Function at 0x4514f7
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x19c
push ebx
push esi
push edi
push 2
pop esi
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x14c]
push esi
mov dword [esp + 0x54], edx
call fcn.0041796c
xor edi, edi
inc edi
xor eax, eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x2c], 0xbe4212cf
mov dword [esp + 0xc], eax
jmp 0x45154f
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14c]
mov dword [ecx + edx*4], 3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x451539
push 4
mov dword [esp + 0x10], eax
pop edx
jmp 0x45156e
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x6c], 0xdf1febae
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x45155e
mov dword [esp + 0x78], eax
cmp dword [esp + 0x78], edi
jg 0x45175c
mov dword [esp + 0xc], 0x1e2c0d37
mov dword [esp + 0x18], 0xeaa3e8f0
mov dword [esp + 0x10], 0x935c
mov dword [esp + 0x24], 0xe2f093b0
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x4515c8
push 0x3af
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x451741
mov dword [esp + 0x1c], 0x497f
mov dword [esp + 0x2c], 0xc043ca38
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x78], eax
je 0x451631
mov ecx, dword [esp + 0x78]
xor edx, edx
cmp ecx, edi
setl dl
cmp edx, 0xfff9
je 0x451606
mov ecx, edi
cmp dword [esp + 0xc], eax
jne 0x451608
mov ecx, eax
mov dword [esp + 0x18], ecx
xor ebx, ebx
mov ecx, dword [esp + 0x18]
cmp ecx, 8
mov ecx, dword [esp + 0x78]
setne bl
xor edx, edx
cmp ebx, ecx
setne dl
imul ecx, edx, 0xfff8
mov edx, edi
cmp ecx, dword [esp + 0x1c]
jl 0x451633
mov edx, eax
mov ecx, dword [esp + 0x1c]
add ecx, edx
xor edx, edx
cmp ecx, 0x82b0
mov ecx, dword [esp + 0x1c]
setle dl
xor ebx, ebx
cmp edx, 0xfffffffe
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x1c]
setg dl
xor ebx, ebx
cmp edx, ecx
setl bl
xor edx, edx
sub ebx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
cmp ebx, ecx
mov ecx, dword [esp + 0x10]
setle dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0xc]
setne bl
xor edx, edx
cmp ecx, 0xfffffff9
setge dl
cmp edx, ebx
jle 0x451690
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp ecx, 0x1e0
setl dl
sub edx, dword [esp + 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x24], edx
cmp dword [esp + 0x10], eax
je 0x4516d6
mov ecx, dword [esp + 0x18]
xor ebx, ebx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0xc]
cmp edx, ecx
mov ecx, dword [esp + 0xc]
setl bl
imul ecx, ebx
test ecx, ecx
mov ecx, edi
jne 0x4516d8
mov ecx, eax
mov dword [esp + 0x2c], ecx
xor ebx, ebx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
setl bl
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], eax
je 0x4516f9
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setl dl
cmp dword [esp + 0x1c], 8
sbb ecx, ecx
inc ecx
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x24], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x4515d1
inc dword [esp + 0x78]
cmp dword [esp + 0x78], edi
jle 0x451582
push 2
pop esi
lea ecx, [esp + 0x14c]
call fcn.00417a3e
or ebx, 0xffffffff
xor eax, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x3c], 0xfffffffd
mov dword [esp + 0x10], esi
mov dword [esp + 0x38], 0x46e06334
mov dword [esp + 0xc], eax
jmp 0x45179f
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x40], 0xb4f5fdfd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x45178f
mov dword [esp + 0xc], eax
jmp 0x4517be
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x194], 0x9702f8fa
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x4517ab
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0x17
je 0x451b1a
mov dword [esp + 0xc], eax
mov dword [esp + 0x20], 5
mov dword [esp + 0x28], 0x8f57
mov dword [esp + 0x30], 0x2973452c
mov dword [esp + 0x34], 0x4e0b
mov dword [esp + 0x24], 0xf3aebb8f
mov dword [esp + 0x18], eax
jmp 0x451815
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0xb0], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x451806
mov ecx, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
test ecx, ecx
mov ecx, dword [esp + 0xc]
setg dl
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x1c]
setge bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x1c]
setle dl
mov dword [esp + 0x2c], edx
xor edx, edx
cmp dword [esp + 0x2c], ecx
setne dl
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], eax
jne 0x45186c
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
add ecx, dword [esp + 0x1c]
je 0x451961
mov dword [esp + 0x28], 0xd4f5
mov dword [esp + 0x2c], 0xf53c8cbf
push 6
pop ecx
mov dword [esp + 0x13c], ecx
mov dword [esp + 0x140], ecx
mov dword [esp + 0x144], ecx
mov dword [esp + 0x148], ecx
cmp dword [esp + 0xc], eax
jne 0x4518d3
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x28], 0xe2499e72
mov ecx, eax
jle 0x4518d5
mov ecx, edi
xor ebx, ebx
cmp ecx, 0xffff
mov ecx, dword [esp + 0x40]
sete bl
xor edx, edx
cmp ebx, ecx
setne dl
mov dword [esp + 0x40], edx
cmp dword [esp + 0xc], eax
jne 0x451940
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x140], ecx
test ecx, ecx
je 0x451914
mov edx, edi
cmp dword [esp + 0x2c], eax
jne 0x451916
mov edx, eax
mov ecx, dword [esp + 0xc]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0xc]
setg bl
xor edx, edx
cmp ebx, ecx
setle dl
mov dword [esp + 0x40], edx
mov edx, eax
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], eax
je 0x451942
mov edx, edi
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [esp + 0x28]
setne bl
xor edx, edx
cmp ecx, ebx
setne dl
mov dword [esp + 0x18], edx
jmp 0x451ab8
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
jmp 0x451983
mov ecx, dword [esp + 0x28]
mov dword [esp + ecx*4 + 0x7c], 9
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jl 0x451973
mov ecx, dword [esp + 0x40]
xor edx, edx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x84]
cmp ecx, 0xffffffff
setle dl
mov dword [esp + 0x28], edx
xor edx, edx
mov ecx, dword [esp + 0x3c]
cmp ecx, 0xfffffff9
setl dl
xor ebx, ebx
mov dword [esp + 0x30], edx
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
cmp ecx, edx
mov ecx, dword [esp + 0x20]
setl bl
xor edx, edx
cmp ecx, ebx
setge dl
sub edx, dword [esp + 0x20]
je 0x4519e9
cmp dword [esp + 0x40], eax
jne 0x451b17
jmp 0x451a56
mov dword [esp + 0x2c], edi
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x451a05
push 0xf85
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
cmp dword [esp + 0x28], eax
je 0x451a48
mov ecx, dword [esp + 0x20]
xor ebx, ebx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xb4]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0xb8]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
cmp edx, ecx
setne bl
cmp ebx, dword [esp + 0x18]
jne 0x451a48
cmp dword [esp + 0x2c], eax
jne 0x451a50
mov ecx, eax
cmp dword [esp + 0x2c], eax
je 0x451a52
mov ecx, edi
mov dword [esp + 0x40], ecx
cmp dword [esp + 0xb8], eax
je 0x451a6b
mov ecx, dword [esp + 0x7c]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x34]
xor ebx, ebx
mov ecx, dword [esp + 0x84]
mov ecx, dword [esp + 0x84]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
cmp ecx, edx
mov ecx, dword [esp + 0x10]
setle bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x38]
setle dl
mov dword [esp + 0x34], edx
xor edx, edx
cmp dword [esp + 0x34], ecx
setg dl
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0xb8]
xor ebx, ebx
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0xb4]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
mov edx, dword [esp + 0x18]
setl bl
lea ecx, [ebx - 1]
imul edx, ecx
test edx, edx
je 0x451aeb
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x19c]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x10]
sub edx, ecx
mov dword [esp + 0x18], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x17
jne 0x4517d4
or ebx, 0xffffffff
mov dword [esp + 0x28], esi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], eax
jmp 0x451b88
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 0xfffffffc
mov dword [esp + 0x34], ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], eax
jmp 0x451b5d
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x94], 0x1d925b0e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x451b4a
mov dword [esp + 0x18], eax
jmp 0x451b7a
mov ecx, dword [esp + 0x18]
cmp dword [esp + ecx*4 + 0x94], eax
jne 0x451b80
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x451b69
inc dword [esp + 0x24]
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xffffffea
jg 0x451b30
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x451baf
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
push esi
lea ecx, [esp + 0x9c]
call fcn.0041796c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0
jmp 0x451be0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0x9f9b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x451bca
mov dword [esp + 0x1c], 0
jmp 0x451c00
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x64], 0x7a9413e4
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x451bf0
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], 0
jl 0x451cc9
mov edi, dword [esp + 0x98]
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], 1
mov dword [esp + 0x24], 0xfffffff9
mov dword [esp + 0x34], 8
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
xor eax, eax
cmp dword [edi + 4], 0xd45b0e82
push 2
setne al
xor edx, edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
imul ecx, dword [esp + 0x1c], 0x3dda
mov eax, dword [esp + 0x9c]
cmp ecx, dword [eax]
setle dl
mov dword [esp + 0x28], edx
xor edx, edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x68]
cmp ecx, eax
setg dl
sub edx, 0x22a19820
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x28], edx
mov esi, dword [esp + 0x1c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
sub edx, 3
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x9c]
setne cl
add ecx, dword [eax + esi*4]
imul ecx, dword [edi + 4]
pop esi
mov dword [esp + 0x64], ecx
dec dword [esp + 0x18]
jns 0x451c1c
xor edi, edi
inc edi
lea ecx, [esp + 0x98]
call fcn.00417a3e
mov dword [esp + 0x20], 5
xor eax, eax
mov dword [esp + 0x34], 0xcf5
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], al
je 0x451d2f
push 0x1bee
push 0x2fd
push 0x604
push 0xe0a
push 0x963
push 0x1fe7
push 0x2043
push 0x1421
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Arc]
xor eax, eax
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x451d52
push eax
push 0x19c5
push eax
push eax
push 0x1948
push 0x2156
call dword [sym.imp.USER32.dll_ToAsciiEx]
push esi
lea ecx, [esp + 0xec]
call fcn.0041796c
push 4
pop ebx
mov dword [esp + 0xc], 0
lea ecx, [esp + 0x88]
mov dword [esp + 0x10], 0x3061ece3
push ebx
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x18], 9
mov dword [esp + 0x38], eax
mov dword [esp + 0x1c], eax
jmp 0x451da3
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x4c], 0x8ec0ae97
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x451d93
mov dword [esp + 0x1c], eax
jmp 0x451dc5
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x88]
mov dword [ecx + edx*4], 0xfa017779
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jl 0x451daf
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], eax
jl 0x451ebe
mov esi, dword [esp + 0x88]
push dword [esp + 0x68]
movdqa xmm0, xmmword [0xa6cc90]
lea ecx, [esp + 0x18c]
push ecx
lea ecx, [esp + 0x180]
mov dword [esp + 0x30], eax
push ecx
push eax
lea ecx, [esp + 0xd8]
mov dword [esp + 0xd8], eax
movdqu xmmword [esp + 0x188], xmm0
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
call fcn.00419199
mov dword [esp + 0x30], 0x6eab
xor ecx, ecx
mov eax, dword [esp + 0xc]
dec dword [esp + 0x30]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp eax, 0xffffffff
setle cl
xor eax, eax
add ecx, dword [esp + 0xc]
cmp ecx, dword [esi + 0xc]
mov ecx, dword [esp + 0xc]
setle al
imul ecx, eax
add ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x4c]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, 9
sbb eax, eax
neg eax
sub edx, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x28]
add eax, edx
xor edx, edx
cmp ecx, eax
lea ecx, [esp + 0xc8]
sete dl
add edx, dword [esp + 0x28]
mov dword [esi + 4], edx
call fcn.00417a3e
dec dword [esp + 0xc]
push 0
pop eax
jns 0x451de0
or ecx, 0xffffffff
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], 8
je 0x451f8c
mov edi, dword [esp + 0x88]
mov dword [esp + 0x24], 9
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x38]
dec edx
neg edx
sbb edx, edx
neg edx
sub edx, dword [esp + 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [edi + 8], edx
mov edx, dword [esp + 0x18]
setge cl
xor ebx, ebx
imul edx, ecx
mov ecx, dword [esp + 0x88]
mov dword [ecx], edx
mov ecx, dword [esp + 0x4c]
cmp edx, ecx
mov ecx, dword [esp + 0x4c]
setl bl
sub ebx, ecx
jne 0x451f3c
cmp dword [esp + 0x24], eax
jne 0x451f3c
mov esi, eax
jmp 0x451f3f
xor esi, esi
inc esi
xor edx, edx
mov dword [esp + 0xc], 0xfffffffb
mov ecx, dword [esp + 0xc]
cmp ecx, 0x22781501
mov ecx, dword [esp + 0x38]
setl dl
xor ebx, ebx
cmp edx, esi
setl bl
xor edx, edx
cmp ecx, ebx
setne dl
sub edx, 0xb643e267
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x10], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 8
jne 0x451ed7
xor edi, edi
push 4
inc edi
pop ebx
lea ecx, [esp + 0x88]
call fcn.00417a3e
mov dword [esp + 0x2c], 0xfffffff7
lea ecx, [esp + 0xd4]
push ebx
call fcn.0041796c
mov dword [esp + 0x18], 0x1ca2961c
xor eax, eax
mov dword [esp + 0x34], 0x1e6e2bfb
mov dword [esp + 0x30], 0xfffffff6
mov dword [esp + 0x10], eax
jmp 0x451fe3
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xd4]
mov dword [ecx + edx*4], 0x837b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x451fcd
mov ecx, dword [esp + 0xd4]
mov edx, dword [ecx + 0xc]
add edx, dword [ecx]
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], 0x14
jmp 0x452075
mov dword [esp + 0x10], 0xd2f3
mov dword [esp + 0x38], 5
mov dword [esp + 0x34], eax
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x45202b
push eax
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
xor eax, eax
inc dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x38], ecx
cmp dword [esp + 0x10], eax
jne 0x452056
mov ecx, dword [esp + 0xd4]
mov ecx, dword [ecx]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
xor ebx, ebx
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
cmp ecx, edx
setle bl
mov dword [esp + 0x34], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x15
jl 0x452003
lea ecx, [esp + 0xd4]
call fcn.00417a3e
push 2
mov dword [esp + 0x14], 0
pop esi
jmp 0x4520a8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x452095
cmp dword [esp + 0x20], 0
jne 0x4520ff
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0xe8]
setle dl
imul ecx, edx, 0xdec9
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x20]
cmp eax, edi
setl dl
xor ecx, ecx
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
shl edx, 3
cmp edx, eax
mov eax, dword [esp + 0x20]
setne cl
xor edx, edx
imul ecx, ecx, 0xfffffffd
cmp ecx, eax
mov eax, dword [esp + 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, 0xc769
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], 0xfffffff9
cmp dword [esp + 0x20], 0x22
jg 0x4525a0
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor ebx, ebx
inc ebx
push esi
lea ecx, [esp + 0x110]
call fcn.0041796c
mov dword [esp + 0x18], 0xc08901f2
xor eax, eax
mov dword [esp + 0x34], 0x5467
mov dword [esp + 0x10], eax
jmp 0x45219f
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10c]
mov dword [ecx + edx*4], 0xfffc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x452189
mov dword [esp + 0x18], eax
jmp 0x4521ef
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x4521c9
push 0x1bc0
push eax
push 0xc96
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor eax, eax
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x4521eb
push eax
push eax
push 0x4c3
push 0x13a
call edi
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
xor eax, eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x4521ab
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10c]
mov edx, dword [eax + 4]
mov eax, edx
neg eax
cmp edx, eax
sete cl
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x10c]
call fcn.00417a3e
push 4
pop eax
mov dword [esp + 0x28], 0x2235
lea ecx, [esp + 0x130]
mov dword [esp + 0x3c], 0xc1846e97
mov dword [esp + 0xc], ebx
push eax
call fcn.0041796c
mov dword [esp + 0x24], 0
lea ecx, [esp + 0x16c]
mov dword [esp + 0x38], ebx
push ebx
call fcn.0041796c
xor eax, eax
push 4
mov dword [esp + 0x20], eax
pop ecx
cmp dword [esp + 0x1c], ecx
jge 0x45228f
push ecx
pop esi
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x130]
mov dword [ecx + edx*4], 0x55248722
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x452270
push 2
pop esi
mov dword [esp + 0x1c], eax
jmp 0x4522a7
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x16c]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jl 0x452295
mov dword [esp + 0xc], eax
jmp 0x4522bd
cmp dword [esp + 0xc], eax
jne 0x4522c4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x18
jl 0x4522b3
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setge cl
xor edx, edx
cmp eax, ecx
setne dl
sub edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
neg edx
mov eax, dword [esp + 0x130]
sbb edx, edx
inc edx
imul ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax + 8], ecx
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, ebx
setg cl
cmp ecx, 9
sbb eax, eax
add eax, 0xfffffff9
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x24]
sub ecx, eax
sub ecx, dword [esp + 0x38]
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x16c]
call fcn.00417a3e
lea ecx, [esp + 0x130]
call fcn.00417a3e
mov dword [esp + 0xc], ebx
xor eax, eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0xfffffffd
mov dword [esp + 0x24], 0xd9751230
mov dword [esp + 0x24], 7
mov dword [esp + 0x24], 0xf3f07903
mov dword [esp + 0x34], 0xf2ba10f4
mov dword [esp + 0x10], eax
jmp 0x4523a0
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x164], 0xa6d7d045
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x45238d
mov esi, ebx
cmp dword [esp + 0xc], eax
jne 0x4523b0
mov esi, eax
mov ecx, dword [esp + 0xc]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0xc]
setl dl
add ecx, edx
mov edx, ebx
sub ecx, dword [esp + 0xc]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
sub edx, ecx
xor ecx, ecx
cmp edx, 0x91c8
setne cl
or edx, 0xffffffff
cmp edx, ecx
mov ecx, dword [esp + 0xc]
sbb edx, edx
neg edx
imul ecx, edx
neg ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0xc]
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
sub esi, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp esi, ecx
setge dl
mov dword [esp + 0x168], edx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
add ecx, 0xe35
mov dword [esp + 0x24], ecx
mov esi, dword [esp + 0x24]
sub esi, dword [esp + 0xc]
neg esi
sbb esi, esi
xor edx, edx
neg esi
sub esi, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp ecx, 0x307d7c11
setge dl
xor ecx, ecx
cmp edx, esi
setne cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0xc]
jle 0x452478
mov ecx, eax
cmp dword [esp + 0xc], eax
je 0x45247a
mov ecx, ebx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0xc]
jge 0x452490
mov ecx, eax
cmp dword [esp + 0x30], eax
je 0x452492
mov ecx, ebx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], eax
jmp 0x4524af
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x188], 0x9f33d48
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x45249c
or ecx, 0xffffffff
push 2
mov dword [esp + 0x34], ecx
mov dword [esp + 0x14], eax
pop esi
jmp 0x4524d5
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1a0], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4524c6
mov dword [esp + 0x30], ebx
cmp dword [esp + 0x30], eax
jl 0x452522
mov dword [esp + 0x24], 0x210b999f
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x452518
push eax
push eax
push eax
push 0x1ae9
push 0xd15
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
xor eax, eax
dec dword [esp + 0x24]
dec dword [esp + 0x30]
jns 0x4524e5
cmp dword [esp + 0x2c], eax
je 0x45255d
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x3c], eax
jne 0x45253a
mov edx, eax
cmp dword [esp + 0x28], eax
je 0x45253c
mov edx, ebx
mov ecx, dword [esp + 0x20]
xor ebx, ebx
cmp edx, ecx
mov ecx, dword [esp + 0x28]
setge bl
xor edx, edx
cmp ebx, ecx
setne dl
xor ebx, ebx
inc ebx
cmp dword [esp + 0x20], edx
jg 0x45255d
mov eax, ebx
xor ecx, ecx
cmp eax, 0x585c2c1
mov eax, dword [esp + 0x28]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [esp + 0x188], edx
mov eax, dword [esp + 0x3c]
sub edx, eax
mov eax, dword [esp + 0x20]
cmp edx, eax
setne cl
mov dword [esp + 0x2c], ecx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x22
jle 0x452164
xor edi, edi
inc edi
lea ecx, [esp + 0xe8]
call fcn.00417a3e
push dword [esp + 0x50]
lea eax, [esp + 0x4f]
push eax
push dword [esp + 0x4c]
push 0
call fcn.004533a2
add esp, 0x10
lea ecx, [esp + 0x100]
push esi
call fcn.0041796c
mov dword [esp + 0x10], 0
jmp 0x4525f0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0xdf99ff60
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4525da
mov eax, dword [esp + 0x100]
lea ecx, [esp + 0x100]
and dword [eax + 4], 0
call fcn.00417a3e
mov dword [esp + 0x24], 0x5664
lea ecx, [esp + 0xf4]
mov dword [esp + 0x28], 0x4fc2285f
mov eax, 0x7412df3d
mov dword [esp + 0x30], 0xf5872d9
mov dword [esp + 0x54], eax
mov dword [esp + 0x58], eax
mov dword [esp + 0x5c], eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x2c], 0xa5eafb5d
push 3
call fcn.0041796c
push edi
lea ecx, [esp + 0xa8]
call fcn.0041796c
mov dword [esp + 0x44], 0xb167
lea ecx, [esp + 0x158]
mov dword [esp + 0x3c], 0xe43c7d75
mov dword [esp + 0x1c], 0x17c927db
mov dword [esp + 0x50], 0xf09d89c1
mov dword [esp + 0x38], 0x75688afc
mov dword [esp + 0xc], 7
mov dword [esp + 0x34], 0xc45603fb
push edi
call fcn.0041796c
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x4526b9
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0xe0], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x4526aa
mov dword [esp + 0x20], eax
jmp 0x4526db
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0xf4]
mov dword [ecx + edx*4], 0xe13f
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x4526c5
mov dword [esp + 0x20], eax
jmp 0x4526fe
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0xa4]
mov dword [ecx + edx*4], 0xffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x4526e8
mov dword [esp + 0x20], eax
jmp 0x45271c
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x158]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x45270a
mov ecx, dword [esp + 0xa4]
push 4
pop edx
dec dword [ecx]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x58]
mov dword [esp + 0xe4], ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x58]
mov ecx, dword [esp + 0x60]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x54]
mov ecx, dword [esp + 0xa4]
mov ecx, dword [ecx]
add ecx, 0xd29be1d9
mov dword [esp + 0x60], ecx
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x3c], ecx
cmp dword [esp + 0x3c], eax
je 0x4527d7
mov ecx, dword [esp + 0xa4]
cmp dword [ecx], eax
je 0x45278e
mov edx, edi
cmp dword [esp + 0x50], eax
jne 0x452790
mov edx, eax
mov ecx, dword [esp + 0x2c]
xor ebx, ebx
cmp ecx, edx
mov ecx, dword [esp + 0x30]
setge bl
xor edx, edx
cmp ebx, ecx
setl dl
xor ecx, ecx
cmp edx, edi
mov edx, 0xc116104d
setge cl
add ecx, dword [esp + 0x1c]
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x54], ecx
je 0x4527c9
mov ecx, edi
cmp dword [esp + 0x2c], eax
jne 0x4527cb
mov ecx, eax
mov dword [esp + 0x28], ecx
mov ecx, edi
cmp dword [esp + 0x28], eax
jne 0x4527d9
mov ecx, eax
imul ecx, ecx, 0xffff
test ecx, ecx
je 0x452886
push esi
lea ecx, [esp + 0x128]
call fcn.0041796c
mov dword [esp + 0x1c], 0
cmp dword [esp + 0x1c], esi
jge 0x45281d
push 4
pop edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x452805
mov dword [esp + 0x1c], 0
jmp 0x452837
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x68], 9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x452827
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0xf4]
mov edx, dword [esp + 0x28]
sub edx, dword [eax + 8]
mov eax, dword [esp + 0x124]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax], 0x68f781be
setg cl
xor eax, eax
cmp edx, ecx
lea ecx, [esp + 0x124]
setle al
mov dword [esp + 0x68], eax
dec dword [esp + 0x38]
call fcn.00417a3e
jmp 0x452935
mov dword [esp + 0x18], 0x128c85c7
mov dword [esp + 0x24], 0x89d53c4a
mov dword [esp + 0x44], 0xc5b2e90e
mov dword [esp + 0x10], eax
jmp 0x4528b7
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xbc], 0xdfbf73ec
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x4528a4
mov dword [esp + 0xc4], 5
mov ecx, dword [esp + 0x18]
dec dword [esp + 0x18]
test ecx, ecx
jne 0x4528e8
mov ecx, dword [esp + 0xc0]
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
mov esi, 0xf1df
mov ecx, dword [esp + 0x58]
xor edx, edx
mov ecx, dword [esp + 0xc4]
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
sub esi, ecx
mov ecx, dword [esp + 0x28]
cmp esi, ecx
setge dl
mov dword [esp + 0x60], edx
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0xe4], edi
jl 0x452931
cmp dword [esp + 0x18], eax
je 0x452931
mov eax, edi
mov dword [esp + 0x44], eax
lea ecx, [esp + 0x158]
call fcn.00417a3e
lea ecx, [esp + 0xa4]
call fcn.00417a3e
lea ecx, [esp + 0xf4]
call fcn.00417a3e
mov dword [esp + 0x18], 0x6df37d45
lea ecx, [esp + 0x118]
mov dword [esp + 0x24], 0
push 3
call fcn.0041796c
mov dword [esp + 0x24], 0xdca27289
or eax, 0xffffffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x44], eax
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4529b0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x118]
mov dword [ecx + edx*4], 0xf58
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x45299a
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], al
je 0x4529d5
push eax
push eax
push eax
push eax
push 0x1f26
push edi
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
imul esi, eax
dec edx
mov eax, dword [esp + 0x118]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [eax], esi
mov eax, dword [esp + 0x18]
cmp edx, eax
setl cl
xor edx, edx
imul eax, ecx, 0x2524
sub eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov ecx, dword [esp + 0x24]
setg dl
xor ebx, ebx
cmp edx, esi
setne bl
sub ecx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ebx, ecx
lea ecx, [esp + 0x118]
setle al
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x44], eax
call fcn.00417a3e
mov al, byte [esp + 0x4b]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret