Function at 0x435d57
Capabilities:
Allocate thread local storage
Create pipe
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
push 2
pop edi
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x154]
mov dword [ebp - 8], 0xf782
push edi
mov byte [ebp - 0x35], dl
call fcn.004359e4
mov dword [ebp - 0x2c], 0xfffffffe
xor eax, eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x28], 0x98d72a67
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
jmp 0x435db1
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x154]
mov dword [ecx + edx*4], 0xfc2da8af
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x435d9e
push 1
pop ebx
cmp dword [ebp - 8], eax
jne 0x435e13
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 8]
cmp ecx, 0x8a06
mov ecx, dword [ebp - 0x154]
setge dl
xor ebx, ebx
add edx, 0xffffbfa9
mov dword [ecx + 4], edx
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
setl bl
neg ebx
mov dword [ebp - 0x34], ebx
xor ebx, ebx
cmp edx, ecx
setle bl
sub ebx, dword [ebp - 0x34]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ecx, ebx
sbb ecx, ecx
xor ebx, ebx
inc ecx
inc ebx
cmp ecx, dword [ebp - 8]
mov ecx, eax
jle 0x435e15
mov ecx, ebx
mov eax, dword [ebp - 8]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 8]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x154]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x1c]
call fcn.00435ab6
push ebx
lea ecx, [ebp - 0x70]
call fcn.004359e4
mov dword [ebp - 8], 0x4896
xor eax, eax
mov dword [ebp - 0x14], 0x6928694a
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x435e75
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x70]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x435e68
inc dword [ebp - 8]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], eax
jg 0x435f9c
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x130]
push edi
call fcn.004359e4
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x435eae
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x130]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x435e9f
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x70]
cmp dword [edx + ecx*4], eax
jne 0x435eee
cmp dword [edx], 0xd683
jle 0x435ed3
mov edx, dword [ebp - 8]
mov esi, ebx
mov ecx, dword [ebp - 0x70]
cmp dword [ecx + edx*4], eax
jne 0x435ed5
mov esi, eax
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov edx, dword [ebp - 0x70]
cmp esi, dword [edx + ecx*4]
setl bl
cmp ebx, dword [edx]
je 0x435eeb
mov ecx, eax
jmp 0x435ef0
xor ebx, ebx
inc ebx
mov ecx, ebx
mov dword [ebp - 0x2c], ecx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x130]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp dword [esi + 4], ecx
mov ecx, dword [ebp - 0x70]
setg dl
xor ebx, ebx
add edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x70]
cmp dword [edx + esi*4], ecx
setle bl
sub ebx, 0x96a9
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 8]
mov edx, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x2c]
cmp ecx, dword [edx + esi*4]
mov ecx, dword [ebp - 0x70]
setne bl
mov ecx, dword [ecx + edi*4]
sub ecx, ebx
je 0x435f73
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x435f7d
push eax
push 0x1e00
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x435f7d
mov dword [ebp - 0x2c], 0x9757a83
dec dword [ebp - 0x2c]
lea ecx, [ebp - 0x130]
call fcn.00435ab6
inc dword [ebp - 8]
xor eax, eax
push 1
pop ebx
push 2
pop edi
cmp dword [ebp - 8], eax
jle 0x435e89
lea ecx, [ebp - 0x70]
call fcn.00435ab6
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa2aa0]
lea ecx, [ebp - 0x1c0]
push ecx
xor eax, eax
lea ecx, [ebp - 0x1d0]
push ecx
push eax
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], eax
movdqu xmmword [ebp - 0x1d0], xmm0
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
call fcn.00435b27
mov esi, dword [ebp - 0xcc]
xor eax, eax
mov dword [ebp - 0x2c], 0x23498e64
mov dword [ebp - 0x34], 0xacff8ee1
mov dword [esi + 4], 0xfffffff2
mov dword [ebp - 0x14], 0xffffffff
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x43601b
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [esi + 4]
sub edx, ecx
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, dword [ebp - 0x2c]
imul ecx, dword [esi + 8]
cmp ecx, 0x7e7308f4
setle dl
mov dword [ebp - 0x14], edx
mov ecx, dword [ebp - 0x14]
add ecx, 0x2828ee19
dec dword [esi + 4]
cmp dword [esi + 4], 0xffffffe6
mov dword [ebp - 0x34], ecx
jge 0x436002
lea ecx, [ebp - 0xcc]
call fcn.00435ab6
xor eax, eax
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x43607a
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x20c], 0x3b91
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x436069
mov dword [ebp - 0x18], eax
jmp 0x43612e
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], eax
jmp 0x4360a1
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x190], 0xd434678d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x436090
mov ecx, dword [ebp - 0x18]
cmp dword [ebp + ecx*4 - 0x20c], eax
jne 0x436137
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], edi
jg 0x43612b
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa2ad0]
lea ecx, [ebp - 0x1d0]
push ecx
lea ecx, [ebp - 0x1e0]
mov dword [ebp - 0xf4], eax
push ecx
push eax
lea ecx, [ebp - 0xf4]
mov dword [ebp - 0xf0], eax
movdqu xmmword [ebp - 0x1e0], xmm0
mov dword [ebp - 0xec], eax
call fcn.00435b27
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x43610f
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
inc dword [ebp - 0x190]
lea ecx, [ebp - 0xf4]
call fcn.00435ab6
inc dword [ebp - 0x10]
push 0
pop eax
cmp dword [ebp - 0x10], edi
jle 0x4360bf
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x436088
mov esi, dword [0x4b05ec]
mov dword [ebp - 0x20], 0x9714
dec dword [ebp - 0x20]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], 0x13
jmp 0x43617c
cmp dword [ebp - 0x20], eax
jne 0x436182
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x436179
push 0x1db0
push eax
push 0x8c9
push 0x2a9
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
xor eax, eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x26
jle 0x436153
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0x7bf0b96c
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x14], 9
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], eax
call fcn.004359e4
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x4361ca
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c0]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x4361bb
inc dword [ebp - 0x1c]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x18], eax
je 0x43624b
mov dword [ebp - 0x10], 0x315362da
xor ebx, ebx
mov dword [ebp - 0x14], 0xfa32a17d
mov dword [ebp - 0x14], 0x37c1
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x14]
add esi, dword [ebp - 0x10]
imul esi, dword [ebp - 0x10]
imul esi, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
cmp ecx, edx
setne bl
cmp ebx, esi
jg 0x436221
cmp dword [ebp - 0x14], eax
je 0x436221
xor edx, edx
inc edx
jmp 0x436223
mov edx, eax
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edx, eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
setg cl
mov esi, dword [ebp - 0x2c]
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x14], ecx
jmp 0x43627b
mov dword [ebp - 0x20], eax
jmp 0x43625d
mov dword [ebp - 0x14], 0x9dbc9b78
mov ecx, dword [ebp - 0x20]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], eax
jle 0x436250
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x43627b
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
lea ecx, [ebp - 0x1c0]
call fcn.00435ab6
cmp byte [ebp - 0x35], 0
je 0x43647e
cmp esi, 1
jne 0x43647e
mov dword [ebp - 0x18], 4
xor eax, eax
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x14], 0x6c2e7ccc
mov dword [ebp - 0x40], 0x2f3ccd24
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x4362d4
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
xor eax, eax
cmp dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
jne 0x4362e8
cmp dword [ebp - 0x34], eax
jne 0x4362e8
xor esi, esi
mov edx, eax
inc esi
jmp 0x4362ed
xor esi, esi
inc esi
mov edx, esi
xor ecx, ecx
cmp edx, 0xfffffffd
push 4
setge cl
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x40], 0xf923561c
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 8], 0x457102d1
mov dword [ebp - 0x14], 0xffffffff
pop edx
mov dword [ebp - 0x14], 7
mov dword [edi + 8], edx
cmp dword [ebp - 0x1c], eax
je 0x436362
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x436475
push eax
push 0x1bce
push 0x1b49
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x436475
mov dword [ebp - 8], eax
jmp 0x436378
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xd4], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x436367
mov dword [ebp - 8], eax
jmp 0x436394
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1a8], 0xf20920a6
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x436383
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4363ab
push eax
call dword [sym.imp.USER32.dll_CreateIconIndirect]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x43646c
mov dword [ebp - 0x1c], 0x520ea0c8
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp + ecx*4 - 0xd4]
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0xd4], esi
mov ecx, dword [ebp - 0x1a4]
cmp ecx, 1
mov ecx, dword [ebp - 0x1c]
setl dl
cmp edx, 3
sbb edx, edx
xor ebx, ebx
inc edx
imul ecx, edx
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cmp ecx, edx
setne bl
sub ebx, 0x89a5
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
add ebx, esi
imul ebx, dword [ebp - 0x1a4]
cmp ebx, 0xfbb9
setge cl
add ecx, 0xfffb
jne 0x436435
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0xd4], eax
jne 0x436435
xor esi, esi
inc esi
mov ecx, esi
jmp 0x43643a
xor esi, esi
mov ecx, eax
inc esi
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1a4], ecx
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x436469
push eax
push 0x21ce
push 0x8db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor eax, eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x4363b3
mov dword [edi + 0xc], 0x4b05ec
jmp 0x436481
xor esi, esi
inc esi
mov dword [ebp - 8], esi
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x14], 9
push 3
call fcn.004359e4
mov dword [ebp - 0x28], 0xfffffff9
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 0x9a1f
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x28], 0x93f07ca
mov dword [ebp - 0x10], eax
jmp 0x4364d1
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x148]
mov dword [ecx + edx*4], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x4364be
mov dword [ebp - 0x10], 0x5459eeda
mov dword [ebp - 0x18], 0xffff
mov dword [ebp - 0x10], eax
jmp 0x4364f4
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x48], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4364ea
mov dword [ebp - 8], eax
mov edi, 0xfff6
jmp 0x436679
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], 0xfffc
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x10], 3
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x48]
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x48], eax
je 0x436540
mov ecx, esi
cmp dword [ebp - 0x48], eax
jne 0x436542
mov ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
sub ecx, 0x7363
je 0x436553
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], 0xf644accb
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x18]
add edx, ecx
mov ecx, dword [ebp - 8]
cmp edx, ecx
mov ecx, dword [ebp - 0x10]
sete bl
xor edx, edx
add ebx, 0xda73
cmp ecx, ebx
mov ecx, dword [ebp - 8]
setle dl
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x48]
cmp ecx, edx
setl bl
sub ebx, 0x5a27557b
add ebx, dword [ebp - 8]
neg ebx
sbb ebx, ebx
inc ebx
mov dword [ebp - 0x14], ebx
mov ecx, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
je 0x436631
mov ecx, dword [ebp - 8]
xor edx, edx
mov esi, dword [ebp + ecx*4 - 0x48]
mov ecx, dword [ebp - 0x10]
cmp ecx, 0x1ede
setle dl
sub esi, edx
mov edx, 0xffff0008
mov dword [ebp - 0x10], esi
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
sub edx, ecx
jne 0x4365e7
cmp dword [ebp - 0x18], eax
jne 0x4365e7
mov esi, eax
jmp 0x4365ea
xor esi, esi
inc esi
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x48]
cmp esi, ecx
mov ecx, dword [ebp - 0x20]
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x148]
setge bl
mov dword [ecx + 4], ebx
mov dword [ebp - 0x10], ebx
mov esi, dword [ebp - 0x10]
sub esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x48]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, dword [ebp - 8]
setl dl
add ecx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
neg esi
sbb esi, esi
xor edx, edx
neg esi
sub esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x18]
cmp esi, ecx
setne dl
add edx, dword [ebp - 0x44]
mov dword [ebp - 0x10], edx
mov ecx, dword [ebp - 0x10]
sub ecx, 0xf466
cmp edi, ecx
mov ecx, dword [ebp - 8]
sbb esi, esi
xor edx, edx
neg esi
sub esi, dword [ebp + ecx*4 - 0x48]
mov ecx, dword [ebp - 8]
cmp esi, ecx
setg dl
xor esi, esi
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x14], edx
inc dword [ebp - 8]
inc esi
cmp dword [ebp - 8], esi
jle 0x436507
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x436690
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea ecx, [ebp - 0x148]
call fcn.00435ab6
mov edi, dword [ebp - 0x30]
cmp edi, dword [ebp - 0x2c]
jge 0x43735c
mov ebx, 0x4b05f0
mov dword [ebp - 8], 5
push esi
lea ecx, [ebp - 0x17c]
mov dword [ebp - 0x20], ebx
call fcn.004359e4
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa2ae0]
lea ecx, [ebp - 0x1f0]
push ecx
xor eax, eax
mov dword [ebp - 0x1c], 0x891023f1
lea ecx, [ebp - 0x200]
mov dword [ebp - 0xa8], eax
push ecx
push eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0xa4], eax
movdqu xmmword [ebp - 0x200], xmm0
mov dword [ebp - 0xa0], eax
call fcn.00435b27
xor eax, eax
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x10], eax
jmp 0x436727
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], 0xee973417
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x436714
mov dword [ebp - 8], 4
cmp dword [ebp - 8], 0xffffffe5
je 0x4367c4
mov esi, dword [ebp - 0xa8]
xor ebx, ebx
inc ebx
mov dword [ebp - 0x10], 0x318d5816
xor edx, edx
mov dword [ebp - 0x14], 0x60389a9b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x1c], 0xfffffff6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
cmp eax, ecx
mov dword [esi + 4], ebx
setle dl
mov dword [ebp - 0x10], edx
xor edx, edx
mov eax, dword [ebp - 8]
cmp eax, ebx
setg dl
xor ecx, ecx
imul edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 0x5a12
setle al
add eax, 0xef7d2923
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x34], eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe5
jne 0x436746
xor esi, esi
mov ebx, 0x4b05f0
inc esi
lea ecx, [ebp - 0xa8]
call fcn.00435ab6
lea ecx, [ebp - 0x17c]
call fcn.00435ab6
xor eax, eax
mov dword [ebp - 0x34], eax
test edi, edi
jle 0x436ebc
jmp 0x4367ee
xor esi, esi
xor eax, eax
inc esi
mov dword [ebp - 8], eax
mov dword [ebp - 0x24], 0xbef9f3b0
mov dword [ebp - 0x18], esi
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xa756a336
mov ecx, dword [ebp - 8]
sbb edx, edx
neg edx
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub edx, ecx
mov ecx, 0x4b370f30
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp - 8]
sub ecx, edx
je 0x436920
push 2
mov dword [ebp - 0x1c], 6
mov dword [ebp - 8], eax
pop edx
jmp 0x436848
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x54], 0x36de
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x43683a
mov dword [ebp - 8], eax
jmp 0x43685f
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x184], esi
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x436852
mov dword [ebp - 8], eax
cmp dword [ebp - 8], esi
jg 0x4368e6
mov dword [ebp - 0x1c], 0x955205
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x54]
cmp dword [ebp - 8], eax
je 0x4368a9
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0x54]
mov dword [ebp - 0x1c], esi
mov edx, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x1c]
add edx, ecx
mov ecx, dword [ebp - 0x50]
cmp edx, ecx
mov ecx, dword [ebp - 0x50]
setl bl
xor edx, edx
cmp ebx, esi
setle dl
add ecx, edx
jne 0x4368ab
mov esi, eax
mov ecx, dword [ebp - 8]
neg esi
mov edx, dword [ebp + ecx*4 - 0x54]
xor ecx, ecx
cmp esi, edx
setle cl
xor esi, esi
mov dword [ebp - 0x1c], ecx
inc esi
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x54]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x184], 0xe96bb645
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x43686c
mov ebx, dword [ebp - 0x20]
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4369d8
push 0x115
push 0x2525
push 0x12f6
push 0x198
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
jmp 0x4369d8
push 0xfffffffffffffff7
pop edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x10], eax
jmp 0x43693c
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x90], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x43692b
dec dword [ebp - 0x88]
mov ecx, dword [ebp - 0x88]
je 0x43696f
cmp dword [ebp - 0x88], 0xd43a1e25
jbe 0x43695f
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x88]
mov edx, esi
mov ecx, dword [ebp - 8]
cmp dword [ebp - 8], eax
jne 0x436971
mov edx, eax
xor ecx, ecx
cmp edx, 0x39807108
setl cl
imul ecx, ecx, 0x17b4
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], eax
jmp 0x4369d2
mov dword [ebp - 0x20], eax
jmp 0x4369ca
mov dword [ebp - 0x24], eax
jmp 0x4369c1
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x4369b2
push 0x1169
push eax
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
xor eax, eax
mov ecx, dword [ebp - 0x24]
cmp dword [ebp + ecx*4 - 0x90], eax
jne 0x4369c7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x43699a
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
je 0x436995
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffc
jl 0x436990
mov edi, dword [ebx]
lea ecx, [ebp - 0x1b4]
push 2
mov dword [ebp - 0x28], edi
call fcn.004359e4
xor eax, eax
mov dword [ebp - 0x18], 0xa66fe7d8
mov dword [ebp - 0x10], eax
jmp 0x436a0b
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1b4]
mov dword [ecx + edx*4], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x4369f8
mov dword [ebp - 0x18], eax
jmp 0x436ae6
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x436a40
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
xor eax, eax
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], eax
jl 0x436ae3
push 3
lea ecx, [ebp - 0x118]
call fcn.004359e4
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x436a73
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x118]
mov dword [ecx + edx*4], 0xfc0272a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x436a60
mov esi, dword [ebp - 0x118]
xor ecx, ecx
inc ecx
mov dword [esi + 4], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], eax
jl 0x436ac2
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x436aa2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x436aba
push 0x2096
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor eax, eax
dec dword [ebp - 0x14]
jns 0x436a90
xor ecx, ecx
inc ecx
inc dword [esi + 4]
cmp dword [esi + 4], ecx
jle 0x436a85
lea ecx, [ebp - 0x118]
call fcn.00435ab6
dec dword [ebp - 0x20]
jns 0x436a4c
xor esi, esi
xor eax, eax
inc esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x436a19
lea ecx, [ebp - 0x1b4]
call fcn.00435ab6
add ebx, 4
mov dword [ebp - 0x40], 0xffffffff
xor eax, eax
mov dword [ebp - 0x3c], 9
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], eax
jmp 0x436b22
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x218], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x436b15
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x436b46
push eax
push 0x32
push eax
push 0x164a
push 0x1400
call dword [sym.imp.GDI32.dll_ExtCreatePen]
xor eax, eax
mov ecx, dword [ebp - 0x40]
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa2ab0]
mov esi, dword [ebx]
mov dword [ebp - 0x214], ecx
lea ecx, [ebp - 0x1e0]
push ecx
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x3c], esi
push ecx
push eax
lea ecx, [ebp - 0x9c]
mov dword [ebp - 0x9c], eax
movdqu xmmword [ebp - 0x1f0], xmm0
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
call fcn.00435b27
mov dword [ebp - 0x24], 0x5ccc90a3
xor eax, eax
mov dword [ebp - 0x78], 0xfcc9
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], 0x532d49ac
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x1c], 0x1241a59c
mov dword [ebp - 0x18], 0xe324e816
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jg 0x436dff
xor ecx, ecx
push 3
inc ecx
pop ebx
mov dword [ebp - 0x14], 0x32937a3a
mov dword [ebp - 0x74], 0xfffc
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x436dea
mov dword [ebp - 0x10], 0x6715f0ed
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x10], eax
jmp 0x436db1
mov dword [ebp - 8], 0x98e64e6d
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], eax
jl 0x436d93
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
cmp dword [ebp - 0xe0], eax
je 0x436c61
mov ebx, ecx
cmp dword [ebp - 0x14], eax
jne 0x436c63
mov ebx, eax
mov edi, dword [ebp - 8]
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x9c]
mov esi, dword [ebp - 0x9c]
push 0xfffffffffffffffe
mov ecx, dword [ecx + edx*4]
xor edx, edx
mov dword [esi + edi*4], ecx
cmp ebx, 0x5d7c
mov ecx, dword [ebp - 0x74]
sete dl
xor ebx, ebx
cmp ecx, edx
pop edi
setne bl
imul ebx, dword [ebp - 0x10]
add ebx, dword [ebp - 0x78]
mov dword [ebp - 0x18], ebx
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x78]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setg dl
xor ebx, ebx
mov dword [ebp - 0x1c], edx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
cmp ecx, 0x6f4e
mov ecx, dword [ebp - 0x74]
setl bl
xor edx, edx
cmp ecx, ebx
setne dl
xor ecx, ecx
cmp edx, edi
setge cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x1c]
cmp ecx, edx
setge bl
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x40]
dec esi
neg esi
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [ebp - 8]
mov ecx, dword [ebp - 0xe0]
cmp esi, ecx
mov ecx, dword [ebp - 0x58]
setne dl
xor ebx, ebx
cmp edx, 0xed52
setne bl
xor edx, edx
cmp ebx, ecx
setle dl
cmp edx, dword [ebp - 0xe0]
je 0x436d51
mov dword [ebp - 0x18], eax
jmp 0x436d49
mov dword [ebp - 0x4c], 0xe255
mov dword [ebp - 0x4c], edi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x39
jne 0x436d3c
jmp 0x436d81
mov byte [ebp - 9], al
cmp byte [ebp - 9], cl
je 0x436d81
push eax
push 0xfce
push 0x20f4
push 0x954
push 0x2458
push 0x1a56
push 0x170b
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor eax, eax
mov ecx, dword [ebp - 0x1c]
dec dword [ebp - 8]
push 1
pop ecx
push 3
pop ebx
jns 0x436c3a
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x436dab
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
xor eax, eax
inc dword [ebp - 0x10]
push 1
pop ecx
cmp dword [ebp - 0x10], ebx
jle 0x436c27
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x436dde
push 0x1d9a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor eax, eax
dec dword [ebp - 0x14]
push 1
pop ecx
jns 0x436c11
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x436bd8
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x28]
lea ecx, [ebp - 0x9c]
call fcn.00435ab6
mov dword [ebp - 0x14], 0x41b3c692
lea ecx, [ebp - 0x10c]
push 3
add ebx, 4
call fcn.004359e4
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x436e38
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10c]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x436e28
mov dword [ebp - 0x14], eax
jmp 0x436e8f
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], eax
jmp 0x436e62
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10c]
mov dword [ecx + edx*4], 0xf7fd1e81
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x436e4f
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x436e8c
push 0x1f1b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
je 0x436e43
lea ecx, [ebp - 0x10c]
call fcn.00435ab6
test esi, esi
jne 0x436ea7
add ebx, 8
mov esi, dword [ebp - 0x34]
add ebx, edi
inc esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x34], esi
cmp esi, dword [ebp - 0x30]
jl 0x4367e9
mov dword [ebp - 0x28], 0xdcec
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x58], 0xe31d8329
mov dword [ebp - 0x4c], 0xfffffff8
push 3
call fcn.004359e4
push 4
pop edx
mov dword [ebp - 0x3c], edx
xor eax, eax
mov dword [ebp - 0x1c], 0x711e7bff
mov dword [ebp - 8], edx
mov dword [ebp - 0x3c], 0x7a912e75
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x436f1f
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xb4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x436f07
push 4
pop edx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], eax
je 0x436f83
mov dword [ebp - 0x28], 0xfffffffb
mov ecx, 0xc60edac7
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], 2
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xb4]
cmp ecx, dword [eax + 8]
sbb edx, edx
inc edx
cmp dword [eax + 4], 0xc12a7b09
mov eax, dword [ebp - 0x3c]
sbb esi, esi
xor ecx, ecx
inc esi
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setne cl
add esi, ecx
imul eax, esi
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x1c]
jmp 0x43707d
push 2
pop esi
push esi
lea ecx, [ebp - 0x13c]
call fcn.004359e4
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x436fac
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x13c]
mov dword [ecx + edx*4], 8
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x436f99
mov dword [ebp - 8], eax
jmp 0x436fc7
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x198], 0xf6a1241a
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x436fb6
push 0xfffffffffffffff5
pop edi
mov dword [ebp - 8], edi
cmp dword [ebp - 8], edi
jl 0x437054
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0x124]
call fcn.004359e4
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x437000
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x124]
mov dword [ecx + edx*4], 0xc1543f36
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x436fed
mov ecx, dword [ebp - 0x4c]
xor ebx, ebx
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x13c]
cmp dword [ecx], esi
mov ecx, dword [ebp - 0x124]
setne bl
xor edx, edx
cmp ebx, esi
setle dl
cmp edx, dword [ecx]
jg 0x437036
mov ecx, dword [ebp - 0xb4]
cmp dword [ecx + 8], eax
je 0x437036
mov eax, esi
mov dword [ebp - 0x198], eax
lea ecx, [ebp - 0x124]
call fcn.00435ab6
dec dword [ebp - 8]
cmp dword [ebp - 8], edi
jge 0x436fda
mov ebx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x43706c
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xed832cb8
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x437059
lea ecx, [ebp - 0x13c]
call fcn.00435ab6
lea ecx, [ebp - 0xb4]
call fcn.00435ab6
mov edi, dword [ebx]
xor eax, eax
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x28], 0xaa6e6f7
mov dword [ebp - 0x10], 0xfffffff2
cmp dword [ebp - 0x10], 0xffffffee
jl 0x4370e8
mov dword [ebp - 0x14], eax
jmp 0x4370b9
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0xc0], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x4370ac
mov dword [ebp - 0xb8], eax
jmp 0x4370da
mov dword [ebp - 0x28], 1
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], 9
jg 0x4370c7
dec dword [ebp - 0x10]
jmp 0x4370a1
mov ecx, dword [ebx + 4]
mov dword [ebp - 0x1c], 0x285faafe
mov dword [ebp - 0x14], 0x72d9ee1c
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x10], 0x3ddca272
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
mov dword [ebp - 0x3c], ecx
je 0x437137
push eax
push 0x835
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x14], 0x664a
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
dec dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0xd9ba
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x18]
jl 0x437175
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x18]
add esi, 0x9d29
cmp esi, ecx
setle dl
add ebx, 8
mov dword [ebp - 0x18], edx
xor esi, esi
inc esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x28], 0x5b16
mov dword [ebp - 8], eax
jmp 0x437252
mov dword [ebp - 0x30], 0x55145ccb
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
jmp 0x4371d4
mov ecx, dword [ebp - 0x14]
mov dword [ebp + ecx*4 - 0x100], 0x2285
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x4371c3
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov ecx, dword [ebp - 0x100]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x30], ecx
mov esi, dword [ebp - 0x100]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 8]
imul esi, ecx
mov ecx, dword [ebp - 0x100]
sub edx, esi
cmp edx, ecx
mov ecx, dword [ebp - 8]
setge bl
xor edx, edx
cmp ebx, ecx
sete dl
xor esi, esi
mov dword [ebp - 0x28], edx
inc esi
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], eax
jl 0x43724f
mov dword [ebp - 0x28], 0xf6658d83
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp + ecx*4 - 0x100]
cmp ecx, esi
setne dl
mov dword [ebp - 0x28], edx
dec dword [ebp - 0x24]
jns 0x43722f
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffea
jg 0x4371b4
mov eax, dword [ebp - 0x24]
xor ebx, ebx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
setg bl
xor edx, edx
cmp eax, ecx
setne dl
xor eax, eax
cmp ebx, edx
setge al
cmp dword [ebp - 0x3c], 0
mov dword [ebp - 0x34], eax
jne 0x43735c
cmp byte [ebp - 0x35], 0
je 0x4372a1
cmp dword [ebp - 0x2c], esi
jne 0x4372a1
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [ebp - 0x20]
push edi
mov ecx, dword [eax]
mov dword [ebp - 0x28], ecx
mov ecx, dword [eax + 4]
add eax, 8
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], eax
call fcn.00489a41
mov dword [ebp - 0x30], eax
xor eax, eax
pop ecx
mov dword [ebp - 0xd8], eax
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0xd8]
push eax
push edi
call fcn.0046cf11
mov ebx, dword [ebp - 0x84]
xor ecx, ecx
mov esi, ecx
test edi, edi
jle 0x437338
mov eax, esi
and eax, 0x80000001
jns 0x437302
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
add eax, esi
add eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x3c]
jmp 0x437317
lea eax, [edx + 1]
cdq
idiv edi
cmp word [ebx + edx*2], cx
jne 0x437314
xor eax, eax
inc eax
mov word [ebx + edx*2], ax
mov eax, dword [ebp - 0x20]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x30]
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x4372f4
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [ecx], edi
mov dword [ecx + 4], eax
test ebx, ebx
je 0x43735c
push ebx
call fcn.0048af36
xor eax, eax
pop ecx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
xor edi, edi
lea ecx, [ebp - 0x64]
inc edi
push edi
call fcn.004359e4
mov dword [ebp - 8], 0x4896
xor eax, eax
mov dword [ebp - 0x2c], 0x6928694a
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x14], eax
jmp 0x437391
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x64]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x437384
inc dword [ebp - 8]
mov dword [ebp - 8], eax
jmp 0x4374a5
mov dword [ebp - 0x30], edi
lea ecx, [ebp - 0x160]
push 2
call fcn.004359e4
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4373c7
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x160]
mov dword [ecx + edx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x4373b8
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x64]
cmp dword [edx + ecx*4], eax
jne 0x437403
cmp dword [edx], 0xd683
jle 0x4373ed
mov edx, dword [ebp - 8]
mov esi, edi
mov ecx, dword [ebp - 0x64]
cmp dword [ecx + edx*4], eax
jne 0x4373ef
mov esi, eax
mov ecx, dword [ebp - 8]
xor ebx, ebx
mov edx, dword [ebp - 0x64]
cmp esi, dword [edx + ecx*4]
mov ecx, eax
setl bl
cmp ebx, dword [edx]
jne 0x437405
mov ecx, edi
mov dword [ebp - 0x30], ecx
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov esi, dword [ebp - 0x160]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp dword [esi + 4], ecx
mov ecx, dword [ebp - 0x64]
setg dl
xor ebx, ebx
add edx, dword [ecx]
mov dword [ebp - 0x2c], edx
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x64]
cmp dword [edx + esi*4], ecx
setle bl
sub ebx, 0x96a9
mov dword [ebp - 0x30], ebx
xor ebx, ebx
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 8]
mov edx, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [edx + esi*4]
mov ecx, dword [ebp - 0x64]
setne bl
mov ecx, dword [ecx + edi*4]
sub ecx, ebx
je 0x437488
mov byte [ebp - 9], al
cmp byte [ebp - 9], al
je 0x437492
push eax
push 0x1e00
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x437492
mov dword [ebp - 0x30], 0x9757a83
dec dword [ebp - 0x30]
lea ecx, [ebp - 0x160]
call fcn.00435ab6
inc dword [ebp - 8]
xor eax, eax
push 1
pop edi
cmp dword [ebp - 8], eax
jle 0x4373a1
lea ecx, [ebp - 0x64]
call fcn.00435ab6
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret