Function at 0x40fac0
Capabilities:
Get disk size
Query or enumerate registry key
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c8
and dword [esp + 0x4c], 0
push esi
xor esi, esi
mov dword [esp + 0x48], ecx
push edi
inc esi
mov dword [esp + 0x20], 0x7cb3
push esi
lea ecx, [esp + 0x11c]
mov dword [esp + 0x38], edx
call fcn.004011bf
push 2
lea ecx, [esp + 0x208]
call fcn.004011bf
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x40fb1b
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x118]
mov dword [ecx + edx*4], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x40fb09
mov dword [esp + 0xc], eax
jmp 0x40fb3d
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x204]
mov dword [ecx + edx*4], 0xb959c45c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x40fb27
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x118]
mov dword [ecx], edx
mov dword [esp + 0x20], eax
jmp 0x40fc37
mov dword [esp + 0x10], 6
mov dword [esp + 0x10], eax
jmp 0x40fc29
mov dword [esp + 0x24], 0xe6e7f737
mov dword [esp + 0x24], eax
jmp 0x40fc0b
mov dword [esp + 0xc], 0xfffffff7
mov dword [esp + 0xc], eax
jmp 0x40fbfd
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], eax
jl 0x40fbf9
mov dword [esp + 0x2c], 0x1cb4e76a
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x40fbcb
push 0x1ba6
push 0x23f2
push 0x2149
push 0x15ff
call dword [sym.imp.GDI32.dll_CreateRectRgn]
xor eax, eax
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], eax
jl 0x40fbf3
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x40fbed
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor eax, eax
dec dword [esp + 0x2c]
jns 0x40fbd5
dec dword [esp + 0x14]
jns 0x40fb9c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], eax
jle 0x40fb8a
mov ecx, dword [esp + 0x10]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], eax
jle 0x40fb7c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x118]
cmp dword [ecx + edx*4], eax
jne 0x40fc33
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x40fb6b
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x40fb5a
lea ecx, [esp + 0x204]
call fcn.00401291
lea ecx, [esp + 0x118]
call fcn.00401291
movdqa xmm0, xmmword [0xa64bf0]
lea ecx, [esp + 0x27c]
push 0xfffffffffffffffa
pop esi
push dword [esp + 0x54]
xor eax, eax
mov dword [esp + 0x18], 0xade
push ecx
lea ecx, [esp + 0x274]
mov dword [esp + 0x14], 0x3aaf5bfb
push ecx
mov dword [esp + 0x38], esi
lea ecx, [esp + 0xc0]
push eax
movdqu xmmword [esp + 0x27c], xmm0
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
call fcn.004016de
xor eax, eax
mov dword [esp + 0x1c], 0x299fa9ef
mov dword [esp + 0x10], eax
jmp 0x40fcd8
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x124], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x40fcc9
mov dword [esp + 0x14], 0xfffffff6
xor edx, edx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
cmp esi, ecx
mov edi, dword [esp + 0xb4]
setge dl
add edx, dword [esp + 0x124]
mov dword [edi + 0xc], esi
mov byte [esp + 0x1b], al
je 0x40fd5d
cmp byte [esp + 0x1b], al
je 0x40fd77
push 1
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
jmp 0x40fd75
cmp byte [esp + 0x1b], al
je 0x40fd77
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1ecb
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x40febb
mov dword [esp + 0x30], 0xa3bb1d44
lea ecx, [esp + 0x174]
push 1
call fcn.004011bf
xor eax, eax
mov dword [esp + 0xc], eax
jmp 0x40fdad
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x224], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x40fd9e
mov dword [esp + 0xc], eax
jmp 0x40fdd0
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x174]
mov dword [ecx + edx*4], 0x39ba
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x40fdba
mov dword [esp + 0xc], eax
jmp 0x40fea0
mov dword [esp + 0x2c], 0x4126315b
xor edx, edx
mov dword [esp + 0x2c], 0x81b27067
mov dword [esp + 0x1c], 0xc2e3
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + ecx*4 + 0x124]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x124]
cmp ecx, esi
sete dl
mov dword [esp + 0x224], edx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x124], 0x8c24
mov ecx, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0xb4]
mov ecx, dword [edx + ecx*4]
cmp ecx, dword [edx + esi*4]
jge 0x40fe46
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], eax
je 0x40fe54
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp dword [edi + 0xc], ecx
sete dl
xor ecx, ecx
cmp edx, 0x25c7
setle cl
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x1c]
sub ecx, 0x499c77e2
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xfffa
jae 0x40fe96
mov ecx, dword [esp + 0x174]
cmp dword [ecx], eax
je 0x40fe96
xor ecx, ecx
inc ecx
jmp 0x40fe98
mov ecx, eax
mov dword [esp + 0x2c], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x40fde0
lea ecx, [esp + 0x174]
call fcn.00401291
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x40fd80
lea ecx, [esp + 0xb4]
call fcn.00401291
mov eax, dword [0xa66ff4]
xor edi, edi
push 7
inc edi
pop esi
test al, 1
jne 0x40ff5d
or eax, edi
mov dword [0xa66ff4], eax
xor eax, eax
push eax
push eax
mov dword [0xa67020], eax
mov dword [0xa67024], eax
call fcn.00412ae6
mov ecx, eax
mov dword [0xa6703c], 0x3f800000
mov dword [0xa67020], ecx
xor eax, eax
mov dword [esp + 0xf0], ecx
lea ecx, [esp + 0xf0]
push ecx
push 0x10
push eax
mov dword [0xa67028], eax
mov ecx, 0xa67028
mov dword [0xa67030], eax
mov dword [0xa6702c], eax
lea eax, [esp + 0x1e8]
push eax
call fcn.0041288b
push 0x472faa
mov dword [0xa67034], esi
mov dword [0xa67038], 8
call fcn.00466bef
pop ecx
imul eax, dword [esp + 0x4c], 0x2710
add eax, dword [esp + 0x34]
mov dword [esp + 0x74], eax
xor eax, eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 0x58bd4dfb
mov dword [esp + 0x1c], 0xcc2443ac
mov dword [esp + 0xc], eax
jmp 0x40ffa1
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x3c], 0x5b9b55bb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x40ff91
mov dword [esp + 0xc], eax
jmp 0x40ffbc
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x1ec], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x40ffad
push 0xfffffffffffffffe
mov dword [esp + 0x40], esi
pop eax
jmp 0x40ffdb
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], eax
inc dword [esp + 0x1c]
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], 0xd
je 0x40ffcb
lea eax, [esp + 0x74]
push eax
call fcn.0041210d
push 8
mov esi, dword [eax]
pop eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x41002c
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x1fc], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x41001d
push 3
mov dword [esp + 0x14], eax
pop edx
cmp dword [esp + 0x10], 0x1d
jl 0x41012c
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], eax
jmp 0x41006e
mov dword [esp + 0x28], 0x6dd8
mov dword [esp + 0x28], 0xfffffffe
mov dword [esp + 0x1c], edi
inc dword [esp + 0x1c]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], eax
jle 0x410052
mov dword [esp + 0x24], eax
jmp 0x410119
mov dword [esp + 0xc], 0x868bb4aa
mov dword [esp + 0xc], eax
jmp 0x410102
mov dword [esp + 0x20], 0x348cc383
mov dword [esp + 0x20], eax
jmp 0x4100ac
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x2a0], 0xfffb
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x410099
mov dword [esp + 0x20], eax
jmp 0x4100f8
mov dword [esp + 0x1c], 0x233fd52
mov ecx, dword [esp + 0x24]
push 3
mov ecx, dword [esp + ecx*4 + 0x10c]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2ac]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x10c], edx
inc dword [esp + 0x24]
pop edx
cmp dword [esp + 0x20], edx
jle 0x4100b8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jle 0x41008b
mov ecx, dword [esp + 0x24]
cmp dword [esp + ecx*4 + 0x108], eax
jne 0x410123
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jle 0x41007d
inc dword [esp + 0x10]
jmp 0x410039
push edx
test esi, esi
je 0x410402
lea ecx, [esp + 0x134]
mov dword [esp + 0xe0], esi
call fcn.004011bf
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], eax
jmp 0x41016a
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x130]
mov dword [ecx + edx*4], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x410154
push 4
mov dword [esp + 0x18], eax
pop esi
jmp 0x41018d
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0xf4], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x41017a
mov dword [esp + 0x14], eax
jmp 0x4101ac
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x104], 0xce4ac035
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x410199
mov edx, dword [esp + 0x130]
xor ecx, ecx
cmp dword [edx + 8], 0xfffffffa
setne cl
cmp ecx, dword [edx + 4]
jne 0x410274
push 0xfffffffffffffff8
pop esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x34], 0x27363782
mov dword [esp + 0x10], eax
jmp 0x4101ef
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x9c], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x4101e0
mov ecx, dword [esp + 0x130]
cmp dword [ecx], eax
jne 0x41022c
mov ecx, dword [edx + 8]
test ecx, ecx
jne 0x410226
mov ecx, dword [esp + 0x9c]
mov esi, eax
mov ecx, dword [esp + 0x9c]
mov ecx, dword [esp + 0x9c]
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x410228
mov esi, edi
cmp esi, ecx
jge 0x41022e
mov eax, edi
mov ecx, dword [edx + 8]
xor edx, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x9c]
setl dl
imul edx, ecx
neg edx
mov dword [esp + 0x34], edx
xor edx, edx
cmp dword [esp + 0x34], 0xff44
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x34], ecx
mov dword [esp + 0xf8], edi
jmp 0x4103f1
mov dword [esp + 0x20], 0x758185f1
mov dword [esp + 0x10], 6
mov dword [esp + 0x34], edi
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x10], eax
jmp 0x4102a9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xec], 0x16cbb4d0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x410296
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add ecx, dword [edx + 8]
add eax, ecx
lea ecx, [esp + 0x180]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xf8]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xf8]
mov eax, dword [esp + 0xf4]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
push 2
call fcn.004011bf
mov eax, 0xcc08f94b
mov dword [esp + 0x1c0], eax
mov dword [esp + 0x1c4], eax
mov dword [esp + 0x1c8], eax
mov dword [esp + 0x1cc], eax
xor eax, eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0xc], eax
jmp 0x41033b
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x22c], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x41032c
mov dword [esp + 0xc], eax
jmp 0x41035d
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x180]
mov dword [ecx + edx*4], 0xe2185aeb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x410347
mov ecx, dword [esp + 0x238]
xor edx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov dword [esp + 0xec], ecx
mov ecx, dword [esp + 0x238]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0xf4]
mov ecx, dword [esp + 0xf8]
neg esi
cmp esi, ecx
mov ecx, dword [esp + 0x180]
setle dl
mov dword [ecx], edx
xor edx, edx
mov dword [esp + 0x1c0], edi
mov ecx, dword [esp + 0x1c]
cmp ecx, edi
setge dl
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x2c], eax
je 0x4103c8
mov eax, dword [esp + 0x104]
mov ecx, dword [esp + 0x238]
xor edx, edx
mov eax, dword [esp + 0x34]
cmp eax, ecx
lea ecx, [esp + 0x180]
setl dl
mov dword [esp + 0xf8], edx
inc dword [esp + 0x20]
call fcn.00401291
lea ecx, [esp + 0x130]
call fcn.00401291
jmp 0x411f5a
lea ecx, [esp + 0x94]
call fcn.004011bf
mov dword [esp + 0xc], 0x6915a136
xor eax, eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x14], 0x5fdfda84
push 3
mov dword [esp + 0x24], 0xd469
mov dword [esp + 0x14], eax
pop esi
jmp 0x41044b
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x90]
mov dword [ecx + edx*4], 0x8ec0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x410435
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 2
jg 0x4106bf
mov edi, dword [esp + 0x90]
mov dword [esp + 0x28], edi
mov dword [esp + 0x14], 0xd53bc6e5
mov dword [esp + 0x24], 0x542afa01
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], 6
mov dword [esp + 0x30], esi
mov dword [esp + 0x14], eax
jmp 0x4104a7
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x90]
mov dword [ecx + edx*4], 0xa00f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x410491
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x90]
push 0
mov edx, dword [ecx + edx*4]
imul edx, dword [edi + 4]
mov ecx, dword [esp + 0x10]
cmp ecx, dword [edi + 4]
pop ecx
setl cl
add ecx, edx
xor edx, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x24]
sete dl
sub edx, 0xdd9cd443
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x30], edx
xor edx, edx
cmp dword [esp + 0x30], ecx
setge dl
inc edx
imul edx, dword [edi + 4]
inc edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 2
jg 0x4106aa
mov dword [esp + 0x10], 0xfffffffa
mov dword [esp + 0x1c], 0x39ef5b50
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], eax
jl 0x410571
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x41054a
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor eax, eax
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x41056b
push eax
push eax
push 0x1ec0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DefWindowProcA]
xor eax, eax
dec dword [esp + 0x14]
jns 0x410536
cmp dword [esp + 0xc], eax
jne 0x410590
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x90]
mov edx, dword [ecx + 8]
mov dword [ecx + esi*4], edx
test edx, edx
jne 0x410590
mov edi, eax
jmp 0x410593
xor edi, edi
inc edi
mov dword [esp + 0x14], 3
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x2c]
sub esi, ecx
mov ecx, dword [esp + 0x24]
neg esi
push 0
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setne dl
sub edx, dword [esp + 0x14]
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
pop ecx
setg cl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0x14]
sub esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
neg esi
push 0
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
mov ecx, 0xaf53c8cb
setle dl
cmp ecx, edx
sbb edx, edx
inc edx
imul edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
cmp ecx, edx
pop edx
setge dl
neg edx
sub edx, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edi, edx
setle cl
xor edx, edx
imul ecx, dword [esp + 0xc]
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x30], ecx
setge dl
mov dword [esp + 0x14], edx
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
cmp ecx, dword [esp + 0x24]
je 0x410668
cmp dword [esp + 0x1c], eax
jne 0x410668
mov esi, eax
jmp 0x41066b
xor esi, esi
inc esi
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x10]
push 0
sete dl
cmp edx, ecx
pop ecx
setge cl
xor edx, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x30], ecx
setg dl
mov dword [esp + 0x30], edx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jle 0x410518
mov edi, dword [esp + 0x28]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
push 3
pop esi
jle 0x41046b
xor edi, edi
inc edi
mov edx, dword [esp + 0x90]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
cmp dword [edx + 8], eax
setge cl
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x90]
call fcn.00401291
mov eax, dword [0xa66ff4]
test al, 2
jne 0x410770
or eax, 2
mov dword [0xa66ff4], eax
xor eax, eax
push eax
push eax
mov dword [0xa67000], eax
mov dword [0xa67004], eax
call fcn.00412ae6
mov ecx, eax
mov dword [0xa6701c], 0x3f800000
mov dword [0xa67000], ecx
xor eax, eax
mov dword [esp + 0xe8], ecx
lea ecx, [esp + 0xe8]
push ecx
push 0x10
push eax
mov dword [0xa67008], eax
mov ecx, 0xa67008
mov dword [0xa67010], eax
mov dword [0xa6700c], eax
lea eax, [esp + 0x20c]
push eax
call fcn.0041288b
push 0x472fa5
mov dword [0xa67014], 7
mov dword [0xa67018], 8
call fcn.00466bef
pop ecx
xorps xmm0, xmm0
lea ecx, [esp + 0x168]
movdqu xmmword [esp + 0xa4], xmm0
xor esi, esi
mov dword [esp + 0xc], esi
push edi
call fcn.004011bf
mov dword [esp + 0x2c], 0x7b39
xor eax, eax
mov dword [esp + 0x1c], 0xfffffff9
mov dword [esp + 0x10], eax
mov dword [esp + 0x1c], 5
mov dword [esp + 0x28], 0xc6833e1a
push 3
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], eax
pop esi
jmp 0x4107d6
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x68], 7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x4107c6
mov dword [esp + 0xc], eax
jmp 0x4107f8
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x168]
mov dword [ecx + edx*4], 0x829cbc21
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x4107e2
mov dword [esp + 0xc], eax
jmp 0x410814
mov dword [esp + 0x28], 0x4c23afc3
mov dword [esp + 0x28], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x410804
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x168]
mov dword [eax], ecx
test ecx, ecx
jne 0x410840
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [esp + 0xc]
setl cl
xor edx, edx
cmp ecx, 0x24015e1b
setge dl
add edx, 0xfffffffa
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0xc]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x70]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x6c]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], edi
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setne dl
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0x10]
sub ecx, eax
jne 0x4108bf
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x168]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 0x416c0119
call fcn.00401291
lea eax, [esp + 0x4c]
push eax
call fcn.0041216f
xor edx, edx
mov edi, dword [eax]
mov dword [esp + 0x10], 0xb905
mov dword [esp + 0xc], 5
mov dword [esp + 0x20], 0x59d568d5
mov dword [esp + 0x1c], 0xc0198ab7
mov dword [esp + 0x1c], 0x2130
mov dword [esp + 0x1c], 4
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
imul ecx, dword [esp + 0xc], 0xffff
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], edi
cmp ecx, eax
setl dl
mov dword [esp + 0xc], edx
xor edx, edx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
add ecx, 0xa
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setl al
mov dword [esp + 0x1c], eax
xor eax, eax
cmp dword [esp + 0x1c], eax
je 0x41097c
xor ecx, ecx
inc ecx
jmp 0x41097e
mov ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x10], 1
jae 0x4109bf
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], al
je 0x410a22
push 0x1f26
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x410a22
mov dword [esp + 0x10], eax
jmp 0x4109d4
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x27c], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x4109c5
mov dword [esp + 0x20], 0xffffffe3
jmp 0x410a1b
mov dword [esp + 0xc], eax
jmp 0x4109fd
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x27c], 4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x4109ea
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x410a17
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor eax, eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x3c
jge 0x4109e4
cmp byte [ebp + 0xc], 0
jne 0x410a30
test edi, edi
jne 0x410ec5
mov dword [esp + 0x10], 0x97f6af11
lea ecx, [esp + 0x218]
mov dword [esp + 0x28], 0x9c9fb37b
push esi
call fcn.004011bf
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x410a67
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x218]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x410a55
mov dword [esp + 0x10], eax
jmp 0x410aa3
mov dword [esp + 0x28], 0x19c5a654
mov dword [esp + 0x30], 0x67215912
mov dword [esp + 0x30], 7
mov dword [esp + 0x1c], 0xfffffffc
mov eax, dword [esp + 0x28]
mov dword [esp + 0x30], eax
dec dword [esp + 0x1c]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffee
jne 0x410a73
lea ecx, [esp + 0x218]
call fcn.00401291
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x2c0]
mov ecx, dword [esp + 0x4c]
push eax
call fcn.004019a5
mov esi, eax
lea edi, [esp + 0xa8]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], 0xfffffffa
xor edi, edi
mov dword [esp + 0x20], 8
inc edi
mov dword [esp + 0x20], edi
xor eax, eax
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0xc], eax
jmp 0x410baf
mov dword [esp + 0x10], 9
xor edx, edx
mov dword [esp + 0x20], edi
mov esi, 0xa2c930f8
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
test ecx, ecx
push 0
setns dl
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
cmp edx, ecx
pop ecx
setne cl
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
sub ecx, 0xea3de81d
neg ecx
push 0
sbb ecx, ecx
inc ecx
sub esi, ecx
mov ecx, dword [esp + 0x10]
dec esi
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
mov ecx, dword [esp + 0x14]
setge dl
dec ecx
add edx, ecx
imul edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
cmp edx, ecx
pop ecx
setg cl
xor edx, edx
cmp ecx, edi
setl dl
xor ecx, ecx
cmp edx, 0xb72b
setle cl
mov dword [esp + 0x1c], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xb
jg 0x410b02
mov dword [esp + 0x1c], 0xfffffffe
cmp byte [ebp + 0xc], al
je 0x410ec1
cmp dword [esp + 0xac], eax
je 0x410ec1
push 3
mov dword [esp + 0x18], 0xfffffff8
mov dword [esp + 0x14], eax
pop esi
jmp 0x410bf9
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x40], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x410be9
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], eax
jl 0x410cfa
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], 0xffffffff
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + ecx*4 + 0x40]
imul edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x40], edx
mov ecx, dword [esp + 0x44]
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
je 0x410c76
mov dword [esp + 0x10], eax
jmp 0x410c61
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x294], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x410c4e
cmp dword [esp + 0x298], eax
jne 0x410cfa
jmp 0x410cf0
mov dword [esp + 0x1c], 0x589d
mov ecx, dword [esp + 0x14]
cmp dword [esp + ecx*4 + 0x40], eax
je 0x410c90
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
imul edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
add edx, 9
mov dword [esp + ecx*4 + 0x40], edx
xor ecx, ecx
cmp edx, edi
setne cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x10]
cmp ecx, dword [esp + 0x28]
setle dl
xor ecx, ecx
cmp edx, 0xbc62
setne cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x28], ecx
setge dl
mov dword [esp + 0x1c], edx
dec dword [esp + 0x14]
jns 0x410c11
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], eax
jl 0x410dc9
mov dword [esp + 0x20], 0x808adc70
mov dword [esp + 0x20], eax
jmp 0x410db4
mov dword [esp + 0x10], 0xfffffff6
mov dword [esp + 0x1c], 0xfffffff9
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x40], edx
mov dword [esp + 0x10], eax
jmp 0x410da9
mov dword [esp + 0x28], 0xf3bc9fc2
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0x20]
cmp dword [esp + ecx*4 + 0x40], edi
jle 0x410d71
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x40], edx
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
xor edx, edx
add ecx, 8
cmp ecx, edi
setl dl
cmp edx, dword [esp + 0x14]
jl 0x410d8d
mov ecx, edi
cmp dword [esp + 0x20], eax
jne 0x410d8f
mov ecx, eax
add ecx, 0x838a6d20
jne 0x410d9f
mov ecx, eax
cmp dword [esp + 0x1c], eax
je 0x410da1
mov ecx, edi
mov dword [esp + 0x28], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x410d43
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x410d1d
dec dword [esp + 0x14]
jns 0x410d0c
mov ecx, dword [esp + 0xb0]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x28], 8
mov dword [esp + 0x30], eax
mov dword [esp + 0xe0], ecx
lea ecx, [esp + 0x15c]
mov dword [esp + 0x1c], 0x921e124d
mov dword [esp + 0x10], eax
push esi
call fcn.004011bf
xor eax, eax
mov ecx, 0xcb314b81
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x24c], ecx
mov dword [esp + 0x250], ecx
mov dword [esp + 0x254], ecx
mov dword [esp + 0x258], ecx
mov dword [esp + 0x10], eax
jmp 0x410e4c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x15c]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x410e39
mov ecx, dword [esp + 0xc]
inc dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0x27213ec7
je 0x410e74
mov ecx, edi
cmp dword [esp + 0xc], eax
jne 0x410e76
mov ecx, eax
xor eax, eax
cmp ecx, 0xfffffffa
setle al
xor edx, edx
imul ecx, eax, 0xffff
mov eax, dword [esp + 0x28]
inc ecx
cmp ecx, eax
setg dl
neg edx
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x15c]
mov dword [eax], ecx
lea ecx, [esp + 0x15c]
dec dword [esp + 0x24]
call fcn.00401291
mov eax, dword [esp + 0xac]
mov dword [esp + 0xe4], eax
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], 0x2304b25b
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x1c], 0x272a727
mov dword [esp + 0xc], 0xfffffff9
push 4
call fcn.004011bf
xor esi, esi
mov dword [esp + 0x28], 0xa83a
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x1e0]
push 3
call fcn.004011bf
inc esi
xor eax, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], eax
jmp 0x410f2a
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1f0]
mov dword [ecx + edx*4], 0x456160cb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x410f14
mov dword [esp + 0x14], eax
jmp 0x410f4a
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x2b4], 0x5a9c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x410f37
mov dword [esp + 0x14], eax
jmp 0x410f6d
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1e0]
mov dword [ecx + edx*4], 0x24489be6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x410f57
cmp dword [esp + 0x10], eax
jne 0x410f86
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
xor edx, edx
sub ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x1e0]
setl dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0xc], eax
inc dword [esp + 0x20]
mov eax, dword [esp + 0x20]
sub dword [esp + 0xc], eax
call fcn.00401291
lea ecx, [esp + 0x1f0]
call fcn.00401291
test edi, edi
jne 0x4118ed
cmp dword [esp + 0xa4], edi
jle 0x4118ed
mov dword [esp + 0x1c], 0xf09c
xor eax, eax
mov dword [esp + 0x30], 0xef2c3654
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], 0x6e54ee87
mov dword [esp + 0x28], 0x7cfaf42
mov dword [esp + 0x28], 0xfffffffd
mov dword [esp + 0x10], 0x42477066
mov dword [esp + 0x24], 0xae65c342
mov dword [esp + 0xc], eax
jmp 0x411039
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x54], 0xab5457d6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x411029
mov dword [esp + 0xc], eax
jmp 0x411058
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x23c], 0xf204795e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x411045
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
dec esi
neg esi
push 0
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setle dl
xor ecx, ecx
cmp edx, 0xffffffff
setge cl
sub ecx, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
neg ecx
inc dword [esp + 0x248]
mov edi, dword [esp + 0x248]
mov edx, dword [esp + 0x20]
mov dword [esp + 0x58], edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x34]
cmp ecx, edx
mov edx, dword [esp + 0x24]
pop ecx
setl cl
add ecx, dword [esp + 0x28]
add edx, ecx
mov ecx, dword [esp + 0x24]
cmp edx, ecx
push 0
pop ecx
setge cl
xor edx, edx
imul ecx, edi
push 0
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x20]
cmp ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
setle dl
mov dword [esp + 0x2c], edx
xor edx, edx
cmp dword [esp + 0x2c], ecx
setle dl
xor ecx, ecx
xor edi, edi
inc edi
cmp edx, edi
setg cl
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
inc edx
add ecx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x28], 0xbeccce1e
mov dword [esp + 0x10], 6
mov dword [esp + 0x18], 0xf4399391
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], 0xc96c
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
sub edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
cmp ecx, edx
pop ecx
setg cl
xor edx, edx
neg ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x24]
setg dl
cmp ecx, edx
push 0
pop ecx
setle cl
sub ecx, 0x62a96950
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x24]
add ecx, dword [esp + 0x24]
je 0x41119e
mov dword [esp + 0x1c], 5
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], ecx
jmp 0x4112a0
mov dword [esp + 0x10], 7
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0x85ca7db
mov dword [esp + 0x30], 0x43ca3807
mov dword [esp + 0x20], eax
jmp 0x4111d0
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0x64], 0x5b872a60
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x4111c0
mov ecx, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x24]
sub esi, ecx
mov ecx, dword [esp + 0x1c]
cmp esi, ecx
push 0
setle dl
imul ecx, edx, 0xfffa
add ecx, 7
mov dword [esp + 0x68], ecx
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x28]
cmp ecx, edx
pop ecx
setle cl
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [esp + 0x14]
je 0x41121e
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
cmp ecx, 0xe5e2
mov ecx, dword [esp + 0x10]
setg dl
cmp edx, ecx
push 0
pop ecx
setl cl
sub ecx, 0xd594399
imul ecx, dword [esp + 0x14]
cmp ecx, 0x1183
jne 0x411264
mov edx, eax
cmp dword [esp + 0x64], eax
je 0x411266
mov edx, edi
mov ecx, dword [esp + 0x30]
add ecx, edx
cmp ecx, dword [esp + 0x24]
je 0x41127a
mov ecx, edi
cmp dword [esp + 0x24], eax
jne 0x41127c
mov ecx, eax
add ecx, 0x5d478cec
mov dword [esp + 0xc], ecx
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], al
je 0x4112a0
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor eax, eax
push 4
pop edi
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x18c]
mov dword [esp + 0x1c], 0xfffffffc
push edi
call fcn.004011bf
xor eax, eax
push 3
mov dword [esp + 0x10], eax
pop esi
jmp 0x4112d7
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x58], 0x8f69f7fd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x4112c7
mov dword [esp + 0xc], eax
jmp 0x4112f5
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x18c]
mov dword [ecx + edx*4], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x4112e3
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], al
je 0x41131c
push 0x19be
push 0x6b9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
sub ecx, 7
neg ecx
sbb ecx, ecx
add eax, 9
inc ecx
xor edx, edx
add eax, ecx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setl dl
mov dword [esp + 0x1c], edx
xor edx, edx
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x58]
cmp ecx, eax
mov ecx, dword [esp + 0x58]
setne dl
xor eax, eax
cmp edx, 0x6ec7
setne al
xor edx, edx
imul ecx, eax
mov eax, dword [esp + 0x5c]
cmp eax, ecx
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x18c]
setg dl
imul ecx, edx
mov dword [eax + 4], ecx
lea ecx, [esp + 0x18c]
call fcn.00401291
xor eax, eax
mov dword [esp + 0x10], 0xfffffff8
mov dword [esp + 0x10], eax
jmp 0x4113c0
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x148], 0x710dd01
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x4113ad
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x10], eax
jmp 0x4114ea
mov dword [esp + 0xc], 0x7013
lea ecx, [esp + 0x198]
mov dword [esp + 0x10], esi
mov dword [esp + 0x1c], 0x9f89
mov dword [esp + 0x24], 0x218670fc
push esi
call fcn.004011bf
xor eax, eax
mov dword [esp + 0x20], 0xf47073e7
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], esi
jge 0x411950
push dword [esp + 0x20]
lea ecx, [esp + 0x19c]
call fcn.004012ad
mov dword [eax], 5
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x41192e
xor eax, eax
mov ecx, dword [esp + 0x10]
xor edx, edx
cmp ecx, 0x2759951e
setne dl
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], eax
je 0x4119cb
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp esi, ecx
setl dl
cmp edx, 0xcbbbc254
jae 0x41198e
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x24]
mov esi, dword [esp + 0x10]
sub esi, ecx
mov ecx, dword [esp + 0x1c]
neg esi
push eax
sbb esi, esi
inc esi
sub esi, ecx
lea ecx, [esp + 0x19c]
call fcn.004012ad
mov dword [eax], esi
xor eax, eax
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], eax
je 0x4119cb
xor esi, esi
inc esi
jmp 0x4119cd
mov esi, eax
inc dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0x1c]
cmp esi, ecx
setge dl
sub edx, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x28], edx
xor edx, edx
cmp ecx, dword [esp + 0x28]
setge dl
mov dword [esp + 0x28], edx
mov byte [esp + 0x1b], al
cmp byte [esp + 0x1b], 0
je 0x411a14
push eax
push eax
push 0x1f09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
lea ecx, [esp + 0x198]
call fcn.00401291
lea ecx, [esp + 0xa4]
call fcn.0040360b
push 2
pop esi
push esi
lea ecx, [esp + 0xc4]
call fcn.004011bf
mov dword [esp + 0x10], 0xf93f8de9
lea ecx, [esp + 0x150]
push esi
call fcn.004011bf
movdqa xmm0, xmmword [0xa64c20]
lea eax, [esp + 0x26c]
push eax
lea eax, [esp + 0x260]
mov dword [esp + 0x20], 0x1885a1ec
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x2b0]
push eax
movdqu xmmword [esp + 0x264], xmm0
call fcn.004012bf
push ecx
lea ecx, [esp + 0x140]
push dword [eax + 4]
push dword [eax]
call fcn.0040126b
mov dword [esp + 0x1c], 0x4c5f6b4a
xor eax, eax
mov dword [esp + 0x30], 0xb265
mov dword [esp + 0x1c], 0x5cd4dcd7
mov dword [esp + 0x10], 0xd98c6833
mov dword [esp + 0x20], 0x1323
mov dword [esp + 0x1c], 0x4cec8e44
mov dword [esp + 0x14], eax
jmp 0x411ae8
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x50], 0xfff9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x411ad8
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], esi
jge 0x411b18
push dword [esp + 0x14]
lea ecx, [esp + 0xc4]
call fcn.004012ad
or dword [eax], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x411af9
xor eax, eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], esi
jge 0x411b44
push dword [esp + 0x14]
lea ecx, [esp + 0x154]
call fcn.004012ad
mov dword [eax], 0x121f2059
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x411b22
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x411b5d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x288], 0xad94
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x411b4a
push 1
lea ecx, [esp + 0xc4]
call fcn.004012ad
and dword [eax], 0
mov byte [esp + 0x1b], 0
cmp byte [esp + 0x1b], 0
je 0x411b95
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
push 1
lea ecx, [esp + 0xc4]
call fcn.004012ad
dec dword [eax]
jns 0x411b75
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0xc0]
push 1
call fcn.004012ad
mov edi, eax
lea ecx, [esp + 0xc0]
xor esi, esi
mov dword [esp + 0x28], edi
push esi
call fcn.004012ad
mov ecx, 0x839bf5bf
push 1
cmp ecx, dword [eax]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [edi]
lea ecx, [esp + 0x154]
setl dl
mov dword [esp + 0x14], edx
call fcn.004012ad
mov edx, dword [esp + 0x50]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
xor eax, eax
cmp ecx, edx
mov ecx, dword [esp + 0x24]
setne al
xor edx, edx
imul eax, dword [ecx]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
cmp ecx, dword [edi]
setne dl
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], esi
je 0x411c3b
push 3
lea ecx, [esp + 0x140]
call fcn.004012ad
cmp dword [eax], esi
je 0x411c3b
xor ecx, ecx
inc ecx
jmp 0x411c3d
mov ecx, esi
xor eax, eax
cmp ecx, dword [edi]
push 3
sete al
lea ecx, [esp + 0x140]
mov dword [esp + 0x20], eax
call fcn.004012ad
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
inc ecx
mov eax, dword [edi]
add ecx, edx
mov edi, dword [esp + 0xc]
xor edx, edx
cmp ecx, dword [edi]
mov edi, dword [esp + 0x28]
setge dl
sub edx, 0xc3f
neg edx
sbb edx, edx
inc edx
imul edx, eax
test edx, edx
je 0x411c8f
test eax, eax
je 0x411c8f
xor esi, esi
inc esi
push 2
lea ecx, [esp + 0x140]
call fcn.004012ad
xor edx, edx
lea ecx, [esi - 0xeceb]
cmp ecx, 0xb115
setge dl
cmp edx, dword [eax]
jl 0x411cbf
xor eax, eax
cmp dword [esp + 0x1c], eax
je 0x411cc1
xor ecx, ecx
inc ecx
jmp 0x411cc3
xor eax, eax
mov ecx, eax
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], eax
je 0x411cd8
cmp dword [esp + 0x10], eax
je 0x411cd8
xor ecx, ecx
inc ecx
jmp 0x411cda
mov ecx, eax
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], eax
je 0x411ce8
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0xc]
xor ecx, ecx
cmp dword [esi], eax
setne cl
cmp dword [esp + 0x50], ecx
je 0x411d08
cmp dword [esp + 0x10], eax
je 0x411d08
xor ecx, ecx
inc ecx
jmp 0x411d0a
mov ecx, eax
xor eax, eax
cmp ecx, 0xffffffff
setg al
xor edx, edx
imul eax, dword [edi]
cmp eax, 2
mov eax, dword [esp + 0x20]
setle dl
sub edx, dword [esi]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [esp + 0x24]
sete cl
xor eax, eax
cmp ecx, dword [edx]
setl al
xor esi, esi
xor edx, edx
inc esi
cmp eax, esi
mov eax, dword [esp + 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
mov dword [edi], edx
setne cl
add ecx, dword [esp + 0x20]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x13c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x290], eax
call fcn.00401291
lea ecx, [esp + 0x150]
call fcn.00401291
lea ecx, [esp + 0xc0]
call fcn.00401291
mov edi, dword [esp + 0x2c]
test edi, edi
je 0x411f5a
mov dword [esp + 0x20], 0xfffffffb
xor eax, eax
mov dword [esp + 0x28], 7
mov dword [esp + 0xc], eax
jmp 0x411dbc
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x38], 0xbdde0bcd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x411dac
mov dword [esp + 0xc], eax
jmp 0x411dd7
cmp dword [esp + 0xc], 2
jl 0x411dc8
mov eax, dword [ebp + 8]
lea esi, [esp + 0xdc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret