Function at 0x1004270b
Capabilities:
Create pipe
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100828a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x238
push ebx
xor ebx, ebx
mov dword [esp + 0x98], edx
push esi
push edi
mov dword [esp + 0xc], ebx
xor edi, edi
mov dword [esp + 0x14], 0xab5c2947
inc edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x98], ecx
mov dword [esp + 0x1c], ebx
jmp 0x10042768
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x58], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1004275c
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x60d2f38
setne dl
xor ecx, ecx
imul edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, edx
mov eax, dword [esp + 0xc]
setl cl
xor edx, edx
cmp ecx, eax
setl dl
add edx, dword [esp + 0xc]
cmp edx, 0xffff
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xfffffffe
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
setne dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp esi, eax
setl cl
imul eax, ecx, 0x9968
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], ebx
jmp 0x1004285c
mov dword [esp + 0x2c], 0x4b14151c
cmp dword [esp + 0x20], ebx
jne 0x10042863
mov eax, dword [esp + 0x58]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
je 0x10042850
mov dword [esp + 0x14], 0x1b
jmp 0x10042847
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1004283d
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
cmp dword [esp + 0x2c], ebx
jne 0x10042858
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffffd
je 0x1004282c
jmp 0x10042858
mov dword [esp + 0x24], ebx
inc dword [esp + 0x24]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 6
jl 0x10042806
mov eax, 0xe91a049f
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0x14], 0xc1ec2db2
mov dword [esp + 0x18], 0xa237f4a7
push 3
mov dword [esp + 0x2c], edi
mov dword [esp + 0x18], ebx
pop eax
jmp 0x1004293b
mov dword [esp + 0x1c], 0x80c170c
mov dword [esp + 0x1c], ebx
jmp 0x1004292d
mov dword [esp + 0x18], 8
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
jl 0x10042929
mov dword [esp + 0x24], edi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x100428fb
push ebx
push 0x1ae6
push 0xc70
push 0x1e4d
push 0xc76
push 0x15e5
push 0x10b8
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push 3
pop eax
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ebx
jl 0x10042923
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1004291a
push 0x1682
call dword [sym.imp.KERNEL32.dll_TlsFree]
dec dword [esp + 0x24]
jns 0x10042905
push 3
pop eax
dec dword [esp + 0x18]
jns 0x100428c4
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x100428b2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], eax
jle 0x100428a4
mov dword [esp + 0x14], 0xffffffe3
jmp 0x100429b4
mov dword [esp + 0x18], ebx
mov edx, 0x6974
mov dword [esp + 0x24], 0x6548aab5
mov eax, dword [esp + 0xc4]
sub edx, eax
mov eax, dword [esp + 0xcc]
sub edx, eax
mov eax, dword [esp + 0x18]
sub edx, eax
mov eax, dword [esp + 0xcc]
mov ecx, dword [esp + 0x18]
imul edx, eax
imul ecx, edx
add ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
sub eax, 0xff4c
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xf
jle 0x1004294f
push 4
lea ecx, [esp + 0x19c]
call fcn.10026cbf
mov dword [esp + 0x24c], ebx
lea ecx, [esp + 0x180]
or esi, 0xffffffff
mov dword [esp + 0x134], esi
mov dword [esp + 0x138], esi
mov dword [esp + 0x13c], esi
mov dword [esp + 0x140], esi
mov dword [esp + 0x30], 0xcb61d225
mov dword [esp + 0x14], 0x13717be9
mov dword [esp + 0x20], edi
push 2
call fcn.10026cbf
mov dword [esp + 0x28], 0xfffffffb
mov dword [esp + 0x1c], 0x3818264d
mov dword [esp + 0x24], 0x5adf851f
mov dword [esp + 0x18], 0xe5f88592
push 4
mov dword [esp + 0x30], 0x4045
mov dword [esp + 0x10], ebx
pop edx
jmp 0x10042a55
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x218], 0x89328a06
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10042a42
mov dword [esp + 0xc], ebx
jmp 0x10042a77
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10042a61
mov dword [esp + 0xc], ebx
jmp 0x10042a97
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x200], 0x2a67f8b4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10042a84
mov dword [esp + 0xc], ebx
jmp 0x10042ab6
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x94], 0xe4ed383d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10042aa3
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042ace
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x180]
xor edx, edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x13c]
dec dword [ecx + 4]
dec dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x20]
mov dword [esp + 0x20c], eax
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x13c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20c]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x94]
setg dl
cmp edx, 9
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x180]
call fcn.10026d71
mov dword [esp + 0x14], 0x66fe7d8a
lea ecx, [esp + 0x110]
mov dword [esp + 0x24], 8
mov dword [esp + 0x20], ebx
push 4
call fcn.10026cbf
mov dword [esp + 0x1c], 0x8700d35
push 4
pop edx
mov dword [esp + 0x11c], edx
mov dword [esp + 0x120], edx
mov dword [esp + 0x124], edx
mov dword [esp + 0x128], edx
mov dword [esp + 0x24], 0x6f80366e
mov dword [esp + 0x30], esi
mov dword [esp + 0x14], ebx
jmp 0x10042bc1
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x34], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10042bb5
mov dword [esp + 0x14], ebx
jmp 0x10042be3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0xb16aac89
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10042bcd
cmp dword [esp + 0x34], ebx
jne 0x10042c4d
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
cmp eax, dword [esp + 0x34]
jne 0x10042c05
mov edx, edi
cmp dword [esp + 0x20], ebx
jne 0x10042c07
mov edx, ebx
mov eax, dword [esp + 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x110]
setge cl
mov dword [eax + 8], ecx
test ecx, ecx
jne 0x10042c28
mov ecx, ebx
cmp dword [esp + 0x1c], ebx
je 0x10042c2a
mov ecx, edi
mov eax, dword [esp + 0x34]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x34]
setle cl
add eax, ecx
mov dword [esp + 0x128], eax
mov eax, dword [esp + 0x34]
xor edx, edx
cmp eax, edi
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [esp + 0x1c]
mov edi, dword [sym.imp.GDI32.dll_GetClipBox]
setle dl
sub edx, 0x951f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], 0xffffffea
cmp dword [esp + 0x1c], 0xf
jl 0x10042dc4
mov esi, dword [esp + 0x110]
mov dword [esp + 0xc], 0xdc705be7
mov dword [esp + 0x30], 0x11945b4
mov eax, dword [esp + 0xc]
neg eax
je 0x10042d2f
mov dword [esp + 0x20], ebx
jmp 0x10042cfb
mov dword [esp + 0xc], ebx
jmp 0x10042cd7
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x120], 0xfffffff7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x10042cc4
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042cf7
push ebx
push ebx
push 0x1225
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x10042cbe
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042d4b
push 0x243a
push ebx
push ebx
push 0x24f
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x10042d4b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042d4b
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x34]
cmp eax, 1
mov eax, dword [esp + 0x34]
setg cl
xor edx, edx
add eax, ecx
cmp eax, 0xa9ad1dc2
mov eax, dword [esp + 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
setg cl
mov dword [esi + 8], ecx
xor ecx, ecx
cmp dword [esi + 8], ebx
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x30], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xf
jge 0x10042ca0
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [esp + 0x110]
call fcn.10026d71
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x1e4]
mov dword [esp + 0xc], 1
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x1c], 0xe0fc36fe
push 2
call fcn.10026cbf
push 2
mov dword [esp + 0x18], ebx
pop edx
jmp 0x10042e17
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3c], 0xe2799ac7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10042e07
mov dword [esp + 0x14], ebx
jmp 0x10042e39
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1e4]
mov dword [eax + ecx*4], 0xbd95d606
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10042e23
mov dword [esp + 0xc], ebx
jmp 0x10042ea7
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x3c]
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff8
ja 0x10042e64
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x24], 0x53f0d3ec
je 0x10042e7c
cmp dword [esp + 0x24], ebx
jne 0x10042e7c
mov edx, ebx
jmp 0x10042e7f
xor edx, edx
inc edx
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, edx
setg cl
imul ecx, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x3c], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jle 0x10042e45
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x1c], ebx
je 0x10042ecc
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], 1
cmp dword [esp + 0xc], ebx
jl 0x10042f3f
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x3c], ebx
je 0x10042f29
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042efc
push 0x9ef
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042f39
push 0x1372
push ebx
push 0x189
push 0x1f2d
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x10042f39
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x3c], ecx
dec dword [esp + 0xc]
jns 0x10042eda
lea ecx, [esp + 0x1e4]
call fcn.10026d71
xor edx, edx
inc edx
mov dword [esp + 0x20], edx
mov dword [esp + 0xc], 0x7e2799ac
mov dword [esp + 0x28], 0xe12aa53f
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x28], 0xab06c0e2
mov dword [esp + 0x24], 0x7374
mov dword [esp + 0xc], ebx
jmp 0x10042f9b
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xec], 0x72fd4914
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10042f88
mov dword [esp + 0xc], ebx
jmp 0x10042fbb
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x210], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10042fa8
mov dword [esp + 0xc], ebx
jmp 0x10042fdb
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x228], 0x41b44adc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10042fc8
mov dword [esp + 0xc], 0x12
cmp dword [esp + 0xc], 0xfffffff3
jne 0x1004309e
mov dword [esp + 0x14], 0x7cefa9d1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10043013
push 0x1f04
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x1004308c
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], ebx
jmp 0x1004307f
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0xec]
neg eax
cmp eax, 0xfffb
mov eax, dword [esp + 0x14]
sbb ecx, ecx
inc ecx
imul ecx, dword [esp + eax*4 + 0xec]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x1c], ebx
jmp 0x10043074
mov ecx, dword [esp + 0xf4]
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xec], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x1004305e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x10043033
dec dword [esp + 0x14]
jns 0x10043021
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff3
je 0x10042ff5
xor edx, edx
inc edx
inc dword [esp + 0x24]
mov dword [esp + 0x1c], ebx
jmp 0x100430be
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x100430a8
mov dword [esp + 0x14], 0x75b57fd5
mov dword [esp + 0x18], 7
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
jmp 0x100431ce
mov dword [esp + 0xc], 0xbd7b1c2a
mov dword [esp + 0x1c], 0x5eec80f2
mov dword [esp + 0xc], ebx
jmp 0x1004316a
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x18], ebx
je 0x1004311a
mov eax, edx
cmp dword [esp + 0x20], ebx
jne 0x1004311c
mov eax, ebx
neg eax
sub eax, 0x9df9481f
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xfffffffb
cmp eax, dword [esp + 0xc]
jle 0x10043139
mov ecx, ebx
cmp dword [esp + 0xc], ebx
je 0x1004313b
mov ecx, edx
xor eax, eax
test ecx, ecx
setne al
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x14], eax
jg 0x10043158
mov eax, ebx
cmp dword [esp + 0x20], ebx
je 0x1004315a
mov eax, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x1a
jle 0x10043100
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x14], ebx
jne 0x1004319e
mov dword [esp + 0xc], 0xaead
mov ecx, ebx
mov eax, dword [esp + 0xc]
neg eax
sbb eax, eax
neg eax
add eax, 0xffffa3ee
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ebx
je 0x100431a0
mov ecx, edx
mov eax, dword [esp + 0x1c]
sub ecx, eax
jne 0x100431ac
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jne 0x100431d9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x10
jl 0x100430ea
push 3
pop eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jl 0x100432ba
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], 0x314af12a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004320e
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
xor edx, edx
inc edx
cmp dword [esp + 0x14], 0xfffffffb
jg 0x10043239
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x198]
mov eax, dword [eax + ecx*4]
neg eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], 0xb81eca6c
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x14]
je 0x10043273
cmp dword [esp + 0x18], ebx
jne 0x100432ba
mov eax, dword [esp + 0x20]
jmp 0x100432b0
mov dword [esp + 0x30], 0xf06e85fc
cmp dword [esp + 0xc], ebx
jne 0x100432ba
push 3
mov dword [esp + 0x10], ebx
pop eax
jmp 0x100432aa
mov dword [esp + 0x24], 0x39d20578
mov dword [esp + 0x20], ebx
jmp 0x100432a0
mov dword [esp + 0x30], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x10043298
inc dword [esp + 0xc]
cmp dword [esp + 0xc], eax
jle 0x1004328a
dec dword [esp + 0x14]
jns 0x100431ea
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x198]
call fcn.10026d71
mov dword [esp + 0x24], 0xec2e0cf5
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x18], 0xb34e
mov dword [esp + 0x30], 0x887cf2e5
push 1
call fcn.10026cbf
push 2
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x250], 1
call fcn.10026cbf
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10043329
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1d4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10043316
mov dword [esp + 0x14], ebx
jmp 0x1004334b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1b0]
mov dword [eax + ecx*4], 0xc2e7ccc8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10043335
mov dword [esp + 0x30], edx
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0xfffffff7
jge 0x1004337a
mov eax, dword [esp + 0x1b0]
dec dword [eax + 4]
mov dword [esp + 0x28], edx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff7
jl 0x10043368
lea ecx, [esp + 0x1b0]
call fcn.10026d71
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x1d4]
call fcn.10026d71
mov dword [esp + 0x1c], 0xac204e2d
mov dword [esp + 0x1c], 0xfffffff7
jmp 0x10043430
mov dword [esp + 0x14], 0x90197f0a
mov dword [esp + 0x18], ebx
jmp 0x100433d0
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x9c], 0x17ca
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x100433bd
mov dword [esp + 0x14], ebx
jmp 0x10043408
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10043404
push 0x20dc
push ebx
push 0x17e2
push ebx
push 0x184d
push 0x2c0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x100433dd
mov dword [esp + 0x14], ebx
jmp 0x10043426
mov dword [esp + 0x30], 0x143e95aa
cmp dword [esp + 0x30], ebx
jne 0x1004342c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x10043414
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe2
jl 0x100433af
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10043453
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
mov eax, 0x22ba3946
xor edi, edi
mov dword [esp + 0x78], eax
inc edi
mov dword [esp + 0x7c], eax
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x18], ebx
jmp 0x10043483
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x54], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10043477
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100434aa
push ebx
push 0x149d
push 0x11c8
push 0x185d
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [esp + 0x80], ebx
cmp dword [esp + 0x80], ebx
jl 0x10043529
mov dword [esp + 0x18], ebx
jmp 0x100434cc
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x44], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x100434c0
mov dword [esp + 0x48], ebx
cmp dword [esp + 0x48], ebx
jl 0x10043515
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10043505
push 0x243a
push ebx
push ebx
push 0x24f
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov eax, dword [esp + 0x48]
cmp dword [esp + eax*4 + 0x54], ebx
jne 0x10043515
dec dword [esp + 0x48]
jns 0x100434dd
mov eax, dword [esp + 0x80]
mov eax, dword [esp + eax*4 + 0x54]
dec dword [esp + 0x80]
jns 0x100434ba
push 0x78bb
push ebx
call fcn.10046cc2
pop ecx
pop ecx
push 3
lea ecx, [esp + 0x160]
call fcn.10026cbf
push 3
mov dword [esp + 0x20], 0x256915a
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x1004356b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10043555
mov dword [esp + 0x1c], ebx
jmp 0x1004358d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], 0x6951
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x10043577
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100435b0
push 0x25a
push ebx
push ebx
push 0x220b
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
lea ecx, [esp + 0x15c]
call fcn.10026d71
mov dword [esp + 0x24], ebx
jmp 0x10044097
push edi
lea ecx, [esp + 0x70]
call fcn.10026cbf
push 2
pop eax
mov dword [esp + 0x24c], eax
lea ecx, [esp + 0x88]
push dword [esp + 0x9c]
movdqa xmm0, xmmword [0x10007ac0]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x204]
push eax
lea eax, [esp + 0x1f8]
mov dword [esp + 0x90], ebx
push eax
push ebx
movdqu xmmword [esp + 0x200], xmm0
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
call fcn.10027ecb
mov byte [esp + 0x24c], 3
mov dword [esp + 0xc], 0xfffffffa
jmp 0x100436d2
push edi
lea ecx, [esp + 0xa8]
call fcn.10026cbf
mov dword [esp + 0x18], ebx
jmp 0x10043665
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xa4]
mov dword [eax + ecx*4], 0xc74a
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1004364f
mov eax, dword [esp + 0xa4]
mov edx, dword [eax]
test edx, edx
je 0x10043691
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xa4]
neg ecx
sbb ecx, ecx
neg ecx
mov edx, dword [eax]
cmp ecx, edx
mov ecx, edi
je 0x10043693
mov ecx, ebx
imul ecx, edx
xor eax, eax
cmp edx, ecx
mov edx, dword [esp + 0xc]
setne al
xor ecx, ecx
cmp eax, 4
mov eax, dword [esp + 0xa4]
setle cl
sub edx, ecx
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [esp + 0x88]
setl cl
mov dword [eax], ecx
lea ecx, [esp + 0xa4]
call fcn.10026d71
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe8
jg 0x1004363c
mov dword [esp + 0xc], 0xffffffed
jmp 0x100436fd
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100436f9
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x14
je 0x100436e7
lea ecx, [esp + 0x88]
mov byte [esp + 0x24c], 2
call fcn.10026d71
mov dword [esp + 0x28], 0xd8b9dbea
mov dword [esp + 0x20], edi
mov dword [esp + 0x38], 0xa836
mov dword [esp + 0x2c], 0xf4aec701
mov dword [esp + 0xc], 0x63028ec7
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x1004375a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x60], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004374a
mov dword [esp + 0x14], ebx
jmp 0x1004377a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x12c], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10043767
mov dword [esp + 0x20], ebx
jmp 0x10043951
cmp dword [esp + 0x20], 2
jle 0x1004378a
cmp dword [esp + 0x24], 0x18
jl 0x100435c5
mov dword [esp + 0x1c], 0xfffffffd
lea ecx, [esp + 0x150]
push 3
call fcn.10026cbf
mov dword [esp + 0x24c], 7
mov dword [esp + 0x28], 0x9b12db22
mov dword [esp + 0x24], ebx
jmp 0x100440e3
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x100440d1
mov dword [esp + 0x1c], 8
cmp dword [esp + 0x1c], 0xffffffe8
jl 0x1004429d
mov eax, 0xd9b4e94f
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x4ccb63e
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc], 0x12a2ef7e
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 0x15
jg 0x1004428e
mov esi, dword [esp + 0x150]
mov dword [esp + 0x18], 9
lea ecx, [esp + 0x1bc]
push edi
call fcn.10026cbf
push 2
lea ecx, [esp + 0xfc]
mov byte [esp + 0x250], 8
call fcn.10026cbf
mov dword [esp + 0x28], edi
mov dword [esp + 0x14], ebx
jmp 0x10044190
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1bc]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004417d
mov dword [esp + 0x14], ebx
jmp 0x100441b2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x389
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1004419c
mov eax, dword [esp + 0xf8]
mov eax, dword [eax + 4]
mov dword [esp + 0xb8], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xf8]
cmp dword [eax], ebx
je 0x100441f4
mov eax, edi
cmp dword [esp + 0xb8], ebx
jne 0x100441f6
mov eax, ebx
cmp eax, dword [esi + 8]
jle 0x10044203
mov edx, ebx
cmp dword [esp + 0x18], ebx
je 0x10044205
mov edx, edi
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [esp + 0x18]
jg 0x10044221
mov ecx, edi
cmp dword [esp + 0xb8], ebx
jne 0x10044223
mov ecx, ebx
dec dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov dword [esi + 4], edx
mov eax, dword [esp + 0xc]
sete cl
xor edx, edx
cmp ecx, 0x98b4
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0xf8]
call fcn.10026d71
lea ecx, [esp + 0x1bc]
mov byte [esp + 0x24c], 7
call fcn.10026d71
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x15
jle 0x10044148
mov eax, 0xd9b4e94f
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe8
jge 0x10044102
or dword [esp + 0x24c], 0xffffffff
lea ecx, [esp + 0x150]
call fcn.10026d71
mov eax, dword [esp + 0xa0]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x98]
mov edi, edx
mov esi, eax
call fcn.10042699
mov ecx, dword [esp + 0x244]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret