Function at 0x4118f8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2a8
xor eax, eax
mov dword [esp + 0x40], ecx
mov dword [esp + 0x94], eax
mov dword [esp + 0x18], 0xffffffff
push esi
mov byte [esp + 0x13], al
mov esi, edx
push edi
mov dword [esp + 0x38], esi
cmp byte [esp + 0x17], al
je 0x41194a
push eax
push 0x1217
push 0xc82
push eax
push 0x7b0
push 0x719
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x411962
mov dword [esp + 0x18], 6
cmp dword [esp + 0x18], eax
jne 0x411969
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff8
jle 0x411950
push 4
lea ecx, [esp + 0x68]
call fcn.00413ed8
mov dword [esp + 0x30], 0x66fe7d8a
xor eax, eax
push 1
mov dword [esp + 0x38], 9
mov dword [esp + 0x24], eax
pop edi
jmp 0x41199e
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x64]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x41198f
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], 3
push 0xfffffffffffffffc
pop edx
jg 0x411b9d
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], 0x57a55752
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 3
jg 0x411b83
mov dword [esp + 0x1c], edi
mov dword [esp + 0x118], edx
mov dword [esp + 0x11c], edx
mov dword [esp + 0x120], edx
mov dword [esp + 0x124], edx
mov dword [esp + 0x1c], eax
jmp 0x411aac
mov dword [esp + 0x24], edx
mov dword [esp + 0x24], 3
cmp dword [esp + 0x24], eax
jl 0x411a38
mov edi, dword [esp + 0xc]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x64]
mov esi, dword [esp + 0x64]
mov ecx, dword [ecx + edx*4]
mov dword [esi + edi*4], ecx
mov dword [esp + 0x118], ecx
dec dword [esp + 0x24]
jns 0x411a15
mov dword [esp + 0x24], eax
jmp 0x411a9e
mov dword [esp + 0x28], 0x969161d5
mov dword [esp + 0x28], eax
jmp 0x411a5d
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x64]
cmp dword [ecx + edx*4], eax
jne 0x411a64
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jle 0x411a4c
mov dword [esp + 0x28], 3
cmp dword [esp + 0x28], eax
jl 0x411a9a
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x411a94
push 0xc1e
push 0x3d3
push 0x44b
call dword [sym.imp.GDI32.dll_GetPixel]
xor eax, eax
dec dword [esp + 0x28]
jns 0x411a72
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jle 0x411a3e
inc dword [esp + 0x1c]
push 0xfffffffffffffffc
pop edx
cmp dword [esp + 0x1c], 3
jle 0x411a03
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x118]
mov ecx, dword [esp + 0x118]
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0xc]
neg edi
mov ecx, dword [esp + 0x118]
sbb edi, edi
xor edx, edx
neg edi
sub edi, ecx
mov ecx, dword [esp + 0x64]
push 0
cmp dword [ecx + esi*4], edi
mov ecx, 0x919c44d4
setge dl
cmp ecx, edx
mov ecx, dword [esp + 0x1c]
sbb edx, edx
inc edx
cmp edx, ecx
mov ecx, dword [esp + 0x10]
pop edx
setg dl
cmp edx, ecx
mov edx, dword [esp + 0xc]
push 0
pop ecx
setne cl
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x64]
mov esi, dword [esp + 0x34]
mov dword [ecx + edx*4], esi
xor edx, edx
mov dword [esp + 0x1c], esi
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
add esi, 0x68d9a65c
cmp esi, ecx
setg dl
cmp edx, dword [esp + 0x30]
jne 0x411b64
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x64]
cmp dword [ecx + edx*4], eax
jne 0x411b64
xor edi, edi
mov ecx, eax
inc edi
jmp 0x411b69
xor edi, edi
inc edi
mov ecx, edi
mov dword [esp + 0x34], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
push 0xfffffffffffffffc
pop edx
jle 0x4119da
mov ecx, dword [esp + 0x2c]
mov dword [ecx + 0xc], 0xfffffffa
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 3
jle 0x4119bf
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x64]
call fcn.0041431c
mov eax, dword [0x46fb5e8]
test al, 1
jne 0x411c33
or eax, edi
mov dword [0x46fb5e8], eax
xor eax, eax
push eax
push eax
mov dword [0x46fb5f0], eax
mov dword [0x46fb5f4], eax
call fcn.00414e36
mov ecx, eax
mov dword [0x46fb60c], 0x3f800000
mov dword [0x46fb5f0], ecx
xor eax, eax
mov dword [esp + 0x128], ecx
lea ecx, [esp + 0x128]
push ecx
push 0x10
push eax
mov dword [0x46fb5f8], eax
mov ecx, 0x46fb5f8
mov dword [0x46fb600], eax
mov dword [0x46fb5fc], eax
lea eax, [esp + 0x110]
push eax
call fcn.00414bdb
push 0x4c1145
mov dword [0x46fb604], 7
mov dword [0x46fb608], 8
call fcn.004a3d6f
pop ecx
xor eax, eax
mov dword [esp + 0x18], 0x9eeda585
push 3
mov dword [esp + 0x10], eax
pop edx
jmp 0x411c59
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x80], 0x888a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x411c46
mov dword [esp + 0xc], eax
jmp 0x411c78
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x280], 0x57f451d5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x411c65
mov dword [esp + 0xc], eax
jmp 0x411c97
mov ecx, dword [esp + 0xc]
mov dword [esp + ecx*4 + 0x28c], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x411c84
mov ecx, dword [esp + 0x84]
mov ecx, dword [esp + 0x88]
mov dword [esp + 0x18], edi
mov edx, dword [esp + 0x18]
mov dword [esp + 0x284], edx
mov ecx, dword [esp + 0x84]
sub edx, ecx
cmp edx, dword [esp + 0x80]
jle 0x411cd7
mov ecx, edi
cmp dword [esp + 0x88], eax
jne 0x411cd9
mov ecx, eax
xor eax, eax
cmp ecx, 0x7a67
setg al
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x88]
sets cl
xor edx, edx
add ecx, 0x3d87e3bc
cmp ecx, eax
mov eax, dword [esp + 0x88]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x88]
setne cl
sub ecx, eax
cmp edi, ecx
sbb eax, eax
inc eax
mov dword [esp + 0x290], eax
imul eax, dword [esp + 0x48], 0x2710
add eax, esi
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x7c]
push eax
call fcn.00413f9d
push 2
lea ecx, [esp + 0x22c]
mov esi, dword [eax]
call fcn.00413ed8
mov dword [esp + 0x1c], 0x57976326
lea ecx, [esp + 0x234]
push 4
call fcn.00413ed8
mov dword [esp + 0x18], 0x8f4e1c2e
lea ecx, [esp + 0x1f4]
push 4
call fcn.00413ed8
xor eax, eax
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], eax
jmp 0x411d98
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x228]
mov dword [ecx + edx*4], 0xffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x411d82
mov dword [esp + 0xc], eax
jmp 0x411dbb
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x234]
mov dword [ecx + edx*4], 0xfffffffb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x411da5
mov dword [esp + 0xc], eax
jmp 0x411dde
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1f4]
mov dword [ecx + edx*4], 0xfffffff7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x411dc8
mov dword [esp + 0x1c], eax
jmp 0x411e46
mov dword [esp + 0x18], 0x696a485b
lea ecx, [esp + 0x1e8]
push edi
call fcn.00413ed8
mov dword [esp + 0x18], 0x18e
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 0
jmp 0x411e2c
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1e8]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x411e1a
inc dword [esp + 0x18]
lea ecx, [esp + 0x1e8]
call fcn.0041431c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x411deb
lea ecx, [esp + 0x1f4]
call fcn.0041431c
lea ecx, [esp + 0x234]
call fcn.0041431c
lea ecx, [esp + 0x228]
call fcn.0041431c
test esi, esi
je 0x412148
mov dword [esp + 0xc], 0xc9cc1417
lea ecx, [esp + 0x19c]
mov dword [esp + 0x10], 0x101aae4b
push 3
call fcn.00413ed8
mov dword [esp + 0x38], edi
lea ecx, [esp + 0x208]
push 4
call fcn.00413ed8
mov dword [esp + 0x18], 0xeab3ae5d
xor eax, eax
mov dword [esp + 0x18], 0xe507
mov dword [esp + 0x24], eax
jmp 0x411ed6
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x19c]
mov dword [ecx + edx*4], 0x1b44adca
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x411ec0
mov dword [esp + 0x24], eax
jmp 0x411ef9
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x208]
mov dword [ecx + edx*4], 0xfffffff6
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 4
jl 0x411ee3
cmp dword [esp + 0xc], eax
jne 0x411f36
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
imul edx, dword [esp + 0xc], 0xffff
mov ecx, dword [esp + 0x19c]
cmp edx, dword [ecx + 4]
jle 0x411f2e
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov dword [esp + 0xc], 0x9b467bb1
mov ecx, dword [esp + 0xc]
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], eax
jmp 0x411f60
mov dword [esp + 0x18], 3
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe8
jl 0x411f54
lea ecx, [esp + 0x208]
call fcn.0041431c
lea ecx, [esp + 0x19c]
call fcn.0041431c
mov dword [esp + 0x28], 0xffffffff
xor eax, eax
mov dword [esp + 0x1c], 0x3825062d
mov dword [esp + 0x30], 0x5a83d87
mov dword [esp + 0x34], 0x13053bf8
mov dword [esp + 0xf8], esi
mov dword [esp + 0x24], eax
jmp 0x411fbd
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x1dc], edi
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jl 0x411fae
mov dword [esp + 0x24], eax
jmp 0x411fdd
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x200], 0xbb0f55f5
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x411fca
mov dword [esp + 0x28], eax
jmp 0x412138
mov dword [esp + 0xc], 0xa3dbc56e
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
cmp ecx, dword [esp + 0x28]
jle 0x41200b
mov edx, eax
cmp dword [esp + 0xc], eax
je 0x41200d
mov edx, edi
xor ecx, ecx
cmp edx, 0x76fd
setg cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], 0xc35240ca
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0xc]
jne 0x412035
mov esi, eax
cmp dword [esp + 0xc], eax
je 0x412037
mov esi, edi
mov dword [esp + 0x1e0], esi
xor edx, edx
mov ecx, dword [esp + 0x28]
cmp esi, ecx
setge dl
mov dword [esp + 0x30], edx
mov dword [esp + 0x30], 0xffffffe6
jmp 0x412129
mov dword [esp + 0x18], 0x4433
mov dword [esp + 0x10], 0xdbe4fcd5
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x41207e
push eax
call dword [sym.imp.USER32.dll_DestroyCursor]
xor eax, eax
mov dword [esp + 0xc], 0xfffffffb
jmp 0x41211a
mov dword [esp + 0x2c], edi
mov dword [esp + 0x1c], 0xfffffff5
jmp 0x41210f
mov dword [esp + 0x34], 0xbbda73a1
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x2c], eax
je 0x4120c2
mov ecx, dword [esp + 0x34]
mov esi, edi
mov edx, dword [esp + 0xc]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x10], edx
jne 0x4120c4
mov esi, eax
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp esi, ecx
sete dl
cmp edx, dword [esp + 0x34]
jl 0x4120d9
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1e0]
mov ecx, dword [esp + 0x34]
cmp ecx, dword [esp + 0x18]
jne 0x4120ee
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x200], 0x5ce4ec6f
cmp dword [esp + 0x10], eax
jne 0x412116
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x16
jl 0x412099
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xe
jle 0x41208b
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0x1a
jl 0x41205a
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0xf
jne 0x411fed
jmp 0x413d69
push dword [esp + 0x104]
movdqa xmm0, xmmword [0xaba900]
lea ecx, [esp + 0x274]
push ecx
xor eax, eax
lea ecx, [esp + 0x268]
push ecx
push eax
lea ecx, [esp + 0x68]
mov dword [esp + 0x68], eax
movdqu xmmword [esp + 0x270], xmm0
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
call fcn.0041519b
mov dword [esp + 0x28], 0x1dba3399
lea ecx, [esp + 0x148]
push 0xfffffffffffffff7
pop eax
mov dword [esp + 0xc], 0x274b
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
mov dword [esp + 0x140], eax
mov dword [esp + 0x144], eax
mov dword [esp + 0x18], 0xffffffff
push edi
call fcn.00413ed8
mov dword [esp + 0x10], 0xfffffffa
xor eax, eax
mov dword [esp + 0x2c], 0x5c15dc1c
mov dword [esp + 0x20], eax
jmp 0x4121fa
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x148]
mov dword [ecx + edx*4], 9
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x4121e4
mov esi, dword [esp + 0x58]
mov dword [esp + 0x1c], esi
mov ecx, dword [esi + 4]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x58]
cmp dword [ecx + 0xc], eax
je 0x412226
cmp dword [esp + 0xc], eax
jne 0x41222d
mov edx, eax
cmp dword [esi + 4], eax
je 0x41222f
mov edx, edi
mov ecx, dword [esp + 0x28]
sub edx, ecx
je 0x41223e
mov edx, edi
cmp dword [esi + 4], eax
jne 0x412240
mov edx, eax
neg edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, 0xb0a
setl cl
xor edx, edx
cmp ecx, dword [esi + 4]
mov ecx, dword [esp + 0xc]
setle dl
add ecx, edx
je 0x4123d4
mov dword [esp + 0x34], 0xbb2f
mov dword [esp + 0x10], 0xef906d8b
mov dword [esp + 0x2c], 0xfffffff9
mov dword [esp + 0xc], 3
cmp dword [esp + 0xc], eax
jl 0x412503
push 4
lea ecx, [esp + 0x1c4]
call fcn.00413ed8
mov dword [esp + 0x20], 0
jmp 0x4122bf
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c0]
mov dword [eax + ecx*4], 0x1d0b
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x4122a9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x58]
cmp dword [eax + ecx*4], 0
jne 0x4123a4
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
jne 0x4123a4
mov eax, dword [esp + 0x58]
xor edx, edx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x108], edi
mov dword [esp + 0x10c], edi
mov eax, dword [eax + 8]
mov dword [esp + 0x110], edi
mov dword [esp + 0x114], edi
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x114]
mov eax, dword [esp + 0x10]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
neg ecx
jne 0x41233f
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c0]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x114]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x114]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x110]
neg ecx
cmp ecx, eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
setge dl
imul ecx, edx
xor edx, edx
cmp ecx, dword [eax + esi*4]
mov esi, dword [esp + 0x1c]
setle dl
mov dword [esp + 0x28], edx
jmp 0x4123b2
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x58]
mov ecx, dword [esi + 4]
mov dword [eax + edx*4], ecx
inc dword [esp + 0x138]
lea ecx, [esp + 0x1c0]
call fcn.0041431c
dec dword [esp + 0xc]
jns 0x412291
jmp 0x412503
mov dword [esp + 0x18], 0x2f23
lea ecx, [esp + 0x90]
push edi
call fcn.00413ed8
mov dword [esp + 0x1c], edi
xor eax, eax
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x20], eax
jmp 0x412413
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x90]
mov dword [ecx + edx*4], 0x28a21817
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x4123fd
mov ecx, dword [esp + 0x148]
mov edx, dword [esi + 4]
push 0
cmp edx, dword [ecx]
mov ecx, dword [esp + 0x94]
pop edx
setle dl
push 0
add edx, dword [ecx]
mov ecx, dword [esp + 0x1c]
sub edx, ecx
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
inc dword [esp + 0x14]
mov ecx, dword [esp + 0x13c]
mov ecx, dword [esp + 0x14]
pop ecx
setns cl
cmp ecx, 0x8302a6f4
ja 0x41246b
mov edx, edi
cmp dword [esp + 0x2c], eax
jne 0x41246d
mov edx, eax
mov ecx, dword [esp + 0x90]
push 0
mov dword [ecx], edx
xor edx, edx
cmp dword [esi + 4], eax
mov ecx, dword [esp + 0x1c]
sete dl
cmp edx, ecx
mov ecx, dword [esp + 0x94]
pop edx
setg dl
push 0
imul edx, dword [ecx]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x20]
add edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x94]
cmp edx, dword [ecx]
pop ecx
setg cl
xor edx, edx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x148]
cmp dword [ecx], eax
mov eax, dword [esp + 0x10]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x90]
setne cl
xor edx, edx
cmp ecx, dword [eax]
mov ecx, 0xe5f641d3
mov eax, dword [esp + 0x34]
setge dl
cmp ecx, eax
sbb eax, eax
neg eax
lea ecx, [eax - 7]
mov eax, dword [esp + 0x90]
add ecx, edx
mov dword [eax], ecx
lea ecx, [esp + 0x90]
call fcn.0041431c
lea ecx, [esp + 0x148]
call fcn.0041431c
lea ecx, [esp + 0x58]
call fcn.0041431c
mov eax, dword [0x46fb5e8]
test al, 2
jne 0x41259f
or eax, 2
mov dword [0x46fb5e8], eax
xor eax, eax
push eax
push eax
mov dword [0x46fb630], eax
mov dword [0x46fb634], eax
call fcn.00414e36
mov ecx, eax
mov dword [0x46fb64c], 0x3f800000
mov dword [0x46fb630], ecx
xor eax, eax
mov dword [esp + 0x12c], ecx
lea ecx, [esp + 0x12c]
push ecx
push 0x10
push eax
mov dword [0x46fb638], eax
mov ecx, 0x46fb638
mov dword [0x46fb640], eax
mov dword [0x46fb63c], eax
lea eax, [esp + 0x60]
push eax
call fcn.00414bdb
push 0x4c1140
mov dword [0x46fb644], 7
mov dword [0x46fb648], 8
call fcn.004a3d6f
pop ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0xb4], xmm0
mov dword [esp + 0x20], 0x31713b91
mov dword [esp + 0x20], 0
jmp 0x4125ec
mov byte [esp + 0x17], 0
cmp byte [esp + 0x17], 0
je 0x4125cf
call dword [sym.imp.KERNEL32.dll_GetACP]
mov byte [esp + 0x17], 0
cmp byte [esp + 0x17], 0
je 0x4125e8
push 0x2018
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe4
jl 0x4125bd
lea eax, [esp + 0x48]
push eax
call fcn.00413fff
push 0xfffffffffffffff9
pop edx
mov esi, dword [eax]
xor eax, eax
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x18], 0x24ce5545
mov dword [esp + 0x18], 0xc4f3f7e8
mov dword [esp + 0x18], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], 0x5077045b
mov dword [esp + 0x18], edi
mov dword [esp + 0x18], 0x1fcc1031
mov dword [esp + 0x18], 0x6fa66fa4
mov dword [esp + 0x34], esi
mov dword [esp + 0x20], eax
jmp 0x412665
mov ecx, dword [esp + 0x20]
mov dword [esp + ecx*4 + 0xc4], 0xad313dd3
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x412652
mov dword [esp + 0xc4], 0xb
cmp dword [esp + 0xc4], edx
jne 0x4127ba
jmp 0x412688
xor eax, eax
push dword [esp + 0x54]
movdqa xmm0, xmmword [0xaba8c0]
lea ecx, [esp + 0x264]
push ecx
lea ecx, [esp + 0x258]
mov dword [esp + 0x24], 0xffffffff
push ecx
push eax
lea ecx, [esp + 0x170]
mov dword [esp + 0x170], eax
movdqu xmmword [esp + 0x260], xmm0
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
call fcn.0041519b
mov dword [esp + 0x1c], 0xffffffeb
jmp 0x412788
push 4
lea ecx, [esp + 0x1b8]
call fcn.00413ed8
mov dword [esp + 0x18], 0xffffffff
xor eax, eax
mov dword [esp + 0x18], 0x2e65251c
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x18], 0xfffffff7
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], 0xdb7b2415
mov dword [esp + 0x18], 0xc105a83d
mov dword [esp + 0x18], 0x5fec46bc
mov dword [esp + 0x18], 0x28451d77
mov dword [esp + 0x18], 0xac254176
mov dword [esp + 0x18], 0x3053bf84
mov dword [esp + 0x20], eax
jmp 0x412764
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1b4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x412752
inc dword [esp + 0x18]
lea ecx, [esp + 0x1b4]
cmp dword [esp + 0xc8], eax
jne 0x412794
call fcn.0041431c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jg 0x4126e4
jmp 0x412799
call fcn.0041431c
lea ecx, [esp + 0x160]
call fcn.0041431c
dec dword [esp + 0xc4]
cmp dword [esp + 0xc4], 0xfffffff9
je 0x412686
mov al, byte [ebp + 0xc]
test al, al
jne 0x4127c9
test esi, esi
jne 0x413798
lea ecx, [esp + 0x2a0]
mov dl, al
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.00401e7d
mov esi, eax
lea edi, [esp + 0xb8]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
inc edi
xor eax, eax
mov dword [esp + 0x30], edi
mov dword [esp + 0x18], 0x7ed6f186
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0x235bd639
mov dword [esp + 0x24], 0xf9f0ac77
mov dword [esp + 0x1c], eax
jmp 0x41282d
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x3c], 0x624039b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x41281d
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], eax
jl 0x412a37
mov dword [esp + 0xc], 0x76ff55e0
mov dword [esp + 0x2c], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0x697ab83d
mov dword [esp + 0x1c], eax
jmp 0x412872
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x214], 0x58fb5c4c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x41285f
mov dword [esp + 0xc], eax
jmp 0x412a23
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x30]
cmp dword [esp + ecx*4 + 0x3c], eax
je 0x412925
mov ecx, dword [esp + 0x30]
xor edx, edx
push 0
mov esi, edi
mov ecx, dword [esp + ecx*4 + 0x40]
test ecx, ecx
mov ecx, dword [esp + 0x34]
setne dl
mov dword [esp + 0x1c], edx
mov edx, dword [esp + ecx*4 + 0x40]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x1c], ecx
pop ecx
setg cl
sub ecx, edx
neg ecx
push 0
sbb ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
xor ecx, ecx
cmp dword [esp + 0x1c], 0x65f4b3f4
setle cl
dec ecx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x2c]
sub edx, ecx
mov ecx, dword [esp + 0x40]
imul edx, edx, 0x5d9c
cmp ecx, edx
pop ecx
setle cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + ecx*4 + 0x3c]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
cmp ecx, 0x176
setge dl
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], eax
jne 0x412927
mov esi, eax
mov dword [esp + 0x18], 0xf2e9
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + ecx*4 + 0x3c]
mov edx, dword [esp + 0xc]
imul edx, esi
sub edx, ecx
mov ecx, dword [esp + 0xc]
neg edx
sbb edx, edx
inc edx
add edx, dword [esp + ecx*4 + 0x3c]
mov dword [esp + 0x214], edx
xor edx, edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + ecx*4 + 0x3c]
cmp ecx, 0x2b782624
setg dl
sub edx, dword [esp + 0x10]
add edx, dword [esp + 0x10]
je 0x41297d
mov ecx, edi
cmp dword [esp + 0xc], eax
jne 0x41297f
mov ecx, eax
mov dword [esp + 0x1c], ecx
xor edx, edx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + ecx*4 + 0x3c]
mov ecx, dword [esp + 0x30]
test ecx, ecx
setns dl
xor ecx, ecx
cmp edx, 0xffffffff
setne cl
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x18]
add ecx, 7
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], eax
je 0x4129dc
mov ecx, dword [esp + 0x30]
mov edx, edi
cmp dword [esp + ecx*4 + 0x3c], eax
jne 0x4129de
mov edx, eax
xor ecx, ecx
cmp edx, 7
sete cl
xor edx, edx
add ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x24]
setne dl
mov dword [esp + 0x18], edx
xor edx, edx
cmp dword [esp + 0x18], ecx
setl dl
xor ecx, ecx
cmp ecx, edx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x2c], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], eax
jle 0x412882
dec dword [esp + 0x30]
jns 0x412841
mov dword [esp + 0x20], 0xf
jmp 0x412aa9
mov dword [esp + 0x28], eax
jmp 0x412a9f
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], eax
jl 0x412a9b
mov dword [esp + 0x24], eax
jmp 0x412a8f
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x412a70
push 0x9a5
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + ecx*4 + 0x3c]
mov ecx, dword [esp + 0x24]
mov dword [esp + ecx*4 + 0x3c], edx
xor ecx, ecx
test edx, edx
setne cl
mov dword [esp + 0x18], ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], eax
jle 0x412a57
dec dword [esp + 0x1c]
jns 0x412a51
inc dword [esp + 0x28]
cmp dword [esp + 0x28], eax
jle 0x412a47
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff5
jle 0x412a41
cmp byte [ebp + 0xc], 0
je 0x412ebc
cmp dword [esp + 0xbc], 0
je 0x412ebc
mov dword [esp + 0xc], 9
mov dword [esp + 0x2c], 0x4e20eeb
mov dword [esp + 0x28], 0x38fd2320
mov dword [esp + 0xc], eax
jmp 0x412d78
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], eax
jmp 0x412b0a
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xa0], 0xfffffff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x412af7
mov dword [esp + 0x1c], eax
jmp 0x412d69
mov dword [esp + 0x30], 0xffffffff
cmp dword [esp + 0xc], eax
je 0x412b2c
mov ecx, dword [esp + 0x30]
cmp dword [esp + 0x1c], eax
jne 0x412b5d
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0xc], eax
je 0x412b48
mov ecx, edi
cmp dword [esp + 0x30], eax
jne 0x412b4a
mov ecx, eax
add ecx, 0x53f0d3ec
mov dword [esp + 0xa0], ecx
je 0x412b5d
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
cmp ecx, dword [esp + 0xc]
je 0x412d5f
mov dword [esp + 0x20], 0x7758a8c
lea ecx, [esp + 0x154]
push 4
call fcn.00413ed8
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x412ba3
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x154]
mov dword [ecx + edx*4], 0x600bf094
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x412b8d
mov dword [esp + 0x30], 2
cmp dword [esp + 0x30], eax
jl 0x412d4f
push dword [esp + 0x54]
movdqa xmm0, xmmword [0xaba8e0]
lea ecx, [esp + 0x284]
push ecx
lea ecx, [esp + 0x278]
mov dword [esp + 0xd8], eax
push ecx
push eax
lea ecx, [esp + 0xe0]
mov dword [esp + 0xe4], eax
movdqu xmmword [esp + 0x280], xmm0
mov dword [esp + 0xe8], eax
call fcn.0041519b
mov esi, dword [esp + 0xd0]
and dword [esi + 4], 0
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + eax*4 + 0xa0]
mov eax, dword [esi + 4]
cmp dword [esp + eax*4 + 0xa0], ecx
jl 0x412cfa
mov dword [esp + 0x18], 0xfffffff8
mov byte [esp + 0x17], 0
cmp byte [esp + 0x17], 0
je 0x412c50
push 0x14d5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [esp + 0x2c]
xor edx, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xd0]
cmp dword [eax + 8], 8
mov eax, dword [esp + 0x30]
setl dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0xa0]
cmp eax, edx
setle cl
xor edx, edx
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x154]
cmp ecx, dword [eax]
setne dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x2c]
cmp edx, eax
mov eax, dword [esp + 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xa0]
mov edx, 0x41e56eb4
setg cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x30]
setge cl
xor edx, edx
mov dword [esp + 0x18], ecx
mov dword [esp + eax*4 + 0xa0], ecx
mov ecx, edi
sub ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setle dl
sub edx, 0x8af1
neg edx
sbb edx, edx
add edx, 0xffff52ae
mov dword [esp + 0x10], edx
jmp 0x412d29
mov byte [esp + 0x17], 0
cmp byte [esp + 0x17], 0
je 0x412d0c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x154]
mov dword [eax], ecx
mov eax, dword [esp + 0xc]
add eax, ecx
mov dword [esp + 0xa0], eax
inc dword [esi + 4]
cmp dword [esi + 4], 2
jle 0x412c0e
lea ecx, [esp + 0xd0]
call fcn.0041431c
dec dword [esp + 0x30]
push 0
pop eax
jns 0x412bbc
lea ecx, [esp + 0x154]
call fcn.0041431c
xor eax, eax
jmp 0x412d65
cmp dword [esp + 0x28], eax
jne 0x412d74
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 9
jne 0x412b1a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x14
jg 0x412ae9
mov ecx, dword [esp + 0xc0]
mov dword [esp + 0x2c], 0xdda37bb0
mov dword [esp + 0x28], edi
mov dword [esp + 0x18], 0x5378470e
mov dword [esp + 0xfc], ecx
mov dword [esp + 0x10], eax
jmp 0x412dba
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xac], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x412dab
xor edx, edx
mov dword [esp + 0x28], 0x348c
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0xb0]
cmp ecx, 0x34d00693
push 0
setle dl
mov dword [esp + 0xb4], edx
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
sub edx, 0x697c9b75
cmp ecx, edx
pop ecx
setne cl
xor edx, edx
cmp ecx, 0xb0ae28de
mov ecx, dword [esp + 0x2c]
push 0
setne dl
cmp edx, ecx
pop edx
setg dl
sub edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
neg edx
sbb edx, edx
inc edx
add edx, dword [esp + 0x10]
add ecx, edx
sub ecx, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x18]
jl 0x412e86
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], eax
mov byte [esp + 0x17], al
je 0x412e56
cmp byte [esp + 0x17], 0
je 0x412eae
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x412e82
cmp byte [esp + 0x17], 0
je 0x412e6c
push eax
push eax
push 0x161d
call dword [sym.imp.USER32.dll_SetPropA]
xor eax, eax
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x412eae
push 0x9c4
call dword [sym.imp.GDI32.dll_EndDoc]
xor eax, eax
jmp 0x412eae
mov dword [esp + 0x28], edi
cmp dword [esp + 0x28], eax
jl 0x412eae
mov ecx, dword [esp + 0x28]
cmp dword [esp + ecx*4 + 0xac], eax
jne 0x412eae
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + ecx*4 + 0xac]
dec dword [esp + 0x28]
jns 0x412e90
mov ecx, dword [esp + 0xbc]
mov dword [esp + 0x100], ecx
cmp dword [esp + 0x34], 0
jne 0x413798
cmp dword [esp + 0xb4], 0
jle 0x413798
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x24], 0x3d9b950
mov dword [esp + 0x18], 0xc926164a
mov dword [esp + 0x2c], 0xe175a398
mov dword [esp + 0x10], eax
jmp 0x412f0b
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x40], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x412efb
mov dword [esp + 0x1c], 0xfffa
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x24], ecx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x40]
cmp edx, ecx
mov ecx, dword [esp + 0x44]
push 0
pop edx
setge dl
imul ecx, edx
add ecx, 0x44c0
jne 0x412f45
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x40], ecx
cmp dword [esp + 0x44], eax
je 0x412fa0
mov dword [esp + 0x18], 0x6d99
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x44]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x40]
add edx, 4
cmp edx, ecx
push 0
pop ecx
setl cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x2c], ecx
setge dl
add edx, dword [esp + 0x1c]
mov dword [esp + 0x24], edx
jmp 0x41325d
mov dword [esp + 0xc], eax
lea ecx, [esp + 0x16c]
push 2
call fcn.00413ed8
mov dword [esp + 0x20], 0x2a9e
xor eax, eax
mov dword [esp + 0x20], 0xdd98ae1f
mov dword [esp + 0x10], eax
jmp 0x412fe0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x16c]
mov dword [ecx + edx*4], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x412fca
mov ecx, dword [esp + 0x24]
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x40]
cmp ecx, 0xfffffffc
mov ecx, dword [esp + 0x24]
setge dl
neg ecx
mov dword [esp + 0x2c], edx
xor edx, edx
cmp dword [esp + 0x2c], ecx
push 0
setge dl
xor ecx, ecx
cmp edx, 0xfffffffa
setge cl
sub ecx, 0xfbc6
neg ecx
sbb ecx, ecx
add ecx, 0xffff0002
imul edx, ecx, 5
mov ecx, dword [esp + 0x10]
cmp edx, ecx
pop ecx
setl cl
sub ecx, 0x8a6ce2e7
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [esp + 0x40]
mov dword [esp + 0x44], ecx
mov dword [esp + 0xc], eax
jmp 0x413245
mov dword [esp + 0x10], 0x3401ff3c
mov dword [esp + 0x10], 0x88d18043
push 7
pop ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + ecx*4 + 0x40]
neg ecx
je 0x41321e
cmp dword [esp + 0xc], eax
jne 0x4130ba
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x44]
push 8
pop edx
sub edx, ecx
mov dword [esp + 0x20], eax
xor ecx, ecx
cmp edx, 0xffffffff
setg cl
xor edx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0xc]
cmp dword [esp + 0x10], ecx
setne dl
sub edx, dword [esp + 0xc]
je 0x4130be
mov dword [esp + 0x20], edi
mov ecx, dword [esp + 0xc]
xor edx, edx
push 0
mov ecx, dword [esp + ecx*4 + 0x44]
mov dword [esp + 0x14], ecx
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x170]
mov dword [ecx], esi
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x44]
setg dl
inc edx
mov dword [esp + 0x14], edx
xor edx, edx
cmp dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x28]
setl dl
add ecx, edx
xor edx, edx
cmp ecx, 0xba9e
setl dl
mov dword [esp + 0x14], edx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
pop edx
setle dl
xor ecx, ecx
test esi, esi
sete cl
cmp ecx, edx
jge 0x41312e
mov esi, eax
cmp dword [esp + 0x18], eax
je 0x413130
mov esi, edi
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x44]
push 0
setl dl
cmp edx, ecx
pop ecx
setl cl
sub ecx, 0xfffffffb
neg ecx
push 0
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x44]
sete dl
cmp ecx, edx
pop ecx
setle cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x20], ecx
push 0
setge dl
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
cmp ecx, edx
mov ecx, dword [esp + 0x10]
pop edx
setg dl
mov dword [esp + 0x20], edx
mov dword [esp + ecx*4 + 0x40], edx
xor edx, edx
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x2c]
sete dl
add edx, 4
mov dword [esp + 0x20], edx
xor edx, edx
cmp dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
setge dl
cmp edx, ecx
push 0
pop ecx
setg cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x20], ecx
setg dl
xor ecx, ecx
cmp edx, 0x2d3770b9
mov edx, 0x98cfe46d
setl cl
cmp edx, ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
jne 0x4131fc
cmp dword [esp + 0x1c], eax
je 0x413204
mov ecx, edi
cmp dword [esp + 0x10], eax
jne 0x413206
mov ecx, eax
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov ecx, dword [esp + ecx*4 + 0x40]
mov ecx, edi
jmp 0x413220
mov ecx, eax
mov dword [esp + 0x2c], ecx
xor edx, edx
mov esi, dword [esp + 0x2c]
sub esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x28]
cmp esi, ecx
setl dl
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x20], eax
jne 0x41324f
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x413059
lea ecx, [esp + 0x16c]
call fcn.0041431c
xor eax, eax
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x24], edi
push 0xfffffffffffffff8
mov dword [esp + 0x2c], 0xfffffffd
pop edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
jmp 0x41328e
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x50], 0xdda37bb0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x41327e
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], edx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x24], eax
je 0x413315
mov dword [esp + 0x24], eax
jmp 0x4132f9
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], eax
jl 0x4132ef
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x4132d9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + ecx*4 + 0x50]
mov ecx, dword [esp + 0x28]
mov dword [esp + ecx*4 + 0x50], edx
dec dword [esp + 0x28]
jns 0x4132c6
cmp dword [esp + 0x18], eax
jne 0x413300
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffee
jg 0x4132bc
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x41331d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
jmp 0x41331d
mov eax, dword [esp + 0x50]
mov dword [esp + 0x28], eax
push 3
pop esi
mov dword [esp + 0xc], esi
lea ecx, [esp + 0x190]
mov dword [esp + 0x18], 0x403ca955
mov dword [esp + 0x18], 0xffffffff
push esi
call fcn.00413ed8
mov dword [esp + 0x18], 0x5c3421ad
mov dword [esp + 0x2c], 0xa81d5f49
mov dword [esp + 0x10], 0
jmp 0x413371
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x41335b
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
add eax, 0x3817d1dc
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp edi, eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0xc]
cmp eax, 0xeec80f21
mov eax, dword [esp + 0xc]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, 0xffff
setl dl
cmp eax, edx
mov eax, dword [esp + 0xc]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, 0xc9d8d923
setne dl
sub edx, dword [esp + 0xc]
neg edx
sbb edx, edx
inc edx
sub eax, edx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x190]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x190]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
imul eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
call fcn.0041431c
push 4
lea ecx, [esp + 0x1ac]
call fcn.00413ed8
xor eax, eax
mov dword [esp + 0x10], 0x252cb136
mov dword [esp + 0x10], eax
jmp 0x41344c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x1a8]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x41343a
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], eax
jl 0x41348e
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x413478
push eax
push eax
push 0x2602
push eax
call dword [sym.imp.USER32.dll_AppendMenuA]
xor eax, eax
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x1a8]
mov ecx, dword [edx]
mov dword [edx + esi*4], ecx
dec dword [esp + 0x10]
jns 0x41345d
lea ecx, [esp + 0x1a8]
call fcn.0041431c
mov dword [esp + 0x10], 0xfffffff7
xor eax, eax
mov dword [esp + 0x18], 0xa028
mov dword [esp + 0x2c], 6
mov dword [esp + 0x1c], 0xb0cadfb1
mov dword [esp + 0x18], 0xf5cbf793
mov dword [esp + 0x10], eax
jmp 0x4134dd
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x9c], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4134ca
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jne 0x4134f5
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
cmp eax, 0x7b718a6
mov eax, dword [esp + 0x2c]
push 4
setg cl
xor edx, edx
cmp ecx, 0x105fa2ef
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x17c]
cmp dword [esp + 0x30], edi
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
call fcn.00413ed8
xor eax, eax
mov dword [esp + 0x18], 0x6660b256
mov dword [esp + 0x10], eax
jmp 0x41355c
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x178]
mov dword [ecx + edx*4], 0xbecc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x413546
mov dword [esp + 0x1c], eax
jmp 0x41357a
mov ecx, dword [esp + 0x1c]
cmp dword [esp + ecx*4 + 0x9c], eax
jne 0x413580
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x413569
mov eax, dword [esp + 0x178]
lea ecx, [esp + 0x178]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x18], eax
call fcn.0041431c
cmp dword [esp + 0xb8], 0
je 0x413798
push dword [esp + 0x54]
movdqa xmm0, xmmword [0xaba8f0]
lea ecx, [esp + 0x254]
push ecx
xor eax, eax
lea ecx, [esp + 0x248]
push ecx
push eax
lea ecx, [esp + 0x80]
mov dword [esp + 0x80], eax
movdqu xmmword [esp + 0x250], xmm0
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
call fcn.0041519b
mov dword [esp + 0x2c], 0x2c32b96c
xor eax, eax
mov dword [esp + 0x18], 0x8e10
mov dword [esp + 0x34], 0x17716e31
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], edi
mov dword [esp + 0x18], 0xb077cb11
mov dword [esp + 0x10], eax
jmp 0x413631
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x4c], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x413625
mov edx, dword [esp + 0x70]
lea esi, [edx + 0xc]
mov dword [esp + 0x10], esi
cmp dword [esi], eax
jne 0x413679
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
cmp ecx, 0x765e
mov edx, dword [esi]
push 0
pop ecx
setne cl
mov dword [esp + 0x18], eax
add ecx, edx
imul ecx, edx
mov edx, dword [esp + 0x70]
sub ecx, dword [edx + 4]
imul ecx, ecx, 0x3779
dec ecx
je 0x41367d
mov dword [esp + 0x18], edi
mov ecx, dword [edx + 8]
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x34]
cmp dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x2c]
setne dl
mov dword [esp + 0x18], edx
xor edx, edx
cmp ecx, dword [esp + 0x18]
setge dl
xor ecx, ecx
cmp dword [esi], edx
setl cl
xor edx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
cmp dword [esp + 0x18], ecx
setg dl
xor ecx, ecx
cmp edx, 0x4d41bd43
setl cl
xor edx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x70]
mov esi, dword [esp + 0x18]
cmp esi, dword [ecx]
setle dl
xor ecx, ecx
cmp edx, 0xffffffff
setne cl
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], eax
jne 0x4136f4
mov ecx, dword [esp + 0x10]
cmp dword [ecx], eax
mov ecx, eax
je 0x4136f6
mov ecx, edi
cmp ecx, dword [esp + 0x4c]
jne 0x413704
mov esi, edi
cmp dword [esp + 0x4c], eax
jne 0x413706
mov esi, eax
mov ecx, dword [esp + 0x34]
xor edx, edx
cmp esi, ecx
setge dl
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], eax
jne 0x413721
cmp dword [esp + 0x4c], eax
je 0x413723
mov eax, edi
cmp eax, edi
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 2
mov eax, dword [esp + 0x70]
setne cl
xor edx, edx
cmp ecx, dword [eax + 4]
lea ecx, [esp + 0x70]
setge dl
add edx, 0xe3e75f6
mov dword [esp + 0x18], edx
call fcn.0041431c
push 0x607d
push dword [esp + 0xbc]
push 0x7ecc
push edi
push edi
push 0xccb
push 0x4907
push 0x1c3e
call fcn.004106e9
push dword [esp + 0xd8]
call fcn.0042fdd0
add esp, 0x24
mov esi, eax
lea eax, [esp + 0x48]
mov dword [esp + 0x34], esi
push eax
call fcn.00413fff
mov dword [eax], esi
mov dword [esp + 0x24], edi
lea ecx, [esp + 0xdc]
mov dword [esp + 0xc], 0xfffffffb
push 2
call fcn.00413ed8
mov dword [esp + 0x18], 0xfa1a8f1
mov eax, 0xffff
mov dword [esp + 0x2c], eax
mov dword [esp + 0x2c], 0x477a75e3
mov dword [esp + 0x10], 0
jmp 0x4137eb
push dword [esp + 0x10]
lea ecx, [esp + 0xe0]
call fcn.00413f7a
mov dword [eax], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x4137d5
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp eax, 4
setge cl
add ecx, dword [esp + 0x24]
add ecx, dword [esp + 0x24]
jne 0x413816
cmp dword [esp + 0x24], ecx
jne 0x413816
xor eax, eax
jmp 0x413818
mov eax, edi
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0
je 0x413997
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x184]
push edi
call fcn.00413ed8
mov dword [esp + 0x2c], 0xfffffffe
mov dword [esp + 0x10], 0
jmp 0x413864
push dword [esp + 0x10]
lea ecx, [esp + 0x188]
call fcn.00413f7a
mov dword [eax], 0x1bd53d2a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x41384a
mov dword [esp + 0xc], 0
jmp 0x4138fd
mov dword [esp + 0x10], 0xfffffffc
lea ecx, [esp + 0xdc]
mov dword [esp + 0x10], 0x809d0107
push dword [esp + 0xc]
call fcn.00413f7a
cmp dword [eax], 0
jne 0x413907
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], 0
jl 0x4138f9
mov dword [esp + 0x24], 0
jmp 0x4138ed
mov byte [esp + 0x17], 0
cmp byte [esp + 0x17], 0
je 0x4138c3
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
push dword [esp + 0xc]
lea ecx, [esp + 0xe0]
call fcn.00413f7a
push dword [esp + 0x24]
lea ecx, [esp + 0xe0]
mov esi, eax
call fcn.00413f7a
mov ecx, dword [esi]
mov dword [eax], ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jle 0x4138b1
dec dword [esp + 0x10]
jns 0x4138a7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x413877
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x18]
je 0x413927
cmp dword [esp + 0x18], 0
je 0x413927
cmp dword [esp + 0xc], 0
je 0x413927
mov eax, edi
jmp 0x413929
xor eax, eax
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x184]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x20]
push 0
call fcn.00413f7a
xor ecx, ecx
push 0
mov dword [eax], esi
mov eax, dword [esp + 0x28]
cmp esi, eax
setl cl
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0xe0]
call fcn.00413f7a
mov ecx, dword [esp + 0x2c]
add ecx, dword [eax]
mov eax, dword [esp + 0xc]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xb834
setle cl
mov dword [esp + 0xc], ecx
lea ecx, [esp + 0x184]
call fcn.00413f75
jmp 0x4139af
mov dword [esp + 0x18], 0x83adeb94
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0xdc]
call fcn.00413f75
lea ecx, [esp + 0xb4]
call fcn.0040b8c3
xor eax, eax
mov dword [esp + 0x1c], 0x15252cb1
mov dword [esp + 0x10], eax
jmp 0x4139ea
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x21c], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x4139d7
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], al
je 0x413a09
push eax
push 0x15d8
call dword [sym.imp.GDI32.dll_RectVisible]
xor eax, eax
mov dword [esp + 0x1c], eax
jmp 0x413a73
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x413a59
push 0x2308
push 0x107d
push 0x1dce
push 0xa1d
push 0x1707
push 0x1a0f
push 0x108b
push 0xc37
push 0x191e
push 0x1e26
push 0x6fa
call dword [sym.imp.GDI32.dll_StretchBlt]
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + ecx*4 + 0x21c]
mov ecx, dword [esp + 0x1c]
mov dword [esp + ecx*4 + 0x21c], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x413a0f
mov esi, dword [esp + 0x34]
test esi, esi
je 0x413cfb
mov dword [esp + 0x28], 0xb3ae3556
or ecx, 0xffffffff
mov dword [esp + 0x1cc], ecx
mov dword [esp + 0x1d0], ecx
mov dword [esp + 0x1d4], ecx
mov dword [esp + 0x1d8], ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], 0x1d
jge 0x413baf
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
jmp 0x413add
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x130], 0xfffffffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x413aca
mov ecx, 0xffff
cmp dword [esp + 0x28], ecx
mov ecx, 0x615e82aa
sbb edx, edx
inc edx
sub ecx, edx
je 0x413b01
mov ecx, edi
cmp dword [esp + 0x1c], eax
jne 0x413b03
mov ecx, eax
mov esi, dword [esp + 0x1c]
xor edx, edx
add esi, ecx
mov ecx, dword [esp + 0x1c]
cmp esi, ecx
mov ecx, dword [esp + 0x1c]
push 0
setle dl
imul edx, edx, 0xffff
cmp edx, ecx
pop ecx
setle cl
xor edx, edx
mov dword [esp + 0x1cc], ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x28]
cmp dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x1c]
setg dl
mov dword [esp + 0x18], edx
xor edx, edx
cmp dword [esp + 0x18], ecx
push 0
setg dl
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x134]
add edx, 0xa3f3
cmp edx, ecx
mov ecx, dword [esp + 0x134]
pop edx
setge dl
cmp edx, ecx
mov edx, 0xffff
push 0
pop ecx
sete cl
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x130], eax
jne 0x413bab
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x1d
jl 0x413ac0
mov esi, dword [esp + 0x34]
mov byte [esp + 0x17], al
cmp byte [esp + 0x17], 0
je 0x413bc5
push 0x1596
call dword [sym.imp.KERNEL32.dll_Sleep]
mov edx, dword [esp + 0x38]
mov ecx, esi
call fcn.004118ee
or edx, 0xffffffff
mov esi, eax
mov dword [esp + 0x20], edx
xor eax, eax
mov dword [esp + 0x18], 0xfffffffd
mov dword [esp + 0xe8], edx
mov dword [esp + 0xec], edx
mov dword [esp + 0xf0], edx
mov dword [esp + 0xf4], edx
mov dword [esp + 0x34], 0xb2f67ab6
mov dword [esp + 0xf8], esi
mov dword [esp + 0x10], eax
jmp 0x413c27
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x8c], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x413c14
mov dword [esp + 0x20], 0xfffffffc
jmp 0x413c76
mov dword [esp + 0x38], 0xfffffffb
mov dword [esp + 0x38], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x38], 0xa9869ec4
mov dword [esp + 0x10], eax
jmp 0x413c64
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x298], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x413c55
inc dword [esp + 0x8c]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff6
jl 0x413c37
mov ecx, dword [esp + 0xe8]
xor edx, edx
cmp ecx, 0x69b4
mov ecx, dword [esp + 0xec]
setle dl
mov dword [esp + 0x38], edx
xor edx, edx
cmp ecx, dword [esp + 0x38]
setne dl
imul ecx, edx, 0xe0cd
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], eax
jne 0x413cb5
mov edi, eax
mov eax, dword [esp + 0xf4]
xor ecx, ecx
mov edx, dword [esp + 0xf4]
cmp edi, eax
setle cl
cmp ecx, 7
sbb eax, eax
inc eax
cmp eax, 0xfffffffa
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [esp + 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
lea eax, [esp + 0x7c]
push eax
setne cl
mov dword [esp + 0xf0], ecx
call fcn.00413f9d
mov dword [eax], esi
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x38], 0x949dfcf0
mov dword [esp + 0x38], 0xfef9d786
mov dword [esp + 0x38], 0x2c36544d
mov dword [esp + 0x20], 0
jmp 0x413d62
mov dword [esp + 0x10], 0
mov dword [esp + 0x38], 0xfffffff9
mov dword [esp + 0x38], 0xfffffffb
mov dword [esp + 0x10], 0xffffffea
jmp 0x413d57
mov dword [esp + 0x38], 0x7f6f
dec dword [esp + 0x38]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jge 0x413d47
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 5
jle 0x413d25
mov eax, dword [ebp + 8]
lea esi, [esp + 0xf8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov esp, ebp
pop ebp
ret