Function at 0x10041a86
Capabilities:
Get geographical location
Query service status
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10064c7a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x370
push ebx
push esi
xor eax, eax
mov dword [esp + 0x5c], ecx
push edi
inc eax
mov dword [esp + 0x5c], edx
push eax
lea ecx, [esp + 0x8c]
call fcn.1000d8e5
xor ebx, ebx
xor edx, edx
mov dword [esp + 0x384], ebx
inc edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x24], 0xaf833954
mov dword [esp + 0xc], ebx
jmp 0x10041afa
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x88]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10041ae8
push 2
mov dword [esp + 0x10], ebx
pop edi
jmp 0x10041b1c
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xf8], 0x21ec2184
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10041b09
mov eax, dword [esp + 0x88]
mov dword [eax], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10041b42
push ebx
push 0x20cc
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [esp + 0x88]
dec dword [eax]
cmp dword [eax], 0xffffffe2
jg 0x10041b2b
push 0xfffffffffffffff8
mov dword [esp + 0x10], ebx
pop esi
jmp 0x10041cc6
push 4
lea ecx, [esp + 0x114]
call fcn.1000d8e5
mov dword [esp + 0x20], 0xffffffff
xor edx, edx
mov dword [esp + 0x24], 0xfffffff7
inc edx
mov dword [esp + 0x1f8], edx
mov dword [esp + 0x1fc], edx
mov dword [esp + 0x200], edx
mov dword [esp + 0x204], edx
mov dword [esp + 0x18], ebx
jmp 0x10041bb1
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10041b9f
mov edx, dword [esp + 0x110]
mov dword [edx], ebx
mov esi, dword [esp + 0x88]
xor ecx, ecx
mov eax, dword [esi]
dec eax
cmp eax, edi
mov eax, dword [edx]
setl cl
mov dword [esp + 0x18], ecx
mov edx, dword [esp + 0x18]
sub edx, dword [esi + eax*4]
mov eax, dword [esp + 0x110]
neg edx
sbb edx, edx
inc edx
mov ecx, dword [eax]
mov eax, dword [esp + 0x88]
mov dword [eax + ecx*4], edx
mov dword [esp + 0x20], 0xffffffef
jmp 0x10041c2d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10041c13
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10041c29
push ebx
push 0x1e3b
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10041c01
mov edx, dword [esp + 0x110]
dec dword [edx]
jns 0x10041bc1
cmp dword [esp + 0xc], ebx
je 0x10041c78
mov eax, dword [esp + 0xf8]
imul eax, dword [esp + 0xf8]
test eax, eax
jne 0x10041c5c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
xor eax, eax
inc eax
mov dword [esp + 0xfc], eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
je 0x10041c78
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x88]
mov eax, dword [esp + 0x88]
push 0xfffffffffffffff8
mov eax, dword [eax + ecx*4]
lea ecx, [esp + 0x114]
mov dword [edx + esi*4], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x204], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
pop esi
mov dword [esp + 0x24], esi
call fcn.1000e49e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x10041b5c
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x88]
call fcn.1000e49e
mov dword [esp + 0x3c], 0xfffffffc
lea ecx, [esp + 0xe4]
push edi
call fcn.1000d8e5
xor ecx, ecx
mov dword [esp + 0x40], esi
mov dword [esp + 0xc], ebx
inc ecx
jmp 0x10041d16
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x58], 0xfffffffa
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x10041d06
mov dword [esp + 0xc], ebx
jmp 0x10041d38
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0xdb84c6a3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10041d22
mov dword [esp + 0x58], 0xfffffffb
jmp 0x10041dc4
mov dword [esp + 0x1c], 7
mov dword [esp + 0x4c], 0xfffffffa
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], 0xf44401d1
mov eax, dword [esp + 0x3c]
cmp ecx, eax
mov eax, dword [esp + 0x58]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x58]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x1c]
setl cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
cmp dword [esp + 0x24], eax
setg cl
cmp ecx, esi
jne 0x10041da8
cmp dword [esp + 0x58], ebx
jne 0x10041da8
xor ecx, ecx
inc ecx
jmp 0x10041daa
mov ecx, ebx
mov eax, dword [esp + 0x4c]
imul eax, ecx
imul ecx, eax, 0xfffc
mov eax, dword [esp + 0xe4]
mov dword [eax], ecx
inc dword [esp + 0x58]
cmp dword [esp + 0x58], 0xfffffffd
push 9
pop ecx
jge 0x10041d48
mov esi, dword [esp + 0x58]
mov eax, dword [esp + 0xe4]
neg esi
sbb esi, esi
xor edx, edx
neg esi
cmp dword [eax], ebx
mov eax, dword [esp + 0x3c]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, 0x655af779
je 0x10041e08
cmp dword [esp + 0x40], ebx
je 0x10041e08
xor edi, edi
inc edi
jmp 0x10041e0a
mov edi, ebx
mov eax, dword [esp + 0x58]
xor ecx, ecx
cmp esi, eax
mov eax, dword [esp + 0xe4]
setg cl
xor edx, edx
sub edi, dword [eax]
mov eax, dword [esp + 0x58]
cmp ecx, edi
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0xe4]
call fcn.1000e49e
mov eax, dword [0x11134fb0]
test al, 1
jne 0x10041ee5
xor ecx, ecx
inc ecx
or eax, ecx
mov dword [0x11134fb0], eax
push ebx
mov dword [esp + 0x388], ecx
push ebx
mov dword [0x11134f90], ebx
mov dword [0x11134f94], ebx
call fcn.10011d1b
mov dword [0x11134f90], eax
mov dword [0x11134f98], ebx
mov dword [0x11134fa0], ebx
mov byte [esp + 0x384], 3
mov ecx, 0x11134f98
mov dword [esp + 0x100], eax
lea eax, [esp + 0x100]
push eax
push 0x10
push ebx
lea eax, [esp + 0x22c]
mov dword [0x11134fac], 0x3f800000
push eax
mov dword [0x11134f9c], ebx
call fcn.10011abf
push 0x10064f6a
mov dword [0x11134fa4], 7
mov dword [0x11134fa8], 8
call fcn.1004a7e2
or dword [esp + 0x388], 0xffffffff
pop ecx
push 2
pop esi
push esi
lea ecx, [esp + 0x160]
call fcn.1000d8e5
mov dword [esp + 0x18], ebx
jmp 0x10041f11
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10041efb
mov eax, dword [esp + 0x15c]
mov dword [eax], 0xffffffec
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10041f36
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov eax, dword [esp + 0x15c]
inc dword [eax]
cmp dword [eax], 7
jle 0x10041f24
lea ecx, [esp + 0x15c]
call fcn.1000e49e
imul eax, dword [esp + 0x60], 0x2710
lea ecx, [esp + 0x1c8]
push esi
add eax, dword [esp + 0x60]
mov dword [esp + 0x98], eax
call fcn.1000d8e5
mov dword [esp + 0x1c], 0x44ad3740
mov edx, 0xffff
mov dword [esp + 0x24], 0x3b6f9b69
mov dword [esp + 0x18], ebx
jmp 0x10041f9d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c8]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10041f8b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10041fb5
push ebx
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c8]
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x1c]
inc eax
cmp eax, edx
jne 0x10041fd4
test edx, edx
jne 0x10041fd4
mov ecx, ebx
jmp 0x10041fd7
xor ecx, ecx
inc ecx
xor eax, eax
cmp edx, ecx
setne al
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0xe124dc41
lea ecx, [esp + 0x1c8]
setne al
sub eax, dword [esp + 0x1c]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
call fcn.1000e49e
lea eax, [esp + 0x94]
push eax
call fcn.10043c30
push 4
lea ecx, [esp + 0x1e4]
mov edi, dword [eax]
mov dword [esp + 0x2c], 0x1824a8c6
mov dword [esp + 0x34], 1
call fcn.1000d8e5
push 4
pop eax
mov dword [esp + 0x384], eax
xor edx, edx
mov dword [esp + 0x18], ebx
inc edx
cmp dword [esp + 0x18], eax
jge 0x10042065
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1004204c
mov dword [esp + 0x28], 0xffffffe3
cmp dword [esp + 0x28], 0xffffffe5
je 0x100420d8
mov esi, dword [esp + 0x1e0]
mov dword [esp + 0x30], 0x288a137b
lea ecx, [esp + 0x208]
mov dword [esp + 0x30], edx
push 3
call fcn.1000d8e5
mov dword [esp + 0x18], ebx
jmp 0x100420b1
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x208]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1004209b
dec dword [esi + 0xc]
lea ecx, [esp + 0x208]
call fcn.1000e49e
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0xffffffe5
push 1
pop edx
jne 0x1004207b
push 2
pop esi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100420f0
push 0x180a
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x1e0]
call fcn.1000e49e
test edi, edi
je 0x10042114
mov dword [esp + 0xac], edi
jmp 0x100439bf
push 0x16
mov dword [esp + 0x24], 0x61928c17
mov dword [esp + 0x24], 0x15
pop eax
jmp 0x1004214b
mov dword [esp + 0x18], 0xaa9ac70c
mov dword [esp + 0x18], ebx
jmp 0x10042141
cmp dword [esp + 0x20], ebx
jne 0x10042147
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jne 0x10042137
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jne 0x10042129
mov eax, dword [0x11134fb0]
test al, 2
jne 0x100421f7
or eax, esi
mov dword [0x11134fb0], eax
push ebx
mov dword [esp + 0x388], 5
push ebx
mov dword [0x11134f70], ebx
mov dword [0x11134f74], ebx
call fcn.10011d1b
mov dword [0x11134f70], eax
mov dword [0x11134f78], ebx
mov dword [0x11134f80], ebx
mov byte [esp + 0x384], 7
mov ecx, 0x11134f78
mov dword [esp + 0xf4], eax
lea eax, [esp + 0xf4]
push eax
push 0x10
push ebx
lea eax, [esp + 0x278]
mov dword [0x11134f8c], 0x3f800000
push eax
mov dword [0x11134f7c], ebx
call fcn.10011abf
push 0x10064f65
mov dword [0x11134f84], 7
mov dword [0x11134f88], 8
call fcn.1004a7e2
or dword [esp + 0x388], 0xffffffff
pop ecx
push 4
pop edi
mov dword [esp + 0x20], 0xfffffff7
lea ecx, [esp + 0x144]
push edi
call fcn.1000d8e5
mov dword [esp + 0x18], 0x50e8f7cf
mov dword [esp + 0x28], 0x85a06c0f
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x4c], 0x95c78859
mov dword [esp + 0xc], ebx
jmp 0x1004224b
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10042235
mov dword [esp + 0xc], ebx
jmp 0x1004226a
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x29c], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10042257
mov dword [esp + 0x20], ebx
jmp 0x1004243a
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x2c], 0xfffffffe
mov dword [esp + 0x50], 0x6013
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], ebx
jl 0x100423c1
mov dword [esp + 0x1c], 0xc51978e6
mov dword [esp + 0x40], 0xccc09984
mov dword [esp + 0x2c], 0xffffffff
cmp dword [esp + 0x14], ebx
jne 0x10042368
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x144]
sub ecx, dword [eax]
mov eax, dword [esp + 0x14]
add eax, ecx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp eax, ecx
setg dl
xor ecx, ecx
mov dword [esp + 0x40], edx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
add edx, edx
cmp edx, eax
setge cl
imul edx, ecx, 0xfffb
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
neg edx
sbb edx, edx
add edx, 0xffffc912
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
je 0x10042345
cmp dword [esp + 0x2c], ebx
je 0x10042345
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
xor edx, edx
cmp eax, 1
mov eax, dword [esp + 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x144]
setne cl
cmp ecx, dword [eax + 0xc]
jne 0x10042373
cmp dword [esp + 0x2c], ebx
je 0x10042373
xor eax, eax
inc eax
jmp 0x10042375
mov eax, ebx
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
imul eax, eax, 0xe128
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x40]
cmp eax, 1
setle cl
add ecx, 0x5569c69b
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
dec dword [esp + 0x14]
jns 0x100422a4
mov eax, dword [esp + 0x50]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2a4]
cmp eax, esi
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
mov eax, 0xffff
setne dl
xor ecx, ecx
add edx, eax
mov eax, dword [esp + 0x24]
cmp eax, edx
mov eax, dword [esp + 0x14]
setl cl
sub ecx, 9
mov dword [esp + 0x4c], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x4c]
setg cl
mov dword [esp + 0x28], ecx
imul eax, dword [esp + 0x28], 0x427
mov dword [esp + 0x4c], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x1a
je 0x1004227a
lea ecx, [esp + 0x144]
call fcn.1000e49e
push 0xfffffffffffffffc
xorps xmm0, xmm0
xor ecx, ecx
movdqu xmmword [esp + 0x120], xmm0
pop esi
mov dword [esp + 0x3c], esi
inc ecx
mov dword [esp + 0x40], 0x66a756a3
mov dword [esp + 0x50], 0x1e3ff14e
mov dword [esp + 0x30], 0xc99cdf9c
mov dword [esp + 0x30], ecx
mov dword [esp + 0x30], 0x1bbb4f5a
mov dword [esp + 0x30], 0xfe936be8
mov dword [esp + 0x30], 0xb996a530
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], ebx
jmp 0x100424b8
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x21c], 9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x100424a5
mov dword [esp + 0x3c], ebx
cmp dword [esp + 0x3c], ebx
jl 0x10042524
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x40], 0xe0184dcc
mov dword [esp + 0x40], 0x2e08
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x10042518
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x50]
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xfffffffb
test eax, eax
jne 0x10042514
mov dword [esp + 0x40], 0xfffffffe
mov eax, dword [esp + 0x40]
sub eax, dword [esp + 0x1c]
je 0x10042518
mov eax, ecx
jmp 0x1004251a
mov eax, ebx
mov dword [esp + 0x50], eax
dec dword [esp + 0x3c]
jns 0x100424c8
dec dword [esp + 0x28]
lea eax, [esp + 0x60]
push eax
call fcn.10043c92
cmp byte [ebp + 0xc], 0
mov edi, dword [eax]
mov dword [esp + 0x40], edi
jne 0x10042546
test edi, edi
jne 0x10042b8e
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x224]
mov dword [esp + 0x30], ebx
xor eax, eax
mov dword [esp + 0x30], 3
inc eax
mov dword [esp + 0x30], 4
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0xb023ed15
push eax
call fcn.1000d8e5
mov dword [esp + 0x384], 8
lea ecx, [esp + 0x260]
mov dword [esp + 0x30], 0xfffffff9
mov dword [esp + 0x30], 0x9ef4
push 3
call fcn.1000d8e5
xor edx, edx
inc edx
mov dword [esp + 0x50], edx
mov dword [esp + 0x14], ebx
jmp 0x100425ca
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x224]
mov dword [eax + ecx*4], 0xe5a60d00
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100425b4
mov dword [esp + 0x14], ebx
jmp 0x100425e5
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x9c], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100425d6
mov dword [esp + 0x14], ebx
jmp 0x10042607
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x260]
mov dword [eax + ecx*4], 0x6038
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x100425f1
inc dword [esp + 0x50]
lea ecx, [esp + 0x260]
call fcn.1000e49e
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x224]
call fcn.1000e49e
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x2c0]
mov ecx, dword [esp + 0x60]
push eax
call fcn.100393b4
mov esi, eax
lea edi, [esp + 0x120]
pop ecx
push 4
lea ecx, [esp + 0x154]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000d8e5
mov dword [esp + 0x384], 9
mov dword [esp + 0x24], 0x1825
cmp dword [esp + 0x24], 0xf02
jge 0x1004276a
lea eax, [esp + 0x98]
mov ecx, 0x10654250
push eax
call fcn.10017fa7
mov edi, dword [esp + 0x98]
jmp 0x1004275a
dec edi
mov dword [esp + 0xcc], 0xf
mov dword [esp + 0xc8], ebx
mov byte [esp + 0xb8], bl
lea edx, [esp + 0xb8]
mov byte [esp + 0x384], 0xa
mov ecx, 0x10654250
call fcn.10038434
mov eax, dword [esp + 0xc8]
cmp eax, 0xa
jbe 0x10042733
cmp dword [esp + 0xcc], 0x10
lea esi, [esp + 0xb8]
lea ecx, [esp + 0xb8]
cmovae ecx, dword [esp + 0xb8]
cmovae esi, dword [esp + 0xb8]
add eax, 0xfffffffe
push eax
push ecx
mov dl, byte [ecx]
mov ecx, 0x10654198
call fcn.1001891a
pop ecx
mov ecx, eax
call fcn.100439e3
mov ecx, dword [esp + 0xc8]
mov dl, byte [esi + ecx - 1]
mov ecx, eax
call fcn.1001891a
jmp 0x10042744
lea edx, [esp + 0xb8]
mov ecx, 0x10654198
call fcn.10037fb9
push eax
call fcn.10011fcc
pop ecx
push ebx
push 1
lea ecx, [esp + 0xc0]
call fcn.1000df30
test edi, edi
jne 0x100426a1
dec edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x20], 0x6960f57a
mov dword [esp + 0x18], ebx
jmp 0x1004278a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10042778
mov dword [esp + 0x20], 3
push 6
pop esi
cmp dword [esp + 0x20], ebx
jl 0x10042877
mov dword [esp + 0xd0], esi
xor eax, eax
mov dword [esp + 0xd4], esi
inc eax
mov dword [esp + 0xd8], esi
mov dword [esp + 0xdc], esi
mov dword [esp + 0x28], eax
mov dword [esp + 0xd8], 3
cmp dword [esp + 0xd8], ebx
jl 0x10042847
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], 3
jg 0x1004283e
mov dword [esp + 0x18], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042807
push ebx
push 0x928
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov dword [esp + 0x18], ebx
jmp 0x10042829
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0xd8]
mov ecx, dword [esp + 0x150]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x1004280d
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
push 1
pop eax
jle 0x100427ec
dec dword [esp + 0xd8]
jns 0x100427dd
mov dword [esp + 0x28], ebx
jmp 0x10042866
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x150]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jle 0x1004284d
dec dword [esp + 0x20]
jns 0x100427a6
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x150]
call fcn.1000e49e
cmp byte [ebp + 0xc], 0
mov dword [esp + 0x24], 0x1619
mov eax, dword [esp + 0x24]
je 0x10042b8a
cmp dword [esp + 0x124], 0
je 0x10042b8a
mov eax, dword [esp + 0x128]
xor edx, edx
mov dword [esp + 0x18], 2
inc edx
mov dword [esp + 0x24], 0x3629aa81
mov dword [esp + 0x50], 8
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x20], 0x717be9fb
mov dword [esp + 0x14], 0x9d010789
mov dword [esp + 0x4c], 0xc9995890
mov dword [esp + 0x30], 0xfffffffe
mov dword [esp + 0xb0], eax
mov dword [esp + 0x18], ebx
jmp 0x10042915
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xf0], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10042906
mov dword [esp + 0x18], 0x1a
cmp dword [esp + 0x18], 0xa
jne 0x10042a52
mov dword [esp + 0x3c], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0xc], 0x37f1
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x3c]
sub ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
inc ecx
dec dword [esp + 0x14]
cmp eax, ecx
mov eax, edx
cmovle eax, ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x2c], 0xb382e580
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x50], edx
jne 0x100429a9
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042a40
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x10042a40
mov dword [esp + 0x28], 0x24b83428
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0xc], ebx
jne 0x10042a26
cmp dword [esp + 0x28], ebx
je 0x10042a22
mov eax, dword [esp + 0x28]
xor edx, edx
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
cmp ecx, eax
setge dl
mov dword [esp + 0xc], edx
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp eax, esi
mov eax, dword [esp + 0x3c]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x20]
sub eax, 0xa1a8f1ed
add eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x50], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xa
push 1
pop edx
je 0x1004292e
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0x17
je 0x10042b7c
mov esi, 0xffff
jmp 0x10042a6b
xor edx, edx
inc edx
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x1c], edx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042a8a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x20], ebx
jmp 0x10042b62
push 4
lea ecx, [esp + 0x16c]
call fcn.1000d8e5
mov dword [esp + 0x50], ebx
mov dword [esp + 0xc], ebx
jmp 0x10042ac1
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], 0x7f6c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10042aab
mov dword [esp + 0xc], ebx
jmp 0x10042ae1
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x258], 0xfffffffb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10042ace
mov dword [esp + 0xc], ebx
jmp 0x10042af8
cmp dword [esp + 0x4c], ebx
jne 0x10042aff
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff5
jle 0x10042aee
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x168]
mov dword [esp + 0x50], 0x2d528561
mov ecx, dword [esp + 0x4c]
add ecx, dword [eax + 8]
mov eax, dword [esp + 0x30]
add eax, ecx
sub eax, dword [esp + 0x25c]
neg eax
sbb eax, eax
inc eax
cmp esi, eax
mov eax, dword [esp + 0x1c]
sbb ecx, ecx
neg ecx
imul eax, ecx
xor ecx, ecx
mov dword [esp + 0xf0], eax
mov eax, dword [esp + 0x168]
cmp dword [eax], 1
setge cl
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x168]
call fcn.1000e49e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0xf
jne 0x10042a93
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x17
jne 0x10042a68
mov eax, dword [esp + 0x124]
mov dword [esp + 0xb4], eax
mov edi, dword [esp + 0x40]
push dword [esp + 0x9c]
movdqa xmm0, xmmword [0x10008960]
lea eax, [esp + 0x284]
push eax
lea eax, [esp + 0x278]
mov dword [esp + 0x48], 0xd5464b5f
push eax
mov dword [esp + 0x20], 0xd1dc6b79
lea ecx, [esp + 0x88]
push ebx
movdqu xmmword [esp + 0x280], xmm0
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
call fcn.100385b6
mov dword [esp + 0x384], 0xb
lea ecx, [esp + 0x24c]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x24], 0xe2e800bc
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 0x8701e4a2
push 3
call fcn.1000d8e5
mov byte [esp + 0x384], 0xc
mov dword [esp + 0x50], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x10042c4d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24c]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x10042c37
cmp dword [esp + 0x40], ebx
je 0x10042ddd
xor ecx, ecx
mov eax, 0x65925ef2
inc ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x24], 0xffffffff
cmp dword [esp + 0xc], ebx
je 0x10042c91
cmp dword [esp + 0x24], 0xffffffff
mov edx, ecx
jne 0x10042c93
mov edx, ebx
mov esi, dword [esp + 0xc]
xor ecx, ecx
mov dword [esp + 0x70], esi
mov eax, dword [esp + 0xc]
cmp edx, eax
mov eax, 0xd7c6ae49
sete cl
cmp eax, ecx
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
cmp eax, ecx
setle dl
sub esi, edx
sub esi, dword [esp + 0x40]
cmp esi, dword [esp + 0xc]
jg 0x10042cdf
mov eax, dword [esp + 0x7c]
cmp dword [eax], ebx
jne 0x10042cdf
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x10042ce4
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [esp + 0xc]
sub eax, ecx
je 0x10042d5f
push dword [esp + 0x9c]
movdqa xmm0, xmmword [0x10008920]
lea eax, [esp + 0x294]
push eax
lea eax, [esp + 0x288]
mov dword [esp + 0x188], ebx
push eax
push ebx
lea ecx, [esp + 0x190]
mov dword [esp + 0x194], ebx
movdqu xmmword [esp + 0x290], xmm0
mov dword [esp + 0x198], ebx
call fcn.100385b6
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0x180]
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x6c]
mov dword [esp + 0x14], 1
call fcn.1000e49e
xor edx, edx
inc edx
jmp 0x10042d73
mov dword [esp + 0x30], 0xfffffff8
mov ecx, edx
mov eax, dword [esp + 0x30]
sub ecx, eax
mov dword [esp + 0x74], ecx
cmp dword [esp + 0x24], ebx
je 0x10042dbc
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x7c]
imul ecx, dword [eax]
mov eax, dword [esp + 0x70]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
mov dword [esp + 0x24], eax
je 0x10042da6
mov eax, dword [esp + 0x6c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0xc]
jne 0x10042dbe
mov edx, ebx
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, 0xce92b64
setge al
mov dword [esp + 0x14], eax
jmp 0x10042ea5
mov dword [esp + 0x20], 0xed117543
xor edx, edx
mov dword [esp + 0x24], 0x102817ac
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 2
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setge dl
xor eax, eax
inc eax
sub eax, edx
mov edx, dword [esp + 0x14]
sub eax, 0xbcaf
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x4405
mov eax, dword [esp + 0x7c]
setl cl
sub ecx, dword [eax + 4]
neg ecx
sbb ecx, ecx
inc ecx
imul edx, ecx
xor ecx, ecx
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], ecx
xor ecx, ecx
cmp dword [esp + 0x30], eax
setg cl
sub ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x7c]
cmp ecx, 0xfffffff7
jle 0x10042e94
cmp dword [eax + 0xc], ebx
jne 0x10042e94
mov ecx, ebx
jmp 0x10042e97
xor ecx, ecx
inc ecx
mov eax, dword [eax + 8]
imul eax, ecx
mov dword [esp + 0x14], eax
dec dword [esp + 0x50]
lea ecx, [esp + 0x24c]
call fcn.1000e49e
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x7c]
call fcn.1000e49e
test edi, edi
jne 0x10043494
cmp dword [esp + 0x11c], edi
jle 0x10043494
push 1
lea ecx, [esp + 0x1b4]
call fcn.1000d8e5
push 2
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x388], 0xd
call fcn.1000d8e5
xor edx, edx
mov dword [esp + 0xc], ebx
inc edx
jmp 0x10042f1a
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1b0]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10042f07
mov dword [esp + 0xc], ebx
jmp 0x10042f3c
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 0x831e42a4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10042f26
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042f59
push 0xb19
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0x1b0]
cmp dword [eax], ebx
je 0x10042f83
mov dword [esp + 0x24], 0xcbad86e5
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10042f7d
call dword [sym.imp.GDI32.dll_GdiFlush]
inc dword [esp + 0x24]
jmp 0x10042f91
mov eax, dword [esp + 0x1a4]
mov dword [eax + 4], 0xafc37186
lea ecx, [esp + 0x1a4]
call fcn.1000e49e
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x1b0]
call fcn.1000e49e
push 1
lea ecx, [esp + 0x130]
call fcn.1000d8e5
mov dword [esp + 0x384], 0xe
lea ecx, [esp + 0x1bc]
push 9
pop eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x194], eax
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], eax
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x24], 5
push 3
call fcn.1000d8e5
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10043023
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x12c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10043010
mov dword [esp + 0x14], ebx
jmp 0x10043042
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x104], 0x97341720
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1004302f
mov dword [esp + 0x14], ebx
jmp 0x10043060
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004304e
mov dword [esp + 0x24], edx
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x12c]
mov edx, dword [eax]
test edx, edx
mov dword [esp + 0x104], edx
sete cl
mov dword [esp + 0x19c], edx
xor eax, eax
cmp ecx, edx
setg al
cmp eax, 2
jg 0x100430a7
cmp dword [esp + 0x19c], ebx
je 0x100430a7
xor eax, eax
inc eax
jmp 0x100430a9
mov eax, ebx
cmp eax, 0xffffffff
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0x24]
mov eax, dword [eax]
add ecx, eax
imul ecx, eax
mov eax, dword [esp + 0x1bc]
cmp ecx, 0xbcd
lea ecx, [esp + 0x1bc]
setg dl
mov dword [eax + 4], edx
call fcn.1000e49e
or dword [esp + 0x384], 0xffffffff
lea ecx, [esp + 0x12c]
call fcn.1000e49e
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x174]
mov dword [esp + 0xc], 0xea388845
push 1
call fcn.1000d8e5
mov dword [esp + 0x40], 0x764361a6
xor edx, edx
mov dword [esp + 0x30], 6
inc edx
mov dword [esp + 0x1c], ebx
jmp 0x10043144
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], 0xd72b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1004312e
mov eax, dword [esp + 0x14]
mov ecx, 0xb66bafcb
add eax, 0x616e
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp ecx, eax
sbb eax, eax
inc eax
cmp dword [esp + 0x14], eax
je 0x1004317a
mov esi, ebx
cmp dword [esp + 0x14], ebx
je 0x1004317c
mov esi, edx
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
neg ecx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setle al
imul eax, dword [esp + 0x14]
test eax, eax
je 0x100431b8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004320b
push 0xe51
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x1004320b
mov dword [esp + 0xc], ebx
jmp 0x10043204
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100431db
push 0x1fc5
push ebx
push 0x1e1
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x14], ebx
jmp 0x100431fa
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x174]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x100431e1
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff9
jne 0x100431be
mov eax, dword [esp + 0x40]
cmp eax, dword [esp + 0xc]
jle 0x10043274
cmp dword [esp + 0x40], ebx
jne 0x10043235
mov eax, dword [esp + 0xc]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0x62a7
sub eax, dword [esp + 0x14]
jne 0x10043235
mov ecx, ebx
jmp 0x10043238
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x40]
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
add edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp edx, eax
mov eax, dword [esp + 0x174]
setne cl
xor edx, edx
imul ecx, ecx, 0x90a
cmp ecx, dword [eax]
setge dl
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
jne 0x10043274
mov eax, ebx
jmp 0x10043277
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
lea ecx, [esp + 0x174]
call fcn.1000e49e
mov dword [esp + 0x30], 0x1d51
cmp dword [esp + 0x30], 0x784
jge 0x10043325
push 0xa0
lea eax, [esp + 0x2d5]
mov byte [esp + 0x2d4], bl
push ebx
push eax
call fcn.1004a8c0
add esp, 0xc
mov dword [esp + 0x64], ebx
lea eax, [esp + 0x64]
push eax
push 0x10008670
call fcn.1004a47b
mov esi, ebx
pop ecx
pop ecx
cmp dword [esp + 0x64], esi
jle 0x10043301
lea eax, [esp + 0xe0]
push eax
push 0x10008670
call fcn.1004a47b
mov eax, dword [esp + 0xe8]
inc esi
pop ecx
pop ecx
mov byte [esp + eax + 0x2d0], 1
cmp esi, dword [esp + 0x64]
jl 0x100432d7
xor eax, eax
inc eax
cmp byte [esp + eax + 0x2d0], 0
je 0x10043318
inc eax
cmp eax, 0xa1
jl 0x10043304
jmp 0x10043325
push eax
push 0x100086ec
call fcn.1004a80c
pop ecx
pop ecx
push 1
lea ecx, [esp + 0x238]
call fcn.1000d8e5
xor edx, edx
mov dword [esp + 0xc], 0x1c1ec2db
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x1004335a
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x234]
mov dword [eax + ecx*4], 0x49fe387f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x10043344
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], ebx
jl 0x100433a0
mov dword [esp + 0x24], edx
mov dword [esp + 0x4c], 0xa969ac54
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x4c], eax
dec dword [esp + 0xc]
jns 0x1004336a
lea ecx, [esp + 0x234]
call fcn.1000e49e
mov ecx, dword [esp + 0x120]
test ecx, ecx
je 0x10043494
call fcn.10041a49
push 1
lea ecx, [esp + 0x13c]
mov edi, eax
call fcn.1000d8e5
mov dword [esp + 0x24], 0x48cc
xor edx, edx
mov dword [esp + 0x30], 0x233fd52
inc edx
mov dword [esp + 0xc], ebx
jmp 0x100433ff
push 2
lea ecx, [esp + 0x1d8]
call fcn.1000d8e5
mov dword [esp + 0xc], ebx
jmp 0x100434be
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1d4]
mov dword [eax + ecx*4], 3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x100434a8
mov dword [esp + 0xc], ebx
jmp 0x100434de
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2a8], 0x1bd9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x100434cb
mov eax, dword [esp + 0x1d4]
lea ecx, [esp + 0x1d4]
mov dword [eax + 4], 0xffffffee
call fcn.1000e49e
lea ecx, [esp + 0x11c]
call fcn.1003e935
test edi, edi
je 0x100437bb
mov dword [esp + 0x20], 0x1aae4b9a
xor edx, edx
mov dword [esp + 0x50], 0xd1e12aa5
inc edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0xcd1b7e2
mov dword [esp + 0x30], 0x714
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], ebx
jmp 0x1004355f
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x230], 7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1004354c
cmp dword [esp + 0x20], ebx
je 0x10043581
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
inc edx
cmp dword [esp + 0x20], ecx
mov ecx, edx
jl 0x10043583
mov ecx, ebx
mov eax, dword [esp + 0x20]
sub ecx, eax
mov dword [esp + 0x50], ecx
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x50]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x40]
cmp edx, ecx
sbb eax, eax
neg eax
inc eax
cmp eax, dword [esp + 0x40]
jge 0x100435b5
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
xor ecx, ecx
mov edx, dword [esp + 0x5c]
cmp eax, 0x46e74a6e
setge cl
mov dword [esp + 0x30], ecx
mov ecx, edi
dec dword [esp + 0x24]
call fcn.10041a7c
mov dword [esp + 0x30], 0x1d12
mov esi, eax
cmp dword [esp + 0x30], 0x1297
mov dword [esp + 0xac], esi
jge 0x10043741
lea eax, [esp + 0x68]
push eax
push 0x100081ac
call fcn.1004a47b
pop ecx
pop ecx
lea eax, [esp + 0x240]
mov dword [esp + 0xa0], ebx
push eax
push dword [esp + 0x6c]
xorps xmm0, xmm0
mov dword [esp + 0xac], ebx
lea ecx, [esp + 0xa8]
movlpd qword [esp + 0x248], xmm0
mov dword [esp + 0xb0], ebx
call fcn.100185be
mov eax, dword [esp + 0x68]
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
mov edi, dword [esp + 0x34]
movlpd qword [esp + 0x50], xmm0
movlpd qword [esp + 0x40], xmm0
mov dword [esp + 0x5c], ebx
test eax, eax
jle 0x1004369d
mov esi, dword [esp + 0xa0]
mov ebx, dword [esp + 0x30]
push esi
push 0x1000889c
call fcn.1004a47b
add ebx, dword [esi]
mov eax, dword [esp + 0x70]
adc edi, dword [esi + 4]
add esi, 8
pop ecx
pop ecx
mov ecx, dword [esp + 0x5c]
inc ecx
mov dword [esp + 0x5c], ecx
cmp ecx, eax
jl 0x1004366f
mov dword [esp + 0x24], ebx
xor ebx, ebx
jmp 0x100436a5
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x24], ecx
mov esi, dword [esp + 0x40]
dec eax
mov dword [esp + 0x4c], edi
mov ecx, ebx
mov dword [esp + 0x30], eax
test eax, eax
jle 0x1004371b
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x5c], edx
mov edx, dword [esp + 0x44]
mov edi, dword [esp + 0xa0]
mov ebx, dword [esp + 0x5c]
push 0
add ebx, dword [edi + ecx*8]
mov dword [esp + 0x60], ebx
adc eax, dword [edi + ecx*8 + 4]
mov edi, dword [esp + 0x50]
mov dword [esp + 0x54], eax
mov eax, ebx
mov ebx, dword [esp + 0x54]
mov dword [esp + 0x44], ebx
shld dword [esp + 0x44], eax, 1
pop ebx
add eax, eax
cmp eax, dword [esp + 0x24]
jne 0x1004370e
cmp dword [esp + 0x40], edi
jne 0x1004370e
xor eax, eax
inc eax
add esi, eax
adc edx, ebx
mov eax, dword [esp + 0x50]
inc ecx
cmp ecx, dword [esp + 0x30]
jl 0x100436c8
jmp 0x1004371f
mov edx, dword [esp + 0x44]
push edx
push esi
push 0x100086a8
call fcn.1004a80c
add esp, 0xc
lea ecx, [esp + 0xa0]
call fcn.1000e49e
mov esi, dword [esp + 0xac]
push 2
pop edi
push edi
lea ecx, [esp + 0x1f0]
call fcn.1000d8e5
mov dword [esp + 0x18], 0x94a18885
mov dword [esp + 0x1c], ebx
jmp 0x10043775
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1ec]
mov dword [eax + ecx*4], 0x9b3198a8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1004375f
xor edx, edx
mov dword [esp + 0x18], ebx
inc edx
jmp 0x10043798
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1ec]
cmp dword [eax + ecx*4], ebx
jne 0x1004379e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jle 0x10043784
lea ecx, [esp + 0x1ec]
call fcn.1000e49e
lea eax, [esp + 0x94]
push eax
call fcn.10043c30
mov dword [eax], esi
jmp 0x100437be
push 2
pop edi
mov dword [esp + 0x40], 0xfff8
mov dword [esp + 0x50], 5
mov dword [esp + 0x14], 0x1860
mov dword [esp + 0x2c], 0x8cf5a8b
mov dword [esp + 0x1c], 7
mov dword [esp + 0x30], 0xa25a9550
mov dword [esp + 0x1c], ebx
jmp 0x10043807
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2b4], 0x88b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x100437f4
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x40], ebx
jne 0x1004381c
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x14]
xor edx, edx
sub eax, dword [esp + 0x14]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
imul ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x50]
cmp eax, ecx
setl dl
sub edx, dword [esp + 0x50]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [esp + 0x14]
jg 0x10043858
cmp dword [esp + 0x2c], ebx
je 0x10043858
xor edx, edx
inc edx
mov eax, edx
jmp 0x1004385d
xor edx, edx
mov eax, ebx
inc edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], ebx
jmp 0x100439b4
mov dword [esp + 0x3c], 0x734cb441
mov dword [esp + 0x40], 0x7cd95329
mov dword [esp + 0x1c], ebx
jmp 0x10043893
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x214], 0xe214
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10043880
mov dword [esp + 0x14], ebx
jmp 0x10043950
mov dword [esp + 0xc], ebx
jmp 0x100438b7
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x108], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x100438a8
mov dword [esp + 0xc], ebx
jmp 0x100438d6
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x18c], 0xfffffffa
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x100438c3
dec dword [esp + 0x108]
mov esi, edx
mov ecx, dword [esp + 0x108]
mov eax, dword [esp + 0x3c]
inc dword [esp + 0x3c]
cmp ecx, eax
mov eax, dword [esp + 0x18c]
cmove esi, ebx
xor ecx, ecx
cmp eax, 0x5d
mov eax, dword [esp + 0x18c]
setne cl
sub ecx, 0x8b9b
neg ecx
sbb ecx, ecx
inc ecx
cmp edx, ecx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setne cl
xor eax, eax
cmp esi, ecx
setg al
mov dword [esp + 0x40], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10043949
push ebx
push ebx
push 0x1950
call dword [sym.imp.ADVAPI32.dll_CopySid]
inc dword [esp + 0x14]
push 1
pop edx
cmp dword [esp + 0x14], edi
jle 0x100438a2
mov dword [esp + 0x1c], 0x118158fb
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x14], eax
jg 0x10043983
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x40], eax
cmp dword [esp + 0x40], ebx
je 0x10043983
xor eax, eax
inc eax
jmp 0x10043985
mov eax, ebx
mov ecx, dword [esp + 0x3c]
xor edx, edx
imul ecx, dword [esp + 0x14]
push 1
add ecx, eax
mov eax, dword [esp + 0x40]
cmp ecx, eax
mov eax, dword [esp + 0x21c]
setne dl
xor ecx, ecx
cmp edx, eax
pop edx
setle cl
mov dword [esp + 0x30], ecx
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x19
jle 0x1004386a
mov eax, dword [ebp + 8]
lea esi, [esp + 0xac]
mov ecx, dword [esp + 0x37c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret