Function at 0x1004a860
Capabilities:
Delete file
Get session user name
Identify system language via api
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008927c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
push ebx
push esi
xor eax, eax
mov dword [esp + 0x58], ecx
push edi
inc eax
mov dword [esp + 0xc8], edx
push eax
lea ecx, [esp + 0x150]
call fcn.100280d9
xor ebx, ebx
xor esi, esi
push 4
mov dword [esp + 0x24], ebx
inc esi
pop edi
jmp 0x1004a8bf
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1004a8ad
mov eax, dword [esp + 0x14c]
lea ecx, [esp + 0x14c]
mov dword [eax], ebx
call fcn.1002815b
mov dword [esp + 0x40], esi
lea ecx, [esp + 0x1b8]
mov dword [esp + 0x40], 0xfffffffb
mov dword [esp + 0x40], edi
push esi
call fcn.100280d9
push 0xffffffffffffffff
mov dword [esp + 0x34], 0x61c71bc7
mov dword [esp + 0x24], ebx
pop edx
jmp 0x1004a91a
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1b8]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1004a908
inc dword [esp + 0x30]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1004a938
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
lea ecx, [esp + 0x1b8]
call fcn.1002815b
push dword [esp + 0x5c]
lea eax, [esp + 0x204]
mov dword [esp + 0x18], 8
push eax
lea eax, [esp + 0x1f8]
mov dword [esp + 0x74], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0x7c], ebx
push ebx
lea ecx, [esp + 0x7c]
mov dword [esp + 0x84], ebx
movdqu xmmword [esp + 0x200], xmm0
call fcn.10029248
push esi
lea ecx, [esp + 0x7c]
mov dword [esp + 0x248], ebx
call fcn.100280d9
xor edx, edx
inc edx
mov byte [esp + 0x244], dl
mov dword [esp + 0x24], 0xec0351a9
mov dword [esp + 0x1c], 0xf0ed6937
mov dword [esp + 0x20], ebx
jmp 0x1004a9c9
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x78]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1004a9b6
mov eax, dword [esp + 0x78]
mov dword [eax], ebx
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x38], eax
mov dword [esp + 0x18], 0xa8d7d2a7
lea ecx, [esp + 0x84]
push 2
call fcn.100280d9
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], 0xf3e8e036
mov dword [esp + 0x20], ebx
jmp 0x1004aa1b
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x84]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1004aa09
mov eax, dword [esp + 0x78]
cmp dword [eax], ebx
jne 0x1004aa5a
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x78]
mov edx, dword [eax]
xor eax, eax
cmp edx, 0x10a83afd
sete al
xor ecx, ecx
cmp eax, 0xfc35
mov eax, dword [esp + 0x6c]
setg cl
cmp ecx, dword [eax + edx*4]
je 0x1004aa5e
mov esi, ebx
jmp 0x1004aa61
mov eax, dword [esp + 0x6c]
xor esi, esi
inc esi
mov eax, dword [eax]
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x78]
mov ecx, dword [eax]
mov eax, dword [esp + 0x6c]
cmp esi, dword [eax + ecx*4]
setge dl
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x18], 0xad5b481d
mov edx, dword [esp + 0x84]
mov edi, dword [esp + 0x78]
sbb eax, eax
inc eax
mov dword [esp + 0x20], edx
xor ecx, ecx
cmp eax, dword [edx + 4]
mov eax, dword [esp + 0x6c]
setg cl
xor edx, edx
mov dword [esp + 0x34], ecx
mov ecx, dword [edi]
mov esi, dword [esp + 0x34]
cmp esi, dword [eax + ecx*4]
mov eax, 0x5c2f
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x38]
setl dl
mov dword [esi + 4], edx
sub eax, dword [ecx + 0xc]
cmp eax, 0x25a33ed8
jge 0x1004ab0f
cmp dword [edi], ebx
jne 0x1004ab0f
mov esi, 0x3984
xor edi, edi
mov dword [esp + 0x1a0], esi
inc edi
mov dword [esp + 0x1a4], esi
mov dword [esp + 0x1a8], esi
mov dword [esp + 0x1ac], esi
mov eax, dword [esp + 0x1a8]
mov dword [esp + 0x30], eax
jmp 0x1004ac82
mov dword [esp + 0x28], 0xcc19ab5a
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x1c], 9
jmp 0x1004ab40
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004ab3c
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff8
jge 0x1004ab29
xor edi, edi
inc edi
mov dword [esp + 0x24], edi
cmp dword [esp + 0x24], ebx
jl 0x1004ac82
mov dword [esp + 0x18], ebx
jmp 0x1004ab71
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x84]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1004ab5e
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [esp + 0x24]
jne 0x1004ab99
mov eax, dword [esp + 0x84]
mov edx, ebx
cmp dword [eax], ebx
je 0x1004ab9b
mov edx, edi
mov eax, dword [esp + 0x2c]
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, edi
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp eax, 0xa4cb52c2
setne cl
sub ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x28]
sub ecx, 0x2ca82e93
jne 0x1004abdc
cmp dword [esi + 4], ebx
mov esi, ebx
je 0x1004abde
mov esi, edi
mov ecx, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x84]
cmp esi, dword [eax + ecx*4]
mov eax, dword [esp + 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x78]
setg dl
mov ecx, dword [eax]
mov eax, dword [esp + 0x6c]
cmp dword [eax + ecx*4], edx
jne 0x1004ac23
mov eax, dword [esp + 0x84]
mov esi, ebx
cmp dword [eax], ebx
je 0x1004ac25
mov esi, edi
mov ecx, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x84]
cmp dword [eax + ecx*4], esi
mov eax, dword [esp + 0x2c]
sete dl
mov esi, dword [esp + 0x20]
xor ecx, ecx
cmp edx, 2
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x28]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xffffffff
setge al
sub eax, dword [esp + 0x28]
neg eax
sbb eax, eax
add eax, 0xffffa3c1
cmp eax, edi
sbb eax, eax
inc eax
mov dword [esp + 0x34], eax
dec dword [esp + 0x24]
jns 0x1004ab58
lea ecx, [esp + 0x84]
call fcn.1002815b
mov eax, dword [esp + 0x78]
inc dword [eax]
cmp dword [eax], 3
jle 0x1004a9dd
lea ecx, [esp + 0x78]
call fcn.1002815b
or esi, 0xffffffff
lea ecx, [esp + 0x6c]
mov dword [esp + 0x244], esi
call fcn.1002815b
push dword [esp + 0x5c]
movdqa xmm0, xmmword [0x10007b50]
lea eax, [esp + 0x1f4]
mov dword [esp + 0x3c], 0xe58b
lea ecx, [esp + 0xa0]
push eax
mov dword [esp + 0x24], 0xfcc58a01
lea eax, [esp + 0x1e8]
mov dword [esp + 0x38], 0xe76d238e
push eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], esi
push ebx
movdqu xmmword [esp + 0x1f0], xmm0
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
call fcn.10029248
cmp dword [esp + 0x1c], 2
mov ecx, 0xf068cd54
jl 0x1004ad7e
cmp dword [esp + 0x1c], ebx
mov eax, edi
add eax, 8
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0xe6fc2e60
sbb edx, edx
inc edx
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, edi
setl cl
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
jne 0x1004ad80
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp edx, eax
setle cl
xor edx, edx
imul ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x9c]
cmp ecx, dword [eax + 8]
setg dl
xor ecx, ecx
inc ecx
cmp edx, ecx
jb 0x1004ae68
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x1004add5
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x218], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1004adc6
mov dword [esp + 0x18], 0xfffffffe
jmp 0x1004adfc
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004adf8
push ebx
call dword [sym.imp.USER32.dll_RegisterClassA]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff3
jle 0x1004ade6
mov dword [esp + 0x18], ebx
jmp 0x1004ae5f
mov dword [esp + 0x20], 0xa7b48fe2
xor edx, edx
mov dword [esp + 0x34], 7
mov eax, dword [esp + 0x28]
cmp eax, 0x81cd
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 9
je 0x1004ae09
jmp 0x1004aee2
mov dword [esp + 0x20], ebx
jmp 0x1004ae81
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x20c], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1004ae6e
mov dword [esp + 0x24], ebx
jmp 0x1004aec0
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004aebc
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor ecx, ecx
inc ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jl 0x1004ae8e
mov dword [esp + 0x24], ebx
jmp 0x1004aedb
mov dword [esp + 0x214], 0x609e00c2
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xf
jne 0x1004aecc
lea ecx, [esp + 0x9c]
call fcn.1002815b
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0xa4ccfd66
mov dword [esp + 0x18], 0x4a938f73
push 0xfffffffffffffffa
pop edi
cmp dword [esp + 0x14], ebx
je 0x1004af8a
mov dword [esp + 0x2c], 0xfff7
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x1004af30
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1b0], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1004af21
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov eax, dword [esp + 0x2c]
setge dl
imul edx, eax
xor eax, eax
cmp edx, 0xa17d
mov dword [esp + 0x1b4], edx
setl al
xor ecx, ecx
cmp eax, 0x5ba1
setge cl
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
jmp 0x1004b037
mov dword [esp + 0x30], 8
mov dword [esp + 0x2c], 0x5b01d976
mov dword [esp + 0x34], 2
mov dword [esp + 0x1c], ebx
jmp 0x1004b02d
mov dword [esp + 0x34], 0x8be
mov dword [esp + 0x18], 0xf8609561
cmp dword [esp + 0x18], ebx
jne 0x1004afcf
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x1c], eax
jl 0x1004afcf
mov ecx, ebx
jmp 0x1004afd2
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x30]
add eax, ecx
cmp eax, dword [esp + 0x30]
jg 0x1004afe8
cmp dword [esp + 0x14], ebx
jne 0x1004afe8
mov ecx, ebx
jmp 0x1004afeb
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0xd0d4
setl al
xor edx, edx
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
mov eax, dword [esp + 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x34], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], al
je 0x1004b029
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1004afab
mov dword [esp + 0x18], 0x15
jmp 0x1004b083
mov dword [esp + 0x2c], 0xf908
cmp dword [esp + 0x2c], ebx
jne 0x1004b08a
mov dword [esp + 0x34], 0xfffffff7
mov eax, dword [esp + 0x34]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x18], ebx
jne 0x1004b07f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004b07f
push ebx
push 0xea5
call esi
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 9
jg 0x1004b041
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], ebx
jmp 0x1004b0a6
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xf4], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004b097
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 0xb
jg 0x1004b2e2
mov dword [esp + 0x28], 0x78f1e0c8
mov dword [esp + 0x18], edi
mov dword [esp + 0x2c], 0xef31
mov dword [esp + 0x14], ebx
jmp 0x1004b0e6
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x44], 0x67a876e6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004b0d6
mov dword [esp + 0x48], ebx
jmp 0x1004b299
mov dword [esp + 0x30], 0xffffffff
xor edx, edx
mov dword [esp + 0x1c], 0xaf7806aa
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x28]
cmp ecx, eax
mov eax, dword [esp + 0x48]
setne dl
xor ecx, ecx
cmp edx, 0xc1da
setne cl
add eax, ecx
mov dword [esp + 0xf8], eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
je 0x1004b142
cmp dword [esp + 0x1c], ebx
je 0x1004b142
xor esi, esi
inc esi
jmp 0x1004b144
mov esi, ebx
mov eax, dword [esp + 0x48]
xor edx, edx
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x48]
mov eax, dword [esp + 0x30]
cmp ecx, eax
setle dl
xor eax, eax
neg esi
cmp edx, esi
setne al
xor ecx, ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
neg eax
cmp eax, dword [esp + 0x34]
mov eax, dword [esp + 0x44]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x4c]
setl dl
add eax, edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x1004b295
mov dword [esp + 0x14], 0x8c74c3ee
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0xf4], ebx
jne 0x1004b295
cmp dword [esp + 0x48], ebx
je 0x1004b220
mov dword [esp + 0x28], ebx
jmp 0x1004b1f1
cmp byte [esp + 0x13], 0
je 0x1004b1ed
push ebx
push 0x1220
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
mov byte [esp + 0x13], bl
jle 0x1004b1cb
cmp byte [esp + 0x13], 0
je 0x1004b28b
push 0x2478
push 0x22f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x1004b28b
mov dword [esp + 0x34], 0xfffffff7
cmp dword [esp + 0x1c], ebx
jne 0x1004b238
cmp dword [esp + 0x48], ebx
jne 0x1004b238
mov esi, ebx
jmp 0x1004b23b
xor esi, esi
inc esi
mov dword [esp + 0x2c], 1
xor edx, edx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
cmp eax, esi
setl cl
xor eax, eax
cmp ecx, 0xfffffff9
setne al
cmp eax, dword [esp + 0x30]
je 0x1004b279
cmp dword [esp + 0x14], ebx
jne 0x1004b279
mov eax, ebx
jmp 0x1004b27c
xor eax, eax
inc eax
cmp eax, 0xffffffff
sbb eax, eax
neg eax
add eax, dword [esp + 0x34]
mov dword [esp + 0x34], eax
dec dword [esp + 0x1c]
jns 0x1004b19e
dec dword [esp + 0x48]
cmp dword [esp + 0x48], 0xffffffeb
jle 0x1004b0f6
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x1004b2d0
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0xf4], ebx
jne 0x1004b2d0
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0xf4]
dec dword [esp + 0x18]
jns 0x1004b2b2
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xb
jle 0x1004b0bc
xor ecx, ecx
inc ecx
push ecx
lea ecx, [esp + 0x18c]
call fcn.100280d9
mov dword [esp + 0x244], 2
lea ecx, [esp + 0xe8]
mov dword [esp + 0x24], 0x2e91a049
mov dword [esp + 0x18], 0x64276038
push 3
call fcn.100280d9
mov byte [esp + 0x244], 3
mov dword [esp + 0x14], 0x9db2213a
mov dword [esp + 0x38], 0xe7a5
mov dword [esp + 0x14], ebx
jmp 0x1004b34c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0xe80c6548
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004b336
push 0xc
pop edi
mov dword [esp + 0x24], edi
jmp 0x1004b42f
mov dword [esp + 0x1c], 0x2124f84b
lea ecx, [esp + 0x17c]
push 2
call fcn.100280d9
mov dword [esp + 0x2c], 0xcaa5d732
mov dword [esp + 0x34], 3
mov dword [esp + 0x14], ebx
jmp 0x1004b3a1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x17c]
mov dword [eax + ecx*4], 0x8dee21af
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1004b38b
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0xfffffff3
jl 0x1004b41f
mov esi, dword [esp + 0xe8]
mov dword [esp + 0x14], 0x8af8
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
test eax, eax
mov dword [esi + 8], eax
mov eax, dword [esp + 0x14]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x17c]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff3
jge 0x1004b3ba
lea ecx, [esp + 0x17c]
call fcn.1002815b
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff5
jl 0x1004b35f
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0x31
jne 0x1004b64a
mov esi, dword [esp + 0xe8]
push 1
lea ecx, [esp + 0xb0]
call fcn.100280d9
mov dword [esp + 0x28], 5
xor edx, edx
mov dword [esp + 0x30], ebx
inc edx
mov dword [esp + 0x14], ebx
jmp 0x1004b489
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1004b473
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004b4a3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
xor edx, edx
inc edx
mov eax, dword [esp + 0x24]
mov eax, dword [esi + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xac]
mov ecx, dword [esi + 8]
dec ecx
cmp ecx, dword [eax]
jne 0x1004b50c
mov dword [esp + 0x14], ebx
jmp 0x1004b4ea
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1c4], 0xf668
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1004b4d7
mov eax, dword [esp + 0x1c8]
mov ecx, 0x8fba323a
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x24], eax
jmp 0x1004b62f
mov dword [esp + 0x20], 0xe95372a7
mov dword [esp + 0x1c], 0x2a25
mov dword [esp + 0x2c], 0x74ecb9a7
mov dword [esp + 0x14], ebx
jmp 0x1004b53d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x90], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1004b52a
mov eax, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xac]
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setge dl
xor eax, eax
sub edx, dword [esp + 0x1c]
cmp edx, 0xdfb9
setg al
xor ecx, ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x38]
cmp eax, dword [esp + 0x34]
setl cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x24]
je 0x1004b5a1
mov eax, dword [esp + 0xac]
cmp dword [eax], ebx
je 0x1004b5a1
xor eax, eax
inc eax
jmp 0x1004b5a3
mov eax, ebx
dec dword [esp + 0x20]
xor edx, edx
mov ecx, dword [esp + 0x1c]
imul ecx, eax
mov eax, dword [esp + 0x28]
cmp ecx, eax
setle dl
xor ecx, ecx
imul edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp edx, eax
mov eax, dword [esp + 0x1c]
setg cl
xor edx, edx
cmp ecx, eax
mov ecx, 0xfff6
setge dl
sub edx, dword [esp + 0x30]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x30]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x30]
setl dl
xor ecx, ecx
cmp edx, dword [esi + 8]
setg cl
sub ecx, eax
dec ecx
imul ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], ecx
xor ecx, ecx
cmp dword [esp + 0x34], eax
setne cl
mov dword [esp + 0x90], ecx
lea ecx, [esp + 0xac]
call fcn.1002815b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x31
je 0x1004b450
lea ecx, [esp + 0xe8]
mov byte [esp + 0x244], 2
call fcn.1002815b
push 4
lea ecx, [esp + 0x54]
call fcn.100280d9
mov byte [esp + 0x244], 4
mov dword [esp + 0x14], 0xfffffffe
mov dword [esp + 0x18], ebx
jmp 0x1004b68f
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x3c], 0x39b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1004b67f
mov dword [esp + 0x18], ebx
jmp 0x1004b6af
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x50]
mov dword [eax + ecx*4], 0x743d837b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1004b69c
mov eax, dword [esp + 0x50]
push 3
pop esi
mov dword [eax], ebx
push esi
lea ecx, [esp + 0x168]
call fcn.100280d9
mov dword [esp + 0x14], ebx
jmp 0x1004b6e8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 0xb9193c1d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1004b6d2
mov eax, dword [esp + 0x50]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x50]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x50]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x50]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x50]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x50]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x50]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x164]
mov dword [eax], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004b74e
call dword [sym.imp.USER32.dll_GetCapture]
lea ecx, [esp + 0x164]
call fcn.1002815b
mov eax, dword [esp + 0x50]
dec dword [eax]
jns 0x1004b6bf
mov dword [esp + 0x14], ebx
jmp 0x1004b790
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004b78c
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe4
jg 0x1004b76c
lea ecx, [esp + 0x50]
mov byte [esp + 0x244], 2
call fcn.1002815b
push 2
lea ecx, [esp + 0x104]
call fcn.100280d9
mov dword [esp + 0x18], 0xdf1febae
mov dword [esp + 0x2c], 0x3b2c57e7
mov dword [esp + 0x14], ebx
jmp 0x1004b7e2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1004b7cc
xor eax, eax
mov dword [esp + 0x18], ebx
inc eax
cmp dword [esp + 0x18], eax
jg 0x1004b8db
mov dword [esp + 0x1c], 0xbeccce1e
mov dword [esp + 0x1c], ebx
jmp 0x1004b8c0
mov dword [esp + 0x28], 4
mov dword [esp + 0x2c], 0x41a62a96
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004b844
push 0x36
push 0x1b47
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
inc eax
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], eax
jg 0x1004b8bc
mov esi, dword [esp + 0x100]
xor ebx, ebx
inc ebx
mov dword [esp + 0x34], 0x3895196e
mov dword [esp + 0x34], 6
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], 0xe9c9
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x100]
mov edx, dword [esi + 4]
mov dword [eax + ecx*4], edx
mov dword [esp + 0x34], edx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ebx
jle 0x1004b858
xor eax, eax
xor ebx, ebx
inc eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x1004b80b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x1004b7fa
push 3
pop esi
lea ecx, [esp + 0x100]
call fcn.1002815b
push 2
lea ecx, [esp + 0x12c]
call fcn.100280d9
mov byte [esp + 0x244], 5
mov dword [esp + 0x1c], 0xc93b4e1a
mov dword [esp + 0x14], ebx
jmp 0x1004b91e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x228], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1004b90b
mov dword [esp + 0x1c], edi
jmp 0x1004b95a
mov dword [esp + 0x18], 0xf759609c
mov dword [esp + 0x18], ebx
jmp 0x1004b950
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x228], ebx
jne 0x1004b956
cmp dword [esp + 0x18], ebx
jne 0x1004b956
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1004b939
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jg 0x1004b92b
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x134]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0xd8], 0xffff
mov dword [esp + 0x2c], 0xb0ad8ea5
push 1
call fcn.100280d9
mov eax, 0x20b5
xor edx, edx
mov dword [esp + 0x10c], eax
inc edx
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0x18], ebx
jmp 0x1004b9cb
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x60], 0x236432a2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1004b9bb
mov dword [esp + 0x18], ebx
or edi, 0xffffffff
cmp dword [esp + 0x18], edx
jge 0x1004b9f2
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x18]
jmp 0x1004b9d8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004ba0b
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
cmp dword [esp + 0x60], 0xfffb
mov edx, dword [esp + 0x68]
sbb eax, eax
inc eax
imul edx, eax
mov eax, dword [esp + 0x68]
sub edx, 0xfffffff9
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x134]
mov dword [eax], ecx
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x114]
mov eax, dword [esp + 0x114]
cmp ecx, eax
mov eax, dword [esp + 0x68]
setl dl
xor ecx, ecx
cmp edx, 1
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x60]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x64]
setle cl
mov dword [esp + 0x34], ecx
xor ecx, ecx
cmp dword [esp + 0x34], eax
mov eax, dword [esp + 0x68]
setle cl
sub eax, ecx
lea ecx, [esp + 0x134]
mov dword [esp + 0x34], eax
call fcn.1002815b
xor ecx, ecx
inc ecx
mov dword [esp + 0x98], ecx
mov dword [esp + 0xb8], 0x7e318b47
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], ebx
jmp 0x1004badd
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1cc], 0xa8f93905
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1004baca
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x1004bb0a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004bb04
push 0x26e2
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
dec dword [esp + 0x14]
jns 0x1004baed
mov dword [esp + 0x2c], 0x10f7
lea ecx, [esp + 0xbc]
mov dword [esp + 0x30], 0x528ace4b
push 4
call fcn.100280d9
mov byte [esp + 0x244], 6
lea ecx, [esp + 0x140]
mov dword [esp + 0x14], 0x53f3ac9d
mov dword [esp + 0x34], 9
push 2
call fcn.100280d9
xor esi, esi
mov dword [esp + 0x38], edi
mov dword [esp + 0x18], ebx
inc esi
cmp dword [esp + 0x18], 4
jge 0x1004bb74
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xbc]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x18]
jmp 0x1004bb59
mov dword [esp + 0x18], ebx
jmp 0x1004bb90
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0x79facd4a
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1004bb7a
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
cmp eax, 0xad94
setl cl
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xbc]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
imul eax, ecx
test eax, eax
je 0x1004bbcd
mov edx, esi
cmp dword [esp + 0x30], ebx
jne 0x1004bbcf
mov edx, ebx
mov eax, dword [esp + 0x34]
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, 0x6d8ff8cd
jne 0x1004bbef
mov eax, dword [esp + 0xbc]
mov ecx, ebx
cmp dword [eax], ebx
je 0x1004bbf1
mov ecx, esi
mov eax, dword [esp + 0x14]
sub ecx, eax
je 0x1004bbfd
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xbc]
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [esp + 0x140]
setne cl
mov dword [eax], ecx
xor eax, eax
cmp ecx, 0x351f2000
lea ecx, [esp + 0x140]
setge al
sub eax, 0x13532fe2
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x38], eax
call fcn.1002815b
lea ecx, [esp + 0xbc]
mov byte [esp + 0x244], 5
call fcn.1002815b
mov dword [esp + 0x18], ebx
jmp 0x1004bc69
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x188]
mov dword [eax + ecx*4], 0x9dfc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1004bc53
push 2
lea ecx, [esp + 0x15c]
call fcn.100280d9
push 2
pop edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
jmp 0x1004bca0
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1004bc8a
xor edx, edx
inc edx
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], ebx
jl 0x1004bd00
mov dword [esp + 0x14], ebx
mov dword [esp + 0x14], ebx
jmp 0x1004bcf4
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004bce0
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
xor edx, edx
inc edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x158]
cmp dword [eax + ecx*4], ebx
jne 0x1004bcfa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jle 0x1004bcbd
dec dword [esp + 0x20]
jns 0x1004bcb3
lea ecx, [esp + 0x158]
call fcn.1002815b
xor ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x14], ebx
jmp 0x1004bd2c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x94], 0xc204e2db
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1004bd19
mov dword [esp + 0x14], ebx
jmp 0x1004bd4a
cmp byte [esp + 0x13], 0
je 0x1004bd46
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
mov byte [esp + 0x13], bl
jle 0x1004bd38
cmp byte [esp + 0x13], 0
je 0x1004bd6e
push ebx
push ebx
push 0xde0
push 0x2503
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov dword [esp + 0x18], ebx
jmp 0x1004bd8a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0x807cfaf4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1004bd74
push dword [esp + 0x94]
movdqa xmm0, xmmword [0x10007b50]
lea eax, [esp + 0x1e4]
push eax
mov dword [esp + 0x24], 0xfcc58a01
lea eax, [esp + 0x1d8]
mov dword [esp + 0x38], 0xe76d238e
lea ecx, [esp + 0xd4]
push eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x24], edi
push ebx
movdqu xmmword [esp + 0x1e0], xmm0
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
call fcn.10029248
cmp dword [esp + 0x1c], 2
jl 0x1004be55
cmp dword [esp + 0x1c], ebx
xor eax, eax
inc eax
mov ecx, 0xf068cd54
add eax, 8
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0xe6fc2e60
sbb edx, edx
inc edx
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
je 0x1004be55
xor ecx, ecx
inc ecx
jmp 0x1004be57
mov ecx, ebx
mov eax, dword [esp + 0x1c]
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
imul edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xcc]
cmp edx, dword [eax + 8]
setg cl
xor edx, edx
inc edx
cmp ecx, edx
jb 0x1004bf35
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x14], ebx
jmp 0x1004bea2
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x220], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1004be93
mov dword [esp + 0x18], 0xfffffffe
jmp 0x1004bec9
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004bec5
push ebx
call dword [sym.imp.USER32.dll_RegisterClassA]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff3
jle 0x1004beb3
mov dword [esp + 0x18], ebx
jmp 0x1004bf2c
cmp dword [esp + 0x18], 9
je 0x1004bed6
mov dword [esp + 0x14], ebx
jmp 0x1004bf4a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x200], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004bf3b
mov dword [esp + 0x24], ebx
jmp 0x1004bf89
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004bf85
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor edx, edx
inc edx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jl 0x1004bf57
mov dword [esp + 0x24], ebx
jmp 0x1004bfa4
cmp dword [esp + 0x24], 0xf
jne 0x1004bf95