Function at 0x10043f31
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10063f27
call fcn.100628e0
sub esp, 0x1ac
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x58], edx
je 0x1004407d
mov dword [ebp - 0x14], 0x715
cmp dword [ebp - 0x14], 0x964
push 0
pop ebx
jle 0x10043fed
mov esi, ebx
mov dword [ebp - 0x10], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
add edi, eax
add edi, esi
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x13c]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10043f9b
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x13c]
call fcn.1000d197
inc esi
cmp esi, 0x4a9c
jl 0x10043f7d
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
inc eax
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
cmp eax, 0x4e01
jl 0x10043f77
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x5cfa
jl 0x10043f72
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x7f20
jl 0x10043f6d
push ebx
push ebx
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
mov dword [ebp - 0x20], 0x7935
cmp dword [ebp - 0x20], 0x7a17
jle 0x10044047
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x18], 0xf47
mov eax, edi
lea ecx, [ebp - 0x16c]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10044022
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x16c]
call fcn.1000d197
add edi, esi
dec dword [ebp - 0x18]
jne 0x10044008
inc esi
cmp esi, 0x6d61
jl 0x10043fff
cmp dword [ebp - 0x20], 0x755a
jge 0x1004405b
push str.ygu_jbpry_gtf_hpw_rndy_aogkl_gkwrv_xuv_feemehj_qatgc_vdhurt_bvya_sbck
call fcn.1004d87c
pop ecx
cmp dword [ebp - 0x14], 0x57e
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jge 0x10044a8f
push str.ruc_iscywbnkr_miqlr_iflejat_tsaqskym_lxbyiobw_maofed_efq
call fcn.1004d87c
pop ecx
jmp 0x10044a8f
push ecx
lea ecx, [ebp - 0xf0]
call fcn.1000ccd5
xor ebx, ebx
lea ecx, [ebp - 0xd8]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x9b55bb2c
push 2
call fcn.1000cdd8
xor edx, edx
inc edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x10], ebx
jmp 0x100440bc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100440ad
push 0xfffffffffffffffb
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x1004418d
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], 0x266d8ff8
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0xd764ce34
mov dword [ebp - 0x98], 0xcd95ff7
mov dword [ebp - 0x40], ebx
jmp 0x10044181
mov dword [ebp - 0x9c], 0xa73d2d67
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x10], ebx
jmp 0x1004411f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x124], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10044112
push ecx
push 0x5a30
push 0x7518
push 0x3c15
push 0x6239
push ebx
push 0x3bc3
push 0x3cde
push ecx
mov edx, 0x10fa
mov ecx, 0xd0c
call fcn.10043d13
add esp, 0x24
lea eax, [ebp - 0x98]
lea ecx, [ebp - 0x9c]
push eax
sub esp, 0xc
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10046533
add esp, 0x18
xor edx, edx
inc dword [ebp - 0x40]
inc edx
cmp dword [ebp - 0x40], edx
jle 0x10044100
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jge 0x100440cd
lea ecx, [ebp - 0xd8]
mov byte [ebp - 4], bl
call fcn.1000ce5b
push ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0xf0]
call fcn.10048b0e
mov dword [ebp - 0x48], eax
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x10], 0xffffffff
push 2
call fcn.1000cdd8
push 3
lea ecx, [ebp - 0xc0]
mov byte [ebp - 4], 2
call fcn.1000cdd8
mov byte [ebp - 4], 3
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x24], ebx
jmp 0x100441fa
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x74], 0x4c924b54
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100441ec
sub esp, 0xc
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x24]
call fcn.10047ab7
add esp, 0xc
mov dword [ebp - 0x24], ebx
jmp 0x10044228
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10044219
mov dword [ebp - 0x10], 1
jmp 0x100442da
mov dword [ebp - 0x28], 0xf72d4ea6
mov dword [ebp - 0x14], 0x7c70ab22
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jge 0x10044289
mov dword [ebp - 0x1c], 0xfffffffe
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setne dl
imul eax, dword [ebp - 0x10]
xor ecx, ecx
add eax, edx
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x14]
cmp eax, 1
mov eax, dword [ebp - 0xa8]
setge cl
mov dword [eax + 4], ecx
jmp 0x10044290
xor cl, cl
call fcn.100438f8
mov dword [ebp - 0x14], ebx
jmp 0x100442d1
push ecx
push ebx
push ecx
push 0x5319
push ecx
mov edx, 0x5244
lea ecx, [ebp - 0x28]
call fcn.10045733
add esp, 0x14
mov dword [ebp - 0x28], ebx
jmp 0x100442c8
mov byte [ebp - 0x31], bl
cmp byte [ebp - 0x31], 0
je 0x100442c5
push ecx
push ecx
call fcn.10045ca3
pop ecx
pop ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jle 0x100442b3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x10044295
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jg 0x1004423a
cmp dword [ebp - 0x70], ebx
jne 0x10044320
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0xa8]
cmp dword [edx], 0xa6add33d
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, esi
mov eax, dword [ebp - 0xc0]
setg cl
mov eax, dword [eax]
add eax, 2
add eax, ecx
imul eax, dword [edx + 4]
cmp eax, dword [ebp - 0x38]
jle 0x10044320
mov ecx, ebx
jmp 0x10044323
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0xa8]
mov dword [eax], ecx
lea ecx, [ebp - 0xc0]
call fcn.1000ce5b
lea ecx, [ebp - 0xa8]
mov byte [ebp - 4], bl
call fcn.1000ce5b
cmp dword [ebp - 0x48], 0xffffffff
je 0x1004440b
mov dword [ebp - 0x18], 0x4e67
cmp dword [ebp - 0x18], 0x4fd1
jle 0x100443ad
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x19c]
or eax, esi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1004437e
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x19c]
call fcn.1000d197
inc edi
cmp edi, 0x692a
jl 0x10044362
inc esi
cmp esi, 0x28fe
jl 0x10044360
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetWindowPlacement]
cmp dword [ebp - 0x18], 0x4b2e
jge 0x100443c1
push str.obeqecbw_ghcclre_jaeeqmr_bcyfkyct_fgviq_kmfdc_ihwdij_jkj_afimuolm_fwxwhxtf_froxxka_ybfutm
call fcn.1004d87c
pop ecx
mov dword [ebp - 0x10], ebx
jmp 0x100443d4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], 0x4fd3df75
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x100443c6
mov dword [ebp - 0x50], 0x1b
jmp 0x100443ed
mov cl, 1
call fcn.100438f8
inc dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0x1d
jle 0x100443e3
lea eax, [ebp - 0x48]
xor dl, dl
push 0x1058
push eax
lea ecx, [ebp - 0xf0]
call fcn.10045108
pop ecx
pop ecx
push dword [ebp - 0x58]
movdqa xmm0, xmmword [0x10075500]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x80], ebx
push eax
push ebx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x7c], ebx
movdqu xmmword [ebp - 0x11c], xmm0
mov dword [ebp - 0x78], ebx
call fcn.1000f388
mov byte [ebp - 4], 4
xor ecx, ecx
mov dword [ebp - 0x2c], 6
inc ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x18], 5
mov dword [ebp - 0x1c], 0x39032f82
mov dword [ebp - 0x10], ebx
jmp 0x10044473
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x54], 0xce1c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10044465
mov dword [ebp - 0x2c], ebx
jmp 0x1004465b
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x38], 0xffffffff
push eax
lea eax, [ebp - 0x4c]
mov edx, 0x2ba3
push eax
push ecx
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x314e
lea ecx, [ebp - 0x2c]
call fcn.100439ac
add esp, 0x18
mov dword [ebp - 0x3c], ebx
jmp 0x1004464e
mov dword [ebp - 0x14], 0x399c
cmp dword [ebp - 0x14], 0x3c31
jle 0x1004454b
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov edi, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], 0x6cf1
mov esi, ebx
mov eax, edi
mov ecx, ebx
xor eax, esi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
or eax, ecx
lea ecx, [ebp - 0x154]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10044506
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x154]
call fcn.1000d197
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x5709
jl 0x100444ec
inc esi
cmp esi, 0x417c
jl 0x100444e0
dec edi
dec dword [ebp - 0x20]
jne 0x100444de
mov edi, dword [ebp - 0x10]
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x4834
jl 0x100444d4
push 2
lea ecx, [ebp - 0x100]
call fcn.1000cdd8
mov byte [ebp - 4], 5
cmp dword [ebp - 0x14], 0x3848
jge 0x10044570
push str.erwri_ndnu_wukkil_ajsqekw
call fcn.1004d87c
pop ecx
push 0x3639
lea eax, [ebp - 0x100]
push eax
push ebx
push ecx
lea edx, [ebp - 0xf4]
call fcn.10045ab1
mov dword [ebp - 0x20], 0x7024
add esp, 0x10
cmp dword [ebp - 0x20], 0x7057
jle 0x100445ea
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, esi
mov esi, 0x4930
mov eax, edi
lea ecx, [ebp - 0x184]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100445c2
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x184]
call fcn.1000d197
dec edi
dec esi
jne 0x100445a8
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x50f1
jl 0x100445a1
mov dword [ebp - 0x4c], 3
cmp dword [ebp - 0x4c], ebx
jl 0x10044628
mov eax, dword [ebp - 0x2c]
mov edx, 0xffff
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x80]
cmp edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x54]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x4c]
jns 0x100445f6
cmp dword [ebp - 0x20], 0x6c72
jge 0x1004463c
push str.gfbv_ekjtt_mjvabmiwx_tskglw
call fcn.1004d87c
pop ecx
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 4
call fcn.1000ce5b
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 3
jle 0x100444b2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jle 0x10044480
lea eax, [ebp - 0x32]
mov byte [ebp - 0x32], bl
push eax
mov edx, 0x7dd5
xor cl, cl
call fcn.10044ad6
pop ecx
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], bl
call fcn.1000ce5b
push ecx
push dword [ebp + 0x10]
lea ecx, [ebp - 0xf0]
call fcn.10048a8a
push 2
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x48], eax
call fcn.1000cdd8
mov byte [ebp - 4], 6
mov dword [ebp - 0x20], 0x11eb
cmp dword [ebp - 0x20], 0x1325
jle 0x100446fd
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov eax, edi
mov dword [ebp - 0x1c], ebx
cdq
idiv esi
mov edi, edx
mov eax, edi
mov ecx, 0x1007bbb8
and eax, ebx
cdq
push edx
push eax
call fcn.1000cbc0
inc ebx
cmp ebx, 0x1b62
jl 0x100446c8
mov edi, dword [ebp - 0x18]
inc esi
push 0
pop ebx
cmp esi, 0x7a0a
jl 0x100446be
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x1e41
jl 0x100446bc
cmp dword [ebp - 0x20], 0xe4b
jge 0x10044715
mov edx, str.xyeaaxc_aav_jkge_kktxwkqje_lxpw_lumntjy_majo_vyk_gjdrgofx
mov ecx, 0x1007bbb8
call fcn.1000ee07
push 1
lea eax, [ebp - 0x44]
mov dword [ebp - 0x30], 0xfff7
push eax
lea eax, [ebp - 0x10c]
mov edx, 0x1b1
push eax
call fcn.100435e6
add esp, 0xc
mov dword [ebp - 0x44], ebx
jmp 0x10044749
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x68], 0x9bdba76a
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 4
jl 0x1004473b
mov dword [ebp - 0x5c], ebx
jmp 0x100448e5
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x20], 0x289f
cmp dword [ebp - 0x20], 0x2c37
jle 0x100447b0
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetMenu]
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x1007bbb8
or eax, edi
cdq
push edx
push eax
call fcn.1000cbc0
inc ebx
cmp ebx, 0x331a
jl 0x1004477d
inc esi
push 0
pop ebx
cmp esi, 0x6ab3
jl 0x1004477a
inc edi
cmp edi, 0x30c5
jl 0x10044778
mov dword [ebp - 0x10], 0x35240ca7
cmp dword [ebp - 0x20], 0x252d
jge 0x100447cf
mov edx, str.lcwvb_skimhbsjb_jll_jjl_mkgvunnc_kcnvl_qepkaeihv
mov ecx, 0x1007bbb8
call fcn.1000ee07
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x18]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x5c]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x5c]
setl cl
sub eax, ecx
je 0x10044800
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x5c], ebx
jne 0x1004480e
cmp dword [ebp - 0x18], ebx
jne 0x1004480e
mov eax, ebx
jmp 0x10044811
xor eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], ebx
jl 0x100448e2
mov dword [ebp - 0x1c], 0x6f1
cmp dword [ebp - 0x1c], 0xa2c
jle 0x100448bb
mov dword [ebp - 0x20], ebx
mov esi, ebx
mov dword [ebp - 0x38], ebx
mov eax, esi
mov dword [ebp - 0x6c], 0x768e
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov edi, ebx
and eax, edi
lea ecx, [ebp - 0x1b4]
or eax, esi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1004486d
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1000d197
mov eax, dword [ebp - 0x14]
inc edi
cmp edi, 0x50f0
jl 0x10044851
dec eax
dec dword [ebp - 0x6c]
mov dword [ebp - 0x14], eax
jne 0x1004484f
mov esi, dword [ebp - 0x38]
inc esi
mov dword [ebp - 0x38], esi
cmp esi, 0x7511
jl 0x10044840
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x735b
jl 0x1004483b
push ebx
call dword [sym.imp.USER32.dll_RegisterClassA]
cmp dword [ebp - 0x5c], ebx
jne 0x100448e2
cmp dword [ebp - 0x1c], 0x5cd
jge 0x100448d4
push str.ivkmgh_xiiniaage_jjoi_giaqpn_ypjcgkeuu
call fcn.1004d87c
pop ecx
cmp dword [ebp - 0x18], ebx
jne 0x100448e2
dec dword [ebp - 0x10]
jns 0x10044824
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], 1
jle 0x10044757
lea ecx, [ebp - 0x10c]
mov byte [ebp - 4], bl
call fcn.1000ce5b
or edi, 0xffffffff
cmp dword [ebp - 0x48], edi
je 0x10044964
mov dword [ebp - 0x14], 0x68206240
mov dword [ebp - 0x14], 0xfffffff7
jmp 0x10044930
push 0x4594
push 0x5ad7
mov edx, 0x4c01
xor cl, cl
call fcn.100488b8
inc dword [ebp - 0x14]
pop ecx
pop ecx
cmp dword [ebp - 0x14], 0x1d
jl 0x10044915
mov dword [ebp - 0x14], ebx
jmp 0x10044949
push ecx
push ecx
mov cl, 1
call fcn.10047fa5
dec dword [ebp - 0x14]
pop ecx
pop ecx
cmp dword [ebp - 0x14], 0xffffffef
jne 0x1004493b
sub esp, 0xc
lea eax, [ebp - 0xf0]
lea edx, [ebp - 0x48]
push eax
call fcn.10048769
add esp, 0x10
push 4
lea ecx, [ebp - 0xb4]
call fcn.1000cdd8
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xcc]
mov eax, 0x74c3
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x1c], edi
push 4
call fcn.1000cdd8
push ecx
push ecx
lea eax, [ebp - 0x94]
mov byte [ebp - 4], 8
push eax
push 1
push 0x10b3
lea ecx, [ebp - 0xb4]
call fcn.100434fb
add esp, 0x14
lea eax, [ebp - 0x94]
push eax
lea eax, [ebp - 0xcc]
push eax
push ecx
call fcn.10044b8b
mov eax, dword [ebp - 0x84]
add esp, 0xc
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 0xb4]
cmp dword [eax + 8], ebx
jne 0x10044a05
cmp dword [ebp - 0x84], ebx
jne 0x10044a05
mov ecx, ebx
jmp 0x10044a08
xor ecx, ecx
inc ecx
mov esi, dword [ebp - 0xb4]
mov eax, dword [esi + 4]
imul eax, ecx
test eax, eax
je 0x10044a1e
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1c], edi
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov esi, dword [esi + 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x90]
cmp ecx, eax
setge dl
cmp edx, 3
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, esi
mov eax, dword [ebp - 0xcc]
setge cl
sub esi, ecx
lea ecx, [ebp - 0xcc]
mov dword [eax], esi
call fcn.1000ce5b
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], bl
call fcn.1000ce5b
mov eax, dword [ebp - 0x58]
lea ecx, [ebp - 0xf0]
cmp eax, ecx
je 0x10044a81
push edi
push ebx
push ecx
mov ecx, eax
call fcn.1000d1db
push ebx
push 1
lea ecx, [ebp - 0xf0]
call fcn.1000d3a5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret