Function at 0x10048352
Capabilities:
Connect pipe
Delete file
Get common file path
Get file size
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10084e63
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d8
push ebx
mov dword [esp + 0x74], ecx
xor ecx, ecx
push esi
mov dword [esp + 0x34], ecx
push edi
mov dword [esp + 0x78], edx
mov dword [esp + 0x1c], ecx
jmp 0x1004839a
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x4c], 0xfffffffa
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x1004838a
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xffffffffffffffe4
mov dword [esp + 0x50], ecx
pop esi
jmp 0x100483df
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x100483c7
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x100483db
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
dec dword [esp + 0x4c]
cmp dword [esp + 0x4c], esi
jge 0x100483b0
push 0xffffffffffffffff
mov dword [esp + 0x3c], 0x17
pop edx
jmp 0x1004845c
mov dword [esp + 0x24], ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x10048414
push ecx
push ecx
push 0x1200
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor ecx, ecx
or edx, 0xffffffff
mov dword [esp + 0x24], esi
jmp 0x10048451
mov dword [esp + 0x1c], ecx
jmp 0x1004842c
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x44], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10048420
mov dword [esp + 0x44], ecx
jmp 0x10048447
mov eax, dword [esp + 0x44]
cmp dword [esp + eax*4 + 0x4c], ecx
jne 0x1004844d
inc dword [esp + 0x44]
cmp dword [esp + 0x44], ecx
jle 0x10048439
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffe6
jg 0x1004841a
dec dword [esp + 0x38]
cmp dword [esp + 0x38], 0xffffffed
je 0x100483f2
push 2
pop esi
mov dword [esp + 0x20], 0xaa6e6f7
lea ecx, [esp + 0x12c]
push esi
call fcn.10026565
push 3
pop edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x14], 0
jmp 0x100484a4
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x58], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10048494
mov dword [esp + 0x14], 0
jmp 0x100484cb
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100484b5
mov eax, dword [esp + 0x20]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x20]
jne 0x100484f1
cmp dword [esp + 0x20], eax
jne 0x100484f1
xor ecx, ecx
jmp 0x100484f4
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x12c]
xor eax, eax
inc eax
mov dword [edx + 4], ecx
cmp dword [esp + 0x20], eax
jle 0x100485de
mov dword [esp + 0x14], 0x3d2717f4
mov dword [esp + 0x34], eax
mov dword [esp + 0x18], 0xce68266c
mov dword [esp + 0x18], 0x1ac28c4f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
imul ecx, eax
mov dword [esp + 0x58], ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov dword [edx + 4], ecx
mov ecx, 0xb6f2ba10
cmp ecx, eax
mov dword [esp + 0x58], eax
sbb eax, eax
neg eax
imul eax, dword [esp + 0x34]
add eax, 0x245
jne 0x10048578
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x34]
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x58]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
inc ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x18], ecx
jmp 0x100485ea
mov dword [esp + 0x28], 0xa898
inc dword [esp + 0x28]
lea ecx, [esp + 0x12c]
call fcn.10026617
push 7
pop eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], 0
jmp 0x10048ba4
push esi
lea ecx, [esp + 0xb8]
call fcn.10026565
and dword [esp + 0x1ec], 0
lea ecx, [esp + 0x90]
push edi
call fcn.10026565
mov byte [esp + 0x1ec], 1
xor edx, edx
mov dword [esp + 0x24], 0xfffa
mov dword [esp + 0x20], edx
push 7
pop eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x38], 0x6af8
mov dword [esp + 0x34], 1
mov dword [esp + 0x14], edx
jmp 0x10048675
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], 0x3dce9d05
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004865f
mov esi, dword [esp + 0x90]
cmp dword [esi + 4], edx
jne 0x1004868b
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 4]
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp edx, eax
setg cl
sub edx, ecx
add edx, 0xfff7
imul eax, edx, 0x2314
test eax, eax
je 0x10048861
xor eax, eax
lea ecx, [esp + 0x170]
inc eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 8
mov dword [esp + 0x30], 0x54e7f13b
mov dword [esp + 0x14], 0x89f2e072
mov dword [esp + 0x8c], 0x84365721
mov dword [esp + 0x2c], 0xc24489be
mov dword [esp + 0x30], eax
push edi
call fcn.10026565
mov dword [esp + 0x30], 0xfffffffc
xor ebx, ebx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x10048720
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x170]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004870a
mov dword [esp + 0x14], ebx
jmp 0x1004873f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x18c], 0xd58e56a9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1004872c
cmp dword [esp + 0x28], ebx
je 0x10048808
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x190]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x8c]
setl dl
xor ecx, ecx
cmp edx, eax
sete cl
cmp dword [esi + 4], ecx
jg 0x1004878e
cmp dword [esp + 0x1c], ebx
je 0x1004878e
cmp dword [esi + 4], ebx
je 0x1004878e
xor edx, edx
inc edx
jmp 0x10048790
mov edx, ebx
inc dword [esp + 0x38]
xor ecx, ecx
mov eax, dword [esp + 0x34]
sub edx, eax
mov eax, dword [esp + 0x30]
cmp edx, 0x3645
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x28]
setne dl
sub edx, 0x3d57
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov eax, dword [esp + 0x14]
cmp eax, 0x7bbcec63
setne cl
xor eax, eax
cmp ecx, 2
mov ecx, dword [esp + 0x1c]
setge al
xor edx, edx
mov dword [esi + 4], eax
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esp + 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [esp + 0x38], ecx
jg 0x10048808
xor ecx, ecx
inc ecx
jmp 0x1004880a
mov ecx, ebx
mov dword [esp + 0x28], 0x86992f1e
xor ebx, ebx
mov eax, dword [esp + 0x20]
add eax, ecx
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
cmp ecx, eax
setl bl
xor edx, edx
imul ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x170]
call fcn.10026617
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
jmp 0x1004891a
mov dword [esp + 0x14], 0xe2d7e08c
mov dword [esp + 0x28], 0x586bc1af
mov dword [esp + 0x28], 0xffffffff
cmp dword [esp + 0x24], 0
jne 0x100488ae
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x14]
jle 0x10048892
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, 1
setge cl
add ecx, dword [esp + 0x38]
je 0x100488cc
cmp dword [esp + 0x14], 0
je 0x100488cc
xor ecx, ecx
inc ecx
jmp 0x100488ce
xor ecx, ecx
mov eax, dword [esp + 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 1
setle al
imul eax, dword [esp + 0x24]
mov dword [esi + 4], eax
mov dword [esp + 0x20], 2
cmp dword [esp + 0x20], 0
jl 0x10048969
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x90]
mov ecx, dword [esi + 4]
mov dword [eax + edx*4], ecx
mov dword [esp + 0x38], 0x1c
jmp 0x1004895c
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x10048958
push 0
call dword [sym.imp.OLEAUT32.dll_VariantClear]
dec dword [esp + 0x38]
cmp dword [esp + 0x38], 0x10
jle 0x10048944
dec dword [esp + 0x20]
jns 0x10048929
lea ecx, [esp + 0x90]
mov byte [esp + 0x1ec], 0
call fcn.10026617
mov eax, 0x8d13
lea ecx, [esp + 0x164]
push 2
mov dword [esp + 0x1a4], eax
mov dword [esp + 0x1a8], eax
pop esi
mov dword [esp + 0x1a8], eax
mov dword [esp + 0x1ac], eax
push esi
call fcn.10026565
xor edx, edx
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x1c], edx
jmp 0x100489d4
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 0x42eb90da
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x100489be
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], dl
je 0x100489ee
push edx
push edx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
xor edx, edx
mov dword [esp + 0x1c], edx
jmp 0x10048a1b
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x10048a13
push edx
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor edx, edx
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jle 0x100489f4
lea ecx, [esp + 0x164]
call fcn.10026617
mov dword [esp + 0x30], 0xa37bb008
lea ecx, [esp + 0xcc]
mov dword [esp + 0x14], 0xc558
push esi
call fcn.10026565
mov dword [esp + 0x30], 0xad3380ee
mov dword [esp + 0x1c], 0
jmp 0x10048a73
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10048a5d
mov eax, dword [esp + 0x14]
mov ecx, 0xf9f7c8b1
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x14]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setl dl
xor ecx, ecx
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0xcc]
cmp edx, 0xa369
setle cl
sub ecx, 0x9c23
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x30], eax
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x10048af6
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
lea ecx, [esp + 0xcc]
call fcn.10026617
mov dword [esp + 0x1c], 0
jmp 0x10048b22
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], 0xa18885c6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10048b0c
mov dword [esp + 0x1c], 0xe0cf5720
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x10048b58
push 0x3ef
push 0x15f5
push 0x1763
push 0x1f0d
push 0
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x1c], 0xffffffee
jmp 0x10048b7a
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x10048b76
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe5
je 0x10048b62
mov eax, dword [esp + 0xb4]
lea ecx, [esp + 0xb4]
and dword [eax + 4], 0
or dword [esp + 0x1ec], 0xffffffff
call fcn.10026617
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffb
jne 0x1004860a
push edi
lea ecx, [esp + 0xe8]
call fcn.10026565
xor edx, edx
mov dword [esp + 0x30], 0x53aa9ac7
mov dword [esp + 0x18], edx
jmp 0x10048bdf
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xe4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10048bcc
mov edi, dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], dl
je 0x10048c00
push edx
push edx
call ebx
push eax
push 0
push 0
call edi
mov eax, dword [esp + 0xe4]
lea ecx, [esp + 0xe4]
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
call fcn.10026617
mov dword [esp + 0x14], 0xf9b3198a
xor edx, edx
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], 0xd1299d62
mov dword [esp + 0x30], 0x6402d6fa
mov dword [esp + 0x18], edx
jmp 0x10048c52
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x50], 4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10048c42
mov dword [esp + 0x14], 0xffffffe9
jmp 0x10048e31
mov dword [esp + 0x24], 0x8bb4
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x1c], 0xa42bbd4a
mov dword [esp + 0x38], 3
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], 0x23e6
mov dword [esp + 0x18], edx
jmp 0x10048caa
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x84], 0x413e458c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10048c97
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jne 0x10048cc0
dec dword [esp + 0x28]
je 0x10048cc3
xor edx, edx
inc edx
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x54]
cmp eax, 0xfffffffb
mov eax, dword [esp + 0x54]
setle cl
add eax, edx
add eax, ecx
xor ecx, ecx
cmp eax, 0x1cd4
setne cl
cmp ecx, dword [esp + 0x38]
jne 0x10048d09
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [esp + 0x38]
imul ecx, dword [esp + 0x54]
test ecx, ecx
je 0x10048d4a
cmp dword [esp + 0x20], edx
je 0x10048d4a
xor ecx, ecx
inc ecx
jmp 0x10048d4c
mov ecx, edx
mov eax, dword [esp + 0x54]
sub ecx, eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x20], 1
cmp dword [esp + 0x20], edx
jl 0x10048e2d
mov eax, dword [esp + 0x20]
cmp dword [esp + eax*4 + 0x50], edx
je 0x10048d90
mov dword [esp + 0x1c], edx
jmp 0x10048d88
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x50], 0xfffffffd
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10048d78
jmp 0x10048e0e
mov dword [esp + 0x18], 1
mov dword [esp + 0x38], edx
jmp 0x10048e07
mov dword [esp + 0x34], 1
cmp dword [esp + 0x34], edx
jl 0x10048def
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x50]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [esp + 0x18]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + eax*4 + 0x50]
cmp eax, edx
mov eax, dword [esp + 0x20]
setle cl
neg ecx
mov dword [esp + eax*4 + 0x84], ecx
dec dword [esp + 0x34]
jns 0x10048dac
xor edx, edx
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x10048e03
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor edx, edx
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 1
jle 0x10048d9e
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x10048e23
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor edx, edx
dec dword [esp + 0x20]
jns 0x10048d68
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x17
jle 0x10048c65
dec dword [esp + 0x2c]
lea ecx, [esp + 0x194]
mov dword [esp + 0x2c], 0xf251d69f
push 3
call fcn.10026565
xor ecx, ecx
push 3
mov dword [esp + 0x18], ecx
pop edx
jmp 0x10048e70
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b0], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10048e61
xor esi, esi
mov dword [esp + 0x14], ecx
inc esi
cmp dword [esp + 0x14], edx
jge 0x10048e97
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x194]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
jmp 0x10048e7d
mov eax, dword [esp + 0x1b4]
lea ecx, [esp + 0x194]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x2c], 0x37b1891f
call fcn.10026617
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x2c], 0
mov dword [esp + 0x18], 0x7ed6f186
mov dword [esp + 0x28], 0x5a8b060d
mov dword [esp + 0x34], 0xdde9ab5c
mov dword [esp + 0x1c], 0xc
jmp 0x10048f06
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x10048f02
call dword [sym.imp.USER32.dll_EndMenu]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffa
je 0x10048ef0
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x34]
add edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
cmp edx, eax
setge cl
mov dword [esp + 0x18], ecx
xor ecx, ecx
mov dword [esp + 0x18], ecx
jmp 0x10048f54
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x48], 0xfffffffa
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10048f44
push 7
mov dword [esp + 0x20], 0x24a8c6a5
pop eax
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0x1a
jle 0x100490a0
push 2
pop esi
push esi
lea ecx, [esp + 0xa0]
call fcn.10026565
xor edx, edx
mov dword [esp + 0x1ec], esi
mov dword [esp + 0x14], edx
jmp 0x10048fa6
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x14c], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10048f93
mov dword [esp + 0x14], edx
jmp 0x10048fc5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10048fb3
mov esi, dword [esp + 0x9c]
mov dword [esi + 4], 2
mov dword [esp + 0x34], 0xfffffffd
lea ecx, [esp + 0x114]
push 1
call fcn.10026565
mov dword [esp + 0x18], 0
jmp 0x1004900f
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10048ff9
mov dword [esp + 0x34], 2
cmp dword [esp + 0x34], 0
jl 0x10049052
mov eax, dword [esi + 4]
mov ecx, dword [esp + eax*4 + 0x14c]
mov eax, dword [esp + 0x114]
mov dword [eax], ecx
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x1004904c
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
dec dword [esp + 0x34]
jns 0x10049025
lea ecx, [esp + 0x114]
call fcn.10026617
dec dword [esi + 4]
jns 0x10048fd9
or dword [esp + 0x1ec], 0xffffffff
lea ecx, [esp + 0x9c]
cmp dword [esp + 0x154], 0
jne 0x10049096
call fcn.10026617
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x1a
jg 0x10048f74
jmp 0x1004909b
call fcn.10026617
xor esi, esi
xor ecx, ecx
inc esi
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x100490c8
push ecx
push 0x1b43
push 0x83b
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
xor ecx, ecx
mov dword [esp + 0x48], ecx
jmp 0x10049228
mov dword [esp + 0x30], 5
mov dword [esp + 0x30], 0x94964a53
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], esi
mov dword [esp + 0x30], 0x849f845d
mov dword [esp + 0x2c], 0x3050
push 3
mov dword [esp + 0x34], 0x30385d06
mov dword [esp + 0x18], ecx
pop edx
jmp 0x10049121
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1c8], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1004910e
mov dword [esp + 0x14], ecx
jmp 0x10049140
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1bc], 7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1004912d
inc dword [esp + 0x2c]
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x1004915f
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
mov dword [esp + 0x30], 0x28c176b0
lea ecx, [esp + 0x158]
mov dword [esp + 0x30], 0xfffffffb
mov dword [esp + 0x30], 0x2b165808
mov dword [esp + 0x18], 0xfffffff9
push 2
call fcn.10026565
xor edx, edx
mov dword [esp + 0x2c], 0x57863718
mov dword [esp + 0x14], edx
jmp 0x100491b0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1d4], 0xfffffffb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004919d
mov dword [esp + 0x14], edx
jmp 0x100491d3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100491bd
inc dword [esp + 0x2c]
mov dword [esp + 0x18], edx
jmp 0x100491fc
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x100491f8
push edx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xor edx, edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x12
jge 0x100491e4
lea ecx, [esp + 0x158]
call fcn.10026617
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], cl
je 0x10049224
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
dec dword [esp + 0x48]
cmp dword [esp + 0x48], 0xffffffe4
jge 0x100490d1
mov dword [esp + 0x24], 0x17
jmp 0x100492ab
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x1004925c
push ecx
push ecx
push 0x1200
push ecx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor ecx, ecx
mov dword [esp + 0x1c], 0xffffffe4
jmp 0x100492a0
mov dword [esp + 0x18], ecx
jmp 0x1004927c
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x40], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1004926c
mov dword [esp + 0x40], ecx
jmp 0x10049296
mov eax, dword [esp + 0x40]
cmp dword [esp + eax*4 + 0x48], ecx
jne 0x1004929c
inc dword [esp + 0x40]
cmp dword [esp + 0x40], ecx
jle 0x10049288
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe6
jg 0x10049266
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffed
je 0x1004923d
push esi
lea ecx, [esp + 0xf4]
call fcn.10026565
push 3
pop eax
push eax
lea ecx, [esp + 0x100]
mov dword [esp + 0x1f0], eax
call fcn.10026565
xor edx, edx
mov dword [esp + 0x30], 0x53aa9ac7
mov dword [esp + 0x18], edx
jmp 0x100492f9
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xfc]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x100492e6
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], dl
je 0x10049315
push edx
push edx
call ebx
push eax
push 0
push 0
call edi
mov eax, dword [esp + 0xfc]
lea ecx, [esp + 0xfc]
mov eax, dword [eax + 4]
mov dword [esp + 0x30], eax
call fcn.10026617
mov eax, 0xe8c9
lea ecx, [esp + 0xc0]
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
push 7
pop eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], 0x5077045b
mov dword [esp + 0x28], 0x12d29ed7
push 4
call fcn.10026565
xor edx, edx
push 0xfffffffffffffff6
mov dword [esp + 0x24], edx
pop edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], 0xb9117a54
mov dword [esp + 0x18], edx
jmp 0x1004939a