Function at 0x119d2000
Capabilities:
Create process on windows
Delete directory
Get common file path
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007607c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x370
push ebx
push esi
push edi
mov esi, edx
mov dword [esp + 0x68], ecx
push 4
lea ecx, [esp + 0xf8]
mov dword [esp + 0x50], esi
call fcn.100100aa
mov dword [esp + 0x24], 0x6f97812a
xor ebx, ebx
mov dword [esp + 0x38], 0xfffffff8
push 0xffffffffffffffff
mov dword [esp + 0x3c], 9
mov dword [esp + 0x20], ebx
pop edi
jmp 0x119d2071
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x119d205f
push 3
mov dword [esp + 0x20], ebx
pop ecx
jmp 0x119d2090
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xe4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x119d2081
mov dword [esp + 0xec], ecx
cmp dword [esp + 0xec], ebx
jl 0x119d210a
mov eax, dword [esp + 0xf4]
lea edx, [eax + 4]
mov dword [edx], edi
mov dword [eax], 0x1d91
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 1
jb 0x119d20da
mov ecx, dword [esp + 0xec]
mov eax, dword [esp + 0xf4]
cmp dword [eax + ecx*4], ebx
jne 0x119d20da
mov eax, ebx
jmp 0x119d20dd
xor eax, eax
inc eax
xor ecx, ecx
cmp eax, 1
setl cl
xor eax, eax
cmp ecx, 0x25cb
setge al
mov dword [esp + 0x38], eax
mov dword [esp + 0x38], edi
dec dword [esp + 0xec]
js 0x119d210a
mov eax, dword [esp + 0xf4]
jmp 0x119d20b0
lea ecx, [esp + 0xf4]
call fcn.1001012c
mov dword [esp + 0x10], 0x76820624
lea ecx, [esp + 0x118]
mov dword [esp + 0x2c], 0x88b92280
push 2
call fcn.100100aa
mov dword [esp + 0x28], ebx
jmp 0x119d2150
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 0xd9796a0b
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jl 0x119d213a
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xffffffed
jg 0x119d21db
mov esi, dword [esp + 0x118]
mov dword [esp + 0xc], 0x51cf
xor edx, edx
mov dword [esp + 0x24], 0xa277ebd0
mov dword [esp + 0x38], 5
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
inc ecx
cmp ecx, eax
setle dl
add edx, dword [esp + 0x10]
mov dword [esp + 0x2c], edx
xor edx, edx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
setge dl
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
sub eax, dword [esp + 0x38]
mov dword [esi + 4], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffed
jle 0x119d2169
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x118]
lea ecx, [esp + 0x118]
mov dword [eax], 0x41791e6e
call fcn.1001012c
mov eax, dword [0x119cede4]
test al, 1
jne 0x119d2296
or eax, 1
mov dword [0x119cede4], eax
push ebx
mov dword [esp + 0x388], ebx
push ebx
mov dword [0x119cee10], ebx
mov dword [0x119cee14], ebx
call fcn.10012c9b
mov dword [0x119cee10], eax
mov dword [0x119cee18], ebx
mov dword [0x119cee20], ebx
mov byte [esp + 0x384], 2
mov ecx, 0x119cee18
mov dword [esp + 0xd8], eax
lea eax, [esp + 0xd8]
push eax
push 0x10
push ebx
lea eax, [esp + 0x204]
mov dword [0x119cee2c], 0x3f800000
push eax
mov dword [0x119cee1c], ebx
call fcn.10012a73
push 0x119d47b1
mov dword [0x119cee24], 7
mov dword [0x119cee28], 8
call fcn.10057ea7
pop ecx
mov dword [esp + 0x384], edi
mov dword [esp + 0xc], 0xd6804445
mov dword [esp + 0x28], 0x3f6085e0
mov dword [esp + 0x38], 0x13d0bb9
mov dword [esp + 0x2c], 0x130dfdda
mov dword [esp + 0x24], ebx
mov dword [esp + 0x48], 0x99649744
mov dword [esp + 0x44], ebx
mov dword [esp + 0x38], 0x9031ea06
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d22e1
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], eax
mov dword [esp + 0x2c], ebx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
cmp ecx, eax
setge dl
imul edx, dword [esp + 0x28]
test edx, edx
je 0x119d2313
cmp dword [esp + 0x2c], ebx
jne 0x119d231d
cmp dword [esp + 0x28], ebx
jne 0x119d231d
mov edx, ebx
jmp 0x119d2320
xor edx, edx
inc edx
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [esp + 0x28]
jl 0x119d2335
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
xor ecx, ecx
test eax, eax
push 0xfffffffffffffff9
setg cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x28]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x4c], ecx
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x4c]
sub ecx, eax
imul eax, dword [esp + 0x6c], 0x2710
mov dword [esp + 0x3c], ecx
xor ecx, ecx
add eax, esi
mov dword [esp + 0x74], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x30], 0xf2e96673
mov dword [esp + 0x20], 0xfffffffa
mov dword [esp + 0x3c], 0xd39c
mov dword [esp + 0x38], 0xfffffffe
pop eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x34], 5
mov dword [esp + 0x34], 0x7f5aee0c
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
imul eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x1c]
add edx, dword [esp + 0x10]
add edx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
cmp edx, eax
mov eax, 0xb060d2f3
setg cl
cmp eax, ecx
mov eax, dword [esp + 0x10]
mov ecx, 0x76ff
sbb esi, esi
sub ecx, eax
add ecx, dword [esp + 0x10]
inc esi
mov eax, dword [esp + 0x2c]
xor edx, edx
cmp ecx, esi
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x38], ecx
mov dword [esp + 0x10], 9
jmp 0x119d243c
mov dword [esp + 0x24], 0xfffe
mov dword [esp + 0x1c], 0xfffffff3
jmp 0x119d2431
mov dword [esp + 0x34], 0xfbe58499
inc dword [esp + 0x24]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xb
jge 0x119d2421
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x36
jle 0x119d240f
lea eax, [esp + 0x70]
push eax
call fcn.100202f3
push 3
pop esi
mov edi, dword [eax]
xor eax, eax
mov dword [esp + 0x18], 0xe0648261
inc eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0x4e2b
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], edi
cmp dword [esp + 0x18], esi
jne 0x119d24db
jmp 0x119d2488
xor eax, eax
inc eax
push eax
lea ecx, [esp + 0x17c]
call fcn.100100aa
mov dword [esp + 0x28], ebx
jmp 0x119d24b1
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0x34e6d4f2
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 1
jl 0x119d249b
mov eax, dword [esp + 0x178]
lea ecx, [esp + 0x178]
mov dword [eax], 0xb0e446df
call fcn.1001012c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
je 0x119d2485
mov dword [esp + 0x24], 0xa7f4
xor ecx, ecx
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x18]
cmp eax, 4
mov eax, dword [esp + 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp edx, eax
mov eax, 0xa0a9f4f9
setne cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
sub eax, dword [esp + 0x18]
sub eax, 0x3acb
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], 0xc13f
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 1
setle cl
xor edx, edx
imul ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
add eax, 0xfffffffd
add ecx, eax
mov eax, dword [esp + 0x18]
cmp eax, ecx
setne dl
mov dword [esp + 0x18], edx
test edi, edi
je 0x119d2903
mov dword [esp + 0x18], 0xfffa
mov dword [esp + 0xc], 0xffb871c7
mov dword [esp + 0x30], 0xdbc9b780
mov dword [esp + 0x10], 8
mov dword [esp + 0x4c], 0x21d5
cmp dword [esp + 0x4c], 0x1137
jge 0x119d25ff
lea eax, [esp + 0xdc]
push eax
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0xc8]
push eax
push 0x100093ec
call fcn.10057beb
mov ecx, dword [esp + 0xd0]
mov edx, dword [esp + 0xd8]
mov eax, dword [esp + 0xec]
dec edx
dec eax
add edx, ecx
add eax, ecx
imul edx, eax
lea eax, [ecx - 1]
imul eax, ecx
sub edx, eax
push edx
push 0x10009160
call fcn.10057ed1
add esp, 0x18
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], ebx
je 0x119d2839
push esi
lea ecx, [esp + 0x98]
call fcn.100100aa
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0x34ea885c
mov dword [esp + 0x28], ebx
jmp 0x119d2646
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x94]
mov dword [eax + ecx*4], 0xdaab72b2
inc dword [esp + 0x28]
cmp dword [esp + 0x28], esi
jl 0x119d2630
mov dword [esp + 0x18], 0xffffffff
cmp dword [esp + 0x18], 0x17
jle 0x119d27a7
mov esi, dword [esp + 0x94]
push 3
pop edi
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x2c], 0xfff9
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], 0xffffffff
cmp dword [esi + 8], ebx
je 0x119d26d8
cmp dword [esp + 0x28], ebx
jne 0x119d2694
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x30], 0x38f738f5
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
cmp eax, ecx
setge dl
sub edx, dword [esp + 0x28]
mov eax, dword [esp + 0x94]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax + 4], 0xecf4
setl cl
add edx, ecx
je 0x119d26d8
xor eax, eax
inc eax
jmp 0x119d26da
mov eax, ebx
mov dword [esp + 0x20], eax
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov ecx, 0x8bee6dab
setg dl
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
add eax, 4
jne 0x119d2718
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x48], ebx
imul eax, dword [esp + 0x48], 0xffff61b8
test eax, eax
je 0x119d2767
cmp dword [esp + 0x48], ebx
je 0x119d2767
xor edx, edx
inc edx
jmp 0x119d2769
mov edx, ebx
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setg cl
cmp edi, ecx
sbb eax, eax
neg eax
sub eax, dword [esi + 8]
cmp eax, dword [esp + 0x2c]
jg 0x119d278e
cmp dword [esp + 0x18], ebx
je 0x119d278e
xor eax, eax
inc eax
jmp 0x119d2790
mov eax, ebx
mov dword [esp + 0x4c], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x17
jg 0x119d2669
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], 0xba9e
cmp dword [esp + 0x20], ebx
jne 0x119d27c3
cmp dword [esp + 0x18], ebx
jne 0x119d27c3
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xbae6ac69
mov eax, dword [esp + 0x94]
setne cl
sub ecx, dword [eax + 8]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x94]
cmp dword [eax + 4], ebx
jne 0x119d2814
cmp dword [esp + 0x10], ebx
jne 0x119d2814
mov edx, ebx
jmp 0x119d2817
xor edx, edx
inc edx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
sete cl
imul ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x94]
call fcn.1001012c
jmp 0x119d2863
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d2863
push 0xcd3
push 0x12d1
push 0x1f01
push 0x1069
push 0xd59
call dword [sym.imp.GDI32.dll_Ellipse]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d2875
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 2
lea ecx, [esp + 0x14c]
mov dword [esp + 0x88], edi
call fcn.100100aa
xor edx, edx
mov dword [esp + 0x20], 0x3532fe22
inc edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x4c], 0x72a8358b
mov dword [esp + 0xc], ebx
jmp 0x119d28bd
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x119d28a7
mov dword [esp + 0x20], ebx
jmp 0x119d28ec
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x148]
imul eax, dword [eax + ecx*4], 0x8795
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x4c], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jle 0x119d28ca
lea ecx, [esp + 0x148]
call fcn.1001012c
jmp 0x119d4788
mov dword [esp + 0x10], 0xfffffffe
lea ecx, [esp + 0x190]
mov dword [esp + 0x1c], esi
push 2
call fcn.100100aa
mov dword [esp + 0xc], ebx
jmp 0x119d2939
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0xb8d96378
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x119d2923
push 4
mov dword [esp + 0x14], 0xfffffff2
pop edi
cmp dword [esp + 0x10], edi
jne 0x119d29fe
mov esi, 0xaafe30f5
mov dword [esp + 0x20], 0xe1d925b0
cmp dword [esp + 0x20], ebx
je 0x119d297a
mov dword [esp + 0x38], 1
mov dword [esp + 0x38], 0x7d45db34
jmp 0x119d29ed
mov dword [esp + 0x84], esi
mov dword [esp + 0x88], esi
mov dword [esp + 0x8c], esi
mov dword [esp + 0x90], esi
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 0x1b
jg 0x119d29ed
push 3
pop eax
mov dword [esp + 0x2c], 0x7a5b7d8c
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], ebx
jl 0x119d29c4
mov dword [esp + 0x1c], 0x8959310c
dec dword [esp + 0x2c]
jns 0x119d29b6
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d29e2
push 0x1504
push 0x7df
call dword [sym.imp.GDI32.dll_SetROP2]
push 3
pop eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x1b
jle 0x119d29a4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
je 0x119d295a
push 3
pop esi
mov dword [esp + 0x1c], 1
cmp dword [esp + 0x1c], ebx
jl 0x119d2a4f
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], 0x2370
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x190]
mov eax, dword [esp + 0x10]
mov ecx, dword [ecx + edx*4]
sub ecx, eax
xor eax, eax
dec ecx
cmp ecx, 1
setle al
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x1c]
dec dword [esp + 0x1c]
jns 0x119d2a0c
lea ecx, [esp + 0x190]
call fcn.1001012c
mov eax, dword [0x119cede4]
test al, 2
jne 0x119d2afe
or eax, 2
mov dword [0x119cede4], eax
push ebx
mov dword [esp + 0x388], esi
push ebx
mov dword [0x119cedf0], ebx
mov dword [0x119cedf4], ebx
call fcn.10012c9b
mov dword [0x119cedf0], eax
mov dword [0x119cedf8], ebx
mov dword [0x119cee00], ebx
mov byte [esp + 0x384], 5
mov ecx, 0x119cedf8
mov dword [esp + 0xe0], eax
lea eax, [esp + 0xe0]
push eax
push 0x10
push ebx
lea eax, [esp + 0xfc]
mov dword [0x119cee0c], 0x3f800000
push eax
mov dword [0x119cedfc], ebx
call fcn.10012a73
push 0x119d47ac
mov dword [0x119cee04], 7
mov dword [0x119cee08], 8
call fcn.10057ea7
or dword [esp + 0x388], 0xffffffff
pop ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0xa0], xmm0
mov dword [esp + 0x18], 0x8ade19d2
mov dword [esp + 0x1c], 0x25b0e446
mov dword [esp + 0x20], 0x5db34e6d
mov dword [esp + 0x34], 0xd26bc8b8
mov dword [esp + 0xc], ebx
jmp 0x119d2b40
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x5c], 0xf2e5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x119d2b30
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 2
jg 0x119d2dd9
mov dword [esp + 0x38], 0x72b752bf
lea ecx, [esp + 0x10c]
push edi
call fcn.100100aa
push 1
lea ecx, [esp + 0x164]
mov dword [esp + 0x388], 6
call fcn.100100aa
xor edx, edx
mov byte [esp + 0x384], 7
inc edx
mov dword [esp + 0x44], edx
mov dword [esp + 0x10], ebx
jmp 0x119d2bba
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x119d2ba8
mov dword [esp + 0x10], ebx
jmp 0x119d2bdc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0x6658d83f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x119d2bc6
cmp dword [esp + 0x1c], ebx
jne 0x119d2bf8
mov eax, dword [esp + 0x18]
mov ecx, ebx
mov eax, dword [esp + eax*4 + 0x5c]
add eax, dword [esp + 0x20]
je 0x119d2bfa
mov ecx, edx
mov eax, dword [esp + 0x1c]
sub ecx, eax
je 0x119d2c06
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
cmp edx, eax
mov eax, dword [esp + 0x18]
setle cl
sub ecx, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
cmp ecx, dword [esp + eax*4 + 0x5c]
mov esi, dword [esp + 0x10c]
jl 0x119d2c57
cmp dword [esi + 4], ebx
je 0x119d2c57
xor eax, eax
inc eax
jmp 0x119d2c59
mov eax, ebx
xor ecx, ecx
cmp eax, 0xc0a
mov eax, dword [esp + 0x160]
setne cl
xor edx, edx
cmp ecx, dword [eax]
setl dl
inc edx
jne 0x119d2c7d
cmp dword [esi + 4], ebx
jne 0x119d2c7d
mov eax, ebx
jmp 0x119d2c80
xor eax, eax
inc eax
cmp dword [esp + 0x5c], eax
jle 0x119d2c91
cmp dword [esp + 0x18], ebx
je 0x119d2c91
xor edx, edx
inc edx
jmp 0x119d2c93
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
cmp eax, edx
setle cl
add ecx, 0x10ac866
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0xc], 0xfdcbc339
mov dword [esp + 0x38], 0xfffffff9
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d2ce5
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x1c], ebx
jmp 0x119d2d9c
push dword [esp + 0xf0]
movdqa xmm0, xmmword [0x10009a90]
lea eax, [esp + 0x244]
push eax
lea eax, [esp + 0x238]
mov dword [esp + 0x108], ebx
push eax
push ebx
lea ecx, [esp + 0x110]
mov dword [esp + 0x114], ebx
movdqu xmmword [esp + 0x240], xmm0
mov dword [esp + 0x118], ebx
call fcn.10013c3b
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0x5c], ebx
jne 0x119d2d5a
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x1c]
jge 0x119d2d70
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x5c]
add edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x18]
neg edx
mov eax, dword [esp + 0x10c]
sbb edx, edx
neg edx
mov dword [eax + ecx*4], edx
lea ecx, [esp + 0x100]
call fcn.1001012c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x119d2cee
lea ecx, [esp + 0x160]
call fcn.1001012c
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x10c]
call fcn.1001012c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x119d2b65
push 3
pop esi
lea eax, [esp + 0x68]
push eax
call fcn.10020355
push esi
lea ecx, [esp + 0x1ac]
mov edi, dword [eax]
mov dword [esp + 0x30], 0x1d925b0e
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0xfb5d1cb6
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], edi
call fcn.100100aa
mov dword [esp + 0x384], 8
mov dword [esp + 0xc], ebx
jmp 0x119d2e41
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], 0xf5379a1d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x119d2e2b
cmp dword [esp + 0x2c], ebx
je 0x119d2e9c
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp ecx, eax
setle dl
sub edx, dword [esp + 0x10]
cmp edx, dword [esp + 0x10]
jg 0x119d2e6a
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jne 0x119d2e74
mov ecx, ebx
jmp 0x119d2e77
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x10]
xor edx, edx
cmp eax, ecx
setl dl
imul eax, dword [esp + 0x2c], 0xffff
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, dword [esp + 0x2c]
jle 0x119d2e9c
xor eax, eax
inc eax
jmp 0x119d2e9e
mov eax, ebx
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x119d2eb3
cmp dword [esp + 0x2c], ebx
je 0x119d2eb3
xor edx, edx
inc edx
jmp 0x119d2eb5
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], ebx
jne 0x119d2ee3
cmp dword [esp + 0x10], ebx
je 0x119d2ed5
xor eax, eax
inc eax
jmp 0x119d2ed7
mov eax, ebx
sub eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], 0x8e1c
mov dword [esp + 0x18], 0xc
jmp 0x119d300f
mov dword [esp + 0x48], 0x2bf390f3
lea ecx, [esp + 0x130]
push 1
call fcn.100100aa
mov byte [esp + 0x384], 9
mov dword [esp + 0xc], ebx
jmp 0x119d2f32
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0x15e40c88
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x119d2f1c
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0xffffffe3
je 0x119d2ff7
mov esi, dword [esp + 0x1a8]
push 3
pop eax
push eax
lea ecx, [esp + 0x1c4]
call fcn.100100aa
push 3
mov dword [esp + 0x10], ebx
pop edx
jmp 0x119d2f7e
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c0]
mov dword [eax + ecx*4], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x119d2f68
mov eax, dword [esp + 0x18]
mov ecx, 0x8169b41d
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c0]
mov eax, dword [eax + 4]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
mov eax, dword [esp + 0x130]
setle cl
cmp ecx, 1
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax]
lea ecx, [esp + 0x1c0]
mov eax, dword [esp + 0x48]
setge dl
sub eax, edx
mov dword [esi + 4], eax
mov dword [esp + 0x38], 0xfffffffe
call fcn.1001012c
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe3
jne 0x119d2f4f
lea ecx, [esp + 0x130]
mov byte [esp + 0x384], 8
call fcn.1001012c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x39
je 0x119d2ef8
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d3032
push ebx
push ebx
push 0x2143
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x1a8]
call fcn.1001012c
cmp byte [ebp + 0xc], 0
jne 0x119d3054
test edi, edi
jne 0x119d349d
mov dword [esp + 0x34], 0xffffffff
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d3077
push ebx
push ebx
push 0x18cf
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d3092
push 0xe37
push 0x13a1
call dword [sym.imp.GDI32.dll_SetLayout]
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x2a8]
mov ecx, dword [esp + 0x68]
push eax
call fcn.100145f4
mov esi, eax
lea edi, [esp + 0xa4]
pop ecx
push 3
xor ecx, ecx
movsd dword es:[edi], dword [esi]
inc ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], 0xfffffffa
mov dword [esp + 0x28], 0xfffffffe
mov dword [esp + 0x30], 8
mov dword [esp + 0x4c], 0xe8ca4045
mov dword [esp + 0x4c], 0x7675e6d
mov dword [esp + 0x3c], 0xfd7f
mov dword [esp + 0x14], ebx
pop esi
cmp dword [esp + 0x10], esi
jge 0x119d3109
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x13c], ecx
inc dword [esp + 0x10]
jmp 0x119d30f2
mov dword [esp + 0x10], ebx
jmp 0x119d311e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x21c], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x119d310f
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 2
jg 0x119d32c2
jmp 0x119d3139
xor ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x30], 0x7be9fb1c
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], 0x405732aa
mov dword [esp + 0x44], ecx
mov dword [esp + 0x18], ebx
jmp 0x119d316e
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x13c], 0x137b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x119d315b
cmp dword [esp + 0x20], ebx
je 0x119d3238
mov eax, dword [esp + 0xc]
xor edx, edx
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x1c]
jne 0x119d31b4
cmp dword [esp + 0x2c], ebx
jne 0x119d31b4
mov ecx, ebx
jmp 0x119d31b7
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x18]
xor edx, edx
imul eax, dword [esp + 0xc]
imul eax, ecx
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x48]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setne dl
cmp edx, 0xffffffff
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x1c]
jl 0x119d31f4
cmp dword [esp + 0x48], ebx
je 0x119d31ff
cmp dword [esp + 0x20], ebx
je 0x119d31ff
xor edx, edx
inc edx
jmp 0x119d3201
mov edx, ebx
mov eax, dword [esp + 0x30]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [esp + 0x20]
test ecx, ecx
je 0x119d3226
cmp dword [esp + 0x2c], ebx
je 0x119d3226
cmp dword [esp + 0x1c], ebx
je 0x119d3226
xor eax, eax
inc eax
jmp 0x119d3228
mov eax, ebx
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
mov eax, dword [esp + 0xc]
setle dl
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x44]
sub eax, dword [esp + 0x1c]
je 0x119d326e
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x44]
add eax, 0x2506
cmp eax, dword [esp + 0x20]
je 0x119d3285
mov eax, dword [esp + 0x30]
dec dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + eax*4 + 0x13c]
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x13c], ecx
mov eax, dword [esp + 0x18]
sub ecx, eax
add ecx, 0x1c2b
mov dword [esp + 0x18], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x119d3136
cmp byte [ebp + 0xc], 0
mov eax, dword [esp + 0x220]
mov dword [esp + 0x38], eax
je 0x119d349d
cmp dword [esp + 0xa8], 0
je 0x119d349d
mov dword [esp + 0x38], 0x1a32
cmp dword [esp + 0x38], 0x1188
jge 0x119d3368
mov dword [0x10665490], 1
mov esi, 0x1163d974
call fcn.1001fc72
mov dword [esi], eax
add esi, 4
cmp esi, 0x1163da64
jle 0x119d3306
push 0x10bad77c
mov esi, 0x10009148
push esi
call fcn.10057beb
pop ecx
pop ecx
jmp 0x119d3356
dec eax
push 0x1066558c
push esi
mov dword [0x10bad77c], eax
call fcn.10057beb
mov eax, dword [0x1066558c]
push dword [eax*4 + 0x1163d970]
push 0x10009234
call fcn.10057ed1
add esp, 0x10
mov eax, dword [0x10bad77c]
test eax, eax
jne 0x119d332c
dec eax
push 3
mov dword [0x10bad77c], eax
pop esi
mov dword [esp + 0x18], 0xe0648261
xor eax, eax
inc eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x44], 0x4e2b
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x44], eax
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], esi
jne 0x119d33ed
jmp 0x119d339a
xor eax, eax
inc eax
push eax
lea ecx, [esp + 0x158]
call fcn.100100aa
mov dword [esp + 0xc], ebx
jmp 0x119d33c3
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 0x34e6d4f2
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x119d33ad
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x154]
mov dword [eax], 0xb0e446df
call fcn.1001012c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
je 0x119d3397
mov dword [esp + 0x44], 0xa7f4
xor ecx, ecx
mov eax, dword [esp + 0x44]
imul eax, dword [esp + 0x18]
cmp eax, 4
mov eax, dword [esp + 0x18]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp edx, eax
mov eax, 0xa0a9f4f9
setne cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
sub eax, dword [esp + 0x18]
sub eax, 0x3acb
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x44], 0xc13f
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 1
setle cl
xor edx, edx
imul ecx, dword [esp + 0x18]
mov dword [esp + 0x44], ecx
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x18]
add eax, 0xfffffffd
add ecx, eax
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov eax, dword [esp + 0xac]
mov dword [esp + 0x88], eax
mov eax, dword [esp + 0xa8]
setne dl
mov dword [esp + 0x18], edx
mov dword [esp + 0x8c], eax
push 4
lea ecx, [esp + 0x170]
call fcn.100100aa
push 4
mov dword [esp + 0x14], ebx
pop edx
jmp 0x119d34c7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x250], 0x82062403
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x119d34b4
mov dword [esp + 0x10], ebx
jmp 0x119d34e9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x119d34d3
mov esi, dword [esp + 0x16c]
push 3
pop edi
mov dword [esi + 0xc], ebx
mov eax, dword [esi + 0xc]
xor ecx, ecx
inc ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x44], 0x4dde9ab5
mov dword [esp + 0x38], 0xc9dffbe5
cmp dword [esp + eax*4 + 0x250], ebx
je 0x119d3545
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d3538
push ebx
push 0x245d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [esp + 0x30], 0xfe1ca29
jmp 0x119d363b
mov dword [esp + 0xc], ebx
jmp 0x119d355e
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xd4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x119d354b
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d3580
push 0xf9f
push ebx
push 0x266
call dword [sym.imp.USER32.dll_GetClassNameW]
mov dword [esp + 0x30], 0xfffffff9
jmp 0x119d3630
mov dword [esp + 0xc], ebx
mov dword [esp + 0x38], 0x17cd9532
mov dword [esp + 0xc], ebx
jmp 0x119d360f
mov dword [esp + 0x2c], 0xfffffff9
xor edx, edx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xd4]
cmp eax, ecx
setl dl
xor ecx, ecx
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x44]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x2c]
cmp eax, 1
setl cl
cmp ecx, 0xffffffff
ja 0x119d35e0
cmp dword [esp + 0x2c], ebx
jne 0x119d35e0
mov ecx, ebx
jmp 0x119d35e3
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x2c]
xor edx, edx
cmp ecx, eax
mov eax, dword [esi + 0xc]
setg dl
mov ecx, dword [esp + eax*4 + 0x250]
xor eax, eax
cmp edx, 6
setne al
imul ecx, eax
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x30]
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff4
jle 0x119d359f
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d362c
push 0x1206
call dword [sym.imp.GDI32.dll_RealizePalette]
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xfffffff5
jne 0x119d358d
inc dword [esi + 0xc]
cmp dword [esi + 0xc], edi
jle 0x119d34fc
mov edi, dword [esp + 0x28]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d366a
push ebx
push ebx
push ebx
push ebx
push 0xc4d
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [esp + 0x16c]
call fcn.1001012c
test edi, edi
jne 0x119d426b
cmp dword [esp + 0xa0], edi
jle 0x119d426b
mov dword [esp + 0x20], 0x6a9e
mov dword [esp + 0x24], 0x5c285ce9
mov dword [esp + 0x38], 0x3c7d24b5
mov dword [esp + 0x34], 0x360de574
mov dword [esp + 0xc], ebx
jmp 0x119d36c4
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xcc], 0xbbe56890
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x119d36b1
mov eax, dword [esp + 0x20]
xor edx, edx
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0xcc]
mov eax, dword [esp + 0x24]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xb28e
setg al
xor ecx, ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x38]
mov eax, dword [esp + 0xd0]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setg dl
sub eax, edx
jne 0x119d3721
cmp dword [esp + 0x20], ebx
jne 0x119d3721
mov edx, ebx
jmp 0x119d3724
xor edx, edx
inc edx
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp eax, edx
setge cl
cmp ecx, 0x5411
jge 0x119d373e
mov eax, dword [esp + 0xcc]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x38], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], al
je 0x119d3757
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [esp + 0x34], 0x2e31d83
mov ecx, 0xffff
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x34], 7
mov dword [esp + 0x34], 0xfffffff7
mov dword [esp + 0x24], ecx
mov dword [esp + 0x10], ebx
jmp 0x119d3799
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1d8], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x119d378a
mov dword [esp + 0x10], ebx
jmp 0x119d37b9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2b8], 0x5f0ed1ad
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x119d37a6
mov eax, dword [esp + 0x24]
inc dword [esp + 0x24]
test eax, eax
jle 0x119d37d1
xor ecx, ecx
inc ecx
jmp 0x119d37d3
mov ecx, ebx
mov eax, dword [esp + 0x1d8]
sub eax, ecx
je 0x119d3829
push 2
lea ecx, [esp + 0x188]
call fcn.100100aa
mov dword [esp + 0xc], ebx
jmp 0x119d3808
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x119d37f2
mov eax, dword [esp + 0x184]
lea ecx, [esp + 0x184]
push 3
pop esi
mov dword [eax], esi
call fcn.1001012c
jmp 0x119d3849
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d3846
push ebx
push ebx
push 0x2310
push 0x2242
call dword [sym.imp.USER32.dll_PostMessageA]
push 3
pop esi
mov dword [esp + 0x1c], ebx
xor ecx, ecx
mov dword [esp + 0xc], 0xfffffffa
inc ecx
mov dword [esp + 0x48], 0xfffffffe
mov dword [esp + 0x2c], 8
mov dword [esp + 0x24], 0xe8ca4045
mov dword [esp + 0x44], 0x7675e6d
mov dword [esp + 0x38], 0xfd7f
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], esi
jge 0x119d389b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x19c], ecx
inc dword [esp + 0x10]
jmp 0x119d3884
mov dword [esp + 0x10], ebx
jmp 0x119d38b0
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1fc], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x119d38a1
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 2
jg 0x119d3a54
jmp 0x119d38cb
xor ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x30], 0x7be9fb1c
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], 0x405732aa
mov dword [esp + 0x38], ecx
mov dword [esp + 0x18], ebx
jmp 0x119d3900
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x19c], 0x137b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x119d38ed
cmp dword [esp + 0x20], ebx
je 0x119d39ca
mov eax, dword [esp + 0xc]
xor edx, edx
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x1c]
jne 0x119d3946
cmp dword [esp + 0x2c], ebx
jne 0x119d3946
mov ecx, ebx
jmp 0x119d3949
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x18]
xor edx, edx
imul eax, dword [esp + 0xc]
imul eax, ecx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setne dl
cmp edx, 0xffffffff
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x1c]
jl 0x119d3986
cmp dword [esp + 0x24], ebx
je 0x119d3991
cmp dword [esp + 0x20], ebx
je 0x119d3991
xor edx, edx
inc edx
jmp 0x119d3993
mov edx, ebx
mov eax, dword [esp + 0x30]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [esp + 0x20]
test ecx, ecx
je 0x119d39b8
cmp dword [esp + 0x2c], ebx
je 0x119d39b8
cmp dword [esp + 0x1c], ebx
je 0x119d39b8
xor eax, eax
inc eax
jmp 0x119d39ba
mov eax, ebx
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
test eax, eax
mov eax, dword [esp + 0xc]
setle dl
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x1c]
je 0x119d3a00
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
add eax, 0x2506
cmp eax, dword [esp + 0x20]
je 0x119d3a17
mov eax, dword [esp + 0x30]
dec dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + eax*4 + 0x19c]
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x19c], ecx
mov eax, dword [esp + 0x18]
sub ecx, eax
add ecx, 0x1c2b
mov dword [esp + 0x18], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x119d38c8
mov eax, dword [esp + 0x200]
cmp dword [esp + 0xa4], 0
mov dword [esp + 0x38], eax
je 0x119d426b
push 2
lea ecx, [esp + 0x1f0]
call fcn.100100aa
mov dword [esp + 0x384], 0xa
mov dword [esp + 0x30], esi
mov dword [esp + 0x50], 0x564c7b7f
mov dword [esp + 0xc], ebx
jmp 0x119d3aae
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1ec]
mov dword [eax + ecx*4], 0xfffd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x119d3a98
xor ecx, ecx
mov dword [esp + 0x30], ebx
inc ecx
jmp 0x119d412a
mov dword [esp + 0x34], 0x8ea5f34b
mov dword [esp + 0x34], 0x96753f3a
mov dword [esp + 0x34], 0xd162c5d1
mov dword [esp + 0xc], ebx
jmp 0x119d3aef
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x54], 0xf2000252
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x119d3adf
mov dword [esp + 0x54], ebx
jmp 0x119d411c
mov dword [esp + 0x20], 0x2a8358bd
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x34], ecx
mov dword [esp + 0x34], 0xfffffff7
mov dword [esp + 0x38], 0x1556
cmp dword [esp + 0x38], 0x786
jge 0x119d3fd6
lea eax, [esp + 0x74]
push eax
push 0x10009148
call fcn.10057beb
pop ecx
pop ecx
xor ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x74], ecx
jl 0x119d3fd6
lea eax, [esp + 0x7c]
push eax
lea eax, [esp + 0x5c]
push eax
push 0x10009170
call fcn.10057beb
add esp, 0xc
mov edi, ebx
cmp dword [esp + 0x58], 0
jle 0x119d3b90
lea esi, [esp + 0x260]
push esi
push 0x10009148
call fcn.10057beb
inc edi
add esi, 4
pop ecx
pop ecx
cmp edi, dword [esp + 0x58]
jl 0x119d3b79
push 0xa9
lea eax, [esp + 0x2cc]
push ebx
push eax
call fcn.1000fc4d
add esp, 0xc
mov esi, ebx
cmp dword [esp + 0x7c], 0
jle 0x119d3c05
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0x7c]
push eax
push 0x10009170
call fcn.10057beb
mov edx, dword [esp + 0x84]
add esp, 0xc
mov ecx, dword [esp + 0x80]
dec edx
dec ecx
mov dword [esp + 0x78], edx
imul eax, ecx, 0xd
mov dword [esp + 0x80], ecx
add eax, edx
mov byte [esp + eax + 0x2c8], 1
imul eax, edx, 0xd
add eax, ecx
inc esi
mov byte [esp + eax + 0x2c8], 1
cmp esi, dword [esp + 0x7c]
jl 0x119d3baf
cmp dword [esp + 0x58], 1
jne 0x119d3c23
push dword [esp + 0x260]
push 0x100093f8
call fcn.10057ed1
pop ecx
jmp 0x119d3fbc
push 0x548000
push 0xffffffffffffffff
push 0x10665590
call fcn.1000fc4d
add esp, 0xc
push 0xa90000
push ebx
push 0x10bad970
call fcn.1000fc4d
mov esi, dword [esp + 0x64]
add esp, 0xc
mov eax, ebx
mov dword [esp + 0x24], eax
test esi, esi
jle 0x119d3cd7
mov ecx, ebx
lea edx, [esp + 0x260]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x38], edx
mov edi, ebx
cmp eax, edi
je 0x119d3cbb
lea eax, [edi + ecx]
cmp byte [esp + eax + 0x2c8], 0
je 0x119d3cb7
xor eax, eax
lea edx, [edi + ecx]
inc eax
shl edx, 0xd
mov ecx, esi
shl eax, cl
lea ecx, [edx + eax]
mov edx, dword [esp + 0x38]
mov eax, dword [esp + edi*4 + 0x260]
mov dword [ecx*8 + 0x10bad968], 1
mov dword [ecx*8 + 0x10bad96c], ebx
imul eax, dword [edx]
mov dword [ecx*4 + 0x1066558c], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x24]
inc edi
cmp edi, esi
jl 0x119d3c6b
inc eax
add edx, 4
add ecx, 0xd
mov dword [esp + 0x24], eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x44], ecx
cmp eax, esi
jl 0x119d3c69
xor edx, edx
mov ecx, esi
inc edx
shl edx, cl
push 3
sub edx, 2
pop eax
jmp 0x119d3ea0
mov ecx, ebx
mov dword [esp + 0xc], ecx
test esi, esi
jle 0x119d3e9f
lea eax, [esp + 0x260]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], eax
mov edi, ebx
mov eax, ebx
lea ebx, [esp + 0x260]
mov dword [esp + 0x24], edi
mov dword [esp + 0x48], ebx
xor ebx, ebx
mov dword [esp + 0x20], eax
cmp ecx, edi
je 0x119d3e6c
xor eax, eax
inc eax
shl eax, cl
test edx, eax
je 0x119d3e68
xor eax, eax
mov ecx, edi
inc eax
shl eax, cl
test edx, eax
je 0x119d3e64
mov eax, dword [esp + 0x10]
lea eax, [esp + eax + 0x2c8]
cmp byte [edi + eax], 0
mov dword [esp + 0x44], eax
je 0x119d3e64
mov edi, ebx
xor eax, eax
mov ecx, edi
inc eax
shl eax, cl
mov dword [esp + 0x38], eax
test eax, edx
jne 0x119d3e55
mov ecx, dword [esp + 0x20]
lea eax, [edi + ecx]
cmp byte [esp + eax + 0x2c8], 0
je 0x119d3e55
add ecx, edi
mov eax, edx
or eax, dword [esp + 0x38]
shl ecx, 0xd
add eax, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [eax*4 + 0x10665590]
test eax, eax
js 0x119d3e55
mov ecx, dword [esp + 0x28]
mov ebx, dword [esp + 0x48]
mov ecx, dword [ecx]
imul ecx, dword [ebx]
add ecx, eax
mov eax, dword [esp + 0x44]
cmp byte [edi + eax], 0
je 0x119d3dd6
mov esi, dword [esp + 0x28]
mov eax, dword [esp + edi*4 + 0x260]
imul eax, dword [esi]
mov esi, dword [esp + 0x58]
imul eax, dword [ebx]
add ecx, eax
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x10]
shl eax, 0xd
add eax, edx
mov dword [esp + 0x38], eax
mov ebx, dword [eax*4 + 0x10665590]
mov dword [esp + 0x18], ebx
cmp ecx, ebx
jle 0x119d3e27
inc edi
cmp edi, esi
jl 0x119d3d5e
mov edi, dword [esp + 0x24]
xor ebx, ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
add dword [esp + 0x48], 4
inc edi
add eax, 0xd
mov dword [esp + 0x24], edi
mov dword [esp + 0x20], eax
cmp edi, esi
jl 0x119d3d1f
add dword [esp + 0x28], 4
inc ecx
add dword [esp + 0x10], 0xd
mov dword [esp + 0xc], ecx
cmp ecx, esi
jl 0x119d3d06
push 3
pop eax
dec edx
cmp edx, eax
jge 0x119d3ce9
or ecx, 0xffffffff
xorps xmm0, xmm0
mov dword [esp + 0x24], ecx
mov eax, ebx
movlpd qword [esp + 0x38], xmm0
mov dword [esp + 0x20], eax
test esi, esi
jle 0x119d3fb2
mov edi, dword [esp + 0x3c]
mov edx, ebx
mov dword [esp + 0x2c], edi
mov edi, dword [esp + 0x38]
mov dword [esp + 0xc], edx
mov dword [esp + 0x28], edi
mov edi, ebx
mov ebx, dword [esp + 0x2c]
cmp eax, edi
je 0x119d3f55
lea eax, [edi + edx]
cmp byte [esp + eax + 0x2c8], 0
je 0x119d3f51
xor edx, edx
xor eax, eax
inc edx
inc eax
mov ecx, edi
shl edx, cl
mov ecx, dword [esp + 0x20]
shl eax, cl
mov ecx, dword [esp + 0x24]
or edx, eax
mov eax, dword [esp + 0xc]
add eax, edi
shl eax, 0xd
add eax, edx
mov edx, dword [eax*4 + 0x10665590]
cmp edx, ecx
jle 0x119d3f35
mov ebx, dword [eax*8 + 0x10bad974]
mov ecx, edx
mov edx, dword [eax*8 + 0x10bad970]
mov dword [esp + 0x24], ecx
jmp 0x119d3f49
jne 0x119d3f4d
mov edx, dword [esp + 0x28]
add edx, dword [eax*8 + 0x10bad970]
adc ebx, dword [eax*8 + 0x10bad974]
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
inc edi
cmp edi, esi
jl 0x119d3ee2
inc eax
mov dword [esp + 0x2c], ebx
add edx, 0xd
mov dword [esp + 0x20], eax
mov dword [esp + 0xc], edx
push 0
pop ebx
cmp eax, esi
jl 0x119d3edc
cmp ecx, 0xffffffff
je 0x119d3fb2
mov edi, ebx
mov eax, ebx
add edi, dword [esp + eax*4 + 0x260]
inc eax
cmp eax, esi
jl 0x119d3f7e
push ebx
push 2
push dword [esp + 0x34]
push dword [esp + 0x34]
call fcn.100701e0
push edx
push eax
mov eax, dword [esp + 0x2c]
add eax, edi
push eax
push 0x10009408
call fcn.10057ed1
add esp, 0x10
jmp 0x119d3fbd
push 0x10009400
call fcn.10057ed1
pop ecx
mov esi, dword [esp + 0x1c]
inc esi
mov dword [esp + 0x1c], esi
cmp esi, dword [esp + 0x74]
jle 0x119d3b52
xor ecx, ecx
push 3
inc ecx
pop esi
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
jl 0x119d4118
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x210]
push esi
call fcn.100100aa
mov dword [esp + 0xc], ebx
jmp 0x119d4011
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x210]
mov dword [eax + ecx*4], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x119d3ffb
mov dword [esp + 0x28], ebx
jmp 0x119d40f4
mov dword [esp + 0xc], 0x46ddcd16
mov dword [esp + 0x38], 0x4de6f885
mov dword [esp + 0xc], ebx
jmp 0x119d4049
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x224], 0xd94e8fe7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x119d4036
mov dword [esp + 0xc], 1
cmp dword [esp + 0xc], ebx
jl 0x119d40f0
mov dword [esp + 0x2c], 0x51ae
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x38], 9
dec dword [esp + 0x24]
mov dword [esp + 0x2c], 2
cmp dword [esp + 0x2c], ebx
jl 0x119d40e6
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x54]
neg edx
mov eax, dword [esp + 0x30]
sbb edx, edx
neg edx
add eax, edx
add eax, ecx
cmp eax, dword [esp + 0x34]
jne 0x119d40ae
mov eax, dword [esp + 0x228]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x24]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x228], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d40e0
push ebx
push 0x79a
push ebx
push 0x8d3
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
dec dword [esp + 0x2c]
jns 0x119d408b
dec dword [esp + 0xc]
jns 0x119d4061
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 1
jle 0x119d4020
lea ecx, [esp + 0x210]
call fcn.1001012c
dec dword [esp + 0x20]
jns 0x119d3fe4
xor ecx, ecx
inc ecx
inc dword [esp + 0x54]
cmp dword [esp + 0x54], ecx
jle 0x119d3afe
inc dword [esp + 0x30]
cmp dword [esp + 0x30], ecx
jle 0x119d3ac1
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x1ec]
call fcn.1001012c
mov ecx, dword [esp + 0xa4]
call fcn.1001fc3c
mov dword [esp + 0x10], 0xbe8e56f9
mov edi, eax
mov dword [esp + 0x34], 0x891023f1
mov dword [esp + 0x34], 0xf4326038
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], ebx
jmp 0x119d418b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xb0], 0x26bdde0b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x119d4178
mov dword [esp + 0x10], ebx
jmp 0x119d41ab
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x240], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x119d4198
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], ebx
jl 0x119d4258
mov dword [esp + 0x1c], 0x9fb023ed
mov dword [esp + 0x1c], 1
cmp dword [esp + 0x1c], ebx
jl 0x119d424e
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0xb0]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0xb0]
mov ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, eax
sub ecx, dword [esp + 0x1c]
cmp ecx, 0x6ee97341
setne dl
add edx, 0x348f4a8f
imul edx, dword [esp + 0x10]
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
cmp dword [esp + eax*4 + 0xb0], edx
je 0x119d4242
cmp dword [esp + 0x10], ebx
je 0x119d4242
xor eax, eax
inc eax
jmp 0x119d4244
mov eax, ebx
mov dword [esp + 0x34], eax
dec dword [esp + 0x1c]
jns 0x119d41da
dec dword [esp + 0x10]
jns 0x119d41c4
inc dword [esp + 0x248]
lea eax, [esp + 0x68]
push eax
call fcn.10020355
mov dword [eax], edi
mov dword [esp + 0x34], 5
mov dword [esp + 0x20], 0xfffffff8
mov eax, dword [esp + 0x34]
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0x10
jmp 0x119d42ae
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d42aa
push 0xda2
push 1
push 0x2634
call dword [sym.imp.KERNEL32.dll_OpenProcess]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffffb
jg 0x119d428d
lea ecx, [esp + 0xa0]
call fcn.1001ca51
push 2
lea ecx, [esp + 0x1b8]
call fcn.100100aa
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x38], 7
mov dword [esp + 0xc], ebx
jmp 0x119d42fb
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1b4]
mov dword [eax + ecx*4], 0xdf99ff60
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x119d42e5
mov esi, dword [esp + 0x1b4]
mov dword [esi + 4], 0xfffffff9
mov dword [esp + 0xc], 0xb6ec79cf
mov dword [esp + 0x34], 0x2006887e
mov dword [esp + 0x34], 5
cmp dword [esp + 0xc], ebx
je 0x119d434c
mov eax, dword [esp + 0xc]
sub eax, dword [esi + 4]
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], 0xa110
cmp dword [esp + 0x38], ebx
je 0x119d434c
xor edi, edi
inc edi
jmp 0x119d434e
mov edi, ebx
mov eax, dword [esp + 0xc]
xor edx, edx
cmp dword [esi + 4], eax
mov eax, dword [esp + 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setg cl
sub edi, ecx
xor ecx, ecx
cmp edi, eax
setle cl
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x38]
mov dword [esp + 0x34], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d4395
push ebx
push 1
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
inc dword [esi + 4]
cmp dword [esi + 4], 0xfffffffc
jl 0x119d4310
lea ecx, [esp + 0x1b4]
call fcn.1001012c
mov esi, dword [esp + 0x28]
test esi, esi
je 0x119d4647
mov dword [esp + 0x34], 0xfffffff9
lea ecx, [esp + 0x204]
mov dword [esp + 0x50], 0x72d76715
mov dword [esp + 0x50], 0xfffffffd
mov dword [esp + 0x50], ebx
push 2
call fcn.100100aa
push 3
pop edi
mov dword [esp + 0x384], 0xb
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x50], 0x6e836ea0
push edi
call fcn.100100aa
mov dword [esp + 0x38], 0x8160a871
mov dword [esp + 0x18], ebx
jmp 0x119d4424
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x29c], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x119d4415
mov dword [esp + 0x18], ebx
jmp 0x119d4446
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x204]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x119d4430
mov dword [esp + 0x18], ebx
jmp 0x119d4469
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x119d4453
cmp dword [esp + 0x34], ebx
je 0x119d448e
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d44a6
push ebx
push 0xcc8
call dword [sym.imp.GDI32.dll_SetBkColor]
jmp 0x119d44a6
mov dword [esp + 0x34], 0xfffffffc
mov dword [esp + 0x50], 0xffffffff
mov eax, dword [esp + 0x34]
mov dword [esp + 0x50], eax
dec dword [esp + 0x38]
lea ecx, [esp + 0x1e0]
call fcn.1001012c
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x204]
call fcn.1001012c
mov edx, dword [esp + 0x4c]
mov ecx, esi
call fcn.1001fc68
mov dword [esp + 0x34], 4
mov esi, eax
mov dword [esp + 0x34], 0x1b00
cmp dword [esp + 0x34], 0x4eb
mov dword [esp + 0x84], esi
jge 0x119d45db
lea eax, [esp + 0x6c]
push eax
push 0x10009148
call fcn.10057beb
mov eax, dword [esp + 0x74]
pop ecx
pop ecx
inc eax
lea ecx, [esp + 0x124]
push eax
call fcn.100100aa
xor edi, edi
or esi, 0xffffffff
or eax, esi
inc edi
mov dword [esp + 0x4c], eax
cmp dword [esp + 0x6c], edi
jl 0x119d4566
mov ebx, dword [esp + 0x124]
add ebx, 4
push ebx
push 0x10009148
call fcn.10057beb
pop ecx
pop ecx
cmp edi, dword [ebx]
je 0x119d4555
test esi, esi
mov dword [esp + 0x4c], edi
cmovs esi, edi
inc edi
add ebx, 4
cmp edi, dword [esp + 0x6c]
jle 0x119d453b
push 0
pop ebx
test esi, esi
jns 0x119d4571
push 0x10009414
call fcn.10058086
pop ecx
mov edi, dword [esp + 0x4c]
mov eax, esi
mov dword [esp + 0x38], eax
cmp esi, edi
jg 0x119d45b9
mov edx, dword [esp + 0x124]
mov ecx, edi
mov dword [esp + 0x4c], ecx
cmp dword [edx + eax*4], ecx
je 0x119d45ab
push 0x10009414
call fcn.10058086
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x128]
pop ecx
mov ecx, dword [esp + 0x4c]
inc eax
dec ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x4c], ecx
cmp eax, edi
jle 0x119d458c
push edi
push esi
push 0x10009168
call fcn.10057ed1
add esp, 0xc
lea ecx, [esp + 0x124]
call fcn.1001012c
mov esi, dword [esp + 0x84]
mov dword [esp + 0x10], ebx
jmp 0x119d45f4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xc4], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x119d45e1
mov dword [esp + 0x10], ebx
jmp 0x119d4614
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xb8], 0xcb50bf34
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x119d4601
mov eax, dword [esp + 0xc4]
mov dword [esp + 0xb8], eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0xb8]
mov dword [esp + 0xb8], eax
lea eax, [esp + 0x70]
push eax
call fcn.100202f3
mov dword [eax], esi
mov dword [esp + 0x28], 0xc45cdbe8
or edi, 0xffffffff
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0x585b7f
mov dword [esp + 0xc], ebx
jmp 0x119d4677
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x294], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x119d4664
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x119d4695
push ebx
push 0x16cb
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], 1
jg 0x119d4788
push 3
pop esi
mov dword [esp + 0x30], edi
lea ecx, [esp + 0x1cc]
mov dword [esp + 0x4c], 0xfffffffe
push esi
call fcn.100100aa
xor edx, edx
mov dword [esp + 0xc], ebx
inc edx
cmp dword [esp + 0xc], esi
jge 0x119d46e1
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1cc]
mov dword [eax + ecx*4], edx
inc dword [esp + 0xc]
jmp 0x119d46c7
mov eax, dword [esp + 0x30]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], edx
jg 0x119d476d
mov ecx, dword [esp + 0x1cc]
mov dword [esp + 0x34], 0x6ee97341
mov dword [esp + 0x30], edx
cmp dword [esp + 0x30], ebx
jl 0x119d4728
mov dword [esp + 0x4c], edi
shl dword [esp + 0x4c], 2
dec dword [esp + 0x30]
jns 0x119d4719
cmp dword [esp + 0x34], ebx
jne 0x119d474a
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x4c], edi
mov eax, dword [esp + 0x30]
add eax, dword [esp + 0x30]
cmp dword [esp + 0x4c], eax
mov eax, ebx
jne 0x119d474c
mov eax, edx
add eax, 0xd7380006
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add eax, eax
mov dword [ecx + 4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x119d4707
lea ecx, [esp + 0x1cc]
call fcn.1001012c
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 1
jle 0x119d46a7
mov eax, dword [ebp + 8]
lea esi, [esp + 0x84]
mov ecx, dword [esp + 0x37c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret