Function at 0x10046674
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10146b07
call fcn.1014399c
sub esp, 0x350
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
mov esi, ecx
mov dword [ebp - 0xe8], ebx
lea ecx, [ebp - 0xd8]
inc edi
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 2
push edi
mov dword [ebp - 0x84], esi
call fcn.100141a5
push 3
mov dword [ebp - 0x2c], 0x283bc1b0
mov dword [ebp - 0x14], ebx
pop ecx
jmp 0x100466da
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x100], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100466cd
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], edi
jge 0x100466fe
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100466e7
push 3
pop ecx
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1004675a
mov dword [ebp - 0x14], 0xfd4914d2
mov dword [ebp - 0x14], ebx
jmp 0x10046723
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x100], 0xc7555b7c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10046712
mov dword [ebp - 0x14], ebx
jmp 0x10046752
mov dword [ebp - 0x20], 0x14173bf3
mov dword [ebp - 0x20], ebx
jmp 0x1004674a
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x100], 0x8872fa4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10046739
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x1004672d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x10046706
inc dword [ebp - 0x2c]
cmp dword [ebp - 0xd8], ebx
je 0x10046788
push dword [ebp - 0xd8]
call fcn.10123626
pop ecx
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
push 0x104
lea eax, [ebp - 0x35c]
push eax
push 0x5c4a9
push 0x53dfa
call fcn.10027b51
pop ecx
pop ecx
call eax
push 8
pop ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
jmp 0x100467cc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x34], 0x4a8c6a53
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x100467be
mov dword [ebp - 0x48], ebx
cmp dword [ebp - 0x48], ebx
jl 0x10046828
mov dword [ebp - 0x38], 0xbe92e3f9
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x34], ebx
je 0x100467f0
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x48], edi
jne 0x1004681e
mov eax, dword [ebp - 0x48]
cmp dword [ebp + eax*4 - 0x34], ebx
mov eax, edi
jne 0x10046820
mov eax, ebx
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x48]
jns 0x100467d9
mov dword [ebp - 0x20], 0xfffffff1
cmp dword [ebp - 0x20], ecx
jle 0x1004685e
mov dword [ebp - 0x2c], 0xbb000e2e
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 8
jg 0x10046834
lea eax, [ebp - 0x35c]
mov ecx, esi
push eax
call fcn.100140d4
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x10]
add eax, eax
mov dword [ebp - 0xe8], edi
push eax
lea eax, [ebp - 0x35c]
push ebx
push eax
call fcn.10027c8d
add esp, 0xc
mov dword [ebp - 0x20], 0x42eb90da
lea ecx, [ebp - 0xb4]
push 4
call fcn.100141a5
mov dword [ebp - 4], edi
lea eax, [ebp - 0x100]
mov dword [ebp - 0x24], 0xa7221ebc
lea ecx, [ebp - 0x80]
push dword [ebp - 0x24]
xorps xmm0, xmm0
mov dword [ebp - 0x80], ebx
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x7c], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x110], xmm0
mov dword [ebp - 0x78], ebx
call fcn.10015178
mov byte [ebp - 4], 2
mov dword [ebp - 0x2c], 0x7736
mov dword [ebp - 0x18], ebx
jmp 0x100468f6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100468e7
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0xfffffffb
jg 0x10046adb
mov edi, dword [ebp - 0x80]
push 3
lea ecx, [ebp - 0x90]
call fcn.100141a5
push 4
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], 3
call fcn.100141a5
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], ebx
jmp 0x10046949
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10046936
mov dword [ebp - 0x14], ebx
jmp 0x10046967
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0x5261fc42
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10046954
mov esi, dword [ebp - 0x90]
mov dword [esi + 4], 0x18
mov dword [ebp - 0x14], 0x8cccddd1
mov dword [ebp - 0x14], ebx
jmp 0x10046a0d
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x3c], 0xd68f985
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x28], 0x79d44f4c
mov ecx, dword [eax]
mov eax, dword [ebp - 0xa8]
push 0
mov dword [eax], ecx
xor ecx, ecx
mov dword [ebp - 0x3c], 1
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
cmp eax, 0x97b0
mov eax, dword [ebp - 0xb4]
setg cl
cmp dword [eax + edx*4], ecx
mov eax, dword [ebp - 0x3c]
pop edx
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, 0x84b7
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x10046989
dec dword [esi + 4]
cmp dword [esi + 4], 9
jge 0x1004697a
mov eax, dword [ebp - 0x20]
xor ecx, ecx
imul eax, dword [ebp - 0x18], 0xfffffff6
cmp eax, dword [edi + 0xc]
mov eax, dword [ebp - 0xa8]
setge cl
xor edx, edx
cmp ecx, dword [eax]
setge dl
sub edx, 0xe82b
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 5
setl al
cmp eax, 0xe3c2
jge 0x10046a62
mov eax, dword [ebp - 0x80]
cmp dword [eax + 4], ebx
je 0x10046a6c
cmp dword [esi + 4], ebx
je 0x10046a6c
xor ecx, ecx
inc ecx
jmp 0x10046a6e
mov ecx, ebx
dec dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
cmp eax, ecx
jge 0x10046a7e
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa8]
push eax
mov dword [eax], 0x6f576105
call fcn.10123626
mov byte [ebp - 4], 2
push dword [ebp - 0x90]
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
call fcn.10123626
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffb
pop ecx
pop ecx
jle 0x1004690c
xor edi, edi
inc edi
cmp dword [ebp - 0x80], 0
je 0x10046af3
push dword [ebp - 0x80]
call fcn.10123626
pop ecx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov byte [ebp - 4], bl
cmp dword [ebp - 0xb4], 0
je 0x10046b1d
push dword [ebp - 0xb4]
call fcn.10123626
pop ecx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0x14], 0x3248c66
lea ecx, [ebp - 0xe4]
mov dword [ebp - 0x28], 0xba6b42be
mov dword [ebp - 0x28], 0x551fa4c8
push 4
call fcn.100141a5
mov dword [ebp - 0x28], 0x91c84132
mov dword [ebp - 0x28], 0x72d50fa8
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0x914a
mov dword [ebp - 0x18], ebx
jmp 0x10046b73
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], 0x5bb08661
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10046b60
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
inc ecx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], edx
xor edx, edx
cmp dword [ebp - 0x24], 0x2717
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x28]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov edx, 0x1215
setge cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, edx
mov esi, dword [ebp - 0xe4]
setl cl
add ecx, dword [ebp - 0x14]
mov dword [esi + 8], edx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 3
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
setg cl
cmp ecx, edx
je 0x10046c03
mov eax, ebx
cmp dword [esi + 8], ebx
je 0x10046c05
mov eax, edi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10046c1d
call dword [sym.imp.USER32.dll_WaitMessage]
push dword [ebp - 0xe4]
call fcn.10123626
mov dword [ebp - 0xe4], ebx
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0x74], 0x660a7a0b
mov dword [ebp - 0x70], 0x57064c01
mov dword [ebp - 0x6c], 0x7a037b02
mov dword [ebp - 0x68], 0x6b008204
mov dword [ebp - 0x64], 0x82077d08
mov dword [ebp - 0x60], 0x87057e09
mov dword [ebp - 0x5c], 0xb0e8b410
mov dword [ebp - 0x58], 0x9316a0a2
mov dword [ebp - 0x54], 0xdee018ed
mov dword [ebp - 0x50], 0xf481794d
mov dword [ebp - 0x14], 0x68ec0ae9
mov dword [ebp - 0x24], 0xbf2d3f50
pop ecx
mov dword [ebp - 0x14], 0x1b
jmp 0x10046ceb
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x18], ebx
jmp 0x10046cb5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x138], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10046ca4
mov dword [ebp - 0x20], ebx
jmp 0x10046cc8
cmp dword [ebp - 0x20], ebx
jne 0x10046cce
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10046cc0
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10046ce8
push 0x1769
push 0xe14
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
jg 0x10046c98
mov esi, ebx
mov dword [ebp - 0x24], 1
mov edi, ebx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], edi
cmp esi, 0x18
jne 0x10046d61
push 0x10
pop edi
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x18], 0xfffffff0
jmp 0x10046d53
mov dword [ebp - 0x24], 0x8b10
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10046d4b
push 1
push 0x1191
push 0x1e5
push 0x157e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
cmp dword [ebp - 0x24], ebx
jne 0x10046d59
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
jne 0x10046d1d
push 0x26
pop esi
jmp 0x10047041
push 2
lea ecx, [ebp - 0x9c]
call fcn.100141a5
mov dword [ebp - 4], 4
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x18], ebx
jmp 0x10046d94
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10046d81
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x2c], ebx
jl 0x10046edd
push 1
lea ecx, [ebp - 0xc0]
call fcn.100141a5
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x10046dce
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10046dbf
mov eax, dword [ebp - 0xc0]
mov dword [eax], ebx
mov dword [ebp - 0x14], 0xffffffff
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10046dfc
push ebx
push ebx
push 0x1cd2
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
xor edx, edx
inc edx
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x10046eab
mov dword [ebp - 0x20], 0x5f0ed1ad
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x10046e7c
mov dword [ebp - 0x18], 0x498e64e6
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10046e43
push 0x1ef3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edx, edx
inc edx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x10046e77
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10046e61
push ebx
push 0x7fa
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x9c]
cmp dword [eax + ecx*4], ebx
jne 0x10046e74
dec dword [ebp - 0x18]
jns 0x10046e4b
xor edx, edx
inc edx
dec dword [ebp - 0x20]
jns 0x10046e17
mov dword [ebp - 0x20], ebx
jmp 0x10046e9d
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10046e9a
push 0x1aad
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor edx, edx
inc edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x10046e81
dec dword [ebp - 0x14]
jns 0x10046e08
mov eax, dword [ebp - 0xc0]
inc dword [eax]
cmp dword [eax], edx
jle 0x10046ddb
push eax
call fcn.10123626
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
dec dword [ebp - 0x2c]
pop ecx
jns 0x10046daa
mov byte [ebp - 4], bl
cmp dword [ebp - 0x9c], 0
je 0x10046f07
push dword [ebp - 0x9c]
call fcn.10123626
pop ecx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x94], ebx
movzx eax, byte [ebp + esi - 0x73]
lea ecx, [ebp - 0xcc]
sub eax, esi
dec eax
add eax, edi
push 3
mov dword [ebp - 0x2c], eax
call fcn.100141a5
push 3
pop edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x14], ebx
jmp 0x10046f3d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf4], 0xae35
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10046f2c
mov dword [ebp - 0x14], ebx
jmp 0x10046f5a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0xcd453606
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10046f47
mov edi, dword [ebp - 0xcc]
mov dword [edi + 8], 2
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x28], 0x2aa9dade
cmp dword [edi + 8], ebx
je 0x10046f89
cmp dword [ebp - 0x28], ebx
je 0x10046f89
xor ecx, ecx
inc ecx
jmp 0x10046f8b
mov ecx, ebx
mov eax, dword [ebp - 0xf4]
sub ecx, eax
cmp ecx, dword [ebp - 0xf0]
jge 0x10046fa5
cmp dword [edi + 8], ebx
je 0x10046fa5
xor ecx, ecx
inc ecx
jmp 0x10046fa7
mov ecx, ebx
mov eax, dword [edi + 8]
mov esi, 0x693009c
sub eax, ecx
mov ecx, dword [ebp - 0x24]
dec ecx
add ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
sub esi, ecx
mov ecx, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf4]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setl al
dec dword [edi + 8]
mov dword [ebp - 0x28], eax
jns 0x10046f6c
mov edx, dword [ebp - 0xcc]
xor ecx, ecx
push edx
mov eax, dword [edx + 4]
add eax, 0xab79
cmp eax, 0x2c02
setle cl
mov dword [ebp - 0x24], ecx
call fcn.10123626
pop ecx
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
test ecx, ecx
jns 0x1004702e
or eax, 0xffffffff
sub eax, ecx
add ecx, 0x100
and eax, 0xffffff00
add ecx, eax
mov esi, dword [ebp - 0x38]
mov edi, dword [ebp - 0x3c]
movzx eax, byte [ebp + esi - 0x74]
mov word [ebp + eax*2 - 0x12c], cx
add esi, 2
mov dword [ebp - 0x38], esi
cmp esi, 0x28
jb 0x10046d02
xor eax, eax
lea ecx, [ebp - 0x150]
mov word [ebp - 0x114], ax
lea eax, [ebp - 0x12c]
push eax
call fcn.100140d4
push 0xffffffffffffffff
push ebx
mov dword [ebp - 4], 5
mov ecx, dword [ebp - 0x84]
push eax
call fcn.10028a9a
push ebx
push 1
lea ecx, [ebp - 0x150]
call fcn.10014706
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
push 0xd
pop esi
stosw word es:[edi], ax
mov dword [ebp - 0x24], 0xff18ee85
mov dword [ebp - 0x18], ebx
jmp 0x100470bb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x30], 0x4fd3df75
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x100470ad
mov dword [ebp - 0x30], 0xffffffe3
jmp 0x1004713c
mov dword [ebp - 0x20], 0xfffffff6
cmp dword [ebp - 0x20], ebx
je 0x100470ef
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
je 0x100470ef
xor ecx, ecx
inc ecx
jmp 0x100470f1
mov ecx, ebx
mov eax, dword [ebp - 0x20]
imul eax, ecx
neg eax
sbb eax, eax
neg eax
add eax, 0xffff
je 0x1004710e
cmp dword [ebp - 0x30], ebx
je 0x1004710e
xor eax, eax
inc eax
jmp 0x10047110
mov eax, ebx
push 0xfffffffffffffffe
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x30]
cmp eax, 0xfffffffb
jg 0x1004712a
cmp dword [ebp - 0x20], ebx
je 0x1004712a
xor edx, edx
inc edx
jmp 0x1004712c
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffed
jne 0x100470ca
dec esi
jne 0x100470a1
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret