Function at 0x64aa8280
Capabilities:
Access peb ldr_data
Get ntdll base address
Get process heap flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
push ebx
push ecx
sub esp, 0x58
mov ebx, dword [ecx]
mov esi, dword [ecx + 4]
test byte [0x64ab5130], 8
jne 0x64aa8360
test ebx, ebx
je 0x64aa8348
test esi, esi
je 0x64aa8348
mov dword [esp + 8], 0x18
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x20], eax
call eax
mov dword [ebp - 0x1c], eax
sub esp, 0xc
mov edi, eax
mov dword [esi], eax
test eax, eax
je 0x64aa84b0
mov eax, dword [ebx]
mov dword [edi], eax
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
cmp eax, 0x10000001
je 0x64aa8470
ja 0x64aa8398
cmp eax, 0x10000000
jne 0x64aa83a2
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov eax, dword [ebx + 0xc]
mov dword [edi + 0xc], eax
mov eax, dword [ebx + 0x10]
mov dword [edi + 0x10], eax
mov eax, dword [ebx + 0x14]
mov dword [edi + 0x14], eax
xor esi, esi
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
lea esp, [ebp - 0x10]
mov esi, 2
pop ecx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], 0x64ac0770
mov dword [esp + 8], str.GdipCloneRegion
mov dword [esp + 4], 0x64ab5130
mov dword [esp], 3
call sym._wine_dbg_log.constprop.0_12
jmp 0x64aa82a6
sub eax, 0x10000002
cmp eax, 1
jbe 0x64aa832f
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov eax, dword [ebx + 8]
mov dword [ebp - 0x24], eax
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov dword [edi + 8], eax
sub esp, 0xc
test eax, eax
je 0x64aa8738
mov edx, dword [ebp - 0x24]
mov edx, dword [edx]
mov dword [eax], edx
cmp edx, 0x10000001
je 0x64aa85e0
jbe 0x64aa84c8
sub edx, 0x10000002
cmp edx, 1
ja 0x64aa8500
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebx + 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x64aa86fc
mov edx, dword [ebx]
mov dword [eax], edx
cmp edx, 0x10000001
je 0x64aa8830
ja 0x64aa8628
cmp edx, 0x10000000
jne 0x64aa8637
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebx + 4]
xor esi, esi
mov eax, dword [eax + 0xc]
mov dword [eax + 4], edx
mov edx, dword [ebx + 8]
mov dword [eax + 8], edx
mov edx, dword [ebx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x10], edx
jmp 0x64aa8331
mov eax, edi
add eax, 8
mov dword [esp + 4], eax
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
sub esp, 8
mov esi, eax
test eax, eax
je 0x64aa832f
mov eax, dword [ebp - 0x1c]
add eax, 4
mov dword [esp], eax
call sym._delete_element
lea esp, [ebp - 0x10]
mov eax, esi
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
lea esp, [ebp - 0x10]
mov esi, 3
pop ecx
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 8
cmp edx, 0x10000000
jne 0x64aa8500
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
mov eax, dword [eax + 8]
mov dword [eax + 4], edx
mov edx, dword [ecx + 8]
mov dword [eax + 8], edx
mov edx, dword [ecx + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [ecx + 0x10]
mov dword [eax + 0x10], edx
jmp 0x64aa8410
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
mov dword [eax + 4], 0
mov eax, dword [edx + 8]
mov dword [eax + 8], 0
mov eax, dword [edx + 8]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [eax + 4]
mov edx, dword [edx + 4]
mov dword [ebp - 0x28], edx
test eax, eax
je 0x64aa88b7
mov edx, dword [ebp - 0x28]
mov edx, dword [edx]
mov dword [eax], edx
cmp edx, 0x10000001
je 0x64aa8872
ja 0x64aa8748
cmp edx, 0x10000000
jne 0x64aa8757
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov edx, dword [esi + 4]
mov eax, dword [eax + 4]
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
mov dword [eax + 8], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x10], edx
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov edx, dword [edx + 8]
mov eax, dword [eax + 8]
mov dword [ebp - 0x24], edx
mov edx, dword [eax + 8]
mov dword [ebp - 0x28], eax
test edx, edx
je 0x64aa8b87
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [edx], eax
cmp eax, 0x10000001
je 0x64aa8af7
ja 0x64aa88f6
cmp eax, 0x10000000
jne 0x64aa8904
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [esi + 4]
mov eax, dword [eax + 8]
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
mov dword [eax + 8], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x10], edx
jmp 0x64aa8410
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], eax
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
sub esp, 8
mov esi, eax
test eax, eax
je 0x64aa8410
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym._delete_element
mov dword [ebx + 8], 0
jmp 0x64aa8491
sub edx, 0x10000002
cmp edx, 1
jbe 0x64aa832f
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0xc]
mov dword [eax + 4], 0
mov eax, dword [edx + 0xc]
mov dword [eax + 8], 0
mov eax, dword [edx + 0xc]
mov edx, dword [ebx + 4]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
mov edx, dword [eax + 4]
test edx, edx
je 0x64aa8bc3
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [edx], eax
cmp eax, 0x10000001
je 0x64aa8b27
ja 0x64aa899c
cmp eax, 0x10000000
jne 0x64aa89aa
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edx, dword [esi + 4]
mov eax, dword [eax + 4]
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
mov dword [eax + 8], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebx + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [eax + 8]
test eax, eax
je 0x64aa8f71
mov edx, dword [ebx]
mov dword [eax], edx
cmp edx, 0x10000001
je 0x64aa8e27
ja 0x64aa8c45
cmp edx, 0x10000000
jne 0x64aa8c54
mov eax, dword [ebp - 0x24]
lea esi, [ebx + 4]
mov ecx, 4
mov edi, dword [eax + 8]
add edi, 4
rep movsd dword es:[edi], dword [esi]
xor esi, esi
jmp 0x64aa8331
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov edx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [edx + 0xc], eax
test eax, eax
jne 0x64aa8421
lea esi, [esi]
mov esi, 3
jmp 0x64aa8491
sub edx, 0x10000002
cmp edx, 1
jbe 0x64aa8577
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 4]
mov dword [eax + 4], 0
mov eax, dword [edx + 4]
mov dword [eax + 8], 0
mov eax, dword [edx + 4]
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov edx, dword [edx + 4]
mov dword [ebp - 0x30], edx
mov edx, dword [eax + 4]
test edx, edx
je 0x64aa8c04
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
mov dword [edx], eax
cmp eax, 0x10000001
je 0x64aa8b57
ja 0x64aa8a42
cmp eax, 0x10000000
jne 0x64aa8a50
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov edx, dword [esi + 4]
mov eax, dword [eax + 4]
mov dword [eax + 4], edx
mov edx, dword [esi + 8]
mov dword [eax + 8], edx
mov edx, dword [esi + 0xc]
mov dword [eax + 0xc], edx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov edx, dword [edx + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [eax + 8]
mov dword [ebp - 0x28], edx
test eax, eax
je 0x64aa905e
mov edx, dword [ebp - 0x28]
mov edx, dword [edx]
mov dword [eax], edx
cmp edx, 0x10000001
je 0x64aa8ef6
ja 0x64aa8d34
cmp edx, 0x10000000
jne 0x64aa8d43
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x28]
mov ecx, 4
mov edi, dword [eax + 8]
add esi, 4
add edi, 4
rep movsd dword es:[edi], dword [esi]
jmp 0x64aa8577
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
sub esp, 8
mov esi, eax
test eax, eax
je 0x64aa832f
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0xc]
mov dword [esp], eax
call sym._delete_element
mov dword [ebx + 0xc], 0
jmp 0x64aa8491
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov dword [ebp - 0x30], eax
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
sub esp, 8
mov esi, eax
test eax, eax
je 0x64aa8577
mov ebx, dword [ebp - 0x2c]
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._delete_element
mov dword [ebx + 4], 0
jmp 0x64aa860b
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov edx, dword [ebp - 0x2c]
sub esp, 0xc
mov dword [edx + 4], eax
test eax, eax
jne 0x64aa8531
mov esi, 3
jmp 0x64aa860b
sub eax, 0x10000002
cmp eax, 1
jbe 0x64aa8410
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 8]
mov dword [eax + 4], 0
mov eax, dword [edx + 8]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x24]
mov edi, dword [edx + 8]
mov ecx, dword [eax + 4]
mov eax, dword [edi + 4]
test eax, eax
je 0x64aa901c
mov edx, dword [ecx]
mov dword [eax], edx
cmp edx, 0x10000001
je 0x64aa8f4b
ja 0x64aa8ce2
cmp edx, 0x10000000
jne 0x64aa8cf1
mov edi, dword [edi + 4]
lea esi, [ecx + 4]
mov ecx, 4
add edi, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
mov dword [ebp - 0x2c], eax
lea edx, [eax + 8]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
call sym._clone_element
mov esi, eax
test eax, eax
je 0x64aa8410
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym._delete_element
mov dword [ebx + 8], 0
jmp 0x64aa860b
sub eax, 0x10000002
cmp eax, 1
jbe 0x64aa86a9
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 4]
mov dword [eax + 4], 0
mov eax, dword [edx + 4]
mov dword [eax + 8], 0
mov eax, dword [ebp - 0x24]
mov edi, dword [edx + 4]
mov ecx, dword [eax + 4]
mov eax, dword [edi + 4]
test eax, eax
je 0x64aa8fda
mov edx, dword [ecx]
mov dword [eax], edx
cmp edx, 0x10000001
je 0x64aa8f25
ja 0x64aa8dd5
cmp edx, 0x10000000
jne 0x64aa8de4
mov edi, dword [edi + 4]
lea esi, [ecx + 4]
mov ecx, 4
add edi, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
lea edx, [eax + 8]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
call sym._clone_element
mov esi, eax
test eax, eax
je 0x64aa86a9
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._delete_element
mov dword [ebx + 4], 0
jmp 0x64aa8858
sub eax, 0x10000002
cmp eax, 1
jbe 0x64aa87cc
mov edx, dword [ebp - 0x34]
mov eax, dword [edx + 4]
mov dword [eax + 4], 0
mov eax, dword [edx + 4]
mov dword [eax + 8], 0
mov eax, dword [edx + 4]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [eax + 4]
mov edx, dword [edx + 4]
mov dword [ebp - 0x3c], edx
test eax, eax
je 0x64aa9098
mov edx, dword [ebp - 0x3c]
mov edx, dword [edx]
mov dword [eax], edx
cmp edx, 0x10000001
je 0x64aa8fab
ja 0x64aa8e55
cmp edx, 0x10000000
jne 0x64aa8e64
mov eax, dword [ebp - 0x38]
mov esi, dword [ebp - 0x3c]
mov ecx, 4
mov edi, dword [eax + 4]
add esi, 4
add edi, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
mov dword [ebp - 0x38], eax
lea edx, [eax + 8]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
call sym._clone_element
mov esi, eax
test eax, eax
je 0x64aa87cc
mov ebx, dword [ebp - 0x34]
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._delete_element
mov dword [ebx + 4], 0
jmp 0x64aa889d
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
mov dword [ebp - 0x2c], eax
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
sub esp, 8
mov esi, eax
test eax, eax
jne 0x64aa8982
jmp 0x64aa8410
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov dword [ebp - 0x2c], eax
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
sub esp, 8
mov esi, eax
test eax, eax
jne 0x64aa8a28
jmp 0x64aa86a9
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
mov dword [ebp - 0x38], eax
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
sub esp, 8
mov esi, eax
test eax, eax
jne 0x64aa8add
jmp 0x64aa87cc
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov edx, eax
mov eax, dword [ebp - 0x28]
sub esp, 0xc
mov dword [eax + 8], edx
test edx, edx
jne 0x64aa8594
jmp 0x64aa88ec
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov edx, eax
mov eax, dword [ebp - 0x28]
sub esp, 0xc
mov dword [eax + 4], edx
test edx, edx
jne 0x64aa8665
mov esi, 3
jmp 0x64aa8858
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov edx, eax
mov eax, dword [ebp - 0x34]
sub esp, 0xc
mov dword [eax + 4], edx
test edx, edx
jne 0x64aa8788
mov esi, 3
jmp 0x64aa889d
sub edx, 0x10000002
cmp edx, 1
jbe 0x64aa832f
mov edx, dword [ebp - 0x24]
xor ecx, ecx
xor esi, esi
mov eax, dword [edx + 8]
mov dword [eax + 4], ecx
mov eax, dword [edx + 8]
mov dword [eax + 8], esi
mov edi, dword [edx + 8]
mov ecx, dword [ebx + 4]
cmp dword [edi + 4], 0
je 0x64aa92ee
mov edx, dword [edi + 4]
mov eax, dword [ecx]
mov dword [edx], eax
cmp eax, 0x10000001
je 0x64aa9145
ja 0x64aa90d7
cmp eax, 0x10000000
jne 0x64aa90e5
mov edi, dword [edi + 4]
lea esi, [ecx + 4]
mov ecx, 4
add edi, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
lea edx, [eax + 8]
mov eax, dword [ebx + 8]
call sym._clone_element
mov esi, eax
test eax, eax
je 0x64aa832f
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym._delete_element
mov dword [ebx + 8], 0
jmp 0x64aa8858
sub edx, 0x10000002
cmp edx, 1
jbe 0x64aa8961
mov eax, dword [edi + 4]
xor esi, esi
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov dword [eax + 4], esi
mov eax, dword [edi + 4]
mov dword [eax + 8], edx
mov eax, dword [edi + 4]
lea edx, [eax + 4]
mov eax, dword [ecx + 4]
call sym._clone_element
mov ecx, dword [ebp - 0x2c]
test eax, eax
mov esi, eax
je 0x64aa9128
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym._delete_element
xor ecx, ecx
mov dword [edi + 4], ecx
jmp 0x64aa8982
sub edx, 0x10000002
cmp edx, 1
jbe 0x64aa8577
mov edx, dword [ebp - 0x30]
xor ecx, ecx
xor esi, esi
mov eax, dword [edx + 8]
mov dword [eax + 4], ecx
mov eax, dword [edx + 8]
mov dword [eax + 8], esi
mov edi, dword [edx + 8]
mov eax, dword [ebp - 0x28]
cmp dword [edi + 4], 0
mov ecx, dword [eax + 4]
je 0x64aa92ac
mov edx, dword [edi + 4]
mov eax, dword [ecx]
mov dword [edx], eax
cmp eax, 0x10000001
je 0x64aa91d5
ja 0x64aa9184
cmp eax, 0x10000000
jne 0x64aa9192
mov edi, dword [edi + 4]
lea esi, [ecx + 4]
mov ecx, 4
add edi, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x34], eax
lea edx, [eax + 8]
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 8]
call sym._clone_element
mov esi, eax
test eax, eax
je 0x64aa8577
mov ebx, dword [ebp - 0x30]
xor edi, edi
mov eax, dword [ebx + 8]
mov dword [esp], eax
call sym._delete_element
mov dword [ebx + 8], edi
jmp 0x64aa889d
sub edx, 0x10000002
cmp edx, 1
jbe 0x64aa8a07
mov eax, dword [edi + 4]
xor edx, edx
xor esi, esi
mov dword [ebp - 0x2c], ecx
mov dword [eax + 4], edx
mov eax, dword [edi + 4]
mov dword [eax + 8], esi
mov eax, dword [edi + 4]
lea edx, [eax + 4]
mov eax, dword [ecx + 4]
call sym._clone_element
mov ecx, dword [ebp - 0x2c]
test eax, eax
mov esi, eax
je 0x64aa9167
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym._delete_element
xor eax, eax
mov dword [edi + 4], eax
jmp 0x64aa8a28
mov eax, dword [ebp - 0x24]
mov eax, dword [eax + 8]
mov dword [ebp - 0x20], eax
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
mov esi, eax
push edi
push edi
test eax, eax
jne 0x64aa8cc8
xor esi, esi
jmp 0x64aa8331
sub edx, 0x10000002
cmp edx, 1
jbe 0x64aa8abc
mov edx, dword [ebp - 0x38]
xor ecx, ecx
xor esi, esi
mov eax, dword [edx + 4]
mov dword [eax + 4], ecx
mov eax, dword [edx + 4]
mov dword [eax + 8], esi
mov edi, dword [edx + 4]
mov eax, dword [ebp - 0x3c]
cmp dword [edi + 4], 0
mov ecx, dword [eax + 4]
je 0x64aa926a
mov edx, dword [edi + 4]
mov eax, dword [ecx]
mov dword [edx], eax
cmp eax, 0x10000001
je 0x64aa9248
ja 0x64aa91f7
cmp eax, 0x10000000
jne 0x64aa9205
mov edi, dword [edi + 4]
lea esi, [ecx + 4]
mov ecx, 4
add edi, 4
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 4]
mov dword [ebp - 0x40], eax
lea edx, [eax + 8]
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 8]
call sym._clone_element
mov esi, eax
test eax, eax
je 0x64aa8abc
mov ebx, dword [ebp - 0x38]
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sym._delete_element
xor eax, eax
mov dword [ebx + 4], eax
jmp 0x64aa8add
mov eax, dword [ebp - 0x30]
mov eax, dword [eax + 8]
mov dword [ebp - 0x34], eax
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
mov esi, eax
push edi
push edi
test eax, eax
jne 0x64aa8dbd
jmp 0x64aa8577
mov eax, dword [edi + 4]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
mov esi, eax
push edx
push edx
test eax, eax
jne 0x64aa8e12
jmp 0x64aa8a07
mov eax, dword [edi + 4]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
mov esi, eax
push ecx
push ecx
test eax, eax
jne 0x64aa8d1f
jmp 0x64aa8961
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov edx, dword [ebp - 0x24]
sub esp, 0xc
mov dword [edx + 8], eax
test eax, eax
jne 0x64aa86c0
jmp 0x64aa8bfa
mov eax, dword [ebp - 0x38]
mov eax, dword [eax + 4]
mov dword [ebp - 0x40], eax
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
mov esi, eax
push edi
push edi
test eax, eax
jne 0x64aa8ede
jmp 0x64aa8abc
mov dword [ebp - 0x2c], ecx
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov ecx, dword [ebp - 0x2c]
sub esp, 0xc
test eax, eax
mov dword [edi + 4], eax
jne 0x64aa89d5
mov esi, 3
jmp 0x64aa8a28
mov dword [ebp - 0x2c], ecx
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov ecx, dword [ebp - 0x2c]
sub esp, 0xc
test eax, eax
mov dword [edi + 4], eax
jne 0x64aa892f
mov esi, 3
jmp 0x64aa8982
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov edx, dword [ebp - 0x30]
sub esp, 0xc
mov dword [edx + 8], eax
test eax, eax
jne 0x64aa87e9
jmp 0x64aa8c3b
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov edx, dword [ebp - 0x38]
sub esp, 0xc
mov dword [edx + 4], eax
test eax, eax
jne 0x64aa8a81
mov esi, 3
jmp 0x64aa8add
sub eax, 0x10000002
cmp eax, 1
jbe 0x64aa8caa
mov eax, dword [edi + 4]
xor edx, edx
xor esi, esi
mov dword [ebp - 0x20], ecx
mov dword [eax + 4], edx
mov eax, dword [edi + 4]
mov dword [eax + 8], esi
mov eax, dword [edi + 4]
lea edx, [eax + 4]
mov eax, dword [ecx + 4]
call sym._clone_element
mov ecx, dword [ebp - 0x20]
test eax, eax
mov esi, eax
je 0x64aa9330
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym._delete_element
xor eax, eax
mov dword [edi + 4], eax
jmp 0x64aa8cc8
mov eax, dword [edi + 4]
lea edx, [eax + 8]
mov eax, dword [ecx + 8]
call sym._clone_element
mov esi, eax
test eax, eax
jne 0x64aa8d1f
jmp 0x64aa8961
mov eax, dword [edi + 4]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
mov esi, eax
push edx
push edx
test eax, eax
jne 0x64aa9113
jmp 0x64aa8caa
mov eax, dword [edi + 4]
lea edx, [eax + 8]
mov eax, dword [ecx + 8]
call sym._clone_element
mov esi, eax
test eax, eax
jne 0x64aa8e12
jmp 0x64aa8a07
sub eax, 0x10000002
cmp eax, 1
jbe 0x64aa8d9c
mov eax, dword [edi + 4]
xor edx, edx
xor esi, esi
mov dword [ebp - 0x34], ecx
mov dword [eax + 4], edx
mov eax, dword [edi + 4]
mov dword [eax + 8], esi
mov eax, dword [edi + 4]
lea edx, [eax + 4]
mov eax, dword [ecx + 4]
call sym._clone_element
mov ecx, dword [ebp - 0x34]
test eax, eax
mov esi, eax
je 0x64aa936a
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym._delete_element
xor eax, eax
mov dword [edi + 4], eax
jmp 0x64aa8dbd
mov eax, dword [edi + 4]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
mov esi, eax
push edx
push edx
test eax, eax
jne 0x64aa91c0
jmp 0x64aa8d9c
sub eax, 0x10000002
cmp eax, 1
jbe 0x64aa8ebd
mov eax, dword [edi + 4]
xor edx, edx
xor esi, esi
mov dword [ebp - 0x40], ecx
mov dword [eax + 4], edx
mov eax, dword [edi + 4]
mov dword [eax + 8], esi
mov eax, dword [edi + 4]
lea edx, [eax + 4]
mov eax, dword [ecx + 4]
call sym._clone_element
mov ecx, dword [ebp - 0x40]
test eax, eax
mov esi, eax
je 0x64aa934d
mov eax, dword [edi + 4]
mov dword [esp], eax
call sym._delete_element
xor eax, eax
mov dword [edi + 4], eax
jmp 0x64aa8ede
mov eax, dword [edi + 4]
add eax, 4
mov dword [esp + 4], eax
mov eax, dword [ecx + 4]
mov dword [esp], eax
call sym.gdiplus.dll_GdipClonePath
mov esi, eax
push edx
push edx
test eax, eax
jne 0x64aa9233
jmp 0x64aa8ebd
mov dword [ebp - 0x40], ecx
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov ecx, dword [ebp - 0x40]
sub esp, 0xc
test eax, eax
mov dword [edi + 4], eax
jne 0x64aa8e8a
mov esi, 3
jmp 0x64aa8ede
mov dword [ebp - 0x34], ecx
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov ecx, dword [ebp - 0x34]
sub esp, 0xc
test eax, eax
mov dword [edi + 4], eax
jne 0x64aa8d69
mov esi, 3
jmp 0x64aa8dbd
mov dword [ebp - 0x28], ecx
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0x14
mov dword [esp + 4], 8
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [ebp - 0x20]
call eax
mov ecx, dword [ebp - 0x28]
sub esp, 0xc
test eax, eax
mov dword [edi + 4], eax
jne 0x64aa8c77
mov esi, 3
jmp 0x64aa8cc8
mov eax, dword [edi + 4]
lea edx, [eax + 8]
mov eax, dword [ecx + 8]
call sym._clone_element
mov esi, eax
test eax, eax
jne 0x64aa9113
jmp 0x64aa8caa
mov eax, dword [edi + 4]
lea edx, [eax + 8]
mov eax, dword [ecx + 8]
call sym._clone_element
mov esi, eax
test eax, eax
jne 0x64aa9233
jmp 0x64aa8ebd
mov eax, dword [edi + 4]
lea edx, [eax + 8]
mov eax, dword [ecx + 8]
call sym._clone_element
mov esi, eax
test eax, eax
jne 0x64aa91c0
jmp 0x64aa8d9c