Function at 0x41e191
Capabilities:
Accept command line arguments
Identify system language via api
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x298
xor eax, eax
mov dword [esp + 0x2c], edx
mov dword [esp + 0x38], ecx
xor edx, edx
mov dword [esp + 0x40], eax
inc edx
push esi
mov dword [esp + 8], 0x58e469ad
push edi
mov dword [esp + 0xc], eax
jmp 0x41e1d1
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xd4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x41e1be
mov dword [esp + 0xc], eax
jmp 0x41e1f0
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xd4], 0xe57ad95e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x41e1dd
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41e20f
push eax
push 0x659
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor eax, eax
push dword [esp + 0x48]
movdqa xmm0, xmmword [0xa5c880]
lea ecx, [esp + 0x244]
push ecx
lea ecx, [esp + 0x238]
mov dword [esp + 0x94], eax
push ecx
push eax
lea ecx, [esp + 0x9c]
mov dword [esp + 0xa0], eax
movdqu xmmword [esp + 0x240], xmm0
mov dword [esp + 0xa4], eax
call fcn.004114da
mov dword [esp + 0x30], 0x1d8b9dbe
push 3
mov dword [esp + 0x2c], 0xca8cda2a
mov dword [esp + 0x10], 0
pop edi
jmp 0x41e286
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1ac], 0x2e0cf572
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x41e273
mov esi, dword [esp + 0x8c]
and dword [esi + 8], 0
push edi
lea ecx, [esp + 0x84]
call fcn.004113a6
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x41e2c2
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x80]
mov dword [ecx + edx*4], 0xccbad86e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x41e2ac
mov ecx, dword [esp + 0x80]
mov dword [ecx], eax
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
add edx, dword [esp + 0x30]
mov ecx, dword [esi + 8]
mov dword [esp + ecx*4 + 0x1ac], edx
mov ecx, dword [esp + 0x80]
inc dword [ecx]
mov ecx, dword [ecx]
cmp ecx, 2
jle 0x41e2d1
test ecx, ecx
lea ecx, [esp + 0x80]
jne 0x41e312
call fcn.00411478
inc dword [esi + 8]
cmp dword [esi + 8], 2
jle 0x41e297
jmp 0x41e317
call fcn.00411478
mov edi, dword [sym.imp.USER32.dll_GetDC]
xor eax, eax
cmp dword [esp + 0x28], eax
je 0x41e345
mov dword [esp + 0x14], 0xbf495e3b
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
sub eax, 0x2ba2
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
jmp 0x41e39d
mov dword [esp + 0x24], 0x7a14
mov dword [esp + 0x14], 0x526c7153
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41e37c
push eax
push 0xa2d
push 0x113a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword [esi + 8], eax
cmp dword [esp + 0x24], eax
jl 0x41e396
mov ecx, dword [esp + 0x14]
add ecx, dword [esp + 0x24]
je 0x41e396
xor eax, eax
inc eax
mov dword [esp + 0x1ac], eax
lea ecx, [esp + 0x8c]
call fcn.00411478
mov eax, dword [0xa5ec80]
xor esi, esi
inc esi
test al, 1
jne 0x41e439
or eax, esi
mov dword [0xa5ec80], eax
xor eax, eax
push eax
push eax
mov dword [0xa5ec90], eax
mov dword [0xa5ec94], eax
call fcn.0042108b
mov ecx, eax
mov dword [0xa5ecac], 0x3f800000
mov dword [0xa5ec90], ecx
xor eax, eax
mov dword [esp + 0xa0], ecx
lea ecx, [esp + 0xa0]
push ecx
push 0x10
push eax
mov dword [0xa5ec98], eax
mov ecx, 0xa5ec98
mov dword [0xa5eca0], eax
mov dword [0xa5ec9c], eax
lea eax, [esp + 0x1ac]
push eax
call fcn.00420e30
push 0x46be2a
mov dword [0xa5eca4], 7
mov dword [0xa5eca8], 8
call fcn.0045fa6f
pop ecx
mov dword [esp + 0x18], 0xbeaa32b1
xor eax, eax
push 2
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x10], eax
pop edx
jmp 0x41e467
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x198], 0xfffffff8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x41e454
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], eax
jl 0x41e4b4
mov dword [esp + 0xc], 5
mov dword [esp + 0xc], eax
jmp 0x41e4a0
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x198], 0x63384304
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x41e48d
mov dword [esp + 0x14], 0xb9dd952e
dec dword [esp + 0x18]
jns 0x41e47f
imul eax, dword [esp + 0x40], 0x2710
add eax, dword [esp + 0x34]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
push eax
call fcn.004206b2
push 3
lea ecx, [esp + 0x164]
mov esi, dword [eax]
xor eax, eax
inc eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x1c], eax
pop eax
push eax
call fcn.004113a6
mov dword [esp + 0x14], 0xfffffffc
xor eax, eax
xor edx, edx
mov dword [esp + 0x30], 8
mov dword [esp + 0x10], eax
inc edx
jmp 0x41e516
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x44], 0x4e2db58
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x41e506
mov dword [esp + 0x10], eax
jmp 0x41e538
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x160]
mov dword [ecx + edx*4], 0xdfb1af9d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x41e522
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], eax
jl 0x41e62f
xor esi, esi
mov dword [esp + 0x24], 0xa290be4
lea ecx, [esp + 0x1f4]
push 2
call fcn.004113a6
xor eax, eax
mov dword [esp + 0x2c], 0xffff
mov dword [esp + 0xc], eax
jmp 0x41e58b
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1f4]
mov dword [ecx + edx*4], 0xbafcb143
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x41e575
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], eax
jl 0x41e5b6
mov dword [esp + 0x14], 0xfffffffc
mov dword [esp + 0x14], 0xffffffff
dec dword [esp + 0x2c]
dec dword [esp + 0x24]
jns 0x41e59c
cmp dword [esp + 0x2c], eax
jne 0x41e5ea
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x160]
mov dword [ecx], edx
xor ecx, ecx
test edx, edx
setne cl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + ecx*4 + 0x44]
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x14]
cmp ecx, edx
mov ecx, eax
jge 0x41e5ed
lea ecx, [esi + 1]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x44]
imul eax, ecx
xor ecx, ecx
sub eax, dword [esp + 0x18]
cmp eax, 0xcef3cf68
setne cl
sub ecx, 0xb5cf
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x1f4]
call fcn.00411478
dec dword [esp + 0x18]
jns 0x41e54f
mov esi, dword [esp + 0x1c]
dec dword [esp + 0x30]
lea ecx, [esp + 0x160]
call fcn.00411478
test esi, esi
je 0x41e8c8
push 6
xor eax, eax
mov dword [esp + 0x38], 0x36173948
pop edi
inc eax
mov dword [esp + 0x34], edi
push eax
lea ecx, [esp + 0x214]
call fcn.004113a6
push 3
pop eax
mov dword [esp + 0x34], 0x703c5764
lea ecx, [esp + 0x1c4]
push eax
call fcn.004113a6
mov dword [esp + 0x34], 0xfffffffa
xor ecx, ecx
mov dword [esp + 0x34], 0x36a5b5cf
inc ecx
mov dword [esp + 0x34], 0x26cdee94
xor eax, eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ecx
jge 0x41e6cc
xor esi, esi
inc esi
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x210]
mov dword [ecx + edx*4], 0x28ea388
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x41e6ac
mov esi, dword [esp + 0x1c]
push 3
mov dword [esp + 0x24], eax
pop edx
cmp dword [esp + 0x20], edx
jge 0x41e6fa
push edx
pop esi
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x41e6db
mov esi, dword [esp + 0x1c]
push 3
pop edx
mov dword [esp + 0x20], eax
jmp 0x41e70f
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x274], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x41e700
mov dword [esp + 0x34], 1
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41e72f
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
lea ecx, [esp + 0x1c4]
call fcn.00411478
lea ecx, [esp + 0x210]
call fcn.00411478
mov dword [esp + 0xc0], esi
lea ecx, [esp + 0xe8]
xor esi, esi
inc esi
push esi
call fcn.004113a6
mov dword [esp + 0x10], 0x53d8da8e
xor eax, eax
mov dword [esp + 0x34], 0x63ab1943
mov dword [esp + 0xc], eax
jmp 0x41e78c
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0xe8]
mov dword [ecx + edx*4], 0x5d6c05ba
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x41e776
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jl 0x41e7ba
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0xe8]
mov ecx, dword [edx + ecx*4]
mov dword [edx + esi*4], ecx
dec dword [esp + 0x10]
jns 0x41e79c
xor esi, esi
inc esi
mov dword [esp + 0x10], 0xffffffe6
jmp 0x41e8b1
mov dword [esp + 0xc], 0x2121f90e
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], eax
jl 0x41e8ad
mov dword [esp + 0x20], 0x754320e3
mov dword [esp + 0x34], esi
mov dword [esp + 0x18], eax
jmp 0x41e7fe
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x1a4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x41e7ef
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], eax
jl 0x41e81d
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x34], ecx
dec dword [esp + 0x20]
jns 0x41e80f
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], eax
jl 0x41e8a3
mov dword [esp + 0x30], 5
mov dword [esp + 0x18], eax
jmp 0x41e848
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x178], 0x68108531
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x41e835
mov esi, dword [esp + 0xc]
mov edx, dword [esp + 0x17c]
mov ecx, dword [esp + 0xe8]
mov dword [ecx + esi*4], edx
cmp dword [esp + 0x10], eax
jne 0x41e879
mov ecx, dword [esp + 0xc]
push 5
pop edx
sub edx, ecx
jne 0x41e879
mov esi, eax
jmp 0x41e87c
xor esi, esi
inc esi
mov dword [esp + 0x1a4], esi
xor edx, edx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
cmp esi, ecx
setg dl
mov dword [esp + 0x34], edx
dec dword [esp + 0x20]
jns 0x41e827
xor esi, esi
inc esi
dec dword [esp + 0xc]
jns 0x41e7dd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xb
jge 0x41e7c7
lea ecx, [esp + 0xe8]
jmp 0x4204fa
mov eax, dword [0xa5ec80]
test al, 2
jne 0x41e956
or eax, 2
mov dword [0xa5ec80], eax
xor eax, eax
push eax
push eax
mov dword [0xa5ec60], eax
mov dword [0xa5ec64], eax
call fcn.0042108b
mov ecx, eax
mov dword [0xa5ec7c], 0x3f800000
mov dword [0xa5ec60], ecx
xor eax, eax
mov dword [esp + 0xcc], ecx
lea ecx, [esp + 0xcc]
push ecx
push 0x10
push eax
mov dword [0xa5ec68], eax
mov ecx, 0xa5ec68
mov dword [0xa5ec70], eax
mov dword [0xa5ec6c], eax
lea eax, [esp + 0x218]
push eax
call fcn.00420e30
push 0x46be25
mov dword [0xa5ec74], 7
mov dword [0xa5ec78], 8
call fcn.0045fa6f
pop ecx
mov dword [esp + 0x18], 0x1078932
xor edx, edx
inc edx
mov dword [esp + 0x20], edx
mov dword [esp + 0xc], 0x99958900
mov dword [esp + 0x24], 0xfaeb382
mov dword [esp + 0x10], 0xfffffff7
mov dword [esp + 0x30], 0xe2e4ed
push 0xfffffffffffffffe
pop eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x2c], eax
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0xc], eax
jmp 0x41e9b3
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x258], 0x4c6454c9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x41e9a0
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x10], eax
je 0x41e9f2
cmp dword [esp + 0x30], eax
jne 0x41e9fa
mov esi, eax
cmp dword [esp + 0xc], eax
je 0x41e9fc
mov esi, edx
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp esi, ecx
setne dl
sub edx, dword [esp + 0x24]
neg edx
sbb edx, edx
inc edx
cmp edx, 0xb6b7be2d
ja 0x41ea25
cmp dword [esp + 0x18], eax
je 0x41ea25
xor esi, esi
inc esi
mov edx, esi
jmp 0x41ea2a
xor esi, esi
mov edx, eax
inc esi
mov ecx, dword [esp + 0x24]
imul ecx, edx
cmp ecx, 0xbc23cea
jne 0x41ebf9
cmp dword [esp + 0x20], eax
jne 0x41ebf9
cmp dword [esp + 0x10], eax
jne 0x41ebf9
mov dword [esp + 0xc], 0xce3044b1
mov dword [esp + 0x28], esi
mov dword [esp + 0x28], 0xcb0ea5cd
mov dword [esp + 0xc], eax
jmp 0x41ea7b
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x4c], 0x3b36
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x41ea6b
mov ecx, dword [esp + 0x4c]
xor edx, edx
imul ecx, dword [esp + 0x50], 0x1ec3
cmp ecx, esi
setg dl
mov dword [esp + 0xc], edx
xor edx, edx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x13f3
mov ecx, dword [esp + 0x50]
setge dl
mov dword [esp + 0x14], edx
xor edx, edx
cmp ecx, dword [esp + 0x14]
setg dl
mov dword [esp + 0x20], edx
cmp dword [esp + 0x10], 0x673eefd7
jg 0x41ebc9
mov dword [esp + 0x14], 0x2ec3887d
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x28], 2
mov dword [esp + 0x10], 0xd
cmp dword [esp + 0x10], 0x1b
je 0x41ec90
mov dword [esp + 0x1c], 0x18fcd197
mov ecx, dword [esp + 0x20]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
push 0
pop ecx
setl cl
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x50]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
neg esi
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, esi
setl dl
mov dword [esp + 0x28], edx
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
sub esi, 0xfa32
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp ecx, esi
mov ecx, dword [esp + 0x50]
setg dl
mov dword [esp + 0x28], edx
xor edx, edx
cmp dword [esp + 0x28], ecx
setg dl
mov dword [esp + 0x28], edx
cmp dword [esp + 0x28], 6
jle 0x41eb90
cmp dword [esp + 0x1c], eax
je 0x41eb90
xor esi, esi
inc esi
jmp 0x41eb92
mov esi, eax
mov ecx, dword [esp + 0x4c]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0xc]
setge dl
mov dword [esp + 0x28], edx
xor edx, edx
cmp dword [esp + 0x28], ecx
setl dl
mov dword [esp + 0x28], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1b
jne 0x41eafa
xor esi, esi
inc esi
jmp 0x41ec90
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41ec90
push eax
push 0x1739
push 0x19fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
xor eax, eax
jmp 0x41ec90
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0x9c1c73b0
mov dword [esp + 0x18], 0xadf851f0
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0xc], ecx
jge 0x41ec1f
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov dword [esp + 0x18], esi
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0xc], esi
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
cmp ecx, esi
mov ecx, dword [esp + 0x1c]
setg dl
mov dword [esp + 0x14], edx
xor edx, edx
cmp dword [esp + 0x14], ecx
setl dl
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x2c]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x30]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x264]
mov edx, dword [esp + 0x2c]
add ecx, 0x843085ad
imul edx, ecx
push 3
pop ecx
movdqu xmmword [esp + 0x64], xmm0
cmp ecx, edx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x14], 0x69ad59e5
mov dword [esp + 0x1c], eax
jmp 0x41ece2
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x9c], 7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x41eccf
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x41ecf9
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x9c], eax
lea eax, [esp + 0x40]
push eax
call fcn.00420714
push 3
pop edx
mov edi, dword [eax]
mov eax, 0xe820f90f
mov dword [esp + 0x10], 0x925ef2c3
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x14], 0x5e19f8c5
mov dword [esp + 0xc], 0xd14b4322
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
xor eax, eax
mov dword [esp + 0x14], 0x46409ef3
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], eax
jmp 0x41ed7b
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x1dc], 0x259dba5c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x41ed68
cmp dword [esp + 0x10], eax
jne 0x41ee29
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
sub ecx, 0x8b47
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
imul ecx, dword [esp + 0x10]
sub ecx, dword [esp + 0x10]
jne 0x41edcf
cmp dword [esp + 0x10], eax
jne 0x41edcf
cmp dword [esp + 0x1c], eax
jne 0x41edcf
mov esi, eax
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x10]
setle dl
inc edx
mov dword [esp + 0x14], edx
xor edx, edx
cmp dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x10]
setne dl
sub ecx, edx
mov dword [esp + 0x14], ecx
jne 0x41ee05
cmp dword [esp + 0x1c], eax
jne 0x41ee05
xor esi, esi
mov ecx, eax
inc esi
jmp 0x41ee0a
xor esi, esi
inc esi
mov ecx, esi
mov dword [esp + 0x1e4], ecx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1e4]
mov dword [esp + 0xdc], ecx
cmp ecx, esi
jg 0x41ee42
mov ecx, dword [esp + 0xdc]
mov edx, dword [esp + 0xdc]
mov ecx, dword [esp + 0xc]
cmp edx, ecx
push 0
pop ecx
setl cl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0xc], eax
je 0x41eec6
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41eed9
push 0xab2
push 0x1a76
push 0xb5e
push eax
push 0x153b
push 0xced
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x1bef
push 0x266d
push 0x202c
push 0x147c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor esi, esi
xor eax, eax
inc esi
jmp 0x41eed9
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xd8], ecx
mov dl, byte [ebp + 0xc]
test dl, dl
jne 0x41eee8
test edi, edi
jne 0x41f1fe
mov dword [esp + 0xc], 0x20e83c77
mov dword [esp + 0x1c], eax
jmp 0x41ef06
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x5c], 8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x41eef6
mov dword [esp + 0xc], eax
jmp 0x41ef1e
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x5c], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x41ef12
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x280]
push eax
call fcn.004119a8
mov esi, eax
lea edi, [esp + 0x68]
pop ecx
push 3
lea ecx, [esp + 0x184]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x14], 0x4adca1a1
mov dword [esp + 0x2c], 0
push edi
call fcn.004113a6
xor esi, esi
inc esi
xor eax, eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], eax
jmp 0x41ef9a
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x21c], 0xfffffff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x41ef87
mov dword [esp + 0x10], eax
jmp 0x41efb8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x41efa6
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 0xffff
sbb eax, eax
neg eax
sub eax, dword [esp + 0x28]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
neg eax
cmp eax, esi
setge cl
xor edx, edx
sub ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffffb
lea ecx, [esp + 0x180]
setle al
mov dword [esp + 0x1c], eax
call fcn.00411478
cmp byte [ebp + 0xc], 0
je 0x41f1fa
cmp dword [esp + 0x6c], 0
je 0x41f1fa
mov dword [esp + 0x14], 0xcb457102
xor eax, eax
mov dword [esp + 0x30], 0xbb6748f6
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], esi
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41f079
push 0x21e5
push 0x1abe
push eax
push 0x151f
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
cmp ecx, edx
push 0
pop ecx
setge cl
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x70]
mov dword [esp + 0x10], 2
mov dword [esp + 0x14], eax
mov dword [esp + 0xc4], ecx
mov dword [esp + 0x1c], eax
jmp 0x41f0cd
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x98], 0x7dd68876
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x41f0ba
mov dword [esp + 0x10], 0xffffffea
jmp 0x41f0eb
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], eax
jne 0x41f0f2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffc
jl 0x41f0dd
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jg 0x41f1ef
push esi
lea ecx, [esp + 0x104]
call fcn.004113a6
xor eax, eax
mov dword [esp + 0x14], 0x7f3e76e5
mov dword [esp + 0x1c], eax
jmp 0x41f133
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x100]
mov dword [ecx + edx*4], 0x64caf14c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x41f11d
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41f153
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
xor eax, eax
mov ecx, dword [esp + 0x100]
mov dword [ecx], eax
mov dword [esp + 0x1c], 0xd947597a
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x14], 0xca3191b4
mov dword [esp + 0x14], 0xe80031aa
mov dword [esp + 0x14], esi
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x41f19a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x41f1c0
mov dword [esp + 0x14], 0x7d2038e8
mov dword [esp + 0x14], 0x9753589f
mov dword [esp + 0x14], 0xfffffff7
inc dword [esp + 0x14]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x41f1a0
mov ecx, dword [esp + 0x100]
inc dword [ecx]
cmp dword [ecx], 0
jle 0x41f15c
lea ecx, [esp + 0x100]
call fcn.00411478
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0
jle 0x41f100
mov eax, dword [esp + 0x6c]
mov dword [esp + 0xc8], eax
mov edi, dword [esp + 0x24]
mov dword [esp + 0x2c], 0xfffffffc
lea ecx, [esp + 0x13c]
mov dword [esp + 0x14], esi
push esi
call fcn.004113a6
push 3
pop eax
push eax
lea ecx, [esp + 0x1bc]
call fcn.004113a6
mov dword [esp + 0x28], 0xbb75da2c
xor eax, eax
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x20], eax
jmp 0x41f255
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x13c]
mov dword [ecx + edx*4], 0x4215e1ab
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x41f23f
push 3
mov dword [esp + 0x24], eax
pop edx
cmp dword [esp + 0x20], edx
jge 0x41f289
push edx
pop edi
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1b8]
mov dword [ecx + edx*4], esi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x41f26a
mov edi, dword [esp + 0x24]
push 3
pop edx
mov dword [esp + 0x20], eax
jmp 0x41f2a2
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x18c], 2
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x41f28f
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x2c]
cmp edx, 0xfff8
mov ecx, dword [esp + 0x13c]
mov dword [ecx], edx
sbb ecx, ecx
neg ecx
xor edx, edx
cmp ecx, 0xe9f2
mov ecx, dword [esp + 0x28]
setl dl
mov dword [esp + 0x14], edx
xor edx, edx
cmp ecx, dword [esp + 0x14]
setl dl
xor ecx, ecx
test edx, edx
setg cl
sub ecx, 4
cmp ecx, 0xafd47030
sbb ecx, ecx
inc ecx
neg ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
inc dword [esp + 0x18c]
mov ecx, dword [esp + 0x28]
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x14], eax
call fcn.00411478
lea ecx, [esp + 0x13c]
call fcn.00411478
test edi, edi
jne 0x41fc5e
xor eax, eax
cmp dword [esp + 0x64], eax
jle 0x41fc60
or edx, 0xffffffff
mov dword [esp + 0x18], edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], eax
jmp 0x41f3c9
mov dword [esp + 0xc], 4
mov dword [esp + 0x14], 0x65925ef2
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], 0x7cfaf425
mov dword [esp + 0x14], 0x5457d670
mov dword [esp + 0x14], 0x8f4f368a
mov dword [esp + 0xc], 7
jmp 0x41f3be
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x1c], eax
jmp 0x41f3a7
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x290], 5
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x41f394
mov dword [esp + 0x28], 0x2b29949d
dec dword [esp + 0x14]
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe5
jle 0x41f386
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffb
jge 0x41f350
mov dword [esp + 0x20], edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x30], 0x4320e32c
mov dword [esp + 0xc], 0x3bd6525
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x18], 0x491b
mov dword [esp + 0x28], 0xce68266c
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x20], eax
je 0x41f426
mov dword [esp + 0xc], 0x23a266d2
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x30]
xor edx, edx
mov ecx, dword [esp + 0x10]
test ecx, ecx
mov ecx, dword [esp + 0x30]
setle dl
mov dword [esp + 0x14], edx
xor edx, edx
cmp ecx, dword [esp + 0x14]
setge dl
sub edx, dword [esp + 0x30]
je 0x41f450
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
cmp dword [esp + 0x1c], ecx
je 0x41f462
mov ecx, eax
cmp dword [esp + 0x20], eax
je 0x41f464
mov ecx, esi
mov dword [esp + 0x2c], ecx
push 3
pop ecx
cmp dword [esp + 0x18], ecx
ja 0x41f5aa
mov dword [esp + 0xc], 0x253d9751
mov dword [esp + 0x20], 0xfffffff4
jmp 0x41f595
mov dword [esp + 0x14], 0xfffffff6
mov dword [esp + 0x1c], eax
jmp 0x41f4a8
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x38], 5
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x41f498
mov dword [esp + 0x10], 0xffffffff
jmp 0x41f4dc
mov dword [esp + 0x18], eax
jmp 0x41f4cc
mov ecx, dword [esp + 0x18]
cmp dword [esp + ecx*4 + 0x38], eax
jne 0x41f4d2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x41f4be
cmp dword [esp + 0x38], eax
jne 0x41f4e3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x39
jg 0x41f4b8
imul ecx, dword [esp + 0xc], 0xf725
test ecx, ecx
jne 0x41f4f3
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
sub ecx, dword [esp + 0xc]
neg ecx
push 0
sbb ecx, ecx
inc ecx
neg ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
cmp ecx, edx
pop edx
setge dl
xor ecx, ecx
cmp edx, 0xb224
push 0
setl cl
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
cmp edx, ecx
pop ecx
setl cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0xc], 0xdb9c
cmp ecx, esi
mov ecx, dword [esp + 0x20]
setle dl
mov dword [esp + 0x14], edx
xor edx, edx
cmp dword [esp + 0x14], ecx
setle dl
shl edx, 2
mov dword [esp + 0x38], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x1c
jg 0x41f48a
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
jmp 0x41f5ba
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41f5ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x18], 0xde9bf9f
lea ecx, [esp + 0xf4]
push esi
call fcn.004113a6
mov dword [esp + 0x30], 2
xor eax, eax
mov dword [esp + 0xc], 4
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], eax
jmp 0x41f601
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xf4]
mov dword [ecx + edx*4], 0x53e1
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], esi
jl 0x41f5eb
cmp dword [esp + 0x18], eax
jne 0x41f611
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0xf4]
push 0
mov ecx, dword [ecx]
add ecx, ecx
cmp esi, ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xf8]
mov edx, dword [ecx]
lea ecx, [edx + edx]
cmp ecx, 0xfffd
pop ecx
setne cl
sub ecx, edx
xor edx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x14], ecx
setne dl
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x30], eax
je 0x41f68b
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41f6f3
push 0x1cff
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x41f6f3
mov dword [esp + 0xc], 0x19
jmp 0x41f6ec
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x41f6c7
push 0xf18
push eax
push 0x92a
push 0x382
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
xor eax, eax
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x41f6e8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x29
je 0x41f695
mov byte [esp + 0xb], 0
cmp byte [esp + 0xb], 0
je 0x41f70a
push 0x22c7
call dword [sym.imp.GDI32.dll_GetStockObject]
lea ecx, [esp + 0xf4]
call fcn.00411478
push 2
pop esi
mov dword [esp + 0xc], 0x831713b9
lea ecx, [esp + 0x124]
mov dword [esp + 0x14], esi
push esi
call fcn.004113a6
mov dword [esp + 0x10], 0
jmp 0x41f74e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x41f73c
mov dword [esp + 0x10], 0
jmp 0x41f771
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x204], 0xfffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x41f75e
mov dword [esp + 0xc], 0xffffffe2
cmp dword [esp + 0xc], 0xffffffe8
jne 0x41fa56
mov edi, dword [esp + 0x124]
push 3
pop esi
mov dword [esp + 0x30], 0x6e83
lea ecx, [esp + 0x16c]
mov dword [esp + 0x28], 8
mov dword [esp + 0x28], 0xd434678d
push esi
call fcn.004113a6
mov dword [esp + 0x2c], 4
lea ecx, [esp + 0x154]
mov dword [esp + 0x1c], 0xed693765
push esi
call fcn.004113a6
xor eax, eax
mov dword [esp + 0x18], 0xfffffffb
mov dword [esp + 0x10], eax
jmp 0x41f7fc
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x16c]
mov dword [ecx + edx*4], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x41f7e6
mov dword [esp + 0x10], eax
jmp 0x41f81a
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x154]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x41f808
inc dword [esp + 0x2c]
cmp dword [edi + 4], eax
je 0x41f85f
mov ecx, dword [esp + 0x154]
mov edx, dword [ecx + 8]
mov ecx, dword [esp + 0x16c]
mov dword [ecx], edx
xor ecx, ecx
cmp edx, 0xf4c
sete cl
cmp ecx, 0x7503
jle 0x41f853
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
xor edx, edx
cmp ecx, 0xfffffffc
setg dl
sub edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add ecx, 0x2196db35
add ecx, edx
je 0x41f89e
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41fa2b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x41fa2b
push dword [esp + 0x98]
lea ecx, [esp + 0x254]
mov dword [esp + 0x14], 0xffff
push ecx
lea ecx, [esp + 0x248]
mov dword [esp + 0x30], 4
push ecx
xorps xmm0, xmm0
mov dword [esp + 0x80], eax
push eax
lea ecx, [esp + 0x84]
mov dword [esp + 0x88], eax
movdqu xmmword [esp + 0x250], xmm0
mov dword [esp + 0x8c], eax
call fcn.004114da
xor eax, eax
mov dword [esp + 0x28], 0xfffffffe
cmp dword [edi + 4], eax
jne 0x41f92a
mov esi, dword [esp + 0x10]
xor edx, edx
sub esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x204]
cmp esi, ecx
setg dl
mov dword [esp + 0x28], edx
mov ecx, dword [esp + 0x28]
cmp ecx, dword [esp + 0xc]
jne 0x41f92a
mov esi, eax
jmp 0x41f92f
xor ecx, ecx
lea esi, [ecx + 1]
cmp dword [esp + 0x10], 0xdf500c33
push 0
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, esi
mov ecx, dword [esp + 0x14]
setl dl
cmp edx, ecx
mov ecx, dword [esp + 0x78]
pop edx
setne dl
mov dword [esp + 0x28], edx
mov dword [ecx + 8], edx
xor edx, edx
cmp dword [esp + 0x28], 0xa82e
mov ecx, dword [esp + 0x10]
setle dl
cmp edx, ecx
push 0
pop ecx
setl cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x28], ecx
setl dl
mov dword [esp + 0x28], edx
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x18]
imul ecx, ecx, 0xffff
cmp ecx, dword [edi + 4]
jg 0x41f99e
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
xor esi, esi
mov ecx, dword [esp + 0x10]
inc esi
mov ecx, dword [esp + 0x10]
mov edx, esi
sub edx, ecx
cmp edx, dword [esp + 0x10]
jne 0x41f9bf
mov ecx, eax
cmp dword [esp + 0x30], eax
je 0x41f9c1
mov ecx, esi
imul ecx, ecx, 0xcc78
sub ecx, 0x205c4c30
cmp ecx, dword [esp + 0x10]
jge 0x41f9db
mov ecx, esi
cmp dword [esp + 0x2c], eax
jne 0x41f9dd
mov ecx, eax
push 2
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], eax
pop esi
jmp 0x41fa19
mov dword [esp + 0x10], eax
jmp 0x41fa0f
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x41fa0b
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
xor eax, eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x41f9f0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x41f9ea
lea ecx, [esp + 0x74]
call fcn.00411478
push 3
pop esi
lea ecx, [esp + 0x154]
call fcn.00411478
lea ecx, [esp + 0x16c]
call fcn.00411478
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe8
je 0x41f794
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x124]
call fcn.00411478
xor eax, eax
mov dword [esp + 0xc], 0xa860b4ff
xor esi, esi
mov dword [esp + 0x24], eax
inc esi
jmp 0x41fa84
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0xd0], eax
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x41fa75
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41faa5
push esi
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x41fabe
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0xd0], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x41faab
cmp dword [esp + 0x68], 0
je 0x41fc60
mov dword [esp + 0x2c], 0x950ba1bf
mov dword [esp + 0x30], 5
mov dword [esp + 0x28], 0xfffffffa
mov dword [esp + 0x14], 0xf9481f34
mov dword [esp + 0x18], 0x55a63a74
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x24], eax
jmp 0x41fb1d
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x54], 0x5eec80f2
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x41fb0d
cmp dword [esp + 0x2c], eax
je 0x41fba4
mov ecx, dword [esp + 0x2c]
inc dword [esp + 0x1c]
mov edx, dword [esp + 0x54]
mov ecx, dword [esp + 0x58]
cmp edx, ecx
mov ecx, dword [esp + 0x58]
push 0
pop edx
setge dl
cmp ecx, edx
mov ecx, dword [esp + 0x30]
push 0
pop edx
setg dl
cmp edx, ecx
push 0
pop edx
setg dl
mov dword [esp + 0x58], edx
mov ecx, dword [esp + 0x1c]
sub edx, ecx
add edx, dword [esp + 0x2c]
jne 0x41fb6e
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x58]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
sub esi, ecx
mov ecx, dword [esp + 0x2c]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setge dl
xor esi, esi
inc esi
sub edx, dword [esp + 0x14]
mov edx, esi
jne 0x41fba6
mov edx, eax
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
push 0x1883
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x34]
push esi
push dword [esp + 0x70]
setg dl
xor ecx, ecx
push esi
cmp edx, eax
push 0x68f1
setg cl
push 0x5cb0
mov dword [esp + 0x24], ecx
push 0x6c2c
call fcn.0041d1ac
add esp, 0x1c
push dword [esp + 0x68]
call fcn.0040f094
mov edi, eax
mov dword [esp + 0x10], 0x58e469ad
xor eax, eax
pop ecx
mov dword [esp + 0x24], eax
jmp 0x41fc19
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x48], 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x41fc09
mov dword [esp + 0xc], eax
jmp 0x41fc35
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x48], 0xe57ad95e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x41fc25
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41fc52
push eax
push 0x659
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea eax, [esp + 0x40]
push eax
call fcn.00420714
mov dword [eax], edi
xor eax, eax
mov dword [esp + 0x18], 0xfffffffc
mov dword [esp + 0xc], 0x10e5e534
mov dword [esp + 0x30], 0xfffffff6
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], 0x9b03be46
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0xc]
neg esi
sbb esi, esi
xor edx, edx
inc esi
sub esi, dword [esp + 0x18]
sub esi, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp esi, ecx
mov ecx, dword [esp + 0xc]
setg dl
mov dword [esp + 0x14], edx
xor edx, edx
cmp dword [esp + 0x14], ecx
setle dl
xor ecx, ecx
cmp edx, 0x48a2b8ea
mov edx, dword [esp + 0x18]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
imul edx, dword [esp + 0xc]
test edx, edx
je 0x41fced
cmp dword [esp + 0xc], eax
je 0x41fced
xor ecx, ecx
lea esi, [ecx + 1]
jmp 0x41fcef
mov esi, eax
mov ecx, dword [esp + 0x18]
xor edx, edx
cmp esi, ecx
sete dl
xor esi, esi
inc esi
cmp edx, esi
jg 0x41fd09
mov ecx, eax
cmp dword [esp + 0x18], eax
je 0x41fd0b
mov ecx, esi
mov edx, dword [esp + 0x18]
imul edx, ecx
mov ecx, dword [esp + 0x18]
push 0
cmp edx, ecx
pop edx
setge dl
xor ecx, ecx
cmp edx, 0xffffffff
setne cl
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x30], ecx
jg 0x41fd88
cmp dword [esp + 0xc], eax
jne 0x41fd88
mov dword [esp + 0x14], 8
push 3
mov dword [esp + 0x18], eax
pop edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], eax
jmp 0x41fd66
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x268], 0x6a67606e
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jl 0x41fd53
inc dword [esp + 0x14]
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x41fd8c
push 0xd0f
call dword [sym.imp.USER32.dll_GetKeyboardType]
jmp 0x41fd8c
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x64]
call fcn.00412d0d
mov eax, 0x5bb2c213
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
xor eax, eax
mov dword [esp + 0x14], 0x5010f7a7
mov dword [esp + 0x14], 0x443ac46d
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x14], 0x34bdac84
mov dword [esp + 0x14], 0x96753f3a
mov dword [esp + 0x14], 0x1ae9a07b
push 3
mov dword [esp + 0x18], esi
pop ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x10], eax
jmp 0x41fe10
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x200], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x41fdfd
mov dword [esp + 0x10], eax
jmp 0x41fe2f
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x10c], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x41fe1c
cmp dword [esp + 0x120], eax
je 0x41ff2f
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x1d0]
mov dword [esp + 0x14], 0xfbd6c3f0
mov dword [esp + 0x2c], 0x1c3a23fe
mov dword [esp + 0x14], 0x52d0da0b
push 2
call fcn.004113a6
mov dword [esp + 0x14], 0xf34ffdea
mov dword [esp + 0xc], 0
mov dword [esp + 0x24], 0
jmp 0x41fea1
push dword [esp + 0x24]
lea ecx, [esp + 0x1d4]
call fcn.00401484
mov dword [eax], 0xd95da228
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x41fe87
mov ecx, dword [esp + 0x10c]
xor edx, edx
mov eax, dword [esp + 0x2c]
add ecx, 0x9b6d5beb
cmp eax, ecx
setg dl
sub edx, dword [esp + 0x14]
jne 0x41fece
cmp dword [esp + 0x28], edx
jne 0x41fece
xor esi, esi
dec dword [esp + 0x30]
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x120]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10c]
setle cl
xor edx, edx
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp dword [esp + 0x30], ecx
jge 0x41ff18
cmp dword [esp + 0xc], 0
je 0x41ff18
xor esi, esi
inc esi
mov eax, esi
jmp 0x41ff1d
xor esi, esi
xor eax, eax
inc esi
lea ecx, [esp + 0x1d0]
mov dword [esp + 0x28], eax
call fcn.00411478
jmp 0x41ff61
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x41ff4e
push eax
push eax
push 0x1969
push 0x8e0
push eax
call dword [sym.imp.USER32.dll_ModifyMenuW]
xor eax, eax
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x41ff63
push eax
push eax
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
xor eax, eax
test edi, edi
je 0x4202a7
mov dword [esp + 0x24], eax
jmp 0x41ff81
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x3c], 6
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x41ff71
mov dword [esp + 0x3c], eax
jmp 0x41ffca
mov dword [esp + 0x14], esi
mov dword [esp + 0x28], 7
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x41ffbe
push esi
push 0x2610
push 0x12ac
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemInt]
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
dec dword [esp + 0x3c]
cmp dword [esp + 0x3c], 0xffffffec
jg 0x41ff8d
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x41fffb
push eax
push 0x288
push 0x191
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov edx, dword [esp + 0x34]
mov ecx, edi
call fcn.0041e187
mov dword [esp + 0x20], 6
mov edi, eax
mov dword [esp + 0x10], 0xe864896
mov eax, 0xda79815c
mov dword [esp + 0x18], 0xa08e
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0x34], 0x8e87bb6a
mov dword [esp + 0x34], 0x9478453
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
xor eax, eax
mov dword [esp + 0xc0], edi
cmp dword [esp + 0x10], eax
je 0x42007c
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
cmp edx, ecx
mov ecx, dword [esp + 0x20]
push 0
pop edx
setl dl
cmp edx, ecx
push 0
pop ecx
setge cl
xor edx, edx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x34], ecx
setge dl
cmp dword [esp + 0x20], edx
je 0x4201c0
xor esi, esi
mov dword [esp + 0x34], 0x39b8842b
inc esi
lea ecx, [esp + 0x148]
push esi
call fcn.004113a6
mov dword [esp + 0x24], 0
jmp 0x42010f
push dword [esp + 0x24]
lea ecx, [esp + 0x14c]
call fcn.00401484
mov dword [eax], 0xfd0fe1f2
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x4200f5
mov byte [esp + 0xb], 0
cmp byte [esp + 0xb], 0
je 0x420137
push 0x20dc
push 0
push 0
push 0x1b70
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
push 3
mov dword [esp + 0x24], 0x17
pop ecx
jmp 0x4201ac
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], 0xffffffe5
jle 0x4201a8
push 0
lea ecx, [esp + 0x14c]
call fcn.00401484
mov edx, eax
mov ecx, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
neg ecx
cmp dword [esp + 0x34], ecx
jge 0x420187
cmp dword [esp + 0x20], 0
jne 0x420187
xor ecx, ecx
jmp 0x420189
mov ecx, esi
mov eax, dword [esp + 0x34]
xor eax, eax
cmp ecx, 0xe0c2
setg al
mov dword [edx], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe5
jg 0x42016c
push 3
pop ecx
dec dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x420144
lea ecx, [esp + 0x148]
call fcn.00411478
jmp 0x420218
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], al
je 0x420218
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xab2
push 0x1a76
push 0xb5e
push eax
push 0x153b
push 0xced
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x1bef
push 0x266d
push 0x202c
push 0x147c
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xbc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xbc]
mov eax, dword [esp + 0x18]
neg ecx
push 9
sbb ecx, ecx
neg ecx
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0x14]
sub ecx, eax
pop eax
cmp eax, ecx
mov eax, dword [esp + 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, eax
mov eax, dword [esp + 0xbc]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
imul eax, ecx, 0xdb7a
sub eax, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x60]
push eax
call fcn.004206b2
mov dword [eax], edi
xor esi, esi
mov dword [esp + 0x10], 0xffffffff
inc esi
lea ecx, [esp + 0x1e8]
push esi
call fcn.004113a6
mov dword [esp + 0x24], 0
jmp 0x4202e0
push dword [esp + 0x24]
lea ecx, [esp + 0x1ec]
call fcn.00401484
and dword [eax], 0
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x4202c9
mov dword [esp + 0x10], 0xfffffffa
cmp dword [esp + 0x10], 6
jge 0x420478
push 3
pop edi
movdqa xmm0, xmmword [0xa5c850]
lea eax, [esp + 0x230]
push eax
lea eax, [esp + 0x224]
push eax
lea ecx, [esp + 0x258]
movdqu xmmword [esp + 0x228], xmm0
call fcn.00411497
push ecx
lea ecx, [esp + 0x134]
push dword [eax + 4]
push dword [eax]
call fcn.00411452
push esi
lea ecx, [esp + 0xa8]
call fcn.004113a6
mov dword [esp + 0x34], 0x39f5fa31
mov dword [esp + 0x24], 0
jmp 0x420371
push dword [esp + 0x24]
lea ecx, [esp + 0xa8]
call fcn.00401484
or dword [eax], 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x42035a
mov byte [esp + 0xb], 0
cmp byte [esp + 0xb], 0
je 0x42038b
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0
lea ecx, [esp + 0xa8]
call fcn.00401484
mov dword [eax], edi
xor eax, eax
mov dword [esp + 0xc], 0xc93ee327
mov dword [esp + 0x34], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0xc], eax
jmp 0x4203d1
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x4203cd
push eax
push 0x659
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
xor eax, eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x4203b3
push eax
lea ecx, [esp + 0x134]
call fcn.00401484
cmp dword [eax], 0
jne 0x42040e
push 0
lea ecx, [esp + 0xa8]
call fcn.00401484
lea ecx, [esp + 0x130]
push dword [eax]
call fcn.00401484
cmp dword [eax], 0
jne 0x42040e
xor eax, eax
jmp 0x420410
mov eax, esi
mov dword [esp + 0x34], eax
xor ecx, ecx
mov eax, dword [esp + 0x34]
sub eax, 0x110e6b6c
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
cmp eax, 0x16
push 0
setle cl
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0xa8]
mov eax, dword [esp + 0x38]
neg eax
mov dword [esp + 0x38], eax
call fcn.00401484
dec dword [eax]
jns 0x42039b
lea ecx, [esp + 0xa4]
call fcn.00411478
lea ecx, [esp + 0x130]
call fcn.00411478
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 6
jl 0x4202fc
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x4204ec
mov dword [esp + 0xc], 0x82e58099
mov dword [esp + 0x34], 0xb1c5adf
mov dword [esp + 0xc], eax
jmp 0x4204e2
mov byte [esp + 0xb], al
cmp byte [esp + 0xb], 0
je 0x4204b5
push 0x168c
push eax
push 0x15e7
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jne 0x4204cf
mov ecx, eax
cmp dword [esp + 0xc], eax
je 0x4204d1
mov ecx, esi
cmp ecx, 0xa9c1c73b
sbb ecx, ecx
inc ecx
mov dword [esp + 0x34], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], eax
jle 0x420496
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1b
jle 0x420480
lea ecx, [esp + 0x1e8]
call fcn.00411478
mov eax, dword [ebp + 8]
lea esi, [esp + 0xc0]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret