Function at 0x10043a5f
Capabilities:
Create directory
Enumerate gui resources
Log keystrokes
Resolve function by parsing pe exports
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10065d74
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x250
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x48], ecx
push 2
lea ecx, [esp + 0x110]
mov dword [esp + 0x38], edi
call fcn.100099bf
xor ebx, ebx
mov dword [esp + 0x264], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], 0x1d98
cmp dword [esp + 0x24], 0x131a
push 1
pop edx
jge 0x10043be2
lea eax, [esp + 0x84]
mov ecx, 0x106552b0
push eax
call fcn.100096b2
mov dword [esp + 0x108], 0xf
mov dword [esp + 0x104], ebx
mov byte [esp + 0xf4], bl
mov byte [esp + 0x264], 1
mov esi, dword [esp + 0x84]
test esi, esi
je 0x10043bc8
mov ebx, 0x106551f8
lea edx, [esp + 0xf4]
mov ecx, 0x106552b0
dec esi
call fcn.1000d7d7
cmp dword [esp + 0x104], 3
jne 0x10043bae
mov ecx, dword [esp + 0x108]
lea eax, [esp + 0xf4]
mov edx, dword [esp + 0xf4]
cmp ecx, 0x10
cmovae eax, edx
cmp byte [eax], 0x6f
jne 0x10043b5b
cmp ecx, 0x10
lea eax, [esp + 0xf4]
cmovae eax, edx
cmp byte [eax + 1], 0x6e
je 0x10043ba6
cmp ecx, 0x10
lea eax, [esp + 0xf4]
cmovae eax, edx
cmp byte [eax], 0x6f
jne 0x10043b80
cmp ecx, 0x10
lea eax, [esp + 0xf4]
cmovae eax, edx
cmp byte [eax + 2], 0x65
je 0x10043ba6
cmp ecx, 0x10
lea eax, [esp + 0xf4]
cmovae eax, edx
cmp byte [eax + 1], 0x6e
jne 0x10043baa
cmp ecx, 0x10
lea eax, [esp + 0xf4]
cmovae eax, edx
cmp byte [eax + 2], 0x65
jne 0x10043baa
push 1
jmp 0x10043bb0
push 2
jmp 0x10043bb0
push 3
mov ecx, ebx
call fcn.100098ad
push eax
call fcn.1000ce67
pop ecx
test esi, esi
jne 0x10043b08
xor ebx, ebx
push ebx
dec esi
lea ecx, [esp + 0xf8]
push 1
mov dword [esp + 0x8c], esi
call fcn.10009c9b
xor edx, edx
inc edx
mov dword [esp + 0x10], ebx
jmp 0x10043bfe
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], 0x571177e8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10043be8
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], edx
jg 0x10043c43
mov eax, 0xce1e2c0d
mov dword [esp + 0x1d8], eax
mov dword [esp + 0x1dc], eax
mov dword [esp + 0x1e0], eax
mov dword [esp + 0x1e4], eax
cmp dword [esp + 0x1dc], ebx
jne 0x10043c43
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x10043c14
or dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x10c], 0
je 0x10043c7a
push dword [esp + 0x10c]
call fcn.1004c427
xor edx, edx
mov dword [esp + 0x110], ebx
pop ecx
mov dword [esp + 0x110], ebx
inc edx
mov dword [esp + 0x114], ebx
mov eax, dword [0x107713d0]
test al, 1
jne 0x10043d20
or eax, edx
mov dword [0x107713d0], eax
push ebx
mov dword [esp + 0x268], 2
push ebx
mov dword [0x10771390], ebx
mov dword [0x10771394], ebx
call fcn.10013e06
mov dword [0x10771390], eax
mov dword [0x10771398], ebx
mov dword [0x107713a0], ebx
mov byte [esp + 0x264], 4
mov ecx, 0x10771398
mov dword [esp + 0x148], eax
lea eax, [esp + 0x148]
push eax
push 0x10
push ebx
lea eax, [esp + 0x210]
mov dword [0x107713ac], 0x3f800000
push eax
mov dword [0x1077139c], ebx
call fcn.10013baa
push 0x10066094
mov dword [0x107713a4], 7
mov dword [0x107713a8], 8
call fcn.1004c28c
or dword [esp + 0x268], 0xffffffff
pop ecx
mov dword [esp + 0x38], 0xffffffff
xor edx, edx
mov dword [esp + 0x10], 0xfffffff6
inc edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0x98d253de
mov dword [esp + 0x10], ebx
jmp 0x10043d60
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x168], 0xcf859e22
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10043d4d
cmp dword [esp + 0x38], ebx
je 0x100440d3
mov dword [esp + 0x18], 0x27689351
mov dword [esp + 0x28], 0x9d73df2e
mov dword [esp + 0x20], 0xb18b
mov dword [esp + 0x24], 0xa917
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jne 0x10043f8a
mov dword [esp + 0x24], 0x2462
cmp dword [esp + 0x24], 0x12f2
jge 0x10043f23
mov dword [esp + 0x1a0], 0xf
mov dword [esp + 0x19c], ebx
mov byte [esp + 0x18c], bl
lea edx, [esp + 0x18c]
mov dword [esp + 0x264], 5
call fcn.10045b90
lea eax, [esp + 0x4c]
push eax
push 0x10007764
call fcn.1004c09b
mov eax, dword [esp + 0x54]
pop ecx
pop ecx
test eax, eax
je 0x10043ef4
dec eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x60]
push eax
push ecx
lea eax, [esp + 0x94]
push eax
push ecx
lea eax, [esp + 0x74]
mov ecx, 0x106552b0
push eax
call fcn.100330a0
pop ecx
mov ecx, eax
call fcn.100330a0
pop ecx
mov ecx, eax
call fcn.100330a0
mov ecx, dword [esp + 0x64]
mov esi, dword [esp + 0x8c]
dec ecx
mov eax, dword [esp + 0x60]
dec esi
mov dword [esp + 0x8c], esi
sub esi, ecx
cdq
inc esi
idiv esi
push esi
push ecx
lea eax, [esp + 0x210]
mov dword [esp + 0x6c], ecx
push eax
lea ecx, [esp + 0x198]
mov dword [esp + 0x6c], edx
call fcn.10038c29
mov eax, ebx
mov dword [esp + 0x20], eax
test esi, esi
jle 0x10043ed5
mov ebx, esi
cmp dword [esp + 0x21c], 0x10
lea edi, [esp + 0x208]
lea esi, [esp + 0x18c]
cmovae edi, dword [esp + 0x208]
cmp dword [esp + 0x1a0], 0x10
cmovae esi, dword [esp + 0x18c]
sub eax, dword [esp + 0x60]
add eax, ebx
add esi, dword [esp + 0x20]
cdq
idiv ebx
mov eax, dword [esp + 0x64]
mov cl, byte [edx + edi]
mov byte [esi + eax], cl
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, ebx
jl 0x10043e81
xor ebx, ebx
push ebx
push 1
lea ecx, [esp + 0x210]
call fcn.10009c9b
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x10043e06
mov edi, dword [esp + 0x34]
dec eax
lea edx, [esp + 0x18c]
mov dword [esp + 0x4c], eax
call fcn.10045c05
push eax
call fcn.1000ce67
or dword [esp + 0x268], 0xffffffff
pop ecx
push ebx
push 1
lea ecx, [esp + 0x194]
call fcn.10009c9b
mov dword [esp + 0x38], ebx
jmp 0x10043f7e
mov dword [esp + 0x18], 7
jmp 0x10043f73
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x124], ebx
jmp 0x10043f65
cmp dword [esp + 0x38], ebx
jne 0x10043f6f
dec dword [esp + 0x124]
cmp dword [esp + 0x124], 0xffffffe9
jl 0x10043f58
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x12
jge 0x10043f33
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 0x28
jge 0x10043f29
jmp 0x100441a8
mov dword [esp + 0x30], ebx
mov dword [esp + 0x10], ebx
jmp 0x10043fa7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x88], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10043f94
mov dword [esp + 0x30], 0x4de6
xor edx, edx
mov dword [esp + 0x28], 0x9675
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setne dl
cmp dword [esp + 0x28], 6
sbb eax, eax
neg eax
imul edx, eax
imul edx, dword [esp + 0x30]
test edx, edx
je 0x10043fec
cmp dword [esp + 0x18], ebx
je 0x10043fec
xor eax, eax
inc eax
jmp 0x10043fee
mov eax, ebx
mov dword [esp + 0x10], eax
xor edx, edx
mov eax, dword [esp + 0x20]
mov esi, 0x165f5c9b
mov dword [esp + 0x88], eax
inc dword [esp + 0x20]
mov eax, dword [esp + 0x88]
cmp eax, 0x3fa9a180
mov eax, dword [esp + 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
cmp eax, 0xcb5c7460
mov eax, dword [esp + 0x30]
setne cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
sub esi, edx
sub esi, 0xd46c64e7
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp eax, esi
mov eax, dword [esp + 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x30]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x30]
setge cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
cmp dword [esp + 0x24], eax
setg cl
sub ecx, 0x600b36f3
jne 0x100440a5
cmp dword [esp + 0x28], ebx
jne 0x100440a5
mov eax, ebx
jmp 0x100440a8
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
imul eax, dword [esp + 0x28], 0xf8cd
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x24], eax
jmp 0x100441a8
mov dword [esp + 0x18], 0xd229656
mov dword [esp + 0x20], 0xd54df96
mov eax, dword [esp + 0x38]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
jne 0x10044156
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x168]
cmp dword [esp + 0x14], eax
jg 0x1004410a
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x10], 4
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
add eax, dword [esp + 0x18]
je 0x1004413b
mov esi, edx
cmp dword [esp + 0x174], ebx
jne 0x1004413d
mov esi, ebx
mov eax, dword [esp + 0x168]
xor ecx, ecx
cmp esi, eax
mov esi, ebx
setg cl
cmp ecx, dword [esp + 0x168]
jg 0x10044158
mov esi, edx
mov eax, dword [esp + 0x168]
xor ecx, ecx
cmp esi, eax
setle cl
mov dword [esp + 0x170], ecx
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, edx
setle cl
mov dword [esp + 0x20], ecx
imul eax, dword [esp + 0x48], 0x2710
lea ecx, [esp + 0xa0]
push 2
add eax, edi
mov dword [esp + 0x94], eax
call fcn.100099bf
mov dword [esp + 0x28], 0xf1a0
mov dword [esp + 0x14], ebx
jmp 0x100441eb
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xa0]
mov dword [eax + ecx*4], 0x6e6bacd7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100441d5
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1004420a
push ebx
push 0x1eff
push ebx
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
cmp dword [esp + 0x28], ebx
je 0x10044230
mov eax, dword [esp + 0xa0]
xor edx, edx
xor ecx, ecx
inc edx
mov eax, dword [eax + 4]
cmp eax, edx
setle cl
imul ecx, dword [esp + 0x28]
imul ecx, eax
test ecx, ecx
jne 0x10044232
mov edx, ebx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xa0]
imul ecx, edx
push 4
pop edi
mov eax, dword [eax]
sub ecx, edi
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, eax
mov eax, dword [esp + 0xa0]
push eax
mov dword [eax], ecx
call fcn.1004c427
pop ecx
lea eax, [esp + 0x90]
mov dword [esp + 0xa0], ebx
push eax
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
call fcn.100456ad
mov esi, dword [eax]
mov dword [esp + 0x40], 0xffffffff
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x100442a5
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x100442b7
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
test esi, esi
je 0x10044679
mov dword [esp + 0x18], 0xffffffff
xor ecx, ecx
mov dword [esp + 0x10], 5
inc ecx
mov dword [esp + 0x28], 0xdf0ebf90
mov dword [esp + 0x28], ecx
mov dword [esp + 0x30], 9
mov dword [esp + 0x34], 0x8efa97f5
mov dword [esp + 0x150], esi
mov dword [esp + 0x14], ebx
jmp 0x1004430a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1e8], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x100442fb
mov dword [esp + 0x34], 0x1ce8
cmp dword [esp + 0x34], 0x5b1
jge 0x10044506
lea eax, [esp + 0x44]
push eax
push 0x10007b6c
call fcn.1004c09b
mov eax, dword [esp + 0x4c]
imul eax, eax
pop ecx
pop ecx
lea ecx, [esp + 0x6c]
push eax
call fcn.100099bf
mov dword [esp + 0x264], 6
mov edi, ebx
mov eax, dword [esp + 0x44]
imul eax, eax
test eax, eax
jle 0x10044380
mov esi, dword [esp + 0x6c]
push esi
push 0x10007ae8
call fcn.1004c09b
mov eax, dword [esp + 0x4c]
inc edi
imul eax, eax
add esi, 4
pop ecx
pop ecx
cmp edi, eax
jl 0x10044364
mov esi, dword [esp + 0x70]
mov eax, esi
mov ecx, dword [esp + 0x6c]
mov edx, esi
sub eax, ecx
mov byte [esp + 0x178], bl
push dword [esp + 0x178]
sar eax, 2
push eax
call fcn.10034204
pop ecx
mov eax, ebx
mov dword [esp + 0x5c], ebx
mov edi, ebx
mov dword [esp + 0x54], eax
pop ecx
mov dword [esp + 0x54], edi
mov byte [esp + 0x264], 7
cmp dword [esp + 0x44], 0
mov dword [esp + 0x14], ebx
jle 0x1004449f
jmp 0x100443d2
mov esi, eax
lea eax, [esi - 4]
cmp dword [eax], ebx
jl 0x100443d0
add esi, 0xfffffffc
lea ecx, [esp + 0x50]
mov dword [esp + 0x10], esi
mov dword [esp + 0x70], esi
mov eax, dword [esi]
mov dword [esp + 0x144], eax
lea eax, [esp + 0x144]
push eax
call fcn.10012c27
mov edi, dword [esp + 0x54]
mov ecx, edi
mov eax, dword [esp + 0x50]
sub ecx, eax
sar ecx, 2
mov dword [esp + 0x38], edi
mov dword [esp + 0x34], ecx
test ecx, ecx
je 0x1004448c
mov edi, dword [esp + 0x34]
mov ecx, eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], edi
mov eax, esi
mov dword [esp + 0x34], ebx
sub eax, dword [esp + 0x6c]
mov ebx, dword [esp + 0x50]
mov esi, dword [esp + 0x34]
sar eax, 2
dec eax
mov dword [esp + 0x24], eax
mov edx, dword [ebx + esi*4]
mov ecx, dword [ecx]
call fcn.10043a46
mov ecx, dword [esp + 0x24]
mov edx, eax
test ecx, ecx
js 0x10044467
mov eax, dword [esp + 0x6c]
cmp dword [eax + ecx*4], edx
je 0x10044463
dec ecx
jns 0x10044459
jmp 0x10044467
or dword [eax + ecx*4], 0xffffffff
mov ecx, dword [esp + 0x28]
inc esi
cmp esi, edi
jb 0x10044441
mov esi, dword [esp + 0x10]
add ecx, 4
dec dword [esp + 0x20]
push 0
mov dword [esp + 0x2c], ecx
pop ebx
jne 0x10044427
mov edi, dword [esp + 0x38]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, dword [esp + 0x44]
jl 0x100443d2
sub edi, eax
mov esi, ebx
sar edi, 2
test edi, edi
je 0x100444c2
push dword [eax + esi*4]
push 0x10007c58
call fcn.1004c2b6
mov eax, dword [esp + 0x58]
inc esi
pop ecx
pop ecx
cmp esi, edi
jb 0x100444aa
push 0x100076c5
call fcn.1004c476
mov eax, dword [esp + 0x54]
pop ecx
test eax, eax
je 0x100444e8
push eax
call fcn.1004c427
pop ecx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov eax, dword [esp + 0x6c]
test eax, eax
je 0x10044503
push eax
call fcn.1004c427
pop ecx
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
je 0x10044528
cmp dword [esp + 0x10], ebx
jne 0x10044528
mov ecx, ebx
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setg cl
mov dword [esp + 0x34], ecx
xor ecx, ecx
cmp dword [esp + 0x34], eax
setg cl
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], ebx
jmp 0x1004466a
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10044592
push ebx
push 0x22db
push 0x21ea
push 0x1e85
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x10044666
mov dword [esp + 0x34], 0x2378
cmp dword [esp + 0x34], 0x4ed
jge 0x1004464a
lea eax, [esp + 0x1b0]
push eax
push 0x10007afc
call fcn.1004c09b
mov edi, dword [esp + 0x1bc]
mov esi, dword [esp + 0x1b8]
pop ecx
pop ecx
cmp edi, ebx
jg 0x100445f0
jl 0x100445e3
cmp esi, 2
ja 0x100445f0
push 0x10007768
call fcn.1004c476
pop ecx
jmp 0x1004464a
push ebx
push 2
push edi
push esi
call fcn.10064670
or eax, edx
push edi
push esi
push edi
push esi
je 0x1004461c
call fcn.100519d0
push ebx
push 2
push edx
push eax
call fcn.100645c0
mov esi, eax
mov ecx, edx
add esi, 1
adc ecx, ebx
jmp 0x10044639
call fcn.100519d0
push ebx
push 4
push edx
push eax
call fcn.100645c0
mov esi, eax
mov ecx, edx
add esi, 1
adc ecx, ebx
sub eax, 1
sbb edx, ebx
push ecx
push esi
push edx
push eax
push 0x10007c28
call fcn.1004c2b6
add esp, 0x14
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x1004465c
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
dec dword [esp + 0x10]
jns 0x100445a0
inc dword [esp + 0x30]
cmp dword [esp + 0x30], ebx
jle 0x10044571
jmp 0x10045514
mov eax, dword [0x107713d0]
test al, 2
jne 0x1004471b
or eax, 2
mov dword [0x107713d0], eax
push 8
pop esi
push ebx
mov dword [esp + 0x268], esi
push ebx
mov dword [0x107713b0], ebx
mov dword [0x107713b4], ebx
call fcn.10013e06
mov dword [0x107713b0], eax
mov dword [0x107713b8], ebx
mov dword [0x107713c0], ebx
mov byte [esp + 0x264], 0xa
mov ecx, 0x107713b8
mov dword [esp + 0x14c], eax
lea eax, [esp + 0x14c]
push eax
push 0x10
push ebx
lea eax, [esp + 0x170]
mov dword [0x107713cc], 0x3f800000
push eax
mov dword [0x107713bc], ebx
call fcn.10013baa
push 0x1006608f
mov dword [0x107713c4], 7
mov dword [0x107713c8], esi
call fcn.1004c28c
or dword [esp + 0x268], 0xffffffff
pop ecx
push dword [esp + 0x164]
movdqa xmm0, xmmword [0x10007f50]
lea eax, [esp + 0x234]
push eax
lea eax, [esp + 0x228]
mov dword [esp + 0x30], 0xffffffff
push eax
mov dword [esp + 0x34], 1
lea ecx, [esp + 0xb8]
push ebx
movdqu xmmword [esp + 0x230], xmm0
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
call fcn.1000d959
xor ecx, ecx
mov dword [esp + 0x18], ebx
inc ecx
jmp 0x1004478a
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x3c], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1004477e
mov dword [esp + 0x18], ebx
jmp 0x100447a9
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1b8], 0xf9150fae
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10044796
mov eax, dword [esp + 0x3c]
xor edx, edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
cmp ecx, eax
mov eax, dword [esp + 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c0], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x1bc]
sub ecx, eax
mov eax, dword [esp + 0x3c]
add eax, ecx
jne 0x10044806
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x3c]
xor edx, edx
mov eax, dword [esp + 0x1c0]
cmp ecx, eax
setne dl
xor eax, eax
inc eax
cmp eax, edx
mov eax, dword [esp + 0x3c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x3c]
setl dl
sub edx, eax
mov eax, dword [esp + 0x3c]
sub edx, eax
mov eax, dword [esp + 0x3c]
imul eax, edx
test eax, eax
je 0x10044848
cmp dword [esp + 0x3c], ebx
jne 0x10044855
cmp dword [esp + 0x1c0], ebx
jne 0x10044855
mov ecx, ebx
jmp 0x10044858
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x3c]
mov edx, 0x79f43dc4
sub edx, ecx
mov dword [esp + 0x28], eax
add edx, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x3c]
cmp edx, eax
mov eax, dword [esp + 0xac]
setle cl
push eax
mov dword [eax + 0xc], ecx
call fcn.1004c427
pop ecx
lea eax, [esp + 0x48]
mov dword [esp + 0xac], ebx
xorps xmm0, xmm0
mov dword [esp + 0xb0], ebx
push eax
mov dword [esp + 0xb8], ebx
movdqu xmmword [esp + 0x180], xmm0
call fcn.1004570f
mov esi, dword [eax]
mov eax, 0xa5d6c05b
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0x28], 0xaa6e6f7f
mov dword [esp + 0x38], esi
mov dword [esp + 0xcc], 0xfffffff4
jmp 0x1004494d
xor eax, eax
mov dword [esp + 0x24], 0xa9c4c8d3
mov dword [esp + 0x28], 0xfffffff6
inc eax
cmp dword [esp + 0x24], ebx
jne 0x1004491e
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
jne 0x1004491e
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x28], eax
jmp 0x10044946
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0xfffffffe
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10044946
push eax
push 0x1783
push 0x1c43
call dword [sym.imp.USER32.dll_AttachThreadInput]
dec dword [esp + 0xcc]
cmp dword [esp + 0xcc], 0xffffffef
jle 0x100448ee
mov dword [esp + 0x24], 0x1cde
cmp dword [esp + 0x24], 0xcf9
jge 0x100449f8
lea eax, [esp + 0xd0]
push eax
lea eax, [esp + 0xbc]
push eax
push 0x10007c4c
call fcn.1004c09b
mov edi, dword [esp + 0xc8]
add esp, 0xc
mov esi, dword [esp + 0xb8]
push dword [esp + 0xd4]
push dword [esp + 0xd4]
push edi
push esi
call fcn.10064670
push dword [esp + 0xd4]
sub esi, eax
push dword [esp + 0xd4]
sbb edi, edx
mov dword [esp + 0xc0], esi
push edi
push esi
mov dword [esp + 0xcc], edi
call fcn.100645c0
push ebx
push 2
push edx
push eax
call fcn.10064670
or eax, edx
jne 0x100449e9
push 0x10007b90
jmp 0x100449ee
push 0x10007b8c
call fcn.1004c476
mov esi, dword [esp + 0x3c]
pop ecx
mov al, byte [ebp + 0xc]
test al, al
jne 0x10044a07
test esi, esi
jne 0x10044d4f
lea ecx, [esp + 0x238]
mov dl, al
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.10039949
mov esi, eax
lea edi, [esp + 0x180]
mov eax, 0xfc2285fa
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0x1c8], eax
mov dword [esp + 0x1cc], eax
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x1d4], eax
mov dword [esp + 0x10], 0x12
jmp 0x10044abc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x14], ebx
jmp 0x10044a78
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x248], 8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10044a65
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10044a92
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [esp + 0x20], 3
cmp dword [esp + 0x20], ebx
jl 0x10044ab8
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x10044ab2
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
dec dword [esp + 0x20]
jns 0x10044aa0
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xa
jg 0x10044a5b
cmp byte [ebp + 0xc], 0
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c8], eax
je 0x10044d4b
cmp dword [esp + 0x184], 0
je 0x10044d4b
push 1
lea ecx, [esp + 0x7c]
call fcn.100099bf
xor edx, edx
mov dword [esp + 0x10], 0x8094a188
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10044b1d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x78]
mov dword [eax + ecx*4], 0x9f9b3198
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10044b0a
mov dword [esp + 0x10], ebx
jmp 0x10044bf7
mov dword [esp + 0x20], 0xf36f6dd8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x78]
cmp dword [eax + ecx*4], ebx
je 0x10044b56
mov dword [esp + 0x24], 0x693
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
jmp 0x10044bf3
mov dword [esp + 0x14], ebx
jmp 0x10044b6f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x15c], 0xfd52a42b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10044b5c
mov ecx, dword [esp + 0x15c]
xor edx, edx
mov eax, dword [esp + 0x78]
neg ecx
cmp dword [eax], ecx
mov eax, dword [esp + 0x20]
sete dl
xor ecx, ecx
cmp eax, edx
setge cl
imul ecx, dword [esp + 0x20]
test ecx, ecx
je 0x10044ba2
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x15c]
imul ecx, eax, 0xd55f
mov eax, dword [esp + 0x15c]
mov esi, dword [esp + 0x78]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [esi]
setne al
sub eax, 0x1982
neg eax
sbb eax, eax
inc eax
cmp eax, 0xb4aad9dd
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0x20a2
setg cl
cmp ecx, 0xfffffffa
sbb eax, eax
neg eax
mov dword [esi + edi*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10044b2c
cmp dword [esp + 0x78], 0
je 0x10044c21
push dword [esp + 0x78]
call fcn.1004c427
pop ecx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov eax, dword [esp + 0x188]
lea ecx, [esp + 0xdc]
push 4
mov dword [esp + 0x158], eax
call fcn.100099bf
xor edx, edx
inc edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], 0x74a71a6e
mov dword [esp + 0x28], 0x66efe0cd
mov dword [esp + 0x24], edx
mov dword [esp + 0x40], 0xb467bb1a
mov dword [esp + 0x18], ebx
jmp 0x10044c80
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], 0x1aae
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10044c6a
mov dword [esp + 0x18], ebx
jmp 0x10044ca0
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x140], 0xfff7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10044c8d
mov edi, dword [esp + 0xdc]
xor eax, eax
mov ecx, 0xd3ecf04b
mov esi, dword [edi + 0xc]
cmp esi, 0x75a592c6
setne al
imul eax, esi
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp esi, eax
setg cl
cmp ecx, edx
jg 0x10044cda
test esi, esi
jne 0x10044cda
mov edx, ebx
xor eax, eax
cmp edx, dword [edi + 8]
setl al
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, 0x4adca1a1
mov dword [esp + 0x140], eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
cmp eax, dword [edi + 8]
mov eax, dword [esp + 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
neg ecx
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
push dword [esp + 0xdc]
mov dword [esp + 0x28], eax
call fcn.1004c427
mov eax, dword [esp + 0x188]
pop ecx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0x158], eax
mov esi, dword [esp + 0x38]
push 3
pop edi
push edi
lea ecx, [esp + 0x138]
call fcn.100099bf
mov dword [esp + 0x14], ebx
jmp 0x10044d7b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0x399841b3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10044d65
mov eax, dword [esp + 0x134]
push eax
mov dword [eax], 0xffffffec
call fcn.1004c427
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebx
pop ecx
test esi, esi
jne 0x100452e1
cmp dword [esp + 0x17c], esi
jle 0x100452e1
mov dword [esp + 0x30], 0xfffffffe
lea ecx, [esp + 0xe8]
xor eax, eax
mov dword [esp + 0x28], ebx
inc eax
mov dword [esp + 0x68], ebx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x28], 0xec1e183a
push eax
call fcn.100099bf
mov dword [esp + 0x264], 0xb
mov dword [esp + 0x18], ebx
jmp 0x10044e0b
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1ec], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10044dfc
xor edx, edx
mov dword [esp + 0x18], ebx
inc edx
jmp 0x10044e2c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10044e1a
mov dword [esp + 0x30], 0xffffffe5
cmp dword [esp + 0x30], 2
jle 0x100451af
mov dword [esp + 0x10], 0xecf54c3c
lea ecx, [esp + 0x94]
mov dword [esp + 0x18], edi
mov dword [esp + 0x28], 4
mov dword [esp + 0x24], 6
mov dword [esp + 0x40], 0x81f6ed73
push edi
call fcn.100099bf
mov byte [esp + 0x264], 0xc
mov dword [esp + 0x14], ebx
jmp 0x10044e9a
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x94]
mov dword [eax + ecx*4], 0x97a8d1d9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10044e84
dec dword [esp + 0x10]
cmp dword [esp + 0x30], ebx
je 0x10044eb2
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
xor edx, edx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
neg ecx
cmp ecx, eax
mov eax, 0x2dafbbd
setl dl
xor ecx, ecx
sub eax, edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp eax, 0x928d
setne cl
xor eax, eax
add ecx, dword [esp + 0x68]
cmp ecx, 0x1fc4
setge al
add eax, dword [esp + 0x10]
je 0x10044f0c
cmp dword [esp + 0x18], ebx
je 0x10044f0c
xor edx, edx
inc edx
jmp 0x10044f0e
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 1
setl al
cmp eax, dword [esp + 0x5c]
jl 0x10044f38
mov dword [esp + 0x18], 0x6c4693b9
mov dword [esp + 0x28], ebx
jmp 0x10045168
mov dword [esp + 0x40], 0x8eaf6082
lea ecx, [esp + 0x118]
mov dword [esp + 0x10], 0x5835a7ab
push 4
call fcn.100099bf
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x28], 0x206e
cmp dword [esp + 0x28], 0xccc
jge 0x1004505d
push 0x10007e08
call fcn.1004c2b6
pop ecx
xorps xmm3, xmm3
mov esi, ebx
movsd xmm1, qword [0x10007eb0]
inc esi
movaps xmm2, xmm3
movd xmm0, esi
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
cvtps2pd xmm0, xmm3
addsd xmm1, xmm0
cvtpd2ps xmm3, xmm1
ucomiss xmm2, xmm3
lahf
test ah, 0x44
jp 0x10044f84
push esi
push 0x10007e28
movss dword [esp + 0x30], xmm3
call fcn.1004c2b6
xor eax, eax
xorps xmm2, xmm2
pop ecx
inc eax
pop ecx
mov ecx, eax
cmp esi, eax
jl 0x10044fec
movsd xmm1, qword [0x10007eb0]
movd xmm0, ecx
inc ecx
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
addsd xmm2, xmm1
cmp ecx, esi
jle 0x10044fcf
movss xmm0, dword [esp + 0x28]
sub esp, 0x10
cvtps2pd xmm0, xmm0
movsd qword [esp + 8], xmm2
movsd qword [esp], xmm0
push 0x10007e30
call fcn.1004c2b6
add esp, 0x14
call fcn.1004e6a5
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [esp + 0x28], xmm0
call fcn.1004e6a5
push ecx
push ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm0, qword [esp + 0x30]
divsd xmm0, qword [0x10007ec0]
movsd qword [esp], xmm0
push 0x10007e54
call fcn.1004c2b6
add esp, 0xc
push 0x10007e68
call fcn.1004c2b6
pop ecx
mov dword [esp + 0x14], ebx
jmp 0x10045079
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 0xce7aebb1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10045063
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov dword [esp + 0x28], eax
dec dword [esp + 0x20]
mov esi, dword [esp + 0x118]
mov dword [esp + 0x10], 0x58d0
mov dword [esp + 0x28], 0x7201
mov eax, dword [esp + 0x24]
cmp dword [esi + 0xc], eax
setge cl
xor eax, eax
cmp eax, ecx
mov ecx, dword [esp + 0x28]
sbb eax, eax
inc eax
mov dword [esi + 0xc], eax
add eax, 0xffff82fe
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub ecx, eax
mov eax, dword [esp + 0x10]
cmp eax, ecx
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x94]
setge dl
sub ecx, edx
mov dword [eax], ecx
mov dword [esp + 0x1ec], ecx
mov dword [esp + 0x10], ebx
jmp 0x1004513f
mov dword [esp + 0x40], ebx
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x1f0], ebx
jne 0x1004510e
mov eax, dword [esp + 0x40]
cmp dword [esi + 0xc], ebx
jne 0x1004510e
mov eax, ebx
jmp 0x10045111
xor eax, eax
inc eax
cmp eax, 0xfffe
mov eax, dword [esp + 0x24]
sbb ecx, ecx
inc ecx
add ecx, dword [esi + 0xc]
sub ecx, eax
mov eax, dword [esp + 0x20]
add ecx, eax
mov eax, dword [esp + 0x18]
sub eax, 0xffff
mov dword [esi + 0xc], ecx
imul eax, ecx
mov dword [esp + 0x28], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x10
jge 0x100450f0
push dword [esp + 0x118]
call fcn.1004c427
pop ecx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov byte [esp + 0x264], 0xb
cmp dword [esp + 0x94], 0
je 0x1004519c
push dword [esp + 0x94]
call fcn.1004c427
pop ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 2
jg 0x10044e45
mov esi, dword [esp + 0x38]
or dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0xe8], 0
je 0x100451e3
push dword [esp + 0xe8]
call fcn.1004c427
pop ecx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x10], 0xae9714a
mov dword [esp + 0x24], 8
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 0xf5cd53bc
mov dword [esp + 0x20], 0xf47a6dee
mov dword [esp + 0x18], 0xfffffff8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x40], 0xc629
dec dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], 0xa017
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x10]
je 0x10045241
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
neg ecx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], ebx
jmp 0x100452bc
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x100452b2
push ebx
push ebx
push 0x1c87
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
cmp dword [esp + 0x10], ebx
jne 0x100452c3
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe9
jne 0x10045299
mov ecx, dword [esp + 0x180]
test ecx, ecx
je 0x100452e1
call fcn.10043a06
mov esi, eax
lea eax, [esp + 0x48]
push eax
call fcn.1004570f
mov dword [eax], esi
mov dword [esp + 0x18], 0xe469ad59
mov dword [esp + 0x14], ebx
jmp 0x10045302
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1f8], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x100452ef
mov dword [esp + 0x18], ebx
jmp 0x10045321
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1f8], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1004530e
mov dword [esp + 0x18], 0x17
jmp 0x1004535e
mov dword [esp + 0x14], 0xe4438bea
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x1004535a
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x1f8], ebx
jne 0x1004535a
dec dword [esp + 0x14]
jns 0x10045347
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff8
jle 0x10045331
lea ecx, [esp + 0x17c]
call fcn.10040390
test esi, esi
je 0x100453df
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], ebx
jmp 0x10045392
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x230], 0x102071b1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1004537f
mov dword [esp + 0x14], ebx
jmp 0x100453b5
mov byte [esp + 0x1f], bl
cmp byte [esp + 0x1f], 0
je 0x100453b1
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jle 0x1004539f
mov edx, dword [esp + 0x34]
mov ecx, esi
call fcn.10043a3c
mov esi, eax
lea eax, [esp + 0x90]
push eax
mov dword [esp + 0x154], esi
call fcn.100456ad
mov dword [eax], esi
mov dword [esp + 0x10], 1
lea ecx, [esp + 0x1a4]
push edi
call fcn.100099bf
mov dword [esp + 0x68], 0xfffffffe
xor edx, edx
mov dword [esp + 0x34], 0x7f05f432
inc edx
mov dword [esp + 0x5c], 0x67606e82
mov dword [esp + 0x24], 7
mov dword [esp + 0x28], 0x861a
mov dword [esp + 0x40], edx
mov dword [esp + 0x34], 0x7cf2842c
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], 0xfffffff7
mov dword [esp + 0x34], 0x9ef6e88
mov dword [esp + 0x14], ebx
jmp 0x1004545b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10045445
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
dec dword [esp + 0x28]
cmp eax, ecx
mov eax, edx
cmovg eax, ebx
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x1a4]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1a4]
mov ecx, dword [eax]
mov eax, dword [esp + 0x10]
add eax, ecx
je 0x100454a3
test ecx, ecx
jne 0x100454a5
mov edx, ebx
mov eax, dword [esp + 0x40]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x10]
cmp eax, 0xc03fdda7
sbb eax, eax
neg eax
sub eax, dword [esp + 0x5c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, dword [esp + 0x68]
cmp eax, 0xcaf6
mov eax, dword [esp + 0x10]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x24]
push dword [esp + 0x1a4]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x38], ecx
call fcn.1004c427
pop ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0x150]
mov ecx, dword [esp + 0x25c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret