Function at 0x10045c1a
Capabilities:
Create process on windows
Delete file
Enumerate gui resources
Resume thread
Set environment variable

Disassembly:
mov eax, 0x10069765
call fcn.100682c0
sub esp, 0x20c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xca4f833f
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x1c], 0xffff
push edi
mov byte [ebp - 0x49], dl
inc ecx
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x10], ebx
jmp 0x10045c65
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xec], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10045c54
mov dword [ebp - 0x10], ebx
jmp 0x10045c80
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x174], 0x6f65e790
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10045c6f
inc dword [ebp - 0x1c]
push 3
mov dword [ebp - 0x1c], ebx
pop edi
jmp 0x10045ccb
mov dword [ebp - 0x34], 0xc9ca3191
mov dword [ebp - 0x48], 9
mov dword [ebp - 0x18], ebx
jmp 0x10045cb4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1e4], 0x74e80031
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10045ca3
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xec], ebx
jne 0x10045cd0
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10045c90
push 4
pop eax
push eax
lea ecx, [ebp - 0x14c]
call fcn.10020852
mov dword [ebp - 0x1c], 0xb51dba33
mov dword [ebp - 0x10], ebx
jmp 0x10045cfc
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1cc], 0x7dfa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10045ceb
push 4
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x10045d1c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10045d09
mov ecx, dword [ebp - 0x1c8]
mov eax, dword [ebp - 0x14c]
mov dword [eax + 0xc], ecx
mov dword [ebp - 0x1c], 7
jmp 0x10045d86
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xffffffe9
cmp dword [ebp - 0x20], ebx
jl 0x10045d83
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xffffffe6
jl 0x10045d6e
xor eax, eax
inc eax
mov dword [ebp - 0x48], eax
inc dword [ebp - 0x48]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe6
jge 0x10045d5f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10045d7e
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
inc dword [ebp - 0x20]
jns 0x10045d4c
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffec
jl 0x10045d39
lea ecx, [ebp - 0x14c]
call fcn.100208b4
mov edi, dword [ebp + 8]
mov eax, dword [0x1006e8bc]
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x18], 0x11
cmp dword [ebp - 0x18], 0xffffffe2
mov dword [ebp - 0x48], eax
mov dword [edi], ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
jle 0x10045e83
xor esi, esi
inc esi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x24], 0x36de
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], ebx
jmp 0x10045dee
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x140], 0xfb2c41ac
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10045ddd
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x3c]
jne 0x10045e06
mov edx, ebx
cmp dword [ebp - 0x18], ebx
je 0x10045e08
mov edx, esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
setne dl
mov dword [ebp - 0x24], edx
xor edx, edx
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, dword [ebp - 0x24]
setge al
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x24], eax
setge cl
xor eax, eax
cmp ecx, 0x23aaf5bf
setge al
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x13c]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10045e70
push 0x1cea
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe2
jg 0x10045dc8
mov esi, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x48]
cmp byte [ebp - 0x49], bl
je 0x10045fcb
xor edx, edx
inc edx
cmp eax, edx
jne 0x10045fcb
mov dword [ebp - 0x1c], 0x17b844a7
mov dword [ebp - 0x18], 0xefa1e1c5
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x20], 0xe6966ef3
mov dword [ebp - 0x10], ebx
jmp 0x10045ec9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc0], 0x32d38ca8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10045eb8
mov dword [ebp - 0x10], ebx
jmp 0x10045ee5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb0], 0x643747c9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10045ed4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jne 0x10045ef5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push 4
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x1c]
je 0x10045f1e
mov ecx, edx
cmp dword [ebp - 0x1c], ebx
jne 0x10045f20
mov ecx, ebx
xor eax, eax
cmp ecx, 0x4667120d
mov ecx, 0xd1d25bb0
setl al
cmp ecx, eax
mov ecx, 0x3248
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub ecx, eax
add ecx, dword [ebp - 0xc0]
jne 0x10045f55
cmp dword [ebp - 0x10], ebx
jne 0x10045f55
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, 0x7494
mov dword [ebp - 0xb0], ecx
mov eax, dword [ebp - 0xc0]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
cmp ecx, dword [ebp - 0xbc]
jne 0x10045f81
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x18]
inc edx
mov dword [ebp - 0xb0], edx
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp - 0xbc]
mov eax, dword [ebp - 0x20]
sub ecx, 0xfffffff9
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
sub eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x18]
cmp eax, edx
jg 0x10045fb9
mov eax, edx
cmp dword [ebp - 0x18], ebx
jne 0x10045fbb
mov eax, ebx
push 4
mov dword [ebp - 0x20], eax
pop eax
mov dword [edi + 8], eax
mov dword [edi + 0xc], 0x1006e8bc
cmp esi, dword [ebp - 0x48]
jge 0x10047002
push 0xfffffffffffffffd
pop esi
mov dword [ebp - 0x10], 0x469ad59e
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x20], esi
push 2
call fcn.10020852
mov dword [ebp - 4], ebx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x54], 0xfffffffb
mov dword [ebp - 0x2c], 0x15ca
cmp dword [ebp - 0x2c], 0x174a
jle 0x1004605d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x1fc]
cdq
push edx
push eax
call fcn.1000a566
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10046034
mov eax, dword [eax]
push eax
call fcn.10051696
pop ecx
xor eax, eax
lea ecx, [ebp - 0x1fc]
push ebx
inc eax
push eax
call fcn.10020bbe
inc esi
cmp esi, 0x1927
jl 0x10046016
inc edi
cmp edi, 0x780d
jl 0x10046014
push 3
mov dword [ebp - 0x10], ebx
pop esi
jmp 0x10046073
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x74], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10046065
cmp dword [ebp - 0x2c], 0x14e4
jge 0x1004608c
push 0x10008d10
call fcn.10051696
pop ecx
push 2
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x100460a7
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], 0x796
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10046094
push 4
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x100460c1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x218], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100460b4
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x10046238
mov esi, dword [ebp - 0x158]
xor edi, edi
inc edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x3c], edi
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x74], ebx
je 0x10046101
imul ecx, dword [ebp - 0x74], 0xcc91
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp + eax*4 - 0x74]
mov ecx, edi
jge 0x10046103
mov ecx, ebx
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x74]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
je 0x1004612a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x10]
xor edx, edx
push 0xfffffffffffffffd
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x74]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, dword [esi + 4]
setg al
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
sub ecx, 0x5cf0adc1
imul ecx, dword [ebp + eax*4 - 0x74]
pop eax
push 2
cmp eax, ecx
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
xor edx, edx
inc ecx
mov eax, dword [ebp + eax*4 - 0x74]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
sete dl
imul edx, dword [ebp + eax*4 - 0x74]
neg edx
sbb edx, edx
neg edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10046227
mov dword [ebp - 0x24], 0xfbc79a46
mov dword [ebp - 0x1c], ebx
jmp 0x100461c9
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x138], 3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100461b8
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x134]
imul ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
sub ecx, 0x1371ed4a
mov dword [ebp - 0x24], ecx
je 0x100461fa
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x74]
mov eax, dword [ebp - 0x44]
cmp dword [esi + 4], ebx
jne 0x10046215
mov ecx, ebx
cmp dword [ebp - 0x44], ebx
je 0x10046217
mov ecx, edi
mov eax, dword [ebp - 0x10]
add ecx, 0xec51
mov dword [ebp + eax*4 - 0x74], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x100461ac
dec dword [ebp - 0x10]
jns 0x100460db
push 3
pop esi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046248
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
call fcn.100208b4
mov dword [ebp - 0x10], 0xfffffffa
mov edi, 0x1006e8c0
mov dword [ebp - 0x1c], 0xf37fc033
mov dword [ebp - 0x2c], 0x4752e4a6
mov dword [ebp - 0x54], 0xff29c214
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x3c], 0x8fb0c4f3
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], ebx
jmp 0x1004629b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x130], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1004628a
mov dword [ebp - 0x24], 0x1b1d
cmp dword [ebp - 0x24], 0x7a1
jge 0x1004674a
lea eax, [ebp - 0x64]
push eax
push 0x10008c4c
call fcn.1005199d
pop ecx
pop ecx
lea eax, [ebp - 0x188]
mov dword [ebp - 0xac], ebx
push eax
push dword [ebp - 0x64]
xorps xmm0, xmm0
mov dword [ebp - 0xa8], ebx
lea ecx, [ebp - 0xac]
movlpd qword [ebp - 0x188], xmm0
mov dword [ebp - 0xa4], ebx
call fcn.1004ae1f
mov dword [ebp - 4], esi
lea eax, [ebp - 0xac]
push eax
push dword [ebp - 0x64]
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
call fcn.1004ae61
mov byte [ebp - 4], 5
cmp dword [ebp - 0xac], 0
je 0x1004634c
push dword [ebp - 0xac]
call fcn.10051807
pop ecx
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
or dword [ebp - 0x18], 0xffffffff
or dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x20], ecx
test eax, eax
jle 0x100463b2
mov dword [ebp - 0x44], ecx
mov edi, ebx
mov esi, ebx
test eax, eax
jle 0x100463a2
mov ebx, dword [ebp - 0x44]
mov ecx, dword [ebx]
lea eax, [ecx + esi*8]
push eax
push 0x10008d40
call fcn.1005199d
pop ecx
pop ecx
mov ecx, dword [ebx]
mov eax, dword [ecx + esi*8]
or eax, dword [ecx + esi*8 + 4]
jne 0x10046395
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x64]
inc esi
cmp esi, eax
jl 0x10046374
mov ecx, dword [ebp - 0x44]
xor ebx, ebx
inc edi
add ecx, 0xc
mov dword [ebp - 0x44], ecx
cmp edi, eax
jl 0x10046369
mov edi, 0x1006e8c0
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x88], ebx
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x84], ebx
push eax
lea ecx, [ebp - 0x88]
movlpd qword [ebp - 0x190], xmm0
mov dword [ebp - 0x80], ebx
call fcn.1004ae1f
mov byte [ebp - 4], 6
lea eax, [ebp - 0x180]
push eax
push dword [ebp - 0x64]
xorps xmm0, xmm0
mov dword [ebp - 0x94], ebx
lea ecx, [ebp - 0x94]
movlpd qword [ebp - 0x180], xmm0
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
call fcn.1004ae1f
mov esi, dword [ebp - 0x64]
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, ebx
movlpd qword [ebp - 0x28], xmm0
mov dword [ebp - 0x40], eax
test esi, esi
jle 0x10046537
mov ecx, dword [ebp - 0x34]
mov edi, esi
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x7c], ecx
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x78], ecx
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x44], ecx
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 0x68], ecx
mov ecx, dword [ebp - 0xcc]
mov dword [ebp - 0x60], edx
mov esi, ebx
test edi, edi
jle 0x10046515
mov ecx, dword [ecx]
mov edi, dword [ebp - 0x94]
mov eax, dword [ecx + esi*8]
add dword [edx], eax
mov eax, dword [ecx + esi*8 + 4]
adc dword [edx + 4], eax
mov edx, dword [ebp - 0x20]
mov ecx, dword [edx]
mov eax, dword [ecx + esi*8]
add dword [edi + esi*8], eax
mov eax, dword [ecx + esi*8 + 4]
adc dword [edi + esi*8 + 4], eax
mov edi, dword [ebp - 0x40]
cmp edi, esi
jne 0x1004649d
xor eax, eax
mov dword [ebp - 0x54], ebx
lea ecx, [eax + 1]
jmp 0x100464ae
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [edx]
push dword [ebp - 0x54]
push ecx
mov edx, dword [eax + esi*8]
mov eax, dword [eax + esi*8 + 4]
push eax
push edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x24], eax
call fcn.10055550
add dword [ebp - 0x78], eax
lea ecx, [esi + edi]
mov edi, dword [ebp - 0x64]
adc dword [ebp - 0x7c], edx
lea eax, [edi - 1]
cmp ecx, eax
jne 0x100464e2
xor eax, eax
mov ecx, ebx
inc eax
jmp 0x100464f0
xorps xmm0, xmm0
movlpd qword [ebp - 0x58], xmm0
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x58]
push ecx
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x34]
call fcn.10055550
add dword [ebp - 0x68], eax
mov ecx, dword [ebp - 0x20]
adc dword [ebp - 0x44], edx
inc esi
mov edx, dword [ebp - 0x60]
cmp esi, edi
jl 0x10046465
mov eax, dword [ebp - 0x40]
inc eax
add edx, 8
add ecx, 0xc
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x20], ecx
cmp eax, edi
jl 0x1004645b
mov esi, dword [ebp - 0x64]
mov edi, 0x1006e8c0
jmp 0x1004654f
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x68], eax
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x18], 0
mov byte [ebp - 0x11], cl
jne 0x10046561
mov eax, ecx
cmp esi, ecx
jg 0x10046563
mov eax, ebx
mov ecx, dword [ebp - 0x88]
mov ebx, dword [ebp - 0x18]
push 0
mov edx, dword [ecx + eax*8]
mov ecx, dword [ecx + eax*8 + 4]
mov eax, edx
mov dword [ebp - 0x60], edx
mov edx, dword [ebp - 0x88]
mov dword [ebp - 0x40], ecx
sub eax, dword [edx + ebx*8]
mov dword [ebp - 0x20], eax
sbb ecx, dword [edx + ebx*8 + 4]
mov edx, dword [ebp - 0x1c]
cmp ebx, edx
mov dword [ebp - 0x54], ecx
pop ebx
jne 0x100465a0
xor edx, edx
mov dword [ebp - 0x24], ebx
inc edx
jmp 0x100465b1
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x24], edx
mov edx, dword [ebp - 0x38]
push ecx
push eax
push dword [ebp - 0x24]
push edx
call fcn.10055550
add eax, dword [ebp - 0x78]
adc edx, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0x60]
jne 0x100465cc
cmp edx, dword [ebp - 0x40]
je 0x100465cf
mov byte [ebp - 0x11], bl
mov ecx, dword [ebp - 0x1c]
lea eax, [esi - 1]
add ecx, dword [ebp - 0x18]
cmp ecx, eax
jne 0x100465e3
xor eax, eax
mov ecx, ebx
inc eax
jmp 0x100465f1
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
push dword [ebp - 0x54]
push dword [ebp - 0x20]
push ecx
push eax
call fcn.10055550
add eax, dword [ebp - 0x68]
mov ecx, dword [ebp - 0x44]
adc edx, ecx
cmp eax, dword [ebp - 0x60]
jne 0x10046610
cmp edx, dword [ebp - 0x40]
je 0x10046614
mov cl, bl
jmp 0x10046617
mov cl, byte [ebp - 0x11]
mov eax, ebx
test esi, esi
jle 0x10046652
test cl, cl
je 0x10046652
cmp eax, dword [ebp - 0x18]
je 0x10046649
mov ebx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x60]
push 0
cmp dword [ebx + eax*8], edx
pop ebx
jne 0x10046650
mov ebx, dword [ebp - 0x88]
mov edx, dword [ebp - 0x40]
push 0
cmp dword [ebx + eax*8 + 4], edx
pop ebx
jne 0x10046650
inc eax
cmp eax, esi
jl 0x1004661d
jmp 0x10046652
mov cl, bl
mov ebx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
push 0
mov eax, dword [ebx + eax*8]
add eax, dword [ebp - 0x20]
mov ebx, dword [ebx + edx*8 + 4]
adc ebx, dword [ebp - 0x54]
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0x34], ebx
pop ebx
cmp eax, dword [ebp - 0x60]
jne 0x10046681
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x34], eax
je 0x10046683
mov cl, bl
mov eax, ebx
test esi, esi
jle 0x100466c4
test cl, cl
je 0x100466c4
cmp eax, dword [ebp - 0x1c]
je 0x100466bb
mov ebx, dword [ebp - 0x94]
mov edx, dword [ebp - 0x60]
push 0
cmp dword [ebx + eax*8], edx
mov edx, dword [ebp - 0x20]
pop ebx
jne 0x100466c2
mov edx, dword [ebp - 0x94]
mov ebx, dword [ebp - 0x40]
push 0
cmp dword [edx + eax*8 + 4], ebx
mov edx, dword [ebp - 0x20]
pop ebx
jne 0x100466c2
inc eax
cmp eax, esi
jl 0x10046689
jmp 0x100466c4
mov cl, bl
xor eax, eax
inc eax
cmp esi, eax
jne 0x100466d1
mov edx, eax
mov eax, ebx
jmp 0x100466e0
mov eax, dword [ebp - 0x54]
cmp eax, ebx
jg 0x100466e0
jl 0x100466de
cmp edx, ebx
ja 0x100466e0
mov cl, bl
test cl, cl
jne 0x100466e9
or edx, 0xffffffff
or eax, edx
push eax
push edx
push 0x10008d48
call fcn.10051696
mov eax, dword [ebp - 0x94]
add esp, 0xc
test eax, eax
je 0x1004671b
push eax
call fcn.10051807
pop ecx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov eax, dword [ebp - 0x88]
test eax, eax
je 0x1004673b
push eax
call fcn.10051807
pop ecx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcc]
call fcn.1004ac04
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1004675c
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp dword [ebp - 0x10], 0xe2bbef7d
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, 0xffffffff
setg cl
xor eax, eax
cmp ecx, edx
setl al
cmp eax, dword [ebp - 0x10]
jle 0x10046884
push 4
pop esi
push esi
lea ecx, [ebp - 0x11c]
call fcn.10020852
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x34], 0x2a6add33
mov dword [ebp - 0x20], ebx
jmp 0x100467cf
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 0x41145714
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x100467bc
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x11c]
cmp dword [ecx + 4], ebx
jne 0x100467f1
cmp dword [ebp - 0x10], ebx
jne 0x100467f1
xor esi, esi
mov edx, ebx
inc esi
jmp 0x100467f6
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [ecx + 4]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ecx + 4]
add eax, edx
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x11c]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x10]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x11721670
setle al
xor ecx, ecx
mov dword [ebp - 0x54], eax
mov edx, dword [ebp - 0x24]
sub edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setl cl
mov dword [ebp - 0x34], ecx
mov ecx, esi
mov eax, dword [ebp - 0x10]
sub ecx, eax
xor eax, eax
cmp ecx, 0x77d7
setge al
xor ecx, ecx
mov dword [ebp - 0x34], eax
imul eax, dword [ebp - 0x10], 0xffff
cmp eax, 0x81d2
setg cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x11c]
call fcn.100208b4
jmp 0x100469e1
mov dword [ebp - 0x40], 0x41911659
xor esi, esi
mov dword [ebp - 0x20], 0xc292
inc esi
mov dword [ebp - 0x54], 0xffff
mov dword [ebp - 0x1c], 0xffffffe7
cmp dword [ebp - 0x1c], 0xfffffffc
jg 0x1004695c
mov dword [ebp - 0x18], 0xcc114ff6
mov dword [ebp - 0x24], 0x2d78bea
mov dword [ebp - 0x34], 0xfffffff6
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100468f7
push ebx
push 0xae3
push 0x1c2e
push 0x70b
push 0x2d3
push 0x2552
push 0x6d1
push 0x6ea
push 0x55
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 0x18]
mov ecx, esi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub ecx, eax
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x40], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp eax, 0xe48c
setl cl
cmp ecx, 0xfffffffc
jge 0x10046929
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x130], ecx
inc dword [ebp - 0x1c]
jmp 0x100468a3
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
je 0x1004696e
mov ecx, esi
cmp dword [ebp - 0x40], ebx
jne 0x10046970
mov ecx, ebx
mov eax, dword [ebp - 0x20]
imul eax, ecx
test eax, eax
jne 0x1004697d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
cmp ecx, dword [ebp - 0x20]
je 0x10046991
mov edx, ebx
cmp dword [ebp - 0x3c], ebx
je 0x10046993
mov edx, esi
mov eax, dword [ebp - 0x130]
xor ecx, ecx
cmp eax, 0x20c2
setge cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, edx
setl cl
xor eax, eax
imul ecx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
cmp ecx, 0x7732
setne al
sub edx, eax
mov eax, dword [ebp - 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0xfffffffa
setne al
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x5c], 0
jle 0x10046cb2
push 3
pop esi
mov eax, dword [edi]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x18], 0xf
jmp 0x10046a0b
cmp dword [ebp - 0x18], ebx
jne 0x10046a11
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1b
jg 0x10046a03
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046a21
push ebx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
push 4
pop eax
add edi, eax
lea ecx, [ebp - 0xd8]
push esi
mov dword [ebp - 0x20], edi
mov eax, dword [edi]
mov dword [ebp - 0x44], eax
call fcn.10020852
mov dword [ebp - 4], 7
lea eax, [ebp - 0x1b0]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10008fe0]
lea ecx, [ebp - 0x104]
push eax
lea eax, [ebp - 0x1c0]
mov dword [ebp - 0x104], ebx
push eax
push ebx
movdqu xmmword [ebp - 0x1c0], xmm0
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
call fcn.10024680
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x24], 0x9d012742
mov dword [ebp - 0x10], ebx
jmp 0x10046aa3
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10046a93
mov dword [ebp - 0x10], ebx
jmp 0x10046abe
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x170], 0x1832d74
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10046aad
mov ecx, dword [ebp - 0xd8]
mov edi, dword [ebp - 0x104]
lea esi, [ecx + 8]
lea eax, [ecx + 4]
mov dword [esi], 0xffffffea
mov dword [ebp - 0x34], eax
mov eax, dword [esi]
xor edx, edx
add eax, dword [ecx]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], 0x6efe0cd1
mov dword [ebp - 0x2c], 6
mov dword [edi + 0xc], eax
cmp dword [esi], 0x456574b6
mov dword [ebp - 0x54], 0xfffffff9
mov dword [ebp - 0x24], 0x9879a925
setge dl
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
je 0x10046b2a
xor eax, eax
inc eax
jmp 0x10046b2c
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x50714ba0
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, dword [esi]
setl dl
xor ecx, ecx
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x34]
mov edx, dword [eax]
mov eax, dword [ebp - 0x54]
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, edx
setle al
xor ecx, ecx
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 0x16c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd8]
cmp dword [eax], 0x1552
mov eax, dword [edi + 4]
setge cl
xor edx, edx
sub eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x16c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
setle dl
inc dword [esi]
xor eax, eax
mov dword [ebp - 0x1c], edx
inc eax
cmp dword [esi], eax
jge 0x10046bd4
mov ecx, dword [ebp - 0xd8]
jmp 0x10046ade
lea ecx, [ebp - 0x104]
call fcn.100208b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.100208b4
mov edi, dword [ebp - 0x20]
push 4
pop eax
add edi, eax
mov dword [ebp - 0x20], ebx
jmp 0x10046c0c
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb8], 0x5540d7f8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10046bfb
mov dword [ebp - 0xb8], 0x14
jmp 0x10046c32
cmp byte [ebp - 0x11], 0
je 0x10046c2c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
dec dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], 5
mov byte [ebp - 0x11], bl
jg 0x10046c1e
cmp byte [ebp - 0x11], 0
je 0x10046c55
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp dword [ebp - 0x44], 0
jne 0x10046c5e
add edi, 8
push 3
mov dword [ebp - 0x20], ebx
pop esi
jmp 0x10046c77
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe8], 0x69fdf99f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10046c66
mov dword [ebp - 0xe8], 0xffffffe3
jmp 0x10046c9d
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046c97
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
inc dword [ebp - 0xe8]
cmp dword [ebp - 0xe8], 0x11
jl 0x10046c88
add edi, dword [ebp - 0x68]
dec dword [ebp - 0x5c]
jne 0x100469ee
mov esi, dword [edi]
mov dword [ebp - 0x34], 0xfffe
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046ccb
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10046cef
push 0x1a5e
push 0xb6a
push 0x20fb
push 0x12c0
push ebx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
push 4
pop eax
add edi, eax
push 0xfffffffffffffffd
mov eax, dword [edi]
mov dword [ebp - 0x54], eax
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x5816210b
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0x5dae5a6
mov dword [ebp - 0x24], 0xb7f37c04
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], ebx
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], 9
push 3
mov dword [ebp - 0x5c], 0x82a74db5
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x10046d59
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1d8], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10046d48
mov dword [ebp - 0x10], ebx
jmp 0x10046d74
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x208], 0x4f934f54
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10046d63
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x2c]
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
sub edx, 9
movdqa xmm0, xmmword [0x10009020]
neg edx
push 4
sbb edx, edx
mov dword [ebp - 0xf8], ebx
xor ecx, ecx
mov dword [ebp - 0xf4], ebx
inc edx
mov dword [ebp - 0xf0], ebx
cmp eax, edx
pop eax
push dword [ebp + 8]
setne cl
add edi, eax
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x24], ecx
push eax
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x20], edi
push eax
push ebx
lea ecx, [ebp - 0xf8]
movdqu xmmword [ebp - 0x1b0], xmm0
call fcn.10024680
mov dword [ebp - 4], 8
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x24], 0x26a056eb
mov dword [ebp - 0x34], 0xc9208594
push 2
call fcn.10020852
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x164]
mov dword [ebp - 0x2c], 0x30fc
mov dword [ebp - 0x24], 0xfffffffb
push 3
call fcn.10020852
mov dword [ebp - 0x10], ebx
jmp 0x10046e37
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0xa8d7d2a7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10046e24
mov dword [ebp - 0x10], ebx
jmp 0x10046e55
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x164]
mov dword [eax + ecx*4], 0x5b481d3e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10046e42
mov edi, dword [ebp - 0xf8]
mov eax, dword [edi + 8]
cmp eax, dword [edi + 0xc]
jg 0x10046ed0
mov eax, 0xcf8
mov dword [ebp - 0x24], 0xe0bec035
sub eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
add ecx, 3
je 0x10046e94
cmp dword [edi + 0xc], ebx
je 0x10046e94
xor eax, eax
inc eax
jmp 0x10046e96
mov eax, ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x128]
mov ecx, dword [edi + 8]
mov eax, dword [eax + 4]
add eax, 0x18f0ed69
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x128]
add edx, dword [eax]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub edx, dword [edi + 0xc]
add edx, ecx
je 0x10046ed0
xor edi, edi
inc edi
mov ecx, edi
jmp 0x10046ed5
xor edi, edi
mov ecx, ebx
inc edi
mov eax, dword [ebp - 0x164]
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x164]
call fcn.100208b4
lea ecx, [ebp - 0x128]
call fcn.100208b4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.100208b4
cmp dword [ebp - 0x54], 0
jne 0x10046fff
cmp byte [ebp - 0x49], 0
je 0x10046f21
cmp dword [ebp - 0x48], edi
jne 0x10046f21
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
add dword [ecx + 8], eax
mov edi, dword [ebp - 0x20]
push 4
pop ecx
push esi
mov eax, dword [edi]
add edi, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [edi]
add edi, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x20], edi
call fcn.1004cbbf
pop ecx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0xa0]
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xdc], ebx
push eax
push esi
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
call fcn.1004af03
mov ecx, ebx
test esi, esi
jle 0x10046fcf
mov eax, ecx
and eax, 0x80000001
jns 0x10046f81
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x34]
add eax, ecx
add eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x48]
cdq
idiv esi
mov eax, dword [ebp - 0xa0]
cmp word [eax + edx*2], bx
je 0x10046fb7
mov edi, eax
lea eax, [edx + 1]
cdq
idiv esi
cmp word [edi + edx*2], bx
jne 0x10046fa2
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0xa0]
xor ebx, ebx
inc ebx
mov word [eax + edx*2], bx
mov al, byte [edx + edi]
mov edx, dword [ebp - 0x24]
push 0
pop ebx
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
jl 0x10046f73
mov edi, dword [ebp + 8]
mov eax, dword [ebp - 0x24]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0xa0]
mov dword [edi], esi
test eax, eax
je 0x10047002
push eax
call fcn.10051807
pop ecx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
jmp 0x10047002
mov edi, dword [ebp + 8]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10008fe0]
lea eax, [ebp - 0x190]
push eax
lea eax, [ebp - 0x1a0]
mov dword [ebp - 0x110], ebx
push eax
push ebx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x10c], ebx
movdqu xmmword [ebp - 0x1a0], xmm0
mov dword [ebp - 0x108], ebx
call fcn.10024680
mov dword [ebp - 0x5c], 0xc4d8e5c
mov dword [ebp - 0x5c], 3
cmp dword [ebp - 0x5c], ebx
jl 0x1004706b
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x10047066
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
dec dword [ebp - 0x5c]
jns 0x10047054
lea ecx, [ebp - 0x110]
call fcn.100208b4
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret