax
je 0x4252cf
push eax
call fcn.00489f13
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a2cb
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x425305
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x4252f2
xor ecx, ecx
mov word [edx + eax*2], cx
mov edi, dword [ebp - 0x20]
jmp 0x425327
test eax, eax
je 0x42531d
push eax
call fcn.00489f13
add esp, 4
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
test edi, edi
jne 0x425347
push 2
call fcn.0048a2cb
add esp, 4
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov word [eax], cx
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
push edi
push 0
push 0
mov byte [ebp - 0x18], 1
mov ecx, esi
push dword [esi + 0x64]
call fcn.00428ef0
push 1
push dword [ebp - 0x1190]
lea ecx, [esi + 0x2a8]
push dword [esi + 0x5c]
call fcn.00416470
mov edi, eax
mov eax, dword [ebp - 0x20]
test edi, edi
jne 0x4253cb
test eax, eax
je 0x425386
push eax
call fcn.00489f13
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a2cb
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x4253c3
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x4253b0
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x4253e2
test eax, eax
je 0x4253d8
push eax
call fcn.00489f13
add esp, 4
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0
push 0
push 1
push 1
push 0
push 0x4c1940
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x18], 1
call fcn.004025a0
test eax, eax
je 0x425443
mov eax, dword [esi + 0x6c]
test eax, eax
jne 0x425411
mov ecx, dword [esi + 0x4d8]
jmp 0x42549f
cmp eax, 0xffffffff
jne 0x42541c
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x42549d
cmp eax, 1
jl 0x42549d
cmp eax, dword [esi + 0x2e8]
jg 0x42549d
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x42549d
mov ecx, dword [ecx + eax*8 + 4]
jmp 0x42549f
push 0
push 1
push 1
push 0
push 0x4c1950
lea ecx, [ebp - 0x20]
call fcn.004025a0
test eax, eax
je 0x4254a7
mov eax, dword [esi + 0x70]
test eax, eax
jne 0x42546b
mov ecx, dword [esi + 0x4d8]
jmp 0x42549f
cmp eax, 0xffffffff
jne 0x425476
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x42549d
cmp eax, 1
jl 0x42549d
cmp eax, dword [esi + 0x2e8]
jg 0x42549d
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x42549d
mov ecx, dword [ecx + eax*8 + 4]
jmp 0x42549f
xor ecx, ecx
sub esp, 0xc
call fcn.00409920
lea ecx, [esi + 0x534]
call fcn.004175b0
cmp dword [ebp - 0x11a0], 1
jge 0x426aae
push ecx
push 0x1c2
push 0xaa
push 0
push 4
push 0x4c1960
mov ecx, esi
call fcn.00432ac0
mov dword [ebp - 0x11a0], 1
jmp 0x426aae
cmp edi, 0xffffffd3
je 0x4254f7
cmp edi, 0xffffffd2
jne 0x4256ab
mov eax, dword [esi + 0x64]
cmp dword [esi + 0x238], eax
jne 0x4256ab
cmp eax, 0xffffffff
jne 0x425511
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x42554f
cmp eax, 1
jl 0x42554f
cmp eax, dword [esi + 0x2e8]
jg 0x42554f
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x42554f
cmp dword [ecx + eax*8], 0xf
jne 0x42554f
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
jmp 0x425552
or edi, 0xffffffff
cmp edi, dword [ebp - 0x11b8]
je 0x426aae
push edi
mov ecx, esi
mov dword [ebp - 0x11b8], edi
call fcn.0042f7e0
test eax, eax
jns 0x4255ae
push ecx
push dword [esi + 0x78]
lea edi, [esi + 0x2a8]
push dword [esi + 0x94]
lea ecx, [esi + 0x554]
push dword [esi + 0x7c]
push edi
call fcn.00417480
push ecx
push 0x15e
push 0x96
push edi
push 0
push 0x4c19d0
mov ecx, esi
call fcn.00432ac0
jmp 0x426aae
test edi, edi
jns 0x4255e4
push ecx
push dword [esi + 0x78]
lea eax, [esi + 0x2a8]
push dword [esi + 0x94]
lea ecx, [esi + 0x554]
push dword [esi + 0x7c]
push eax
call fcn.00417480
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
jmp 0x426aae
push 4
push edi
push dword [esi + 0x64]
lea ecx, [esi + 0x2a8]
call fcn.00416470
mov dword [ebp - 0x11c8], eax
lea edi, [esi + 0x1e4]
test eax, eax
jne 0x42560f
push eax
mov ecx, edi
call fcn.00401860
jmp 0x425631
mov eax, dword [edi]
test eax, eax
je 0x42561e
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x11c8]
mov dword [edi], eax
mov dword [edi + 4], 0
mov byte [edi + 8], 1
mov ecx, edi
call fcn.00401fd0
push ecx
mov dword [esi + 0x28], eax
lea edi, [esi + 0x2a8]
push 0
mov dword [esi + 0x2c], edx
lea ecx, [esi + 0x534]
push dword [esi + 0x60]
push dword [esi + 0x5c]
push edi
call fcn.00417480
push ecx
push 0
push dword [esi + 0x94]
lea ecx, [esi + 0x554]
push dword [esi + 0x80]
push edi
call fcn.00417480
cmp dword [ebp - 0x11a0], 2
jge 0x426aae
push ecx
push 0x1c2
push 0xaa
push 0
push 4
push 0x4c1a20
mov ecx, esi
call fcn.00432ac0
mov dword [ebp - 0x11a0], 2
jmp 0x426aae
cmp edi, 0xffffffd3
je 0x4256b9
cmp edi, 0xffffffd2
jne 0x425adb
mov eax, dword [esi + 0xbc]
cmp dword [esi + 0x238], eax
jne 0x425adb
cmp eax, 0xffffffff
jne 0x4256d6
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x42571a
cmp eax, 1
jl 0x42571a
cmp eax, dword [esi + 0x2e8]
jg 0x42571a
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x42571a
cmp dword [ecx + eax*8], 0xf
jne 0x42571a
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [ebp - 0x1190], eax
jmp 0x425723
or edi, 0xffffffff
mov dword [ebp - 0x1190], edi
cmp edi, dword [ebp - 0x1198]
je 0x426aae
mov dword [ebp - 0x1198], edi
test edi, edi
jns 0x4257e4
mov ecx, dword [esi + 0xd8]
cmp ecx, 0xffffffff
jne 0x425750
mov ecx, dword [esi + 0x2e8]
jmp 0x425771
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x42578d
cmp ecx, 1
jl 0x42578d
cmp ecx, dword [esi + 0x2e8]
jg 0x42578d
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x42578d
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, dword [esi + 0xc0]
cmp edi, dword [esi + 0xfc]
jg 0x4257c7
nop dword [eax + eax]
cmp edi, dword [esi + 0xd8]
je 0x4257be
cmp edi, dword [esi + 0xd4]
je 0x4257be
push 0x40
push edi
lea ecx, [esi + 0x2a8]
call fcn.00414360
inc edi
cmp edi, dword [esi + 0xfc]
jle 0x4257a0
push 0
push 0x4c1ac0
push dword [esi + 0xc4]
lea ecx, [esi + 0x2a8]
call fcn.00414a80
jmp 0x426aae
push edi
mov ecx, esi
call fcn.0042cca0
push 7
push edi
push dword [esi + 0xbc]
lea ecx, [esi + 0x2a8]
call fcn.00416470
mov dword [ebp - 0x118c], eax
test eax, eax
jne 0x425864
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42581a
push eax
call fcn.00489f13
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a2cb
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x425853
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x425840
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x118c], eax
jmp 0x425884
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x42587a
push ecx
call fcn.00489f13
mov eax, dword [ebp - 0x118c]
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
cmp eax, 0x4bfc90
je 0x4258b7
test eax, eax
je 0x4259ba
mov edi, 0x4bfc90
nop dword [eax]
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x425958
cmp word [edi], ax
jne 0x42595d
mov eax, 0x20
push eax
push dword [esi + 0xc0]
lea edi, [esi + 0xc0]
mov edx, 0x2a8
mov ecx, esi
add ecx, edx
call fcn.00414360
push 5
push dword [ebp - 0x1190]
lea ecx, [esi + 0x2a8]
push dword [esi + 0xbc]
call fcn.00416470
mov dword [ebp - 0x118c], eax
test eax, eax
jne 0x4259c4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x42590e
push eax
call fcn.00489f13
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a2cb
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x425944
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x425931
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x118c], eax
jmp 0x4259e4
cmp ax, word [edi]
je 0x4259a3
xor edx, edx
cmp dx, ax
jne 0x42596c
mov dword [ebp - 0x119c], edx
jmp 0x42597e
push ecx
call fcn.0048e184
movzx eax, ax
add esp, 4
mov dword [ebp - 0x119c], eax
movzx eax, word [edi]
xor edx, edx
mov ecx, eax
cmp dx, ax
jne 0x42598e
xor eax, eax
jmp 0x42599a
push ecx
call fcn.0048e184
add esp, 4
movzx eax, ax
cmp word [ebp - 0x119c], ax
jne 0x4259ba
mov eax, dword [ebp - 0x118c]
add eax, 2
add edi, 2
mov dword [ebp - 0x118c], eax
jmp 0x4258a0
mov eax, 0x40
jmp 0x4258bc
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x4259da
push ecx
call fcn.00489f13
mov eax, dword [ebp - 0x118c]
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
mov byte [ebp - 0x18], 1
cmp eax, 0x4c1adc
je 0x425a0f
test eax, eax
je 0x425ad1
mov edi, 0x4c1adc
nop dword [eax]
movzx eax, word [eax]
mov ecx, eax
test ax, ax
jne 0x425a6f
cmp word [edi], ax
jne 0x425a74
mov eax, 0x4c1b00
push 0
push eax
push dword [esi + 0xc4]
lea edi, [esi + 0xc4]
mov edx, 0x2a8
mov ecx, esi
add ecx, edx
call fcn.00414a80
push 0x20
push dword [esi + 0xc4]
lea ecx, [esi + 0x2a8]
call fcn.00414360
push 0x20
push dword [esi + 0xcc]
lea ecx, [esi + 0x2a8]
call fcn.00414360
push 0x20
push dword [esi + 0xd0]
lea ecx, [esi + 0x2a8]
call fcn.00414360
jmp 0x426aae
cmp ax, word [edi]
je 0x425aba
xor edx, edx
cmp dx, ax
jne 0x425a83
mov eax, dword [ebp - 0x118c]
add eax, 2
add edi, 2
mov dword [ebp - 0x118c], eax
jmp 0x425a00
mov eax, 0x4c1ae0
jmp 0x425a14
cmp edi, 0xffffffd3
je 0x425aee
cmp edi, 0xffffffd1
je 0x425aee
cmp edi, 0xffffffd0
jne 0x42606c
mov ecx, dword [esi + 0xd8]
cmp dword [esi + 0x238], ecx
jne 0x426066
cmp edi, 0xffffffd0
je 0x425b19
mov eax, dword [esi + 0x23c]
mov dword [ebp - 0x11c4], eax
test eax, eax
jns 0x425b9a
push ecx
push ecx
mov ecx, edx
call fcn.00416520
mov dword [ebp - 0x11c4], eax
test eax, eax
jns 0x425b9a
mov eax, dword [esi + 0xd8]
cmp eax, 0xffffffff
jne 0x425b3d
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x425b64
cmp eax, 1
jl 0x425b64
cmp eax, dword [esi + 0x2e8]
jg 0x425b64
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x425b64
cmp dword [ecx + eax*8], 0xf
je 0x425b81
push 0
push 0
push 0x1004
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x118c], eax
jmp 0x425bc3
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x11c4], eax
push 0
push 0
push 0x1004
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x11c4]
mov dword [ebp - 0x118c], eax
test ecx, ecx
jns 0x425d30
mov edi, dword [esi + 0xdc]
cmp edi, dword [esi + 0xfc]
jg 0x425be8
push 0x40
push edi
lea ecx, [esi + 0x2a8]
call fcn.00414360
inc edi
cmp edi, dword [esi + 0xfc]
jle 0x425bd1
mov eax, dword [ebp - 0x118c]
mov ecx, dword [esi + 0xd8]
dec eax
mov dword [ebp - 0x1190], eax
cmp ecx, 0xffffffff
jne 0x425c06
mov ecx, dword [esi + 0x2e8]
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x426aae
cmp ecx, 1
jl 0x426aae
cmp ecx, dword [esi + 0x2e8]
jg 0x426aae
lea ecx, [ecx + ecx*8]
shl ecx, 3
mov dword [ebp - 0x119c], ecx
cmp dword [edx + ecx + 0xc], 0
je 0x426aae
cmp dword [edx + ecx], 0xf
jne 0x426aae
test eax, eax
jns 0x425d1b
push 0
push 0
push 0x1004
push dword [edx + ecx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x119c]
dec eax
mov dword [ebp - 0x1190], eax
test eax, eax
js 0x426aae
jne 0x425c72
xor edi, edi
test eax, eax
jle 0x425d89
mov esi, dword [ebp - 0x118c]
nop dword [eax]
cmp edi, ecx
mov dword [ebp - 0xfc], 0xf000
mov ecx, 0x2000
mov eax, 0x1000
cmove eax, ecx
mov dword [ebp - 0x100], eax
lea eax, [ebp - 0x10c]
push eax
push edi
push 0x102b
push dword [ebp - 0x11a4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp - 0x11c4]
inc edi
cmp edi, esi
jl 0x425d40
mov esi, dword [ebp - 0x1194]
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xc0], 2
push eax
push ecx
push 0x102b
push dword [ebp - 0x11a4]
mov dword [ebp - 0xc4], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x11c4]
lea ecx, [esi + 0x2a8]
push 4
push eax
push dword [esi + 0xd8]
call fcn.00416470
mov edi, eax
mov eax, dword [ebp - 0x20]
test edi, edi
jne 0x425e31
test eax, eax
je 0x425de6
push eax
call fcn.00489f13
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a2cb
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x425e23
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x425e10
xor ecx, ecx
mov word [edx + eax*2], cx
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
jmp 0x425e46
test eax, eax
je 0x425e3e
push eax
call fcn.00489f13
add esp, 4
xor eax, eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
test edi, edi
je 0x425ed4
test eax, eax
jne 0x425e6d
cmp word [edi], ax
je 0x425e68
nop dword [eax + eax]
inc eax
cmp word [edi + eax*2], 0
jne 0x425e60
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x425ed4
push edi
mov byte [ebp - 0x18], 1
call fcn.0048e09c
mov edi, eax
add esp, 4
mov eax, dword [ebp - 0x11c4]
test edi, edi
jns 0x425ee0
push 0x20
push dword [esi + 0xe0]
lea ecx, [esi + 0x2a8]
call fcn.00414360
mov edi, dword [esi + 0xdc]
cmp edi, dword [esi + 0xfc]
jg 0x426aae
nop dword [eax]
cmp edi, dword [esi + 0xe0]
je 0x425ec6
mov eax, dword [ebp - 0x11c4]
xor edi, edi
mov byte [ebp - 0x18], 0
push 0
push eax
push dword [esi + 0xd8]
lea ecx, [esi + 0x2a8]
call fcn.00416470
mov esi, eax
mov eax, dword [ebp - 0x20]
test esi, esi
jne 0x425f4b
test eax, eax
je 0x425f0a
push eax
call fcn.00489f13
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a2cb
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x425f43
nop dword [eax]
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x425f30
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x425f62
test eax, eax
je 0x425f58
push eax
call fcn.00489f13
add esp, 4
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0
push 0
push 1
push 1
push 0
push 0x4c1b20
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x18], 1
call fcn.004025a0
mov esi, eax
mov ecx, 0x40
test esi, esi
mov eax, 0x20
cmovle ecx, eax
mov eax, dword [ebp - 0x1194]
push ecx
push dword [eax + 0xdc]
lea ecx, [eax + 0x2a8]
call fcn.00414360
mov eax, dword [ebp - 0x1194]
mov ecx, dword [ebp - 0x11ac]
push 0x40
push dword [eax + 0xe0]
call fcn.00414360
test esi, esi
mov ecx, 0x20
mov esi, dword [ebp - 0x1194]
mov eax, 0x40
cmovle eax, ecx
push eax
push dword [esi + 0xe4]
lea ecx, [esi + 0x2a8]
call fcn.00414360
cmp edi, 1
lea ecx, [esi + 0x2a8]
sbb eax, eax
and eax, 0x20
add eax, 0x20
push eax
push dword [esi + 0xe8]
call fcn.00414360
push 0x20
push dword [esi + 0xec]
lea edi, [esi + 0x2a8]
mov ecx, edi
call fcn.00414360
push 0x20
push dword [esi + 0xf0]
mov ecx, edi
call fcn.00414360
push 0x20
push dword [esi + 0xf4]
mov ecx, edi
call fcn.00414360
push 0x20
push dword [esi + 0xf8]
mov ecx, edi
call fcn.00414360
push 0x20
push dword [esi + 0xc8]
mov ecx, edi
call fcn.00414360
push 0x20
push dword [esi + 0xfc]
mov ecx, edi
call fcn.00414360
jmp 0x426aae
lea ecx, [esi + 0xc4]
cmp edi, dword [esi + 0x74]
jne 0x4260d2
mov eax, dword [esi + 0x64]
cmp eax, 0xffffffff
jne 0x42607f
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x426aa3
cmp eax, 1
jl 0x426aa3
cmp eax, dword [esi + 0x2e8]
jg 0x426aa3
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x426aa3
cmp dword [ecx + eax*8], 0xf
jne 0x426aa3
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x426aa6
mov eax, dword [esi + 0x6c]
mov dword [ebp - 0x119c], eax
cmp edi, eax
je 0x426918
cmp edi, dword [esi + 0x70]
je 0x426918
cmp edi, dword [esi + 0x78]
jne 0x426278
push ecx
push 0
push dword [esi + 0x64]
lea ecx, [esi + 0x534]
push dword [esi + 0x60]
push edx
call fcn.00417480
push ecx
push dword [esi + 0x78]
lea eax, [esi + 0x2a8]
push dword [esi + 0x94]
lea ecx, [esi + 0x554]
push dword [esi + 0x7c]
push eax
call fcn.00417480
mov ecx, dword [esi + 0x5c]
cmp ecx, 0xffffffff
jne 0x426139
mov ecx, dword [esi + 0x2e8]
jmp 0x42615a
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x42617a
cmp ecx, 1
jl 0x42617a
cmp ecx, dword [esi + 0x2e8]
jg 0x42617a
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x42617a
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
jmp 0x426180
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0x60]
cmp ecx, 0xffffffff
jne 0x426190
mov ecx, dword [esi + 0x2e8]
jmp 0x4261b1
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x4261c9
cmp ecx, 1
jl 0x4261c9
cmp ecx, dword [esi + 0x2e8]
jg 0x4261c9
lea eax, [ecx + ecx*8]
cmp dword [edx + eax*8 + 0xc], 0
je 0x4261c9
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
mov ecx, dword [esi + 0x64]
cmp ecx, 0xffffffff
jne 0x4261d9
mov ecx, dword [esi + 0x2e8]
jmp 0x4261fa
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x426212
cmp ecx, 1
jl 0x426212
cmp ecx, dword [esi + 0x2e8]
jg 0x426212
mov eax, dword [esi + 0x2e4]
lea ecx, [ecx + ecx*8]
push 0
push 0
push 0x1009
push dword [eax + ecx*8 + 4]
call edi
mov ecx, dword [esi + 0x68]
cmp ecx, 0xffffffff
jne 0x426222
mov ecx, dword [esi + 0x2e8]
jmp 0x426243
mov edx, dword [esi + 0x2e4]
test edx, edx
je 0x42625b
mov eax, dword [esi + 0xb4]
cmp edi, eax
jne 0x4262c9
push ecx
push eax
push dword [esi + 0xb8]
lea ecx, [esi + 0x574]
push dword [esi + 0xac]
push edx
call fcn.00417480
mov ecx, esi
call fcn.0042ee70
push dword [esi + 0xa4]
mov ecx, esi
call fcn.004313d0
mov dword [esi + 0x108], 0xffffffff
mov dword [esi + 0x104], 0xffffffff
jmp 0x426aae
cmp edi, 0xffffffd3
jne 0x4263b9
mov eax, dword [esi + 0x60]
cmp dword [esi + 0x238], eax
jne 0x4263b9
mov edi, dword [esi + 0x23c]
test edi, edi
js 0x426aae
test eax, eax
jne 0x4262fb
mov eax, dword [esi + 0x4d8]
jmp 0x42632f
cmp eax, 0xffffffff
jne 0x426306
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x42632d
cmp eax, 1
jl 0x42632d
xor eax, eax
push 0xf000
push edi
push 0x102c
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
shr eax, 0xd
not eax
mov dword [ebp - 0x84], 0xf002
and eax, 1
inc eax
shl eax, 0xc
mov dword [ebp - 0x88], eax
mov eax, dword [esi + 0x60]
test eax, eax
jne 0x42636c
cmp edi, dword [esi + 0x7c]
jne 0x4263d3
mov ecx, esi
call fcn.00432d50
cmp eax, 2
je 0x426acb
jmp 0x426aae
cmp edi, dword [esi + 0xb8]
jne 0x4263f0
mov ecx, esi
call fcn.0043a3a0
cmp eax, 2
je 0x426acb
jmp 0x426aae
mov eax, dword [esi + 0x80]
cmp edi, eax
jne 0x426407
push eax
mov ecx, esi
call fcn.00426ce0
jmp 0x426aae
mov eax, dword [esi + 0x8c]
cmp edi, eax
jne 0x42641e
push eax
mov ecx, esi
call fcn.00426ce0
jmp 0x426aae
cmp edi, 0xffffffb4
jne 0x426459
mov eax, dword [esi + 0x84]
cmp dword [esi + 0x238], eax
jne 0x42643e
cmp edi, dword [esi + 0xc0]
jne 0x4264de
push 0
push 0
push 0x1004
push dword [ebp - 0x11b4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, eax
xor eax, eax
mov dword [ebp - 0x118c], ecx
mov dword [ebp - 0x1190], eax
test ecx, ecx
jle 0x426a59
push 0
push eax
push dword [esi + 0x60]
lea ecx, [esi + 0x2a8]
call fcn.00416470
mov dword [ebp - 0x11c8], eax
test eax, eax
mov eax, dword [ebp - 0x20]
jne 0x4269ae
test eax, eax
je 0x426970
push eax
call fcn.00489f13
add esp, 4
push 2
mov byte [ebp - 0x18], 0
mov dword [ebp - 0x1c], 0
call fcn.0048a2cb
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x20], edx
test eax, eax
jle 0x4269a6
mov ax, word [ecx + ecx]
mov word [edx + ecx*2], ax
inc ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
cmp ecx, eax
jl 0x426993
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x4269cb
test eax, eax
je 0x4269bb
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x11c8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0
push 0
push 1
push 1
push 0
push 0x4c1b2c
lea ecx, [ebp - 0x20]
mov byte [ebp - 0x18], 1
call fcn.004025a0
test eax, eax
jne 0x4269ff
push eax
push 1
push 1
push eax
push 0x4c1b38
lea ecx, [ebp - 0x20]
call fcn.004025a0
test eax, eax
je 0x426a40
cmp edi, dword [ebp - 0x119c]
mov ecx, 0x2000
mov eax, 0x1000
mov dword [ebp - 0x138], 0xf000
cmove eax, ecx
mov dword [ebp - 0x13c], eax
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 0x1190]
push 0x102b
push dword [ebp - 0x11b4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x1190]
inc eax
mov dword [ebp - 0x1190], eax
cmp eax, dword [ebp - 0x118c]
jl 0x426945
mov eax, dword [esi + 0x64]
cmp eax, 0xffffffff
jne 0x426a67
mov eax, dword [esi + 0x2e8]
mov ecx, dword [esi + 0x2e4]
test ecx, ecx
je 0x426aa3
cmp eax, 1
jl 0x426aa3
cmp eax, dword [esi + 0x2e8]
jg 0x426aa3
lea eax, [eax + eax*8]
cmp dword [ecx + eax*8 + 0xc], 0
je 0x426aa3
cmp dword [ecx + eax*8], 0xf
jne 0x426aa3
push 2
push 0xffffffffffffffff
push 0x100c
push dword [ecx + eax*8 + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x426aa6
or eax, 0xffffffff
push eax
mov ecx, esi
call fcn.0042f7e0
push 0
mov ecx, esi
call fcn.00428440
lea edx, [esi + 0x2a8]
lea ecx, [esi + 0xc4]
test eax, eax
jne 0x425070
mov edi, dword [ebp - 0x11a8]
mov eax, dword [ebp - 0x11b0]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
test eax, eax
je 0x426ae4
push eax
call esi
test edi, edi
je 0x426aeb
push edi
call esi
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x426afb
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x426b0b
push eax
call fcn.00489f13
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x426b1b
push eax
call fcn.00489f13
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00489f05
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 0xc