Function at 0x1004801f
Capabilities:
Compare security identifiers
Get keyboard layout

Disassembly:
mov eax, 0x101418ca
call fcn.1013e250
sub esp, 0x398
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x7c], ebx
lea ecx, [ebp - 0x94]
movdqa xmm0, xmmword [0x1000eac0]
push edi
push dword [ebp - 0x2c]
movdqu xmmword [ebp - 0x14c], xmm0
push eax
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x94], ebx
push eax
push ebx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
call fcn.10014f3b
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x124]
mov dword [ebp - 0x2c], 0xd4e7937d
or esi, 0xffffffff
mov dword [ebp - 0x2c], 0x8462751c
mov dword [ebp - 0x2c], 2
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x2c], 0x9d4346
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xb2b74c38
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x67101392
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x421e0bec
mov dword [ebp - 0x2c], 0x826a056e
push 3
call fcn.10013ee8
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x1aa84cbe
push 3
mov dword [ebp - 0x2c], 0xc22c9208
pop edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x14], ebx
jmp 0x1004811a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x124]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1004810b
dec dword [ebp - 0x28]
lea ecx, [ebp - 0x124]
call fcn.100144eb
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], bl
call fcn.100144eb
push 0x104
lea eax, [ebp - 0x3a4]
push eax
push 0xf90b
push 0x168eb
call fcn.100290d8
pop ecx
pop ecx
call eax
push dword [ebp - 0x2c]
movdqa xmm0, xmmword [0x1000ea70]
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x15c]
mov dword [ebp - 0x20], 0xdb5cabfc
push eax
mov dword [ebp - 0x24], 0x6f93bd5d
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x14], 5
push ebx
movdqu xmmword [ebp - 0x15c], xmm0
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
call fcn.10014f3b
push 2
pop eax
push eax
lea ecx, [ebp - 0xbc]
mov dword [ebp - 4], eax
call fcn.10013ee8
mov dword [ebp - 0x30], 0xf39281c1
mov dword [ebp - 0x28], 0x1f199e1f
mov dword [ebp - 0x14], ebx
jmp 0x100481da
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0xdc0223de
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100481c7
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
imul ecx, dword [ebp - 0x14], 0x4006
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x78]
mov edi, dword [ebp - 0xbc]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x53a3
setle al
xor ecx, ecx
mov dword [esi + 4], eax
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x24]
cmp dword [esi + 4], eax
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0xb0f7
setle al
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
cmp eax, dword [esi + 4]
jle 0x10048276
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x28], 0x5d1cc0c7
jg 0x10048276
mov eax, ebx
jmp 0x10048279
xor eax, eax
inc eax
mov dword [edi + 4], eax
mov ecx, 0x4043ca31
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 0x14]
sub ecx, dword [edx + 8]
add eax, ecx
je 0x1004829d
cmp dword [esi + 4], ebx
je 0x1004829d
xor edi, edi
inc edi
mov ecx, edi
jmp 0x100482a2
xor edi, edi
mov ecx, ebx
inc edi
xor eax, eax
cmp ecx, dword [edx + 8]
lea ecx, [ebp - 0xbc]
setne al
mov dword [ebp - 0x30], eax
call fcn.100144eb
lea ecx, [ebp - 0x78]
mov byte [ebp - 4], bl
call fcn.100144eb
mov esi, dword [ebp - 0x6c]
lea eax, [ebp - 0x3a4]
push eax
mov ecx, esi
call fcn.10013e17
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x10]
add eax, eax
mov dword [ebp - 0x7c], edi
push eax
lea eax, [ebp - 0x3a4]
push ebx
push eax
call fcn.10029225
add esp, 0xc
mov dword [ebp - 0x34], 0x5e3edfa8
mov dword [ebp - 0x2c], 0x391cb4e7
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x24], 0x5a9864ba
mov dword [ebp - 0x14], 0xade0980d
mov dword [ebp - 0x28], 0x5c1d1022
push 2
call fcn.10013ee8
mov dword [ebp - 4], 3
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x20], 0xca3691f6
mov dword [ebp - 0x30], 0x32e26595
push edi
call fcn.10013ee8
mov byte [ebp - 4], 4
mov dword [ebp - 0x28], 0xcd85
mov dword [ebp - 0x1c], ebx
jmp 0x10048364
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa0]
mov dword [eax + ecx*4], 0xaf72b572
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10048351
mov dword [ebp - 0x1c], ebx
jmp 0x1004837f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1004836f
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100483d9
push 0x7d0
push 0x1a45
push 0x1f12
push ebx
push 0x144f
push 0xe65
call edi
push eax
call esi
push eax
push 0x370
push 0xdd2
push 0x26f7
push 0x1da5
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov edx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x14]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x88]
mov ecx, dword [eax]
lea eax, [ecx + 1]
cmp eax, 1
ja 0x10048403
test ecx, ecx
jne 0x10048403
mov eax, ebx
jmp 0x10048406
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x30]
imul ecx, eax
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x30]
cmp ecx, eax
jge 0x1004841b
xor ecx, ecx
inc ecx
jmp 0x1004841d
mov ecx, ebx
xor eax, eax
cmp ecx, 0x3b91
setg al
xor ecx, ecx
inc ecx
cmp eax, ecx
jbe 0x10048437
cmp dword [ebp - 0x14], ebx
je 0x10048437
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x88]
cmp dword [eax], ebx
je 0x1004858b
mov dword [ebp - 0x1c], 0xce724d25
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], 0x15
je 0x10048580
mov dword [ebp - 0x28], 0xffffffff
lea ecx, [ebp - 0xec]
push 4
call fcn.10013ee8
mov byte [ebp - 4], 5
mov dword [ebp - 0x24], ebx
jmp 0x1004848c
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0x7874d2d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x10048479
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0x1c
jne 0x10048558
mov esi, dword [ebp - 0xec]
mov dword [ebp - 0x34], esi
push 3
lea ecx, [ebp - 0xc8]
call fcn.10013ee8
mov dword [ebp - 0x20], ebx
jmp 0x100484cd
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], 0xeb613644
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x100484ba
cmp dword [ebp - 0x1c], ebx
jne 0x100484e0
mov dword [ebp - 0x20], ebx
cmp dword [esi + 8], ebx
je 0x100484e7
mov dword [ebp - 0x20], 1
mov esi, dword [esi + 8]
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov edi, dword [ebp - 0xc8]
sub esi, dword [edi + 8]
cmp ecx, eax
setl dl
sub esi, edx
sub esi, dword [ebp - 0x20]
sub esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
sub esi, 9
neg esi
sbb esi, esi
xor ecx, ecx
neg esi
cmp eax, esi
mov esi, dword [ebp - 0x34]
setg cl
sub ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [esi + 8]
lea ecx, [ebp - 0xc8]
setle al
mov dword [edi + 8], eax
call fcn.100144eb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1c
je 0x100484a8
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 4
call fcn.100144eb
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0x15
jne 0x1004845c
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
jmp 0x10048629
mov dword [ebp - 0x24], 0xfd11e6ac
mov eax, 0x9fb0e7fb
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
jl 0x100485f4
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
push 2
pop ecx
sub ecx, eax
jne 0x100485d6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], 4
xor ecx, ecx
mov eax, dword [ebp - 0x20]
inc ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x20]
jns 0x100485b7
imul eax, dword [ebp - 0x24], 0xc6b9
test eax, eax
je 0x10048617
cmp dword [edx + 4], ebx
jne 0x10048613
cmp dword [ebp - 0x20], ebx
jne 0x10048613
mov eax, dword [ebp - 0xa0]
cmp dword [eax], ebx
je 0x10048617
mov edx, ecx
jmp 0x10048619
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x104], ecx
lea ecx, [ebp - 0x88]
call fcn.100144eb
lea ecx, [ebp - 0xa0]
mov byte [ebp - 4], bl
call fcn.100144eb
mov dword [ebp - 0x14], 0xb743d837
mov eax, 0x643b8a2
mov dword [ebp - 0x28], 0xfa147b80
xor ecx, ecx
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x28], 0xfbe58499
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x118], 0x6088
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, 0x279c
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
sets cl
mov dword [ebp - 0x28], ecx
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
sub dword [ebp - 0x14], edx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100486c5
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
mov dword [ebp - 0x68], 0x72074801
mov dword [ebp - 0x64], 0xeb85440d
mov dword [ebp - 0x60], 0xa9773fec
mov dword [ebp - 0x5c], 0x2cb62a32
mov dword [ebp - 0x58], 0x97a042e
mov dword [ebp - 0x54], 0x5780370
mov dword [ebp - 0x50], 0x269007b
mov dword [ebp - 0x4c], 0xb610681
mov dword [ebp - 0x48], 0x8780a8c
mov byte [ebp - 0x44], 0x83
mov dword [ebp - 0x14], 3
mov dword [ebp - 0x28], 0x19ac196a
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x34], 0xfffffff9
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10048774
push 0x7d0
push 0x1a45
push 0x1f12
push ebx
push 0x144f
push 0xe65
call edi
push eax
call esi
push eax
push 0x370
push 0xdd2
push 0x26f7
push 0x1da5
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [ebp - 0x28], ebx
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov edi, ebx
mov eax, dword [ebp - 0x14]
mov esi, ebx
cmp ecx, eax
mov dword [ebp - 0x24], edi
setg dl
xor eax, eax
add edx, dword [ebp - 0x14]
cmp edx, 0x4ad744d0
setl al
xor ecx, ecx
cmp eax, 0xb9a7
mov eax, dword [ebp - 0x28]
setne cl
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setg dl
mov dword [ebp - 0x28], esi
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x34], ecx
cmp edi, 4
jne 0x10048a72
push 0xd
pop esi
push 0xf
pop edi
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x13c]
mov dword [ebp - 0x30], 3
push 4
mov dword [ebp - 0x28], esi
call fcn.10013ee8
push 1
lea ecx, [ebp - 0xf8]
mov dword [ebp - 4], 6
call fcn.10013ee8
mov byte [ebp - 4], 7
mov dword [ebp - 0x20], ebx
jmp 0x10048826
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x13c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10048817
xor edx, edx
mov dword [ebp - 0x20], ebx
inc edx
jmp 0x10048843
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10048834
mov eax, dword [ebp - 0x1c]
mov ecx, 0xe3cf9575
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
add eax, 0x39f7747
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jne 0x10048876
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10048878
mov ecx, edx
mov eax, dword [ebp - 0x30]
imul eax, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x30], 0xfffffff0
cmp dword [ebp - 0x30], 0xffffffef
jge 0x10048a54
mov esi, 0xffff
jmp 0x1004889c
xor edx, edx
inc edx
mov dword [ebp - 0x24], 0xfff6
lea ecx, [ebp - 0x130]
push edx
call fcn.10013ee8
mov byte [ebp - 4], 8
push 0xfffffffffffffffd
pop eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x14], ebx
jmp 0x100488e6
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 0xe1c2a91
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100488d3
mov dword [ebp - 0x1c], 0xffffffe2
jmp 0x10048a25
mov dword [ebp - 0x14], 5
lea ecx, [ebp - 0xe0]
push 4
call fcn.10013ee8
mov dword [ebp - 0x20], ebx
jmp 0x10048924
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10048911
mov eax, dword [ebp - 0x1c]
cmp esi, eax
sbb eax, eax
neg eax
cmp eax, esi
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x14]
neg edx
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
sub eax, 8
inc edx
cmp eax, edx
je 0x100489a5
mov dword [ebp - 0x24], ebx
jmp 0x10048999
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10048982
push 0x1e31
push 0x5c1
push 0xbfd
push 0xfa1
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10048996
push 0x206
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x1004895f
cmp dword [ebp - 0x14], ebx
je 0x10048a0f
jmp 0x10048a17
mov dword [ebp - 0x34], 0x20be
xor edx, edx
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x20], 0xc894628a
mov dword [ebp - 0x34], 0xbf7d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setge dl
add edx, 0x7ba6da08
je 0x100489ef
cmp dword [ebp - 0x14], 0xd983a5c2
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x14]
jl 0x100489ef
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0xa8], ecx
mov eax, dword [ebp - 0xf8]
dec dword [eax]
lea ecx, [ebp - 0xe0]
call fcn.100144eb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x11
je 0x100488f8
mov dword [ebp - 0xb0], ebx
lea ecx, [ebp - 0x130]
mov byte [ebp - 4], 7
call fcn.100144eb
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffef
jl 0x10048899
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0xf8]
call fcn.100144eb
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], bl
call fcn.100144eb
jmp 0x10048b4d
movzx eax, byte [ebp + edi - 0x67]
dec esi
mov dword [ebp - 0x1c], 0x5a136951
sub eax, edi
mov dword [ebp - 0x2c], ebx
add esi, eax
mov dword [ebp - 0x14], ebx
jmp 0x10048a99
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x38], 0x8ec0ae97
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10048a8b
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x10048b21
mov dword [ebp - 0x34], 0xbf0ddd9c
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x38], ebx
jne 0x10048ad4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x38], ebx
jne 0x10048ad4
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x38], ebx
jne 0x10048ad4
mov edi, ebx
jmp 0x10048ad7
xor edi, edi
inc edi
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
add eax, 9
add ecx, eax
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp + eax*4 - 0x38], edi
mov eax, dword [ebp - 0x14]
imul eax, ecx
xor ecx, ecx
cmp edi, eax
sete cl
mov dword [ebp - 0x14], ecx
dec dword [ebp - 0x1c]
jns 0x10048aa7
mov edi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
test esi, esi
jns 0x10048b3d
or eax, 0xffffffff
sub eax, esi
add esi, 0x100
and eax, 0xffffff00
add esi, eax
movzx eax, byte [ebp + edi - 0x68]
mov word [ebp + eax*2 - 0x184], si
mov esi, dword [ebp - 0x28]
add edi, 2
mov dword [ebp - 0x24], edi
cmp edi, 0x25
jb 0x100487cd
xor eax, eax
xor edx, edx
mov word [ebp - 0x16c], ax
inc edx
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x30], 0x5cc7
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x2c], 0xdc4b
mov dword [ebp - 0x14], ebx
jmp 0x10048b9a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40], 0x8bbca631
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10048b8c
mov dword [ebp - 0x1c], ebx
jmp 0x10048cc9
mov dword [ebp - 0x24], 0x94ff5452
mov dword [ebp - 0x20], 0x3799040c
mov dword [ebp - 0x34], 0xde90
mov dword [ebp - 0x14], ebx
jmp 0x10048bd3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x168], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10048bc2
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x40], ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x24], eax
jge 0x10048c01
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x40]
cmp eax, edx
setge cl
neg ecx
je 0x10048c28
mov ecx, edx
cmp dword [ebp - 0x28], ebx
jne 0x10048c2a
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
cmp ecx, dword [ebp + eax*4 - 0x40]
je 0x10048c3e
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
cmp dword [ebp + eax*4 - 0x40], ebx
je 0x10048c40
mov ecx, edx
xor eax, eax
cmp ecx, 0xd3ed
setge al
cmp eax, 0x5ad058bb
jle 0x10048c59
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x20], 0xfe64
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x30]
jne 0x10048c9d
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10048cc6
push ebx
push 0x1a9b
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
xor edx, edx
inc edx
jmp 0x10048cc6
mov dword [ebp - 0x20], ebx
jmp 0x10048cc1
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10048cb5
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x160], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x10048ca2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x10048ba8
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0x209f
lea eax, [ebp - 0x184]
push eax
setl cl
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0x19c]
call fcn.10013e17
push 0xffffffffffffffff
mov dword [ebp - 4], 9
mov esi, dword [ebp - 0x6c]
mov ecx, esi
push ebx
push eax
call fcn.1002a04a
push ebx
push 1
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], bl
call fcn.10014448
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x184]
rep stosd dword es:[edi], eax
push 2
lea ecx, [ebp - 0xd4]
stosw word es:[edi], ax
call fcn.10013ee8
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x2c], 0x2c40a98c
mov dword [ebp - 0x14], ebx
jmp 0x10048d58
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10048d49
mov eax, dword [ebp - 0xd4]
mov dword [eax], ebx
mov dword [ebp - 0x14], 0x18
jmp 0x10048d93
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10048d7f
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10048d90
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1d
jg 0x10048d6f
lea ecx, [ebp - 0xd4]
call fcn.100144eb
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret