Function at 0x1004c0a9
Capabilities:
Check os version
Get common file path
Log keystrokes via polling
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10072fc9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x420
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x58], ecx
inc edi
mov dword [esp + 0xe8], edx
push edi
lea ecx, [esp + 0x170]
call fcn.100105fb
mov dword [esp + 0x30], 0xfffffffe
xor ebx, ebx
mov dword [esp + 0x1c], 0x34cb4417
mov dword [esp + 0x14], ebx
jmp 0x1004c116
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0x642c70bb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004c100
mov eax, dword [esp + 0x16c]
xor ecx, ecx
mov esi, dword [eax]
cmp esi, 0x1de6
mov eax, esi
setne cl
sub eax, ecx
xor ecx, ecx
cmp esi, eax
setl cl
cmp ecx, 0x2806
jl 0x1004c149
mov edx, ebx
test esi, esi
je 0x1004c14b
mov edx, edi
mov eax, dword [esp + 0x30]
imul edx, esi
shl edx, 3
sub edx, 0x849968cb
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1004c17c
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [esp + 0x16c]
call fcn.10057c67
mov eax, dword [0x119e3410]
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x178], ebx
pop ecx
test al, 1
jne 0x1004c240
or eax, edi
mov dword [0x119e3410], eax
push ebx
mov dword [esp + 0x438], ebx
push ebx
mov dword [0x119e33f0], ebx
mov dword [0x119e33f4], ebx
call fcn.1003f38f
mov dword [0x119e33f0], eax
mov dword [0x119e33f8], ebx
mov dword [0x119e3400], ebx
mov byte [esp + 0x434], 2
mov ecx, 0x119e33f8
mov dword [esp + 0x1a8], eax
lea eax, [esp + 0x1a8]
push eax
push 0x10
push ebx
lea eax, [esp + 0x23c]
mov dword [0x119e340c], 0x3f800000
push eax
mov dword [0x119e33fc], ebx
call fcn.1003f167
push 0x100734a6
mov dword [0x119e3404], 7
mov dword [0x119e3408], 8
call fcn.10057acc
or dword [esp + 0x438], 0xffffffff
pop ecx
mov dword [esp + 0x20], 0x2e91a049
mov dword [esp + 0x18], 9
mov dword [esp + 0x1c8], 0x643a64e7
mov dword [esp + 0x158], edi
mov dword [esp + 0x20], 0xfffffffc
jmp 0x1004c54f
push edi
lea ecx, [esp + 0x80]
call fcn.100105fb
push edi
lea ecx, [esp + 0xfc]
mov dword [esp + 0x438], 3
call fcn.100105fb
mov dword [esp + 0x14], 4
mov dword [esp + 0x28], 0xe10ef7d5
mov dword [esp + 0x28], 0x215f8f50
mov dword [esp + 0xc], ebx
jmp 0x1004c2c5
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], 0x24f84b81
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1004c2b2
mov dword [esp + 0xc], ebx
jmp 0x1004c2e7
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0xaa39ed08
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1004c2d1
mov eax, dword [esp + 0xf8]
mov dword [eax], ebx
mov dword [esp + 0x24], 0xb3f36565
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x34], 0xfffffff9
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jl 0x1004c4ef
mov dword [esp + 0xc], 0xfc88eb98
mov dword [esp + 0x34], 0xef544bd1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004c34e
push ebx
push ebx
push 0x1f00
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], ebx
jg 0x1004c4e5
cmp dword [esp + 0x20], ebx
jne 0x1004c382
mov eax, dword [esp + 0x7c]
cmp dword [eax], ebx
je 0x1004c372
mov eax, edi
cmp dword [esp + 0xc], ebx
jne 0x1004c374
mov eax, ebx
cmp eax, edi
sbb eax, eax
neg eax
cmp eax, dword [esp + 0x20]
jg 0x1004c382
mov edi, ebx
mov esi, dword [esp + 0xf8]
xor ecx, ecx
mov edx, dword [esp + 0x7c]
mov eax, dword [esi]
cmp edi, dword [edx + eax*4]
mov eax, dword [esi]
setge cl
mov dword [esp + 0x18], ecx
mov ecx, 0xf5d870a3
cmp ecx, dword [edx + eax*4]
mov eax, dword [esp + 0xc]
sbb edx, edx
imul eax, dword [esp + 0x18]
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x1004c4d4
mov dword [esp + 0x64], 2
mov dword [esp + 0x30], 0xffffffff
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004c3ed
push ebx
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x1004c4ca
mov dword [esp + 0x30], 0xffffffff
xor ecx, ecx
mov dword [esp + 0x38], 0x36fe5438
mov eax, dword [esp + 0x30]
cmp eax, 0x213aabdc
mov eax, dword [esp + 0x30]
setne cl
xor edx, edx
cmp ecx, eax
setg dl
inc dword [esp + 0x38]
mov eax, dword [esp + 0x38]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
setge dl
sub edx, 0xfffe
add edx, dword [esp + 0x1c8]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x1c], edx
xor edx, edx
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setge dl
add edx, 0x47ebdcf2
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x158]
jne 0x1004c484
cmp dword [esp + 0x34], ebx
jne 0x1004c484
mov edi, ebx
jmp 0x1004c487
xor edi, edi
inc edi
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x7c]
mov edx, dword [esp + 0x7c]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [edx + esi*4], eax
cmp eax, 0x51162d50
mov eax, dword [esp + 0x28]
mov edx, 0xfff9
setge cl
imul eax, edi
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x30], ecx
dec dword [esp + 0x14]
jns 0x1004c3fb
dec dword [esp + 0x18]
jns 0x1004c3cb
inc dword [esp + 0xc]
push 1
pop edi
cmp dword [esp + 0xc], ebx
jle 0x1004c35c
dec dword [esp + 0x24]
jns 0x1004c324
mov eax, dword [esp + 0xf8]
inc dword [eax]
cmp dword [eax], 0
jle 0x1004c2f6
push eax
call fcn.10057c67
or dword [esp + 0x438], 0xffffffff
cmp dword [esp + 0x80], 0
pop ecx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
je 0x1004c54b
push dword [esp + 0x7c]
call fcn.10057c67
pop ecx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 5
jl 0x1004c26f
imul eax, dword [esp + 0x58], 0x2710
add eax, dword [esp + 0xe8]
mov dword [esp + 0xf0], eax
mov dword [esp + 0xc], 0x99841b3c
mov dword [esp + 0x1c], 0x9611ca4b
mov dword [esp + 0x28], 0xbe99b96b
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 0x2e0c
mov dword [esp + 0x28], 0xade45a91
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x14], ebx
jmp 0x1004c5c1
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1a0], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004c5ae
push 0xfffffffffffffff7
pop esi
mov dword [esp + 0xc], esi
jmp 0x1004c6c2
mov dword [esp + 0x18], 0xaa29c146
mov dword [esp + 0x14], ebx
jmp 0x1004c5f4
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x280], 0xcd538770
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004c5e1
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setg cl
add eax, 0x4b7c8e78
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x28]
setg cl
cmp ecx, dword [esp + 0x18]
jge 0x1004c6b0
cmp dword [esp + 0x18], ebx
je 0x1004c6b0
mov dword [esp + 0x24], 0x65c829e
cmp dword [esp + 0x24], ebx
jne 0x1004c661
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x18], ebx
jne 0x1004c65d
cmp dword [esp + 0xc], ebx
je 0x1004c661
mov ecx, edi
jmp 0x1004c663
mov ecx, ebx
xor eax, eax
cmp ecx, 0x5cab
setl al
xor ecx, ecx
cmp eax, 6
mov eax, dword [esp + 0xc]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
imul eax, dword [esp + 0xc]
sub eax, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0xc]
mov dword [esp + 0x284], eax
jmp 0x1004c6be
mov dword [esp + 0x30], 0xfffa
inc dword [esp + 0x30]
jne 0x1004c6cd
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe8
jge 0x1004c5d3
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0x1f95
cmp dword [esp + 0x28], 0x825
jge 0x1004c728
lea eax, [esp + 0xa4]
mov dword [esp + 0xa4], ebx
push eax
push 0x1000b1b8
call fcn.100578db
pop ecx
pop ecx
mov ecx, dword [esp + 0xa4]
mov edx, edi
dec ecx
test ecx, ecx
jle 0x1004c71b
imul eax, edx, 3
push 0x57
pop esi
cdq
idiv esi
dec ecx
jne 0x1004c70c
push 0xfffffffffffffff7
pop esi
push edx
push 0x1000b238
call fcn.10057af6
pop ecx
pop ecx
lea eax, [esp + 0xf0]
push eax
call fcn.1004e6d9
mov eax, dword [eax]
test eax, eax
je 0x1004c789
mov dword [esp + 0x14], 0x53b26bdd
mov dword [esp + 0x1bc], eax
mov dword [esp + 0x14], ebx
jmp 0x1004c77d
mov dword [esp + 0x28], 0x318d5816
cmp dword [esp + 0x28], ebx
jne 0x1004e4da
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004c779
push ebx
push 0x24a6
call dword [sym.imp.USER32.dll_KillTimer]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xa
jle 0x1004c750
jmp 0x1004e4da
push dword [esp + 0x1a0]
movdqa xmm0, xmmword [0x1000b930]
lea eax, [esp + 0x274]
push eax
lea eax, [esp + 0x268]
mov dword [esp + 0x14], esi
push eax
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x7c]
push ebx
movdqu xmmword [esp + 0x270], xmm0
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
call fcn.100147ae
push 4
pop esi
mov dword [esp + 0x434], esi
xor edx, edx
mov dword [esp + 0x14], 0x78c007c7
mov dword [esp + 0x1c], 0x2cb818eb
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x70]
mov dword [eax], ecx
add ecx, 0xff8e
mov eax, dword [esp + 0xc]
cmp eax, ecx
setl dl
xor eax, eax
add edx, 7
cmp edx, 0x7814
setl al
xor ecx, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x28], eax
setne cl
add ecx, 0xf5ef
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
test eax, eax
setle cl
cmp ecx, dword [esp + 0xc]
jl 0x1004c95e
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x24], esi
mov dword [esp + 0x34], 0xcb8f1fe3
push edi
call fcn.100105fb
mov dword [esp + 0x28], 0xb8af769b
mov dword [esp + 0x18], ebx
jmp 0x1004c89c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1ac]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1004c886
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004c8b4
push ebx
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov eax, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0x24]
mov esi, edi
mov eax, dword [esp + 0x70]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x1c]
setle dl
inc dword [esp + 0x1c]
cmp eax, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
cmove esi, ebx
mov eax, dword [esp + 0x70]
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [esp + 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov eax, dword [esp + 0x14]
cmp esi, eax
setge cl
add ecx, dword [esp + 0x38]
cmp ecx, 0x9c7d4e78
sbb eax, eax
neg eax
cmp eax, dword [esp + 0x24]
jle 0x1004c91f
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x28]
imul ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x1ac]
push eax
mov dword [eax], ecx
call fcn.10057c67
pop ecx
push 3
mov dword [esp + 0x1b0], ebx
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x1b8], ebx
pop esi
jmp 0x1004c99b
push 3
pop esi
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], ebx
jl 0x1004c985
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004c97f
push edi
push 0x12
call dword [sym.imp.USER32.dll_FlashWindow]
dec dword [esp + 0xc]
jns 0x1004c96b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004c99b
push 0x209d
call dword [sym.imp.USER32.dll_GetParent]
or dword [esp + 0x434], 0xffffffff
push dword [esp + 0x70]
call fcn.10057c67
mov eax, dword [0x119e3410]
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
pop ecx
test al, 2
jne 0x1004ca60
or eax, 2
mov dword [0x119e3410], eax
push ebx
mov dword [esp + 0x438], 5
push ebx
mov dword [0x119e33d0], ebx
mov dword [0x119e33d4], ebx
call fcn.1003f38f
mov dword [0x119e33d0], eax
mov dword [0x119e33d8], ebx
mov dword [0x119e33e0], ebx
mov byte [esp + 0x434], 7
mov ecx, 0x119e33d8
mov dword [esp + 0x1b8], eax
lea eax, [esp + 0x1b8]
push eax
push 0x10
push ebx
lea eax, [esp + 0x238]
mov dword [0x119e33ec], 0x3f800000
push eax
mov dword [0x119e33dc], ebx
call fcn.1003f167
push 0x100734a1
mov dword [0x119e33e4], 7
mov dword [0x119e33e8], 8
call fcn.10057acc
or dword [esp + 0x438], 0xffffffff
pop ecx
mov dword [esp + 0x14], ebx
jmp 0x1004ca76
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x48], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1004ca66
mov dword [esp + 0x48], 0xffffffe7
jmp 0x1004ca98
cmp byte [esp + 0x13], 0
je 0x1004ca94
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
inc dword [esp + 0x48]
cmp dword [esp + 0x48], 0x11
mov byte [esp + 0x13], bl
jle 0x1004ca86
cmp byte [esp + 0x13], 0
je 0x1004cabf
push 0x21cb
push 0x1dda
push 0x54a
call dword [sym.imp.USER32.dll_SetWindowLongW]
xorps xmm0, xmm0
movdqu xmmword [esp + 0x190], xmm0
mov dword [esp + 0xc], ebx
jmp 0x1004cae4
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x140], 0x69fdf99f
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1004cad1
mov dword [esp + 0xc], ebx
jmp 0x1004cb03
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x210], 0xffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1004caf0
mov dword [esp + 0x148], ebx
jmp 0x1004cbe0
push 2
lea ecx, [esp + 0x164]
call fcn.100105fb
push 2
mov dword [esp + 0x34], ebx
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1004cb46
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0x485bf25c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1004cb30
mov esi, dword [esp + 0x160]
mov dword [esi + 4], edx
mov eax, dword [esi + 4]
sub eax, 0x25468c82
mov dword [esp + 0x28], 0xe3f2f34e
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x144]
imul eax, dword [esp + 0x30]
dec eax
jne 0x1004cb80
mov eax, dword [esp + 0x218]
mov eax, dword [esi + 4]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x210]
mov eax, dword [esp + 0x148]
mov ecx, dword [esi + 4]
inc eax
imul eax, ecx
cmp edx, eax
mov eax, dword [esp + ecx*4 + 0x210]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setl cl
dec dword [esi + 4]
mov dword [esp + 0x28], ecx
jns 0x1004cb56
push dword [esp + 0x160]
call fcn.10057c67
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ebx
dec dword [esp + 0x14c]
pop ecx
cmp dword [esp + 0x148], 0xffffffef
jge 0x1004cb15
lea eax, [esp + 0x58]
push eax
call fcn.1004e73b
mov eax, dword [eax]
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x14], 0x1b
cmp dword [esp + 0x14], 0xfffffff3
mov dword [esp + 0x30], eax
jg 0x1004cd37
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x14], ebx
jne 0x1004cd30
mov dword [esp + 0x18], ebx
jmp 0x1004cd16
mov dword [esp + 0x28], 0x2569
cmp dword [esp + 0x28], 0x1256
jge 0x1004cd06
lea eax, [esp + 0x60]
push eax
push 0x1000b1b8
call fcn.100578db
pop ecx
pop ecx
jmp 0x1004ccf5
dec eax
mov dword [esp + 0x60], eax
lea eax, [esp + 0x1a4]
push eax
push 0x1000b1b8
call fcn.100578db
mov edi, dword [esp + 0x1ac]
pop ecx
pop ecx
lea eax, [edi*2 + 1]
cdq
mov esi, eax
mov ecx, edx
lea eax, [edi + 1]
cdq
push edx
push eax
push ecx
push esi
call fcn.1005ddd0
mov esi, eax
mov ecx, edx
mov eax, edi
cdq
push edx
push eax
push ecx
push esi
call fcn.1005ddd0
push ebx
push 6
push edx
push eax
call fcn.1005de10
mov esi, eax
mov dword [esp + 0x28], edx
lea eax, [edi + 1]
imul eax, edi
cdq
sub eax, edx
sar eax, 1
cdq
push edx
push eax
push edx
push eax
call fcn.1005ddd0
mov ecx, dword [esp + 0x28]
cmp ecx, edx
jb 0x1004ccde
ja 0x1004ccd8
cmp esi, eax
jbe 0x1004ccde
sub esi, eax
sbb ecx, edx
jmp 0x1004cce6
sub eax, esi
mov esi, eax
sbb edx, ecx
mov ecx, edx
push ecx
push esi
push 0x1000b764
call fcn.10057af6
add esp, 0xc
mov eax, dword [esp + 0x60]
test eax, eax
jne 0x1004cc5c
dec eax
mov dword [esp + 0x60], eax
mov dword [esp + 0x1c], 0xffffffff
inc dword [esp + 0x1c]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff2
jle 0x1004cc30
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff3
jle 0x1004cc19
mov eax, dword [esp + 0x30]
xor edi, edi
inc edi
mov dl, byte [ebp + 0xc]
test dl, dl
jne 0x1004cd46
test eax, eax
jne 0x1004d1df
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], 0x415d7249
mov dword [esp + 0xc], ebx
jmp 0x1004cd6b
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x23c], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1004cd5c
mov dword [esp + 0xc], ebx
jmp 0x1004cd8b
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x94], 0x8c66f5a9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1004cd78
mov dword [esp + 0x18], ebx
jmp 0x1004cdb1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0x23c]
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x23c], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x1004cd97
dec dword [esp + 0x1c]
lea eax, [esp + 0x2c0]
mov ecx, dword [esp + 0x58]
push eax
call fcn.10040629
mov esi, eax
lea edi, [esp + 0x194]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x28], 0x1f95
cmp dword [esp + 0x28], 0x11ae
jge 0x1004cf50
push 0x144
lea eax, [esp + 0x2e8]
mov dword [esp + 0x2e4], ebx
push ebx
push eax
call fcn.10057bb0
add esp, 0xc
mov dword [esp + 0x40], ebx
lea eax, [esp + 0x40]
xor edi, edi
inc edi
xorps xmm0, xmm0
mov esi, edi
movsd qword [esp + 0x28], xmm0
push eax
push 0x1000b4e4
call fcn.100578db
pop ecx
pop ecx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0x4c], ebx
jmp 0x1004cf3d
dec eax
mov dword [esp + 0x40], eax
lea eax, [esp + 0x4c]
push eax
push 0x1000b1b8
call fcn.100578db
pop ecx
pop ecx
cmp dword [esp + 0x4c], edi
jne 0x1004cebe
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0xb8]
push eax
push 0x1000b218
call fcn.100578db
mov ecx, dword [esp + 0xc0]
add esp, 0xc
mov edx, dword [esp + 0xe4]
mov eax, ebx
test ecx, ecx
jle 0x1004cea8
add dword [esp + eax*4 + 0x2e0], edx
inc eax
cmp eax, ecx
jl 0x1004ce9c
imul ecx, edx
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
addsd xmm0, qword [esp + 0x28]
movaps xmm1, xmm0
jmp 0x1004cf17
cmp dword [esp + 0x4c], 2
jne 0x1004cef8
lea eax, [esp + 0xec]
push eax
push 0x1000b4e4
call fcn.100578db
mov eax, dword [esp + 0xf4]
pop ecx
mov dword [esp + esi*4 + 0x2e4], eax
inc esi
pop ecx
movd xmm0, eax
cvtdq2pd xmm1, xmm0
addsd xmm1, qword [esp + 0x28]
jmp 0x1004cf17
cmp dword [esp + 0x4c], 3
movsd xmm1, qword [esp + 0x28]
jne 0x1004cf1d
movd xmm0, dword [esp + esi*4 + 0x2dc]
dec esi
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
movsd qword [esp + 0x28], xmm1
movd xmm0, esi
cvtdq2pd xmm0, xmm0
push ecx
push ecx
divsd xmm1, xmm0
movsd qword [esp], xmm1
push 0x1000b850
call fcn.10057af6
add esp, 0xc
mov eax, dword [esp + 0x40]
test eax, eax
jne 0x1004ce4f
dec eax
mov dword [esp + 0x40], eax
jmp 0x1004cf53
xor edi, edi
inc edi
mov dword [esp + 0xc], 0x7a3a11c1
mov dword [esp + 0x18], 0xe7bff44c
mov dword [esp + 0x28], 0x196e86ff
mov dword [esp + 0x1c], 0xec415051
mov dword [esp + 0x34], 0xfe3d2f55
mov dword [esp + 0x34], 7
mov dword [esp + 0x14], ebx
jmp 0x1004cf9c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x298], 0x3a5bed85
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004cf89
mov dword [esp + 0x18], 0xf4727cad
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], 9
je 0x1004cff2
mov ecx, ebx
cmp dword [esp + 0x18], ebx
je 0x1004cff4
mov ecx, edi
mov eax, dword [esp + 0xc]
xor edx, edx
cmp eax, ecx
setl dl
sub edx, dword [esp + 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [esp + 0x2a0], edx
mov eax, dword [esp + 0xc]
cmp edx, eax
setne cl
cmp ecx, 0xfffd
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 2
setl cl
cmp byte [ebp + 0xc], 0
mov dword [esp + 0x34], ecx
je 0x1004d1df
cmp dword [esp + 0x198], 0
je 0x1004d1df
mov dword [esp + 0x1c], 0x8939f5fa
mov dword [esp + 0x38], edi
mov dword [esp + 0x1c], 0x8d72a67f
mov dword [esp + 0x1c], 0x826f393
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x1c], 0x4ed383de
mov dword [esp + 0xc], ebx
jmp 0x1004d089
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x68], 0x5d16df25
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1004d079
mov dword [esp + 0xc], ebx
jmp 0x1004d0a5
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x248], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1004d096
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004d0cd
push ebx
push 0xde6
push 0x22a5
push 0x66f
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov eax, 0xa8afc1da
mov dword [esp + 0x24c], eax
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
sub edx, 2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x38]
jle 0x1004d10a
mov edx, ebx
cmp dword [esp + 0x6c], ebx
je 0x1004d10c
mov edx, edi
mov eax, dword [esp + 0x6c]
neg edx
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x6c]
setl cl
xor edx, edx
cmp eax, ecx
setl dl
sub edx, 0xfffffffc
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x1c], edx
imul eax, dword [esp + 0x1c], 0xffff
mov ecx, dword [esp + 0x68]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x6c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x19c]
setl dl
mov dword [esp + 0x1c0], eax
mov dword [esp + 0x6c], edx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x1004d197
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2b4], 5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004d184
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x1004d1d1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004d1cb
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
dec dword [esp + 0x18]
jns 0x1004d1b9
mov eax, dword [esp + 0x198]
mov dword [esp + 0x1c4], eax
mov dword [esp + 0x18], 9
mov dword [esp + 0x14], ebx
jmp 0x1004d1fc
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x204], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004d1ed
mov dword [esp + 0x18], ebx
jmp 0x1004d4cb
mov dword [esp + 0xc], edi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004d223
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 2
jg 0x1004d4c7
mov dword [esp + 0x14], ebx
jmp 0x1004d24b
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1f4], 0xbc781ced
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1004d238
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x204]
cmp eax, 0xffff
mov eax, dword [esp + 0xc]
sete dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x204]
cmp eax, edx
mov eax, dword [esp + 0xc]
setne cl
mov dword [esp + eax*4 + 0x204], ecx
mov dword [esp + 0x28], 0x1c20
cmp dword [esp + 0x28], 0xb2a
jge 0x1004d484
lea eax, [esp + 0x44]
mov dword [esp + 0x5c], ebx
push eax
lea eax, [esp + 0x60]
mov dword [esp + 0x48], ebx
push eax
push 0x1000b1d8
call fcn.100578db
add esp, 0xc
mov byte [esp + 0x3f], 0x30
lea eax, [esp + 0x3f]
mov dword [esp + 0x88], ebx
lea ecx, [esp + 0x88]
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
push eax
push dword [esp + 0x48]
call fcn.1004ea4b
mov dword [esp + 0x434], 8
lea eax, [esp + 0x88]
push eax
push dword [esp + 0x60]
lea ecx, [esp + 0x18c]
mov dword [esp + 0x18c], ebx
mov dword [esp + 0x190], ebx
mov dword [esp + 0x194], ebx
call fcn.1004ea80
or dword [esp + 0x434], 0xffffffff
cmp dword [esp + 0x88], 0
je 0x1004d354
push dword [esp + 0x88]
call fcn.10057c67
pop ecx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov eax, dword [esp + 0x5c]
mov ecx, ebx
mov edx, dword [esp + 0x44]
mov esi, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x1c], ebx
test eax, eax
jle 0x1004d422
mov eax, dword [esp + 0x184]
mov dword [esp + 0x38], eax
cmp dword [esp + 0x44], 0
mov edi, ebx
jle 0x1004d3ef
mov ebx, dword [esp + 0x20]
lea eax, [esp + 0x3e]
mov byte [esp + 0x3e], 0x30
push eax
push 0x1000b214
call fcn.100578db
mov eax, dword [esp + 0x40]
pop ecx
pop ecx
mov ecx, dword [eax]
mov al, byte [esp + 0x3e]
mov byte [edi + ecx], al
cmp byte [esp + 0x3e], 0x2a
jne 0x1004d3e2
mov eax, dword [esp + 0x1c]
cmp eax, ebx
cmovl ebx, eax
cmp eax, esi
cmovg esi, eax
mov eax, dword [esp + 0x24]
cmp edi, eax
cmovl eax, edi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
cmp edi, eax
cmovg eax, edi
mov dword [esp + 0x14], eax
inc edi
cmp edi, dword [esp + 0x44]
jl 0x1004d390
mov dword [esp + 0x20], ebx
xor ebx, ebx
push 0x1000b510
call fcn.100578db
add dword [esp + 0x3c], 0xc
pop ecx
mov ecx, dword [esp + 0x1c]
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, dword [esp + 0x5c]
jl 0x1004d383
mov eax, dword [esp + 0x20]
cmp eax, esi
jg 0x1004d478
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
imul edi, eax, 0xc
sub esi, eax
add edi, dword [esp + 0x184]
inc esi
mov dword [esp + 0x1c], esi
mov ebx, edx
cmp edx, ecx
jg 0x1004d459
mov esi, dword [esp + 0x14]
mov eax, dword [edi]
movsx eax, byte [eax + ebx]
push eax
push 0x1000b214
call fcn.10057af6
inc ebx
pop ecx
pop ecx
cmp ebx, esi
jle 0x1004d43d
mov esi, dword [esp + 0x1c]
push 0x1000b125
call fcn.10057cb6
mov edx, dword [esp + 0x28]
add edi, 0xc
pop ecx
mov ecx, dword [esp + 0x14]
dec esi
mov dword [esp + 0x1c], esi
jne 0x1004d433
xor ebx, ebx
lea ecx, [esp + 0x184]
call fcn.1004eb22
mov dword [esp + 0x200], 0xfffffff8
jmp 0x1004d4ab
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004d4a4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommState]
dec dword [esp + 0x200]
cmp dword [esp + 0x200], 0xffffffe3
je 0x1004d491
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x1004d232
xor edi, edi
inc edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x15
jne 0x1004d20c
mov esi, dword [esp + 0x30]
test esi, esi
jne 0x1004dff6
cmp dword [esp + 0x190], esi
jle 0x1004dff6
mov dword [esp + 0x14], edi
lea ecx, [esp + 0x128]
mov dword [esp + 0x18], 0x14383674
push 3
call fcn.100105fb
mov dword [esp + 0x434], 9
mov dword [esp + 0xc], edi
mov dword [esp + 0x28], 7
mov dword [esp + 0x34], 0x8f302d78
mov dword [esp + 0xc], ebx
jmp 0x1004d53a
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x50], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1004d52e
mov dword [esp + 0xc], ebx
jmp 0x1004d559
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1004d547
cmp dword [esp + 0x50], ebx
jne 0x1004d57b
cmp dword [esp + 0x54], ebx
jne 0x1004d581
cmp dword [esp + 0x50], ebx
jne 0x1004d57b
mov esi, dword [esp + 0x128]
jmp 0x1004d5e4
cmp dword [esp + 0x54], ebx
je 0x1004d589
mov ecx, edi
cmp dword [esp + 0x50], ebx
jne 0x1004d58b
mov ecx, ebx
mov eax, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x50]
cmp ecx, eax
mov eax, dword [esp + 0x54]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x50]
setl cl
cmp ecx, 5
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setge dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
jne 0x1004d5d4
mov eax, ebx
cmp dword [esp + 0x18], ebx
je 0x1004d5d6
mov eax, edi
mov esi, dword [esp + 0x128]
cmp eax, dword [esi + 8]
mov eax, edi
jge 0x1004d5e6
mov eax, ebx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x50]
mov dword [esp + 0xc], eax
mov dword [esp + 0xc], ebx
jmp 0x1004d724
push dword [esp + 0x94]
movdqa xmm0, xmmword [0x1000b920]
lea eax, [esp + 0x284]
push eax
lea eax, [esp + 0x278]
mov dword [esp + 0xb0], ebx
push eax
push ebx
lea ecx, [esp + 0xb8]
mov dword [esp + 0xbc], ebx
movdqu xmmword [esp + 0x280], xmm0
mov dword [esp + 0xc0], ebx
call fcn.100147ae
mov dword [esp + 0x1c], 0x1fa6f63e
xor edx, edx
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xfffffff7
setg al
xor ecx, ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x34]
setle cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [esi + 8], edi
mov dword [esp + 0x18], ebx
jmp 0x1004d6ed
mov eax, dword [esi + 8]
xor ecx, ecx
mov dword [esp + 0x1c], 0xe89c674f
mov dword [esp + 0x38], 0x59018101
mov dword [esp + 0x34], 0xac77acae
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp eax, edi
setl cl
mov dword [esp + 0x38], ecx
xor ecx, ecx
mov eax, dword [esp + 0x38]
sub eax, dword [esp + 0x1c]
cmp eax, 8
setl cl
neg ecx
mov dword [esp + 0x34], ecx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffeb
jle 0x1004d68d
cmp dword [esp + 0xa8], 0
je 0x1004d720
push dword [esp + 0xa8]
call fcn.10057c67
pop ecx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff5
jle 0x1004d5fa
or dword [esp + 0x434], 0xffffffff
push dword [esp + 0x128]
call fcn.10057c67
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x2c], 0x17ea
cmp dword [esp + 0x2c], 0xe45
pop ecx
jge 0x1004d7e4
lea eax, [esp + 0xe0]
push eax
lea eax, [esp + 0x1d0]
push eax
push 0x1000b624
call fcn.100578db
mov edi, dword [esp + 0x1d8]
xor ecx, ecx
mov esi, dword [esp + 0xec]
mov eax, edi
cdq
inc ecx
sub eax, edx
add esp, 0xc
sar eax, 1
add eax, esi
movd xmm1, edi
cdq
idiv edi
cvtdq2pd xmm1, xmm1
sub ecx, eax
add eax, eax
imul ecx, edi
mulsd xmm1, qword [0x1000b898]
add esi, ecx
mov dword [esp + 0xe0], esi
movd xmm0, esi
cvtdq2pd xmm0, xmm0
comisd xmm0, xmm1
jb 0x1004d7d4
inc eax
push eax
push 0x1000b238
call fcn.10057af6
pop ecx
xor edi, edi
pop ecx
inc edi
mov dword [esp + 0x18], 0xffffffff
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004d804
push ebx
push 0xfa1
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov dword [esp + 0x18], ebx
jmp 0x1004d877
mov dword [esp + 0x24], 0xf390197f
mov dword [esp + 0x14], ebx
jmp 0x1004d82b
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2d0], 0xe57ad95e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1004d818
mov dword [esp + 0x24], 3
cmp dword [esp + 0x24], ebx
jl 0x1004d873
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004d86d
push ebx
push 0x12ae
push ebx
push ebx
push 0x185
push 0x624
push 0x1bb1
push 0x87
call dword [sym.imp.GDI32.dll_ExtTextOutA]
dec dword [esp + 0x24]
jns 0x1004d840
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x14
jl 0x1004d80a
push 3
lea ecx, [esp + 0x120]
call fcn.100105fb
mov dword [esp + 0x434], 0xa
mov dword [esp + 0xc], 2
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x38], 0x1d67a3d5
mov dword [esp + 0x28], 0x182f
cmp dword [esp + 0x28], 0x133f
jge 0x1004d9a6
lea eax, [esp + 0x1d0]
push eax
lea eax, [esp + 0x1dc]
push eax
push 0x1000b550
call fcn.100578db
mov esi, dword [esp + 0x1e8]
add esp, 0xc
mov edi, dword [esp + 0x1d8]
push ebx
push 2
push esi
push edi
call fcn.100719d0
mov ecx, eax
mov eax, edx
mov edx, dword [esp + 0x1d4]
mov dword [esp + 0x34], ecx
or ecx, eax
mov ecx, dword [esp + 0x1d0]
mov dword [esp + 0x1c], eax
jne 0x1004d961
mov eax, ecx
sub eax, edi
mov dword [esp + 0x28], eax
mov eax, edx
sbb eax, esi
mov dword [esp + 0x15c], eax
js 0x1004d95d
jg 0x1004d936
cmp dword [esp + 0x28], 2
jb 0x1004d95d
mov ecx, edi
mov eax, esi
add ecx, 2
adc eax, ebx
push eax
push ecx
mov ecx, edi
mov eax, esi
add ecx, 1
adc eax, ebx
push eax
push ecx
push esi
push edi
push 0x1000b858
call fcn.10057af6
add esp, 0x1c
jmp 0x1004d9a3
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x34], 1
jne 0x1004d998
cmp eax, ebx
jne 0x1004d998
sub ecx, edi
sbb edx, esi
mov dword [esp + 0x2c], edx
js 0x1004d998
jg 0x1004d97d
cmp ecx, 3
jb 0x1004d998
mov ecx, edi
mov eax, esi
add ecx, 3
adc eax, ebx
push eax
push ecx
mov ecx, edi
mov eax, esi
add ecx, 2
adc eax, ebx
add edi, 1
adc esi, ebx
jmp 0x1004d94a
push 0x1000b240
call fcn.10057cb6
pop ecx
xor edi, edi
inc edi
push 2
lea ecx, [esp + 0x108]
call fcn.100105fb
mov dword [esp + 0xc], ebx
jmp 0x1004d9d0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0x540d7f82
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1004d9ba
mov dword [esp + 0xc], ebx
jmp 0x1004d9f3
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 0x8bb6af83
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1004d9dd
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 2
jg 0x1004db75
mov esi, 0x7ea0d018
mov eax, 0xeac8e4c1
mov dword [esp + 0x14], 0x704f3d4e
mov dword [esp + 0x1e4], esi
mov dword [esp + 0x1e8], esi
mov dword [esp + 0x1ec], esi
mov dword [esp + 0x1f0], esi
mov dword [esp + 0x28], 0xc24489be
mov dword [esp + 0x1c], 0x3c8a0c09
mov dword [esp + 0x18], 0x2783de76
mov dword [esp + 0x21c], eax
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], eax
mov dword [esp + 0x228], eax
mov dword [esp + 0x1c], 0xea471603
mov dword [esp + 0x34], 0xc130268d
mov dword [esp + 0x14], 0xffff
cmp dword [esp + 0x14], ebx
jne 0x1004db29
mov eax, dword [esp + 0x1f0]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x11c]
sub ecx, 0xe7f13bcf
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [esp + 0x1e8], ecx
mov dword [esp + 0x28], edi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
dec dword [esp + 0x24]
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
sub eax, 2
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0x224], eax
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x14]
imul edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0xc]
cmp edx, eax
setg cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], ebx
jne 0x1004db25
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp eax, ecx
mov eax, dword [esp + 0x104]
setle dl
mov dword [eax], edx
mov dword [esp + 0x18], ebx
jmp 0x1004db5b
mov dword [esp + 0x28], 0x47dc4622
mov dword [esp + 0x28], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x1004db4b
inc dword [esp + 0xc]
mov eax, 0xeac8e4c1
cmp dword [esp + 0xc], 2
jle 0x1004da13
cmp dword [esp + 0x104], 0
je 0x1004dba1
push dword [esp + 0x104]
call fcn.10057c67
pop ecx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
or esi, 0xffffffff
mov dword [esp + 0x434], esi
cmp dword [esp + 0x11c], 0
je 0x1004dbd7
push dword [esp + 0x11c]
call fcn.10057c67
pop ecx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x24], 0x8f4727c
mov dword [esp + 0x20], 0x59c3cbaa
mov dword [esp + 0x14], 0x50e16ffa
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], ebx
jmp 0x1004dc10
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xb8], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1004dc01
mov eax, dword [esp + 0xc]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0xc], eax
mov edx, dword [esp + 0xc]
dec edx
neg edx
sbb edx, edx
neg edx
cmp dword [esp + 0x18], 0x937a3a11
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setle cl
sub ecx, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x18]
jg 0x1004dd2a
mov dword [esp + 0x14], 0x57a1
xor ecx, ecx
mov dword [esp + 0x1c], 4
mov dword [esp + 0x1c], 0xe01e6e83
mov dword [esp + 0x1c], 0x2cb818eb
mov dword [esp + 0x28], 9
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp eax, esi
setg cl
cmp ecx, 0x7b09
jg 0x1004dccd
cmp dword [esp + 0x24], ebx
je 0x1004dcd1
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, edi
setge cl
xor eax, eax
cmp ecx, 0x1cf6
setne al
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004deed
push 0x2623
call dword [sym.imp.USER32.dll_GetMenu]
jmp 0x1004deed
mov dword [esp + 0x18], 0xd764e38b
lea ecx, [esp + 0x134]
push edi
call fcn.100105fb
mov dword [esp + 0x64], 0xe40b
mov dword [esp + 0xc], ebx
jmp 0x1004dd60
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xf4], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1004dd4d
mov dword [esp + 0xc], ebx
jmp 0x1004dd82
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0x219042fb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1004dd6c
mov dword [esp + 0xc], 2
cmp dword [esp + 0xc], ebx
jl 0x1004de73
cmp dword [esp + 0x194], 0
je 0x1004dff2
push edi
lea ecx, [esp + 0x150]
call fcn.100105fb
mov dword [esp + 0x30], esi
mov dword [esp + 0x30], 0xf451d52a
mov dword [esp + 0xc], ebx
jmp 0x1004df30
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1004df1a
mov dword [esp + 0xc], ebx
jmp 0x1004df4f
mov esi, dword [esp + 0x30]
push edi
lea ecx, [esp + 0x114]
call fcn.100105fb
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0x24], ebx
jmp 0x1004e03b
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jl 0x1004e025
mov dword [esp + 0xd0], ebx
jmp 0x1004e062
mov ecx, dword [esp + 0xd0]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], edi
inc dword [esp + 0xd0]
cmp dword [esp + 0xd0], edi
jl 0x1004e04a
mov eax, dword [esp + 0xc4]
cmp dword [esp + 0x110], 0
mov dword [esp + 0xd0], eax
je 0x1004e0a5
push dword [esp + 0x110]
call fcn.10057c67
pop ecx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ebx
lea ecx, [esp + 0x190]
call fcn.10047f34
mov dword [esp + 0x28], 0x1490
lea ecx, [esp + 0x98]
mov eax, dword [esp + 0x28]
push edi
call fcn.100105fb
mov dword [esp + 0x18], 0x76942a1e
mov dword [esp + 0xc], 0x63d18804
mov dword [esp + 0x24], ebx
jmp 0x1004e0f6
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jl 0x1004e0e0
mov eax, dword [esp + 0x98]
cmp dword [eax], ebx
jne 0x1004e161
mov dword [esp + 0x18], ebx
xor ecx, ecx
mov eax, dword [esp + 0x18]
test eax, eax
setle cl
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], ebx
jne 0x1004e161
mov dword [esp + 0x28], 8
mov dword [esp + 0x34], 0x4956e74e
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004e1c7
push ebx
push 0x118a
push ebx
push ebx
push 0x19f0
push 0xed5
call dword [sym.imp.USER32.dll_ToAsciiEx]
jmp 0x1004e1c7
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004e184
push ebx
push 0xaef
push ebx
push 0x183f
push ebx
push 0x894
call dword [sym.imp.USER32.dll_DrawTextExW]
mov dword [esp + 0xc], ebx
jmp 0x1004e1c1
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x98]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [esp + 0x18], ebx
jmp 0x1004e1b7
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1004e1a5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x1004e18a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004e1de
push 0x134a
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [esp + 0x98]
call fcn.10057c67
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
pop ecx
test esi, esi
je 0x1004e332
mov dword [esp + 0x28], 0x261f9c28
mov dword [esp + 0x30], 8
mov dword [esp + 0xc], ebx
jmp 0x1004e231
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2a4], 0x29be1d92
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1004e21e
mov dword [esp + 0xc], ebx
jmp 0x1004e251
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x234], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1004e23e
inc dword [esp + 0x30]
mov ecx, esi
mov eax, dword [esp + 0x238]
mov edx, dword [esp + 0xe8]
mov dword [esp + 0x2a4], eax
call fcn.1004c09f
mov esi, eax
lea ecx, [esp + 0x178]
push 2
mov dword [esp + 0x1c0], esi
call fcn.100105fb
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x34], 0x2250db85
mov dword [esp + 0x24], ebx
jmp 0x1004e2b8
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x178]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1004e2a5
mov eax, dword [esp + 0x178]
xor ecx, ecx
mov edx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, edx
setg cl
cmp ecx, edi
jge 0x1004e2de
mov ecx, edi
test edx, edx
jne 0x1004e2e0
mov ecx, ebx
xor eax, eax
cmp edx, ecx
setne al
mov dword [esp + 0x34], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004e301
push 0x988
call dword [sym.imp.USER32.dll_GetQueueStatus]
push dword [esp + 0x178]
call fcn.10057c67
pop ecx
lea eax, [esp + 0xf0]
mov dword [esp + 0x178], ebx
push eax
mov dword [esp + 0x180], ebx
mov dword [esp + 0x184], ebx
call fcn.1004e6d9
mov dword [eax], esi
push dword [esp + 0x94]
movdqa xmm0, xmmword [0x1000b940]
lea eax, [esp + 0x264]
push eax
lea eax, [esp + 0x258]
mov dword [esp + 0x28], 0x4e064826
push eax
push ebx
lea ecx, [esp + 0xe4]
mov dword [esp + 0xe4], ebx
movdqu xmmword [esp + 0x260], xmm0
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
call fcn.100147ae
mov dword [esp + 0x28], 6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004e3b2
push 0x25ea
push 0x1f64
push 0xa41
push 0x1d7d
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x20], 0xffffffe9
jmp 0x1004e4b8
mov dword [esp + 0xc], 0x5145ccb9
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xd4]
mov dword [eax], ecx
test ecx, ecx
je 0x1004e476
mov dword [esp + 0x18], edi
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0xfffffff4
jle 0x1004e453
mov esi, dword [esp + 0xd4]
mov dword [esp + 0x28], 0xa272
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [esp + 0xc]
je 0x1004e422
mov ecx, edi
cmp dword [esp + 0x28], ebx
jne 0x1004e424
mov ecx, ebx
mov eax, dword [esp + 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xd4]
sete dl
mov ecx, dword [eax]
mov eax, dword [esp + 0x18]
sub ecx, edx
add eax, ecx
imul eax, dword [esp + 0x18]
mov dword [esi + 4], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff4
jg 0x1004e3f2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004e4b4
push 0x2020
push ebx
push 0x89d
push 0x52f
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
jmp 0x1004e4b4
mov dword [esp + 0xc], ebx
jmp 0x1004e4ad
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004e493
push 0x1675
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004e4a9
push 0x1f96
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jle 0x1004e47c
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0xb
jg 0x1004e3bf
cmp dword [esp + 0xd4], 0
je 0x1004e4da
push dword [esp + 0xd4]
call fcn.10057c67
pop ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0x1bc]
mov ecx, dword [esp + 0x42c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret