Function at 0x1004c7e7
Capabilities:
Create pipe
Get disk information
Identify system language via api
Start service

Disassembly:
mov eax, 0x1007190c
call fcn.100700e8
sub esp, 0x1cc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 2
pop edi
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x28], 0xd86e52d8
mov dword [ebp - 0x44], 0x4475ee4c
push edi
mov byte [ebp - 0x54], dl
call fcn.10018406
xor ebx, ebx
lea ecx, [ebp - 0x15c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x3c], 0xfcc8
mov dword [ebp - 0x18], 0x674f9af3
push 3
call fcn.10018406
push 3
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 1
call fcn.10018406
xor esi, esi
mov dword [ebp - 0x30], ebx
inc esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x20], ebx
jmp 0x1004c872
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 0xe33a79cc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1004c85f
push 3
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x1004c88e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x15c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1004c87f
mov dword [ebp - 0x20], ebx
jmp 0x1004c8a7
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1004c898
inc dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x138]
push 0
mov dword [eax + 4], ebx
mov eax, dword [ebp - 0x5c]
test eax, eax
mov edx, dword [ebp - 0x18]
setns cl
sub edx, ecx
sub edx, 0x37eebdc1
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x15c]
pop edx
setle cl
neg ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
setne dl
sub edx, eax
xor ecx, ecx
mov eax, dword [ebp - 0x168]
cmp edx, 0x7f4
setge cl
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, 0xb1220059
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp esi, eax
mov eax, dword [ebp - 0x5c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x44], 6
call fcn.10018488
lea ecx, [ebp - 0x15c]
call fcn.10018488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.10018488
mov dword [ebp - 0x20], 0xaccb24ce
or eax, 0xffffffff
mov dword [ebp - 0x24], 0xf451d52a
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xfff6
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x44], 0x61f3
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, esi
setge cl
imul ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, 0xffffffff
setge dl
xor ecx, ecx
add edx, 9
cmp eax, edx
setle cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], edi
jne 0x1004c9dd
mov ecx, ebx
cmp dword [ebp - 0x20], ebx
je 0x1004c9df
mov ecx, esi
mov eax, dword [ebp - 0x20]
xor edx, edx
dec ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, esi
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp eax, ecx
setle dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
cmp edx, 7
jg 0x1004ca27
cmp dword [ebp - 0x1c], ebx
jne 0x1004ca29
mov esi, ebx
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
imul edx, esi
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x20], ecx
inc edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0x28], 0xac36
jg 0x1004cb55
cmp dword [ebp - 0x1c], ebx
je 0x1004cb55
mov dword [ebp - 0x18], ebx
jmp 0x1004ca77
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x6c], 0x191d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1004ca69
mov dword [ebp - 0x1c], 0x10
jmp 0x1004cb46
mov dword [ebp - 0x38], 0x36fe
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], ebx
jl 0x1004cb43
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], ebx
jmp 0x1004cb31
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x6c], ebx
jne 0x1004caba
mov esi, ebx
cmp dword [ebp - 0x20], ebx
je 0x1004cabc
mov esi, edx
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x28], edx
neg ecx
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
neg ecx
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp esi, ecx
setle dl
sub edx, eax
mov eax, dword [ebp - 0x24]
sub edx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0x40], edx
xor edx, edx
cmp dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x6c]
cmp edx, eax
mov eax, dword [ebp - 0x6c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
mov dword [ebp - 0x40], edx
mov edx, dword [ebp + eax*4 - 0x6c]
imul edx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x2c]
inc edx
cmp dword [ebp - 0x2c], edx
jle 0x1004caaa
dec dword [ebp - 0x24]
jns 0x1004ca9b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x16
jne 0x1004ca88
jmp 0x1004cc70
mov dword [ebp - 0x3c], 0xc5f7c0cb
mov dword [ebp - 0x48], 0xfffffff9
mov dword [ebp - 0x48], 0xc4cae1fa
mov dword [ebp - 0x48], ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004cb80
push ebx
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
xor edx, edx
inc edx
mov dword [ebp - 0x1c], ebx
jmp 0x1004cc66
mov dword [ebp - 0x24], ebx
jmp 0x1004cb97
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x80], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1004cb8d
mov dword [ebp - 0x24], ebx
jmp 0x1004cbb2
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x180], 0xfffffffc
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x1004cba1
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], edx
jg 0x1004cc60
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x18], ebx
jmp 0x1004cbdc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1004cbcf
cmp dword [ebp - 0xbc], 0xc6dea280
mov eax, dword [ebp - 0x7c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0xc4]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0xc4]
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x7c]
cmp edx, eax
mov eax, dword [ebp - 0x7c]
setg cl
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x2c]
setge dl
imul ecx, edx
xor edx, edx
inc edx
mov dword [ebp + eax*4 - 0x80], ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jle 0x1004cbc3
push 2
pop edi
dec dword [ebp - 0x44]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffe
jl 0x1004cb88
mov dword [ebp - 0x1c], ebx
xor esi, esi
mov dword [ebp - 0x2c], ebx
inc esi
mov dword [ebp - 0x3c], 0xca44
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xfffffffe
jle 0x1004ce41
mov dword [ebp - 0x34], 0x5a136951
lea ecx, [ebp - 0x150]
push 4
call fcn.10018406
mov dword [ebp - 4], edi
mov dword [ebp - 0x24], ebx
jmp 0x1004ccba
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xf0], 0xfffffffb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1004cca9
mov dword [ebp - 0x24], ebx
jmp 0x1004ccd7
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0x848298bb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x1004ccc4
mov dword [ebp - 0x34], 0xffffffe7
cmp dword [ebp - 0x34], 0xfffffff9
jle 0x1004ce2a
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x30], 0x44401d1b
mov dword [ebp - 0x28], 0xffffffe9
cmp dword [ebp - 0x28], 0xfffffff0
jge 0x1004cdd6
mov edi, dword [ebp - 0x150]
mov dword [ebp - 0x30], 0xfffffff8
lea ecx, [ebp - 0xd0]
push 4
call fcn.10018406
mov dword [ebp - 0x18], ebx
jmp 0x1004cd3f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1004cd2c
mov dword [ebp - 0x2c], 0x6a37
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
cmp eax, 0xfffffffb
mov edx, dword [ebp - 0xd0]
setl cl
xor eax, eax
test ecx, ecx
sete al
mov dword [edx + 0xc], ecx
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xf0], ebx
je 0x1004cd84
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xd76c
setg cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [edx + 0xc]
neg eax
je 0x1004cdb1
mov eax, dword [ebp - 0xd0]
mov ecx, esi
cmp dword [eax + 8], ebx
jne 0x1004cdb3
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffff8
lea ecx, [ebp - 0xd0]
setl al
mov dword [edi + 0xc], eax
call fcn.10018488
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffff0
jl 0x1004cd13
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004ce1a
push ebx
push 0x23e9
push ebx
push ebx
push 0x139a
push 0x2068
push 0xced
push 0x1409
push 0x1fb0
push 0x2c3
push 0x1f3e
push 0x1eb0
push 0x1d90
call dword [sym.imp.GDI32.dll_StretchDIBits]
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xfffffff9
jg 0x1004ccee
push 2
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10018488
dec dword [ebp - 0x1c]
jmp 0x1004cc83
cmp dword [ebp - 0x1c], 0xbc0ae227
ja 0x1004ce51
mov eax, esi
cmp dword [ebp - 0x2c], ebx
jne 0x1004ce53
mov eax, ebx
mov ecx, dword [ebp - 0x2c]
xor edx, edx
add ecx, eax
imul ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x4f5fdfda
setl dl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], edx
xor edx, edx
cmp dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xbae54fd5
sbb eax, eax
neg eax
neg eax
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [0x100778dc]
mov dword [ebp - 0x18], 0x5d6c05ba
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x18], edi
jmp 0x1004ced4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004ced1
push 0x1fbf
call dword [sym.imp.USER32.dll_IsIconic]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe9
jge 0x1004cebd
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], 0x27de
cmp dword [ebp - 0x3c], 0x298e
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
jle 0x1004cf29
mov edi, ebx
mov dword [ebp - 0x38], ebx
mov eax, edi
mov ecx, 0x10618cd8
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.100180fd
inc ebx
cmp ebx, 0x2689
jl 0x1004cefd
inc edi
push 0
pop ebx
cmp edi, 0x600a
jl 0x1004cefa
push 2
pop edi
mov dword [ebp - 0x28], 0x462d5e48
lea ecx, [ebp - 0x114]
push edi
call fcn.10018406
mov dword [ebp - 0x30], 0xf5e4d8d9
mov dword [ebp - 0x18], ebx
jmp 0x1004cf57
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1004cf48
mov dword [ebp - 0x28], 0xfffffffd
jmp 0x1004cfbc
mov dword [ebp - 0x18], 0x30cc
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x114]
cmp ecx, dword [eax]
jl 0x1004cf9d
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x38], ebx
jne 0x1004cfac
mov ecx, ebx
cmp dword [ebp - 0x30], ebx
je 0x1004cfae
mov ecx, esi
xor eax, eax
cmp ecx, 0xffffffff
setge al
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffe8
jge 0x1004cf65
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004cfe1
push ebx
push 0x59b
push 0xf64
push 0x79e
call dword [sym.imp.GDI32.dll_SetPixel]
lea ecx, [ebp - 0x114]
call fcn.10018488
mov dword [ebp - 4], 3
cmp dword [ebp - 0x3c], 0x2704
jge 0x1004d029
mov edx, 0x100092a8
mov ecx, 0x10618cd8
call fcn.1001ae02
jmp 0x1004d029
or dword [ebp - 4], 0xffffffff
xor eax, eax
mov ecx, dword [ebp - 0x5c]
inc eax
cmp byte [ebp - 0x54], 0
push 2
pop esi
je 0x1004d123
cmp ecx, eax
jne 0x1004d123
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009540]
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1b4]
mov dword [ebp - 0xa4], ebx
push eax
push ebx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0xa0], ebx
movdqu xmmword [ebp - 0x1b4], xmm0
mov dword [ebp - 0x9c], ebx
call fcn.1001b4de
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], 0xfffffff8
push 3
call fcn.10018406
xor edi, edi
inc edi
push 3
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1004d0c6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0xe948708e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1004d0b3
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1004d0f3
mov edx, dword [ebp - 0x120]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [edx + 8], eax
dec dword [ebp - 0x18]
jns 0x1004d0d9
dec dword [ebp - 0x3c]
lea ecx, [ebp - 0x120]
call fcn.10018488
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa4]
call fcn.10018488
mov eax, dword [ebp + 8]
mov dword [eax + 8], 4
mov dword [eax + 0xc], 0x100778dc
jmp 0x1004d126
xor edi, edi
inc edi
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x5c]
jge 0x1004dcc8
mov dword [ebp - 0x48], 0xffffffff
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
mov dword [ebp - 0x2c], 0x100778e0
je 0x1004d152
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRegionData]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004d164
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp dword [ebp - 0x4c], 0
mov dword [ebp - 0x38], ebx
jle 0x1004d826
mov eax, 0x100778e0
mov eax, dword [eax]
lea ecx, [ebp - 0x1a4]
push 3
pop edi
mov dword [ebp - 0x44], 0x76ac116e
push edi
mov dword [ebp - 0x48], eax
call fcn.10018406
mov eax, 0x6dd75471
xor edx, edx
mov dword [ebp - 0x198], eax
inc edx
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
mov dword [ebp - 0x20], ebx
jmp 0x1004d1c0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x58], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1004d1b6
mov dword [ebp - 0x20], ebx
jmp 0x1004d1db
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x12c], 0x1d12
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1004d1ca
mov dword [ebp - 0x20], ebx
jmp 0x1004d1f8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1a4]
mov dword [eax + ecx*4], 0xde30ea3b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1004d1e5
push 0xfffffffffffffff7
pop edi
mov dword [ebp - 0x58], ebx
cmp dword [ebp - 0x58], edi
jl 0x1004d376
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x60], 0x9d8e7dfb
mov dword [ebp - 0x60], 8
mov dword [ebp - 0x3c], ebx
cmp dword [ebp - 0x58], ebx
je 0x1004d2be
mov dword [ebp - 0x24], 0xe446df3
mov dword [ebp - 0x40], 0x99da9727
mov dword [ebp - 0x24], ebx
jmp 0x1004d264
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004d261
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe3
je 0x1004d251
mov dword [ebp - 0x24], ebx
jmp 0x1004d2b4
mov dword [ebp - 0x18], 0xfe662db8
mov dword [ebp - 0x30], 6
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
neg eax
je 0x1004d28a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x58]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x415e40c8
setge al
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jge 0x1004d26f
jmp 0x1004d364
mov dword [ebp - 0x28], 7
mov dword [ebp - 0x40], 0xfffffffa
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004d2e1
push ebx
push 0x7b8
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], esi
jg 0x1004d364
mov dword [ebp - 0x30], 1
xor edx, edx
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x12c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x12c]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setne dl
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
imul ecx, dword [ebp + eax*4 - 0x12c]
mov dword [ebp - 0x40], ecx
mov ecx, 0xc81b9349
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], 0x668f781b
mov eax, dword [ebp - 0x30]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xda8f9e1
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1004d2e9
xor ebx, ebx
dec dword [ebp - 0x3c]
dec dword [ebp - 0x58]
push 1
pop edx
cmp dword [ebp - 0x58], edi
jge 0x1004d20c
mov ecx, ebx
cmp dword [ebp - 0x44], ebx
je 0x1004d37f
mov ecx, edx
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0x1a4]
setl al
inc eax
mov dword [ebp - 0x58], eax
call fcn.10018488
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x8c]
add eax, 4
mov dword [ebp - 0x2c], eax
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
xor eax, eax
mov dword [ebp - 0x40], 0xfffffff6
inc eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0x3c], 0xb457102d
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xe814
mov dword [ebp - 0x50], 0x33843046
mov dword [ebp - 0x24], edi
push eax
call fcn.10018406
mov dword [ebp - 0x44], 0xcaad901
or edx, 0xffffffff
mov dword [ebp - 0x30], edx
xor edi, edi
mov dword [ebp - 0x50], ebx
inc edi
mov dword [ebp - 0x28], ebx
jmp 0x1004d401
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1004d3f2
dec dword [ebp - 0x44]
mov dword [ebp - 0x24], ebx
jmp 0x1004d623
mov dword [ebp - 0x1c], 0xb416c28c
mov dword [ebp - 0x34], 0x69d0
mov dword [ebp - 0x28], ebx
jmp 0x1004d435
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x108], 0xe06dcf8e
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1004d424
cmp dword [ebp - 0x18], ebx
je 0x1004d44e
mov edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], edx
mov ecx, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x1c]
dec eax
add ecx, eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
imul eax, ecx, 0x2728
test eax, eax
jne 0x1004d478
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], 0xba2d3c5e
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jg 0x1004d620
push 4
pop ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x34], ebx
jmp 0x1004d4b5
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x100], 6
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jl 0x1004d4a4
mov eax, dword [ebp - 0x44]
xor edx, edx
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x8c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ecx + esi*4]
mov eax, dword [ebp - 0x8c]
setl dl
xor ecx, ecx
cmp dword [eax + edi*4], edx
setg cl
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [eax + ecx*4]
add ecx, dword [eax]
mov eax, dword [ebp - 0x1c]
imul eax, ecx
xor ecx, ecx
cmp eax, 0x593b
setge cl
xor eax, eax
cmp dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x24]
setne al
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x8c]
setg dl
xor edi, edi
inc edi
mov dword [eax + ecx*4], edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], 0x36
jge 0x1004d611
mov dword [ebp - 0x20], 5
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, edi
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, edi
push 0
setg cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0xb8]
sub edx, eax
mov dword [ebp - 0x104], edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
pop eax
setg al
sub eax, edx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xfc]
cmp dword [ebp - 0x64], eax
mov edx, dword [ebp - 0x30]
setg cl
imul edx, ecx
add edx, dword [ebp - 0x3c]
imul edx, dword [ebp - 0x50]
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, 0x6a9c
jge 0x1004d5c1
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0xfc]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x108]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, 3
setne al
xor ecx, ecx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0xf4]
cmp dword [ebp - 0x64], eax
sete cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xfc]
cmp ecx, eax
setg dl
mov dword [ebp - 0x64], edx
inc dword [ebp - 0x34]
jmp 0x1004d527
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], ebx
jle 0x1004d499
push 2
pop esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1004d411
lea ecx, [ebp - 0x8c]
call fcn.10018488
add dword [ebp - 0x2c], 4
mov dword [ebp - 0x18], 0x4039
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x50], 6
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x50], 0x779e46ed
mov dword [ebp - 0x50], 0x7f0d3066
mov dword [ebp - 0x50], 0xf5ead4a2
mov dword [ebp - 0x50], 0xd40f69ff
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x24], ebx
jmp 0x1004d68e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xe8], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1004d67d
mov dword [ebp - 0x24], ebx
jmp 0x1004d6aa
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1bc], 0xeba6e321
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x1004d699
xor edx, edx
cmp dword [ebp - 0x18], ebx
je 0x1004d75c
mov dword [ebp - 0x28], 0x86e8
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
or eax, 0xffffffff
sub edx, dword [ebp - 0x24]
add edx, dword [ebp - 0x28]
cmp eax, edx
mov eax, dword [ebp - 0x18]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setge dl
cmp edx, dword [ebp - 0x24]
je 0x1004d70d
cmp dword [ebp - 0x18], ebx
je 0x1004d714
mov eax, edi
cmp dword [ebp - 0x28], ebx
jne 0x1004d716
mov eax, ebx
cmp dword [ebp - 0x28], eax
jne 0x1004d720
cmp dword [ebp - 0x24], ebx
je 0x1004d72a
cmp dword [ebp - 0x30], ebx
jne 0x1004d72e
cmp dword [ebp - 0x24], ebx
jne 0x1004d72e
mov eax, ebx
jmp 0x1004d730
mov eax, edi
xor edx, edx
test eax, eax
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004d801
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1004d801
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x50], 0x74d2ad05
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setle dl
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ebx
jmp 0x1004d7f8
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x30], ebx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xe8], ebx
je 0x1004d7b3
mov eax, dword [ebp - 0x1c]
mov edx, edi
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jg 0x1004d7b5
mov edx, ebx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xe8]
mov eax, dword [ebp - 0x34]
add eax, edx
xor edx, edx
cmp ecx, eax
setg dl
add edx, 8
je 0x1004d7d7
mov eax, edi
cmp dword [ebp - 0x40], ebx
jne 0x1004d7d9
mov eax, ebx
imul eax, eax, 6
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x50], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1004d77c
dec dword [ebp - 0x44]
cmp dword [ebp - 0x60], 0
mov eax, dword [ebp - 0x2c]
jne 0x1004d810
add eax, 8
add eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], ecx
cmp ecx, dword [ebp - 0x4c]
jl 0x1004d176
mov dword [ebp - 0x24], 0x68206240
mov dword [ebp - 0x18], 0xeb59008c
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x4c], 0xad5
cmp dword [ebp - 0x4c], 0xe9b
jle 0x1004d8b0
push 0x2d
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x40], 0x6ee4
mov dword [ebp - 0x38], eax
cdq
lea ecx, [ebp - 0x1d4]
push edx
push eax
call fcn.1000ab3e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1004d87a
mov eax, dword [eax]
push eax
call fcn.10058ec3
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x1d4]
call fcn.10018bc0
mov eax, dword [ebp - 0x38]
add eax, esi
dec dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
jne 0x1004d862
inc esi
cmp esi, 0x4675
jl 0x1004d856
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 2
pop esi
mov dword [ebp - 0x24], ebx
jmp 0x1004d8cb
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004d8c8
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
jne 0x1004d8b5
cmp dword [ebp - 0x4c], 0x745
jge 0x1004d8e5
push 0x100092e0
call fcn.10058ec3
pop ecx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], ebx
jne 0x1004d8f1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
push 0xfffffffffffffffd
pop ecx
cmp ecx, eax
push 3
sbb eax, eax
xor ecx, ecx
add eax, 0xfffffffc
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x38], edi
mov eax, dword [ebp - 0x38]
cmp eax, 0x42b9193c
mov eax, dword [ebp - 0x2c]
setle cl
imul ecx, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xdc]
call fcn.10018406
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1004d950
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 0xdc85f70a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1004d93d
mov dword [ebp - 0x28], ebx
jmp 0x1004d97a
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xdc]
cmp dword [eax + ecx*4], ebx
jne 0x1004d97f
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xdc]
cmp dword [eax + ecx*4], ebx
jne 0x1004d97f
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1004d95b
lea ecx, [ebp - 0xdc]
call fcn.10018488
add dword [ebp - 0x2c], 4
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x4c], 0xee61780e
push edi
call fcn.10018406
mov dword [ebp - 0x20], ebx
jmp 0x1004d9c0
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1004d9ad
mov dword [ebp - 0x20], ebx
jmp 0x1004d9db
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x188], 0x43e2f7c6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1004d9ca
mov dword [ebp - 0x20], ebx
jmp 0x1004d9f6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x170], 0x8dc5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1004d9e5
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
sub eax, 8
inc edx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setle cl
xor edx, edx
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x1004da5f
mov ecx, ebx
cmp dword [ebp - 0x4c], ebx
je 0x1004da61
mov ecx, edi
mov eax, dword [ebp - 0x1c]
neg ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x98]
setne dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x4c]
cmp edx, eax
setge cl
mov dword [ebp - 0x184], ecx
mov eax, dword [ebp - 0x1c]
imul eax, ecx
test eax, eax
jne 0x1004da92
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x98]
cmp dword [eax], ebx
je 0x1004dac4
mov dword [ebp - 0x38], 0xabf8b243
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004dabf
push ebx
push ebx
push 0xdd0
push 0x1780
push ebx
call dword [sym.imp.USER32.dll_ModifyMenuW]
dec dword [ebp - 0x38]
jmp 0x1004dad7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004dad7
push edi
push ebx
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, dword [ebp - 0x98]
xor edx, edx
cmp dword [eax], 0xfffffff8
mov eax, dword [ebp - 0x170]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x98]
setge cl
mov dword [eax], ecx
lea ecx, [ebp - 0x98]
call fcn.10018488
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x144]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x1c], 0xffff
mov dword [ebp - 0x38], 0xdca1a1f0
mov dword [ebp - 0x60], eax
call fcn.10018406
mov dword [ebp - 0x48], 0xbbb66efe
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x48], 0x14ba09a1
mov dword [ebp - 0x18], ebx
jmp 0x1004db54
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0x6e74a6e8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1004db41
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
xor ecx, ecx
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x1c]
jge 0x1004db81
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
test eax, eax
mov edx, dword [ebp - 0x144]
setne cl
mov dword [edx + 4], eax
imul eax, ecx, 0xe4b9
xor ecx, ecx
cmp dword [edx], 0x4489b467
setle cl
xor edx, edx
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
add eax, 0x154d1983
add ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
mov dword [ebp - 0x38], edx
xor edx, edx
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
lea ecx, [ebp - 0x144]
setge dl
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
call fcn.10018488
cmp dword [ebp - 0x60], 0
mov ecx, dword [ebp - 0x2c]
jne 0x1004dcc8
cmp byte [ebp - 0x54], 0
mov esi, dword [ebp - 0x34]
je 0x1004dc18
cmp dword [ebp - 0x5c], edi
jne 0x1004dc18
mov edx, dword [ebp + 8]
lea eax, [esi + 0x10]
add dword [edx + 8], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x38], eax
mov eax, dword [ecx + 8]
add ecx, 0xc
push esi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x2c], ecx
call fcn.10054314
pop ecx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x78]
lea eax, [ebp - 0xb4]
mov dword [ebp - 0xb4], ebx
push eax
push esi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
call fcn.100527e6
mov ecx, dword [ebp - 0x78]
mov edx, ebx
mov dword [ebp - 0x40], edx
test esi, esi
jle 0x1004dca9
mov eax, edx
and eax, 0x80000001
jns 0x1004dc6d
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x38]
add eax, edx
add eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x48]
jmp 0x1004dc82
lea eax, [edx + 1]
cdq
idiv esi
cmp word [ecx + edx*2], bx
jne 0x1004dc7f
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x4c]
mov word [ecx + edx*2], di
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x40]
mov byte [edx + esi], al
inc edx
mov esi, dword [ebp - 0x34]
mov dword [ebp - 0x40], edx
cmp edx, esi
jl 0x1004dc5f
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x4c]
mov dword [edx], esi
mov dword [edx + 4], eax
test ecx, ecx
je 0x1004dcc8
push ecx
call fcn.10059099
pop ecx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x18], ebx
jmp 0x1004dce1
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xb0], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1004dcd0
mov dword [ebp - 0xa8], ebx
jmp 0x1004dd28
mov dword [ebp - 0x18], ebx
jmp 0x1004dd05
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x17c], 0x3eb905d0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1004dcf4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004dd1c
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
inc dword [ebp - 0x17c]
inc dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], 0x1c
jl 0x1004dcef
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret