Function at 0x10046d89
Capabilities:
Create directory
Create process on windows
Enumerate gui resources
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
mov eax, 0x1008b3c3
call fcn.10089d40
sub esp, 0x1cc
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xe0], edx
push edi
mov dword [ebp - 0xcc], ecx
mov dword [ebp - 0x18], ebx
jmp 0x10046dbd
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x64], 0x26bdde0b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10046daf
mov dword [ebp - 0x64], ebx
jmp 0x10046ddb
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10046dd8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
dec dword [ebp - 0x64]
cmp dword [ebp - 0x64], 0xfffffffe
jle 0x10046dc8
push 7
mov dword [ebp - 0x18], 0xf6af1124
mov dword [ebp - 0x18], 0xfffffffa
pop edi
jmp 0x10046f76
push 1
lea ecx, [ebp - 0x7c]
call fcn.1001a32c
xor esi, esi
mov dword [ebp - 0x10], ebx
inc esi
jmp 0x10046e19
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0x3fa75c1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10046e09
mov dword [ebp - 0x10], ebx
jmp 0x10046e34
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x84], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10046e23
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046e49
call dword [sym.imp.USER32.dll_GetCapture]
mov eax, dword [ebp - 0x7c]
mov dword [eax], 0xb
mov dword [ebp - 0x24], esi
mov ecx, 0xa41449c9
mov dword [ebp - 0x38], 0x9a31c0a9
mov eax, dword [ebp - 0x24]
sub ecx, eax
je 0x10046e87
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046f44
push ebx
push 0x1d7d
push ebx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x10046f44
mov dword [ebp - 0x10], 0x6fc2
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7c]
add ecx, dword [eax]
xor eax, eax
cmp ecx, 0x876a47cd
mov ecx, dword [ebp - 0x10]
setne al
xor ebx, ebx
add ecx, eax
mov eax, dword [ebp - 0x7c]
cmp ecx, dword [eax]
setle bl
xor edx, edx
mov dword [ebp - 0x84], ebx
mov eax, dword [ebp - 0x10]
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
imul ecx, ecx, 0x4593
cmp eax, ecx
setg dl
xor ebx, ebx
add edx, dword [ebp - 0x18]
jne 0x10046ee8
mov ecx, ebx
cmp dword [ebp - 0x10], ebx
je 0x10046eea
mov ecx, esi
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, ecx
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
add eax, edi
cmp eax, edx
mov eax, dword [ebp - 0x7c]
setg cl
imul ecx, dword [eax]
test ecx, ecx
je 0x10046f16
mov dword [ebp - 0x38], 0x5d64f689
jmp 0x10046f44
mov dword [ebp - 0x10], ebx
jmp 0x10046f3f
mov dword [ebp - 0x24], ebx
jmp 0x10046f37
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x84], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10046f20
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x10046f1b
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
jl 0x10046f5d
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x84], ebx
jne 0x10046f5d
dec dword [ebp - 0x24]
jns 0x10046f4c
mov eax, dword [ebp - 0x7c]
inc dword [eax]
cmp dword [eax], 0x16
jle 0x10046e52
lea ecx, [ebp - 0x7c]
call fcn.1001abec
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffb
jg 0x10046df7
mov dword [ebp - 0x18], 0x9fdf99ff
mov dword [ebp - 0x18], 0xfffffff2
jmp 0x10046fc2
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x10], ebx
jmp 0x10046fad
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x190], 0xfff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10046f9c
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jle 0x10046f90
push 4
pop edi
push edi
lea ecx, [ebp - 0x5c]
call fcn.1001a32c
xor esi, esi
inc esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], ebx
jmp 0x10046fef
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ecx*4], 0x313d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10046fdf
mov dword [ebp - 0x10], ebx
jmp 0x10047006
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xac], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10046ff9
mov dword [ebp - 0xa4], 3
cmp dword [ebp - 0xa4], ebx
jl 0x100471ac
mov dword [ebp - 0x10], 0x888adae8
mov dword [ebp - 0x20], 0x700d62e6
mov dword [ebp - 0x18], 0x6076fda0
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
jl 0x10047082
mov ecx, dword [ebp - 0x10]
mov edx, 0xeda5
mov eax, dword [ebp - 0x5c]
sub edx, dword [eax + ecx*4]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp edx, 0x1d52aa0a
setl bl
xor ecx, ecx
cmp ebx, eax
setle cl
imul ecx, dword [ebp - 0x20]
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x10]
jns 0x10047042
xor ebx, ebx
mov dword [ebp - 0x18], 6
jmp 0x10047193
mov dword [ebp - 0x24], 0x4433
cmp dword [ebp - 0xa4], ebx
jne 0x1004719d
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 3
jg 0x10047190
mov dword [ebp - 0x10], ebx
jmp 0x100470c4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x178], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100470b3
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x18]
jg 0x100470ee
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x5c]
cmp dword [eax + ecx*4], 0xffffffff
mov ecx, esi
setg dl
cmp dword [ebp - 0x18], edx
je 0x100470f0
mov ecx, ebx
mov esi, dword [ebp - 0x20]
xor edx, edx
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa4]
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
setge dl
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x5c]
sete cl
xor edx, edx
sub ecx, 8
imul ecx, dword [eax + esi*4]
cmp ecx, dword [eax + edi*4]
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x24], ebx
jmp 0x1004717a
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
cmp dword [eax + ecx*4], ebx
jne 0x1004715d
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jne 0x1004715d
mov esi, ebx
jmp 0x10047160
xor esi, esi
inc esi
mov ecx, dword [ebp - 0xa4]
xor edx, edx
mov eax, dword [ebp - 0x5c]
cmp dword [eax + ecx*4], esi
sete dl
mov dword [ebp - 0x174], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x10047137
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
push 1
pop esi
jle 0x100470ae
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
jl 0x1004708e
dec dword [ebp - 0xa4]
jns 0x10047021
push 4
pop edi
lea ecx, [ebp - 0x5c]
call fcn.1001abec
push 2
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0x9b546158
mov dword [ebp - 0x34], 0xd3b3152c
mov dword [ebp - 0x34], 0x86f8c7b5
mov dword [ebp - 0x34], 0xc7008b15
mov dword [ebp - 0x34], 0xb9c279a2
mov dword [ebp - 0x34], 0x1b40
mov dword [ebp - 0x30], 0x334adc6f
mov dword [ebp - 0x18], ebx
jmp 0x10047207
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d8], 0xa77c8748
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100471f6
dec dword [ebp - 0x30]
mov dword [ebp - 0x18], ebx
jmp 0x10047225
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x180], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10047214
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], 0x643cdf98
mov dword [ebp - 0x1c], 0xa149cec7
mov dword [ebp - 0x18], ebx
jmp 0x10047251
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x188], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10047240
mov dword [ebp - 0x3c], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x672ca3c0
mov eax, dword [ebp - 0x3c]
setge cl
sub eax, ecx
cmp dword [ebp - 0x28], eax
jne 0x10047294
mov dword [ebp - 0x1c], 0x371247ad
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100472a3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x100472a3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100472a3
call dword [sym.imp.GDI32.dll_GdiFlush]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
mov ebx, dword [sym.imp.USER32.dll_GetDC]
jl 0x10047a11
mov dword [ebp - 0x18], 0x8cafa32f
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x20], 0x478c38ec
mov dword [ebp - 0x28], 0xfffffff6
push esi
call fcn.1001a32c
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x100472f1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], 0x3df603fa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100472e3
mov dword [ebp - 0x10], edx
jmp 0x1004730b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100472fc
cmp dword [ebp - 0x44], edx
je 0x10047356
cmp dword [ebp - 0x48], edx
jne 0x10047352
mov dword [ebp - 0x18], 0x3672
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
imul ecx, eax
mov eax, dword [ebp - 0x48]
sub ecx, eax
jne 0x10047338
mov eax, edx
cmp dword [ebp - 0x20], edx
je 0x1004733a
mov eax, esi
add dword [ebp - 0x44], eax
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, esi
jmp 0x10047358
mov ecx, edx
mov eax, dword [ebp - 0x90]
mov eax, dword [eax]
imul eax, ecx
test eax, eax
je 0x1004737a
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x90]
mov dword [eax], ecx
jmp 0x100473fc
mov dword [ebp - 0x3c], 0x6d5d64f6
mov dword [ebp - 0x20], edx
jmp 0x100473f7
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x20]
cmp dword [ecx + edx*4], eax
jle 0x100473d2
xor edx, edx
mov dword [ebp - 0x18], edx
jmp 0x100473c5
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x100473b0
push edx
call dword [sym.imp.GDI32.dll_CreatePalette]
xor edx, edx
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x100473c2
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
xor edx, edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1004739e
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
jmp 0x100473f4
xor edx, edx
mov dword [ebp - 0x38], edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x90]
mov eax, dword [eax + ecx*4]
add eax, 0x4d4b
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x10047386
lea ecx, [ebp - 0x90]
call fcn.1001abec
push 3
lea ecx, [ebp - 0x15c]
call fcn.1001a32c
xor esi, esi
lea ecx, [ebp - 0x9c]
push 4
mov dword [ebp - 4], esi
pop esi
push esi
call fcn.1001a32c
mov dword [ebp - 0x10], 0xfffffffb
xor edx, edx
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x18], edx
jmp 0x10047450
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 0x6f5020f8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1004743d
mov ecx, dword [ebp - 0x9c]
cmp dword [ecx + 8], edx
jle 0x10047539
mov dword [ebp - 0x20], edx
xor edx, edx
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x20]
cmp dword [ecx + 8], eax
mov eax, dword [ebp - 0x9c]
setl dl
xor ecx, ecx
cmp edx, dword [eax + 4]
setge cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], edx
jmp 0x1004752d
mov dword [ebp - 0x34], edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x9c]
cmp dword [eax + ecx*4], edx
je 0x10047520
push 7
pop eax
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x100474bf
push edx
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor edx, edx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 3
jg 0x1004752a
mov eax, 0xe9e84363
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 3
jg 0x10047515
mov dword [ebp - 0x1c], 0xdf628589
mov dword [ebp - 0x1c], edx
jmp 0x10047501
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x9c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
xor edx, edx
cmp dword [ebp - 0x38], edx
jne 0x10047507
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x100474e5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x100474d9
mov eax, 0xe9e84363
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x100474cd
jmp 0x1004752a
mov dword [ebp - 0x30], 1
inc dword [ebp - 0x30]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10047490
jmp 0x10047540
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x38], 0x96d402da
lea ecx, [ebp - 0x9c]
call fcn.1001abec
mov dword [ebp - 0x28], 0xffffffff
lea ecx, [ebp - 0x150]
mov dword [ebp - 0x18], 0x7a66fe7d
push 1
call fcn.1001a32c
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x10047584
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x150]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10047574
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x150]
mov dword [eax], ecx
mov dword [ebp - 0x18], edx
jmp 0x100475df
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x100475dc
push edx
push 0x27a
push 0x1176
push 0x5b1
push 0x1727
push 0x471
push 0x565
push 0x165d
push 0x9f6
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor edx, edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x100475a0
lea ecx, [ebp - 0x150]
call fcn.1001abec
push 2
lea ecx, [ebp - 0xc4]
call fcn.1001a32c
mov byte [ebp - 4], 1
xor edx, edx
push 2
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x3c], 0x14c5530c
mov dword [ebp - 0x38], 0x21029358
mov dword [ebp - 0x10], edx
jmp 0x10047630
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], 0xe0648261
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10047622
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ecx
jge 0x10047656
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 0x46df37d4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1004763d
mov dword [ebp - 0x50], edx
cmp dword [ebp - 0x50], 0xffffffe7
jle 0x10047787
push 0xfffffffffffffff7
pop edi
mov dword [ebp - 0x10], 0x2887cf2e
mov dword [ebp - 0x18], 0xccaea0a9
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], edx
jl 0x10047763
xor esi, esi
push 3
lea ecx, [ebp - 0x114]
call fcn.1001a32c
mov dword [ebp - 0x1c], esi
jmp 0x100476b2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0xf3ccd246
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1004769f
mov eax, dword [ebp - 0x114]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc4]
or dword [eax], 0xffffffff
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x3c], 1
mov eax, dword [ebp - 0x3c]
add eax, dword [ebp - 0x30]
cmp edi, eax
mov eax, dword [ebp - 0x50]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc4]
cmp dword [eax + ecx*4], esi
je 0x10047727
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x50], esi
jne 0x10047721
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
lea ecx, [ebp - 0x114]
setle dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc4]
mov dword [eax], esi
mov eax, dword [ebp - 0x20]
neg eax
mov dword [ebp - 0x38], eax
call fcn.1001abec
dec dword [ebp - 0x10]
jns 0x1004768d
xor edx, edx
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x10047774
call dword [sym.imp.USER32.dll_GetMessageTime]
xor edx, edx
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xffffffe7
jg 0x10047666
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x11], dl
cmp byte [ebp - 0x11], 0
je 0x100477a0
push edx
push edx
push 0xf57
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor edx, edx
lea ecx, [ebp - 0xc4]
mov byte [ebp - 4], dl
call fcn.1001abec
xor esi, esi
mov dword [ebp - 0x1c], esi
jmp 0x100477c5
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x15c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100477b5
mov eax, dword [ebp - 0x15c]
inc dword [eax + 8]
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], esi
jl 0x100479f6
xor esi, esi
inc esi
mov dword [ebp - 0x18], 0x632667a8
lea ecx, [ebp - 0x12c]
push 3
call fcn.1001a32c
mov byte [ebp - 4], 2
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x38], 0xffffffff
push 7
pop eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0xd0], 0xb42b08f1
mov dword [ebp - 0x68], 0x30fb
mov dword [ebp - 0x1c], 0
jmp 0x10047843
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], 0xdc164f94
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10047830
cmp dword [ebp - 0x18], esi
jbe 0x100479a1
mov dword [ebp - 0x20], 0xba80
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0x38], 0xf314
mov dword [ebp - 0x30], 0x3d9c8c74
mov dword [ebp - 0x38], 0xffffffff
push 2
call fcn.1001a32c
mov byte [ebp - 4], 3
mov dword [ebp - 0x1c], 0
jmp 0x1004789b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 0xe495ee35
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10047888
mov dword [ebp - 0x18], 0x11
jmp 0x1004793f
mov dword [ebp - 0x30], 3
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], 0x7b400765
mov dword [ebp - 0x3c], 0
push 2
call fcn.1001a32c
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], edx
jmp 0x100478ef
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 0xfeb4e522
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100478dc
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
imul eax, eax, 0x5eb2
add eax, dword [ebp - 0x30]
jne 0x10047916
mov eax, edx
cmp dword [ebp - 0x38], edx
je 0x10047918
mov eax, esi
add eax, 0xffff161b
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xbc795c38
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x10]
call fcn.1001abec
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jge 0x100478ad
mov ecx, dword [ebp - 0xd0]
mov eax, dword [ebp - 0xfc]
mov dword [eax + 4], ecx
test ecx, ecx
je 0x1004795f
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov dword [ebp - 0x30], 0x709c1800
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x12c]
mov eax, dword [esi + 4]
imul eax, dword [esi + 8]
cmp eax, dword [esi + 8]
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esi + 4], ecx
lea ecx, [ebp - 0xfc]
call fcn.1001abec
xor esi, esi
inc esi
jmp 0x100479b9
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x100479b9
push 0
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
lea ecx, [ebp - 0x12c]
mov byte [ebp - 4], 0
call fcn.1001abec
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], al
je 0x100479db
push eax
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor eax, eax
mov byte [ebp - 0x11], al
cmp byte [ebp - 0x11], 0
je 0x100479ed
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
dec dword [ebp - 0x28]
jns 0x100477e7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x15c]
call fcn.1001abec
dec dword [ebp - 0x24]
push 1
pop esi
jns 0x100472bb
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
jmp 0x10047a29
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb8], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10047a18
mov dword [ebp - 0xb0], ecx
jmp 0x10047a49
mov dword [ebp - 0x34], 0xffffffff
cmp dword [ebp - 0x34], ecx
jne 0x10047a52
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], 0x14
jle 0x10047a37
mov dword [ebp - 0x24], 0xe
jmp 0x10047a7a
mov byte [ebp - 0x11], cl
cmp byte [ebp - 0x11], 0
je 0x10047a77
push 0x16d8
push 0x1993
push ecx
call dword [sym.imp.USER32.dll_OffsetRect]
xor ecx, ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x12
jge 0x10047a5b
mov dword [ebp - 0x18], 0x5031
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], 0xfdadf860
mov dword [ebp - 0x34], 0x506ed55c
mov dword [ebp - 0x1c], ecx
jmp 0x10047ab5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x16c], 0xc178
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10047aa4
mov byte [ebp - 0x11], cl
cmp byte [ebp - 0x11], 0
je 0x10047acb
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, 0x9c8d
setl cl
sub ecx, 0xfffffff8
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne bl
neg ebx
neg ebx
sbb ebx, ebx
xor edx, edx
neg ebx
cmp ebx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp eax, esi
setle cl
add ecx, dword [ebp - 0x18]
jne 0x10047b2c
mov eax, dword [ebp - 0x28]
xor ebx, ebx
cmp dword [ebp - 0x10], ebx
je 0x10047b36
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
je 0x10047b52
cmp dword [ebp - 0x34], ebx
je 0x10047b52
mov eax, dword [ebp - 0x10]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10047b61
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0xc8], 0x2db5
lea ecx, [ebp - 0x144]
push 2
call fcn.1001a32c
push 4
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x18], 0x58d32ffa
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x30], 0x9642e40c
mov dword [ebp - 0x34], 0xa20b2878
mov dword [ebp - 0x1c], ebx
jmp 0x10047baf
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b0], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10047ba2
mov eax, dword [ebp - 0x18]
mov ecx, 0xe9e84363
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
push 7
sbb eax, eax
neg eax
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
push 2
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
pop esi
setl dl
xor ecx, ecx
mov dword [ebp - 0x1b0], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x14a5
setne al
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setg bl
xor ecx, ecx
cmp eax, ebx
setg cl
xor edx, edx
add ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
xor ebx, ebx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x1c], ebx
jmp 0x10047c4d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0x9e57ad95
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10047c3a
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0x144]
push eax
push ebx
call fcn.1004acc0
mov dword [ebp - 0x24], 0xfffffffe
add esp, 0xc
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x1c], ebx
jmp 0x10047c90
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x40], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10047c86
mov dword [ebp - 0x24], 0xa
jmp 0x10047cfc
mov dword [ebp - 0x10], 0xf01b
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x24], ebx
jne 0x10047cdc
mov eax, dword [ebp - 0x18]
inc eax
jne 0x10047cdc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x40], eax
cmp eax, dword [ebp - 0x10]
jl 0x10047cc2
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x18], ebx
je 0x10047cd1
cmp dword [ebp - 0x10], ebx
je 0x10047cd1
xor eax, eax
inc eax
jmp 0x10047cd3
mov eax, ebx
cmp eax, dword [ebp - 0x10]
jge 0x10047cdc
mov eax, ebx
jmp 0x10047cdf
xor eax, eax
inc eax
cmp eax, dword [ebp - 0x10]
jl 0x10047cee
cmp dword [ebp - 0x10], ebx
je 0x10047cee
xor eax, eax
inc eax
jmp 0x10047cf0
mov eax, ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xc
jg 0x10047c9f
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jl 0x10047f04
push 0xfffffffffffffff7
pop edi
mov dword [ebp - 0x20], 0x6cdee94c
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x40], ebx
jne 0x10047d8b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x40]
cmp dword [ebp - 0x20], ebx
je 0x10047d33
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov esi, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x40], esi
mov eax, dword [ebp - 0x28]
cmp eax, 0xc33bab72
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp esi, ecx
setne al
cmp eax, dword [ebp - 0x10]
jle 0x10047d87
cmp dword [ebp - 0x24], ebx
jne 0x10047d8b
mov ecx, ebx
jmp 0x10047d8e
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
add edx, 0x4fc37f20
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
imul eax, dword [ebp - 0x28], 0xe360
test eax, eax
setle cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x10], eax
je 0x10047ee0
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x30], 0xd53af4b5
mov dword [ebp - 0x10], ebx
jmp 0x10047e30
mov dword [ebp - 0x34], 0xfd208dd2
mov dword [ebp - 0x38], 0xfa0b5bcd
mov dword [ebp - 0x20], ebx
jmp 0x10047e28
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x40], ebx
jne 0x10047e1f
cmp dword [ebp - 0x10], ebx
je 0x10047e06
cmp dword [ebp - 0x34], ebx
je 0x10047e06
xor ecx, ecx
inc ecx
jmp 0x10047e08
mov ecx, ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x40], ecx
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0xeb8f
jge 0x10047e1f
mov eax, ebx
jmp 0x10047e22
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10047dee
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10047ddb
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, eax
setle cl
xor edx, edx
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
imul ecx, eax
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x40], ecx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
sub eax, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x4183
mov ecx, 0x918a9074
setl al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x30]
jg 0x10047ec8
mov dword [ebp - 0x34], 0x9e278474
cmp dword [ebp - 0x34], ebx
jne 0x10047efb
jmp 0x10047ef2
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10047ef2
push ebx
push 0xbc7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
jmp 0x10047ef2
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10047ef2
push ebx
push 0xb
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
dec dword [ebp - 0x24]
jns 0x10047d11
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 2
pop esi
mov byte [ebp - 0x29], bl
mov dword [ebp - 0x28], ebx
jmp 0x10047f1a
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x70], 0x26bdde0b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10047f0c
mov dword [ebp - 0x70], ebx
jmp 0x10047f37
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10047f34
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
dec dword [ebp - 0x70]
cmp dword [ebp - 0x70], 0xfffffffe
jle 0x10047f24
cmp byte [ebp - 0x29], bl
je 0x10047f54
push 0x1f66
push ebx
push ebx
push ebx
push ebx
call edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.1001abec
mov dword [ebp - 0x20], 0x901f
xor esi, esi
mov dword [ebp - 0x10], 0xfd2d1a4e
inc esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x28], ebx
jmp 0x10047f90
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x108], 0xfffffffa
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x10047f7f
cmp dword [ebp - 0x20], ebx
je 0x1004800e
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
imul edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x20]
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x38], 0xfc2f92e6
sbb eax, eax
inc eax
neg eax
je 0x10047fd6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x20]
je 0x10047fed
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x104], ebx
je 0x1004800e
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], bl
je 0x10048033
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x10048033
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10048033
mov dword [ebp - 0x34], 0xfffffffb
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x108]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x18]
jns 0x1004801a
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x10048053
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], bl
je 0x1004804e
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
dec dword [ebp - 0x10]
jns 0x1004803f
mov eax, 0x66bafcb1
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xf0], eax
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
push esi
call fcn.1001a32c
mov dword [ebp - 4], 5
mov dword [ebp - 0x24], ebx
jmp 0x1004809c
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1a0], 0xf3617394
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1004808b
mov dword [ebp - 0x24], ebx
jmp 0x100480b7
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xdc]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x100480a7
mov dword [ebp - 0x24], ebx
jmp 0x100480ce
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1bc], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x100480c1
cmp dword [ebp - 0x20], ebx
jne 0x100480db
mov esi, ebx
mov ecx, 0xa0b8
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0x19c], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg edx
push 7
sbb edx, edx
add eax, ecx
inc edx
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xdc]
setl cl
xor edx, edx
mov dword [eax], ecx
add ecx, 6
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setl dl
xor eax, eax
cmp esi, edx
setl al
mov dword [ebp - 0x20], eax
pop eax
push 3
mov dword [ebp - 0x20], eax
pop esi
jmp 0x100481e6
mov dword [ebp - 0x10], 0x2b90f998
mov dword [ebp - 0x10], 0x18
jmp 0x10048185
push 1
lea ecx, [ebp - 0x120]
call fcn.1001a32c
mov dword [ebp - 0x28], ebx
jmp 0x10048165
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0x42206dd2
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x10048152
mov eax, dword [ebp - 0x120]
lea ecx, [ebp - 0x120]
mov dword [eax], 0xf
call fcn.1001abec
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff9
jg 0x10048140
cmp dword [ebp - 0x10], ebx
je 0x100481b2
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0xec]
je 0x100481ad
cmp dword [ebp - 0xe8], ebx
je 0x100481b2
xor edx, edx
inc edx
jmp 0x100481b4
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xdc]
setle cl
xor edx, edx
cmp dword [eax], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xdc]
setle dl
add ecx, 0x66409095
add ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10048130
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdc]
call fcn.1001abec
mov dword [ebp - 0x34], 1
lea ecx, [ebp - 0x138]
push 4
call fcn.1001a32c
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], esi
jge 0x1004822f
push 7
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1004821d
mov dword [ebp - 0x10], ebx
jmp 0x10048247
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 0x7747
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10048234
mov eax, dword [ebp - 0x138]
dec dword [eax + 0xc]
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x10048270
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
lea ecx, [ebp - 0x138]
call fcn.1001abec
mov eax, dword [ebp - 0xe0]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0xcc]
mov edi, edx
mov esi, eax
call fcn.10046d17
mov ecx, dword [ebp - 0xc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret