Function at 0x41ae69
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
push ebx
push esi
mov byte [esp + 0x38], cl
push edi
mov dword [esp + 0x18], 0x78144ad7
mov edi, edx
mov dword [esp + 0x18], 0xfffffffc
or edx, 0xffffffff
mov dword [esp + 0x1c], edx
xor eax, eax
mov dword [esp + 0x14], eax
push 2
mov dword [esp + 0x1c], 4
mov dword [esp + 0x10], eax
pop esi
jmp 0x41aeb8
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x40], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x41aeac
mov dword [esp + 0x44], eax
xor ebx, ebx
mov edx, dword [esp + 0x40]
mov ecx, dword [esp + 0x40]
imul edx, ecx
mov ecx, dword [esp + 0x44]
cmp edx, ecx
mov ecx, dword [esp + 0x1c]
setl bl
xor edx, edx
cmp ebx, ecx
setl dl
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
cmp ecx, dword [esp + 0x1c]
je 0x41af05
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x14]
xor ebx, ebx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x44]
mov ecx, dword [esp + 0x44]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
cmp edx, ecx
mov ecx, dword [esp + 0x18]
setle bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [esp + 0x14]
setne dl
mov dword [esp + 0x18], edx
xor edx, edx
cmp dword [esp + 0x18], ecx
setl dl
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x44]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x28], 0x9e2a8d3a
mov dword [esp + 0x18], eax
mov dword [esp + 0x34], 0x3013
mov dword [esp + 0x30], eax
mov dword [esp + 0xc], 0xaf2c9a13
mov dword [esp + 0x18], 0xae974ca7
mov dword [esp + 0x1c], 0x26af9031
mov dword [esp + 0x20], eax
jmp 0x41afa6
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x54], 0xb064
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x41af96
xor esi, esi
mov dword [esp + 0x20], eax
inc esi
jmp 0x41afc1
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x60], esi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x41afb5
mov dword [esp + 0x20], eax
jmp 0x41afe0
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0xec], 0xfffffffd
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x41afcd
mov ecx, esi
cmp dword [esp + 0x58], eax
jne 0x41aff1
mov ecx, eax
mov dword [esp + 0x60], ecx
xor ebx, ebx
mov ecx, dword [esp + 0xec]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x18]
cmp ecx, edx
mov ecx, dword [esp + 0x58]
setg bl
sub ebx, ecx
jne 0x41b021
cmp dword [esp + 0x34], eax
je 0x41b02a
cmp dword [esp + 0xec], eax
jne 0x41b02c
mov esi, eax
mov ecx, dword [esp + 0x58]
xor edx, edx
cmp ecx, esi
mov ecx, dword [esp + 0x54]
setl dl
xor ebx, ebx
sub ecx, edx
mov dword [esp + 0x30], ecx
mov edx, dword [esp + 0x58]
mov ecx, dword [esp + 0x30]
cmp edx, ecx
setge bl
mov dword [esp + 0xc], ebx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x1c], eax
je 0x41b069
mov ecx, dword [esp + 0xf0]
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x60]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
push 7
pop edx
sub edx, ecx
mov dword [esp + 0x18], edx
je 0x41b0a9
mov dword [esp + 0x18], 0x61e7ff51
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x41b0a0
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
xor esi, esi
inc esi
mov dword [esp + 0x18], esi
jmp 0x41b0d5
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x41b0d2
push eax
push 0x1435
push 0x18ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetPixel]
xor esi, esi
inc esi
push dword [esp + 0x24]
movdqa xmm0, xmmword [0xa5dbd0]
lea ecx, [esp + 0x11c]
push ecx
xor eax, eax
lea ecx, [esp + 0x110]
push ecx
push eax
lea ecx, [esp + 0x88]
mov dword [esp + 0x88], eax
movdqu xmmword [esp + 0x118], xmm0
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
call fcn.00401f92
push 2
pop ebx
push ebx
lea ecx, [esp + 0x100]
call fcn.00401e5e
mov dword [esp + 0x24], 0x66c1932e
mov dword [esp + 0xc], 0
jmp 0x41b153
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xfc]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x41b140
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0xfc]
mov dword [eax + 8], 0xffffffed
call fcn.00401f30
lea ecx, [esp + 0x78]
call fcn.00401f30
mov dword [esp + 0x14], 8
xor eax, eax
mov dword [esp + 0x38], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x2c], 0x503401ff
mov dword [esp + 0x28], 0x9e30c926
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], 0x2d37
mov dword [esp + 0x28], 0xda0476f2
mov dword [esp + 0x1c], eax
jmp 0x41b1c5
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x48], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x41b1b5
mov dword [esp + 0x14], eax
jmp 0x41b40c
mov dword [esp + 0x20], 0x87fc
mov dword [esp + 0x28], 0xd8bc0d13
mov dword [esp + 0x30], 8
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + ecx*4 + 0x48]
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x48], edx
xor edx, edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x48]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x48]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x48]
cmp ecx, 0x288586fd
setne dl
xor ecx, ecx
cmp edx, 0xfffffffc
setg cl
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], esi
cmp dword [esp + 0x28], eax
jne 0x41b23e
mov ecx, eax
cmp dword [esp + 0x14], eax
je 0x41b240
mov ecx, esi
mov dword [esp + 0x30], ecx
xor edx, edx
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
mov dword [esp + 0x38], ecx
imul ecx, dword [esp + 0x38], 3
cmp edx, ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xffffffff
setne dl
sub edx, dword [esp + 0x14]
je 0x41b3ee
mov dword [esp + 0x1c], 0x25ec560
mov dword [esp + 0x28], esi
dec dword [esp + 0x1c]
mov dword [esp + 0x38], 0xffffffe9
jmp 0x41b3e1
mov dword [esp + 0x34], esi
mov dword [esp + 0x28], esi
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x41b2ad
push 0xb32
call dword [sym.imp.USER32.dll_GetSysColorBrush]
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x41b3d3
mov ecx, 0x96354d18
mov dword [esp + 0xb4], ecx
mov dword [esp + 0xb8], ecx
mov dword [esp + 0xbc], ecx
mov dword [esp + 0xc0], ecx
cmp dword [esp + 0x34], eax
je 0x41b2f4
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x1c]
je 0x41b2f4
mov dword [esp + 0xc0], esi
jmp 0x41b2fb
mov dword [esp + 0xc0], eax
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + ecx*4 + 0x48]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + ecx*4 + 0x48]
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x34]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + ecx*4 + 0x48]
cmp ecx, esi
setle dl
imul ecx, edx, 0xb639
xor edx, edx
add ecx, dword [esp + 0x34]
cmp ecx, 0xffffffff
setne dl
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], eax
je 0x41b35e
mov edx, esi
cmp dword [esp + 0x28], eax
jne 0x41b360
mov edx, eax
xor ecx, ecx
cmp edx, 0xdb5b
push 2
setg cl
xor ebx, ebx
cmp ecx, 0x2b9c
mov ecx, dword [esp + 0x24]
setne bl
sub ebx, 0x9798
mov ecx, dword [esp + ecx*4 + 0x4c]
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ecx, ebx
mov ecx, dword [esp + 0x30]
sete dl
xor ebx, ebx
cmp edx, ecx
setg bl
xor edx, edx
sub ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
cmp ebx, 0x817
pop ebx
setle dl
sub edx, dword [esp + ecx*4 + 0x48]
mov ecx, dword [esp + 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x28], edx
xor edx, edx
cmp dword [esp + 0x28], ecx
setl dl
mov dword [esp + 0x28], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x41b2b6
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 0x17
jl 0x41b28d
jmp 0x41b408
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x2c], eax
jl 0x41b408
mov ecx, dword [esp + 0x2c]
cmp dword [esp + ecx*4 + 0x48], eax
jne 0x41b408
dec dword [esp + 0x2c]
jns 0x41b3f8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x41b1d5
mov dword [esp + 0x28], esi
xor edx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setge dl
xor ebx, ebx
cmp eax, edx
setne bl
sub ebx, 0xe8580ca7
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
add ebx, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
cmp ebx, eax
setle cl
cmp byte [esp + 0x3c], 0
mov dword [esp + 0x28], ecx
je 0x41b6e0
mov dword [esp + 0xc], 0x2e91a049
lea ecx, [esp + 0xc4]
push esi
call fcn.00401e5e
mov dword [esp + 0xc], 0
jmp 0x41b4ae
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc4]
mov dword [eax + ecx*4], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x41b49c
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x41b4c6
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [esp + 0xc], 0xffffffe8
jmp 0x41b4e1
mov eax, dword [esp + 0xc4]
mov dword [eax], 0x4bc44e68
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x11
jl 0x41b4d0
lea ecx, [esp + 0xc4]
call fcn.00401f30
mov dword [esp + 0x30], esi
xor eax, eax
mov dword [esp + 0x14], 0xfffffffb
mov dword [esp + 0x1c], eax
mov dword [esp + 0x68], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x70], esi
mov dword [esp + 0x74], esi
mov dword [esp + 0x24], 0xfffffffe
mov dword [esp + 0xc], eax
jmp 0x41b534
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x5c], 0xe4c7ba3f
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x41b524
cmp dword [esp + 0x30], eax
je 0x41b544
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x14], 0xab65
xor ebx, ebx
mov edx, dword [esp + 0x70]
mov ecx, dword [esp + 0x30]
imul edx, ecx
cmp edx, 0x3c61
mov dword [esp + 0x6c], edx
setle bl
xor edx, edx
sub ebx, dword [esp + 0x1c]
add ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
cmp ecx, ebx
mov ecx, dword [esp + 0x30]
setg dl
xor ebx, ebx
cmp ecx, edx
setge bl
xor ecx, ecx
sub ebx, dword [esp + 0x30]
cmp ebx, 0x76a
setge cl
mov dword [esp + 0x24], ecx
mov dword [esp + 0x1c], 0xfffffff0
cmp dword [esp + 0x1c], 0x30
jle 0x41b66f
or ebx, 0xffffffff
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x24], eax
jne 0x41b66f
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], eax
jl 0x41b660
mov dword [esp + 0x24], 0x2a04f777
inc dword [esp + 0x5c]
mov ecx, dword [esp + 0x5c]
jne 0x41b647
mov ecx, dword [esp + 0x24]
xor edx, edx
test ecx, ecx
mov ecx, dword [esp + 0x14]
sets dl
cmp ebx, edx
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, ebx
setg dl
imul esi, edx
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + ecx*4 + 0x68]
mov ecx, dword [esp + 0x18]
sub ecx, 0xa2f
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
imul edx, ecx
mov ecx, dword [esp + 0x14]
test edx, edx
mov edx, eax
setg bl
imul ebx, dword [esp + ecx*4 + 0x68]
sub ebx, 0xdd5c
neg ebx
sbb ebx, ebx
xor esi, esi
inc ebx
inc esi
cmp ebx, 0x7054
je 0x41b649
mov edx, esi
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
pop ebx
mov dword [esp + ecx*4 + 0x68], edx
dec dword [esp + 0x14]
jns 0x41b5d1
or ebx, ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x30
jg 0x41b5ad
mov dword [esp + 0x24], 0x3d06
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x18], 0xfffffff9
mov dword [esp + 0x18], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x18], 0x9aa810d2
mov dword [esp + 0x18], 0x7be9fb1c
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], esi
jge 0x41b6be
push 2
pop ebx
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x64], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x41b6ac
mov eax, dword [esp + 0x24]
mov ecx, dword [ebp + 8]
mov dword [esp + 0x28], eax
inc dword [esp + 0x18]
cmp dword [ecx + 0x14], 8
jb 0x41b6d5
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
mov dword [eax + 0x14], ecx
jmp 0x41b9e6
push 3
lea ecx, [esp + 0xd4]
call fcn.00401e5e
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x41b70c
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xd0]
mov dword [ecx + edx*4], 0x313dd33a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x41b6f6
mov dword [esp + 0x14], eax
jmp 0x41b728
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x9c], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x41b719
push 2
pop ebx
mov dword [esp + 0xa8], ebx
cmp dword [esp + 0xa8], eax
jl 0x41b75e
mov edx, dword [esp + 0xa8]
mov ecx, dword [esp + 0xd0]
cmp dword [ecx + edx*4], eax
jne 0x41b75e
dec dword [esp + 0xa8]
jns 0x41b742
lea ecx, [esp + 0xd0]
call fcn.00401f30
mov dword [esp + 0x2c], esi
xor edx, edx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setg dl
xor ecx, ecx
cmp eax, 0xfecafe8
setge cl
xor eax, eax
add edx, ecx
sub edx, dword [esp + 0x2c]
je 0x41b79d
mov ecx, eax
cmp dword [esp + 0x2c], eax
je 0x41b79f
mov ecx, esi
mov esi, dword [esp + 0x2c]
xor edx, edx
add esi, ecx
mov ecx, dword [esp + 0x2c]
cmp ecx, esi
setl dl
cmp edx, dword [esp + 0x2c]
je 0x41b7e2
xor esi, esi
mov dword [esp + 0x24], 0x1546
inc esi
mov dword [esp + 0x24], esi
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], 0
je 0x41b81b
push eax
push eax
push 0x134e
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
jmp 0x41b81b
mov dword [esp + 0x24], 0x7ab6dad8
mov dword [esp + 0xc], eax
jmp 0x41b7ff
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xac], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jl 0x41b7f0
mov ecx, dword [esp + 0x24]
mov dword [esp + 0xb0], ecx
mov dword [esp + 0xb0], 0xfffffff9
push dword [esp + 0x64]
movdqa xmm0, xmmword [0xa5dbf0]
lea ecx, [esp + 0x12c]
push ecx
lea ecx, [esp + 0x120]
mov dword [esp + 0x8c], eax
push ecx
push eax
lea ecx, [esp + 0x94]
mov dword [esp + 0x98], eax
movdqu xmmword [esp + 0x128], xmm0
mov dword [esp + 0x9c], eax
call fcn.00401f92
mov dword [esp + 0x24], 0x18ee85ec
lea ecx, [esp + 0x84]
mov dword [esp + 0x24], 0x8f1fe3d2
mov eax, 0xaa9c4ad1
or ebx, 0xffffffff
mov dword [esp + 0x24], ebx
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0xe8], eax
mov eax, dword [esp + 0x84]
and dword [eax + 4], 0
call fcn.00401f30
push dword [esp + 0x64]
movdqa xmm0, xmmword [0xa5dbf0]
lea ecx, [esp + 0x13c]
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x38], 6
mov dword [esp + 0x28], 0x534bf8f0
mov dword [esp + 0x34], 5
mov dword [esp + 0x30], 3
mov dword [esp + 0x28], 0xfffffffb
push ecx
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x130]
mov dword [esp + 0x2c], 0x754320e3
mov dword [esp + 0x2c], ebx
push ecx
mov dword [esp + 0x34], 0xed6b6572
lea ecx, [esp + 0x9c]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 0xe23a266d
push eax
movdqu xmmword [esp + 0x138], xmm0
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
call fcn.00401f92
xor eax, eax
mov dword [esp + 0x18], 0x6b43
mov dword [esp + 0x34], eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x41b96f
push 0x187b
push eax
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
dec dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x90]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
cmp eax, ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
setl dl
xor ebx, ebx
cmp edx, dword [esi + 4]
setle bl
xor edx, edx
cmp ecx, eax
mov ecx, 0xa8fad749
setl dl
xor eax, eax
cmp edx, ebx
setle al
cmp ecx, eax
mov eax, dword [esp + 0x2c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esi + 4], ecx
lea ecx, [esp + 0x90]
call fcn.00401f30
add dword [edi], 0x1b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret