Function at 0x100406ab
Capabilities:
Query environment variable
Read .ini file
Resolve function by parsing pe exports
Set environment variable
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006c1e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x250
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x50], ecx
mov esi, edx
lea ecx, [esp + 0x108]
inc edi
mov dword [esp + 0x94], esi
push edi
call fcn.1002a7d6
xor ebx, ebx
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x14], ebx
jmp 0x1004070f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x108]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x100406fc
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x100407bb
mov dword [esp + 0x28], 0x33992443
mov dword [esp + 0x28], ebx
jmp 0x100407ab
mov dword [esp + 0x14], ebx
jmp 0x10040747
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x44], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10040737
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1004075f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [esp + 0x44], ebx
jmp 0x100407a1
mov dword [esp + 0x14], 7
mov dword [esp + 0x2c], 8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x108]
cmp dword [eax + ecx*4], ebx
jne 0x100407a7
mov dword [esp + 0x14], ebx
jmp 0x10040797
mov dword [esp + 0x2c], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1004078b
inc dword [esp + 0x44]
cmp dword [esp + 0x44], ebx
jle 0x10040765
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ebx
jle 0x10040731
dec dword [esp + 0x1c]
jns 0x10040723
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100407d1
push ebx
push 0xab3
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
cmp dword [esp + 0x108], ebx
je 0x100407fc
push dword [esp + 0x108]
call fcn.10054019
pop ecx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0xe4]
push edi
call fcn.1002a7d6
mov dword [esp + 0x264], ebx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x20], 0xb168f92
mov dword [esp + 0x14], 0x27a4129b
push 3
call fcn.1002a7d6
mov dword [esp + 0x10], ebx
jmp 0x10040856
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0x3638
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10040840
mov dword [esp + 0x10], ebx
jmp 0x10040875
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc0]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10040862
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100408a0
push ebx
push ebx
push ebx
push 0x180
push 0x122c
push ebx
push 0x17f3
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov dword [esp + 0x1c], 5
cmp dword [esp + 0x1c], 0xa
jle 0x10040a33
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x28], 0x4ef66b17
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x18], 0xfffffffd
mov dword [esp + 0x20], 0xe3bf118c
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], 0xd900
mov dword [esp + 0x14], ebx
jmp 0x10040910
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1c0], 0xe2718b96
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x100408fd
mov dword [esp + 0x10], ebx
jmp 0x100409bd
mov dword [esp + 0x14], edi
mov dword [esp + 0x14], ebx
jmp 0x1004093c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b8], 0xfffffff8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10040929
inc dword [esp + 0x24]
mov edx, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov dword [esp + 0x1b8], edx
mov esi, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp eax, edx
mov eax, dword [esp + 0x1c]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfec1
setne cl
xor eax, eax
cmp ecx, 0xa205
setg al
imul ecx, eax, 0x83a0
sub ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xe4]
neg ecx
sbb ecx, ecx
inc ecx
mov edx, dword [eax + esi*4]
mov eax, dword [esp + 0x18]
sub edx, ecx
sub edx, eax
xor eax, eax
cmp edx, 0xb705
setl al
mov dword [esp + 0x1c0], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1004091f
mov dword [esp + 0x14], 0x10
jmp 0x10040a16
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x28], ebx
jne 0x10040a1d
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, 0x5f5a
mov eax, dword [esp + 0xc0]
setge cl
mov dword [eax], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1b
jge 0x100409d1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xa
jg 0x100408b3
mov esi, dword [esp + 0x94]
cmp dword [esp + 0xc0], 0
je 0x10040a5f
push dword [esp + 0xc0]
call fcn.10054019
pop ecx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
or dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0xe4], 0
je 0x10040a93
push dword [esp + 0xe4]
call fcn.10054019
pop ecx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov eax, dword [0x11ad1bc0]
test al, 1
jne 0x10040b35
or eax, edi
mov dword [0x11ad1bc0], eax
push ebx
mov dword [esp + 0x268], edi
push ebx
mov dword [0x11ad1b80], ebx
mov dword [0x11ad1b84], ebx
call fcn.10035fc7
mov dword [0x11ad1b80], eax
mov dword [0x11ad1b88], ebx
mov dword [0x11ad1b90], ebx
mov byte [esp + 0x264], 3
mov ecx, 0x11ad1b88
mov dword [esp + 0x18c], eax
lea eax, [esp + 0x18c]
push eax
push 0x10
push ebx
lea eax, [esp + 0x220]
mov dword [0x11ad1b9c], 0x3f800000
push eax
mov dword [0x11ad1b8c], ebx
call fcn.10035d6b
push 0x1006c725
mov dword [0x11ad1b94], 7
mov dword [0x11ad1b98], 8
call fcn.10053e1f
or dword [esp + 0x268], 0xffffffff
pop ecx
imul eax, dword [esp + 0x50], 0x2710
push 4
add eax, esi
mov dword [esp + 0xc0], eax
pop eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ebx
jmp 0x10040b6a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x90], 0x229e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10040b57
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10040b8b
push 0xab8
push 0x1310
call dword [sym.imp.USER32.dll_SetCaretPos]
mov dword [esp + 0x28], 0xfffffff7
jmp 0x10040cb7
push edi
lea ecx, [esp + 0x100]
call fcn.1002a7d6
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x10040bc5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10040bb3
mov eax, dword [esp + 0xfc]
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x90]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xfc]
mov esi, dword [eax]
mov eax, dword [esp + 0x1c]
cmp eax, esi
setl cl
cmp ecx, 0xc3938dd4
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, esi
mov eax, dword [esp + 0x28]
setl cl
xor edx, edx
cmp esi, ecx
setl dl
xor ecx, ecx
add edx, esi
cmp edx, eax
setge cl
cmp ecx, 0xf93bd5de
jne 0x10040c61
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10040c44
push ebx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10040c91
push 0x1d61
push 0x131f
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x10040c91
mov dword [esp + 0x1c], ebx
jmp 0x10040c8a
mov dword [esp + 0x10], ebx
jmp 0x10040c80
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x90], 0xcf5a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10040c6d
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff9
jne 0x10040c67
push dword [esp + 0xfc]
call fcn.10054019
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
inc dword [esp + 0x2c]
pop ecx
cmp dword [esp + 0x28], 8
jg 0x10040b98
lea eax, [esp + 0xbc]
push eax
call fcn.10042ac5
push 2
lea ecx, [esp + 0x124]
mov esi, dword [eax]
call fcn.1002a7d6
mov dword [esp + 0x10], ebx
jmp 0x10040cf7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10040ce5
mov dword [esp + 0x10], ebx
jmp 0x10040d17
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x19c], 0x245f1dbe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10040d04
mov eax, dword [esp + 0x120]
mov dword [eax], 0x1c
mov dword [esp + 0x28], 0x2c0d37ad
mov dword [esp + 0x28], ebx
jmp 0x10040d4b
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x19c], 0x51cdcb36
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jl 0x10040d38
mov eax, dword [esp + 0x120]
dec dword [eax]
cmp dword [eax], 0xffffffef
jge 0x10040d2a
push eax
call fcn.10054019
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
pop ecx
test esi, esi
je 0x10040eb6
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], 0x16488a97
mov dword [esp + 0x2c], 0xd580090a
mov dword [esp + 0x1a0], esi
mov dword [esp + 0x14], ebx
jmp 0x10040db4
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x74], 0x93b4e1a3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10040da4
mov dword [esp + 0x10], ebx
jmp 0x10040e8a
mov dword [esp + 0x20], 0xc2a41b87
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10040de4
push ebx
push edi
push 0x22df
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x74], 4
je 0x10040dfb
mov eax, dword [esp + 0x10]
mov esi, ebx
cmp dword [esp + eax*4 + 0x74], ebx
je 0x10040dfd
mov esi, edi
mov eax, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x74]
cmp ecx, eax
mov eax, dword [esp + 0x7c]
setle dl
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
neg ecx
je 0x10040e29
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
mov eax, dword [esp + eax*4 + 0x74]
sub eax, edx
jne 0x10040e54
mov eax, dword [esp + 0x10]
mov ecx, ebx
cmp dword [esp + eax*4 + 0x74], ebx
je 0x10040e56
mov ecx, edi
xor eax, eax
cmp esi, ecx
setle al
xor edx, edx
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x7c]
setge dl
xor ecx, ecx
imul edx, eax
mov eax, dword [esp + 0x78]
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x10040dc4
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1004257d
push 0x1473
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x1004257d
push 2
pop esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], 0x9729cf30
mov dword [esp + 0x24], 6
mov dword [esp + 0x14], ebx
jmp 0x10040ee6
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x200], 0x3735b263
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10040ed3
mov dword [esp + 0x20], 0x14ee
cmp dword [esp + 0x20], 0xd3c
jge 0x10041142
mov dword [esp + 0xb8], 0xf
mov dword [esp + 0xb4], ebx
mov byte [esp + 0xa4], bl
push 0x10007775
lea ecx, [esp + 0x1cc]
mov dword [esp + 0x268], 4
call fcn.10029fbe
lea eax, [esp + 0x54]
mov byte [esp + 0x264], 5
mov esi, 0x1065cd10
push eax
mov ecx, esi
call fcn.1002a06b
mov edi, dword [esp + 0x54]
jmp 0x1004110b
lea eax, [esp + 0x1bc]
dec edi
push eax
push ecx
lea eax, [esp + 0x210]
mov dword [esp + 0x1c], edi
push eax
mov ecx, esi
call fcn.1002a06b
pop ecx
mov ecx, eax
call fcn.1002a06b
push 0xffffffffffffffff
push ecx
push ecx
call fcn.100426eb
mov eax, dword [0x1065cd10]
push 0xa
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.1002ce9e
movzx eax, al
lea edx, [esp + 0xa4]
push eax
mov ecx, esi
call fcn.10030243
cmp dword [esp + 0x1e0], 0x10
lea eax, [esp + 0x1cc]
mov edi, dword [esp + 0x1c0]
cmovae eax, dword [esp + 0x1cc]
mov dword [esp + 0x1dc], ebx
pop ecx
mov dword [esp + 0x20], ebx
mov byte [eax], bl
cmp dword [esp + 0xb8], 0x10
lea eax, [esp + 0xa4]
cmovae eax, dword [esp + 0xa4]
cmp byte [eax + ebx], 0x20
jne 0x10040ffa
push 0x20
jmp 0x100410c8
cmp dword [esp + 0xb8], 0x10
lea eax, [esp + 0xa4]
cmovae eax, dword [esp + 0xa4]
movsx eax, byte [eax + ebx]
push eax
call fcn.10054c78
mov byte [esp + 0x44], al
lea eax, [esp + 0x44]
push ecx
push eax
call fcn.10042c30
cmp dword [esp + 0xb8], 0x10
lea ecx, [esp + 0xa4]
mov dword [esp + 0x2c], eax
lea esi, [esp + 0xa4]
cmovae ecx, dword [esp + 0xa4]
cmovae esi, dword [esp + 0xa4]
movsx eax, byte [ecx + ebx]
push eax
call fcn.10054c78
pop ecx
movsx ecx, byte [esi + ebx]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
mov ecx, 0x10071674
jne 0x1004109d
cmp dword [0x10071688], 0x10
cmovae ecx, dword [0x10071674]
add eax, edi
xor edx, edx
div dword [0x10071684]
movsx eax, byte [edx + ecx]
push eax
call fcn.10054e19
pop ecx
mov byte [esp + 0x54], al
push dword [esp + 0x54]
jmp 0x100410c8
cmp dword [0x10071688], 0x10
cmovae ecx, dword [0x10071674]
add eax, edi
xor edx, edx
div dword [0x10071684]
movsx eax, byte [edx + ecx]
push eax
call fcn.10054c78
pop ecx
mov byte [esp + 0x18], al
push dword [esp + 0x18]
push 1
lea ecx, [esp + 0x1d0]
call fcn.1002b072
mov eax, dword [esp + 0xb4]
inc ebx
dec eax
cmp ebx, eax
jbe 0x10040fd6
lea edx, [esp + 0x1c8]
mov ecx, 0x1065cc58
call fcn.1002f555
push eax
call fcn.1002f1f4
mov edi, dword [esp + 0x18]
mov esi, 0x1065cd10
pop ecx
push 0
pop ebx
test edi, edi
jne 0x10040f59
dec edi
lea ecx, [esp + 0x1c8]
mov dword [esp + 0x54], edi
xor edi, edi
push ebx
inc edi
push edi
call fcn.1002b22e
or dword [esp + 0x264], 0xffffffff
lea ecx, [esp + 0xa4]
push ebx
push edi
call fcn.1002b22e
push 2
pop esi
mov dword [esp + 0x28], ebx
jmp 0x10041243
mov dword [esp + 0x14], 0xfffffffb
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x20], 0x51af7f3
mov dword [esp + 0x20], esi
mov dword [esp + 0x20], 0x589fe57f
mov dword [esp + 0x20], 0xbc43
mov dword [esp + 0x1e0], edi
mov dword [esp + 0x1e4], edi
mov dword [esp + 0x1e8], edi
mov dword [esp + 0x1ec], edi
mov dword [esp + 0x14], ebx
jmp 0x100411a8
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x23c], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10041199
mov dword [esp + 0x14], 0xa
jmp 0x10041234
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x20], 0xe790e864
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0x668451f1
mov dword [esp + 0x10], ebx
jmp 0x100411f2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1fc], 0x8ef6b8f3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100411df
mov dword [esp + 0x10], ebx
jmp 0x10041211
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x210], 0x8cac31e1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100411fe
inc dword [esp + 0x1e8]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10041230
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x18
jl 0x100411b9
inc dword [esp + 0x28]
cmp dword [esp + 0x28], esi
jl 0x1004114b
mov eax, dword [esp + 0x24]
mov dword [esp + 0x200], eax
mov dword [esp + 0x24], eax
mov eax, dword [0x11ad1bc0]
test al, 2
jne 0x10041302
or eax, esi
mov dword [0x11ad1bc0], eax
push ebx
mov dword [esp + 0x268], 6
push ebx
mov dword [0x11ad1ba0], ebx
mov dword [0x11ad1ba4], ebx
call fcn.10035fc7
mov dword [0x11ad1ba0], eax
mov dword [0x11ad1ba8], ebx
mov dword [0x11ad1bb0], ebx
mov byte [esp + 0x264], 8
mov ecx, 0x11ad1ba8
mov dword [esp + 0x17c], eax
lea eax, [esp + 0x17c]
push eax
push 0x10
push ebx
lea eax, [esp + 0x224]
mov dword [0x11ad1bbc], 0x3f800000
push eax
mov dword [0x11ad1bac], ebx
call fcn.10035d6b
push 0x1006c720
mov dword [0x11ad1bb4], 7
mov dword [0x11ad1bb8], 8
call fcn.10053e1f
or dword [esp + 0x268], 0xffffffff
pop ecx
push edi
lea ecx, [esp + 0xd0]
call fcn.1002a7d6
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x10041333
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 0x2062
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004131d
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x100413e1
mov dword [esp + 0x24], 4
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jl 0x100413d7
mov dword [esp + 0x14], 0x67e307b
mov dword [esp + 0x14], ebx
jmp 0x100413cb
mov dword [esp + 0x28], 8
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1004138f
push 0x48
push ebx
push 0x236c
push 0x218e
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esp + 0x28], ebx
jmp 0x100413c1
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xcc]
cmp dword [eax + ecx*4], ebx
jne 0x100413c7
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100413bd
push 0x1874
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ebx
jle 0x10041395
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x10041367
dec dword [esp + 0x24]
jns 0x10041359
dec dword [esp + 0x18]
jns 0x10041347
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100413f7
push 0x1dfa
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [esp + 0xcc], 0
je 0x10041423
push dword [esp + 0xcc]
call fcn.10054019
pop ecx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
xorps xmm0, xmm0
lea ecx, [esp + 0xd8]
push edi
movdqu xmmword [esp + 0x160], xmm0
call fcn.1002a7d6
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x14], ebx
jmp 0x1004145c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004144a
mov dword [esp + 0x1c], ebx
jmp 0x1004148d
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x1c]
mov esi, dword [esp + 0xd8]
mov eax, dword [esi + eax*4]
cmp eax, dword [esi + edx*4]
setge cl
mov dword [esi + edi*4], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jle 0x10041468
cmp dword [esp + 0xd8], 0
je 0x100414bf
push dword [esp + 0xd8]
call fcn.10054019
pop ecx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
lea eax, [esp + 0x50]
push eax
call fcn.10042b27
xor esi, esi
inc esi
mov edi, dword [eax]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x14], edi
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], 4
jg 0x100414ff
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
inc dword [esp + 0x28]
jmp 0x100414de
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10041549
push 0x1973
push 0x1dc4
push ebx
push ebx
push 0xac8
push 0x3cb
push 0x246b
push 0x1652
push 0x1f27
push 0x1346
push 0x256f
push 0x151e
push 0x1abd
call dword [sym.imp.GDI32.dll_StretchDIBits]
cmp byte [ebp + 0xc], 0
jne 0x10041557
test edi, edi
jne 0x10041b99
mov dword [esp + 0x28], 0xfff8
lea ecx, [esp + 0x138]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x2c], ebx
push 4
call fcn.1002a7d6
mov dword [esp + 0x264], 9
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0xfffffffb
mov dword [esp + 0x2c], 0x5653649d
push esi
call fcn.1002a7d6
mov dword [esp + 0x10], ebx
jmp 0x100415c9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0x77fc7df3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100415b3
mov dword [esp + 0x10], ebx
jmp 0x100415ec
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1ac]
mov dword [eax + ecx*4], 0xc3d8d58
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x100415d6
cmp dword [esp + 0x28], ebx
je 0x10041616
mov dword [esp + 0x20], 0x7df2f4a8
mov dword [esp + 0x20], 0xfffffff8
dec dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
jmp 0x1004167e
mov dword [esp + 0x24], 0xd4a55f07
mov dword [esp + 0x1c], 7
mov dword [esp + 0x2c], 0x4b5e4957
mov dword [esp + 0x20], 0x60de5741
mov eax, dword [esp + 0x28]
add eax, 0x31694887
jne 0x10041668
mov ecx, ebx
cmp dword [esp + 0x1c], ebx
je 0x1004164b
mov ecx, esi
mov eax, dword [esp + 0x18]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ecx
jne 0x10041668
mov eax, ebx
cmp dword [esp + 0x24], ebx
je 0x1004166a
mov eax, esi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0xa1172167
xor edx, edx
mov dword [esp + 0x2c], esi
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
add ecx, eax
mov eax, dword [esp + 0x138]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x28]
add eax, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
imul ecx, dword [esp + 0x28], 0x2a6a
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setg dl
sub edx, 0xa971
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
sub eax, 0x921b
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp ecx, eax
mov eax, dword [esp + 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [esp + 0x1ac]
push eax
setle dl
mov dword [eax], edx
call fcn.10054019
or dword [esp + 0x268], 0xffffffff
pop ecx
push dword [esp + 0x138]
mov dword [esp + 0x1b0], ebx
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x1b8], ebx
call fcn.10054019
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x24c]
pop ecx
mov ecx, dword [esp + 0x50]
push eax
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ebx
call fcn.1003689f
mov esi, eax
lea edi, [esp + 0x160]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x24], 0x96dd1e1e
xor edi, edi
mov dword [esp + 0x2c], 0x801f
inc edi
mov dword [esp + 0x18], ebx
jmp 0x100417a3
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x20c], 0xffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10041790
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jl 0x100417d4
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100417ce
push ebx
push 0x2c2
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
dec dword [esp + 0x24]
jns 0x100417b3
inc dword [esp + 0x2c]
cmp byte [ebp + 0xc], 0
je 0x10041b95
cmp dword [esp + 0x164], 0
je 0x10041b95
mov dword [esp + 0x10], 0xfd3df75d
mov dword [esp + 0x1c], 0x3cfcb8f
mov dword [esp + 0x18], ebx
jmp 0x10041816
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x30], 0xe7bf1993
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10041806
mov dword [esp + 0x10], 0x10
jmp 0x10041a7a
push 3
lea ecx, [esp + 0x9c]
call fcn.1002a7d6
mov dword [esp + 0x2c], 0xb5cec816
mov dword [esp + 0x18], ebx
jmp 0x10041858
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x98]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10041845
mov esi, dword [esp + 0x98]
cmp dword [esi + 8], ebx
je 0x1004187a
cmp dword [esi + 4], ebx
jne 0x10041876
cmp dword [esp + 0x10], ebx
je 0x1004187a
mov edx, edi
jmp 0x1004187c
mov edx, ebx
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10041894
mov eax, dword [esp + 0x98]
cmp dword [eax + 4], ebx
mov eax, edi
jne 0x10041896
mov eax, ebx
cmp eax, dword [esi + 8]
je 0x100418a3
cmp dword [esi + 8], 0
mov eax, ebx
je 0x100418a5
mov eax, edi
mov dword [esp + 0x30], eax
xor ecx, ecx
mov eax, dword [esp + 0x30]
cmp edx, eax
mov eax, 0xbed85728
setle cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, dword [esp + 0x10]
jg 0x100418cc
mov eax, edi
cmp dword [esi + 8], ebx
jne 0x100418ce
mov eax, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x10041a54
mov dword [esp + 0x2c], 0xf4a3ca5a
mov dword [esp + 0x2c], 0xefa766e9
mov dword [esp + 0x18], ebx
jmp 0x1004190a
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x58], 0xe01e6e83
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x100418fa
mov dword [esp + 0x58], ebx
jmp 0x10041a28
mov eax, dword [esp + 0x58]
cmp dword [esp + eax*4 + 0x30], ebx
jne 0x10041982
mov eax, dword [esp + 0x58]
mov eax, dword [esp + eax*4 + 0x30]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 4
mov ecx, dword [esp + 0x1c]
sbb eax, eax
inc eax
sub ecx, eax
add ecx, dword [esp + 0x30]
je 0x1004194b
mov ecx, edi
cmp dword [esi + 8], ebx
jne 0x1004194d
mov ecx, ebx
mov eax, dword [esp + 0x1c]
sub ecx, eax
mov eax, dword [esp + 0x60]
sub ecx, 0x8743
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xabdb
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x10]
jg 0x10041982
mov eax, ebx
cmp dword [esp + 0x30], ebx
je 0x10041984
mov eax, edi
mov dword [esp + 0x2c], eax
xor edx, edx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + eax*4 + 0x30]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setne dl
mov dword [esp + 0x2c], edx
xor edx, edx
mov eax, dword [esp + 0x58]
mov ecx, dword [esp + eax*4 + 0x30]
mov eax, dword [esp + 0x2c]
cmp eax, 0xfffffffe
mov eax, dword [esp + 0x98]
setne dl
sub edx, ecx
imul edx, dword [eax]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + eax*4 + 0x30]
sub edx, eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x20], edx
mov edx, dword [esi + 8]
mov ecx, dword [esp + eax*4 + 0x30]
add ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, edx
setne al
cmp eax, edx
jle 0x100419fd
mov eax, ebx
cmp dword [esp + 0x30], ebx
je 0x100419ff
mov eax, edi
xor ecx, ecx
cmp eax, 0x5249
mov eax, dword [esp + 0x58]
sete cl
mov dword [esp + eax*4 + 0x30], ecx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10041a24
push ebx
push ebx
call dword [sym.imp.GDI32.dll_RectInRegion]
inc dword [esp + 0x58]
cmp dword [esp + 0x58], ebx
jle 0x1004191a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10041a4a
push 0x24ef
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec dword [esp + 0x1c]
jns 0x100418e4
push dword [esp + 0x98]
call fcn.10054019
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
inc dword [esp + 0x14]
pop ecx
cmp dword [esp + 0x10], 0x12
jle 0x10041829
mov eax, dword [esp + 0x168]
mov dword [esp + 0x20], 0x1559
cmp dword [esp + 0x20], 0x1208
mov dword [esp + 0x1a4], eax
jge 0x10041b87
lea eax, [esp + 0x16c]
push eax
lea eax, [esp + 0x74]
push eax
push 0x10007864
call fcn.100539eb
add esp, 0xc
lea ecx, [esp + 0x170]
push dword [esp + 0x70]
call fcn.1002a7d6
mov esi, dword [esp + 0x70]
mov edi, dword [esp + 0x170]
mov dword [esp + 0x20], ebx
test esi, esi
jle 0x10041b0e
mov ebx, edi
mov edi, dword [esp + 0x20]
push ebx
push 0x1000780c
call fcn.100539eb
mov esi, dword [esp + 0x78]
inc edi
pop ecx
add ebx, 4
pop ecx
cmp edi, esi
jl 0x10041aec
mov edi, dword [esp + 0x170]
xor ebx, ebx
xor ecx, ecx
push 2
inc ecx
pop eax
mov dword [esp + 0x24], eax
cmp esi, ecx
jle 0x10041b5a
mov eax, dword [esp + 0x16c]
mov ebx, ecx
add eax, eax
mov dword [esp + 0x2c], eax
jmp 0x10041b31
mov eax, dword [esp + 0x2c]
mov ecx, dword [edi + ebx*4]
xor edx, edx
sub ecx, dword [edi + ebx*4 - 4]
cmp ecx, eax
setg dl
xor eax, eax
cmp ecx, dword [esp + 0x2c]
sete al
add eax, dword [esp + 0x24]
inc ebx
lea eax, [eax + edx*2]
mov dword [esp + 0x24], eax
cmp ebx, esi
jl 0x10041b2d
xor ebx, ebx
push eax
push 0x100078b4
call fcn.10053e49
pop ecx
pop ecx
test edi, edi
je 0x10041b87
push edi
call fcn.10054019
pop ecx
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x178], ebx
mov eax, dword [esp + 0x164]
mov dword [esp + 0x1a8], eax
mov edi, dword [esp + 0x14]
xor esi, esi
lea ecx, [esp + 0x180]
inc esi
push esi
call fcn.1002a7d6
mov dword [esp + 0x264], 0xa
lea ecx, [esp + 0x144]
mov dword [esp + 0x20], esi
mov dword [esp + 0x20], 6
push 3
call fcn.1002a7d6
mov dword [esp + 0x10], ebx
jmp 0x10041bea
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xf6af1124
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10041bd4
mov dword [esp + 0x10], ebx
jmp 0x10041c0c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0x1e5de2ca
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10041bf6
cmp dword [esp + 0x144], 0
mov esi, dword [esp + 0x180]
mov dword [esi], 0xe
je 0x10041c4c
push dword [esp + 0x144]
call fcn.10054019
pop ecx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], ebx
or dword [esp + 0x264], 0xffffffff
push esi
call fcn.10054019
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], ebx
mov dword [esp + 0x18c], ebx
pop ecx
test edi, edi
jne 0x10041f71
cmp dword [esp + 0x15c], edi
jle 0x10041f71
push 3
lea ecx, [esp + 0x118]
call fcn.1002a7d6
mov dword [esp + 0x2c], 0x1160
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x18], ebx
jmp 0x10041cbc
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x114]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10041ca9
mov esi, dword [esp + 0x114]
mov eax, dword [esi + 8]
inc eax
imul eax, dword [esi]
test eax, eax
je 0x10041cdf
cmp dword [esi], 0
je 0x10041cdf
xor ecx, ecx
inc ecx
jmp 0x10041ce1
mov ecx, ebx
xor eax, eax
cmp ecx, dword [esi]
setle al
xor ecx, ecx
add eax, 0x289fff12
cmp eax, dword [esi + 4]
mov eax, dword [esp + 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
setg dl
sub edx, 0x4dc9
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x114]
imul ecx, dword [eax]
mov dword [esi + 4], ecx
mov dword [esp + 0x1c], 0xffffffe4
jmp 0x10041d44
mov dword [esp + 0x20], 5
cmp dword [esp + 0x20], ebx
jne 0x10041d4b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jg 0x10041d32
push dword [esp + 0x114]
call fcn.10054019
pop ecx
push 2
lea ecx, [esp + 0x194]
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
call fcn.1002a7d6
push 3
lea ecx, [esp + 0x130]
mov dword [esp + 0x268], 0xc
call fcn.1002a7d6
mov dword [esp + 0x10], ebx
jmp 0x10041db0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0x13dd33a4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10041d9a
mov dword [esp + 0x10], ebx
jmp 0x10041dd3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10041dbd
cmp dword [esp + 0x12c], 0
mov esi, dword [esp + 0x190]
mov dword [esi + 4], 1
je 0x10041e14
push dword [esp + 0x12c]
call fcn.10054019
pop ecx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x134], ebx
or dword [esp + 0x264], 0xffffffff
push esi
call fcn.10054019
cmp dword [esp + 0x164], 0
pop ecx
mov dword [esp + 0x190], ebx
mov dword [esp + 0x194], ebx
mov dword [esp + 0x198], ebx
je 0x10041f71
mov dword [esp + 0x10], 0x60477862
lea ecx, [esp + 0x150]
push 1
call fcn.1002a7d6
mov dword [esp + 0x2c], 0xfffffff9
mov dword [esp + 0x20], 0xc8f0d071
mov dword [esp + 0x18], ebx
jmp 0x10041e88
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0x2039
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10041e72
mov dword [esp + 0x10], ebx
jmp 0x10041ed8
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jl 0x10041ed4
mov dword [esp + 0x20], 0xed9a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10041ec8
push ebx
push 1
push 0x22df
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp dword [esp + 0x20], ebx
jne 0x10041ed4
dec dword [esp + 0x24]
jns 0x10041ea7
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffeb
jl 0x10041e95
mov dword [esp + 0x10], ebx
jmp 0x10041f20
mov dword [esp + 0x18], 7
mov dword [esp + 0x18], 0x13
jmp 0x10041f03
cmp dword [esp + 0x10], 0xfffffffe
jl 0x10041ee5
cmp dword [esp + 0x150], 0
je 0x10041f53
mov dword [esp + 0x2c], 0xffffffff
push 2
mov dword [esp + 0x24], 0xc0faab39
mov dword [esp + 0x1c], ebx
pop esi
jmp 0x10041f9a
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x48], 0xfffffffd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10041f8a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10041fc1
push 0x1b29
push ebx
push 0x1cab
push 0xbbe
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
mov eax, dword [esp + 0x48]
xor ecx, ecx
mov eax, dword [esp + 0x48]
cmp eax, 1
setge cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x48], ebx
jne 0x10041ff7
mov eax, ebx
jmp 0x10041ffa
xor eax, eax
inc eax
lea ecx, [esp + 0x15c]
mov dword [esp + 0x20], eax
call fcn.1003cc00
test edi, edi
je 0x100424fe
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x1c], 0xe6e836ea
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x10042047
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x80], 0x5f394a2a
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10042034
cmp dword [esp + 0x88], ebx
jne 0x100420bc
mov eax, dword [esp + 0x84]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x88]
neg edx
sbb edx, edx
add edx, 0x3f684377
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x80]
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x8c]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x1c]
je 0x100424cd
mov dword [esp + 0x2c], esi
lea ecx, [esp + 0xf0]
mov dword [esp + 0x28], 0x8227fd5d
push 3
call fcn.1002a7d6
mov dword [esp + 0x264], 0xd
mov dword [esp + 0x20], 0x1f1d
cmp dword [esp + 0x20], 0xd85
jge 0x10042341
lea eax, [esp + 0x3c]
push eax
push 0x1000780c
call fcn.100539eb
mov eax, dword [esp + 0x44]
or dword [esp + 0x1cc], 0xffffffff
inc eax
pop ecx
pop ecx
lea ecx, [esp + 0x1c4]
mov dword [esp + 0x64], ebx
push ecx
push eax
lea ecx, [esp + 0x6c]
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
call fcn.1002b3d6
mov byte [esp + 0x264], 0xe
cmp dword [esp + 0x3c], 0
mov edi, dword [esp + 0x64]
mov dword [esp + 0x20], ebx
jle 0x1004217a
mov esi, edi
push esi
push 0x1000780c
call fcn.100539eb
inc ebx
add esi, 4
pop ecx
pop ecx
cmp ebx, dword [esp + 0x3c]
jl 0x10042161
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ebx
call fcn.1002f118
mov dword [esp + 0x34], eax
mov byte [esp + 0x264], 0xf
mov esi, dword [esp + 0x3c]
mov dword [esp + 0x20], ebx
lea eax, [esi - 1]
mov dword [esp + 0x28], eax
test esi, esi
js 0x100421e5
push edi
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], ebx
call fcn.10042bb2
test eax, eax
jne 0x100421e3
movzx eax, byte [0x11ad1acd]
push eax
push edi
push ecx
lea eax, [esp + 0x230]
push eax
lea ecx, [esp + 0x44]
call fcn.1002fb42
mov esi, dword [esp + 0x3c]
inc ebx
add edi, 4
cmp ebx, esi
jle 0x100421aa
xor ebx, ebx
mov ecx, dword [esp + 0x18]
lea edi, [esi - 1]
cmp edi, ecx
jl 0x10042238
mov eax, dword [esp + 0x64]
mov ebx, ecx
lea esi, [eax + edi*4]
push esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x2c], edi
call fcn.10042bb2
test eax, eax
jne 0x1004222e
movzx eax, byte [0x11ad1acd]
push eax
push esi
push ecx
lea eax, [esp + 0x228]
push eax
lea ecx, [esp + 0x44]
call fcn.1002fb42
dec edi
sub esi, 4
cmp edi, ebx
jge 0x100421f9
mov esi, dword [esp + 0x3c]
xor ebx, ebx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
sub eax, ecx
mov dword [esp + 0x18], ebx
inc eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x28], eax
dec esi
mov eax, dword [esp + 0x34]
push dword [eax + 4]
call fcn.1002e916
mov eax, dword [esp + 0x34]
mov edi, dword [esp + 0x64]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x34]
mov dword [eax], eax
mov eax, dword [esp + 0x34]
mov dword [eax + 8], eax
mov eax, dword [esp + 0x3c]
dec eax
mov dword [esp + 0x38], ebx
js 0x100422b9
mov ebx, eax
lea eax, [edi + ebx*4]
mov edi, eax
push edi
lea ecx, [esp + 0x38]
mov esi, ebx
call fcn.10042bb2
test eax, eax
jne 0x100422b3
movzx eax, byte [0x11ad1acd]
push eax
push edi
push ecx
lea eax, [esp + 0x240]
push eax
lea ecx, [esp + 0x44]
call fcn.1002fb42
sub edi, 4
dec ebx
jns 0x10042282
mov edi, dword [esp + 0x64]
xor ebx, ebx
mov dword [esp + 0x20], ebx
test esi, esi
js 0x10042302
mov ebx, edi
mov edi, dword [esp + 0x20]
push ebx
lea ecx, [esp + 0x38]
mov dword [esp + 0x1c], edi
call fcn.10042bb2
test eax, eax
jne 0x100422fc
movzx eax, byte [0x11ad1acd]
push eax
push ebx
push ecx
lea eax, [esp + 0x238]
push eax
lea ecx, [esp + 0x44]
call fcn.1002fb42
inc edi
add ebx, 4
cmp edi, esi
jle 0x100422c7
mov edi, dword [esp + 0x64]
xor ebx, ebx
sub esi, dword [esp + 0x18]
inc esi
cmp dword [esp + 0x28], esi
cmovl esi, dword [esp + 0x28]
push esi
push 0x100078b4
call fcn.10053e49
pop ecx
pop ecx
lea ecx, [esp + 0x34]
call fcn.10042b89
test edi, edi
je 0x1004233d
push edi
call fcn.10054019
pop ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
mov edi, dword [esp + 0x14]
mov dword [esp + 0x18], ebx
jmp 0x1004235d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xf0]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10042347
mov dword [esp + 0x10], ebx
jmp 0x10042432
mov dword [esp + 0x20], 5
mov dword [esp + 0x1c], ebx
jmp 0x1004240b
mov dword [esp + 0x18], 1
mov ecx, 0xa05008d6
mov dword [esp + 0x18], 0xe9c7d4e7
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
sub ecx, eax
je 0x100423ae
cmp dword [esp + 0x20], ebx
je 0x100423ae
xor edx, edx
inc edx
jmp 0x100423b0
mov edx, ebx
mov dword [esp + 0x18], 0xfffffffc
xor ecx, ecx
mov eax, dword [esp + 0x18]
cmp eax, edx
mov eax, dword [esp + 0x10]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setne dl
add edx, dword [esp + eax*4 + 0x80]
xor eax, eax
add edx, dword [esp + 0x2c]
cmp edx, 0xfffffff9
setge al
xor edx, edx
imul eax, eax, 5
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 1
setge al
mov dword [esp + 0x28], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x1004237e
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1004242e
push 0x6d
push 0x12f8
call dword [sym.imp.GDI32.dll_SetROP2]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x1004236d
mov dword [esp + 0x28], 0xd
cmp dword [esp + 0x28], 0xfffffff6
je 0x10042497
mov esi, dword [esp + 0xf0]
xor ecx, ecx
mov dword [esp + 0x20], 0x70e9afb8
mov eax, dword [esp + 0x1c]
cmp eax, 1
mov eax, dword [esp + 0x20]
setl cl
xor edx, edx
cmp ecx, 1
setle dl
xor ecx, ecx
sub edx, 0x1eb66491
cmp edx, eax
setl cl
xor eax, eax
cmp dword [esi + 4], ecx
setl al
mov dword [esp + 0x10], eax
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xfffffff6
jne 0x10042453
or dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0xf0], 0
je 0x100424d5
push dword [esp + 0xf0]
call fcn.10054019
pop ecx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
jmp 0x100424d5
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x94]
mov ecx, edi
call fcn.100406a1
mov esi, eax
lea eax, [esp + 0xbc]
push eax
mov dword [esp + 0x1a4], esi
call fcn.10042ac5
push 2
mov dword [eax], esi
pop esi
push esi
lea ecx, [esp + 0x1f4]
call fcn.1002a7d6
mov dword [esp + 0x24], 0x490c4d8e
mov dword [esp + 0x24], ebx
jmp 0x1004252f
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1f0]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x10042519
mov dword [esp + 0x24], 1
cmp dword [esp + 0x24], ebx
jl 0x10042566
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10042560
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
dec dword [esp + 0x24]
jns 0x10042543
cmp dword [esp + 0x1f0], 0
je 0x1004257d
push dword [esp + 0x1f0]
call fcn.10054019
pop ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0x1a0]
mov ecx, dword [esp + 0x25c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret