Function at 0x427b9c
Capabilities:
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c4
movdqa xmm0, xmmword [0xa9f6c0]
xor eax, eax
push ebx
push esi
push edi
push dword [esp + 0x84]
mov ebx, ecx
mov dword [esp + 0x54], edx
lea ecx, [esp + 0x284]
mov dword [esp + 0x38], ebx
push ecx
lea ecx, [esp + 0x278]
mov dword [esp + 0xf8], eax
push ecx
push eax
lea ecx, [esp + 0x100]
mov dword [esp + 0x104], eax
movdqu xmmword [esp + 0x280], xmm0
mov dword [esp + 0x108], eax
call fcn.0041187b
xor eax, eax
xor edi, edi
mov dword [esp + 0x14], eax
inc edi
jmp 0x427c1c
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x40], 0xd4081c29
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x427c0c
push 3
mov dword [esp + 0x44], eax
pop esi
jmp 0x427c65
mov dword [esp + 0x18], edi
mov dword [esp + 0x18], eax
jmp 0x427c5b
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x427c53
push 0x580
push 0x26e5
push eax
call dword [sym.imp.GDI32.dll_PtInRegion]
xor eax, eax
mov ecx, dword [esp + 0x18]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x427c35
inc dword [esp + 0x40]
cmp dword [esp + 0x40], esi
jle 0x427c2b
lea ecx, [esp + 0xf0]
call fcn.00410a53
push edi
lea ecx, [esp + 0x124]
call fcn.00410610
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x427ca2
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x120]
mov dword [ecx + edx*4], 0x1928c176
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x427c8c
mov ecx, dword [esp + 0x120]
mov dword [ecx], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x849f845d
cmp dword [esp + 0x24], eax
jne 0x427cd7
mov edx, dword [esp + 0x120]
mov ecx, dword [edx]
dec dword [edx]
cmp dword [edx], 0xffffffea
mov dword [esp + 0x28], ecx
jge 0x427cb1
lea ecx, [esp + 0x120]
call fcn.00410a53
push edi
lea ecx, [esp + 0x118]
call fcn.00410610
mov dword [esp + 0x24], 0xa6318529
lea ecx, [esp + 0x148]
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], 0xb3e90a62
mov dword [esp + 0x24], 0xaaeb
push 4
call fcn.00410610
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x427d3b
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x244], 0xb3921ded
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x427d28
mov dword [esp + 0x20], eax
jmp 0x427d5d
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x148]
mov dword [ecx + edx*4], 0x7dfe4d9e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x427d47
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x427d74
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, dword [esp + 0x148]
lea ecx, [esp + 0x148]
inc dword [eax + 0xc]
call fcn.00410a53
mov dword [esp + 0x20], 0x9b55bb2c
xor esi, esi
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x24], 0x2d672a83
mov dword [esp + 0x20], 0xfffffffb
cmp dword [esp + 0x20], 0xfffffff9
jg 0x427e4c
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x28], 0xcd95da22
mov dword [esp + 0x14], esi
jmp 0x427de0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2b0], 0x3ac46ddc
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x427dcd
mov dword [esp + 0x18], 0xffffffeb
jmp 0x427e3c
mov dword [esp + 0x24], 0xd6c3
lea ecx, [esp + 0x22c]
push edi
call fcn.00410610
mov dword [esp + 0x14], esi
jmp 0x427e1e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x22c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x427e0c
dec dword [esp + 0x24]
lea ecx, [esp + 0x22c]
inc dword [esp + 0x28]
call fcn.00410a53
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1d
jl 0x427df1
dec dword [esp + 0x20]
jmp 0x427dac
lea edx, [esp + 0x114]
lea ecx, [esp + 0x204]
call fcn.00426b6c
mov dword [esp + 0x14], 0x7e2799ac
mov dword [esp + 0x14], 0xfffffff2
jmp 0x427f1e
push 3
lea ecx, [esp + 0x1c4]
call fcn.00410610
mov dword [esp + 0x24], esi
lea ecx, [esp + 0x184]
mov dword [esp + 0x24], 0xc08872fa
push edi
call fcn.00410610
mov dword [esp + 0x20], esi
jmp 0x427eb3
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c0]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x427ea1
mov dword [esp + 0x20], esi
jmp 0x427ed6
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 2
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x427ec0
mov eax, dword [esp + 0x1c0]
mov ecx, 0xd4914d2e
mov dword [eax + 4], ecx
mov eax, dword [eax]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x184]
mov dword [eax], ecx
lea ecx, [esp + 0x184]
call fcn.00410a53
lea ecx, [esp + 0x1c0]
call fcn.00410a53
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xb
jl 0x427e74
push edi
lea ecx, [esp + 0x1a0]
call fcn.00410610
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x427f54
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x19c]
mov dword [ecx + edx*4], 0xfb871c7b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x427f3e
mov ecx, dword [esp + 0x19c]
mov dword [ecx], edi
mov ecx, dword [ecx]
mov dword [esp + 0x24], 9
mov dword [esp + 0x24], ecx
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x427f83
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
lea ecx, [esp + 0x19c]
call fcn.00410a53
mov eax, dword [esp + 0x114]
lea ecx, [esp + 0x1b4]
push 3
mov dword [eax], edi
call fcn.00410610
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x427fc1
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x258], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x427fae
mov dword [esp + 0x20], eax
jmp 0x427fe4
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1b4]
mov dword [ecx + edx*4], 0xf5c184c5
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x427fce
mov ecx, dword [esp + 0x1b4]
mov dword [ecx + 8], eax
mov eax, dword [ecx + 8]
inc dword [ecx + 8]
cmp dword [ecx + 8], 2
mov dword [esp + eax*4 + 0x258], 0x82bd
jl 0x427ff5
lea ecx, [esp + 0x1b4]
call fcn.00410a53
mov dword [esp + 0x24], 0x45ee28fd
xor esi, esi
mov dword [esp + 0x24], 0x8a2b8ea2
mov dword [esp + 0x24], 4
mov dword [esp + 0x24], 0x2db7
mov dword [esp + 0x20], esi
jmp 0x428053
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x2a8], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x428040
mov dword [esp + 0x20], esi
jmp 0x42806f
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x2c4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x428060
mov dword [esp + 0x24], edi
lea ecx, [esp + 0x16c]
mov dword [esp + 0x18], 0xfffffff7
push 2
call fcn.00410610
mov dword [esp + 0x28], 0x712c5197
mov dword [esp + 0x24], 8
mov dword [esp + 0x14], esi
jmp 0x4280bc
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0xeff3de03
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x4280a6
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], 0xa
jle 0x4281ee
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x12c]
push 4
call fcn.00410610
mov dword [esp + 0x1f4], 0xd17017a6
xor eax, eax
mov dword [esp + 0x1f8], 0xd17017a6
mov dword [esp + 0x1fc], 0xd17017a6
mov dword [esp + 0x200], 0xd17017a6
mov dword [esp + 0x14], eax
jmp 0x428132
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x12c]
mov dword [ecx + edx*4], 0xc18ab9c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x42811c
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x42814d
push eax
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
xor eax, eax
cmp dword [esp + 0x24], eax
jne 0x4281bb
mov ecx, dword [esp + 0x16c]
mov esi, dword [ecx]
test esi, esi
je 0x4281bb
mov ecx, dword [esp + 0x12c]
mov edi, dword [ecx + 8]
test edi, edi
je 0x428178
cmp esi, 1
jne 0x428178
xor ecx, ecx
inc ecx
jmp 0x42817a
mov ecx, eax
xor edx, edx
cmp ecx, esi
mov ecx, dword [esp + 0x18]
setl dl
sub edx, esi
neg edx
sbb edx, edx
inc edx
imul edx, edi
sub edx, ecx
mov ecx, dword [esp + 0x12c]
mov dword [ecx + 4], edx
mov dword [esp + 0x28], edx
cmp dword [esp + 0x28], 6
sbb ecx, ecx
inc ecx
dec ecx
jne 0x4281b0
cmp dword [esp + 0x18], eax
je 0x4281b4
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x200]
mov eax, dword [esp + 0x28]
or ecx, 0xffffffff
sub ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x12c]
call fcn.00410a53
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xa
jg 0x4280d2
xor edi, edi
xor esi, esi
inc edi
lea ecx, [esp + 0x16c]
call fcn.00410a53
mov dword [esp + 0xd0], 9
lea ecx, [esp + 0x24c]
push 2
call fcn.00410610
mov dword [esp + 0x24], 0x5cd53bc6
lea ecx, [esp + 0x178]
mov dword [esp + 0x24], 2
mov dword [esp + 0x24], 0xeec54165
push 3
call fcn.00410610
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 0xd3f5
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], esi
jmp 0x42826a
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x24c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x428257
push 3
mov dword [esp + 0x24], esi
pop esi
jmp 0x428290
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0xc74aa0d7
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x42827a
inc dword [esp + 0x24]
lea ecx, [esp + 0x178]
mov eax, dword [esp + 0x178]
mov dword [esp + 0x24], edi
mov eax, dword [eax + 4]
mov dword [esp + 0x24], eax
call fcn.00410a53
lea ecx, [esp + 0x24c]
call fcn.00410a53
lea edx, [esp + 0x114]
lea ecx, [esp + 0xd0]
call fcn.00426e62
mov dword [esp + 0x14], 0x814b733c
xor ecx, ecx
mov dword [esp + 0x18], 0xfffc
mov dword [esp + 0x28], 0x34392f20
push 0xfffffffffffffffc
pop eax
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x18]
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
sub eax, 0x34c865b4
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0xd061
setg al
cmp dword [esp + 0x14], eax
jl 0x42832a
cmp dword [esp + 0x14], 0
jne 0x42832a
xor ecx, ecx
jmp 0x42832c
mov ecx, edi
mov eax, dword [esp + 0x14]
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [esp + 0x14]
test ecx, ecx
je 0x428356
cmp dword [esp + 0x18], 0
je 0x428356
mov eax, edi
jmp 0x428358
xor eax, eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0xfffffff1
jmp 0x42838e
mov dword [esp + 0x20], 0x10
jmp 0x428383
cmp dword [esp + 0x28], 0
jne 0x42838a
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xd
jg 0x428378
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x31
jg 0x42836e
call fcn.004262cc
lea ecx, [esp + 0x114]
call fcn.00410a53
mov dword [esp + 0x18], 0x79b69b2e
xor eax, eax
mov dword [esp + 0x24], 0x38b4b72b
mov dword [esp + 0x14], eax
jmp 0x4283cd
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x2b8], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x4283be
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], eax
jmp 0x428407
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x428403
push 0x25f9
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x4283e9
cmp dword [ebx + 0x10], eax
jne 0x42841a
xor al, al
jmp 0x4298bc
lea ecx, [esp + 0x50]
call fcn.004270a1
push edi
lea ecx, [esp + 0x100]
call fcn.00410610
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x42844e
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xfc]
mov dword [ecx + edx*4], 0x1928c176
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x428438
mov ecx, dword [esp + 0xfc]
mov dword [ecx], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x849f845d
cmp dword [esp + 0x24], eax
jne 0x428483
mov edx, dword [esp + 0xfc]
mov ecx, dword [edx]
dec dword [edx]
cmp dword [edx], 0xffffffea
mov dword [esp + 0x28], ecx
jge 0x42845d
lea ecx, [esp + 0xfc]
call fcn.00410a53
push 4
pop ebx
xor eax, eax
mov dword [esp + 0x24], ebx
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x4284ab
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x4284d3
push 0x24f4
push 0x1808
push 0x178b
push 0xd3d
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
mov dword [esp + 0x38], 0x88a137b1
mov dword [esp + 0x18], eax
mov dword [esp + 0x30], 0x6b6cd333
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0x26f39384
mov ecx, dword [esp + 0x38]
cmp dword [esp + 0x18], eax
je 0x428501
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x30], ecx
imul ecx, dword [esp + 0x30], 0xa
mov edx, dword [esp + 0x18]
neg edx
sub edx, ecx
xor ecx, ecx
cmp edx, 0x2d34caa8
setl cl
xor edx, edx
cmp ecx, 0x2b000cd9
setl dl
add edx, dword [esp + 0x18]
je 0x42853a
mov edx, edi
cmp dword [esp + 0x18], eax
jne 0x42853c
mov edx, eax
xor ecx, ecx
test edx, edx
sete cl
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], eax
je 0x428555
mov edx, edi
cmp dword [esp + 0x30], eax
jne 0x428557
mov edx, eax
mov ecx, dword [esp + 0x18]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x38]
setl bl
xor edx, edx
cmp ecx, ebx
setl dl
mov dword [esp + 0x24], edx
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x428593
push eax
push 0x1d46
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor eax, eax
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], 0x7412df3d
mov dword [esp + 0x24], 0xfffffffe
push 3
mov dword [esp + 0x28], 0x34e1054d
mov dword [esp + 0x18], eax
pop edi
jmp 0x4285d7
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x94], 2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x4285c4
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x428605
push 0xdd7
push 0x11f2
push 0x7f6
push 0x1cfa
push eax
call dword [sym.imp.USER32.dll_SetRect]
xor eax, eax
mov ecx, dword [esp + 0x18]
xor ebx, ebx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
cmp ecx, 7
mov ecx, dword [esp + 0x98]
setle bl
xor edx, edx
cmp ebx, ecx
setg dl
mov dword [esp + 0x28], edx
mov ecx, dword [esp + 0x98]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x98]
cmp dword [esp + 0x98], eax
jg 0x428663
cmp dword [esp + 0x18], eax
je 0x428670
cmp dword [esp + 0x18], eax
je 0x428670
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x428675
xor ebx, ebx
mov edx, eax
inc ebx
xor ecx, ecx
cmp edx, 0xb0e4
setne cl
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], eax
jmp 0x42869a
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x44], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x42868a
mov dword [esp + 0x2c], 2
cmp dword [esp + 0x2c], eax
jl 0x42908a
mov ecx, 0x9ff60657
mov dword [esp + 0x24], eax
mov dword [esp + 0x138], ecx
mov dword [esp + 0x13c], ecx
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], ecx
mov dword [esp + 0x18], 0x6e6bacd7
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], eax
jl 0x428711
mov dword [esp + 0x24], 0x7161ab6e
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + ecx*4 + 0x138]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + ecx*4 + 0x138]
mov dword [esp + 0x24], ecx
dec dword [esp + 0x18]
jns 0x4286e9
mov dword [esp + 0x18], 0xffff8cb1
xor ebx, ebx
mov ecx, dword [esp + 0x2c]
push 0xfffffffffffffffc
pop esi
mov edx, dword [esp + ecx*4 + 0x44]
mov ecx, dword [esp + 0x2c]
cmp ecx, edx
mov ecx, dword [esp + 0x2c]
setne bl
xor edx, edx
mov ecx, dword [esp + ecx*4 + 0x44]
cmp ebx, ecx
mov ecx, dword [esp + 0x2c]
setne dl
xor ebx, ebx
sub edx, 9
cmp edx, ecx
mov ecx, dword [esp + 0x4c]
setne bl
neg ecx
sbb ecx, ecx
inc ecx
imul ebx, ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + ecx*4 + 0x44]
add ebx, 0xecaf
cmp esi, ebx
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
mov ecx, dword [esp + 0x2c]
setne bl
xor edx, edx
mov ecx, dword [esp + ecx*4 + 0x44]
cmp ebx, ecx
mov ecx, dword [esp + 0x2c]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x2c]
setg bl
xor edx, edx
mov ecx, dword [esp + ecx*4 + 0x44]
cmp ebx, ecx
mov ecx, dword [esp + 0x2c]
setle dl
cmp dword [esp + ecx*4 + 0x44], edx
jl 0x4287b5
mov ecx, dword [esp + 0x2c]
cmp dword [esp + ecx*4 + 0x44], eax
jne 0x4287b5
xor ebx, ebx
inc ebx
jmp 0x4287ba
xor ebx, ebx
inc ebx
mov eax, ebx
mov dword [esp + 0x24], eax
lea ecx, [esp + 0xa0]
mov dword [esp + 0x18], 9
mov dword [esp + 0x20], 0xef5d870a
push ebx
call fcn.00410610
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x4287f9
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xa0]
mov dword [ecx + edx*4], 0xa1654207
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x4287e3
mov edx, dword [esp + 0x18]
sub edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
sub ecx, edx
cmp dword [esp + 0x18], ecx
jle 0x42881c
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0xa0]
mov dword [ecx], edx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], eax
jg 0x4288f0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0x215169ff
mov dword [esp + 0x1c], eax
jmp 0x428860
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x220], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x428851
mov ecx, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x7f51
mov ecx, dword [esp + 0xa0]
setle dl
xor ebx, ebx
mov dword [ecx + esi*4], edx
mov dword [esp + 0x28], 0xfffffff6
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esp + 0x220], edx
mov ecx, dword [esp + 0x14]
cmp ecx, edx
mov ecx, dword [esp + 0x18]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ebx, ebx
xor ecx, ecx
inc ebx
cmp edx, ebx
setg cl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [esp + 0xa0]
setl dl
mov dword [ecx], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x42883f
push 0xfffffffffffffffc
pop esi
lea ecx, [esp + 0xa0]
call fcn.00410a53
mov eax, dword [esp + 0x2c]
xor edx, edx
imul ecx, dword [esp + eax*4 + 0x44], 0x8123
mov eax, dword [esp + 0x2c]
cmp eax, ecx
setl dl
xor ecx, ecx
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
cmp eax, ebx
mov eax, dword [esp + 0x4c]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x2c]
setle dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x44]
cmp eax, edx
mov eax, dword [esp + 0x2c]
setle cl
xor edx, edx
mov eax, dword [esp + eax*4 + 0x44]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setg dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x44]
cmp edx, eax
mov eax, dword [esp + 0x2c]
setge cl
cmp ecx, dword [esp + eax*4 + 0x44]
jle 0x428974
mov ecx, dword [esp + 0x2c]
xor eax, eax
cmp dword [esp + ecx*4 + 0x44], eax
jne 0x428976
mov ecx, eax
jmp 0x428978
xor eax, eax
mov ecx, ebx
add ecx, 0xffff0ee4
je 0x428c63
push ebx
lea ecx, [esp + 0x68]
call fcn.00410610
mov dword [esp + 0x18], 0x81c2900
mov dword [esp + 0x38], 0xe5411aa8
mov dword [esp + 0x30], 0xe0e3cec3
mov dword [esp + 0x1c], 0
jmp 0x4289c3
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], 0x1713b910
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jl 0x4289b0
mov dword [esp + 0x18], 0
cmp dword [esp + 0x18], 0
jl 0x428c49
mov dword [esp + 0x20], 0x26a056eb
lea ecx, [esp + 0x190]
mov dword [esp + 0x28], 0x4b748abb
mov dword [esp + 0x14], 0xd7582ba8
mov dword [esp + 0x1c], 0
push edi
call fcn.00410610
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x428a27
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x190]
mov dword [ecx + edx*4], 0x3fccfb42
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x428a11
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
cmp dword [ecx + edx*4], eax
je 0x428acd
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x38], 0xfffffff8
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
mov esi, dword [esp + 0x20]
imul esi, dword [ecx + edx*4]
neg esi
sbb esi, esi
neg esi
cmp esi, dword [esp + 0x28]
jl 0x428a78
mov ecx, dword [esp + 0x64]
mov esi, ebx
cmp dword [ecx], eax
jne 0x428a7a
mov esi, eax
mov ecx, dword [esp + 0x18]
xor edx, edx
cmp esi, ecx
setne dl
xor ebx, ebx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x64]
cmp edx, dword [ecx]
setle bl
mov dword [esp + 0x14], ebx
xor ebx, ebx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
setge bl
cmp ebx, 6
sbb ecx, ecx
xor ebx, ebx
add ecx, 0xb32fde57
inc ebx
mov dword [esp + 0x1c], ecx
mov edx, ebx
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x38], 0x6522
jne 0x428acf
mov edx, eax
mov ecx, dword [esp + 0x64]
cmp edx, dword [ecx]
je 0x428baa
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], 0x5e2d
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], eax
jl 0x428bf9
mov ecx, dword [esp + 0x64]
xor edx, edx
mov dword [esp + 0x14], 0xffffffff
cmp dword [ecx], ebx
mov ecx, dword [esp + 0x38]
setl dl
imul ecx, edx
test ecx, ecx
je 0x428b23
mov ecx, ebx
cmp dword [esp + 0x20], eax
jne 0x428b25
mov ecx, eax
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x30]
dec dword [esp + 0x30]
test ecx, ecx
je 0x428b54
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x14], eax
je 0x428b54
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x64]
cmp dword [ecx + edx*4], eax
je 0x428b54
mov esi, ebx
cmp dword [esp + 0x14], eax
jne 0x428b56
mov esi, eax
mov ecx, dword [esp + 0x14]
xor edx, edx
cmp ecx, esi
mov ecx, dword [esp + 0x14]
push 1
setne dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x18]
pop ebx
setle dl
sub esi, edx
xor edx, edx
cmp ecx, esi
mov ecx, 0x87c3cb87
setl dl
imul edx, dword [esp + 0x28]
cmp ecx, edx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
dec dword [esp + 0x20]
jns 0x428afd
jmp 0x428bf9
mov dword [esp + 0x14], 0xfffffffb
mov dword [esp + 0x1c], eax
jmp 0x428bcb
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x29c], 8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x428bb8
mov ecx, dword [esp + 0x190]
dec dword [ecx]
mov dword [esp + 0x14], eax
jmp 0x428bf3
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x29c], 0x50227cdb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x428be0
mov dword [esp + 0x20], eax
jmp 0x428c2d
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], eax
jl 0x428c29
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x428c23
push eax
push 0xdc3
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
xor eax, eax
dec dword [esp + 0x14]
jns 0x428c09
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x428bff
lea ecx, [esp + 0x190]
call fcn.00410a53
dec dword [esp + 0x18]
jns 0x4289dc
lea ecx, [esp + 0x64]
call fcn.00410a53
xor eax, eax
cmp dword [esp + 0x24], eax
jne 0x42908a
jmp 0x42907b
mov dword [esp + 0x14], 0x33992443
mov dword [esp + 0x24], 0xab274bf9
mov dword [esp + 0x24], 0x2086bd08
mov dword [esp + 0x28], 0xfffffffd
mov dword [esp + 0x24], 0xa87fce6b
mov dword [esp + 0x1c], eax
jmp 0x428ca4
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0xcc], 0xb72b21a3
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jl 0x428c91
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x428cbf
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], eax
je 0x428cd5
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xcc], ecx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp ecx, 0x4ccf
setl dl
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], 0xfffffff9
mov dword [esp + 0x18], 0x1accbad8
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0x24], 0x80d416db
mov dword [esp + 0x24], 0x31d8b9db
mov dword [esp + 0x20], 0xe7b79f6a
mov dword [esp + 0x24], 0x75d5f8d9
mov dword [esp + 0x1c], eax
jmp 0x428d60
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0xbc], 0xc2e0cf57
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jl 0x428d4d
mov dword [esp + 0x14], eax
jmp 0x428e08
push edi
lea ecx, [esp + 0x218]
call fcn.00410610
mov dword [esp + 0x24], 0xfffffff8
xor eax, eax
mov dword [esp + 0x24], 0xfa3a92bd
mov dword [esp + 0x1c], eax
jmp 0x428da6
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x214]
mov dword [ecx + edx*4], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x428d94
dec dword [esp + 0x20]
mov dword [esp + 0x20], eax
jmp 0x428df0
mov dword [esp + 0x18], eax
jmp 0x428de6
mov dword [esp + 0x24], 5
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x428dde
push 0x1255
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor eax, eax
inc dword [esp + 0x24]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x428dbc
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x428db6
lea ecx, [esp + 0x214]
call fcn.00410a53
inc dword [esp + 0x14]
xor eax, eax
cmp dword [esp + 0x14], eax
jle 0x428d6f
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
mov byte [esp + 0x13], al
mov dword [esp + 0x70], 0x5bb2c213
mov dword [esp + 0x74], 0x5bb2c213
mov dword [esp + 0x78], 0x5bb2c213
mov dword [esp + 0x7c], 0x5bb2c213
mov dword [esp + 0x18], 9
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], edi
jg 0x428f5f
push edi
lea ecx, [esp + 0x8c]
call fcn.00410610
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x428e84
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x88]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x428e71
mov ecx, dword [esp + 0x88]
mov dword [ecx], eax
mov dword [esp + 0x1c], eax
jmp 0x428ea9
cmp byte [esp + 0x13], 0
je 0x429079
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], eax
jmp 0x428fa7
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x428f89
cmp dword [esp + 0x1c], 0xf
jge 0x428f74
mov dword [esp + 0x18], 0x834504cd
mov dword [esp + 0x1e4], ebx
mov dword [esp + 0x1e8], ebx
mov dword [esp + 0x1ec], ebx
mov dword [esp + 0x1f0], ebx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], eax
jl 0x42900f
xor eax, eax
dec dword [esp + 0x2c]
mov ecx, 0x9ff60657
jns 0x4286b7
mov dword [esp + 0x14], 0x571177e8
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x24], 0x7928fbc7
push edi
call fcn.00410610
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], eax
jmp 0x4290c9
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1a8]
mov dword [ecx + edx*4], 0xfffffff9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x4290b3
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], 0xffffffed
je 0x42914c
mov dword [esp + 0x28], 0xfffffffd
mov dword [esp + 0x24], 0xfffffffc
cmp dword [esp + 0x14], 0xfff8
sbb ecx, ecx
neg ecx
cmp ecx, 0xfff9
jbe 0x429106
mov edi, ebx
cmp dword [esp + 0x24], eax
jne 0x429108
mov edi, eax
mov ecx, dword [esp + 0x28]
xor edx, edx
mov dword [esp + 0x24], ecx
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1a8]
mov dword [ecx], esi
mov ecx, dword [esp + 0x28]
cmp edi, ecx
setle dl
add edx, esi
sub edx, dword [esp + 0x28]
je 0x429138
mov ecx, ebx
cmp dword [esp + 0x28], eax
jne 0x42913a
mov ecx, eax
mov dword [esp + 0x24], ecx
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffed
jne 0x4290da
push 3
pop edi
lea ecx, [esp + 0x1a8]
call fcn.00410a53
push dword [esp + 0xbc]
movdqa xmm0, xmmword [str._t_t_t_t]
lea ecx, [esp + 0x294]
push ecx
xor eax, eax
lea ecx, [esp + 0x288]
push ecx
mov byte [esp + 0x1f], al
lea ecx, [esp + 0xbc]
push eax
movdqu xmmword [esp + 0x290], xmm0
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
call fcn.0041187b
mov dword [esp + 0x14], 0x184c506d
xor esi, esi
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], esi
jl 0x429229
push 4
lea ecx, [esp + 0x1dc]
call fcn.00410610
mov dword [esp + 0x1c], esi
jmp 0x4291e6
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1d8]
mov dword [eax + ecx*4], 0xa6b950ba
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x4291d0
mov edi, dword [esp + 0x1d8]
mov dword [edi + 0xc], esi
mov edx, dword [esp + 0x14]
mov eax, dword [edi + 0xc]
mov ecx, dword [esp + 0xb0]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [edi + 0xc]
cmp dword [edi + 0xc], 3
jle 0x4291f7
lea ecx, [esp + 0x1d8]
call fcn.00410a53
dec dword [esp + 0x14]
jns 0x4291bc
push 3
pop edi
lea ecx, [esp + 0xb0]
call fcn.00410a53
cmp byte [esp + 0x13], 0
je 0x429363
mov dword [esp + 0x14], 0xfffffff9
xor eax, eax
mov dword [esp + 0x18], 0x1accbad8
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0x24], 0x80d416db
mov dword [esp + 0x24], 0x31d8b9db
mov dword [esp + 0x20], 0xe7b79f6a
mov dword [esp + 0x24], 0x75d5f8d9
mov dword [esp + 0x1c], eax
jmp 0x429293
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x248], 0xc2e0cf57
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jl 0x429280
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], eax
jg 0x42934e
push edi
lea ecx, [esp + 0x20c]
call fcn.00410610
mov dword [esp + 0x24], 0xfffffff8
xor eax, eax
mov dword [esp + 0x24], 0xfa3a92bd
mov dword [esp + 0x1c], eax
jmp 0x4292e2
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x208]
mov dword [ecx + edx*4], 0xfffffffc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x4292cc
dec dword [esp + 0x20]
mov dword [esp + 0x20], eax
jmp 0x42932c
mov dword [esp + 0x18], eax
jmp 0x429322
mov dword [esp + 0x24], 5
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x42931a
push 0x1255
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor eax, eax
inc dword [esp + 0x24]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x4292f8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x4292f2
lea ecx, [esp + 0x208]
call fcn.00410a53
inc dword [esp + 0x14]
xor esi, esi
cmp dword [esp + 0x14], esi
jle 0x4292a7
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
call fcn.004274a0
mov dword [esp + 0x2c], 0x24ec2e0c
xor eax, eax
mov dword [esp + 0x28], 0x4c7af5af
mov dword [esp + 0x1c], eax
jmp 0x429387
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x5c], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x42937b
mov dword [esp + 0x2c], 0xb
jmp 0x4293dc
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x4293d8
push 0xffe
push 0xdc7
push 0x2430
push 0x15a9
push 0x23c
push 0x2506
push 0xac5
push 0x2433
push 0x85b
call dword [sym.imp.GDI32.dll_Arc]
xor eax, eax
dec dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0xfffffff5
jg 0x429398
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], ebx
jg 0x42959b
push edi
lea ecx, [esp + 0x158]
call fcn.00410610
xor eax, eax
mov dword [esp + 0x24], 0x4d14b718
mov dword [esp + 0x1c], eax
jmp 0x429420
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x154]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x42940e
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + ecx*4 + 0x5c]
add ecx, 0x16db
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + ecx*4 + 0x5c]
imul ecx, dword [esp + 0x28]
test ecx, ecx
je 0x42956d
mov dword [esp + 0x30], 0xffff
lea ecx, [esp + 0x1cc]
mov dword [esp + 0x24], ebx
push edi
call fcn.00410610
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x429484
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1cc]
mov dword [ecx + edx*4], 0x2324
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x42946e
mov dword [esp + 0x18], eax
jmp 0x4294a3
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x290], 0xc65a
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x429490
cmp dword [esp + 0x30], eax
jne 0x4294e8
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
mov edx, dword [esp + ecx*4 + 0x5c]
mov ecx, dword [esp + 0x5c]
cmp edx, ecx
mov ecx, dword [esp + 0x2c]
setne bl
mov dword [esp + ecx*4 + 0x5c], ebx
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], 1
cmp dword [esp + 0x28], eax
jne 0x4294e4
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x154]
xor ebx, ebx
mov ecx, dword [esp + 0x30]
cmp dword [edx + 8], ecx
mov esi, dword [edx + 8]
mov ecx, dword [esp + 0x2c]
setge bl
sub ebx, edi
xor edx, edx
cmp ebx, ecx
setge dl
xor ecx, ecx
cmp edx, 6
setle cl
add ecx, esi
jne 0x429522
test esi, esi
jne 0x429522
xor ebx, ebx
mov edx, eax
inc ebx
jmp 0x429527
xor ebx, ebx
inc ebx
mov edx, ebx
xor ecx, ecx
cmp esi, edx
sete cl
cmp ecx, dword [esp + 0x2c]
je 0x42953c
mov ecx, ebx
cmp dword [esp + 0x60], eax
jne 0x42953e
mov ecx, eax
mov eax, dword [esp + 0x1cc]
xor edx, edx
cmp ecx, dword [eax + 8]
mov eax, dword [esp + 0x294]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x1cc]
call fcn.00410a53
jmp 0x42957f
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x42957f
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
lea ecx, [esp + 0x154]
call fcn.00410a53
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], ebx
jle 0x4293f1
xor eax, eax
mov edx, dword [esp + 0x34]
cmp dword [edx + 0x14], 0x10
jb 0x4295a9
mov ecx, dword [edx]
jmp 0x4295ab
mov ecx, edx
cmp dword [edx + 0x14], 0x10
mov dword [esp + 0x80], ecx
jb 0x4295bc
mov esi, dword [edx]
jmp 0x4295be
mov esi, edx
mov edx, dword [edx + 0x10]
add edx, esi
cmp ecx, edx
je 0x42972d
mov cl, byte [ecx]
cmp cl, 0x30
jl 0x42963d
cmp cl, 0x39
jg 0x42963d
mov dword [esp + 0x24], 4
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x4295f3
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x42961b
push 0x24f4
push 0x1808
push 0x178b
push 0xd3d
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
xor eax, eax
mov edi, dword [esp + 0x50]
mov ecx, dword [esp + 0x80]
imul esi, dword [edi], 0xa
movsx edx, byte [ecx]
add edx, 0xffffffd0
add edx, esi
inc ecx
mov dword [edi], edx
mov edx, dword [esp + 0x34]
jmp 0x4295ab
push 0x576f
push 0x4b27
push eax
lea eax, [esp + 0x5c]
push eax
push 0x62f9
push 0x117b
push 0x18e5
push 0x206e
push 0x3537
call fcn.0042d36a
add esp, 0x24
lea ecx, [esp + 0x160]
push 2
call fcn.00410610
mov dword [esp + 0x3c], 0x79763266
lea edx, [esp + 0x160]
lea ecx, [esp + 0x228]
call fcn.00426389
xor esi, esi
mov dword [esp + 0x3c], esi
jmp 0x4296ac
lea edx, [esp + 0x3c]
call fcn.00427557
inc dword [esp + 0x3c]
lea ecx, [esp + 0x160]
cmp dword [esp + 0x3c], ebx
jle 0x42969f
call fcn.00410a53
push ebx
lea ecx, [esp + 0x10c]
call fcn.00410610
lea edx, [esp + 0x108]
lea ecx, [esp + 0xd4]
call fcn.00427740
lea ecx, [esp + 0x108]
call fcn.0042795f
mov dword [esp + 0xdc], 9
lea edx, [esp + 0x108]
lea ecx, [esp + 0xdc]
call fcn.004264eb
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x42971c
push eax
push eax
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
lea ecx, [esp + 0x108]
call fcn.00410a53
jmp 0x428413
mov dword [esp + 0x1c], 0xdb3ae355
mov dword [esp + 0x1c], eax
jmp 0x42976a
mov dword [esp + 0x34], 0x9ea
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x24], ecx
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x429766
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
xor eax, eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff6
jne 0x42973b
movdqa xmm0, xmmword [0xa9f700]
lea ecx, [esp + 0x270]
push 2
pop edi
push dword [esp + 0xd4]
mov dword [esp + 0xf0], 0xa35f394a
push ecx
mov dword [esp + 0x3c], edi
lea ecx, [esp + 0x268]
mov dword [esp + 0xe0], 0x7a4bedcc
push ecx
mov dword [esp + 0x40], 0xfffffff8
lea ecx, [esp + 0xcc]
mov dword [esp + 0xf4], 0x660f7e73
mov dword [esp + 0x40], ebx
push eax
movdqu xmmword [esp + 0x270], xmm0
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], eax
call fcn.0041187b
mov dword [esp + 0xac], 8
lea ecx, [esp + 0x238]
mov dword [esp + 0x34], 0x6773
mov dword [esp + 0x34], 0xfffffffb
mov dword [esp + 0xe0], 0x6493
mov dword [esp + 0xe4], 0xffffffff
mov dword [esp + 0x84], 0x1ba1
push edi
call fcn.00410610
xor esi, esi
mov dword [esp + 0x1c], esi
jmp 0x429856
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x238]
mov dword [eax + ecx*4], 0x5aa9c4ad
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x429840
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0xec]
push eax
lea eax, [esp + 0xd0]
push eax
lea ecx, [esp + 0x100]
push ecx
lea edx, [esp + 0xc4]
lea ecx, [esp + 0x9c]
call fcn.004266ac
add esp, 0x18
lea ecx, [esp + 0x238]
call fcn.00410a53
lea ecx, [esp + 0xc0]
call fcn.00410a53
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret