Function at 0x42597c
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push edi
mov edi, ecx
mov byte [ebp - 0x39], dl
xor ecx, ecx
mov dword [ebp - 0x18], edi
inc ecx
xor ebx, ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], 0x45b3659e
mov dword [ebp - 0x34], 0x51d77f17
mov dword [ebp - 4], ebx
jmp 0x4259bb
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x64], 0xe01b
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x4259ad
mov dword [ebp - 4], ebx
jmp 0x4259d4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x50], 0x6fa66fa4
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x4259c6
push esi
cmp dword [ebp - 0x20], ebx
je 0x4259ea
cmp dword [ebp - 0x64], 0xd8a9
mov esi, ecx
je 0x4259ec
mov esi, ebx
mov eax, dword [ebp - 0x64]
xor ecx, ecx
cmp eax, 0xec4f3f7e
mov eax, dword [ebp - 0x64]
push 0xffffffffffffffff
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x64]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
lea eax, [ecx - 1]
mov ecx, dword [ebp - 0x28]
add ecx, eax
xor eax, eax
cmp ecx, 0xfdb7
setge al
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 0x64]
setle dl
xor ecx, ecx
cmp eax, edx
pop edx
setne cl
xor eax, eax
cmp ecx, 0x7d92
push 3
setl al
pop esi
cmp eax, dword [ebp - 0x64]
jle 0x425b73
mov dword [ebp - 0x38], ebx
xor ecx, ecx
mov dword [ebp - 0x38], 0x446cd5fe
inc ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x38], 0x1fcc1031
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x38], 0x907c4e7c
mov dword [ebp - 0x38], ecx
mov dword [ebp - 4], ebx
jmp 0x425a88
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc4], 0x75623758
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x425a77
mov dword [ebp - 4], ebx
jmp 0x425a9f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xdc], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x425a92
inc dword [ebp - 0xd8]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
jl 0x425b85
xor edi, edi
inc edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0xc], ebx
jmp 0x425b58
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x50], ebx
jne 0x425b1b
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x60]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0xd8]
cmp dword [ebp - 0xd8], ebx
jne 0x425afe
mov esi, ebx
cmp dword [ebp - 0x28], ebx
je 0x425b00
mov esi, edi
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x50]
cmp edx, eax
setne cl
cmp ecx, esi
mov ecx, ebx
jne 0x425b1d
mov ecx, edi
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc4], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xd8]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x64]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 4]
setl cl
mov dword [ebp + eax*4 - 0x50], ecx
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x425ac4
dec dword [ebp - 4]
jns 0x425ab9
mov edi, dword [ebp - 0x18]
push 3
pop esi
jmp 0x425b82
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x425b82
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
xor ecx, ecx
inc ecx
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], 0xd21dfe4b
mov dword [ebp - 4], 0xfffffffe
push 4
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0xc], ebx
pop edx
jmp 0x425bae
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1c4], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x425ba1
cmp dword [ebp - 8], ebx
jne 0x425bbf
inc dword [ebp - 4]
mov eax, ebx
je 0x425bc1
mov eax, ecx
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], esi
jg 0x425d1d
xor edi, edi
inc edi
mov dword [ebp - 0x28], 0xd3335637
mov dword [ebp - 0x24], edi
mov dword [ebp - 0xc], ebx
jmp 0x425bf6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x188], 0xa2d34caa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x425be5
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x425c4b
mov dword [ebp - 0x38], 0x4dfe
mov dword [ebp - 4], ebx
jmp 0x425c41
mov dword [ebp - 0xc], ebx
jmp 0x425c25
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1fc], 0xfaeb382
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x425c14
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x425c3b
push ebx
push ebx
call dword [sym.imp.GDI32.dll_RectInRegion]
dec dword [ebp - 0x24]
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jle 0x425c0f
dec dword [ebp - 0x14]
jns 0x425c03
mov dword [ebp - 0x14], ebx
jmp 0x425d05
mov dword [ebp - 0xc], 0x61c44381
xor edx, edx
mov dword [ebp - 0x20], 0x248e6bae
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x11f0b9f5
setg al
cmp eax, dword [ebp - 0xc]
je 0x425c99
mov edx, ebx
cmp dword [ebp - 8], ebx
je 0x425c9b
mov edx, edi
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp - 0x20], eax
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
push 3
mov dword [ebp + eax*4 - 0x1c4], esi
mov eax, dword [ebp - 0x180]
cmp edx, eax
mov eax, dword [ebp - 0xc]
setg cl
xor edx, edx
cmp esi, ecx
mov ecx, dword [ebp - 0x20]
pop esi
setg dl
add eax, edx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
or ecx, 0xffffffff
neg eax
cmp eax, ecx
mov eax, dword [ebp - 0x188]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setg cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x425c53
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x425bd6
mov edi, dword [ebp - 0x18]
or ecx, 0xffffffff
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0xc], 0x84c506d4
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ebx
jl 0x425dc1
mov ecx, 0xfffc
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x11c], ebx
jne 0x425dbe
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
jl 0x425db9
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x128], ecx
mov dword [ebp - 0x124], ecx
mov dword [ebp - 0x120], ecx
cmp dword [ebp - 0x128], ebx
jne 0x425db9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x425db4
push 0xdc4
push ebx
push 0x1ae2
push 0x7c5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov ecx, 0xfffc
dec dword [ebp - 0x24]
jns 0x425d63
dec dword [ebp - 0xc]
jns 0x425d4c
or ecx, 0xffffffff
xor edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], 8
mov dword [ebp - 0xc], ebx
jmp 0x425de0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x228], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x425dd3
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x425e0a
push 0x99f
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
xor edx, edx
inc edx
push 2
pop ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jl 0x425e21
mov dword [ebp - 0x28], 0x9ef72d4e
dec dword [ebp - 0x24]
jns 0x425e15
mov esi, dword [0x48a5ec]
mov dword [ebp - 0x38], esi
mov dword [ebp - 4], ebx
jmp 0x425e39
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x6c], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x425e2f
mov dword [ebp - 4], ebx
jmp 0x425e51
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x80], 0xab61b583
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x425e43
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 3
jge 0x425e75
or ecx, 0xffffffff
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1e8], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x425e62
inc dword [ebp - 0x80]
xor ecx, ecx
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
cmp ecx, eax
mov ebx, dword [ebp + 8]
sbb eax, eax
inc eax
neg eax
mov dword [ebp - 0x1e4], eax
mov dword [ebx], ecx
mov dword [ebx + 4], ecx
mov dword [ebx + 8], ecx
mov dword [ebx + 0xc], ecx
cmp byte [ebp - 0x39], cl
je 0x426090
cmp esi, edx
jne 0x426090
mov dword [ebp - 0x14], 0x124f
cmp dword [ebp - 0x14], ecx
je 0x425f0b
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x425f3f
push ecx
push 0x193d
push 0xcfd
push 0xeb5
push 0xabb
push 0xc48
push 0x26ce
push ecx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor edx, edx
xor ecx, ecx
inc edx
jmp 0x425f3f
mov dword [ebp - 0xc], ecx
jmp 0x425f1d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1a4], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x425f10
mov dword [ebp - 0x14], ecx
jmp 0x425f39
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a4], 0x603fa75c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x425f28
push 4
pop eax
mov dword [ebp - 8], 0x9fdf99ff
mov dword [ebp - 0x28], 0x71362395
mov dword [ebx + 8], eax
or eax, 0xffffffff
mov dword [ebp - 0x34], 0x622b
mov dword [ebp - 0x24], eax
mov dword [ebp - 0xc], ecx
jmp 0x425f76
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x88], 0xbacd
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x425f65
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xfffffff6
jge 0x426086
or edi, 0xffffffff
mov dword [ebp - 0x14], 0x6a485bf2
mov dword [ebp - 0xc], 0x1dab9737
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ecx
jl 0x426026
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x88], ecx
jne 0x425fee
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 8], eax
jle 0x425ff0
mov ecx, edx
mov eax, dword [ebp - 0xc]
xor edx, edx
add ecx, 0xffff6c88
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x28], edx
xor edx, edx
inc edx
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], ecx
jl 0x426021
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0x88], ecx
jne 0x426021
dec dword [ebp - 0xc]
jns 0x426010
dec dword [ebp - 0x14]
jns 0x425fb3
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp - 0x88]
neg ecx
push 0
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
cmp ecx, 0xee3f2f34
setne dl
sub edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff6
pop ecx
push 1
pop edx
jl 0x425f8c
mov edi, dword [ebp - 0x18]
xor edx, edx
mov dword [ebx + 0xc], 0x48a5ec
inc edx
mov dword [ebp - 0x20], 0x6b950ba1
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x1c], 0x426f3791
mov dword [ebp - 0x24], 0xec1b16eb
mov dword [ebp - 0x1c], 0x5c3421ad
mov dword [ebp - 0x28], 0x17f95e19
mov dword [ebp - 0x14], ecx
jmp 0x4260cf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x190], 0xd5f4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x4260be
push 0xfffffffffffffff7
pop edx
cmp dword [ebp - 0x20], ecx
je 0x426143
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp eax, 0x6206b7e1
setl cl
cmp edx, ecx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x28], ecx
inc edx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp eax, edx
mov eax, dword [ebp - 0x20]
setg cl
sub eax, ecx
je 0x426134
cmp dword [ebp - 0x1c], 0
je 0x426134
mov ecx, edx
jmp 0x426136
xor ecx, ecx
mov eax, dword [ebp - 0xc]
sub ecx, eax
je 0x426141
mov eax, edx
jmp 0x426145
xor ecx, ecx
mov eax, ecx
mov dword [ebp - 0x1c], eax
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18c]
sub ecx, 0xe60b
cmp ecx, eax
setg dl
or eax, 0xffffffff
cmp eax, edx
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
cmp edi, esi
jge 0x427424
mov dword [ebp - 4], 0xfffffffb
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0xc], 0x81ced8f6
mov dword [ebp - 8], ebx
inc esi
jmp 0x426198
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x70], 0xe1e2
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x42618a
mov dword [ebp - 8], ebx
jmp 0x4261b3
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x21c], 0xe52129e5
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4261a2
cmp dword [ebp - 4], ebx
jne 0x4261dc
mov dword [ebp - 0xc], 0xb792
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp ecx, eax
setle dl
cmp edx, 0xa4d63a88
mov edx, ebx
jne 0x4261de
mov edx, esi
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, edx
mov dword [ebp - 0x70], eax
setl cl
sub ecx, dword [ebp - 4]
je 0x4262aa
mov dword [ebp - 0x20], 0x6985ba5
mov dword [ebp - 8], ebx
jmp 0x42620e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4c], 0x796840eb
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x426200
push 4
mov dword [ebp - 8], ebx
pop ecx
jmp 0x42622c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1b4], 0xaf9ca3ea
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x42621b
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x70]
cmp eax, ecx
mov eax, dword [ebp - 0x70]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1a8]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x1a8]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0xc]
cmp eax, 0x373b2c57
setne cl
sub ecx, dword [ebp - 0x1a8]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x9501
setge al
xor ecx, ecx
mov dword [ebp - 0x4c], eax
jmp 0x426396
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], eax
or eax, 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], ebx
jmp 0x4262cf
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x7c], 0x4fb7d476
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4262c1
push 4
mov dword [ebp - 8], ebx
pop ecx
jmp 0x4262ed
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x238], 0xe11d69c0
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x4262dc
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jne 0x4262fd
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0xc]
inc dword [ebp - 0x7c]
mov esi, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
add ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle bl
xor ecx, ecx
cmp esi, eax
setne cl
xor eax, eax
cmp ecx, ebx
setg al
xor ecx, ecx
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0xfffffff1
jge 0x426393
mov edx, 0x344ffa2b
or edi, 0xffffffff
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x17c], edx
mov dword [ebp - 0x178], edx
mov dword [ebp - 0x174], edx
mov dword [ebp - 0x170], edx
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff1
jl 0x426359
mov edi, dword [ebp - 0x18]
xor esi, esi
inc esi
mov ebx, 0x48a5f0
mov dword [ebp - 4], 0xfcb50bf3
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
jmp 0x4263bb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x19c], 0xa8eac8b1
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4263aa
mov dword [ebp - 8], ecx
jmp 0x4263d7
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb0], 0xa7ef23e4
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4263c6
mov dword [ebp - 4], 2
cmp dword [ebp - 4], ecx
jl 0x426412
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x426401
push ecx
push 0x123f
push ecx
call dword [sym.imp.GDI32.dll_GetObjectW]
xor ecx, ecx
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x19c], ecx
jne 0x426412
dec dword [ebp - 4]
jns 0x4263e9
mov dword [ebp - 4], ecx
mov eax, 0x996fd0fe
cmp dword [ebp - 4], 0x1b
je 0x42653a
mov dword [ebp - 0x24], 0x2a1e
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x140], eax
mov dword [ebp - 0xc], ecx
jmp 0x42645c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xfc], 0x38e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x42644b
mov eax, dword [ebp - 0xf8]
xor ecx, ecx
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, 0xf7f3
mov ecx, dword [ebp - 4]
setg al
xor edx, edx
lea esi, [eax + 1]
mov eax, dword [ebp - 0x194]
cmp eax, ecx
setne dl
cmp edx, esi
jg 0x4264ae
mov dword [ebp - 0x28], 0xe57f6cc9
xor esi, esi
mov dword [ebp - 0x34], 6
inc esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], 0x3191b495
jmp 0x426525
mov dword [ebp - 0x1c], 0xffff
xor esi, esi
mov dword [ebp - 0x20], 0xc39c9d94
inc esi
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xac]
add eax, ecx
mov ecx, dword [ebp - 0xf8]
imul ecx, eax
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x24]
cmp eax, esi
mov eax, dword [ebp - 0xac]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xac]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x144], eax
inc dword [ebp - 4]
mov eax, 0x996fd0fe
cmp dword [ebp - 4], 0x1b
push 0
pop ecx
jne 0x426424
mov esi, ecx
mov dword [ebp - 0x20], esi
test edi, edi
jle 0x426d02
push 3
pop edx
mov dword [ebp - 8], 0xf6af1124
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 0xc], ecx
jmp 0x42656e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1d0], 0xa75c19c5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x42655d
mov dword [ebp - 8], ecx
jmp 0x4265a6
mov dword [ebp - 0xc], 0x46721591
mov dword [ebp - 0xc], 2
cmp dword [ebp - 0xc], ecx
jl 0x42659e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1d0], 9
dec dword [ebp - 0xc]
jns 0x42658b
cmp dword [ebp - 0x28], ecx
jne 0x4265ac
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1a
jle 0x426578
mov eax, dword [ebx]
mov dword [ebp - 0xc], 0xfffffff7
mov dword [ebp - 0x2c], eax
mov dword [ebp - 8], ecx
jmp 0x4265ce
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xf4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x4265bd
xor edi, edi
mov dword [ebp - 8], ecx
inc edi
jmp 0x4265e8
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd0], edi
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x4265db
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0x1a
jle 0x42667d
push 4
or esi, 0xffffffff
pop ebx
mov dword [ebp - 8], 0x39ed
mov dword [ebp - 0x1c], 0xd228
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], 0xd50c8576
cmp dword [ebp - 0xec], ecx
je 0x426638
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 0xec]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0xd0], 0x7f51ef99
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xec]
cmp ecx, eax
mov eax, dword [ebp - 8]
setle dl
xor ecx, ecx
cmp eax, edx
push 0
setle cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1a
pop ecx
jg 0x426600
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 8], 0x3fa75c1
mov dword [ebp - 0x24], 0x4fddd3f4
mov dword [ebp - 4], 0x89226c31
mov dword [ebp - 0xc], 0x26d8d38
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], 0xfff7
mov dword [ebp - 0x34], edi
push 4
mov dword [ebp - 0x30], 0xb7203fca
pop eax
add ebx, eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0xc], edi
jge 0x4266d2
or ecx, 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc8], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x4266c0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
cmp eax, 8
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
imul ecx, dword [ebp - 8]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x6bc3ec3d
setg al
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
cmp eax, edi
setg cl
xor eax, eax
imul ecx, dword [ebp - 8]
dec ecx
cmp ecx, 0xe5de
setg al
xor edx, edx
cmp eax, edi
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, 0x9f41
setne al
xor ecx, ecx
cmp eax, 0xf890ba5f
setne cl
xor eax, eax
cmp ecx, edi
setge al
xor edx, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 7
setle al
xor ecx, ecx
cmp eax, 5
mov eax, dword [ebp - 0xc]
setle cl
add eax, 4
xor edx, edx
cmp eax, ecx
setge dl
add edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edi, dword [ebx]
cmp edx, eax
setle cl
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov dword [ebp - 4], 0xfcb50bf3
mov dword [ebp - 8], ecx
jmp 0x4267e5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x158], 0xa8eac8b1
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x4267d4
mov dword [ebp - 8], ecx
jmp 0x426801
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb8], 0xa7ef23e4
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x4267f0
mov dword [ebp - 4], 2
cmp dword [ebp - 4], ecx
jl 0x426840
xor ebx, ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x42682a
push ebx
push 0x123f
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x158], ebx
jne 0x42683b
dec dword [ebp - 4]
jns 0x426815
mov ebx, dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x1b
je 0x426962
xor ebx, ebx
mov dword [ebp - 8], 0x2a1e
mov eax, 0x996fd0fe
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0xc], ebx
jmp 0x42688c
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x104], 0x38e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x42687b
mov eax, dword [ebp - 0x100]
xor ecx, ecx
cmp eax, 1
setg cl
xor eax, eax
cmp ecx, 0xf7f3
mov ecx, dword [ebp - 0x150]
setg al
xor edx, edx
lea esi, [eax + 1]
mov eax, dword [ebp - 4]
cmp ecx, eax
setne dl
cmp edx, esi
jg 0x4268dc
mov dword [ebp - 0x30], 0xe57f6cc9
mov dword [ebp - 0x28], 6
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], 0x3191b495
jmp 0x42694d
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x1c], 0xc39c9d94
mov dword [ebp - 0x1c], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov ecx, dword [ebp - 0x100]
imul ecx, eax
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xb8]
mov eax, dword [ebp - 8]
cmp eax, 1
mov eax, dword [ebp - 0xb4]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xb4]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x134], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1b
jne 0x42684f
mov ebx, dword [ebp - 0x14]
xor ecx, ecx
mov esi, dword [ebp - 0x20]
push 4
pop eax
mov dword [ebp - 4], 0xb13638ec
add ebx, eax
mov dword [ebp - 0x1c], 0x8c84
or eax, 0xffffffff
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 5
push 2
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
pop edx
jmp 0x42699e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x78], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x426990
mov dword [ebp - 8], ecx
jmp 0x4269b9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x160], 0x2718
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x4269a8
cmp dword [ebp - 0x78], 0x9ba5
jne 0x4269d1
cmp dword [ebp - 0x74], ecx
je 0x4269d1
cmp dword [ebp - 4], ecx
jne 0x4269d4
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
xor edx, edx
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp - 4]
cmp eax, ecx
setne dl
imul eax, edx, 0x3fa37eda
xor edx, edx
add eax, dword [ebp - 0x78]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 4]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x74]
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x160], eax
cmp eax, dword [ebp - 4]
jle 0x426a3b
xor eax, eax
cmp dword [ebp - 0x1c], eax
jne 0x426a3b
mov edx, eax
jmp 0x426a3e
xor edx, edx
inc edx
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
test edi, edi
jne 0x426a5b
add ebx, 8
mov dword [ebp - 0x14], ebx
xor ecx, ecx
push 3
mov dword [ebp - 4], ecx
pop edx
jmp 0x426a73
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x5c], 0xbbca6318
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x426a65
mov dword [ebp - 4], ecx
jmp 0x426a87
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x48], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x426a7d
push 2
mov dword [ebp - 4], ecx
pop edi
jmp 0x426aa5
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc0], 0xfffffff7
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x426a94
mov dword [ebp - 0x40], ecx
cmp dword [ebp - 0x40], edi
jg 0x426cef
mov dword [ebp - 4], 0x1f3813bf
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x5c], ecx
je 0x426b32
xor edi, edi
inc edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0xc], ecx
jmp 0x426ae2
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1dc], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x426ad1
mov dword [ebp - 0x1d4], 0x977a1245
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x54]
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x54]
cmp eax, edi
setg cl
mov dword [ebp - 4], ecx
jmp 0x426bf8
mov dword [ebp - 0x30], 0x92764969
mov dword [ebp - 4], edi
cmp dword [ebp - 4], ecx
jl 0x426bb3
mov dword [ebp - 0x1c], 0xb91ee4c
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x426b67
push ecx
push ecx
push 0x1659
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
xor ecx, ecx
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], ecx
jl 0x426bae
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc], ecx
jmp 0x426ba4
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x426ba1
push ecx
push 0xb44
push 0xca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
xor ecx, ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jle 0x426b77
dec dword [ebp - 0x1c]
jns 0x426b6f
dec dword [ebp - 4]
jns 0x426b41
mov eax, dword [ebp - 0x58]
xor ecx, ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp + eax*4 - 0x5c]
cmp eax, 7
mov eax, dword [ebp - 0x54]
mov edx, dword [ebp - 0x40]
setne cl
imul eax, ecx
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x40]
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
xor edi, edi
mov dword [ebp - 4], eax
inc edi
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0xc0]
cmp ecx, eax
setge dl
xor esi, esi
cmp edx, dword [ebp - 0xc0]
jle 0x426c20
mov edx, esi
cmp dword [ebp - 4], esi
je 0x426c22
mov edx, edi
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0x1818
test eax, eax
jne 0x426c49
mov eax, dword [ebp - 0x40]
cmp dword [ebp + eax*4 - 0x5c], esi
mov eax, esi
je 0x426c4b
mov eax, edi
mov ecx, dword [ebp - 4]
add ecx, eax
mov eax, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x5c]
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle bl
sub ebx, 0xfffffffa
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x5c]
test eax, eax
sete cl
cmp ecx, edx
jg 0x426c8f
mov edx, esi
cmp dword [ebp - 4], esi
je 0x426c91
mov edx, edi
mov eax, dword [ebp - 0x40]
xor ecx, ecx
push 2
pop edi
push 0
mov eax, dword [ebp + eax*4 - 0x5c]
sub edx, eax
mov eax, dword [ebp - 0x40]
cmp edx, eax
mov eax, dword [ebp - 0x40]
setne cl
xor ebx, ebx
cmp ecx, 0x6ca138db
setne bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 4]
cmp ebx, eax
mov eax, dword [ebp - 4]
setl dl
add eax, 0xc429a419
imul ecx, edx
add eax, ecx
pop ecx
mov dword [ebp - 0xc0], eax
inc dword [ebp - 0x40]
push 3
pop edx
cmp dword [ebp - 0x40], edi
jle 0x426ab6
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add ebx, dword [ebp - 0x2c]
inc esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], esi
cmp esi, dword [ebp - 0x18]
jl 0x42654a
push 2
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
pop edx
jmp 0x426d1a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x426d0d
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ecx
jl 0x426e58
push 4
or edi, 0xffffffff
pop ebx
mov dword [ebp - 8], 0xfffffff9
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], ecx
jmp 0x426d54
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x204], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x426d43
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], esi
jg 0x426e22
push 3
pop edi
mov dword [ebp - 0x2c], 0xf4ffcf33
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x2c], 0x426a760
mov dword [ebp - 0x2c], 0x94abc248
mov dword [ebp - 0x1c], 0xb8ea
mov dword [ebp - 0x18], ecx
jmp 0x426da7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xe8], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x426d96
mov dword [ebp - 0xe4], ecx
cmp dword [ebp - 0xe4], esi
jg 0x426e13
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x2c], 0xd0b5486b
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x18], ecx
jmp 0x426de5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x210], 0x6c7f05f4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x426dd4
mov eax, dword [ebp - 0x108]
cmp ebx, eax
mov eax, dword [ebp - 8]
sbb ecx, ecx
inc ecx
push 0
mov dword [ebp + eax*4 - 0x10c], ecx
dec dword [ebp - 0x1c]
inc dword [ebp - 0xe4]
pop ecx
cmp dword [ebp - 0xe4], esi
jle 0x426dba
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x426d68
or edi, 0xffffffff
mov dword [ebp - 0x18], ecx
jmp 0x426e46
mov dword [ebp - 8], 0x15
jmp 0x426e3d
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0x7b88cdf8
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff1
jle 0x426e30
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe3
jge 0x426e27
dec dword [ebp - 0x20]
jns 0x426d34
mov ebx, dword [ebp - 0x14]
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x426eb4
push 0x1292
push 0x256e
push 0x1c04
push ecx
push 0x2412
push 0x243b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x1d58
push 0x18ba
push 0xebe
push 0xae3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor esi, esi
xor ecx, ecx
inc esi
mov edi, dword [ebx]
mov dword [ebp - 0xc], 0xd5e48d32
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
mov dword [ebp - 0x28], edi
je 0x426ee3
push 0xf42
push 0xa0c
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor ecx, ecx
mov dword [ebp - 0xc], 0xfffffff2
jmp 0x426f20
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], 0xffffffe6
jmp 0x426f17
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x426f14
push 0x206f
push 0x1bd
push ecx
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor ecx, ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x19
jl 0x426ef8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 9
jle 0x426eec
push 4
pop eax
mov dword [ebp - 0x2c], 0x8552ad1
add ebx, eax
mov dword [ebp - 0x18], ecx
jmp 0x426f48
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x94], 0x7ddc85f7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x426f37
mov dword [ebp - 0x8c], 0xfffffff8
jmp 0x427086
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], 0xcc167df2
mov dword [ebp - 0x18], ecx
jmp 0x426f79
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x9c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x426f6c
mov dword [ebp - 0x14], ecx
jmp 0x427076
mov dword [ebp - 0x1c], 0x8d19c921
xor edx, edx
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x2c], 0x47d17017
mov dword [ebp - 0x30], 0x90ef874a
mov dword [ebp - 0x9c], 0x1462ccd2
mov eax, dword [ebp - 0x1c]
cmp eax, 0x1462ccd2
setge dl
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xffffffff
setg al
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x94]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
mov edx, esi
setne cl
add eax, ecx
xor ecx, ecx
cmp eax, 0xab8d
setg cl
xor eax, eax
cmp ecx, 0xfffffffe
setl al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x14]
sub edx, eax
mov eax, dword [ebp - 0x8c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setl cl
add eax, ecx
je 0x427046
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x18], ecx
jmp 0x427067
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x16c], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x427056
dec dword [ebp - 0x16c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x19
jne 0x426f86
dec dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 0xffffffe8
jge 0x426f5d
mov esi, dword [ebx]
xor edx, edx
push 4
pop eax
mov dword [ebp - 4], eax
or eax, 0xffffffff
mov dword [ebp - 0xc], ecx
inc edx
mov dword [ebp - 8], eax
mov dword [ebp - 0x34], 0x5c875ff9
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], ecx
jmp 0x4270c3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x98], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x4270b6
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], ecx
jl 0x42716d
or edi, 0xffffffff
mov dword [ebp - 0x14], edx
xor edx, edx
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x98], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
add ecx, 0x874d
cmp ecx, 0xfffffff6
mov ecx, dword [ebp - 0xc]
setne al
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
inc edx
cmp edx, 0x2e77e815
jge 0x427131
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x98]
sub eax, 0x8a69f64
mov dword [ebp - 0xc], eax
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x42715e
push ecx
push ecx
push 0x17ed
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
xor ecx, ecx
dec dword [ebp - 4]
push 1
pop edx
jns 0x4270d7
mov edi, dword [ebp - 0x28]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0xffffffe3
jne 0x427283
xor esi, esi
inc esi
mov dword [ebp - 0x14], 0xc1676565
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x10
je 0x42726a
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x2c], 0x2aec7f51
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x4271c2
push ecx
push ecx
push 0xf4f
push ecx
call dword [sym.imp.USER32.dll_AppendMenuA]
xor ecx, ecx
cmp dword [ebp - 0x14], ecx
jne 0x427240
cmp dword [ebp - 0x20], 0xaafa0b2b
sbb eax, eax
neg eax
neg eax
je 0x4271e3
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x20], esi
je 0x4271e3
mov ecx, esi
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edi, edi
cmp ecx, dword [ebp - 0x1c]
jge 0x427203
cmp dword [ebp - 0x14], edi
je 0x42720a
mov edx, esi
cmp dword [ebp - 0x20], edi
jne 0x42720c
mov edx, edi
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
imul ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
cmp edx, eax
setle cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x14]
imul edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
push 0
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x10
pop ecx
jne 0x427191
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe3
je 0x42717d
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x30]
push 4
pop eax
mov dword [ebp - 8], 0x9b55bb2c
add ebx, eax
mov dword [ebp - 0x18], ecx
jmp 0x4272a5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1f4], 0x9351
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x427294
mov dword [ebp - 8], ecx
jmp 0x4272cf
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x4272cc
push 0x1422
push 0x33e
push ecx
call dword [sym.imp.USER32.dll_CheckMenuItem]
xor ecx, ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x17
jne 0x4272b0
push 2
pop edx
mov dword [ebp - 8], edx
cmp dword [ebp - 8], ecx
jl 0x42732c
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ecx
jl 0x427300
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x1f4], ecx
jne 0x427300
dec dword [ebp - 0x14]
jns 0x4272ef
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ecx
jl 0x427327
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x42731f
push 0x9cb
push ecx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor ecx, ecx
dec dword [ebp - 0x14]
jns 0x427308
push 2
pop edx
dec dword [ebp - 8]
jns 0x4272e0
test esi, esi
jne 0x42741d
cmp byte [ebp - 0x39], 0
je 0x427349
cmp dword [ebp - 0x38], 1
jne 0x427349
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [ebx]
push 4
pop ecx
add ebx, ecx
mov dword [ebp - 0x38], eax
push edi
mov eax, dword [ebx]
add ebx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], ebx
call fcn.0046356b
pop ecx
mov ebx, eax
lea ecx, [ebp - 0xa8]
lea eax, [ebp - 0xcc]
mov dword [ebp - 0x30], ebx
xor esi, esi
push eax
push edi
mov dword [ebp - 0xcc], esi
mov dword [ebp - 0xa8], esi
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
call fcn.0044ad24
mov ecx, esi
mov esi, dword [ebp - 0xa8]
test edi, edi
jle 0x4273f1
mov eax, ecx
and eax, 0x80000001
jns 0x4273b0
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x38]
add eax, ecx
add eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x2c]
cdq
idiv edi
xor eax, eax
cmp word [esi + edx*2], ax
je 0x4273dc
xor ebx, ebx
lea eax, [edx + 1]
cdq
idiv edi
cmp word [esi + edx*2], bx
jne 0x4273cd
mov ebx, dword [ebp - 0x30]
xor eax, eax
inc eax
mov word [esi + edx*2], ax
mov eax, dword [ebp - 0x14]
mov al, byte [eax + edx]
mov byte [ecx + ebx], al
inc ecx
cmp ecx, edi
jl 0x4273a2
mov eax, dword [ebp + 8]
mov dword [eax], edi
mov dword [eax + 4], ebx
test esi, esi
je 0x427422
push esi
call fcn.00464a56
mov ebx, dword [ebp + 8]
xor eax, eax
pop ecx
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xa0], eax
jmp 0x427426
mov ebx, dword [ebp + 8]
jmp 0x427424
mov ebx, eax
xor eax, eax
mov dword [ebp + 8], 0x99ac7894
mov byte [ebp + 0xb], al
cmp byte [ebp + 0xb], 0
pop esi
je 0x427458
push 0x1c59
push 0x22c6
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
xor eax, eax
mov byte [ebp + 0xb], al
cmp byte [ebp + 0xb], 0
je 0x42746e
push eax
push 0x2144
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret