Function at 0x416aac
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x33c
push ebx
push esi
push edi
xor eax, eax
mov byte [ebp - 0x15], dl
push 1
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x1c], eax
pop ebx
jmp 0x416ad2
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x60], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x416ac8
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
mov dword [ebp - 0x60], 0xfffffff4
pop esi
jmp 0x416c39
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], eax
jmp 0x416b06
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x138], 0x3eb905d0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x416af5
mov dword [ebp - 8], esi
cmp dword [ebp - 8], eax
jl 0x416c21
mov dword [ebp - 0xc], 0xd0d3f7bf
mov dword [ebp - 0x14], 0xaa9dade6
mov byte [ebp - 0x2a], al
cmp byte [ebp - 0x2a], 0
je 0x416b42
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x416c0f
mov dword [ebp - 0x24], 0xa8bc
mov dword [ebp - 0x20], 9
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x138], eax
jne 0x416c18
mov edx, dword [ebp - 0x24]
mov esi, ebx
mov ecx, dword [ebp - 0xc]
inc dword [ebp - 0x24]
cmp edx, ecx
mov ecx, dword [ebp - 0x5c]
cmovne esi, eax
xor edx, edx
cmp ecx, 2
mov ecx, dword [ebp - 0x60]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setne bl
mov ecx, dword [ebp + ecx*4 - 0x138]
add ecx, ebx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0xc]
jg 0x416bad
cmp dword [ebp - 0xc], eax
jne 0x416bad
mov edx, eax
jmp 0x416bb2
xor ecx, ecx
lea edx, [ecx + 1]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x138]
add ecx, edx
mov edx, 0xc89d73ae
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp esi, ecx
mov ecx, dword [ebp - 0xc]
setne dl
imul edx, dword [ebp + ecx*4 - 0x138]
test edx, edx
jne 0x416be2
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 8]
inc edx
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [ebp - 8]
setl bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 8]
push 2
pop esi
setge dl
push 1
mov dword [ebp + ecx*4 - 0x138], edx
inc dword [ebp - 0xc]
pop ebx
cmp dword [ebp - 0xc], esi
jle 0x416b4a
dec dword [ebp - 8]
jns 0x416b18
mov byte [ebp - 0x2a], al
cmp byte [ebp - 0x2a], 0
je 0x416c36
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
inc dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0x1a
jne 0x416aed
push 3
lea ecx, [ebp - 0x290]
call fcn.004147f5
mov dword [ebp - 0x24], 0xffffffff
mov eax, 0x2d14
mov dword [ebp - 0x14], 0x91f782a1
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c0], eax
mov dword [ebp - 0x1bc], eax
xor eax, eax
mov dword [ebp - 0x10], 0xd1e814b7
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x20], 0xfdad
mov dword [ebp - 0x24], 0xd5d08818
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
jmp 0x416cae
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x1d0], 0x6eb6b9dd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x416c9d
inc dword [ebp - 0x20]
jne 0x416cbf
mov esi, eax
cmp dword [ebp - 0xc], eax
je 0x416cc1
mov esi, ebx
mov ecx, dword [ebp - 0xc]
xor edx, edx
cmp ecx, 0x21
setge dl
xor ebx, ebx
mov dword [ebp - 0x1d0], edx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1bc]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1cc]
mov ecx, dword [ebp - 0xc]
cmp ecx, edx
mov ecx, dword [ebp - 0x24]
setl bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x10], eax
je 0x416d16
cmp dword [ebp - 0x1bc], eax
je 0x416d16
xor ecx, ecx
inc ecx
jmp 0x416d18
mov ecx, eax
add ecx, esi
push 3
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x1c], eax
pop ebx
jmp 0x416d34
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x290]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x416d25
xor esi, esi
mov dword [ebp - 0xc], 0x60477862
inc esi
mov dword [ebp - 0x1c], 0x70ade216
push esi
lea ecx, [ebp - 0x1a0]
call fcn.004147f5
mov dword [ebp - 0x10], 9
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x20], 0xb7a2e255
push 4
call fcn.004147f5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x416d89
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x278], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x416d78
mov dword [ebp - 4], eax
jmp 0x416da6
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1a0]
mov dword [ecx + edx*4], 0xe0184dcc
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x416d93
push 2
mov dword [ebp - 4], eax
pop edx
jmp 0x416dc4
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xc4], 0x299fa9ef
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x416db3
mov dword [ebp - 4], eax
jmp 0x416ddf
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x2b4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x416dce
mov dword [ebp - 4], eax
jmp 0x416df8
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x208]
mov dword [ecx + edx*4], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x416de9
mov dword [ebp - 0xc], 0xffffffe3
jmp 0x416e15
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x274], eax
jne 0x416e1b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1a
jle 0x416e07
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x97867a7b
mov ecx, dword [ebp - 0xc]
setne dl
xor ebx, ebx
sub edx, ecx
mov dword [ebp - 0xc4], edx
lea ecx, [edx + 1]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp ecx, edx
setge bl
xor ecx, ecx
cmp ebx, 0xe96bb645
setne cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
cmp dword [ebp - 0x14], ecx
setg dl
cmp edx, ecx
jle 0x416e6e
cmp dword [ebp - 0xc], eax
je 0x416e6e
mov eax, esi
neg eax
jne 0x416e78
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0xc4]
cmp eax, 0x245e3205
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2b0], eax
imul ecx, dword [ebp - 0x1c], 0xa
mov eax, dword [ebp - 0x1a0]
add ecx, dword [ebp - 0x10]
dec dword [eax]
mov eax, dword [ebp - 0x1a0]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x208]
setne dl
xor ecx, ecx
cmp edx, esi
mov dword [ebp - 0x278], edx
setge cl
mov dword [eax], ecx
lea ecx, [ebp - 0x208]
call fcn.004148c7
lea ecx, [ebp - 0x1a0]
call fcn.004148c7
push 2
pop ebx
mov dword [ebp - 0x24], ebx
xor eax, eax
cmp dword [ebp - 0x24], eax
jl 0x4177fd
jmp 0x416efb
xor eax, eax
mov dword [ebp - 4], 0xfffffff6
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x10], 0xbc00eadd
mov dword [ebp - 0x14], 0xea90
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0xffffffeb
cmp dword [ebp - 4], 0xffffffed
je 0x416fa0
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x1c], eax
jmp 0x416f4b
mov ecx, dword [ebp - 0x1c]
mov dword [ebp + ecx*4 - 0x54], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x416f3d
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x54], ecx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0x20], ecx
jge 0x416f7d
mov edx, eax
cmp dword [ebp - 4], eax
je 0x416f7f
mov edx, esi
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x54], esi
mov ecx, dword [ebp - 0x28]
add ecx, edx
xor edx, edx
cmp esi, ecx
push 1
setl dl
mov dword [ebp - 0x10], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffed
pop esi
jne 0x416f27
mov dword [ebp - 4], eax
jmp 0x41709d
mov dword [ebp - 8], 0xd6cd5387
mov dword [ebp - 0xc], 0xe45a9172
mov dword [ebp - 0x1c], 0xfffffff6
mov ecx, dword [ebp - 0x20]
dec dword [ebp - 0x14]
je 0x416fdd
mov edx, dword [ebp - 0x1c]
xor ebx, ebx
mov ecx, dword [ebp - 8]
cmp edx, ecx
setne bl
cmp ebx, 0x71f8
jg 0x416fdd
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], 0x87b332e
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
sub edx, ecx
mov ecx, dword [ebp - 0x1c]
cmp edx, ecx
setne bl
xor edx, edx
sub ebx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ebx, ecx
mov ecx, dword [ebp - 0x1c]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0xc]
setg bl
shl ebx, 2
sub ecx, ebx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x99fd
mov ecx, dword [ebp - 8]
setne dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setle bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x1c]
setne dl
dec edx
mov dword [ebp - 0x28], edx
xor edx, edx
cmp dword [ebp - 0x28], ecx
setg dl
cmp edx, 0xc911b6be
sbb ecx, ecx
inc ecx
neg ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xc], 0x11
jmp 0x417094
mov byte [ebp - 0x2a], al
cmp byte [ebp - 0x2a], 0
je 0x41707c
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
mov byte [ebp - 0x2a], al
cmp byte [ebp - 0x2a], 0
je 0x417091
push esi
call edi
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
xor eax, eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x417069
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffffb
jle 0x416fa8
mov dword [ebp - 4], 0xfffffff9
mov dword [ebp - 8], 0xfffffff7
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], 0xfffffff5
cmp dword [ebp - 4], 3
jg 0x417206
mov dword [ebp - 0xc], 0xfffffffe
mov dword [ebp - 0x1c], 0x95196ee4
mov dword [ebp - 0x10], 0xfffffff7
cmp dword [ebp - 0xc], eax
jne 0x4170f1
mov ecx, eax
cmp dword [ebp - 4], eax
je 0x4170f3
mov ecx, esi
mov dword [ebp - 8], ecx
xor edx, edx
mov ecx, dword [ebp - 0xc]
cmp ecx, 0x4d63a88e
mov ecx, dword [ebp - 0xc]
setle dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setge bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 4]
setge dl
mov dword [ebp - 0x14], edx
xor edx, edx
cmp dword [ebp - 0x14], ecx
setle dl
mov dword [ebp - 0xc], edx
xor edx, edx
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 4]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 8]
setne dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x10]
setle bl
xor edx, edx
cmp ecx, ebx
setg dl
cmp edx, dword [ebp - 0x28]
jl 0x417165
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
inc ecx
sub edx, ecx
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 4]
jge 0x4171ed
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0xc], 2
je 0x417192
mov edx, esi
cmp dword [ebp - 4], eax
jne 0x417194
mov edx, eax
mov ecx, dword [ebp - 4]
sub edx, ecx
xor ecx, ecx
cmp edx, 0xa7a2
setle cl
inc ecx
mov dword [ebp - 0x14], ecx
jne 0x4171b1
mov edi, eax
cmp dword [ebp - 0x20], eax
je 0x4171b3
mov edi, esi
mov dword [ebp - 8], 0xffff
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 4]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
setg dl
xor esi, esi
xor ecx, ecx
inc esi
cmp edx, esi
setle cl
xor ebx, ebx
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
cmp ecx, edx
setl bl
sub ebx, edi
mov dword [ebp - 0xc], ebx
jmp 0x4171f3
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x4170d0
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x29], al
lea ecx, [ebp - 0x94]
mov dword [ebp - 8], 0xfffffffb
mov dword [ebp - 4], 0x41b66baf
push 2
call fcn.004147f5
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 0x14], 0x1d584d75
mov dword [ebp - 0x10], eax
jmp 0x417248
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x94]
mov dword [ecx + edx*4], 0x3b0a6d08
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x417235
mov ecx, dword [ebp - 8]
cmp dword [ebp - 4], eax
je 0x41729d
mov edx, dword [ebp - 4]
xor ebx, ebx
mov ecx, dword [ebp - 8]
cmp ecx, edx
setne bl
xor edx, edx
sub ebx, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp ebx, ecx
setge dl
sub edx, 4
jne 0x41727e
cmp dword [ebp - 4], eax
jne 0x41727e
mov ecx, eax
jmp 0x417281
xor ecx, ecx
inc ecx
xor edx, edx
cmp esi, ecx
sete dl
xor ecx, ecx
cmp edx, 0x889e
setge cl
xor esi, esi
inc esi
cmp ecx, dword [ebp - 8]
mov ecx, esi
jle 0x41729f
mov ecx, eax
imul ecx, ecx, 7
xor ebx, ebx
mov edx, 0x8fc3a89c
sub edx, ecx
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, dword [ebp - 0x94]
setle bl
mov dword [ecx], ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 8], eax
je 0x4173ca
mov dword [ebp - 0x14], 0x239f
mov dword [ebp - 8], eax
jmp 0x4173a6
mov dword [ebp - 0x28], 0xf0adc109
mov dword [ebp - 0x20], 0xa0f83931
mov dword [ebp - 4], eax
cmp dword [ebp - 4], esi
jg 0x4173a3
push 2
lea ecx, [ebp - 0x238]
call fcn.004147f5
mov dword [ebp - 0x10], 0
jmp 0x417316
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x238]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x417306
dec dword [ebp - 0x28]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x94]
mov ecx, dword [esi]
sub ecx, eax
xor eax, eax
add ecx, 0xffff
cmp ecx, 0xd1a0c8
setge al
xor ecx, ecx
cmp eax, dword [esi + edx*4]
mov eax, dword [ebp - 0x238]
mov edx, dword [ebp - 4]
setle cl
xor ebx, ebx
cmp dword [esi + edi*4], ecx
setl bl
xor ecx, ecx
mov dword [eax], ebx
mov eax, dword [ebp - 0x14]
cmp ebx, eax
mov eax, dword [ebp - 0x94]
setge cl
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x20], ecx
mov ecx, 0x8e12b6a3
mov dword [eax], ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x238]
call fcn.004148c7
inc dword [ebp - 4]
xor esi, esi
inc esi
cmp dword [ebp - 4], esi
jle 0x4172f0
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x4172d6
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x2a], al
cmp byte [ebp - 0x2a], 0
je 0x41740a
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x41740a
mov dword [ebp - 0xc], 0xfffffffd
mov dword [ebp - 0x14], 0xbda3fa0b
mov eax, dword [ebp - 0xc]
inc eax
imul eax, eax, 0x78c7
cmp dword [ebp - 0xc], eax
jne 0x4173ea
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setne dl
cmp edx, 0x85e3970c
sbb eax, eax
neg eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x94]
mov ecx, 0x51ef224b
mov dword [eax], ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x94]
call fcn.004148c7
cmp byte [ebp - 0x29], 0
je 0x417508
mov dword [ebp - 0xc], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], 0x18c9a01c
mov dword [ebp - 0x10], eax
jmp 0x417455
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x33c], 0xffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x417444
cmp dword [ebp - 0xc], eax
je 0x4174f6
mov dword [ebp - 0x14], 0x209c3997
mov dword [ebp - 0x10], eax
jmp 0x417481
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x13c], 0xd02268f6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x417470
push 3
pop ebx
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x4174d7
mov dword [ebp - 0x10], 0xbdd7770b
mov dword [ebp - 0x14], 0xb8575526
mov dword [ebp - 0x10], eax
jmp 0x4174cd
mov dword [ebp - 0x14], 0xfffffffa
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x4174c7
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
xor eax, eax
dec dword [ebp - 0x14]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x4174a4
dec dword [ebp - 0xc]
jns 0x417491
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x417500
push 0x12ce
push eax
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor eax, eax
jmp 0x417500
mov dword [ebp - 0x14], 0xcc51
inc dword [ebp - 0x14]
push eax
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 4], 0xdb3ae355
mov dword [ebp - 0xc], 0x63d62a04
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x14], 0x5291260e
mov dword [ebp - 4], 0xfffffff2
cmp dword [ebp - 4], 0xd
jle 0x4176b5
xor eax, eax
mov dword [ebp - 8], 0xa473eb90
push 3
mov dword [ebp - 0x14], 0x7006986d
mov dword [ebp - 8], eax
pop edx
jmp 0x41755e
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xd0], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x41754d
mov dword [ebp - 8], eax
jmp 0x417579
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x314], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x417568
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 7
jge 0x417621
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x14], 0x213072c0
mov dword [ebp - 0x20], 0x3d076c56
mov dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 8], eax
je 0x4175dd
mov ecx, dword [ebp - 4]
xor edx, edx
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x14]
sub esi, ecx
mov ecx, dword [ebp - 0x20]
cmp esi, ecx
setle dl
cmp dword [ebp - 0x20], edx
jge 0x4175dd
xor ecx, ecx
lea esi, [ecx + 1]
jmp 0x4175df
mov esi, eax
mov dword [ebp - 0xc], 0x29a2
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x2377
mov ecx, dword [ebp - 4]
setne dl
xor ebx, ebx
cmp edx, esi
push 1
setl bl
xor edx, edx
cmp ebx, ecx
pop esi
setge dl
mov dword [ebp - 0xd0], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 7
jl 0x41758b
mov dword [ebp - 0xc], 0xfffffffe
jmp 0x4176a2
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jmp 0x41767d
cmp dword [ebp - 4], eax
jne 0x417654
mov ecx, dword [ebp - 0xd0]
mov edx, eax
mov ecx, dword [ebp - 0xd0]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xd0]
cmp dword [ebp - 0x14], 8
je 0x417656
mov edx, esi
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setge bl
xor edx, edx
mov dword [ebp + ecx*4 - 0xd0], ebx
mov ecx, dword [ebp - 0x20]
cmp ebx, ecx
setg dl
mov dword [ebp - 0x310], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x417632
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], 0
je 0x41769f
push 0x59
push eax
push 0xe26
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor eax, eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xa
jl 0x41762a
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xd
jg 0x417537
xor eax, eax
mov byte [ebp - 0x2a], al
mov dword [ebp - 0xc], 0xc68ec0ae
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0x3051ebf0
mov dword [ebp - 0x14], 0xb5542afa
mov dword [ebp - 0x28], 0x273d
push 0xfffffffffffffff8
mov dword [ebp - 0x1c], 0x69b7d6b5
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0x19
jmp 0x4177c1
push 2
pop edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], 0x11521faf
mov dword [ebp - 8], 0x3372585f
mov dword [ebp - 4], 0x289aa508
mov dword [ebp - 0x10], eax
jmp 0x417727
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x144], 0x431f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x417716
mov ecx, dword [ebp - 0x140]
mov edx, esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x28]
sub edx, ecx
sub edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x17c7128a
mov ecx, dword [ebp - 0x20]
setl dl
inc dword [ebp - 0x140]
cmp ecx, edx
mov ecx, dword [ebp - 0xc]
mov edx, esi
cmovle edx, eax
xor ebx, ebx
cmp ecx, 0xd76c
mov ecx, dword [ebp - 0xc]
setle bl
sub ebx, edx
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
mov ecx, esi
setle dl
sub ecx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
inc ecx
add ecx, edx
cmp ecx, 0xffffffff
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xfda3
setge dl
sub edx, dword [ebp - 4]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x14], edx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe7
je 0x4176f6
mov byte [ebp - 0x29], al
cmp byte [ebp - 0x29], al
je 0x4177dd
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
cmp byte [ebp - 0x2a], 0
je 0x4177f1
push 0x120d
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
dec dword [ebp - 0x24]
jns 0x416ef9
push 2
pop ebx
push 4
lea ecx, [ebp - 0x220]
call fcn.004147f5
mov dword [ebp - 0xc], 0xa18885c6
mov dword [ebp - 0x10], 0
jmp 0x41782d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x220]
mov dword [eax + ecx*4], 0xb3198a8f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x41781a
mov dword [ebp - 0xc], 0
jmp 0x417851
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x220]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x41783c
lea ecx, [ebp - 0x220]
call fcn.004148c7
mov byte [ebp - 0x29], 0
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x24], 0xb0647dc4
push esi
call fcn.004147f5
mov dword [ebp - 0x20], 0xcff26af9
xor eax, eax
mov dword [ebp - 0x14], 0xd3ed23c5
mov dword [ebp - 4], eax
jmp 0x41789f
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x2ac], 0xfff6
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x41788e
mov dword [ebp - 4], eax
jmp 0x4178bc
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xdc]
mov dword [ecx + edx*4], 0x5132d7af
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x4178a9
mov dword [ebp - 4], eax
jmp 0x4178d7
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x1f0], 0x813bf58a
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x4178c6
cmp dword [ebp - 0x24], eax
jne 0x417905
mov dword [ebp - 0x2a8], 0xfffffffd
mov edx, 0xffff7c62
cmp dword [ebp - 0x24], 0x90611bc3
sbb ecx, ecx
neg ecx
imul ecx, ecx, 9
sub edx, ecx
mov edx, eax
je 0x417907
mov edx, esi
mov ecx, dword [ebp - 0xdc]
mov dword [ecx], edx
cmp dword [ebp - 0x24], eax
je 0x417920
mov ecx, dword [ebp - 0xdc]
cmp dword [ecx], eax
mov ecx, esi
jne 0x417922
mov ecx, eax
cmp ecx, dword [ebp - 0x1e8]
jg 0x417934
mov edx, eax
cmp dword [ebp - 0x1f0], eax
je 0x417936
mov edx, esi
mov ecx, dword [ebp - 0x1ec]
sub edx, ecx
xor ecx, ecx
cmp edx, 5
setl cl
cmp ecx, 0xff15cc7c
je 0x41795a
mov ecx, dword [ebp - 0xdc]
mov edx, eax
cmp dword [ecx], eax
je 0x41795c
mov edx, esi
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, edx
setle cl
sub ecx, 0x271dbcab
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xdc]
dec dword [ebp - 0x14]
call fcn.004148c7
cmp byte [ebp - 0x29], 0
je 0x417a73
mov dword [ebp - 0xc], 0x7ddc85f7
xor eax, eax
mov dword [ebp - 0x14], 0x1b40e11a
mov dword [ebp - 0x20], 0x653ffd03
mov dword [ebp - 0x24], 0x914cc5c6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
jmp 0x417a40
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], 0x364d64ea
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], 0x17a68fa
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], eax
jne 0x417a1f
cmp dword [ebp - 0xc], eax
jne 0x4179d7
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor edx, edx
cmp edx, ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x14], ecx
je 0x4179ec
cmp dword [ebp - 0x14], eax
jne 0x4179ee
mov esi, eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
cmp esi, ecx
sete dl
xor esi, esi
mov dword [ebp - 0x14], edx
inc esi
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0xc]
cmp ecx, esi
setg dl
mov dword [ebp - 0x20], edx
mov edx, eax
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0x20], 0xfffffff7
jle 0x417a21
mov edx, esi
mov ecx, dword [ebp - 0x10]
sub ecx, edx
add ecx, dword [ebp - 0x10]
je 0x417a32
mov ecx, esi
cmp dword [ebp - 0x28], eax
jne 0x417a34
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], ecx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffc
jge 0x4179b0
push 0x1835
push 0x80d
push 0x16f5
push 0x1df4
push 0xe41
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
lea ecx, [ebp - 0x290]
call fcn.004148c7
cmp byte [ebp - 0x15], 0
je 0x4187a9
mov dword [ebp - 0x1c], 0x16df251d
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x14], 0xd383de46
mov dword [ebp - 0xc], 0x37f1
push ebx
call fcn.004147f5
mov dword [ebp - 0x24], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
jmp 0x417ad2
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x1ac], 0xa53d
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x417ac1
mov dword [ebp - 4], eax
jmp 0x417af0
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x88]
mov dword [ecx + edx*4], 0x248e6bae
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x417add
mov dword [ebp - 4], eax
jmp 0x417b08
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x64], 0x764fe605
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x417afa
mov dword [ebp - 4], eax
jmp 0x417b1f
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xe4], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x417b12
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], eax
jl 0x417cb9
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1fc]
mov dword [ebp - 0x28], 0xb017
mov dword [ebp - 0x20], 0x592840cc
push esi
call fcn.004147f5
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x417b67
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1fc]
mov dword [ecx + edx*4], 0xe8236511
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x417b54
cmp dword [ebp - 0x1ac], eax
jne 0x417c6d
mov dword [ebp - 0x14], 0xffffffff
cmp dword [ebp - 0x1c], esi
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, esi
mov ecx, dword [ebp - 0xc]
setl bl
sub ebx, 0xfffffff9
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
mov ecx, dword [ebp - 0x1a4]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setle bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 8]
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x88]
setle bl
xor edx, edx
mov dword [ecx], ebx
lea ecx, [ebx - 1]
cmp ecx, 0x3fa9dfee
mov ecx, dword [ebp - 8]
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x1a8]
setg bl
xor edx, edx
imul ebx, ecx
mov ecx, dword [ebp - 0x28]
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setg dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setge bl
xor edx, edx
cmp ebx, ecx
setne dl
cmp edx, 0x7001
jge 0x417c1a
mov ecx, dword [ebp - 0x88]
cmp dword [ecx], eax
mov ecx, esi
jne 0x417c1c
mov ecx, eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
je 0x417c27
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1fc]
push 0
pop edx
push 2
mov dword [ecx], esi
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
neg ecx
mov ecx, dword [ebp - 8]
sete dl
xor ebx, ebx
cmp edx, ecx
mov ecx, eax
setge bl
sub ebx, dword [ebp - 0xc]
neg ebx
sbb ebx, ebx
add ebx, 0xffff7cf7
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x14], ebx
pop ebx
cmp dword [ebp - 0x14], esi
jne 0x417c6f
mov ecx, esi
mov dword [ebp - 0x64], ecx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x64]
mov dword [ebp - 8], ecx
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], eax
jl 0x417ca2
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x417c9d
push eax
push eax
call edi
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor eax, eax
dec dword [ebp - 8]
jns 0x417c83
lea ecx, [ebp - 0x1fc]
call fcn.004148c7
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x417b30
mov dword [ebp - 8], 0xfffffff3
jmp 0x417d84
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 0x2630673e
mov dword [ebp - 0x10], eax
jmp 0x417ce2
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x3c], 0xc3d2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x417cd4
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], eax
jl 0x417d81
mov dword [ebp - 0x14], 0x12742e7f
mov ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x20]
mov edx, dword [edx + esi*4]
sub edx, ecx
mov ecx, dword [ebp - 0x14]
add ecx, edx
cmp ecx, dword [ebp - 0x24]
jne 0x417d2c
cmp dword [ebp - 0x3c], eax
jne 0x417d2c
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0xe0]
xor edx, edx
cmp ecx, 0x3b720fae
setle dl
xor ebx, ebx
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x88]
cmp dword [ecx + edx*4], eax
sete bl
cmp dword [ebp - 0x1ac], 9
jbe 0x417d5d
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xe0]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
imul ecx, ebx
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0xc]
jns 0x417cf3
xor esi, esi
inc esi
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffb
jle 0x417cc5
lea ecx, [ebp - 0x88]
call fcn.004148c7
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x38], 0x94543beb
mov dword [ebp - 0x10], 0x1d
cmp dword [ebp - 0x10], 0xffffffef
jl 0x417dde
xor eax, eax
mov dword [ebp - 0x14], 0x44696a48
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x417dce
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
xor eax, eax
mov dword [ebp - 0x14], 0x876e6bac
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffef
jge 0x417db2
mov dword [ebp - 0x24], 0xea5d6c05
xor eax, eax
mov dword [ebp - 0x38], 0xffff
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x417e0b
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x31c], 0xf9b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x417dfa
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], eax
jl 0x417e3e
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x417e39
push eax
push eax
push 0x1069
push 0x6ca
call edi
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
xor eax, eax
dec dword [ebp - 0x24]
jns 0x417e19
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], eax
je 0x4181ea
mov edx, 0xfffb
mov dword [ebp - 0xc], 0x1928c176
mov dword [ebp - 0xc], 0x16
jmp 0x417e8b
mov dword [ebp - 0x14], 0x662a2b3b
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x417e7b
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], eax
jne 0x417e91
jmp 0x417e88
mov dword [ebp - 0x20], 0xffffffff
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xd
jne 0x417e5f
push 0xfffffffffffffff8
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], eax
jmp 0x417ea6
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x70], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x417e9c
mov dword [ebp - 0x70], 0xfffffff4
jmp 0x418001
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
jmp 0x417ed1
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0xf0], 0x3eb905d0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x417ec0
mov dword [ebp - 0xc], 2
cmp dword [ebp - 0xc], eax
jl 0x417fe9
mov dword [ebp - 8], 0xd0d3f7bf
mov dword [ebp - 0x28], 0xaa9dade6
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x417f11
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x417fd6
mov dword [ebp - 0x20], 0xa8bc
mov dword [ebp - 0x14], 9
mov ecx, dword [ebp - 0xc]
cmp dword [ebp + ecx*4 - 0xf0], eax
jne 0x417fe0
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
inc dword [ebp - 0x20]
cmp edx, ecx
mov ecx, dword [ebp - 0x6c]
cmovne esi, eax
xor edx, edx
cmp ecx, 2
mov ecx, dword [ebp - 0x70]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0xc]
setne bl
mov ecx, dword [ebp + ecx*4 - 0xf0]
add ecx, ebx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jg 0x417f7a
cmp dword [ebp - 8], eax
jne 0x417f7a
mov edx, eax
jmp 0x417f7f
xor ecx, ecx
lea edx, [ecx + 1]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp + ecx*4 - 0xf0]
add ecx, edx
mov edx, 0xc89d73ae
cmp edx, ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp esi, ecx
mov ecx, dword [ebp - 8]
setne dl
imul edx, dword [ebp + ecx*4 - 0xf0]
test edx, edx
jne 0x417faf
mov ecx, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x28]
xor esi, esi
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
inc esi
cmp ecx, esi
mov ecx, dword [ebp - 0xc]
setl bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0xc]
setge dl
mov dword [ebp + ecx*4 - 0xf0], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x417f19
dec dword [ebp - 0xc]
jns 0x417ee7
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x417ffe
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
xor eax, eax
inc dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0x1a
jne 0x417eb8
mov dword [ebp - 0x1c], eax
jmp 0x4181cf
mov dword [ebp - 4], 0x443250e6
xor ebx, ebx
mov dword [ebp - 0x14], 2
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, dword [ebp - 4]
setne bl
inc ecx
add ecx, ebx
xor edx, edx
imul ecx, dword [ebp - 4]
cmp ecx, 0xbf0b
setl dl
sub edx, dword [ebp - 4]
cmp edx, 0x35ca4204
jg 0x418137
push esi
lea ecx, [ebp - 0x188]
call fcn.004147f5
mov dword [ebp - 0x20], 0x80f885bd
xor eax, eax
mov dword [ebp - 0x14], 0xcfdfe92
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x14], 0x8d36fbc6
mov dword [ebp - 0x10], eax
jmp 0x418094
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x188]
mov dword [ecx + edx*4], 0x12def906
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x418081
mov dword [ebp - 0x20], 0xbdae4f9d
xor ebx, ebx
mov dword [ebp - 0x14], 2
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
cmp edx, ecx
mov ecx, 0xfffb
setle bl
cmp ecx, ebx
mov ecx, dword [ebp - 0x188]
sbb esi, esi
xor edx, edx
inc esi
imul esi, dword [ecx]
mov ecx, dword [ebp - 0x20]
cmp ecx, esi
setg dl
mov dword [ebp - 0x14], edx
xor edx, edx
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp ecx, 0x25e4
setge dl
cmp edx, 0xfff7
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xb3bf
setge dl
neg edx
je 0x418113
mov ecx, dword [ebp - 0x188]
cmp dword [ecx], eax
je 0x418113
xor ecx, ecx
inc ecx
jmp 0x418115
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x418128
push eax
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
lea ecx, [ebp - 0x188]
call fcn.004148c7
xor eax, eax
jmp 0x418177
mov dword [ebp - 0x10], eax
jmp 0x41814d
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x2fc], 0x5c526587
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x41813c
mov dword [ebp - 4], 0xfffffff0
jmp 0x418171
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x2fc], ecx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x26
jle 0x41815c
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 0x48bbca63
mov dword [ebp - 0xc], eax
jmp 0x4181a8
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x4181a0
push 0x1901
push eax
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor eax, eax
cmp dword [ebp - 0xc], eax
jne 0x4181ae
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffffa
jge 0x418189
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x4181c9
push eax
push eax
push 0x131
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
xor eax, eax
dec dword [ebp - 0x1c]
push 1
pop esi
cmp dword [ebp - 0x1c], 0xfffffff0
jg 0x418013
inc dword [ebp - 0x24]
mov edx, 0xfffb
push 1
pop esi
jne 0x417e4f
push 3
pop ebx
push ebx
lea ecx, [ebp - 0x7c]
call fcn.004147f5
push esi
lea ecx, [ebp - 0x214]
call fcn.004147f5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x418219
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x7c]
mov dword [ecx + edx*4], 0x177e
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x418209
push 4
mov dword [ebp - 4], eax
pop edi
jmp 0x418237
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xbc], 0xeef20fe6
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x418226
mov dword [ebp - 4], eax
jmp 0x418254
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x214]
mov dword [ecx + edx*4], 0xfffffffa
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x418241
mov dword [ebp - 0xb8], 2
cmp dword [ebp - 0xb8], eax
jl 0x418508
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
jmp 0x41828f
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x308], 0x1183d964
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x41827e
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x4184f9
push dword [ebp - 0x13c]
movdqa xmm0, xmmword [0xaa6bd0]
lea ecx, [ebp - 0x2d4]
push ecx
lea ecx, [ebp - 0x2e4]
mov dword [ebp - 0xac], eax
push ecx
push eax
lea ecx, [ebp - 0xac]
mov dword [ebp - 0xa8], eax
movdqu xmmword [ebp - 0x2e4], xmm0
mov dword [ebp - 0xa4], eax
call fcn.00416015
push esi
lea ecx, [ebp - 0x170]
call fcn.004147f5
xor eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], eax
jmp 0x41830f
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x170]
mov dword [ecx + edx*4], 0x283019c3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x4182fc
mov ebx, dword [ebp - 0xac]
mov dword [ebp - 0x14], ebx
mov dword [ebx + 8], 2
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jg 0x4184c8
mov ecx, dword [ebp - 0x7c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0x4fb7d476
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0xb0]
mov edx, dword [ebx + 8]
sub edi, ecx
mov ecx, dword [ebp - 0x7c]
neg edi
mov esi, dword [ebp - 0xbc]
sbb edi, edi
inc edi
add edi, dword [ecx + edx*4]
xor edx, edx
mov ecx, dword [ebp - 8]
imul esi, edi
mov edi, dword [ebx + 8]
cmp esi, ecx
mov ecx, dword [ebp - 0x7c]
mov esi, dword [ebp - 0x20]
setl dl
xor ebx, ebx
imul edx, edx, 9
mov ecx, dword [ecx + edi*4]
sub ecx, edx
add ecx, edi
cmp ecx, edi
setge bl
xor edx, edx
add ebx, 0x5cb51404
cmp dword [esi + 4], eax
sete dl
xor ecx, ecx
cmp edx, ebx
setg cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], eax
jne 0x4183bf
cmp dword [ebp - 0xb0], eax
jne 0x4183bf
xor edi, edi
mov edx, eax
inc edi
jmp 0x4183c4
xor edi, edi
inc edi
mov edx, edi
mov ecx, dword [ebp - 0xb8]
add ecx, edx
je 0x4183d5
mov edx, edi
cmp dword [ebp - 0x24], eax
jne 0x4183d7
mov edx, eax
mov ebx, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, dword [ebx + 0xc]
setg cl
xor edx, edx
cmp ecx, dword [ebx + 4]
mov ecx, dword [ebp - 0x170]
setge dl
xor ebx, ebx
mov dword [ecx], edx
mov ecx, dword [ebp - 0xc]
cmp dword [esi + 8], 0xfff7
mov ecx, dword [ebp - 0xc]
setne bl
xor edx, edx
cmp ebx, ecx
mov ebx, dword [ebp - 0x14]
mov ecx, 0xd57638ff
setne dl
cmp ecx, edx
mov ecx, dword [ebp - 0x214]
sbb edx, edx
inc edx
mov dword [ecx], edx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jg 0x4184bb
mov esi, 0xd594398f
mov dword [ebp - 0x10], eax
jmp 0x418448
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x2a4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x418437
mov ecx, dword [ebp - 0x170]
mov dword [ecx], esi
mov dword [ebp - 0x300], esi
mov edx, dword [ebp - 0x2a4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x5d3384f7
setne cl
xor edx, edx
cmp ecx, esi
setle dl
xor ecx, ecx
cmp edx, 0x39ab
setle cl
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebx + 8]
mov ecx, dword [ebp - 0x7c]
cmp dword [ecx + edx*4], eax
jne 0x41849e
test edx, edx
mov edx, eax
je 0x4184a0
mov edx, edi
xor ecx, ecx
cmp edx, 0xafd3
setl cl
mov dword [ebp - 0x10], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x418432
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x418346
dec dword [ebx + 8]
jns 0x418324
lea ecx, [ebp - 0x170]
call fcn.004148c7
lea ecx, [ebp - 0xac]
call fcn.004148c7
dec dword [ebp - 0x1c]
push 0
pop eax
push 1
pop esi
jns 0x4182a4
push 3
pop ebx
dec dword [ebp - 0xb8]
jns 0x41826f
push 4
pop edi
lea ecx, [ebp - 0x214]
call fcn.004148c7
lea ecx, [ebp - 0x7c]
call fcn.004148c7
mov dword [ebp - 0x10], 0xb363f9e9
lea ecx, [ebp - 0x17c]
push edi
call fcn.004147f5
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], 0x6bcfb656
mov dword [ebp - 8], 0
jmp 0x418554
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], 0x7fc0549e
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x418541
mov dword [ebp - 8], 0
jmp 0x418573
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x164], 0x5b689063
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x418562
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x160]
cmp eax, 9
mov eax, dword [ebp - 0x164]
setle cl
xor edx, edx
cmp ecx, 0xffffffff
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x877e
jle 0x4185b2
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x158]
mov edx, dword [ebp - 0x17c]
cmp eax, dword [edx]
setne cl
cmp esi, ecx
lea ecx, [ebp - 0x17c]
sbb eax, eax
inc eax
mov dword [edx + 8], eax
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
call fcn.004148c7
xor eax, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], eax
jmp 0x41866c
mov dword [ebp - 0x14], 0x90069f30
mov dword [ebp - 0x10], eax
jmp 0x418623
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x104], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x418612
mov dword [ebp - 0x104], 0xffffffed
cmp dword [ebp - 0x104], 2
jg 0x418669
mov dword [ebp - 0x20], eax
xor ebx, ebx
push 5
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
cmp ecx, edx
setl bl
mov dword [ebp - 0x14], ebx
inc dword [ebp - 0x104]
cmp dword [ebp - 0x104], 2
jle 0x41863b
push 3
pop ebx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff3
jg 0x418606
mov ecx, dword [ebp + 0x14]
cmp byte [ecx], al
je 0x418683
push eax
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
xor eax, eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x22c]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x14], 0x708bee6d
push ebx
call fcn.004147f5
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4186ad
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x30], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4186a3
mov dword [ebp - 8], eax
jmp 0x4186ca
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x22c]
mov dword [ecx + edx*4], 0xfffffff8
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4186b7
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x4186f2
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x17e9
push 0x257c
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
xor eax, eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], eax
jl 0x418799
mov ecx, dword [ebp - 4]
mov edx, 0xffff77a5
mov ecx, dword [ebp + ecx*4 - 0x30]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x30]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x30]
mov ecx, dword [ebp - 4]
mov esi, dword [ebp + ecx*4 - 0x30]
mov ecx, dword [ebp - 4]
sub edx, ecx
add esi, edx
xor edx, edx
add esi, dword [ebp - 4]
mov ecx, dword [ebp - 0x30]
cmp esi, ecx
setge dl
cmp edx, dword [ebp - 4]
jle 0x418744
cmp dword [ebp - 0x30], eax
je 0x418744
xor ebx, ebx
inc ebx
mov edx, ebx
jmp 0x418749
xor ebx, ebx
mov edx, eax
inc ebx
mov ecx, dword [ebp - 4]
add ecx, edx
je 0x418757
mov edx, ebx
cmp dword [ebp - 4], eax
jne 0x418759
mov edx, eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp + ecx*4 - 0x30]
sub edx, ecx
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov ecx, dword [ebp - 4]
cmp dword [ebp - 4], 0xd9935ff5
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x14]
sub edx, ecx
mov ecx, dword [ebp - 0x30]
sub edx, ecx
mov ecx, dword [ebp - 0x22c]
mov dword [ecx], edx
dec dword [ebp - 4]
jns 0x4186fe
lea ecx, [ebp - 0x22c]
call fcn.004148c7
jmp 0x419636
xor eax, eax
mov dword [ebp - 0xc], 0x5c68ec0a
mov dword [ebp - 0xc], eax
jmp 0x4187d0
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x20], 0x6e5c7a00
cmp dword [ebp - 0x14], eax
jne 0x4187d6
mov dword [ebp - 0x20], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xf
jle 0x4187b7
mov dword [ebp - 0xc], 0xffffffff
xor edx, edx
mov dword [ebp - 8], 0xfffffffd
mov dword [ebp - 0x14], 0x37182abb
mov dword [ebp - 0xc], 0xc520ea0c
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x627f5e24
mov ecx, dword [ebp - 0x14]
setne dl
mov edi, dword [sym.imp.USER32.dll_SetMenu]
xor ebx, ebx
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp ecx, edx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
setg bl
mov dword [ebp - 0x14], ebx
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setne bl
add ecx, ebx
add ecx, dword [ebp - 8]
cmp ecx, 0xfffffffe
sbb ecx, ecx
neg ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xfffffffb
jge 0x418897
mov dword [ebp - 8], eax
jmp 0x41888c
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x418863
push eax
call esi
push eax
call edi
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x418889
push eax
push 0x89c
push 0x22b4
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor eax, eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffeb
je 0x418852
dec dword [ebp - 0xc]
jmp 0x418847
xor eax, eax
mov dword [ebp - 0xc], 0x55b7cefa
inc eax
lea ecx, [ebp - 0x244]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], 0xf8b8ae50
push 4
call fcn.004147f5
mov dword [ebp - 4], 0x53f0d3ec
xor eax, eax
mov dword [ebp - 0x14], 0x5142
mov dword [ebp - 0x10], eax
jmp 0x4188dd
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x244]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x4188cd
mov ecx, dword [ebp - 0xc]
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
cmp edx, ecx
setle bl
sub ebx, dword [ebp - 0xc]
sub ebx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ecx, ebx
mov ecx, dword [ebp - 0x244]
setg dl
xor ebx, ebx
cmp edx, dword [ecx]
mov ecx, dword [ebp - 8]
setne bl
mov dword [ebp - 0x14], ebx
xor ebx, ebx
cmp dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
sete bl
xor edx, edx
cmp ebx, ecx
setne dl
mov dword [ebp - 4], edx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xfffffff4
jge 0x418a61
xor edx, edx
inc edx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x418960
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x108], 0x701832d7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x41894f
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffffa
jge 0x418a4d
mov dword [ebp - 0x10], eax
jmp 0x418988
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x114], 0x83bc1b0f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x418977
mov dword [ebp - 0xc], 0xffffffef
jmp 0x418a1a
mov dword [ebp - 0x14], 8
xor ebx, ebx
mov ecx, dword [ebp - 0x10c]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x114]
mov ecx, dword [ebp - 0x10c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0xbca3
mov ecx, dword [ebp - 0x114]
setne bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x14]
setne dl
xor ebx, ebx
cmp edx, 0x2a4e6309
setg bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x1c]
setge dl
xor ebx, ebx
cmp ecx, edx
setl bl
xor edx, edx
mov dword [ebp - 0x108], ebx
mov ecx, dword [ebp - 0x114]
cmp ecx, ebx
setg dl
xor ecx, ecx
cmp edx, 0x1190
setne cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff2
je 0x41899a
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x418a3d
push 0x1f6c
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindow]
xor eax, eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffa
jl 0x418972
xor edx, edx
inc edx
mov dword [ebp - 0x1c], 0xca307758
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff4
jl 0x418943
lea ecx, [ebp - 0x244]
call fcn.004148c7
xor ebx, ebx
lea ecx, [ebp - 0x26c]
inc ebx
push ebx
call fcn.004147f5
mov dword [ebp - 0x20], 0xf37831e4
lea ecx, [ebp - 0x29c]
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0x2d8cb4c2
push 3
call fcn.004147f5
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], 0
jmp 0x418abf
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x26c]
mov dword [eax + ecx*4], 0xe0cf5720
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x418aac
mov dword [ebp - 8], 0
jmp 0x418ae0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x29c]
mov dword [eax + ecx*4], 0x865425a8
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x418acd
inc dword [ebp - 0x14]
lea ecx, [ebp - 0x29c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
call fcn.004148c7
lea ecx, [ebp - 0x26c]
call fcn.004148c7
mov dword [ebp - 0xc], 0x60477862
lea ecx, [ebp - 0x1b8]
mov dword [ebp - 0x10], 0x70ade216
push ebx
call fcn.004147f5
mov dword [ebp - 0x24], 9
lea ecx, [ebp - 0x1e4]
mov dword [ebp - 0x14], 0xb7a2e255
push 4
call fcn.004147f5
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x418b52
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x284], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x418b41
mov dword [ebp - 4], eax
jmp 0x418b70
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1b8]
mov dword [ecx + edx*4], 0xe0184dcc
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x418b5d
push 2
mov dword [ebp - 4], eax
pop edx
jmp 0x418b8e
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x12c], 0x299fa9ef
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x418b7d
mov dword [ebp - 4], eax
jmp 0x418ba9
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x2c4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x418b98
mov dword [ebp - 4], eax
jmp 0x418bc2
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x1e4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x418bb3
mov dword [ebp - 0xc], 0xffffffe3
jmp 0x418bdf
dec dword [ebp - 0x10]
cmp dword [ebp - 0x280], eax
jne 0x418be5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1a
jle 0x418bd1
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x24]
cmp ecx, 0x97867a7b
mov ecx, dword [ebp - 0xc]
setne dl
xor ebx, ebx
sub edx, ecx
mov dword [ebp - 0x12c], edx
lea ecx, [edx + 1]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp ecx, edx
setge bl
xor ecx, ecx
cmp ebx, 0xe96bb645
setne cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x24]
cmp dword [ebp - 0x14], ecx
setg dl
cmp edx, ecx
jle 0x418c3d
cmp dword [ebp - 0xc], eax
je 0x418c3d
xor ebx, ebx
inc ebx
mov eax, ebx
jmp 0x418c40
xor ebx, ebx
inc ebx
neg eax
jne 0x418c4a
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x12c]
cmp eax, 0x245e3205
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c0], eax
imul ecx, dword [ebp - 0x10], 0xa
mov eax, dword [ebp - 0x1b8]
add ecx, dword [ebp - 0x24]
dec dword [eax]
mov eax, dword [ebp - 0x1b8]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x1e4]
setne dl
xor ecx, ecx
cmp edx, ebx
mov dword [ebp - 0x284], edx
setge cl
mov dword [eax], ecx
lea ecx, [ebp - 0x1e4]
call fcn.004148c7
lea ecx, [ebp - 0x1b8]
call fcn.004148c7
mov dword [ebp - 0x1c], 0x16df251d
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x14], 0xd383de46
mov dword [ebp - 0xc], 0x37f1
push 2
call fcn.004147f5
mov dword [ebp - 0x24], 0xffffffff
xor eax, eax
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 8], ebx
mov dword [ebp - 4], eax
jmp 0x418d03
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x194], 0xa53d
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x418cf2
mov dword [ebp - 4], eax
jmp 0x418d21
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0xa0]
mov dword [ecx + edx*4], 0x248e6bae
inc dword [ebp - 4]
push 2
pop edx
cmp dword [ebp - 4], edx
jl 0x418d0e
mov dword [ebp - 4], eax
jmp 0x418d3c
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0x50], 0x764fe605
inc dword [ebp - 4]
cmp dword [ebp - 4], ebx
jl 0x418d2e
mov dword [ebp - 4], eax
jmp 0x418d53
mov ecx, dword [ebp - 4]
mov dword [ebp + ecx*4 - 0xf8], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x418d46
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
jl 0x418efc
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x250]
mov dword [ebp - 0x28], 0xb017
mov dword [ebp - 0x20], 0x592840cc
push ebx
call fcn.004147f5
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x418d9b
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x250]
mov dword [ecx + edx*4], 0xe8236511
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x418d88
cmp dword [ebp - 0x194], eax
jne 0x418eac
mov dword [ebp - 0x14], 0xffffffff
cmp dword [ebp - 0x1c], ebx
sbb ecx, ecx
xor edx, edx
inc ecx
xor ebx, ebx
inc edx
cmp ecx, edx
mov ecx, dword [ebp - 0xc]
setl bl
sub ebx, 0xfffffff9
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
mov ecx, dword [ebp - 0x18c]
setge dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setle bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 8]
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0xa0]
setle bl
xor edx, edx
mov dword [ecx], ebx
lea ecx, [ebx - 1]
cmp ecx, 0x3fa9dfee
mov ecx, dword [ebp - 8]
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x190]
setg bl
xor edx, edx
imul ebx, ecx
mov ecx, dword [ebp - 0x28]
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setg dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setge bl
xor edx, edx
cmp ebx, ecx
setne dl
cmp edx, 0x7001
jge 0x418e56
mov ecx, dword [ebp - 0xa0]
cmp dword [ecx], eax
je 0x418e56
xor edx, edx
inc edx
mov ecx, edx
jmp 0x418e5b
xor edx, edx
mov ecx, eax
inc edx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], eax
je 0x418e66
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x250]
push 0
mov dword [ecx], edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x24]
neg ecx
pop edx
sbb ecx, ecx
neg ecx
mov ecx, dword [ebp - 8]
sete dl
xor ebx, ebx
cmp edx, ecx
mov ecx, eax
setge bl
sub ebx, dword [ebp - 0xc]
neg ebx
sbb ebx, ebx
add ebx, 0xffff7cf7
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x14], ebx
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x14], ebx
jne 0x418eae
mov ecx, ebx
mov dword [ebp - 0x50], ecx
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 8], ecx
mov dword [ebp - 8], 2
cmp dword [ebp - 8], eax
jl 0x418ee5
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x418ee0
push eax
push eax
call esi
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor eax, eax
dec dword [ebp - 8]
jns 0x418ec6
lea ecx, [ebp - 0x250]
call fcn.004148c7
dec dword [ebp - 0x1c]
push 0
pop eax
jns 0x418d64
mov dword [ebp - 8], 0xfffffff3
jmp 0x418fc7
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x28], 0x2630673e
mov dword [ebp - 0x10], eax
jmp 0x418f25
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x40], 0xc3d2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x418f17
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x418fc4
mov dword [ebp - 0x14], 0x12742e7f
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x14], ecx
mov esi, dword [ebp - 0xc]
mov edx, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x20]
mov edx, dword [edx + esi*4]
sub edx, ecx
mov ecx, dword [ebp - 0x14]
add ecx, edx
cmp ecx, dword [ebp - 0x24]
jne 0x418f6f
cmp dword [ebp - 0x40], eax
jne 0x418f6f
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xf4]
xor edx, edx
cmp ecx, 0x3b720fae
setle dl
xor ebx, ebx
mov dword [ebp - 0x28], edx
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xa0]
cmp dword [ecx + edx*4], eax
sete bl
cmp dword [ebp - 0x194], 9
jbe 0x418fa0
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
imul ecx, ebx
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0xc]
jns 0x418f36
xor ebx, ebx
inc ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffb
jle 0x418f08
lea ecx, [ebp - 0xa0]
call fcn.004148c7
mov dword [ebp - 0xc], ebx
xor eax, eax
mov dword [ebp - 0x20], 0xc7747bb7
mov dword [ebp - 0x14], 0xfffffff9
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffe4
jne 0x41906f
push 0xfffffffffffffff8
pop edi
mov dword [ebp - 0x28], 0xf7bf48c4
xor ebx, ebx
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x28], edi
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
imul ecx, dword [ebp - 0x20], 0xffff
push 0
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
cmp edx, ecx
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
setl bl
cmp ecx, edx
pop ecx
setle cl
sub ecx, ebx
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
imul ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0xc]
jne 0x419058
cmp dword [ebp - 0x20], eax
jne 0x419058
xor ebx, ebx
mov ecx, eax
inc ebx
jmp 0x41905d
xor ebx, ebx
inc ebx
mov ecx, ebx
mov dword [ebp - 0x14], ecx
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe4
je 0x418ffb
mov edi, dword [sym.imp.USER32.dll_SetMenu]
mov dword [ebp - 0x14], 0xd444182b
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x14], 0xf5f996f3
mov dword [ebp - 0x28], 0x24f20479
mov dword [ebp - 0x24], 0xd1dc6b79
mov dword [ebp - 0x20], 0xfdd8fb8c
mov dword [ebp - 8], eax
jmp 0x4190ab
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x2bc], 0x47706695
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x41909a
mov dword [ebp - 8], eax
jmp 0x4190c3
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x260], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4190b6
mov ecx, dword [ebp - 0x20]
mov esi, ebx
inc dword [ebp - 0x20]
cmp ecx, 0x106ec6e5
mov ecx, dword [ebp - 0x25c]
mov ecx, dword [ebp - 0x14]
cmovg esi, eax
mov ecx, dword [ebp - 0x258]
xor edx, edx
cmp ecx, 0xc7e3
setl dl
xor ecx, ecx
cmp esi, edx
setle cl
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x2b8], ecx
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x28]
je 0x41911f
mov esi, ebx
cmp dword [ebp - 0x258], eax
jne 0x419121
mov esi, eax
mov dword [ebp - 0x14], 0x5f5c
xor edx, edx
mov ecx, dword [ebp - 0x258]
cmp esi, ecx
mov ecx, dword [ebp - 0x24]
mov esi, 0xffff3485
setle dl
sub esi, edx
sub esi, ecx
add esi, dword [ebp - 0x14]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], 0xa8eac8b
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x419177
push eax
push 0xa4e
push 0x1f59
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x41918b
mov dword [ebp - 0x14], 0x7dd68876
cmp dword [ebp - 0x14], eax
jne 0x419190
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jg 0x41917c
mov dword [ebp - 0xc], 0xe0648261
mov dword [ebp - 0x10], eax
jmp 0x4191ad
cmp dword [ebp - 0x10], ebx
jl 0x41919c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret