Function at 0x10045e3e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10071546
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x450
push ebx
push esi
push edi
push 3
pop edi
mov esi, edx
mov dword [esp + 0x48], ecx
xor ebx, ebx
mov dword [esp + 0x40], esi
push edi
lea ecx, [esp + 0x138]
mov dword [esp + 0x2c], ebx
call fcn.100301c4
mov dword [esp + 0x24], 0xe2236432
mov dword [esp + 0xc], ebx
jmp 0x10045ea6
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0xb9b55bb2
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10045e90
mov dword [esp + 0x24], 2
cmp dword [esp + 0x24], ebx
jl 0x10045ed7
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10045ed1
push 0x67d
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
dec dword [esp + 0x24]
jns 0x10045eba
cmp dword [esp + 0x134], ebx
je 0x10045f02
push dword [esp + 0x134]
call fcn.10056e57
pop ecx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0xc], 0x19c9214a
mov dword [esp + 0xc], ebx
jmp 0x10045f23
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xc0], 0xe6d058a8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10045f10
mov eax, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc4]
neg eax
sbb eax, eax
neg eax
sub ecx, eax
mov eax, dword [esp + 0xc0]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
sub ecx, edi
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], 0xde9e8436
jbe 0x10045f6c
cmp dword [esp + 0xc4], ebx
je 0x10045f6c
xor eax, eax
inc eax
jmp 0x10045f6e
mov eax, ebx
add eax, 0xfffffff8
cmp eax, dword [esp + 0xc4]
push 0xffffffffffffffff
pop eax
je 0x10045fbd
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
je 0x10045faa
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setl dl
inc eax
cmp eax, edx
jg 0x10045faa
cmp dword [esp + 0xc], ebx
je 0x10045faa
xor ecx, ecx
inc ecx
jmp 0x10045fac
mov ecx, ebx
xor eax, eax
cmp ecx, 0x653ffd03
setle al
mov dword [esp + 0x18], eax
jmp 0x10045fde
mov dword [esp + 0xc], ebx
jmp 0x10045fd7
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10045fd3
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jle 0x10045fc3
mov eax, dword [0x109cd8b0]
test al, 1
jne 0x10046081
or eax, 1
mov dword [0x109cd8b0], eax
push ebx
mov dword [esp + 0x468], ebx
push ebx
mov dword [0x109cd890], ebx
mov dword [0x109cd894], ebx
call fcn.1003bcb1
mov dword [0x109cd890], eax
mov dword [0x109cd898], ebx
mov dword [0x109cd8a0], ebx
mov byte [esp + 0x464], 2
mov ecx, 0x109cd898
mov dword [esp + 0x214], eax
lea eax, [esp + 0x214]
push eax
push 0x10
push ebx
lea eax, [esp + 0x214]
mov dword [0x109cd8ac], 0x3f800000
push eax
mov dword [0x109cd89c], ebx
call fcn.1003ba89
push 8
pop eax
push 0x100719de
mov dword [0x109cd8a4], 7
mov dword [0x109cd8a8], eax
call fcn.10056cc7
or eax, 0xffffffff
pop ecx
mov dword [esp + 0x464], eax
push 2
lea ecx, [esp + 0x80]
call fcn.100301c4
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 2
jge 0x100460b7
or edx, 0xffffffff
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x100460a1
mov dword [esp + 0xc], 1
cmp dword [esp + 0xc], ebx
jl 0x10046149
mov dword [esp + 0x18], 0x79253a34
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x7c]
cmp dword [eax + ecx*4], ebx
je 0x10046109
cmp dword [esp + 0xc], 0xfffffffb
je 0x100460f3
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x7c]
mov eax, dword [ecx + 4]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x7c]
cmp dword [eax + ecx*4], ebx
je 0x10046109
xor eax, eax
inc eax
jmp 0x1004610b
mov eax, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], ebx
jmp 0x1004613c
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10046138
push 0x1042
push 0x223b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetMessageA]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffeb
jg 0x10046115
dec dword [esp + 0xc]
jns 0x100460c9
cmp dword [esp + 0x7c], 0
je 0x1004616c
push dword [esp + 0x7c]
call fcn.10056e57
pop ecx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
imul eax, dword [esp + 0x48], 0x2710
lea ecx, [esp + 0xa8]
movdqa xmm0, xmmword [0x1000efe0]
push 0xfffffffffffffff7
movdqu xmmword [esp + 0x288], xmm0
mov dword [esp + 0xac], ebx
add eax, esi
mov dword [esp + 0xb0], ebx
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x298]
pop esi
push dword [esp + 0x208]
mov dword [esp + 0x24], 0xffff
push eax
lea eax, [esp + 0x28c]
mov dword [esp + 0x2c], 0xfa72c25f
push eax
mov dword [esp + 0x38], esi
mov dword [esp + 0x48], 0xfffffffb
mov dword [esp + 0x40], 0xfffffffe
push ebx
mov dword [esp + 0xc0], ebx
call fcn.100356d8
mov dword [esp + 0x30], 0x68cd5467
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], ebx
jmp 0x10046213
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x23c], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10046200
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x244]
mov eax, dword [esp + 0xa8]
mov dword [eax + 0xc], ecx
dec dword [esp + 0x244]
test ecx, ecx
je 0x1004624f
cmp dword [esp + 0x24], 1
jg 0x1004624f
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x2c], ebx
je 0x1004624f
xor esi, esi
inc esi
jmp 0x10046251
mov esi, ebx
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x30]
add ecx, 0x60be5208
cmp ecx, eax
push 0xfffffffffffffffc
setne dl
sub esi, edx
pop edx
cmp edx, esi
push 8
sbb eax, eax
neg eax
pop esi
cmp esi, eax
sbb eax, eax
neg eax
sub eax, dword [esp + 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
cmp eax, edx
push dword [esp + 0xa8]
setg cl
mov dword [esp + 0x38], ecx
call fcn.10056e57
pop ecx
lea eax, [esp + 0x98]
mov dword [esp + 0xa8], ebx
push eax
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
call fcn.100487f7
mov edi, dword [eax]
mov dword [esp + 0x1c], 6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100462ee
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10046318
push ebx
push 0x22ff
push 0x9e5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
push 2
test edi, edi
je 0x10046abf
lea ecx, [esp + 0x68]
call fcn.100301c4
mov dword [esp + 0xc], 0x9bdba76a
mov dword [esp + 0xc], ebx
jmp 0x1004634c
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], 7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10046339
xor edx, edx
inc edx
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
jl 0x1004640d
mov dword [esp + 0x18], 0x88adae8c
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], ebx
jl 0x10046403
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x64]
mov eax, dword [eax]
sub eax, ecx
cmp eax, edx
je 0x100463a1
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x64]
cmp dword [eax + ecx*4], ebx
mov eax, edx
jne 0x100463a3
mov eax, ebx
cmp eax, edx
mov eax, dword [esp + 0x18]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
cmp ecx, 0x7d926128
jle 0x100463cc
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x64]
cmp dword [eax + ecx*4], ebx
jne 0x100463cc
mov esi, ebx
jmp 0x100463cf
xor esi, esi
inc esi
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0x64]
push 1
cmp dword [eax + ecx*4], esi
sete dl
xor eax, eax
cmp edx, 0x7704
pop edx
setle al
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
dec dword [esp + 0x18]
jns 0x1004637e
dec dword [esp + 0xc]
jns 0x10046364
cmp dword [esp + 0x64], 0
je 0x1004642a
push dword [esp + 0x64]
call fcn.10056e57
pop ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x20], 0x1efa
cmp dword [esp + 0x20], 0x87b
mov dword [esp + 0x218], edi
jge 0x10046a7b
push 0xf
pop esi
mov dword [esp + 0x1b8], esi
mov dword [esp + 0x1b4], ebx
mov byte [esp + 0x1a4], bl
lea edx, [esp + 0x1a4]
mov dword [esp + 0x464], 3
call fcn.10048c1d
sub esp, 0x18
lea eax, [esp + 0x1bc]
mov ecx, esp
push eax
call fcn.1002fdba
lea ecx, [esp + 0x30c]
call fcn.10045d76
add esp, 0x18
lea ecx, [esp + 0x1a4]
push eax
call fcn.10030a46
xor edi, edi
lea ecx, [esp + 0x2f4]
push ebx
inc edi
push edi
call fcn.10030d0e
mov dword [esp + 0x1d0], esi
mov dword [esp + 0x1cc], ebx
mov byte [esp + 0x1bc], bl
lea edx, [esp + 0x1bc]
mov byte [esp + 0x464], 4
call fcn.10048c1d
sub esp, 0x18
lea eax, [esp + 0x1d4]
mov ecx, esp
push eax
call fcn.1002fdba
lea ecx, [esp + 0x3f0]
call fcn.10045d76
add esp, 0x18
lea ecx, [esp + 0x1bc]
push eax
call fcn.10030a46
push ebx
push edi
lea ecx, [esp + 0x3e0]
call fcn.10030d0e
mov dword [esp + 0x200], esi
mov dword [esp + 0x1fc], ebx
mov byte [esp + 0x1ec], bl
lea edx, [esp + 0x1ec]
mov byte [esp + 0x464], 5
call fcn.10048c1d
sub esp, 0x18
lea eax, [esp + 0x204]
mov ecx, esp
push eax
call fcn.1002fdba
lea ecx, [esp + 0x33c]
call fcn.10045d76
add esp, 0x18
lea ecx, [esp + 0x1ec]
push eax
call fcn.10030a46
push ebx
push edi
lea ecx, [esp + 0x32c]
call fcn.10030d0e
lea eax, [esp + 0x50]
push eax
push 0x1000ea38
call fcn.10056960
pop ecx
pop ecx
jmp 0x10046a40
dec eax
mov dword [esp + 0x1e8], esi
mov dword [esp + 0x50], eax
mov dword [esp + 0x1e4], ebx
mov byte [esp + 0x1d4], bl
lea edx, [esp + 0x1d4]
mov byte [esp + 0x464], 6
call fcn.10048c1d
sub esp, 0x18
lea eax, [esp + 0x1ec]
mov ecx, esp
push eax
call fcn.1002fdba
lea ecx, [esp + 0x2c4]
call fcn.10045d76
add esp, 0x18
lea ecx, [esp + 0x1d4]
push eax
call fcn.10030a46
push ebx
push edi
lea ecx, [esp + 0x2b4]
call fcn.10030d0e
lea eax, [esp + 0x1bc]
push eax
lea edx, [esp + 0x1a8]
lea ecx, [esp + 0x388]
call fcn.10048c92
pop ecx
mov byte [esp + 0x464], 7
lea ecx, [esp + 0x1ec]
mov esi, dword [esp + 0x28]
mov edx, eax
push ecx
or esi, edi
lea ecx, [esp + 0x424]
mov dword [esp + 0x2c], esi
call fcn.10048d24
pop ecx
push 8
pop edi
mov dword [esp + 0x464], edi
lea ecx, [esp + 0x1d4]
or esi, 2
mov edx, eax
mov dword [esp + 0x28], esi
call fcn.10035688
test al, al
jne 0x10046889
lea eax, [esp + 0x1ec]
push eax
lea edx, [esp + 0x1a8]
lea ecx, [esp + 0x3f4]
call fcn.10048c92
pop ecx
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x464], 9
push ecx
or esi, 4
lea ecx, [esp + 0x3c4]
mov edx, eax
mov dword [esp + 0x2c], esi
call fcn.10048d24
pop ecx
mov dword [esp + 0x464], 0xa
lea ecx, [esp + 0x1d4]
or esi, edi
mov edx, eax
mov dword [esp + 0x28], esi
call fcn.10035688
test al, al
jne 0x10046889
lea eax, [esp + 0x1a4]
push eax
lea edx, [esp + 0x1c0]
lea ecx, [esp + 0x3a0]
call fcn.10048c92
pop ecx
push 0x10
pop edi
lea ecx, [esp + 0x1ec]
mov dword [esp + 0x464], 0xb
push ecx
or esi, edi
lea ecx, [esp + 0x370]
mov edx, eax
mov dword [esp + 0x2c], esi
call fcn.10048d24
pop ecx
mov dword [esp + 0x464], 0xc
lea ecx, [esp + 0x1d4]
or esi, 0x20
mov edx, eax
mov dword [esp + 0x28], esi
call fcn.10035688
test al, al
jne 0x10046889
lea eax, [esp + 0x1ec]
push eax
lea edx, [esp + 0x1c0]
lea ecx, [esp + 0x340]
call fcn.10048c92
pop ecx
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x464], 0xd
push ecx
or esi, 0x40
lea ecx, [esp + 0x310]
mov edx, eax
mov dword [esp + 0x2c], esi
call fcn.10048d24
pop ecx
mov dword [esp + 0x464], 0xe
lea ecx, [esp + 0x1d4]
or esi, 0x80
mov edx, eax
mov dword [esp + 0x28], esi
call fcn.10035688
test al, al
jne 0x10046889
lea eax, [esp + 0x1a4]
push eax
lea edx, [esp + 0x1f0]
lea ecx, [esp + 0x2e0]
call fcn.10048c92
pop ecx
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x464], 0xf
push ecx
or esi, 0x100
lea ecx, [esp + 0x2c8]
mov edx, eax
mov dword [esp + 0x2c], esi
call fcn.10048d24
pop ecx
mov dword [esp + 0x464], edi
lea ecx, [esp + 0x1d4]
or esi, 0x200
mov edx, eax
mov dword [esp + 0x28], esi
call fcn.10035688
test al, al
jne 0x10046889
lea eax, [esp + 0x1bc]
push eax
lea edx, [esp + 0x1f0]
lea ecx, [esp + 0x40c]
call fcn.10048c92
pop ecx
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x464], 0x11
push ecx
or esi, 0x400
lea ecx, [esp + 0x358]
mov edx, eax
mov dword [esp + 0x2c], esi
call fcn.10048d24
pop ecx
or esi, 0x800
lea ecx, [esp + 0x1d4]
mov edx, eax
mov dword [esp + 0x28], esi
call fcn.10035688
mov byte [esp + 0x13], bl
test al, al
je 0x1004688e
mov byte [esp + 0x13], 1
mov eax, dword [esp + 0x28]
test eax, 0x800
je 0x100468b5
push ebx
and eax, 0xfffff7ff
lea ecx, [esp + 0x358]
push 1
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
xor edi, edi
inc edi
test eax, 0x400
je 0x100468da
push ebx
and eax, 0xfffffbff
lea ecx, [esp + 0x40c]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
test eax, 0x200
je 0x100468fc
push ebx
and eax, 0xfffffdff
lea ecx, [esp + 0x2c8]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
test eax, 0x100
je 0x1004691e
push ebx
and eax, 0xfffffeff
lea ecx, [esp + 0x2e0]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
test al, al
jns 0x1004693d
push ebx
and eax, 0xffffff7f
lea ecx, [esp + 0x310]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
test al, 0x40
je 0x1004695a
push ebx
and eax, 0xffffffbf
lea ecx, [esp + 0x340]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
test al, 0x20
je 0x10046977
push ebx
and eax, 0xffffffdf
lea ecx, [esp + 0x370]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
test al, 0x10
je 0x10046994
push ebx
and eax, 0xffffffef
lea ecx, [esp + 0x3a0]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
test al, 8
je 0x100469b1
push ebx
and eax, 0xfffffff7
lea ecx, [esp + 0x3c4]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
test al, 4
je 0x100469ce
push ebx
and eax, 0xfffffffb
lea ecx, [esp + 0x3f4]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
test al, 2
je 0x100469eb
push ebx
and eax, 0xfffffffd
lea ecx, [esp + 0x424]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
mov eax, dword [esp + 0x28]
push 6
pop esi
mov dword [esp + 0x464], esi
test al, 1
je 0x10046a0e
push ebx
and eax, 0xfffffffe
lea ecx, [esp + 0x388]
push edi
mov dword [esp + 0x30], eax
call fcn.10030d0e
cmp byte [esp + 0x13], 0
je 0x10046a1c
push 0x1000edd8
jmp 0x10046a21
push 0x1000eddc
call fcn.100572e2
pop ecx
push ebx
push edi
lea ecx, [esp + 0x1dc]
mov byte [esp + 0x46c], 5
call fcn.10030d0e
push 0xf
pop esi
mov eax, dword [esp + 0x50]
test eax, eax
jne 0x10046595
push ebx
dec eax
lea ecx, [esp + 0x1f0]
push edi
mov dword [esp + 0x58], eax
call fcn.10030d0e
push ebx
push edi
lea ecx, [esp + 0x1c4]
call fcn.10030d0e
push ebx
push edi
lea ecx, [esp + 0x1ac]
call fcn.10030d0e
or eax, 0xffffffff
mov dword [esp + 0x40], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10046aa0
push ebx
push 0x98d
push 0x813
push 0x42
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004821f
push 0xfd5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1004821f
mov dword [esp + 0x10], 0xa61928c1
lea ecx, [esp + 0x108]
mov dword [esp + 0x24], 0xd06f
call fcn.100301c4
mov dword [esp + 0xc], ebx
jmp 0x10046af7
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10046ae1
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 0x1c
push 3
pop edi
jl 0x10046c7c
mov eax, 0xac70
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x180], eax
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x18], ebx
jmp 0x10046b4e
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x294], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10046b3f
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], edi
jg 0x10046c65
mov esi, dword [esp + 0x104]
cmp dword [esp + 0x14], ebx
je 0x10046b87
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x174], ebx
je 0x10046b87
cmp dword [esp + 0x14], ebx
je 0x10046b87
xor edx, edx
inc edx
jmp 0x10046b89
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x174]
cmp eax, edx
sete cl
or eax, 0xffffffff
cmp eax, ecx
mov eax, dword [esp + 0x14]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xec99
setg al
xor ecx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x174]
cmp dword [esp + 0x20], eax
setg cl
cmp ecx, 0x9e177c42
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [esp + 0x294], edx
mov eax, dword [esp + 0x14]
cmp edx, eax
mov eax, dword [esp + 0xc]
setle cl
cmp ecx, 0xa5d840df
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setne cl
cmp ecx, 0xc3938dd4
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
sub edx, dword [esp + 0xc]
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x174], ebx
je 0x10046c48
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x174], ebx
je 0x10046c48
xor ecx, ecx
inc ecx
jmp 0x10046c4a
mov ecx, ebx
xor eax, eax
or edx, 0xffffffff
cmp ecx, edx
setg al
mov dword [esi + 4], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x10046b69
inc dword [esp + 0xc]
mov eax, 0xac70
cmp dword [esp + 0xc], 0x1c
jge 0x10046b15
push 8
pop esi
cmp dword [esp + 0x104], 0
je 0x10046ca8
push dword [esp + 0x104]
call fcn.10056e57
pop ecx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov eax, dword [0x109cd8b0]
test al, 2
jne 0x10046d4a
or eax, 2
mov dword [0x109cd8b0], eax
push ebx
mov dword [esp + 0x468], 0x12
push ebx
mov dword [0x109cd870], ebx
mov dword [0x109cd874], ebx
call fcn.1003bcb1
mov dword [0x109cd870], eax
mov dword [0x109cd878], ebx
mov dword [0x109cd880], ebx
mov byte [esp + 0x464], 0x14
mov ecx, 0x109cd878
mov dword [esp + 0x224], eax
lea eax, [esp + 0x224]
push eax
push 0x10
push ebx
lea eax, [esp + 0x6c]
mov dword [0x109cd88c], 0x3f800000
push eax
mov dword [0x109cd87c], ebx
call fcn.1003ba89
push 0x100719d9
mov dword [0x109cd884], 7
mov dword [0x109cd888], esi
call fcn.10056cc7
or eax, 0xffffffff
pop ecx
mov dword [esp + 0x464], eax
push 4
lea ecx, [esp + 0x90]
call fcn.100301c4
push 1
lea ecx, [esp + 0xf0]
mov dword [esp + 0x468], 0x15
call fcn.100301c4
or eax, 0xffffffff
mov byte [esp + 0x464], 0x16
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x14c]
push edi
call fcn.100301c4
mov dword [esp + 0x14], ebx
jmp 0x10046da5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x8c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10046d93
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10046dc7
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10046db5
mov dword [esp + 0x14], ebx
jmp 0x10046de9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 0x6dfc9b99
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10046dd3
mov eax, dword [esp + 0xec]
mov dword [eax], ebx
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], 0xc3d6c1df
mov dword [esp + 0xc], ebx
jmp 0x10046e33
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x88], 0xfffffff6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10046e20
mov dword [esp + 0x2c], 0xfffffff9
mov edx, dword [esp + 0x2c]
mov esi, dword [esp + 0xec]
mov edi, dword [esp + 0x8c]
mov dword [esp + 0x88], edx
mov eax, dword [esi]
mov ecx, dword [edi + eax*4]
mov eax, dword [esp + 0x20]
sub ecx, dword [eax + 4]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
mov ecx, dword [esi]
mov edx, ecx
setg al
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
sub eax, dword [edi + ecx*4]
mov ecx, 0xb66febfb
cmp ecx, eax
mov ecx, 0xa924c000
sbb eax, eax
neg eax
sub eax, 0x3dc9
neg eax
sbb eax, eax
inc eax
sub ecx, eax
mov eax, dword [esp + 0x8c]
sub ecx, edx
mov dword [eax + edx*4], ecx
jne 0x10046ebb
cmp dword [esp + 0x88], ebx
jne 0x10046ebb
xor edx, edx
mov eax, ebx
inc edx
jmp 0x10046ec0
xor edx, edx
inc edx
mov eax, edx
add dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0xec]
inc dword [esi]
cmp dword [esi], 3
jle 0x10046e0e
push dword [esp + 0x14c]
call fcn.10056e57
pop ecx
push esi
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ebx
call fcn.10056e57
or eax, 0xffffffff
mov dword [esp + 0xf0], ebx
pop ecx
mov dword [esp + 0x464], eax
push dword [esp + 0x8c]
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
call fcn.10056e57
pop ecx
lea eax, [esp + 0x48]
mov dword [esp + 0x8c], ebx
xorps xmm0, xmm0
mov dword [esp + 0x90], ebx
push eax
mov dword [esp + 0x98], ebx
movdqu xmmword [esp + 0x198], xmm0
call fcn.10048859
xor esi, esi
lea ecx, [esp + 0xf8]
inc esi
push esi
mov edi, dword [eax]
mov dword [esp + 0x38], edi
call fcn.100301c4
mov dword [esp + 0x3c], 0x93e9
or eax, 0xffffffff
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], 0xfffffff9
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], 2
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0xc], 0xea311c3f
mov dword [esp + 0x20], 0xd52a42bb
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0xeb11de2a
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 0xfd8b26de
mov dword [esp + 0x14], ebx
jmp 0x10046fe6
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10046fd4
push 3
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x10047008
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x248], 0xfffffff8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10046ff5
mov dword [esp + 0x14], ebx
jmp 0x10047027
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2a0], 0x8a922a19
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10047014
mov ecx, dword [esp + 0x2a4]
mov eax, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setle dl
sub edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x24c]
setne cl
xor edx, edx
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0xfffffffa
setl al
xor edx, edx
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xf8]
mov dword [esp + 0x248], ecx
cmp dword [eax], ecx
mov eax, dword [esp + 0x30]
setg dl
sub edx, eax
cmp dword [esp + 0x3c], edx
je 0x100470a0
mov edx, ebx
cmp dword [esp + 0x38], ebx
je 0x100470a2
mov edx, esi
mov eax, dword [esp + 0x30]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xf8]
setg cl
imul ecx, ecx, 0x23e6
cmp dword [eax], ecx
mov dword [esp + 0xc], ebx
jg 0x1004710a
jmp 0x100470e1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100470dd
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x100470c4
jmp 0x10047110
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10047106
push 0x2593
push 0x57f
push ebx
call dword [sym.imp.GDI32.dll_OffsetRgn]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x100470ea
push dword [esp + 0xf8]
call fcn.10056e57
cmp byte [ebp + 0xc], 0
pop ecx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
jne 0x10047140
test edi, edi
jne 0x10047509
mov dword [esp + 0x14], 0xe0648261
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0xfffffff7
jge 0x1004722c
or ecx, 0xffffffff
mov dword [esp + 0xc], 0xd45db34e
mov dword [esp + 0x20], 0xfff8
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0xc], ebx
jmp 0x1004718f
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x230], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10047180
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 2
jg 0x1004721d
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x230]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x230]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x230]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
cmp eax, 0x54d
setle cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], 0x15e0c0a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x100471a1
or ecx, 0xffffffff
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff7
jl 0x1004715a
mov eax, dword [esp + 0x14]
mov dl, byte [ebp + 0xc]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x438]
push eax
call fcn.1003c7d4
mov esi, eax
lea edi, [esp + 0x198]
pop ecx
push 2
lea ecx, [esp + 0x12c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], 0x5b3b9da4
xor esi, esi
mov dword [esp + 0x3c], 0xc593c869
inc esi
mov dword [esp + 0x24], 0x5c8a52b4
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], 0xccedb775
mov dword [esp + 0x18], 0x578cca6
mov dword [esp + 0x40], esi
mov dword [esp + 0x34], 0x8e4c
mov dword [esp + 0x30], ebx
call fcn.100301c4
mov dword [esp + 0x1c], 0x656e2e31
or edi, 0xffffffff
mov dword [esp + 0x20], edi
mov dword [esp + 0xc], ebx
jmp 0x100472ce
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0x38c46158
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x100472b8
mov eax, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp ecx, eax
setle dl
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
inc dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0xc]
cmp eax, 0xfffffffe
setl cl
xor edx, edx
mov dword [esp + 0x14], ecx
imul ecx, dword [esp + 0x14], 0xf57a
mov eax, dword [esp + 0x38]
cmp ecx, eax
setle dl
mov dword [esp + 0x38], edx
cmp dword [esp + 0x38], 0xfffffff8
jle 0x10047348
mov eax, esi
cmp dword [esp + 0x30], ebx
jne 0x1004734a
mov eax, ebx
mov dword [esp + 0x24], eax
xor edx, edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setge dl
sub edx, dword [esp + 0x2c]
jne 0x1004736b
mov eax, ebx
cmp dword [esp + 0x3c], ebx
je 0x1004736d
mov eax, esi
mov dword [esp + 0x2c], eax
mov ecx, 0x702b
mov eax, dword [esp + 0x2c]
imul eax, dword [esp + 0x30], 0x702b
mov edx, dword [esp + 0x18]
add edx, 0xbd2a
push 8
sub ecx, eax
mov eax, dword [esp + 0x34]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x12c]
setne cl
cmp ecx, edi
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
sbb ecx, ecx
inc ecx
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setle cl
sub ecx, eax
mov eax, dword [esp + 0x30]
push dword [esp + 0x128]
mov dword [esp + 0x20], ecx
xor ecx, ecx
cmp dword [esp + 0x20], eax
setge cl
mov dword [esp + 0x24], ecx
call fcn.10056e57
cmp byte [ebp + 0xc], 0
pop ecx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
je 0x10047505
cmp dword [esp + 0x19c], 0
je 0x10047505
mov eax, dword [esp + 0x1a0]
lea ecx, [esp + 0x110]
push 3
mov dword [esp + 0x220], eax
call fcn.100301c4
mov dword [esp + 0x30], 0xfffffff6
mov dword [esp + 0x20], 0x9d94
mov dword [esp + 0xc], ebx
jmp 0x10047460
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0x96dd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1004744a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10047487
push ebx
push 0x6c1
push 0x7a
push 0x23e7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [esp + 0x30], 2
cmp dword [esp + 0x30], ebx
jl 0x100474cb
mov dword [esp + 0xc], 0x801fc3ee
mov dword [esp + 0xc], 2
cmp dword [esp + 0xc], ebx
jl 0x100474c1
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x110]
cmp dword [eax + ecx*4], ebx
jne 0x100474c1
dec dword [esp + 0xc]
jns 0x100474ab
dec dword [esp + 0x20]
dec dword [esp + 0x30]
jns 0x10047495
cmp dword [esp + 0x110], 0
je 0x100474f7
push dword [esp + 0x110]
call fcn.10056e57
pop ecx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ebx
mov eax, dword [esp + 0x19c]
mov dword [esp + 0x220], eax
mov edi, dword [esp + 0x34]
mov dword [esp + 0x18], 0x5c68ec0a
mov dword [esp + 0x20], 0xafe44fa3
mov dword [esp + 0xc], ebx
jmp 0x10047532
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x3b4], 0x1328f6c7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1004751f
mov dword [esp + 0x18], 0xffffffeb
jmp 0x1004757b
mov dword [esp + 0x1c], 0x6cce57bf
mov dword [esp + 0x1c], 0x75cb
mov dword [esp + 0xc], ebx
jmp 0x1004756c
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x448], 7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10047559
dec dword [esp + 0x20]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffed
jne 0x10047543
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100475a1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
test edi, edi
jne 0x10047c68
cmp dword [esp + 0x194], edi
jle 0x10047c68
push 2
lea ecx, [esp + 0x15c]
call fcn.100301c4
push esi
lea ecx, [esp + 0x144]
mov dword [esp + 0x468], 0x17
call fcn.100301c4
mov byte [esp + 0x464], 0x18
mov dword [esp + 0x1c], 0x3b3152c5
mov dword [esp + 0x1c], 0x1ca8
cmp dword [esp + 0x1c], 0x1372
jge 0x10047667
lea eax, [esp + 0x20c]
push eax
push ecx
lea eax, [esp + 0x20c]
mov ecx, 0x10662ef0
push eax
call fcn.10048243
pop ecx
mov ecx, eax
call fcn.10048243
mov eax, dword [esp + 0x204]
push 6
pop esi
mov edx, esi
lea ecx, [eax + eax]
imul eax, dword [esp + 0x20c], 3
cmp ecx, esi
jl 0x10047652
cmp edx, eax
jg 0x10047652
cmp ecx, eax
jg 0x10047649
add ecx, 2
jmp 0x1004764c
add eax, 3
add edx, esi
cmp edx, ecx
jle 0x1004763c
cmp ecx, eax
cmovg eax, ecx
push eax
call fcn.1004846d
push eax
call fcn.100346b6
xor esi, esi
pop ecx
inc esi
push dword [esp + 0x60]
movdqa xmm0, xmmword [0x1000efa0]
lea eax, [esp + 0x288]
push eax
lea eax, [esp + 0x27c]
mov dword [esp + 0xa4], ebx
push eax
push ebx
lea ecx, [esp + 0xac]
mov dword [esp + 0xb0], ebx
movdqu xmmword [esp + 0x284], xmm0
mov dword [esp + 0xb4], ebx
call fcn.100356d8
push esi
lea ecx, [esp + 0xe4]
mov byte [esp + 0x468], 0x19
call fcn.100301c4
mov dword [esp + 0x14], ebx
jmp 0x100476db
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100476c9
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10047701
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0x2ee76f50
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100476eb
mov dword [esp + 0x14], ebx
jmp 0x1004771f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1004770d
mov eax, dword [esp + 0x140]
mov dword [eax], ebx
mov eax, dword [esp + 0xe0]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], 0x80ca9f8d
dec dword [eax]
mov dword [esp + 0x1c], 0xa9bacde9
mov dword [esp + 0x1c], 0xc58bdfad
mov dword [esp + 0x1c], 0x8b78acc4
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10047782
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor edx, edx
inc edx
mov esi, dword [esp + 0x140]
inc dword [esi]
cmp dword [esi], edx
jle 0x1004772e
cmp dword [esp + 0xe0], 0
je 0x100477bb
push dword [esp + 0xe0]
call fcn.10056e57
pop ecx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
cmp dword [esp + 0x9c], 0
je 0x100477e7
push dword [esp + 0x9c]
call fcn.10056e57
pop ecx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
push esi
call fcn.10056e57
or esi, 0xffffffff
mov dword [esp + 0x144], ebx
mov dword [esp + 0x468], esi
cmp dword [esp + 0x15c], 0
pop ecx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
je 0x10047839
push dword [esp + 0x158]
call fcn.10056e57
pop ecx
mov dword [esp + 0x158], ebx
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x160], ebx
push 1
lea ecx, [esp + 0x74]
call fcn.100301c4
mov dword [esp + 0xc], 0xfffffff9
mov dword [esp + 0x1c], 0xf199314e
mov dword [esp + 0x14], ebx
jmp 0x1004786d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x70]
mov dword [eax + ecx*4], 0xa3a1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1004785a
mov dword [esp + 0x14], ebx
jmp 0x1004788d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x228], 0x1ad67a4b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1004787a
mov eax, dword [esp + 0x70]
xor ecx, ecx
cmp dword [eax], 0xfffffffd
setg cl
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], 2
je 0x100478bd
mov eax, dword [esp + 0x70]
cmp dword [eax], ebx
jne 0x100478bd
cmp dword [esp + 0xc], ebx
jne 0x100478bd
mov edx, ebx
jmp 0x100478c0
xor edx, edx
inc edx
mov eax, dword [esp + 0x70]
mov ecx, dword [eax]
lea eax, [edx + ecx]
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
je 0x100478dc
cmp dword [esp + 0xc], ebx
jne 0x100478dc
mov edx, ebx
jmp 0x100478df
xor edx, edx
inc edx
mov eax, dword [esp + 0x70]
mov ecx, dword [eax]
mov dword [esp + 0x22c], ecx
lea eax, [ecx - 2]
add eax, edx
cmp eax, ecx
je 0x100478fe
cmp dword [esp + 0x22c], ebx
jne 0x10047904
cmp dword [esp + 0xc], ebx
je 0x10047909
xor edx, edx
inc edx
jmp 0x1004790b
mov edx, ebx
mov ecx, dword [esp + 0x70]
xor eax, eax
push ecx
cmp edx, dword [ecx]
setge al
mov dword [esp + 0x20], eax
call fcn.10056e57
movdqa xmm0, xmmword [0x1000efc0]
lea eax, [esp + 0x278]
pop ecx
push dword [esp + 0x60]
mov dword [esp + 0x74], ebx
lea ecx, [esp + 0xcc]
push eax
lea eax, [esp + 0x26c]
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
push eax
mov dword [esp + 0x24], 0xc184c506
mov dword [esp + 0x3c], 6
mov dword [esp + 0x28], esi
push ebx
movdqu xmmword [esp + 0x274], xmm0
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
call fcn.100356d8
xor ecx, ecx
mov dword [esp + 0x464], 0x1a
mov dword [esp + 0xc], ebx
inc ecx
jmp 0x100479af
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x44], 0xfffb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1004799f
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jg 0x10047bde
push 8
pop edi
jmp 0x100479cb
xor ecx, ecx
inc ecx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x38], 0xfffffff8
mov dword [esp + 0x1c], 0xf5f2fe86
mov dword [esp + 0x1c], 0x966ba053
mov dword [esp + 0x1c], 0xfffffff9
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x3c], 0x59274cb0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x1c], 0xcb4f7bc7
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10047a27
push 0xd76
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov dword [esp + 0xc], ebx
jmp 0x10047bbf
push dword [esp + 0x60]
movdqa xmm0, xmmword [0x1000efa0]
lea eax, [esp + 0x268]
push eax
lea eax, [esp + 0x25c]
mov dword [esp + 0x1c], 0xcf09cc25
push eax
mov dword [esp + 0x30], 0x7dd9ae65
lea ecx, [esp + 0xc0]
mov dword [esp + 0x28], edi
push ebx
movdqu xmmword [esp + 0x264], xmm0
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
call fcn.100356d8
mov dword [esp + 0x2c], 0x9fa6b86d
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x10047b4d
xor esi, esi
inc esi
mov dword [esp + 0x20], esi
xor ecx, ecx
mov dword [esp + 0x1c], 0x95e1
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
cmp eax, 0x29855eec
setge cl
imul edx, ecx
sub edx, dword [esp + 0x14]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
cmp dword [esp + 0xc], eax
jg 0x10047aec
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], 0x18b47430
mov eax, dword [esp + 0xc]
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, ecx
setl dl
sub edx, dword [esp + 0x38]
je 0x10047b3d
mov eax, dword [esp + 0x18]
mov eax, esi
cmp dword [esp + 0x24], ebx
jne 0x10047b3f
mov eax, ebx
mov dword [esp + 0x24], eax
dec dword [esp + 0x14]
jns 0x10047aa4
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x44], ebx
je 0x10047b5f
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x44]
dec dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
add eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x24]
jg 0x10047b7f
cmp dword [esp + 0x38], ebx
je 0x10047b7f
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0xb4], 0
mov dword [esp + 0x1c], eax
je 0x10047bbb
push dword [esp + 0xb4]
call fcn.10056e57
pop ecx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x10047a30
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x100479c8
mov edi, dword [esp + 0x34]
or esi, 0xffffffff
mov dword [esp + 0x464], esi
cmp dword [esp + 0xc8], 0
je 0x10047c11
push dword [esp + 0xc8]
call fcn.10056e57
pop ecx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
cmp dword [esp + 0x198], 0
je 0x10047c68
mov dword [esp + 0x1c], 0xfffffffa
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10047c36
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10047c4e
push 0x67d
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov ecx, dword [esp + 0x198]
call fcn.10045d2c
mov edi, eax
lea eax, [esp + 0x48]
push eax
call fcn.10048859
mov dword [eax], edi
mov dword [esp + 0x2c], 0xba394643
lea ecx, [esp + 0xd4]
mov dword [esp + 0x1c], 9
xor eax, eax
mov dword [esp + 0x1c], 0xfffffff6
inc eax
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x1c], 0x551da622
mov dword [esp + 0x1c], 0xec79e672
mov dword [esp + 0x24], eax
push eax
call fcn.100301c4
push 8
pop esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], 0x2758e92e
mov dword [esp + 0x20], 0xa34071e9
mov dword [esp + 0x24], ebx
jmp 0x10047cdb
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 1
jl 0x10047cc9
mov eax, dword [esp + 0x2c]
dec dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], 0x2c87
jl 0x10047d19
mov dword [esp + 0x20], 0xbce0
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
jmp 0x10047dc7
mov dword [esp + 0x1c], 0x3147f59e
mov dword [esp + 0x1c], 0x255d5800
mov dword [esp + 0x1c], 0xb870004d
mov dword [esp + 0x1c], 0x3bdf78b1
mov dword [esp + 0x1c], 0xfffffffa
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jg 0x10047d79
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xd4]
mov eax, dword [ecx + eax*4]
imul eax, dword [ecx + esi*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x10047d4f
push 8
pop esi
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jg 0x10047dc7
or eax, 0xffffffff
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], 0x98422518
mov dword [esp + 0x1c], 1
dec dword [esp + 0x20]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10047dbd
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
or eax, 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jle 0x10047d86
cmp dword [esp + 0xd4], 0
je 0x10047df3
push dword [esp + 0xd4]
call fcn.10056e57
pop ecx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
lea ecx, [esp + 0x194]
call section..iusado
push 1
lea ecx, [esp + 0x58]
call fcn.100301c4
mov dword [esp + 0x464], 0x1b
lea ecx, [esp + 0x11c]
mov dword [esp + 0xc], ebx
mov dword [esp + 0x24], 0xa083
mov dword [esp + 0x34], esi
push 0xfffffffffffffffb
pop eax
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], eax
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], eax
mov dword [esp + 0x2c], 0x42f466f6
mov dword [esp + 0x20], 0xa505
push 2
call fcn.100301c4
mov dword [esp + 0x1c], 0x916d66c
xor edx, edx
mov dword [esp + 0x1c], 0xee57e67f
inc edx
mov dword [esp + 0x14], ebx
jmp 0x10047e8e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x54]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10047e7b
mov dword [esp + 0x14], ebx
jmp 0x10047ead
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x164], 0xa5cd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10047e9a
mov dword [esp + 0x14], ebx
jmp 0x10047eca
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x4c], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10047eba
mov dword [esp + 0x14], ebx
jmp 0x10047eec
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0xb4e2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10047ed6
mov dword [esp + 0x14], ebx
jmp 0x10047f0c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x210], 4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10047ef9
mov eax, dword [esp + 0x54]
cmp dword [eax], ebx
jne 0x10047fbb
mov eax, dword [esp + 0x24]
xor ecx, ecx
push 6
pop edx
sub edx, eax
mov eax, dword [esp + 0x24]
cmp edx, eax
mov eax, dword [esp + 0x16c]
setg cl
xor edx, edx
cmp ecx, 0x7e70
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xa8e4
setg al
xor edx, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
setge dl
xor ecx, ecx
cmp edx, dword [eax]
setle cl
xor edx, edx
add ecx, 9
mov dword [esp + 0x190], ecx
mov eax, dword [esp + 0x16c]
cmp ecx, eax
sete dl
add edx, 0xd443
je 0x10047fa1
cmp dword [esp + 0x184], ebx
jne 0x10047fa1
cmp dword [esp + 0x4c], ebx
je 0x10047fa5
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x16c]
mov eax, dword [esp + 0x16c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x16c]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x190]
mov eax, dword [esp + 0x54]
neg edx
mov ecx, dword [esp + 0xc]
sbb edx, edx
neg edx
mov esi, dword [eax]
add ecx, edx
mov eax, dword [esp + 0x2c]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x34]
setne dl
xor ecx, ecx
cmp edx, esi
setg cl
imul ecx, esi
inc dword [esp + 0x34]
cmp eax, ecx
jl 0x10048015
xor ecx, ecx
inc ecx
jmp 0x10048017
mov ecx, ebx
mov eax, dword [esp + 0x54]
xor edx, edx
mov dword [eax], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x184]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x16c]
mov eax, dword [esp + 0x11c]
cmp dword [eax], ecx
sete dl
cmp edx, dword [esp + 0x16c]
je 0x10048058
cmp dword [esp + 0x20], ebx
jne 0x10048058
mov edx, ebx
jmp 0x1004805b
xor edx, edx
inc edx
mov eax, dword [esp + 0x4c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x54]
setge cl
xor edx, edx
cmp ecx, 0xfffffffe
setg dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [esp + 0x4c]
setle cl
mov dword [esp + 0x1c], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
setle cl
xor edx, edx
cmp ecx, 0xbe1f
setge dl
mov dword [eax], edx
cmp edx, dword [esp + 0x34]
jg 0x100480ad
mov eax, dword [esp + 0x54]
cmp dword [eax], ebx
jne 0x100480ad
mov ecx, ebx
jmp 0x100480b0
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x164]
push dword [esp + 0x11c]
add eax, ecx
mov dword [esp + 0x194], eax
mov dword [esp + 0x214], 1
mov dword [esp + 0x20], 0x878d
call fcn.10056e57
or eax, 0xffffffff
mov dword [esp + 0x120], ebx
pop ecx
mov dword [esp + 0x464], eax
push dword [esp + 0x54]
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
call fcn.10056e57
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
pop ecx
test edi, edi
je 0x1004821f
mov edx, dword [esp + 0x40]
mov ecx, edi
call fcn.10045d6c
mov esi, eax
push 0xfffffffffffffff6
pop eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], 0x7c6f1fdb
mov dword [esp + 0x20], 0x93c1de6f
mov dword [esp + 0x20], eax
mov dword [esp + 0x40], 0x968cb667
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
mov dword [esp + 0x218], esi
je 0x1004817d
push 0x1437
push 0x843
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [esp + 0x18]
setne bl
sub eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, ebx
setl cl
add ecx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, 0x2280
setle cl
cmp ecx, 1
sbb eax, eax
neg eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
lea eax, [esp + 0x98]
push eax
setg cl
mov dword [esp + 0x44], ecx
call fcn.100487f7
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0x218]
mov ecx, dword [esp + 0x45c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret