Function at 0x473edb
Capabilities:
Get file attributes
Get memory capacity
Query environment variable
Set thread local storage value
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x340
and dword [esp + 0x84], 0
push esi
push edi
mov dword [esp + 0x44], ecx
mov edi, edx
mov dword [esp + 0x10], 0x34fda0e6
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x2c], 0
push 2
mov dword [esp + 0x38], edi
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], eax
jmp 0x473f3b
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c0]
mov dword [ecx + edx*4], 0x836b16b4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x473f25
cmp dword [esp + 0x10], 0xca4f
push 3
pop esi
jl 0x473f8e
mov dword [esp + 0x14], eax
jmp 0x473f68
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x28c], 7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x473f55
mov dword [esp + 0x10], eax
jmp 0x473f85
mov ecx, dword [esp + 0x10]
cmp dword [esp + ecx*4 + 0x28c], eax
jne 0x473fa5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x473f74
jmp 0x473fa5
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x473fa5
push eax
push 0x1228
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c0]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x10]
cmp edx, eax
sete cl
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x1c0]
call fcn.004014ce
mov dword [esp + 0x10], 0x26bdde0b
xor eax, eax
mov dword [esp + 0x18], 0xb8fa48a2
mov dword [esp + 0x2c], 0xfffd
mov dword [esp + 0x20], 0x31eaa473
mov dword [esp + 0x14], eax
jmp 0x47400e
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x64], 0x7a329ef
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x473ffe
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0xffffffef
jge 0x474146
mov dword [esp + 0x3c], 0x6318d581
lea ecx, [esp + 0x114]
mov dword [esp + 0x1c], 0x1720348f
mov dword [esp + 0x24], 0xfffffff9
mov dword [esp + 0x24], 0x8e10e5e5
mov dword [esp + 0x28], 0xbc248910
push 2
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x14], eax
jmp 0x474077
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x114]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x474065
cmp dword [esp + 0x3c], eax
jne 0x474138
dec dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
neg ecx
cmp ecx, 0x992db756
mov ecx, dword [esp + 0x68]
mov edx, dword [esp + 0x114]
sbb esi, esi
neg esi
imul esi, ecx
xor ecx, ecx
cmp esi, dword [edx + 4]
mov dword [esp + 0x64], esi
setge cl
mov dword [edx + 4], ecx
mov ecx, dword [esp + 0x64]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setle dl
mov dword [esp + 0x28], edx
xor edx, edx
mov ecx, dword [esp + 0x1c]
cmp ecx, 0xfffffff7
setle dl
imul ecx, edx, 0x8642
test ecx, ecx
jne 0x4740f1
cmp dword [esp + 0x38], eax
je 0x474104
cmp dword [esp + 0x64], eax
je 0x474104
cmp dword [esp + 0x3c], eax
je 0x474104
xor eax, eax
lea edx, [eax + 1]
jmp 0x474106
mov edx, eax
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
setl cl
lea eax, [ecx - 0x55d48264]
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x114]
call fcn.004014ce
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffef
jl 0x474023
jmp 0x474144
lea ecx, [esp + 0x114]
call fcn.004014ce
xor eax, eax
mov ecx, dword [esp + 0x6c]
xor edx, edx
add ecx, dword [esp + 0x20]
imul ecx, ecx, 0xa716
cmp ecx, 0xe9140de1
setne dl
xor ecx, ecx
test edx, edx
setle cl
xor edx, edx
inc edx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x68]
cmp edx, ecx
mov ecx, dword [esp + 0x2c]
sbb esi, esi
xor edx, edx
inc esi
imul esi, dword [esp + 0x38]
cmp ecx, esi
setge dl
imul ecx, edx, 0x4b1f
test ecx, ecx
je 0x4742ae
mov dword [esp + 0x28], 0x4961
xor esi, esi
mov dword [esp + 0x30], 0xcbfc796d
inc esi
mov dword [esp + 0x24], 5
mov dword [esp + 0x18], 0xfffffff8
jmp 0x4742a1
mov dword [esp + 0x1c], 6
mov dword [esp + 0x14], 0x316a37a5
mov dword [esp + 0x3c], 0x8b7cb4d6
cmp dword [esp + 0x20], eax
jne 0x474297
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [esp + 0x64]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
cmp ecx, 0xffffffff
push 0
setg dl
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x20]
add ecx, 0x45bd2804
mov dword [esp + 0x40], ecx
mov edx, dword [esp + 0x68]
mov ecx, dword [esp + 0x30]
cmp ecx, edx
pop ecx
setg cl
xor edx, edx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x3c]
cmp dword [esp + 0x38], ecx
setge dl
xor ecx, ecx
cmp edx, 0x2819
setge cl
xor edx, edx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x38], ecx
setg dl
sub edx, dword [esp + 0x24]
add edx, dword [esp + 0x68]
mov ecx, dword [esp + 0x1c]
cmp edx, 0xc51c80f8
sbb edx, edx
neg edx
add ecx, edx
je 0x474273
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x3c], eax
jne 0x474286
cmp dword [esp + 0x28], eax
jne 0x474286
xor esi, esi
mov ecx, eax
inc esi
jmp 0x47428b
xor esi, esi
inc esi
mov ecx, esi
imul ecx, ecx, 0xffd6
test ecx, ecx
mov ecx, eax
je 0x474299
mov ecx, esi
mov dword [esp + 0x64], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 9
jg 0x4741bc
jmp 0x4742c4
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x4742c1
push eax
push eax
call dword [sym.imp.GDI32.dll_RectInRegion]
xor esi, esi
inc esi
mov eax, dword [0xa77ba0]
test al, 1
jne 0x474351
or eax, esi
mov dword [0xa77ba0], eax
xor eax, eax
push eax
push eax
mov dword [0xa77b80], eax
mov dword [0xa77b84], eax
call fcn.0042261d
mov ecx, eax
mov dword [0xa77b9c], 0x3f800000
mov dword [0xa77b80], ecx
xor eax, eax
mov dword [esp + 0xd4], ecx
lea ecx, [esp + 0xd4]
push ecx
push 0x10
push eax
mov dword [0xa77b88], eax
mov ecx, 0xa77b88
mov dword [0xa77b90], eax
mov dword [0xa77b8c], eax
lea eax, [esp + 0x258]
push eax
call fcn.004223c2
push 0x483880
mov dword [0xa77b94], 7
mov dword [0xa77b98], 8
call fcn.0047741f
pop ecx
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], 8
mov dword [esp + 0x18], 0xfffffffb
jmp 0x47441c
xor eax, eax
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x14], eax
jmp 0x47438a
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x54], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x47437a
cmp dword [esp + 0x18], eax
je 0x4743ba
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x54]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x54]
cmp dword [esp + 0x54], eax
je 0x474401
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], eax
je 0x4743d6
cmp dword [esp + 0x18], eax
jne 0x474427
jmp 0x474418
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], eax
jl 0x474418
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x4743f9
push eax
push 0x2c6
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
xor eax, eax
dec dword [esp + 0x1c]
jns 0x4743e0
jmp 0x474418
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x474418
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe7
je 0x47436a
imul eax, dword [esp + 0x44], 0x2710
add eax, edi
mov dword [esp + 0x90], eax
mov dword [esp + 0x14], 0x1f7e2799
mov dword [esp + 0x14], 0xfffffffe
jmp 0x474476
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x47445e
push 0
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x474472
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xd
jl 0x47444a
lea eax, [esp + 0x90]
push eax
call fcn.0047659e
mov edi, dword [eax]
xor eax, eax
mov dword [esp + 0x18], 0x32a27689
mov dword [esp + 0x30], edi
mov dword [esp + 0x14], eax
jmp 0x4744b3
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0xec], 0x1353
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x4744a0
mov dword [esp + 0x18], eax
jmp 0x4745a1
mov dword [esp + 0x10], 0x5010f7a7
mov dword [esp + 0x10], 3
cmp dword [esp + 0x10], eax
jl 0x47459d
mov dword [esp + 0x24], 7
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xec]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
neg esi
push 0
sbb esi, esi
xor edx, edx
neg esi
mov ecx, dword [esp + ecx*4 + 0xf0]
cmp esi, ecx
mov ecx, dword [esp + 0x14]
setle dl
cmp edx, ecx
pop ecx
setg cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + ecx*4 + 0xec]
cmp ecx, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, 0x4c26
setle cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x24]
add esi, dword [esp + ecx*4 + 0xec]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + ecx*4 + 0xec]
cmp esi, ecx
setg dl
xor ecx, ecx
cmp edx, 0xfffffff9
setle cl
xor esi, esi
xor edx, edx
inc esi
cmp ecx, esi
mov ecx, dword [esp + 0x18]
setge dl
inc edx
mov ecx, dword [esp + ecx*4 + 0xec]
mov dword [esp + 0x24], edx
xor edx, edx
cmp ecx, dword [esp + 0x24]
setne dl
mov dword [esp + 0x24], edx
dec dword [esp + 0x10]
jns 0x4744dd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x4744c3
mov ecx, dword [esp + 0xec]
mov dword [esp + 0x18], ecx
test edi, edi
je 0x474971
mov dword [esp + 0x18], 0x2971c1ec
lea ecx, [esp + 0xfc]
mov dword [esp + 0x20], 0xb8114768
push 3
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x1c], 0xf4d21fd0
mov dword [esp + 0x14], eax
jmp 0x4745ff
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xfc]
mov dword [ecx + edx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x4745ed
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
push 0
pop ecx
setg cl
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], 0xd
cmp dword [esp + 0x18], 0x2e
jne 0x474928
xor edi, edi
inc edi
mov dword [esp + 0x24], 9
mov dword [esp + 0x20], eax
jmp 0x47464e
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x48], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x47463e
mov dword [esp + 0x20], eax
jmp 0x47466e
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x94], 0x396434d1
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x47465b
mov dword [esp + 0x20], 2
cmp dword [esp + 0x20], eax
jl 0x474810
mov esi, dword [esp + 0xfc]
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x16c]
mov dword [esp + 0x28], 0xe264
push 3
call fcn.004013fc
push edi
lea ecx, [esp + 0x1a0]
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], eax
jmp 0x4746d7
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x16c]
mov dword [ecx + edx*4], 0xfa7bb34e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x4746c1
mov dword [esp + 0x10], eax
jmp 0x4746f6
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x19c]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4746e4
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x474715
push 0xb96
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov ecx, dword [esp + 0x20]
push 0
mov ecx, dword [esp + ecx*4 + 0x4c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + ecx*4 + 0x4c]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x1c]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
cmp edx, 0xd47cdd53
mov edx, 0x6910c334
sbb ecx, ecx
neg ecx
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x170]
mov dword [ecx + 8], edx
mov ecx, dword [esp + 0x24]
sub edx, ecx
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
mov ecx, dword [esp + 0x24]
pop edx
setle dl
add edx, dword [esp + ecx*4 + 0x48]
je 0x47479c
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + ecx*4 + 0x48]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
mov ecx, dword [esp + 0x9c]
cmp dword [esp + 0x1c], eax
jne 0x4747c2
cmp dword [esp + 0x9c], eax
je 0x4747c4
mov eax, edi
xor ecx, ecx
cmp eax, edi
mov eax, dword [esp + 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x19c]
setle dl
xor ecx, ecx
cmp edx, 2
setl cl
sub ecx, dword [eax]
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x19c]
call fcn.004014ce
lea ecx, [esp + 0x16c]
call fcn.004014ce
dec dword [esp + 0x20]
push 0
pop eax
jns 0x47468e
mov dword [esp + 0x1c], 0xffffffec
jmp 0x47490a
mov dword [esp + 0x14], eax
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x474835
push eax
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
xor eax, eax
mov dword [esp + 0x20], 0xfffffff8
jmp 0x4748fb
mov dword [esp + 0x10], 8
mov dword [esp + 0x28], edi
cmp dword [esp + 0x10], eax
jne 0x474906
cmp dword [esp + 0x9c], eax
jne 0x4748a3
cmp dword [esp + 0x4c], eax
jne 0x47486b
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x10], edi
je 0x474875
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xfc]
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x50]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [esp + 0x18]
test ecx, ecx
sets dl
sub edx, dword [esp + 0x9c]
je 0x4748c3
mov esi, edi
cmp dword [esp + 0x10], eax
jne 0x4748c5
mov esi, eax
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp esi, ecx
setne dl
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x9c]
mov ecx, dword [esp + 0x9c]
add edx, ecx
mov ecx, dword [esp + 0x9c]
add ecx, edx
mov edx, dword [esp + 0x28]
add edx, ecx
mov dword [esp + 0x24], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x18
jge 0x474842
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x35
je 0x47481d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x2e
je 0x474630
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0xfc]
call fcn.004014ce
mov dword [esp + 0x24], 0xdf1f
mov dword [esp + 0x34], 0x6c37fc05
mov eax, dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0xc8], edi
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x4764d2
push eax
push 0x2174
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
jmp 0x4764d2
mov ecx, dword [0xa77ba0]
push 2
pop esi
test cl, 2
jne 0x474a04
push eax
or ecx, esi
mov dword [0xa77bb0], eax
push eax
mov dword [0xa77ba0], ecx
mov dword [0xa77bb4], eax
call fcn.0042261d
mov ecx, eax
mov dword [0xa77bcc], 0x3f800000
mov dword [0xa77bb0], ecx
xor eax, eax
mov dword [esp + 0xe4], ecx
lea ecx, [esp + 0xe4]
push ecx
push 0x10
push eax
mov dword [0xa77bb8], eax
mov ecx, 0xa77bb8
mov dword [0xa77bc0], eax
mov dword [0xa77bbc], eax
lea eax, [esp + 0x21c]
push eax
call fcn.004223c2
push 0x48387b
mov dword [0xa77bc4], 7
mov dword [0xa77bc8], 8
call fcn.0047741f
pop ecx
xor eax, eax
mov dword [esp + 0x14], 0x87df2f4a
mov dword [esp + 0x10], eax
jmp 0x474a25
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x30c], 0x6801fc3e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x474a12
xor edi, edi
mov dword [esp + 0x10], eax
inc edi
jmp 0x474a48
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x22c], 0xd26ec17e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x474a35
mov dword [esp + 0x14], 0xcff0ea75
mov dword [esp + 0x14], 7
cmp dword [esp + 0x14], 0x15
jge 0x474b99
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x214]
mov dword [esp + 0x24], 4
mov dword [esp + 0x24], 9
push 3
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x474aa9
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x214]
mov dword [ecx + edx*4], 0x407858f9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x474a93
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], eax
jl 0x474b68
mov dword [esp + 0x24], 0x7d373ee7
mov dword [esp + 0x24], 0x4ffd8143
mov dword [esp + 0x24], 0xb5e4
mov dword [esp + 0x1c], 0xde574131
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], 0x46b51f0e
mov dword [esp + 0x10], eax
jmp 0x474b03
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xe8], 0x874b28e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x474af0
mov dword [esp + 0x10], eax
jmp 0x474b22
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x2e0], 0x5537c57f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x474b0f
dec dword [esp + 0x28]
mov dword [esp + 0x1c], eax
jmp 0x474b58
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x474b54
push 0x2682
push 0x74b
push 0x1983
call dword [sym.imp.KERNEL32.dll_MulDiv]
xor eax, eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x474b32
dec dword [esp + 0x18]
jns 0x474abe
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x474b7b
push eax
push eax
call dword [sym.imp.GDI32.dll_RectInRegion]
lea ecx, [esp + 0x214]
call fcn.004014ce
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x15
push 0
pop eax
jl 0x474a69
xorps xmm0, xmm0
movdqu xmmword [esp + 0xb8], xmm0
mov dword [esp + 0x24], 0xfd41e559
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x474bc3
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
xor eax, eax
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x474bdf
push 0x150c
push 0x127d
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
lea eax, [esp + 0x44]
push eax
call fcn.00476600
push 2
lea ecx, [esp + 0x234]
mov esi, dword [eax]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x2c], 0x36745799
mov dword [esp + 0x18], 0xe360de57
mov dword [esp + 0x14], 9
mov dword [esp + 0x2c], edi
mov dword [esp + 0x2c], 0x57f39cee
mov dword [esp + 0x28], 0xdc0f1fa6
mov dword [esp + 0x40], esi
call fcn.004013fc
mov dword [esp + 0x10], 0
jmp 0x474c51
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x230]
mov dword [eax + ecx*4], 0x781b5f7a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x474c3b
mov eax, dword [esp + 0x1c]
xor ecx, ecx
test eax, eax
setle cl
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x28]
neg edx
sbb edx, edx
neg edx
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x1c], edi
jg 0x474cd2
cmp dword [esp + 0x10], 0
jne 0x474cd2
xor eax, eax
jmp 0x474cd4
mov eax, edi
lea ecx, [esp + 0x230]
mov dword [esp + 0x24], eax
call fcn.004014ce
cmp byte [ebp + 0xc], 0
jne 0x474cf2
test esi, esi
jne 0x475dc3
push dword [esp + 0xe8]
movdqa xmm0, xmmword [0xa75600]
lea ecx, [esp + 0x274]
push ecx
xor eax, eax
mov dword [esp + 0x28], 0xfffffff9
lea ecx, [esp + 0x268]
mov dword [esp + 0x34], 0xfffffff8
push ecx
mov dword [esp + 0x44], 0xffffffff
lea ecx, [esp + 0x7c]
mov dword [esp + 0x24], 0x25b0d6b1
push eax
movdqu xmmword [esp + 0x270], xmm0
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
call fcn.0040191b
xor eax, eax
mov dword [esp + 0x1c], 0xfffffffd
push 3
mov dword [esp + 0x14], eax
pop esi
jmp 0x474d81
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x298], 0x38a8812e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x474d6e
mov dword [esp + 0x10], eax
jmp 0x474da0
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x2a4], 0x53ceb4b6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x474d8d
cmp dword [esp + 0x20], eax
je 0x474db8
mov ecx, dword [esp + 0x20]
mov edx, edi
mov ecx, dword [esp + 0x20]
jmp 0x474dba
mov edx, eax
xor ecx, ecx
cmp edx, 0x9271
sete cl
sub ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x20]
je 0x474e16
mov dword [esp + 0x30], 8
mov dword [esp + 0x24], 0x69a3
mov ecx, dword [esp + 0x24]
dec ecx
neg ecx
push 0
sbb ecx, ecx
xor edx, edx
inc ecx
cmp edx, ecx
mov ecx, dword [esp + 0x34]
sbb edx, edx
inc edx
cmp edx, ecx
pop ecx
setl cl
sub ecx, 4
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
jmp 0x474f6f
mov dword [esp + 0x14], 0xfffffffc
lea ecx, [esp + 0x108]
mov dword [esp + 0x28], eax
push esi
call fcn.004013fc
push 8
pop eax
mov dword [esp + 0x1cc], eax
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x1d8], eax
xor eax, eax
push 4
pop edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x10], eax
jmp 0x474e70
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1dc], 0xf6c0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x474e5d
mov dword [esp + 0x10], eax
jmp 0x474e92
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x108]
mov dword [ecx + edx*4], 0xa655
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x474e7c
cmp dword [esp + 0x14], eax
je 0x474ea2
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x1e4], 0xf7c9
jle 0x474eb7
mov esi, eax
cmp dword [esp + 0x14], eax
je 0x474eb9
mov esi, edi
mov ecx, dword [esp + 0x18]
xor edx, edx
cmp esi, ecx
setge dl
mov dword [esp + 0x28], edx
xor edx, edx
mov ecx, dword [esp + 0x1e4]
add ecx, dword [esp + 0x28]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x108]
mov esi, dword [ecx]
mov ecx, dword [esp + 0x70]
cmp esi, dword [ecx]
setle dl
xor ecx, ecx
cmp edx, esi
setne cl
xor edx, edx
cmp ecx, 0x7aac
sete dl
xor ecx, ecx
cmp edx, 0x18a3
setne cl
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1e4]
mov ecx, dword [esp + 0x1e4]
cmp dword [esp + 0x1c], eax
jne 0x474f32
mov ecx, dword [esp + 0x70]
mov edx, eax
cmp dword [ecx], eax
je 0x474f34
mov edx, edi
mov ecx, dword [esp + 0x108]
mov ecx, dword [ecx + 4]
imul ecx, edx
mov dword [esp + 0x1d0], ecx
mov dword [esp + 0x24], ecx
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x474f61
push 0x182e
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x108]
call fcn.004014ce
xor eax, eax
mov dword [esp + 0x18], 5
cmp dword [esp + 0x18], eax
je 0x474fe9
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x70]
push 0
add edx, dword [ecx]
mov ecx, dword [esp + 0x3c]
cmp edx, ecx
mov ecx, dword [esp + 0x74]
pop edx
setg dl
mov ecx, dword [ecx]
inc ecx
cmp ecx, edx
jle 0x474fa2
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [esp + 0x20]
jge 0x474fb3
mov ecx, dword [esp + 0x298]
mov ecx, dword [esp + 0x1c]
mov edx, edi
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
sub edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
mov ecx, dword [esp + 0x18]
cmp ecx, 0x61002f44
mov ecx, dword [esp + 0x70]
setle dl
sub edx, dword [ecx + 4]
neg edx
sbb edx, edx
neg edx
sub edx, dword [ecx]
je 0x474fe9
mov eax, edi
mov dword [esp + 0x2ac], eax
lea ecx, [esp + 0x70]
call fcn.004014ce
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x318]
mov ecx, dword [esp + 0x44]
push eax
call fcn.004617bb
mov esi, eax
lea edi, [esp + 0xbc]
xor eax, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x24], 0xed23b618
mov dword [esp + 0x24], 0x30722263
mov dword [esp + 0x14], eax
jmp 0x47504e
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x2f4], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x47503b
mov dword [esp + 0x14], eax
jmp 0x47506b
mov dword [esp + 0x28], 0xfffffffc
inc dword [esp + 0x28]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x47505b
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x47508c
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor eax, eax
xor edi, edi
inc edi
cmp byte [ebp + 0xc], 0
je 0x4752c9
cmp dword [esp + 0xc0], 0
je 0x4752c9
mov dword [esp + 0x10], 0xfffffffc
mov dword [esp + 0x1c], 0x9ba5f27a
mov dword [esp + 0x28], 0x966c4779
mov dword [esp + 0x14], eax
jmp 0x4750d5
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x40], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x4750c5
mov dword [esp + 0x10], eax
jmp 0x47521b
push 2
lea ecx, [esp + 0xdc]
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x24], 0xe01afec1
mov dword [esp + 0x14], eax
jmp 0x475118
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xd8]
mov dword [ecx + edx*4], 0xe80d68f9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x475102
mov ecx, dword [esp + 0x10]
cmp dword [esp + ecx*4 + 0x40], eax
je 0x47518d
cmp dword [esp + 0x40], eax
jne 0x47513b
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0xd8]
cmp dword [ecx], eax
jne 0x475152
mov ecx, dword [esp + 0x10]
mov esi, eax
cmp dword [esp + ecx*4 + 0x40], eax
je 0x475154
mov esi, edi
mov ecx, dword [esp + 0xd8]
xor edx, edx
cmp esi, dword [ecx + 4]
setge dl
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + ecx*4 + 0x40]
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x1c]
add ecx, 0x5526
add ecx, edx
xor edx, edx
cmp esi, ecx
mov ecx, edi
setge dl
cmp edx, 0xfffffffe
jl 0x47518f
mov ecx, eax
mov esi, dword [esp + 0xd8]
xor edx, edx
sub ecx, dword [esi + 4]
cmp ecx, dword [esi + 4]
setle dl
xor ecx, ecx
cmp edx, dword [esi + 4]
setl cl
xor edx, edx
mov dword [esp + 0x40], ecx
mov ecx, dword [esp + 0x40]
cmp ecx, dword [esi + 4]
setl dl
xor ecx, ecx
cmp edx, 0xffffffff
setle cl
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], 0xfffffff5
jmp 0x475202
mov dword [esp + 0x24], 0xa81f6ed7
xor edx, edx
mov ecx, dword [esp + 0x40]
cmp ecx, edi
mov ecx, dword [esp + 0x10]
setle dl
mov dword [esp + ecx*4 + 0x40], edx
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x4751fe
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor eax, eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffea
jg 0x4751cf
lea ecx, [esp + 0xd8]
call fcn.004014ce
inc dword [esp + 0x10]
xor eax, eax
cmp dword [esp + 0x10], eax
jle 0x4750e4
mov ecx, dword [esp + 0xc4]
mov dword [esp + 0x28], 0x1d9d65fe
mov dword [esp + 0x24], 0xae9714a0
mov dword [esp + 0x24], 0xfffffff9
mov dword [esp + 0x24], 6
mov dword [esp + 0x24], 0xf5cd53bc
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0x276b87d0
mov dword [esp + 0x24], 0x941fc9a5
mov dword [esp + 0x30], 0xd3f5047c
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x30], edi
mov dword [esp + 0xcc], ecx
mov dword [esp + 0x14], eax
jmp 0x4752a8
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x328], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x475295
dec dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0xc0]
mov dword [esp + 0xd0], eax
mov ecx, dword [esp + 0x3c]
test ecx, ecx
jne 0x475dc3
cmp dword [esp + 0xb8], ecx
jle 0x475dc3
push 2
lea ecx, [esp + 0x80]
call fcn.004013fc
mov dword [esp + 0x10], 0x6f393842
xor eax, eax
mov dword [esp + 0x1c], 0x3e2be8ca
mov dword [esp + 0x14], eax
jmp 0x47531b
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x7c]
mov dword [ecx + edx*4], 0x1824a8c6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x475308
mov ecx, dword [esp + 0x7c]
mov dword [ecx], eax
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], eax
jl 0x47542a
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x18], 0xd99275a8
mov dword [esp + 0x1c], eax
jmp 0x47535d
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x7c]
cmp dword [ecx + edx*4], eax
jne 0x475363
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x47534c
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
add ecx, dword [esp + 0x28]
je 0x475389
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x7c]
mov dword [ecx + edx*4], 0x1f04fecc
jmp 0x475420
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x18]
mov edi, dword [esp + 0x10]
sub edi, ecx
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x7c]
neg edi
sbb edi, edi
xor edx, edx
inc edi
cmp ecx, dword [esi]
setge dl
add edi, edx
mov dword [esp + 0x18], edi
cmp dword [esi], eax
jne 0x4753d4
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x7c]
cmp dword [ecx], eax
jne 0x4753d4
xor edi, edi
mov esi, eax
inc edi
jmp 0x4753d9
xor edi, edi
inc edi
mov esi, edi
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x7c]
sete dl
cmp edx, dword [ecx]
je 0x4753f4
mov ecx, eax
cmp dword [esp + 0x18], eax
je 0x4753f6
mov ecx, edi
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], 0x90218fcd
mov ecx, dword [esp + 0x10]
sbb edx, edx
inc edx
cmp edx, ecx
push 0
pop edx
setge dl
xor ecx, ecx
cmp edx, 0x2a8
setge cl
mov dword [esp + 0x24], ecx
dec dword [esp + 0x10]
jns 0x475336
lea ecx, [esp + 0x7c]
call fcn.004014ce
mov dword [esp + 0x24], 0xae9714a0
xor eax, eax
mov dword [esp + 0x24], 0xfffffff9
or edx, 0xffffffff
mov dword [esp + 0x24], 6
mov dword [esp + 0x24], 0xf5cd53bc
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0x276b87d0
mov dword [esp + 0x24], 0x941fc9a5
mov dword [esp + 0x30], 0xd3f5047c
mov dword [esp + 0x28], edx
push 4
mov dword [esp + 0x34], edi
mov dword [esp + 0x18], eax
pop esi
jmp 0x47549c
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x338], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x47548d
dec dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
jmp 0x4754c7
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x2bc], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x4754b8
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x4754e2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xor eax, eax
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], eax
jl 0x4755e5
push 2
lea ecx, [esp + 0x188]
call fcn.004013fc
mov dword [esp + 0x14], 0
jmp 0x475522
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x47550c
mov esi, dword [esp + 0x184]
and dword [esi + 4], 0
mov dword [esp + 0x1c], 0xf8067e3
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], 0
jl 0x4755bf
push edi
lea ecx, [esp + 0x14c]
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x475576
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x148]
mov dword [ecx + edx*4], 0xa1fa147b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x475560
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x475590
push eax
push eax
call dword [sym.imp.GDI32.dll_RectInRegion]
xor eax, eax
mov ecx, dword [esp + 0x148]
mov dword [ecx], eax
mov eax, dword [ecx]
inc dword [ecx]
cmp dword [ecx], 3
mov dword [esp + eax*4 + 0x2bc], 0xe3cf9575
jl 0x475599
lea ecx, [esp + 0x148]
call fcn.004014ce
dec dword [esp + 0x1c]
jns 0x47554b
inc dword [esi + 4]
cmp dword [esi + 4], 2
jle 0x475534
lea ecx, [esp + 0x184]
call fcn.004014ce
dec dword [esp + 0x10]
jns 0x4754f4
push 4
pop esi
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x220]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x30], 0xf3e76e5b
push edi
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x475624
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x220]
mov dword [ecx + edx*4], 0xfffffff9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x47560e
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x47563f
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x4756a3
mov dword [esp + 0x14], 0x64caf14c
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0x836b16b4
mov eax, dword [esp + 0x14]
sbb ecx, ecx
neg ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
setle dl
mov dword [esp + 0x30], edx
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x30]
setg dl
sub edx, dword [esp + 0x14]
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe6
je 0x475645
lea ecx, [esp + 0x220]
call fcn.004014ce
mov dword [esp + 0x18], 0x2971c1ec
lea ecx, [esp + 0x12c]
mov dword [esp + 0x20], 0xb8114768
push 3
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x1c], 0xf4d21fd0
mov dword [esp + 0x14], eax
jmp 0x4756f6
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x12c]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x4756e4
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp edx, ecx
push 0
pop ecx
setg cl
mov dword [esp + 0x20], ecx
mov dword [esp + 0x18], 0xd
cmp dword [esp + 0x18], 0x2e
jne 0x475a3a
mov edi, 0x6910c334
mov dword [esp + 0x24], 9
mov dword [esp + 0x10], eax
jmp 0x475747
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x58], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x475737
mov dword [esp + 0x10], eax
jmp 0x475767
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xac], 0x396434d1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x475754
mov dword [esp + 0x20], 2
cmp dword [esp + 0x20], eax
jl 0x475922
mov esi, dword [esp + 0x12c]
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x154]
mov dword [esp + 0x28], 0xe264
push 3
call fcn.004013fc
xor eax, eax
lea ecx, [esp + 0x1b4]
inc eax
push eax
call fcn.004013fc
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4757da
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x154]
mov dword [ecx + edx*4], 0xfa7bb34e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x4757c4
xor ecx, ecx
mov dword [esp + 0x10], eax
inc ecx
cmp dword [esp + 0x10], ecx
jge 0x47580d
xor esi, esi
inc esi
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1b4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4757f1
mov esi, dword [esp + 0x24]
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x475826
push 0xb96
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov ecx, dword [esp + 0x20]
push 0
mov ecx, dword [esp + ecx*4 + 0x5c]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + ecx*4 + 0x5c]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x64]
mov edx, dword [esp + 0x1c]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
cmp edx, 0xd47cdd53
mov edx, edi
sbb ecx, ecx
neg ecx
mov dword [esi + 4], ecx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x158]
mov dword [ecx + 8], edi
mov ecx, dword [esp + 0x24]
sub edx, ecx
mov ecx, dword [esp + 0x1c]
cmp edx, ecx
mov ecx, dword [esp + 0x24]
pop edx
setle dl
add edx, dword [esp + ecx*4 + 0x58]
je 0x4758aa
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + ecx*4 + 0x58]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
mov ecx, dword [esp + 0x58]
mov ecx, dword [esp + 0xb4]
cmp dword [esp + 0x1c], eax
jne 0x4758d0
cmp dword [esp + 0xb4], eax
je 0x4758d3
xor eax, eax
inc eax
xor edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [esp + 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1b4]
setle dl
xor ecx, ecx
cmp edx, 2
setl cl
sub ecx, dword [eax]
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x1b4]
call fcn.004014ce
lea ecx, [esp + 0x154]
call fcn.004014ce
dec dword [esp + 0x20]
push 0
pop eax
jns 0x47578b
mov dword [esp + 0x1c], 0xffffffec
jmp 0x475a1d
mov dword [esp + 0x14], eax
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x475947
push eax
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
xor eax, eax
mov dword [esp + 0x20], 0xfffffff8
jmp 0x475a0e
xor esi, esi
mov dword [esp + 0x10], 8
inc esi
mov dword [esp + 0x28], esi
cmp dword [esp + 0x10], eax
jne 0x475a19
cmp dword [esp + 0xb4], eax
jne 0x4759b8
cmp dword [esp + 0x5c], eax
jne 0x475980
mov ecx, dword [esp + 0x14]
cmp dword [esp + 0x10], esi
je 0x47598a
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x12c]
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x60]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [esp + 0x18]
test ecx, ecx
sets dl
sub edx, dword [esp + 0xb4]
je 0x4759d6
cmp dword [esp + 0x10], eax
jne 0x4759d8
mov esi, eax
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp esi, ecx
setne dl
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0xb4]
mov ecx, dword [esp + 0xb4]
add edx, ecx
mov ecx, dword [esp + 0xb4]
add ecx, edx
mov edx, dword [esp + 0x28]
add edx, ecx
mov dword [esp + 0x24], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x18
jge 0x475954
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x35
je 0x47592f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x2e
je 0x475729
xor edi, edi
inc edi
lea ecx, [esp + 0x12c]
call fcn.004014ce
cmp dword [esp + 0xbc], 0
je 0x475dc3
push 3
lea ecx, [esp + 0x164]
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], 0xc18ab9c2
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], 0x9843
mov dword [esp + 0x14], eax
jmp 0x475a98
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x160]
mov dword [ecx + edx*4], 5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x475a82
mov dword [esp + 0x10], eax
jmp 0x475b3f
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x24], 0x442e1191
inc dword [esp + 0x1c]
imul edx, dword [esp + 0x10], 0xd21c
mov ecx, dword [esp + 0x1c]
push 0
cmp edx, ecx
pop ecx
setl cl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x2c], 0xfffffffb
mov edi, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x1c]
imul edx, dword [esp + 0x2c]
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x10]
push 0
cmp edx, ecx
mov edx, dword [esp + 0x164]
pop ecx
setle cl
sub ecx, dword [edx + edi*4]
mov edi, dword [esp + 0x30]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov esi, dword [esp + 0x24]
cmp esi, dword [edx + edi*4]
mov esi, dword [esp + 0x38]
setne cl
add ecx, dword [edx + esi*4]
mov dword [esp + 0x24], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x475aa8
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], eax
jl 0x475b66
mov dword [esp + 0x2c], 0x712c5197
dec dword [esp + 0x14]
jns 0x475b58
lea ecx, [esp + 0x160]
call fcn.004014ce
push 0x6024
push dword [esp + 0xc0]
xor edi, edi
push 0x5a37
push 0x2e86
push 0xbb5
inc edi
push edi
push 0x1731
push edi
push 0x29be
push 0x1d12
call fcn.00473048
push dword [esp + 0xe4]
call fcn.00452c7a
add esp, 0x2c
mov dword [esp + 0x28], 0xefa4
lea ecx, [esp + 0x178]
mov dword [esp + 0x3c], eax
push edi
call fcn.004013fc
push 2
lea ecx, [esp + 0x124]
call fcn.004013fc
mov dword [esp + 0x18], 0xfffffff6
xor esi, esi
mov dword [esp + 0x24], 0x982b357f
mov dword [esp + 0x20], esi
jmp 0x475c0e
push dword [esp + 0x20]
lea ecx, [esp + 0x17c]
call fcn.004014ea
mov dword [eax], 0x9b69b2e4
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x475bf4
mov dword [esp + 0x20], esi
jmp 0x475c34
push dword [esp + 0x20]
lea ecx, [esp + 0x124]
call fcn.004014ea
mov dword [eax], 0xfffffff8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x475c1a
mov dword [esp + 0x20], esi
jmp 0x475c54
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x88], 0x1f8b
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x475c41
push esi
lea ecx, [esp + 0x17c]
call fcn.004014ea
push esi
lea ecx, [esp + 0x124]
mov edi, eax
call fcn.004014ea
xor ecx, ecx
cmp dword [edi], ecx
setg cl
add ecx, dword [eax]
je 0x475c8c
cmp dword [edi], esi
je 0x475c8c
xor eax, eax
inc eax
mov esi, eax
jmp 0x475c8f
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x120]
push eax
call fcn.004014ea
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [esp + 0x28]
imul ecx, esi
cmp eax, ecx
mov eax, dword [edi]
setne dl
imul eax, edx
cmp eax, dword [esp + 0x18]
jle 0x475cca
xor eax, eax
cmp dword [esp + 0x18], eax
jne 0x475ccc
xor edi, edi
mov edx, eax
inc edi
jmp 0x475cd1
xor eax, eax
xor edi, edi
inc edi
mov edx, edi
mov ecx, 0xc692
sub ecx, edx
je 0x475d66
mov dword [esp + 0x30], 0x4087b332
mov dword [esp + 0x14], eax
jmp 0x475cfb
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x8c], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x475cec
mov dword [esp + 0x18], 0x12
jmp 0x475d41
mov dword [esp + 0x38], 0x72c2
xor edx, edx
mov dword [esp + 0x38], 0x11919b17
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
cmp ecx, edi
setg dl
xor ecx, ecx
test edx, edx
mov dword [esp + 0x8c], edx
setne cl
dec ecx
mov dword [esp + 0x38], ecx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe2
jne 0x475d0b
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x475d94
push 0xdc0
push 0x2044
push eax
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x475d94
mov dword [esp + 0x18], eax
jmp 0x475d8e
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x475d8a
push 0x150c
push 0x127d
push eax
call dword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x475d6c
dec dword [esp + 0x88]
lea ecx, [esp + 0x120]
call fcn.004014ce
lea ecx, [esp + 0x178]
call fcn.004014ce
lea eax, [esp + 0x44]
push eax
call fcn.00476600
mov ecx, dword [esp + 0x3c]
mov dword [eax], ecx
mov dword [esp + 0x24], 0xc6a53d06
lea ecx, [esp + 0x1ec]
mov dword [esp + 0x24], 0x16df251d
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0x24], 0x82a1836c
push edi
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x1c], 0xc03809d0
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], edi
jge 0x475e22
push dword [esp + 0x10]
lea ecx, [esp + 0x1f0]
call fcn.004014ea
mov dword [eax], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x475e04
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x475e3b
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x2e8], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x475e28
inc dword [esp + 0x1c]
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x1c], eax
jmp 0x475e94
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x475e68
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
xor eax, eax
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x475e90
push eax
push 0x16a9
push 0x1449
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
xor eax, eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x27
je 0x475e52
lea ecx, [esp + 0x1ec]
call fcn.004014ce
lea ecx, [esp + 0xb8]
call fcn.00463037
mov eax, 0xb4e1a362
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], eax
xor eax, eax
inc eax
mov dword [esp + 0x1c], 0xf98a59c1
mov dword [esp + 0x24], eax
xor eax, eax
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x475efc
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor eax, eax
mov dword [esp + 0x1c], 3
cmp dword [esp + 0x1c], eax
jl 0x4760c1
mov dword [esp + 0x20], 2
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x475f2f
push eax
push 0x10e5
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
xor eax, eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 3
jg 0x4760b7
xor esi, esi
mov dword [esp + 0x14], 0xfffffff7
lea ecx, [esp + 0x1a8]
push 3
call fcn.004013fc
mov dword [esp + 0x14], esi
jmp 0x475f76
push dword [esp + 0x14]
lea ecx, [esp + 0x1ac]
call fcn.004014ea
mov dword [eax], 0x658edfe0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x475f5c
cmp dword [esp + 0x1c], esi
jne 0x4760a9
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], 3
jg 0x47608c
xor edi, edi
inc edi
mov dword [esp + 0x18], 5
lea ecx, [esp + 0x190]
push 4
call fcn.004013fc
mov dword [esp + 0x10], esi
jmp 0x475fc8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x300], 0x501874da
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x475fb5
mov dword [esp + 0x10], esi
jmp 0x475fef
push dword [esp + 0x10]
lea ecx, [esp + 0x194]
call fcn.004014ea
mov dword [eax], 0xffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x475fd5
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], 3
jg 0x47606b
push edi
lea ecx, [esp + 0x194]
call fcn.004014ea
mov edx, eax
mov dword [esp + 0x24], 0x9cf13e13
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0x24], 6
mov dword [esp + 0x10], esi
jmp 0x476041
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2d0], 0x92758e92
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x47602e
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x138]
mov eax, dword [esp + 0x1c]
dec dword [edx]
mov dword [esp + eax*4 + 0x138], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x476010
lea ecx, [esp + 0x190]
call fcn.004014ce
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x475f99
mov edi, dword [sym.imp.USER32.dll_GetDC]
lea ecx, [esp + 0x1a8]
call fcn.004014ce
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jle 0x475f40
jmp 0x4760b5
lea ecx, [esp + 0x1a8]
call fcn.004014ce
xor eax, eax
dec dword [esp + 0x1c]
jns 0x475f0e
mov esi, dword [esp + 0x3c]
test esi, esi
je 0x4763a5
xor edx, edx
inc edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x14], eax
jmp 0x4760e9
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x23c], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x4760da
mov dword [esp + 0x14], 0xa8eac8b1
mov dword [esp + 0x14], eax
jmp 0x476139
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x47611c
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x476135
push 0x2222
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor eax, eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], eax
jle 0x4760fd
mov edx, dword [esp + 0x34]
mov ecx, esi
call fcn.00473ed1
push 0xfffffffffffffffd
pop ecx
mov dword [esp + 0x14], ecx
mov edi, eax
xor eax, eax
mov dword [esp + 0xc8], edi
mov dword [esp + 0x34], eax
mov dword [esp + 0x34], 0xd2f38d92
mov dword [esp + 0x34], ecx
push 3
mov dword [esp + 0x38], 0xe3f0e26a
mov dword [esp + 0x14], eax
pop edx
jmp 0x476190
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x240], 0x20624039
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x47617d
mov dword [esp + 0x10], eax
jmp 0x4761af
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x2b0], 0x2280643b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x47619c
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x4761ca
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
xor eax, eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 2
jg 0x476396
xor edi, edi
xor esi, esi
inc edi
movdqa xmm0, xmmword [0xa75650]
lea eax, [esp + 0x280]
push eax
lea eax, [esp + 0x274]
mov dword [esp + 0x1c], edi
push eax
lea ecx, [esp + 0x2e0]
movdqu xmmword [esp + 0x278], xmm0
call fcn.004014fc
push ecx
lea ecx, [esp + 0x284]
push dword [eax + 4]
push dword [eax]
call fcn.004014a8
mov dword [esp + 0x18], esi
jmp 0x476369
movdqa xmm0, xmmword [0xa75630]
lea eax, [esp + 0x260]
push eax
lea eax, [esp + 0x254]
mov dword [esp + 0x14], 3
push eax
lea ecx, [esp + 0x2d0]
movdqu xmmword [esp + 0x258], xmm0
call fcn.004014fc
push ecx
lea ecx, [esp + 0x1fc]
push dword [eax + 4]
push dword [eax]
call fcn.004014a8
mov dword [esp + 0x34], esi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], 2
jg 0x476359
mov dword [esp + 0x34], 0xfffffffc
lea ecx, [esp + 0x204]
mov dword [esp + 0x34], 0xfffffff8
push 3
call fcn.004013fc
mov dword [esp + 0x2c], 0xf4b3
mov dword [esp + 0x1c], 0
jmp 0x4762ce
push dword [esp + 0x1c]
lea ecx, [esp + 0x208]
call fcn.004014ea
mov dword [eax], 0x849968cb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x4762b4
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x240]
mov eax, dword [esp + 0x2c]
dec dword [esp + 0x2c]
test eax, eax
jne 0x4762f6
cmp dword [esp + 0x18], eax
jne 0x4762f6
xor ecx, ecx
jmp 0x47631a
mov eax, dword [esp + 0x14]
mov ecx, edi
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x240]
mov eax, dword [esp + 0x2b8]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
xor eax, eax
cmp ecx, 0xe758
push edi
setl al
lea ecx, [esp + 0x1fc]
mov dword [esp + 0x38], eax
call fcn.004014ea
mov ecx, dword [esp + 0x34]
mov dword [eax], ecx
lea ecx, [esp + 0x204]
call fcn.004014ce
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x476284
xor esi, esi
lea ecx, [esp + 0x1f8]
call fcn.004014ce
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x47622a
lea ecx, [esp + 0x280]
call fcn.004014ce
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x4761de
mov edi, dword [esp + 0xc8]
lea eax, [esp + 0x90]
push eax
call fcn.0047659e
mov dword [eax], edi
push 3
lea ecx, [esp + 0xa4]
call fcn.004013fc
mov dword [esp + 0x18], 0
xor eax, eax
mov dword [esp + 0x28], 0x14b58e17
inc eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], 0
cmp dword [esp + 0x14], 3
jge 0x476405
push dword [esp + 0x14]
lea ecx, [esp + 0xa4]
call fcn.004014ea
mov dword [eax], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x4763e1
xor eax, eax
inc eax
mov dword [esp + 0x18], 0
cmp dword [esp + 0x18], 2
jg 0x4764c6
push eax
lea ecx, [esp + 0xa4]
call fcn.004014ea
mov edi, eax
xor esi, esi
push dword [esp + 0x18]
lea ecx, [esp + 0xa4]
call fcn.004014ea
cmp dword [eax], esi
je 0x476486
push dword [esp + 0x18]
lea ecx, [esp + 0xa4]
call fcn.004014ea
xor edx, edx
xor ecx, ecx
inc edx
cmp dword [eax], edx
setge cl
inc ecx
mov dword [esp + 0x34], ecx
cmp dword [esp + 0x18], edx
je 0x476466
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], esi
lea ecx, [esp + 0xa0]
mov eax, dword [esp + 0x28]
push dword [esp + 0x18]
call fcn.004014ea
cmp dword [eax], esi
je 0x476486
mov eax, dword [esp + 0x18]
push dword [esp + 0x18]
lea ecx, [esp + 0xa4]
call fcn.004014ea
mov ecx, dword [esp + 0x18]
xor edx, edx
cmp dword [eax], ecx
setl dl
xor eax, eax
cmp edx, 0xfaaa
setne al
sub eax, dword [edi]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x34], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x476429
lea ecx, [esp + 0xa0]
call fcn.004014ce
mov eax, dword [ebp + 8]
lea esi, [esp + 0xc8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret