Function at 0x431727
Capabilities:
Compare security identifiers
Query environment variable
Resolve function by parsing pe exports
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2a0
and dword [esp + 0x88], 0
push esi
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x1b4]
push edi
mov dword [esp + 0xc], 0x48af
mov dword [esp + 0x28], 0xb8b78acc
mov dword [esp + 0x24], 0x642e40c1
push 3
mov dword [esp + 0x38], edx
call fcn.0040809e
xor eax, eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], eax
jmp 0x43178e
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1b8]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x43177b
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
xor ecx, ecx
sub edx, dword [esp + 0xc]
imul edx, dword [esp + 0xc]
push 0
sub edx, 0xf628
cmp edx, 0x7e78
setl cl
mov dword [esp + 0x2c], ecx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
pop ecx
setne cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x20], ecx
mov ecx, 0xfafd11d9
push 2
setg dl
sub ecx, edx
sub ecx, dword [esp + 0x28]
pop edi
sub ecx, edi
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0xc]
jne 0x4317fb
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], 0x2da3c3d2
cmp dword [esp + 0x28], eax
je 0x431821
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x43183e
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x43183e
mov dword [esp + 0x24], eax
jmp 0x431837
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0xc5c6a3f1
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x14
jne 0x431827
lea ecx, [esp + 0x1b8]
call fcn.00408170
xor esi, esi
lea ecx, [esp + 0x1e0]
inc esi
push esi
call fcn.0040809e
mov dword [esp + 0xc], 0xfffffff6
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], 0x3a266d21
mov dword [esp + 0x24], 0x3bd65256
push 5
pop ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], 0xc173
mov dword [esp + 0x10], eax
jmp 0x4318a7
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1e0]
mov dword [ecx + edx*4], 0xa5d6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x431891
mov dword [esp + 0x10], eax
jmp 0x4318c3
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x5c], 0x1d14cd49
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4318b3
mov dword [esp + 0xc], eax
jmp 0x431912
mov dword [esp + 0x10], 0xede0b407
mov dword [esp + 0x10], eax
jmp 0x431908
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], eax
jmp 0x4318fe
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x4318fa
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
xor eax, eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x4318e7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x4318dd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], eax
jle 0x4318cf
mov ecx, dword [esp + 0x2c]
xor edx, edx
dec dword [esp + 0x2c]
mov ecx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x5c]
cmp ecx, edi
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x60]
setl dl
add esi, edx
xor edx, edx
cmp esi, ecx
setne dl
mov dword [esp + 0x60], edx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x14], 0xfffffff8
je 0x43196b
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x1e0]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
call fcn.00408170
mov eax, dword [0xa6e258]
xor esi, esi
inc esi
test al, 1
jne 0x431a27
or eax, esi
mov dword [0xa6e258], eax
xor eax, eax
push eax
push eax
mov dword [0xa6e280], eax
mov dword [0xa6e284], eax
call fcn.00434073
mov ecx, eax
mov dword [0xa6e29c], 0x3f800000
mov dword [0xa6e280], ecx
xor eax, eax
mov dword [esp + 0xd0], ecx
lea ecx, [esp + 0xd0]
push ecx
push 0x10
push eax
mov dword [0xa6e288], eax
mov ecx, 0xa6e288
mov dword [0xa6e290], eax
mov dword [0xa6e28c], eax
lea eax, [esp + 0xd8]
push eax
call fcn.00433e18
push 0x47a46a
mov dword [0xa6e294], 7
mov dword [0xa6e298], 8
call fcn.0046e0b0
pop ecx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor eax, eax
mov dword [esp + 0xc], 0x4a8c6a53
mov dword [esp + 0xc], eax
jmp 0x431ae5
mov dword [esp + 0x24], 0x2a1836cc
mov dword [esp + 0x1c], eax
jmp 0x431a61
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x268], 0x4288a137
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x431a4e
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x431a7d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCommState]
xor eax, eax
mov dword [esp + 0x24], eax
jmp 0x431adb
mov dword [esp + 0x1c], eax
jmp 0x431a9c
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x18c], 0xb283066c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x431a89
mov dword [esp + 0x198], esi
cmp dword [esp + 0x198], eax
jl 0x431ad7
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x431ace
push 0x147f
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
xor eax, eax
dec dword [esp + 0x198]
jns 0x431ab3
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jle 0x431a83
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x12
jg 0x431a40
imul eax, dword [esp + 0x48], 0x2710
lea ecx, [esp + 0x164]
push esi
add eax, dword [esp + 0x38]
mov dword [esp + 0x74], eax
call fcn.0040809e
mov dword [esp + 0x24], 0xffffffff
xor eax, eax
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0xa9d01274
mov dword [esp + 0x10], eax
jmp 0x431b3f
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x164]
mov dword [ecx + edx*4], 0x2799
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x431b29
mov dword [esp + 0x10], eax
jmp 0x431b5e
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x144], 0x2fa4ad74
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x431b4b
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], eax
jl 0x431ccf
push dword [esp + 0xcc]
movdqa xmm0, xmmword [0xa6be90]
lea ecx, [esp + 0x248]
push ecx
lea ecx, [esp + 0x23c]
mov dword [esp + 0x20], 0xfffffff8
push ecx
mov dword [esp + 0x24], 0x14173bf3
lea ecx, [esp + 0x138]
mov dword [esp + 0x28], 0xa50b5f0b
push eax
movdqu xmmword [esp + 0x244], xmm0
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], eax
call fcn.00408ca2
xor eax, eax
mov dword [esp + 0x20], 0xbdf607db
mov dword [esp + 0x1c], eax
jmp 0x431bf4
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x80], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x431be5
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x164]
mov edx, dword [esp + 0x14]
mov ecx, dword [ecx + esi*4]
inc dword [esp + 0x14]
cmp ecx, edx
jg 0x431c19
xor esi, esi
inc esi
jmp 0x431c1b
mov esi, eax
mov ecx, dword [esp + 0x24]
xor edx, edx
cmp esi, ecx
setle dl
imul ecx, edx, 0x6d56
test ecx, ecx
je 0x431c54
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x431c5c
push 0x1b5
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
xor eax, eax
jmp 0x431c5c
mov dword [esp + 0x1c], 0xa4e63097
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], eax
jl 0x431cb3
mov dword [esp + 0xc], 0xffffffff
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x80]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x80]
mov ecx, dword [esp + 0x144]
cmp dword [esp + 0x144], eax
jne 0x431ca6
cmp dword [esp + 0xc], eax
jne 0x431ca6
mov ecx, eax
jmp 0x431ca9
xor ecx, ecx
inc ecx
mov dword [esp + 0xc], ecx
dec dword [esp + 0x1c]
jns 0x431c66
lea ecx, [esp + 0x12c]
call fcn.00408170
dec dword [esp + 0x24]
push 0
pop eax
push 1
pop esi
jns 0x431b73
lea ecx, [esp + 0x164]
call fcn.00408170
lea eax, [esp + 0x70]
push eax
call fcn.0043369d
mov eax, dword [eax]
test eax, eax
je 0x431f64
mov dword [esp + 0x24], 0x24a8c6a5
lea ecx, [esp + 0x138]
mov dword [esp + 0xc], 0x29aa810d
mov dword [esp + 0x2c], 6
mov dword [esp + 0x1c], 0x7f8b4dfe
mov dword [esp + 0x28], 0xe3f9150f
mov dword [esp + 0x14], 0x9740826f
push 2
mov dword [esp + 0x98], eax
call fcn.0040809e
mov dword [esp + 0x18], 0x697
xor eax, eax
mov dword [esp + 0x20], 0xf3b720fa
mov dword [esp + 0x10], eax
jmp 0x431d5f
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x19c], 0x5ee56e31
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x431d4c
mov dword [esp + 0x10], eax
jmp 0x431d82
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x138]
mov dword [ecx + edx*4], 0x4bf7a832
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x431d6c
mov dword [esp + 0x10], eax
jmp 0x431d9e
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xe8], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x431d8f
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 0x17
jne 0x431ed6
mov edi, dword [esp + 0x138]
mov dword [esp + 0x10], 0xb283066c
mov dword [esp + 0x34], 5
mov dword [esp + 0x30], 0xa3187110
mov dword [esp + 0x38], 0xfffffff9
mov dword [esp + 0x38], 0x8f1edd1e
mov dword [esp + 0x28], 3
mov dword [esp + 0x1c], eax
jmp 0x431dff
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x1d8], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x431df0
dec dword [esp + 0x28]
je 0x431e45
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x1d8]
neg edx
mov ecx, dword [esp + 0x1a4]
sbb edx, edx
neg edx
add ecx, edx
xor edx, edx
cmp ecx, 0xfffffffe
mov dword [esp + 0x1a0], ecx
mov ecx, esi
setge dl
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x2c], 0xb323fa9d
jne 0x431e47
mov ecx, eax
mov dword [esp + 0x1c], ecx
mov esi, dword [esp + 0x1c]
sub esi, 9
neg esi
push 0
sbb esi, esi
xor edx, edx
inc esi
add esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
cmp esi, ecx
setl dl
mov dword [esp + 0x2c], edx
xor edx, edx
mov ecx, dword [esp + 0x2c]
cmp ecx, 0xffffffff
mov ecx, dword [esp + 0x34]
setl dl
cmp edx, ecx
pop ecx
setge cl
xor edx, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x34]
cmp ecx, dword [esp + 0x30]
setge dl
sub edx, dword [esp + 0x38]
mov dword [esp + 0xc], edx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
inc dword [esp + 0x10]
cmp edx, ecx
je 0x431eb0
xor esi, esi
inc esi
jmp 0x431eb2
mov esi, eax
mov ecx, dword [esp + 0x14]
xor edx, edx
cmp esi, ecx
push 1
setg dl
sub edx, dword [esp + 0x28]
mov dword [edi + 4], edx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x17
pop esi
je 0x431dba
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x138]
mov dword [ecx + 4], esi
mov ecx, dword [esp + 0xc]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [esp + 0x28]
test ecx, ecx
jne 0x431efd
cmp dword [esp + 0x14], eax
je 0x431eff
mov eax, esi
xor ecx, ecx
cmp eax, 0x295d0c5f
mov eax, dword [esp + 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x19c]
mov ecx, dword [esp + 0x20]
sub ecx, eax
mov eax, dword [esp + 0x20]
add eax, ecx
lea ecx, [esp + 0x138]
mov dword [esp + 0x1a4], eax
mov dword [esp + 0xe8], eax
jmp 0x43350a
mov dword [esp + 0xc], esi
xor eax, eax
mov dword [esp + 0x20], 0xffff
mov dword [esp + 0x30], esi
mov dword [esp + 0x10], eax
jmp 0x431f8c
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x54], 0xfffffffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x431f7c
mov dword [esp + 0x10], eax
jmp 0x431fac
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xc4], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x431f99
cmp dword [esp + 0xc], eax
je 0x431fde
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x432079
push 0x262e
push eax
push 0x14da
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor eax, eax
jmp 0x432079
mov dword [esp + 0x18], eax
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x431fff
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x432073
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + ecx*4 + 0x54]
cmp ecx, 0xfffffff7
setle dl
sub edx, dword [esp + 0x18]
je 0x43201f
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
push 0
mov ecx, dword [esp + ecx*4 + 0x58]
mov ecx, dword [esp + 0x5c]
add ecx, dword [esp + 0x24]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + ecx*4 + 0x58]
mov ecx, dword [esp + 0x34]
cmp ecx, edx
pop ecx
setne cl
xor edx, edx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + ecx*4 + 0x54]
cmp ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0xc]
setle dl
xor esi, esi
imul edx, dword [esp + ecx*4 + 0x54]
mov dword [esp + 0xc4], edx
inc dword [esp + 0xc]
inc esi
cmp dword [esp + 0xc], esi
jle 0x432005
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x4320a1
push eax
push 0x23b3
push 0x1f47
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
xor eax, eax
mov ecx, dword [0xa6e258]
test cl, 2
jne 0x432130
push eax
or ecx, 2
mov dword [0xa6e260], eax
push eax
mov dword [0xa6e258], ecx
mov dword [0xa6e264], eax
call fcn.00434073
mov ecx, eax
mov dword [0xa6e27c], 0x3f800000
mov dword [0xa6e260], ecx
xor eax, eax
mov dword [esp + 0xc8], ecx
lea ecx, [esp + 0xc8]
push ecx
push 0x10
push eax
mov dword [0xa6e268], eax
mov ecx, 0xa6e268
mov dword [0xa6e270], eax
mov dword [0xa6e26c], eax
lea eax, [esp + 0x21c]
push eax
call fcn.00433e18
push 0x47a465
mov dword [0xa6e274], 7
mov dword [0xa6e278], 8
call fcn.0046e0b0
pop ecx
mov dword [esp + 0x2c], 4
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x2c]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0xfffffffb
je 0x432218
mov dword [esp + 0x28], 0x948b
mov dword [esp + 0x18], esi
mov dword [esp + 0x38], 0xdc1094d0
mov dword [esp + 0x14], eax
jmp 0x432182
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x250], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x43216f
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x4321a3
push 0x117f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
cmp dword [esp + 0xc], eax
jne 0x4321b7
cmp dword [esp + 0x28], eax
je 0x4321b3
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov edx, esi
sub edx, ecx
je 0x4321c5
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
cmp edx, ecx
push 0
pop ecx
setne cl
xor edx, edx
sub ecx, 0x7b1b0cad
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x18], ecx
push 1
setge dl
imul edx, dword [esp + 0x30]
pop esi
lea ecx, [edx - 0x6a6cfc04]
mov dword [esp + 0x250], ecx
mov dword [esp + 0x38], ecx
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffffb
jne 0x432155
xorps xmm0, xmm0
lea ecx, [esp + 0x1f8]
movdqu xmmword [esp + 0xa4], xmm0
mov dword [esp + 0x1c], 0xffffffff
push esi
call fcn.0040809e
mov dword [esp + 0x18], 0xc42206dd
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], 2
mov dword [esp + 0x18], 0xc59458d8
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0xc], eax
jmp 0x43227b
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1f8]
mov dword [ecx + edx*4], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x432269
mov dword [esp + 0xc], eax
jmp 0x432296
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x1b4], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x432287
mov dword [esp + 0x1c], 0xc
jmp 0x43231a
mov dword [esp + 0x18], esi
mov dword [esp + 0x18], 0xc3a0b8ee
mov dword [esp + 0x18], 0xafcb143e
mov dword [esp + 0x18], 0x9bf9f361
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x18], 5
mov dword [esp + 0x14], eax
jmp 0x4322f3
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0xc0], 0xdfba22e9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x4322e0
dec dword [esp + 0x20]
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x432316
push eax
push 0x1f91
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xa
jl 0x4322a6
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x43233c
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
lea ecx, [esp + 0x1f8]
call fcn.00408170
lea eax, [esp + 0x48]
push eax
call fcn.004336ff
mov esi, dword [eax]
mov eax, 0x170cd509
mov dword [esp + 0xc], 0x91a049fe
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xc], 0xe
cmp dword [esp + 0xc], 0x1d
mov dword [esp + 0x1c], esi
jl 0x43248b
mov eax, 0x65653d42
xor esi, esi
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 0xfffffff4
jmp 0x43246d
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov dword [esp + 0xf0], 3
cmp dword [esp + 0xf0], esi
jl 0x432469
push 1
lea ecx, [esp + 0x118]
call fcn.0040809e
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x43240c
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x114]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x4323fa
mov ecx, dword [esp + 0x114]
mov dword [ecx], 3
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x432442
push 0x10dc
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
xor eax, eax
mov ecx, dword [esp + 0x114]
dec dword [ecx]
jns 0x432420
lea ecx, [esp + 0x114]
call fcn.00408170
dec dword [esp + 0xf0]
jns 0x4323e4
xor esi, esi
mov eax, 0x65653d42
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff6
jle 0x4323b0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x1d
jge 0x43239b
mov esi, dword [esp + 0x1c]
cmp byte [ebp + 0xc], 0
push 9
pop edi
jne 0x43249c
test esi, esi
jne 0x43290c
xor esi, esi
mov dword [esp + 0x20], 0xb903cfcb
inc esi
lea ecx, [esp + 0x14c]
mov dword [esp + 0x28], esi
push 2
call fcn.0040809e
push 3
pop edi
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x158]
mov dword [esp + 0x20], 0xf50e16ff
push edi
call fcn.0040809e
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4324ed
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x44], 0xd7d490c4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4324dd
mov dword [esp + 0x10], eax
jmp 0x432508
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xb4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4324f9
mov dword [esp + 0x10], eax
jmp 0x43252a
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14c]
mov dword [ecx + edx*4], 0x6fc75dfc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x432514
mov dword [esp + 0x10], eax
jmp 0x43254d
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x158]
mov dword [ecx + edx*4], 0x3333
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x432537
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb4]
mov ecx, dword [esp + 0xbc]
mov ecx, dword [esp + 0xbc]
mov ecx, dword [esp + 0xb4]
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0xbc]
cmp dword [esp + 0x44], eax
jne 0x43259f
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
xor edx, edx
mov ecx, dword [esp + 0x14c]
cmp dword [ecx], eax
setge dl
imul edx, dword [ecx + 4]
mov dword [esp + 0x20], edx
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setle dl
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x158]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x158]
call fcn.00408170
lea ecx, [esp + 0x14c]
call fcn.00408170
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x278]
mov ecx, dword [esp + 0x48]
push eax
call fcn.004203f1
mov esi, eax
lea edi, [esp + 0xa8]
pop ecx
push 9
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x18], 0x5cb81eca
mov dword [esp + 0x14], eax
jmp 0x432646
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0xe4], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x432637
inc dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
add ecx, dword [esp + 0xc]
imul ecx, dword [esp + 0xc]
push 0
mov dword [esp + 0xe8], ecx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
pop ecx
setge cl
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
add edx, edi
cmp edx, ecx
mov ecx, dword [esp + 0xc]
push 0
pop edx
setge dl
cmp ecx, edx
push 0
pop ecx
setg cl
xor edx, edx
sub ecx, dword [esp + 0x28]
sub ecx, 0x29de13df
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0xc]
cmp ecx, dword [esp + 0x18]
setle dl
mov dword [esp + 0x18], edx
cmp byte [ebp + 0xc], al
je 0x43286f
cmp dword [esp + 0xac], eax
je 0x43286f
mov dword [esp + 0x10], 0x17059141
mov dword [esp + 0x20], 7
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], eax
jmp 0x4326fd
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1cc], 0x86695cd1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x4326ea
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
push 0
pop ecx
setge cl
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x1cc], eax
je 0x432761
cmp dword [esp + 0x1d0], eax
je 0x432761
xor esi, esi
inc esi
mov ecx, esi
jmp 0x432766
xor esi, esi
mov ecx, eax
inc esi
cmp ecx, 0xfffc
sbb ecx, ecx
inc ecx
cmp ecx, 2
sbb ecx, ecx
neg ecx
cmp ecx, 2
sbb ecx, ecx
neg ecx
mov dword [esp + 0x18], ecx
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x4327a0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
mov eax, dword [esp + 0xb0]
lea ecx, [esp + 0x170]
push esi
mov dword [esp + 0x9c], eax
call fcn.0040809e
mov dword [esp + 0x18], esi
xor eax, eax
mov dword [esp + 0x18], 0xb3921ded
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], esi
mov dword [esp + 0x18], 0x52733582
mov dword [esp + 0x18], 0x4b58e17c
mov dword [esp + 0x18], 0x7e4a9061
mov dword [esp + 0x18], 0xa7c6dd3e
mov dword [esp + 0xc], eax
jmp 0x432811
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x170]
mov dword [ecx + edx*4], 0x48bbca63
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x4327fb
mov dword [esp + 0xc], eax
jmp 0x432830
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x288], 0xc67ee39f
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x43281d
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x43284a
push eax
call dword [sym.imp.USER32.dll_SetCursor]
xor eax, eax
mov ecx, dword [esp + 0x170]
mov dword [ecx], eax
lea ecx, [esp + 0x170]
call fcn.00408170
mov eax, dword [esp + 0xac]
mov dword [esp + 0x9c], eax
xor eax, eax
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x24], 0x57e8
mov dword [esp + 0x20], 0x9c710427
mov dword [esp + 0x28], 0xfffffff7
mov dword [esp + 0x20], 7
mov dword [esp + 0x20], 0xe283bc1b
mov dword [esp + 0x30], 0xfffffff8
mov dword [esp + 0x18], 1
cmp dword [esp + 0x24], edi
jne 0x432913
mov ecx, dword [esp + 0x24]
xor edx, edx
add ecx, dword [esp + 0x24]
mov dword [esp + 0x20], ecx
imul ecx, dword [esp + 0x20], 0x5a59
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
cmp ecx, 0x574b
setl dl
sub edx, dword [esp + 0x30]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [esp + 0x30]
jne 0x432913
xor ecx, ecx
inc ecx
jmp 0x432915
xor eax, eax
jmp 0x432873
mov ecx, eax
mov dword [esp + 0x18], ecx
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x43293a
push eax
push 0x125e
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor eax, eax
test esi, esi
jne 0x432f8b
cmp dword [esp + 0xa4], esi
jle 0x432f8b
push dword [esp + 0xc0]
movdqa xmm0, xmmword [0xa6be90]
lea ecx, [esp + 0x228]
push ecx
lea ecx, [esp + 0x21c]
mov dword [esp + 0x104], eax
push ecx
push eax
lea ecx, [esp + 0x10c]
mov dword [esp + 0x110], eax
movdqu xmmword [esp + 0x224], xmm0
mov dword [esp + 0x114], eax
call fcn.00408ca2
inc esi
xor eax, eax
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0xe871d976
mov dword [esp + 0x18], 0xfe1ca296
mov dword [esp + 0x18], 0x67e307b5
mov dword [esp + 0x18], 0xfffffff6
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x18], 0xd3aeb590
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0xfffe
mov dword [esp + 0x14], eax
jmp 0x4329f5
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x298], 0x95751cfd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x4329e2
inc dword [esp + 0x20]
mov dword [esp + 0x14], eax
jmp 0x432a6a
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x432a41
push 0x24f3
push 0x1f1a
push 0x6c
push 0x106e
push 0x1fce
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
xor eax, eax
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x432a66
push 0xf2e
push 0xa92
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor eax, eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x432a06
lea ecx, [esp + 0xfc]
call fcn.00408170
mov dword [esp + 0x2c], 7
lea ecx, [esp + 0x120]
mov eax, 0xe19f
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0x28], 0xfffffffd
mov dword [esp + 0x20], 0xa97f51ef
push 2
call fcn.0040809e
xor eax, eax
mov dword [esp + 0x18], 7
push 2
mov dword [esp + 0x10], eax
pop edx
jmp 0x432ae3
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x4c], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x432ad7
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], edx
jge 0x432b10
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x120]
mov dword [ecx + edx*4], 0x169ff4ca
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x432af3
mov ecx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x50]
mov ecx, dword [esp + 0x50]
mov ecx, esi
cmp dword [esp + 0xd8], eax
jne 0x432b29
mov ecx, eax
mov eax, dword [esp + 0xe0]
xor edx, edx
imul eax, ecx
sub eax, 3
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x4c]
cmp ecx, eax
mov ecx, dword [esp + 0xd8]
mov eax, dword [esp + 0x120]
setg dl
add ecx, edx
xor edx, edx
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x50]
cmp eax, ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
setle dl
imul ecx, edx
xor edx, edx
cmp eax, ecx
lea ecx, [esp + 0x120]
setl dl
sub edx, dword [esp + 0x50]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x120]
mov dword [eax], esi
mov dword [esp + 0x28], esi
call fcn.00408170
push esi
lea ecx, [esp + 0x78]
call fcn.0040809e
xor eax, eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 0x7f6c
mov dword [esp + 0x38], 0xfffe
mov dword [esp + 0x18], 0xfffffff9
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0xc], eax
jmp 0x432c00
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x74]
mov dword [ecx + edx*4], 0x3fcb50bf
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x432bed
mov dword [esp + 0xc], eax
jmp 0x432c1f
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x25c], 0x50170a2c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x432c0c
mov ecx, dword [esp + 0x74]
xor edx, edx
mov dword [esp + 0x20], esi
mov esi, dword [ecx]
mov ecx, dword [esp + 0x20]
cmp ecx, esi
mov dword [esp + 0xc], esi
setge dl
xor ecx, ecx
cmp esi, edx
setne cl
xor edx, edx
imul ecx, esi
cmp ecx, esi
setl dl
cmp dword [esp + 0xc], edx
jg 0x432d97
mov dword [esp + 0x2c], 0x9a54e587
mov dword [esp + 0x18], 0x69e0cd1a
mov dword [esp + 0x20], 0x7afff16c
mov dword [esp + 0x30], 0x3a43
mov dword [esp + 0x14], eax
jmp 0x432c93
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x17c], 0xeeb3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x432c80
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x9f13
setl dl
sub edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x74]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x18], edx
jne 0x432cc8
cmp dword [ecx], eax
jne 0x432cc8
mov edx, eax
jmp 0x432ccb
xor edx, edx
inc edx
mov ecx, dword [ecx]
add ecx, edx
jne 0x432cdb
cmp dword [esp + 0xc], eax
jne 0x432cdb
mov ecx, eax
jmp 0x432cde
xor ecx, ecx
inc ecx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x74]
mov ecx, dword [ecx]
inc ecx
je 0x432cfa
cmp dword [esp + 0x20], eax
je 0x432cfa
xor esi, esi
inc esi
jmp 0x432cfc
mov esi, eax
mov ecx, dword [esp + 0x74]
xor edx, edx
cmp dword [ecx], esi
mov ecx, dword [esp + 0x188]
setge dl
mov dword [esp + 0x18], edx
xor edx, edx
cmp dword [esp + 0x18], ecx
setne dl
cmp edx, dword [esp + 0x188]
jge 0x432d37
mov ecx, dword [esp + 0x74]
cmp dword [ecx], eax
je 0x432d37
cmp dword [esp + 0x2c], eax
je 0x432d37
mov esi, eax
mov ecx, dword [esp + 0x188]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x74]
push 0
sete dl
cmp edx, dword [ecx]
mov ecx, dword [esp + 0x3c]
pop edx
setl dl
add ecx, 7
add ecx, edx
xor edx, edx
cmp ecx, 1
setg dl
mov dword [esp + 0x18], edx
xor edx, edx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], eax
mov dword [esp + 0x264], 0x770c88f3
mov ecx, dword [esp + 0x180]
cmp ecx, 0x11e6770d
setne dl
mov dword [esp + 0x18], edx
jmp 0x432ddc
mov dword [esp + 0x18], 0xa5dbdfdd
mov dword [esp + 0xc], 0xffffffe6
jmp 0x432dbd
mov dword [esp + 0x38], eax
cmp dword [esp + 0x18], eax
jne 0x432dc4
cmp dword [esp + 0x38], eax
jne 0x432dc4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jge 0x432da9
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x432ddc
push 0x20c8
push eax
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor eax, eax
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x432dee
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
lea ecx, [esp + 0x74]
call fcn.00408170
cmp dword [esp + 0xa8], 0
je 0x432f8b
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 1
mov dword [esp + 0xc], eax
jmp 0x432e35
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x3c], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x432e25
mov dword [esp + 0xc], eax
jmp 0x432e52
mov dword [esp + 0x28], 0xd00585b7
xor esi, esi
mov dword [esp + 0x24], 0x9bacc5d9
mov dword [esp + 0x20], 0xf4326038
mov dword [esp + 0x20], 6
mov dword [esp + 0x18], 0xfffffff8
mov dword [esp + 0x14], esi
jmp 0x432fcb
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x64], 0xfff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x432fbb
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov eax, dword [esp + 0x68]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
add ecx, eax
mov eax, dword [esp + 0x68]
cmp ecx, 0xffff
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, 0x8e56
lea ecx, [esp + 0xa4]
setle dl
sub eax, edx
mov dword [esp + 0x24], eax
call fcn.004217b6
mov dword [esp + 0x10], 0xcff0ea75
mov dword [esp + 0x10], esi
jmp 0x4330e9
push 1
lea ecx, [esp + 0x88]
call fcn.0040809e
mov dword [esp + 0xc], 4
mov dword [esp + 0xc], esi
jmp 0x433091
push dword [esp + 0xc]
lea ecx, [esp + 0x88]
call fcn.0040818c
or dword [eax], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x43307a
mov dword [esp + 0xc], esi
jmp 0x4330b1
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x90], 0xe149cff2
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x43309e
push esi
lea ecx, [esp + 0x88]
call fcn.0040818c
mov dword [eax], 0x108f8256
xor eax, eax
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], eax
jge 0x433143
xor esi, esi
lea ecx, [esp + 0x84]
call fcn.00408170
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xb
je 0x43305e
mov edi, dword [esp + 0x1c]
test edi, edi
je 0x433484
mov dword [esp + 0x18], 0xf75d
lea ecx, [esp + 0x1ec]
mov dword [esp + 0x18], esi
push 2
call fcn.0040809e
push 2
lea ecx, [esp + 0x208]
call fcn.0040809e
mov dword [esp + 0x18], 0x660f7e73
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0xc], esi
jmp 0x433248
xor eax, eax
mov dword [esp + 0x18], 0x6cd8
mov dword [esp + 0x20], edi
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x43316c
push 0x204e
push 0xd8f
call dword [sym.imp.KERNEL32.dll_Beep]
xor eax, eax
push eax
lea ecx, [esp + 0x88]
call fcn.0040818c
mov edi, eax
xor esi, esi
cmp dword [edi], esi
je 0x4331d0
push dword [esp + 0xc]
lea ecx, [esp + 0x88]
call fcn.0040818c
mov ecx, dword [eax]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x84]
push dword [esp + 0xc]
call fcn.0040818c
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
sub edx, ecx
sub edx, eax
xor eax, eax
cmp dword [edi], edx
setge al
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x84]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x90], 7
push dword [esp + 0xc]
call fcn.0040818c
push dword [esp + 0xc]
xor ecx, ecx
cmp dword [eax], 0x2b7d1
setge cl
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x88]
call fcn.0040818c
mov ecx, dword [esp + 0x18]
push 9
pop edi
mov dword [eax], ecx
dec dword [esp + 0xc]
jns 0x433141
jmp 0x4330d9
push dword [esp + 0xc]
lea ecx, [esp + 0x1f0]
call fcn.0040818c
mov dword [eax], 4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x43322e
mov dword [esp + 0xc], esi
jmp 0x433268
push dword [esp + 0xc]
call fcn.0040818c
mov dword [eax], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
lea ecx, [esp + 0x204]
jl 0x433255
inc dword [esp + 0x20]
call fcn.00408170
lea ecx, [esp + 0x1ec]
call fcn.00408170
mov edx, dword [esp + 0x34]
mov ecx, edi
call fcn.0043171d
xor edi, edi
lea ecx, [esp + 0x108]
inc edi
mov esi, eax
mov dword [esp + 0xc], edi
push edi
mov dword [esp + 0x98], esi
call fcn.0040809e
xor eax, eax
mov dword [esp + 0x34], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], edi
jge 0x4332ed
push dword [esp + 0x14]
lea ecx, [esp + 0x10c]
call fcn.0040818c
mov dword [eax], 0xfffffffe
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x4332cb
xor eax, eax
inc dword [esp + 0xc]
mov dword [esp + 0xc], eax
jmp 0x433462
cmp dword [esp + 0xc], eax
jle 0x4332fa
lea eax, [esp + 0x234]
xorps xmm0, xmm0
push eax
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x278]
movdqu xmmword [esp + 0x22c], xmm0
call fcn.0040819e
push ecx
lea ecx, [esp + 0x248]
push dword [eax + 4]
push dword [eax]
call fcn.0040814a
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], 3
cmp dword [esp + 0x2c], 0
jl 0x433503
mov byte [esp + 0xb], 0
cmp byte [esp + 0xb], 0
je 0x4334fd
push 0x104e
push 0xbe3
push 0xf5f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
dec dword [esp + 0x2c]
jns 0x4334d5
lea ecx, [esp + 0x244]
call fcn.00408170
mov eax, dword [ebp + 8]
lea esi, [esp + 0x94]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret