Function at 0x1005a984
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10147c1b
call fcn.1014399c
sub esp, 0x124
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x50], ecx
push edi
inc eax
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x30], 0xffffffff
lea ecx, [ebp - 0xe8]
mov dword [ebp - 0x30], 2
push eax
call fcn.100141a5
xor ebx, ebx
mov dword [ebp - 0x28], 0x283bc1b0
push 3
mov dword [ebp - 0x10], ebx
pop esi
jmp 0x1005a9dc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x110], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1005a9cf
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x1005a9f8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1005a9e9
push 2
mov dword [ebp - 0x18], ebx
pop ecx
jmp 0x1005aa59
mov dword [ebp - 0x10], 0xfd4914d2
mov dword [ebp - 0x10], ebx
jmp 0x1005aa22
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x110], 0xc7555b7c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1005aa11
mov dword [ebp - 0x10], ebx
jmp 0x1005aa51
mov dword [ebp - 0x14], 0x14173bf3
mov dword [ebp - 0x14], ebx
jmp 0x1005aa49
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x110], 0x8872fa4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1005aa38
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1005aa2c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x1005aa05
inc dword [ebp - 0x28]
cmp dword [ebp - 0xe8], ebx
je 0x1005aa8a
push dword [ebp - 0xe8]
call fcn.10123626
xor edx, edx
mov dword [ebp - 0xe8], ebx
pop ecx
mov dword [ebp - 0xe4], ebx
inc edx
mov dword [ebp - 0xe0], ebx
push 8
pop edi
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1005aaaf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x38], 0x4a8c6a53
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1005aaa1
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], ebx
jl 0x1005ab0b
mov dword [ebp - 0x20], 0xbe92e3f9
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x38], ebx
je 0x1005aad3
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x44], edx
jne 0x1005ab01
mov eax, dword [ebp - 0x44]
cmp dword [ebp + eax*4 - 0x38], ebx
mov eax, edx
jne 0x1005ab03
mov eax, ebx
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x44]
jns 0x1005aabc
mov dword [ebp - 0x18], 0xfffffff1
jmp 0x1005ab38
mov dword [ebp - 0x28], 0xbb000e2e
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x3c], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jg 0x1005ab14
mov edi, dword [0x10193f3c]
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x18], 0x42eb90da
push 4
mov dword [ebp - 0x2c], edi
call fcn.100141a5
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x11c]
push dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x4c], 0xa7221ebc
push eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x64], ebx
push eax
push ebx
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x60], ebx
movdqu xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x5c], ebx
call fcn.10015178
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov dword [ebp - 0x24], 0x7736
mov dword [ebp - 0x14], ebx
jmp 0x1005abad
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1005aba1
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffffb
jg 0x1005ad7f
mov edi, dword [ebp - 0x64]
jmp 0x1005abc8
push 3
pop esi
push esi
lea ecx, [ebp - 0x94]
call fcn.100141a5
push 4
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 2
call fcn.100141a5
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], ebx
jmp 0x1005ac00
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x94]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1005abed
mov dword [ebp - 0x10], ebx
jmp 0x1005ac1a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0x5261fc42
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1005ac0a
mov esi, dword [ebp - 0x94]
mov dword [esi + 4], 0x18
mov dword [ebp - 0x14], 0x8cccddd1
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jg 0x1005acc6
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x10], 0xd68f985
mov dword [ebp - 0x58], 5
mov dword [ebp - 0x20], 0x79d44f4c
mov ecx, dword [eax]
mov eax, dword [ebp - 0x7c]
push 0
mov dword [eax], ecx
xor ecx, ecx
mov dword [ebp - 0x10], ebx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
cmp eax, 0x97b0
mov eax, dword [ebp - 0x70]
setg cl
cmp dword [eax + edx*4], ecx
mov eax, dword [ebp - 0x10]
pop edx
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, 0x84b7
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1005ac44
xor ebx, ebx
dec dword [esi + 4]
cmp dword [esi + 4], 9
jge 0x1005ac2d
mov eax, dword [ebp - 0x18]
xor ecx, ecx
imul eax, dword [ebp - 0x28], 0xfffffff6
cmp eax, dword [edi + 0xc]
mov eax, dword [ebp - 0x7c]
setge cl
xor edx, edx
cmp ecx, dword [eax]
setge dl
sub edx, 0xe82b
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 5
setl al
cmp eax, 0xe3c2
jge 0x1005ad0e
mov eax, dword [ebp - 0x64]
cmp dword [eax + 4], ebx
je 0x1005ad1a
cmp dword [esi + 4], ebx
je 0x1005ad1a
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1005ad1c
mov ecx, ebx
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x24]
cmp eax, ecx
jge 0x1005ad2c
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x7c]
push eax
mov dword [eax], 0x6f576105
call fcn.10123626
xor eax, eax
mov dword [ebp - 0x7c], ebx
inc eax
mov dword [ebp - 0x78], ebx
mov byte [ebp - 4], al
push dword [ebp - 0x94]
mov dword [ebp - 0x74], ebx
call fcn.10123626
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffffb
pop ecx
pop ecx
jle 0x1005abc5
mov edi, dword [ebp - 0x2c]
cmp dword [ebp - 0x64], 0
je 0x1005ad97
push dword [ebp - 0x64]
call fcn.10123626
pop ecx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x70], 0
je 0x1005adb3
push dword [ebp - 0x70]
call fcn.10123626
pop ecx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x10], 0x3248c66
mov dword [ebp - 0x20], 0xba6b42be
mov dword [ebp - 0x20], 0x551fa4c8
push 4
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call fcn.100141a5
mov dword [ebp - 0x20], 0x91c84132
mov dword [ebp - 0x20], 0x72d50fa8
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x30], 0x914a
mov dword [ebp - 0x14], ebx
jmp 0x1005ae17
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 0x5bb08661
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1005ae04
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
inc ecx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], edx
xor edx, edx
cmp dword [ebp - 0x2c], 0x2717
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov edx, 0x1215
setge cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, edx
mov esi, dword [ebp - 0xc4]
setl cl
add ecx, dword [ebp - 0x10]
mov dword [esi + 8], edx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 3
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, 0xffffffff
setg cl
cmp ecx, edx
je 0x1005aea9
cmp dword [esi + 8], ebx
jne 0x1005aea9
mov eax, ebx
jmp 0x1005aeac
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1005aec4
call dword [sym.imp.USER32.dll_WaitMessage]
push dword [ebp - 0xc4]
call fcn.10123626
mov esi, dword [ebp - 0x50]
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
pop ecx
cmp esi, edi
jge 0x1005b693
push 2
lea ecx, [ebp - 0x88]
call fcn.100141a5
mov dword [ebp - 4], 3
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 2
jge 0x1005af29
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x88]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1005af14
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jl 0x1005b06d
push eax
lea ecx, [ebp - 0xf4]
call fcn.100141a5
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1005af5b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1005af4c
mov eax, dword [ebp - 0xf4]
mov dword [eax], ebx
mov dword [ebp - 0x24], 0xffffffff
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1005af89
push ebx
push ebx
push 0x1cd2
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
xor edx, edx
inc edx
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], ebx
jl 0x1005b038
mov dword [ebp - 0x18], 0x5f0ed1ad
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1005b009
mov dword [ebp - 0x14], 0x498e64e6
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1005afd0
push 0x1ef3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edx, edx
inc edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x1005b004
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1005afee
push ebx
push 0x7fa
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x88]
cmp dword [eax + ecx*4], ebx
jne 0x1005b001
dec dword [ebp - 0x14]
jns 0x1005afd8
xor edx, edx
inc edx
dec dword [ebp - 0x18]
jns 0x1005afa4
mov dword [ebp - 0x18], ebx
jmp 0x1005b02a
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1005b027
push 0x1aad
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor edx, edx
inc edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1005b00e
dec dword [ebp - 0x24]
jns 0x1005af95
mov eax, dword [ebp - 0xf4]
inc dword [eax]
cmp dword [eax], edx
jle 0x1005af68
push eax
call fcn.10123626
pop ecx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0xec], ebx
dec dword [ebp - 0x10]
push 1
pop eax
jns 0x1005af38
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x88], 0
je 0x1005b095
push dword [ebp - 0x88]
call fcn.10123626
pop ecx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov edi, 0x10193f40
mov dword [ebp - 0x24], edi
test esi, esi
jle 0x1005b462
xor edx, edx
mov dword [ebp - 0x2c], 0xff18ee85
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1005b0c2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34], 0x4fd3df75
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1005b0b4
mov dword [ebp - 0x34], 0xffffffe3
jmp 0x1005b13a
mov dword [ebp - 0x14], 0xfffffff6
cmp dword [ebp - 0x14], ebx
je 0x1005b0f2
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
mov ecx, edx
jne 0x1005b0f4
mov ecx, ebx
mov eax, dword [ebp - 0x14]
imul eax, ecx
neg eax
sbb eax, eax
neg eax
add eax, 0xffff
je 0x1005b10e
mov eax, edx
cmp dword [ebp - 0x34], ebx
jne 0x1005b110
mov eax, ebx
push 0xfffffffffffffffe
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x34]
cmp eax, 0xfffffffb
jg 0x1005b125
cmp dword [ebp - 0x14], ebx
jne 0x1005b127
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
push 1
setl cl
mov dword [ebp - 0x2c], ecx
inc dword [ebp - 0x34]
pop edx
cmp dword [ebp - 0x34], 0xffffffed
jne 0x1005b0d0
mov eax, dword [edi]
lea ecx, [ebp - 0xac]
push 4
pop esi
mov dword [ebp - 0x14], 0x8e5c
add edi, esi
push esi
mov dword [ebp - 0x30], eax
call fcn.100141a5
mov dword [ebp - 0x20], 0xd711e7bf
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x10], ebx
jmp 0x1005b18a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xac]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1005b177
xor ecx, ecx
mov dword [ebp - 0x10], ebx
inc ecx
jmp 0x1005b1a5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x54], 0xc60edac7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1005b197
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xac]
mov dword [ecx + 8], eax
test eax, eax
je 0x1005b1ed
mov dword [ebp - 0x20], 0x7308f472
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ecx + 8], edx
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x28], ebx
je 0x1005b1ed
xor eax, eax
inc eax
jmp 0x1005b1ef
mov eax, ebx
push dword [ebp - 0xac]
mov dword [ebp - 0x2c], eax
call fcn.10123626
mov eax, dword [edi]
add edi, esi
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0x24], 0x4d2edc75
mov dword [ebp - 0x20], 0x73bf38c0
mov dword [ebp - 0x2c], 9
mov dword [ebp - 0x18], 0x4b5c6f8b
mov dword [ebp - 0x4c], 0x5b0bb8bf
mov dword [ebp - 0x2c], 0xc7104272
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x20], 0x483bbb66
pop ecx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x14], ebx
jmp 0x1005b273
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11c], 0xd3ecf04b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1005b262
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x114]
cmp ecx, eax
setl dl
mov dword [ebp - 0x18], edx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, 0xfffe
setl cl
cmp eax, ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
setne dl
xor ecx, ecx
cmp edx, esi
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp dword [ebp - 0x58], 0
mov dword [ebp - 0x118], eax
jne 0x1005b2f5
add edi, 8
push 4
pop esi
mov dword [ebp - 0x14], 0xac204e2d
lea ecx, [ebp - 0xd0]
mov dword [ebp - 0x18], 0xee41b66b
push esi
call fcn.100141a5
mov dword [ebp - 4], esi
lea ecx, [ebp - 0xdc]
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x28], 0xfffffff9
push 3
call fcn.100141a5
mov dword [ebp - 0x10], ebx
jmp 0x1005b344
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1005b335
mov dword [ebp - 0x10], ebx
jmp 0x1005b361
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1005b34e
push 0x16
mov dword [ebp - 0x14], 0xffffffef
pop ecx
cmp dword [ebp - 0x14], ecx
jge 0x1005b3e7
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], ebx
jmp 0x1005b3d4
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ecx
jge 0x1005b3a7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1005b396
xor eax, eax
inc eax
mov dword [ebp - 0x18], ebx
jmp 0x1005b3cb
mov dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x10], 6
jmp 0x1005b3c2
dec dword [ebp - 0x20]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe3
jg 0x1005b3bc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 9
jne 0x1005b3ac
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x15
jg 0x1005b381
cmp dword [ebp - 0x14], ebx
jne 0x1005b3e7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1005b379
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xd0]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, edx
setl al
cmp dword [ebp - 0xdc], 0
mov dword [ebp - 0x18], eax
je 0x1005b431
push dword [ebp - 0xdc]
call fcn.10123626
pop ecx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0xd0]
call fcn.10123626
add edi, dword [ebp - 0x30]
dec dword [ebp - 0x50]
pop ecx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
jne 0x1005b0a5
mov dword [ebp - 0x24], edi
mov eax, dword [edi]
lea ecx, [ebp - 0xb8]
push 3
pop esi
push esi
mov dword [ebp - 0x2c], eax
call fcn.100141a5
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], ebx
jmp 0x1005b48f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x104], 0xae35
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1005b47e
mov dword [ebp - 0x10], ebx
jmp 0x1005b4ac
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0xcd453606
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1005b499
mov edi, dword [ebp - 0xb8]
mov dword [edi + 8], 2
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x20], 0x2aa9dade
cmp dword [edi + 8], ebx
je 0x1005b4dd
cmp dword [ebp - 0x20], ebx
je 0x1005b4dd
xor edx, edx
inc edx
mov ecx, edx
jmp 0x1005b4e2
xor edx, edx
mov ecx, ebx
inc edx
mov eax, dword [ebp - 0x104]
sub ecx, eax
cmp ecx, dword [ebp - 0x100]
jge 0x1005b4f9
mov ecx, edx
cmp dword [edi + 8], ebx
jne 0x1005b4fb
mov ecx, ebx
mov eax, dword [edi + 8]
mov esi, 0x693009c
sub eax, ecx
mov ecx, dword [ebp - 0x30]
dec ecx
add ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
sub esi, ecx
mov ecx, dword [ebp - 0x100]
mov eax, dword [ebp - 0x104]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setl al
dec dword [edi + 8]
mov dword [ebp - 0x20], eax
jns 0x1005b4be
mov edx, dword [ebp - 0xb8]
xor ecx, ecx
push edx
mov eax, dword [edx + 4]
add eax, 0xab79
cmp eax, 0x2c02
setle cl
mov dword [ebp - 0x30], ecx
call fcn.10123626
mov edi, dword [ebp - 0x24]
xor eax, eax
pop ecx
push 4
pop esi
add edi, esi
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
inc eax
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xfffffff0
jmp 0x1005b5b8
mov dword [ebp - 0x30], 0x8b10
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1005b5b0
push eax
push 0x1191
push 0x1e5
push 0x157e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
xor eax, eax
inc eax
cmp dword [ebp - 0x30], ebx
jne 0x1005b5be
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe8
jne 0x1005b580
mov eax, dword [edi]
add edi, esi
test eax, eax
jne 0x1005b693
mov eax, dword [edi]
add edi, esi
mov dword [ebp - 0x30], eax
mov eax, dword [edi]
add edi, esi
mov esi, dword [ebp - 0x2c]
push esi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x24], edi
call fcn.1010e14c
pop ecx
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0xa0]
lea eax, [ebp - 0xf8]
mov dword [ebp - 0xf8], ebx
push eax
push esi
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
call fcn.10063664
mov ecx, ebx
test esi, esi
jle 0x1005b675
mov eax, ecx
and eax, 0x80000001
jns 0x1005b627
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x30]
add eax, ecx
add eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x54]
cdq
idiv esi
mov eax, dword [ebp - 0xa0]
cmp word [eax + edx*2], bx
je 0x1005b65d
mov edi, eax
lea eax, [edx + 1]
cdq
idiv esi
cmp word [edi + edx*2], bx
jne 0x1005b648
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0xa0]
xor ebx, ebx
inc ebx
mov word [eax + edx*2], bx
mov al, byte [edx + edi]
mov edx, dword [ebp - 0x20]
push 0
pop ebx
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
jl 0x1005b619
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x20]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xa0]
mov dword [edi], esi
test eax, eax
je 0x1005b696
push eax
call fcn.10123626
pop ecx
jmp 0x1005b696
mov edi, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret