Function at 0x1003f70a
Capabilities:
Accept command line arguments
Create directory
Get common file path
Get graphical window text
Identify system language via api
Modify service
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100683a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3b8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x6c], ecx
xor edi, edi
mov dword [esp + 0x1ec], ebx
mov eax, dword [0x1096aef0]
mov esi, edx
inc edi
mov dword [esp + 0x48], esi
test al, 1
jne 0x1003f773
or eax, edi
mov dword [0x1096aef0], eax
mov dword [esp + 0x3cc], ebx
call fcn.1004251f
push 0x100687ef
call fcn.1004fac5
or dword [esp + 0x3d0], 0xffffffff
pop ecx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0xbb743d8
mov dword [esp + 0x24], 0xe1a8
mov dword [esp + 0x30], 0x3c47aa29
mov dword [esp + 0x14], 0xfffffffe
mov dword [esp + 0x10], 0x18158fb5
mov dword [esp + 0x2c], 0xd93cbfb4
mov dword [esp + 0x28], 0xfffffff7
mov dword [esp + 0x38], 0xd2ad05b3
mov dword [esp + 0x28], 4
mov dword [esp + 0x30], ebx
jmp 0x1003f7dc
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0xbc], 0xf89c8946
inc dword [esp + 0x30]
cmp dword [esp + 0x30], edi
jl 0x1003f7c9
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], eax
cmp dword [esp + 0x34], ebx
jne 0x1003f82d
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x24]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [esp + 0x24]
test ecx, ecx
je 0x1003f81d
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov edx, ebx
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
je 0x1003f82f
mov edx, edi
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0xb300
jne 0x1003f84a
mov ecx, ebx
cmp dword [esp + 0x24], ebx
je 0x1003f84c
mov ecx, edi
mov eax, dword [esp + 0x10]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x6243
jne 0x1003f872
mov eax, edi
cmp dword [esp + 0x24], ebx
jne 0x1003f874
mov eax, ebx
mov ecx, dword [esp + 0x34]
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x10]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0x11e75876
setl al
xor ecx, ecx
cmp eax, 7
setge cl
xor eax, eax
cmp ecx, 0xffffffff
setge al
add eax, 0xe7e1dec
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
cmp dword [esp + 0x34], eax
je 0x1003f8b8
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], 0xfff9
xor edx, edx
mov eax, dword [esp + 0x30]
imul eax, dword [esp + 0x34], 0x81fd
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xbc]
cmp eax, 0xfffffffc
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0xbc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
imul eax, dword [esp + 0x6c], 0x2710
mov dword [esp + 0x28], edi
add eax, esi
mov dword [esp + 0xb8], eax
lea eax, [esp + 0xb8]
push eax
call fcn.1004258c
push 2
mov edi, dword [eax]
mov dword [esp + 0x3c], edi
test edi, edi
je 0x1003fd69
pop esi
push esi
lea ecx, [esp + 0x90]
call fcn.1000ecc1
xor edx, edx
inc edx
mov dword [esp + 0x3cc], edx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
jmp 0x1003f96f
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x8c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x1003f95d
mov eax, dword [esp + 0x8c]
mov dword [eax], 0x17
mov dword [esp + 0x10], edx
xor ecx, ecx
mov dword [esp + 0x28], 0xfffffffb
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, edx
mov eax, dword [esp + 0x8c]
setg cl
mov dword [esp + 0x28], ecx
dec dword [eax]
cmp dword [eax], 0xfffffff5
jg 0x1003f982
mov dword [esp + 0x28], 0x16c1
cmp dword [esp + 0x28], 0x1131
jge 0x1003faea
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x54]
push eax
push 0x10007c8c
call fcn.1004f8bb
mov eax, dword [esp + 0x5c]
lea ecx, [esp + 0x220]
add esp, 0xc
inc eax
push eax
call fcn.1000ecc1
mov esi, dword [esp + 0x214]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x28], 1
mov dword [esi], eax
mov edx, dword [esp + 0x50]
lea eax, [edx + 1]
cmp eax, 1
jle 0x1003fa3c
mov ebx, dword [esp + 0x28]
lea edi, [esi + 4]
push edi
push 0x10007848
call fcn.1004f8bb
mov edx, dword [esp + 0x58]
inc ebx
pop ecx
add edi, 4
pop ecx
lea eax, [edx + 1]
cmp ebx, eax
jl 0x1003fa1e
xor ebx, ebx
xor ecx, ecx
lea eax, [edx + 1]
inc ecx
mov edi, ebx
mov dword [esp + 0x10], edi
cmp eax, ecx
jle 0x1003fa8a
mov ebx, dword [esp + 0x4c]
mov edi, dword [esi + ecx*4 - 4]
mov eax, dword [esi + ecx*4]
add edi, eax
cmp edi, ebx
jge 0x1003fa7c
sub eax, edi
add eax, ebx
mov dword [esi + ecx*4], eax
mov ebx, dword [esp + 0x4c]
mov eax, ebx
mov edx, dword [esp + 0x50]
sub eax, edi
mov edi, dword [esp + 0x10]
add edi, eax
mov dword [esp + 0x10], edi
jmp 0x1003fa80
mov edi, dword [esp + 0x10]
inc ecx
lea eax, [edx + 1]
cmp ecx, eax
jl 0x1003fa50
xor ebx, ebx
push edi
push 0x100078c8
call fcn.1004faef
mov eax, dword [esp + 0x58]
xor edi, edi
inc edi
inc eax
pop ecx
pop ecx
cmp eax, edi
jle 0x1003fabc
push dword [esi + edi*4]
push 0x10007ca0
call fcn.1004faef
mov eax, dword [esp + 0x58]
inc edi
inc eax
pop ecx
pop ecx
cmp edi, eax
jl 0x1003faa3
push 0x100077b5
call fcn.1004fca6
pop ecx
push esi
call fcn.1004fc57
mov edi, dword [esp + 0x3c]
pop ecx
push 2
mov dword [esp + 0x218], ebx
mov dword [esp + 0x21c], ebx
mov dword [esp + 0x220], ebx
pop esi
mov dword [esp + 0x24], ebx
jmp 0x1003fb7f
mov dword [esp + 0x14], 3
xor ecx, ecx
mov dword [esp + 0x10], 0x4defc72f
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 0x5b04
mov eax, dword [esp + 0x8c]
setle cl
sub ecx, dword [eax]
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x8c]
mov dword [eax], 8
mov eax, dword [esp + 0x14]
cmp eax, 9
setne cl
xor eax, eax
cmp ecx, 0xc83b
setg al
inc eax
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x24]
neg eax
sbb eax, eax
add eax, 0xffff0e14
imul eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff4
je 0x1003faf3
or dword [esp + 0x3cc], 0xffffffff
push dword [esp + 0x8c]
call fcn.1004fc57
pop ecx
push esi
lea ecx, [esp + 0xf8]
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x1f4], edi
call fcn.1000ecc1
mov dword [esp + 0x24], 0x1b18d408
mov dword [esp + 0x20], 0x7d8e6e83
mov dword [esp + 0x30], ebx
jmp 0x1003fbf4
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 0x1713
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x1003fbde
mov dword [esp + 0x24], ebx
jmp 0x1003fc16
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 0x2900
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x1003fc00
cmp dword [esp + 0xf4], 0
je 0x1003fc48
push dword [esp + 0xf4]
call fcn.1004fc57
pop ecx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x28], 0x17a1
cmp dword [esp + 0x28], 0x78c
jge 0x10041eb4
lea eax, [esp + 0x130]
push eax
lea eax, [esp + 0x13c]
push eax
lea eax, [esp + 0x1e0]
push eax
lea eax, [esp + 0x22c]
push eax
lea eax, [esp + 0x240]
push eax
push 0x10007f38
call fcn.1004f8bb
mov eax, dword [esp + 0x24c]
add esp, 0x18
mov ecx, dword [esp + 0x1dc]
mov dword [esp + 0x4c], eax
cmp eax, ecx
jl 0x1003fcbb
mov edx, dword [esp + 0x230]
jg 0x1003fcc6
cmp edx, dword [esp + 0x1d8]
ja 0x1003fcc6
mov edx, dword [esp + 0x1d8]
mov dword [esp + 0x4c], ecx
mov edi, dword [esp + 0x224]
cmp edi, dword [esp + 0x13c]
jg 0x1003fce8
mov esi, dword [esp + 0x220]
jl 0x1003fcf6
cmp esi, dword [esp + 0x138]
jb 0x1003fcf6
mov esi, dword [esp + 0x138]
mov edi, dword [esp + 0x13c]
mov eax, esi
mov ecx, edi
sub eax, edx
push 0
sbb ecx, dword [esp + 0x50]
add eax, 1
adc ecx, ebx
mov ebx, dword [esp + 0x138]
cmp dword [esp + 0x50], ebx
pop ebx
jg 0x1003fd3a
jl 0x1003fd20
cmp edx, dword [esp + 0x130]
ja 0x1003fd3a
cmp dword [esp + 0x134], edi
jg 0x1003fd3a
jl 0x1003fd34
cmp dword [esp + 0x130], esi
ja 0x1003fd3a
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebx
jg 0x1003fd55
jl 0x1003fd44
cmp eax, ebx
ja 0x1003fd55
xorps xmm0, xmm0
movlpd qword [esp + 0x70], xmm0
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x70]
push ecx
push eax
push 0x10007874
call fcn.1004faef
add esp, 0xc
jmp 0x10041eb4
mov dword [esp + 0x2c], 0x19c0
cmp dword [esp + 0x2c], 0xd09
pop edi
jge 0x1003ff0c
mov dword [esp + 0x2e8], 0x10007de8
mov dword [esp + 0x358], 0x10001f2c
push ebx
push ebx
lea eax, [esp + 0x300]
mov dword [esp + 0x3d4], edi
push eax
lea ecx, [esp + 0x2f4]
mov dword [esp + 0x1f8], 1
call fcn.10042ec8
mov dword [esp + 0x3cc], 3
mov eax, dword [esp + 0x2e8]
push ebx
mov eax, dword [eax + 4]
mov dword [esp + eax + 0x2ec], 0x10007de4
mov eax, dword [esp + 0x2ec]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [esp + ecx + 0x2e8], eax
lea ecx, [esp + 0x2fc]
call fcn.10043136
sub esp, 0xc
mov dword [esp + 0x3d8], 4
lea ecx, [esp + 0x2f4]
call fcn.10042631
lea eax, [esp + 0xb4]
push eax
lea ecx, [esp + 0x2ec]
call fcn.1000e663
push 0x10007d94
push 0x10007f60
call fcn.10050eab
mov esi, dword [esp + 0xbc]
mov dword [esp + 0x18], eax
pop ecx
pop ecx
test esi, esi
je 0x1003fe93
mov ebx, eax
lea eax, [esp + 0x1e4]
dec esi
push eax
lea ecx, [esp + 0x2ec]
call fcn.10032a1f
mov eax, dword [esp + 0x1e4]
push ebx
and eax, 0x80000001
jns 0x1003fe78
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, 0x10007f70
mov eax, 0x10007f6c
cmove eax, ecx
push eax
call fcn.100504a2
pop ecx
pop ecx
test esi, esi
jne 0x1003fe4f
xor ebx, ebx
dec esi
lea ecx, [esp + 0x2f8]
mov dword [esp + 0xb4], esi
call fcn.1004315a
test eax, eax
jne 0x1003fed5
mov eax, dword [esp + 0x2e8]
lea ecx, [esp + 0x2e8]
push ebx
mov eax, dword [eax + 4]
add ecx, eax
mov edx, dword [ecx + 0xc]
or edx, edi
mov eax, edx
or eax, 4
cmp dword [ecx + 0x38], ebx
cmove edx, eax
push edx
call fcn.100096ef
push dword [esp + 0x10]
call fcn.1005162a
or dword [esp + 0x3d0], 0xffffffff
pop ecx
lea ecx, [esp + 0x358]
call fcn.100425ee
lea eax, [esp + 0x358]
mov dword [esp + 0x358], 0x10001f24
push eax
call fcn.1004a524
pop ecx
push dword [esp + 0x20]
movdqa xmm0, xmmword [0x10008020]
lea eax, [esp + 0x274]
push eax
lea eax, [esp + 0x268]
mov dword [esp + 0xc8], ebx
push eax
push ebx
lea ecx, [esp + 0xd0]
mov dword [esp + 0xd4], ebx
movdqu xmmword [esp + 0x270], xmm0
mov dword [esp + 0xd8], ebx
call fcn.10033f8d
mov dword [esp + 0x3cc], 5
mov eax, dword [esp + 0xc0]
mov dword [eax], ebx
push edi
lea ecx, [esp + 0x148]
call fcn.1000ecc1
push 3
lea ecx, [esp + 0x160]
mov byte [esp + 0x3d0], 6
call fcn.1000ecc1
mov dword [esp + 0x1c], ebx
jmp 0x1003ffa6
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0x7be7e550
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1003ff90
mov dword [esp + 0x1c], ebx
jmp 0x1003ffc5
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x15c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1003ffb2
mov eax, dword [esp + 0x144]
mov esi, dword [esp + 0x15c]
mov dword [eax + 4], 0x6e838462
mov dword [esi + 8], 0xfffffff3
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], ebx
jl 0x10040016
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10040010
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
dec dword [esp + 0x10]
jns 0x1003fffe
inc dword [esi + 8]
cmp dword [esi + 8], 7
jne 0x1003ffe8
push dword [esp + 0x15c]
call fcn.1004fc57
pop ecx
mov byte [esp + 0x3cc], 5
push dword [esp + 0x144]
mov dword [esp + 0x160], ebx
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
call fcn.1004fc57
mov eax, dword [esp + 0xc4]
pop ecx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
inc dword [eax]
cmp dword [eax], 0x1a
mov dword [esp + 0x14c], ebx
jle 0x1003ff67
or dword [esp + 0x3cc], 0xffffffff
push eax
call fcn.1004fc57
mov eax, dword [0x1096aef0]
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
pop ecx
test al, 2
jne 0x1004013f
or eax, edi
mov dword [0x1096aef0], eax
push 7
pop esi
push ebx
mov dword [esp + 0x3d0], esi
push ebx
mov dword [0x1096aed0], ebx
mov dword [0x1096aed4], ebx
call fcn.10012f94
mov dword [0x1096aed0], eax
mov dword [0x1096aed8], ebx
mov dword [0x1096aee0], ebx
mov byte [esp + 0x3cc], 9
mov ecx, 0x1096aed8
mov dword [esp + 0x200], eax
lea eax, [esp + 0x200]
push eax
push 0x10
push ebx
lea eax, [esp + 0x64]
mov dword [0x1096aeec], 0x3f800000
push eax
mov dword [0x1096aedc], ebx
call fcn.10012d6c
push 0x100687ea
mov dword [0x1096aee4], esi
mov dword [0x1096aee8], 8
call fcn.1004fac5
or dword [esp + 0x3d0], 0xffffffff
pop ecx
push 3
mov dword [esp + 0x24], 1
lea ecx, [esp + 0x178]
pop esi
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0x25260
push esi
call fcn.1000ecc1
mov dword [esp + 0x3cc], 0xa
mov dword [esp + 0x2c], 0x2282d564
mov dword [esp + 0x28], 0x1a71
cmp dword [esp + 0x28], 0xb26
jge 0x100403de
lea eax, [esp + 0xac]
mov ecx, 0x1065aaa0
push eax
call fcn.1000e663
push 0xffffffffffffffff
push ecx
push ecx
call fcn.10041f0e
mov eax, dword [esp + 0xac]
test eax, eax
je 0x100403d6
dec eax
mov edx, 0x10070630
mov ecx, 0x1065aaa0
mov dword [esp + 0x28], eax
call fcn.10033cb0
mov ecx, dword [0x10070640]
mov esi, ebx
test ecx, ecx
jle 0x100403b1
cmp dword [0x10070644], 0x10
mov eax, 0x10070630
cmovae eax, dword [0x10070630]
cmp byte [eax + esi], 0x68
je 0x10040205
inc esi
cmp esi, ecx
jl 0x100401e2
jmp 0x100403b1
cmp esi, 0xffffffff
je 0x100403b1
lea edx, [esi + 1]
jmp 0x1004022d
cmp dword [0x10070644], 0x10
mov eax, 0x10070630
cmovae eax, dword [0x10070630]
cmp byte [eax + edx], 0x61
je 0x10040236
inc edx
cmp edx, ecx
jl 0x10040213
jmp 0x100403b1
cmp edx, esi
je 0x100403b1
lea esi, [edx + 1]
jmp 0x1004025d
cmp dword [0x10070644], 0x10
mov eax, 0x10070630
cmovae eax, dword [0x10070630]
cmp byte [eax + esi], 0x63
je 0x10040266
inc esi
cmp esi, ecx
jl 0x10040243
jmp 0x100403b1
cmp esi, edx
je 0x100403b1
lea edx, [esi + 1]
jmp 0x1004028d
cmp dword [0x10070644], 0x10
mov eax, 0x10070630
cmovae eax, dword [0x10070630]
cmp byte [eax + edx], 0x6b
je 0x10040296
inc edx
cmp edx, ecx
jl 0x10040273
jmp 0x100403b1
cmp edx, esi
je 0x100403b1
lea esi, [edx + 1]
jmp 0x100402bd
cmp dword [0x10070644], 0x10
mov eax, 0x10070630
cmovae eax, dword [0x10070630]
cmp byte [eax + esi], 0x65
je 0x100402c6
inc esi
cmp esi, ecx
jl 0x100402a3
jmp 0x100403b1
cmp esi, edx
je 0x100403b1
lea edx, [esi + 1]
jmp 0x100402ed
cmp dword [0x10070644], 0x10
mov eax, 0x10070630
cmovae eax, dword [0x10070630]
cmp byte [eax + edx], 0x72
je 0x100402f6
inc edx
cmp edx, ecx
jl 0x100402d3
jmp 0x100403b1
cmp edx, esi
je 0x100403b1
lea esi, [edx + 1]
jmp 0x1004031d
cmp dword [0x10070644], 0x10
mov eax, 0x10070630
cmovae eax, dword [0x10070630]
cmp byte [eax + esi], 0x72
je 0x10040326
inc esi
cmp esi, ecx
jl 0x10040303
jmp 0x100403b1
cmp esi, edx
je 0x100403b1
lea edx, [esi + 1]
jmp 0x1004034d
cmp dword [0x10070644], 0x10
mov eax, 0x10070630
cmovae eax, dword [0x10070630]
cmp byte [eax + edx], 0x61
je 0x10040357
inc edx
mov dword [esp + 0x10], edx
cmp edx, ecx
jl 0x10040333
jmp 0x100403b1
cmp edx, esi
je 0x100403b1
jmp 0x10040376
cmp dword [0x10070644], 0x10
mov eax, 0x10070630
cmovae eax, dword [0x10070630]
cmp byte [eax + edx], 0x6e
je 0x1004037d
inc edx
cmp edx, ecx
jl 0x1004035d
jmp 0x100403b1
cmp edx, dword [esp + 0x10]
je 0x100403b1
lea esi, [edx + 1]
jmp 0x100403a2
cmp dword [0x10070644], 0x10
mov eax, 0x10070630
cmovae eax, dword [0x10070630]
cmp byte [eax + esi], 0x6b
je 0x100403a8
inc esi
cmp esi, ecx
jl 0x10040388
jmp 0x100403b1
cmp esi, edx
mov edx, 0x1000787c
jne 0x100403b6
mov edx, 0x10007880
mov ecx, 0x1065a9f8
call fcn.10013431
push eax
call fcn.10013226
mov eax, dword [esp + 0x2c]
pop ecx
test eax, eax
jne 0x100401be
push 3
pop esi
dec eax
mov dword [esp + 0xac], eax
mov dword [esp + 0x30], ebx
jmp 0x100403fa
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], 0x8795010f
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x100403e4
inc dword [esp + 0x2c]
or dword [esp + 0x3cc], 0xffffffff
cmp dword [esp + 0x174], 0
je 0x10040438
push dword [esp + 0x174]
call fcn.1004fc57
pop ecx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x178], ebx
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x28], 0x2606
cmp dword [esp + 0x28], 0x988
jge 0x100404ab
lea eax, [esp + 0x54]
push eax
push 0x1000784c
call fcn.1004f8bb
jmp 0x1004049c
dec eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x1e8]
push eax
push 0x1000784c
call fcn.1004f8bb
mov eax, dword [esp + 0x1f0]
mov edx, ebx
pop ecx
pop ecx
xor ecx, ecx
inc ecx
test eax, eax
jle 0x1004048b
add edx, ecx
inc ecx
cmp edx, eax
jl 0x10040484
inc eax
cmp edx, eax
je 0x10040491
dec ecx
push ecx
push 0x100078c8
call fcn.1004faef
mov eax, dword [esp + 0x5c]
pop ecx
pop ecx
test eax, eax
jne 0x1004045b
dec eax
mov dword [esp + 0x54], eax
xorps xmm0, xmm0
lea ecx, [esp + 0x1a4]
push edi
movdqu xmmword [esp + 0x1cc], xmm0
call fcn.1000ecc1
mov dword [esp + 0x1c], ebx
jmp 0x100404da
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x44], 0xfffffff9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x100404ca
mov dword [esp + 0x1c], ebx
jmp 0x100404fa
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x100404e7
mov ecx, dword [esp + 0x1a4]
mov dword [ecx + 4], ebx
mov eax, dword [ecx + 4]
mov dword [esp + 0x28], 4
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [ecx + 4]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [ecx + 4]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [ecx + 4]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [ecx + 4]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [ecx + 4]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [ecx + 4]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [ecx + 4]
mov eax, dword [esp + eax*4 + 0x44]
add eax, dword [ecx + 4]
inc dword [ecx + 4]
cmp dword [ecx + 4], 0
mov dword [esp + 0x28], eax
jle 0x1004050a
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004056f
push ebx
push 0x57
push ebx
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [esp + 0x1a4]
call fcn.1004fc57
pop ecx
lea eax, [esp + 0x6c]
mov dword [esp + 0x1a4], ebx
push eax
mov dword [esp + 0x1ac], ebx
mov dword [esp + 0x1b0], ebx
call fcn.10042da6
push esi
lea ecx, [esp + 0x190]
mov eax, dword [eax]
mov dword [esp + 0x18], 0x477862fd
mov dword [esp + 0x14], 0x300ce3d9
mov dword [esp + 0x3c], 1
mov dword [esp + 0x28], 0x8fb
mov dword [esp + 0x14], 0x6ba8a7e8
mov dword [esp + 0x24], ebx
mov dword [esp + 0x34], eax
call fcn.1000ecc1
push 0xb
pop edx
mov dword [esp + 0x3cc], edx
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x3c], 8
mov dword [esp + 0x1c], ebx
jmp 0x1004060d
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x258], 0xdeea39b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x100405fa
mov dword [esp + 0x1c], ebx
jmp 0x1004062f
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18c]
mov dword [eax + ecx*4], 0xadab8f5b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10040619
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], edx
jle 0x10040897
mov dword [esp + 0x1c], 0xffffffff
xor ecx, ecx
mov dword [esp + 0x34], edi
inc ecx
mov dword [esp + 0x2c], 0x477a14a9
mov dword [esp + 0x20], 5
mov dword [esp + 0x20], 6
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ebx
jmp 0x10040687
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2c8], 0xf19
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10040674
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x10], eax
imul eax, dword [esp + 0x10], 9
cmp eax, dword [esp + 0x34]
jl 0x100406ac
cmp dword [esp + 0x34], ebx
jne 0x100406ac
mov ecx, ebx
mov eax, dword [esp + 0x34]
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x299f
setge cl
xor edx, edx
cmp ecx, eax
setne dl
add edx, dword [esp + 0x2c]
add edx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
sub ecx, dword [esp + 0x2c]
sub ecx, 0x52f0
imul ecx, dword [esp + 0x14]
mov dword [esp + 0x38], ecx
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
add eax, dword [esp + 0x2c]
add eax, dword [esp + 0x24]
cmp eax, 0xd1a9
jle 0x10040727
cmp dword [esp + 0x10], ebx
jne 0x10040727
mov ecx, ebx
jmp 0x1004072a
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x34]
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, 0x2510a741
imul edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
sub edx, 0x7067
cmp edx, eax
mov eax, dword [esp + 0x1c]
setge cl
dec eax
add eax, ecx
xor ecx, ecx
imul eax, dword [esp + 0x14]
inc ecx
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x25c]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x1c], ebx
je 0x10040814
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10008050]
lea eax, [esp + 0x294]
push eax
lea eax, [esp + 0x288]
mov dword [esp + 0x28], ecx
push eax
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0xdc]
mov dword [esp + 0x2c], 0x8a5f0362
push ebx
movdqu xmmword [esp + 0x290], xmm0
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
call fcn.10033f8d
inc dword [esp + 0x28]
cmp dword [esp + 0xd0], 0
je 0x10040888
push dword [esp + 0xd0]
call fcn.1004fc57
pop ecx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
jmp 0x10040888
mov dword [esp + 0x38], ecx
mov dword [esp + 0x24], 0xffffffff
jmp 0x10040837
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10040833
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xd
jl 0x10040822
mov dword [esp + 0x1c], ebx
jmp 0x10040881
mov dword [esp + 0x2c], 0x17d3e822
xor ecx, ecx
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
test eax, eax
sets cl
xor edx, edx
add ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
cmp ecx, 0x6664
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x10], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x12
jl 0x10040844
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xb
jg 0x10040643
or dword [esp + 0x3cc], 0xffffffff
cmp dword [esp + 0x18c], 0
je 0x100408cb
push dword [esp + 0x18c]
call fcn.1004fc57
pop ecx
mov dword [esp + 0x18c], ebx
mov dword [esp + 0x190], ebx
mov dword [esp + 0x194], ebx
mov al, byte [ebp + 0xc]
test al, al
jne 0x100408de
mov ecx, dword [esp + 0x30]
test ecx, ecx
jne 0x10041687
lea ecx, [esp + 0x3b0]
mov dl, al
push ecx
mov ecx, dword [esp + 0x70]
call fcn.1003459d
mov esi, eax
lea edi, [esp + 0x1cc]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x3c], 0x23aa
cmp dword [esp + 0x3c], 0x9c1
jge 0x100409d4
lea eax, [esp + 0xb0]
mov ecx, 0x1065aaa0
push eax
call fcn.1000e663
cmp dword [esp + 0xb0], 1
mov dword [esp + 0x28], 1
jl 0x100409d4
lea eax, [esp + 0xcc]
mov ecx, 0x1065aaa0
push eax
call fcn.1000e663
mov esi, dword [esp + 0xcc]
mov edi, ebx
test esi, esi
je 0x10040980
lea eax, [esp + 0x1fc]
mov ecx, 0x1065aaa0
push eax
call fcn.1000e663
add edi, dword [esp + 0x1fc]
dec esi
jne 0x10040964
push edi
dec esi
mov edx, 0x10007f74
push ecx
mov dword [esp + 0xd4], esi
mov esi, dword [esp + 0x30]
push esi
push ecx
mov ecx, 0x1065a9f8
call fcn.10013431
pop ecx
mov ecx, eax
call fcn.1000e973
mov edx, 0x100077b8
mov ecx, eax
call fcn.10013431
pop ecx
mov ecx, eax
call fcn.1000e973
push eax
call fcn.10013226
inc esi
pop ecx
mov dword [esp + 0x28], esi
cmp esi, dword [esp + 0xb0]
jle 0x10040945
mov dword [esp + 0x10], ebx
jmp 0x100409ed
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2d0], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100409da
mov dword [esp + 0x1c], 0x18
jmp 0x10040a08
cmp dword [esp + 0x1c], ebx
jne 0x10040a0f
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 6
je 0x100409fe
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
mov esi, dword [sym.imp.USER32.dll_GetDC]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x25a80e35
setle cl
sub eax, ecx
xor ecx, ecx
add eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add eax, 0x5223fa3a
cmp eax, 1
setge cl
cmp byte [ebp + 0xc], 0
mov dword [esp + 0x2dc], ecx
je 0x10040d2f
cmp dword [esp + 0x1d0], 0
je 0x10040d2f
mov dword [esp + 0x20], 0x20624039
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10040a99
push 0x266c
push ebx
push 0x230f
push 0x1a49
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10040adc
push 0x1721
push 0x23b7
push 0x1728
push 0x33e
push 0x26dd
push 0x207c
push 0x1c05
push 0x2161
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_Arc]
mov eax, dword [esp + 0x1d4]
lea ecx, [esp + 0xdc]
push 2
pop edi
mov dword [esp + 0x1c], ebx
push edi
mov dword [esp + 0x1f8], eax
call fcn.1000ecc1
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10040b13
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x5c], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10040b07
mov dword [esp + 0x14], ebx
jmp 0x10040b32
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xdc]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10040b1f
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x10040b5f
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x3c], 0x7a4a12b5
mov dword [esp + 0x3c], ebx
jmp 0x10040cf3
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], ebx
jmp 0x10040b7c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xa4], 0x11b55e97
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10040b69
cmp dword [esp + 0x5c], ebx
je 0x10040c44
mov dword [esp + 0x3c], 0xa6e483bb
mov dword [esp + 0x2c], 0xfffffffa
mov dword [esp + 0x28], 0xe630971c
mov dword [esp + 0x1c], ebx
jmp 0x10040c34
mov dword [esp + 0x10], 0x5c6f
mov ecx, edx
mov dword [esp + 0x28], 0xfffffff8
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x10]
sub ecx, eax
je 0x10040bd6
mov eax, dword [esp + 0xa8]
mov eax, dword [esp + 0xa8]
cmp dword [esp + 0x5c], edx
push 1
sbb eax, eax
inc eax
cmp eax, edx
mov eax, dword [esp + 0x14]
sbb edx, edx
imul eax, dword [esp + 0x20]
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0x30]
sub ecx, eax
mov eax, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, edi
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
pop edx
setl cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x1d
jge 0x10040bad
jmp 0x10040cd4
mov dword [esp + 0x10], edx
mov dword [esp + 0x2c], ebx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10040c6d
push ebx
push 0x1585
push 0x1c53
push 0x1756
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov dword [esp + 0x28], 0xffff
mov ecx, dword [esp + 0x28]
imul ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xa8]
neg eax
cmp ecx, eax
jle 0x10040cac
mov eax, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + 0xdc]
mov eax, dword [esp + 0x10]
cmp eax, dword [ecx + 4]
setg dl
cmp edx, dword [esp + 0x1c]
jg 0x10040cac
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xa8]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10040cf3
push ebx
push ebx
push 0xa39
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp dword [esp + 0xdc], 0
je 0x10040d1f
push dword [esp + 0xdc]
call fcn.1004fc57
pop ecx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov eax, dword [esp + 0x1d0]
mov dword [esp + 0x1f8], eax
jmp 0x10040d32
push 2
pop edi
cmp dword [esp + 0x30], 0
jne 0x10041684
cmp dword [esp + 0x1c8], 0
jle 0x10041684
push 4
lea ecx, [esp + 0x154]
call fcn.1000ecc1
mov dword [esp + 0x20], 0xd444182b
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x20], 0x50ba1bf2
mov dword [esp + 0x20], 0xfcf09cc2
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], 0x2af0488f
mov dword [esp + 0x14], ebx
jmp 0x10040da1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0x464b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10040d8b
mov dword [esp + 0x14], ebx
jmp 0x10040dbd
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3a4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10040dae
inc dword [esp + 0x28]
cmp dword [esp + 0x150], 0
je 0x10040df4
push dword [esp + 0x150]
call fcn.1004fc57
pop ecx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ebx
xor eax, eax
mov dword [esp + 0x1c], 6
inc eax
mov dword [esp + 0x34], 0x3de467b4
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x60]
push eax
call fcn.1000ecc1
mov dword [esp + 0x3cc], 0xc
mov dword [esp + 0x204], ebx
mov dword [esp + 0x208], ebx
mov dword [esp + 0x20c], ebx
mov dword [esp + 0x210], ebx
mov dword [esp + 0x14], ebx
jmp 0x10040e51
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10040e42
mov dword [esp + 0x14], ebx
jmp 0x10040e71
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x228], 0x41ec
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10040e5e
mov dword [esp + 0x1c], 0xffffffee
jmp 0x100410ae
mov dword [esp + 0x28], 0x56e3
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x2c], 6
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x10], ebx
jmp 0x10040eb6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x70], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10040ea6
cmp dword [esp + 0x1c], ebx
je 0x10040edd
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x60]
mov dword [eax], ecx
test ecx, ecx
je 0x10040edd
xor eax, eax
inc eax
jmp 0x10040edf
mov eax, ebx
mov dword [esp + 0x208], eax
mov dword [esp + 0x14], ebx
jmp 0x100410a0
push dword [esp + 0x58]
lea eax, [esp + 0x2b4]
mov dword [esp + 0x28], 0xffffffff
push eax
lea eax, [esp + 0x2a8]
mov dword [esp + 0x18], 3
push eax
xorps xmm0, xmm0
mov dword [esp + 0x8c], ebx
push ebx
lea ecx, [esp + 0x90]
mov dword [esp + 0x94], ebx
movdqu xmmword [esp + 0x2b0], xmm0
mov dword [esp + 0x98], ebx
call fcn.10033f8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
cmp dword [eax + ecx*4], ebx
je 0x10040fc3
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x28]
cmp eax, 0x6352
setne cl
xor eax, eax
sub ecx, dword [esp + 0x28]
add ecx, 0x3d34
imul ecx, dword [esp + 0x24]
cmp ecx, 0xfffffff8
setg al
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], ebx
je 0x10040f8c
cmp dword [esp + 0x74], ebx
je 0x10040f8c
xor edx, edx
inc edx
jmp 0x10040f8e
mov edx, ebx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
mov dword [eax + ecx*4], ebx
xor ecx, ecx
mov dword [esp + 0x208], ebx
mov eax, dword [esp + 0x2c]
cmp edx, eax
setge cl
mov dword [esp + 0x228], ecx
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
xor eax, eax
inc eax
jmp 0x10040fc5
mov eax, ebx
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
cmp dword [eax + ecx*4], ebx
jne 0x10040fda
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
sub eax, 0x5db2
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, eax, 0xfffffff8
cmp eax, 0x285618a3
mov eax, dword [esp + 0x80]
setle cl
dec ecx
sub ecx, dword [eax + 4]
mov eax, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
add ecx, eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x208], ecx
mov eax, dword [eax]
add eax, ecx
cmp eax, 0xfffa
jne 0x10041038
cmp dword [esp + 0x70], ebx
je 0x10041038
mov eax, dword [esp + 0x80]
cmp dword [eax + 0xc], ebx
je 0x10041038
xor edx, edx
inc edx
jmp 0x1004103a
mov edx, ebx
mov eax, dword [esp + 0x60]
xor ecx, ecx
cmp edx, dword [eax]
setg cl
cmp ecx, dword [esp + 0x22c]
jg 0x10041052
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x34], eax
jge 0x10041072
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x60]
cmp dword [ecx + eax*4], ebx
je 0x10041076
xor eax, eax
inc eax
jmp 0x10041078
mov ecx, dword [esp + 0x60]
mov eax, ebx
push dword [esp + 0x80]
mov dword [ecx], eax
call fcn.1004fc57
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
inc dword [esp + 0x18]
pop ecx
cmp dword [esp + 0x14], ebx
jle 0x10040eef
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffe
jl 0x10040e84
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100410d4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
or dword [esp + 0x3cc], 0xffffffff
cmp dword [esp + 0x60], 0
je 0x100410f9
push dword [esp + 0x60]
call fcn.1004fc57
pop ecx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x24], 0xe0cf
dec dword [esp + 0x24]
mov dword [esp + 0x24], ebx
jmp 0x10041128
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10041124
push ebx
push 0x187b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x1d
jge 0x1004110b
push 3
pop esi
mov dword [esp + 0x20], 0x8a8f
lea ecx, [esp + 0x10c]
mov dword [esp + 0x3c], esi
mov dword [esp + 0x28], 4
push 1
call fcn.1000ecc1
xor edx, edx
mov dword [esp + 0x3cc], 0xd
inc edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x24], 0x3607a988
mov dword [esp + 0x10], ebx
jmp 0x10041186
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10041174
inc dword [esp + 0x24]
mov dword [esp + 0x2c], 0x16
jmp 0x100412e8
mov dword [esp + 0x10], ebx
jmp 0x100411b6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2bc], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x100411a3
cmp dword [esp + 0x28], ebx
jne 0x100412f3
mov dword [esp + 0x24], 0x19
jmp 0x100412d9
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10007fe0]
lea eax, [esp + 0x2a4]
push eax
lea eax, [esp + 0x298]
mov dword [esp + 0xa0], ebx
push eax
push ebx
lea ecx, [esp + 0xa8]
mov dword [esp + 0xac], ebx
movdqu xmmword [esp + 0x2a0], xmm0
mov dword [esp + 0xb0], ebx
call fcn.10033f8d
mov dword [esp + 0x10], ebx
jmp 0x10041233
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2b0], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10041220
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x98]
mov eax, dword [edx]
cmp eax, 0xe136dc99
mov dword [esp + 0x2c4], eax
mov eax, dword [edx]
sbb ecx, ecx
xor edx, edx
mov dword [esp + 0x2b4], 7
add eax, 7
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setle dl
mov dword [esp + 0x38], edx
xor edx, edx
cmp dword [esp + 0x38], eax
mov eax, dword [esp + 0x28]
sete dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 1
mov ecx, dword [esp + 0x10c]
setle al
xor edx, edx
cmp eax, 8
mov eax, dword [esp + 0x98]
push eax
setle dl
imul edx, dword [ecx]
sub edx, dword [eax + 8]
neg edx
sbb edx, edx
inc edx
neg edx
mov dword [ecx], edx
call fcn.1004fc57
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
dec dword [esp + 0x28]
pop ecx
cmp dword [esp + 0x24], 0x11
jg 0x100411d3
dec dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x13
je 0x1004119d
or dword [esp + 0x3cc], 0xffffffff
cmp dword [esp + 0x10c], 0
je 0x10041327
push dword [esp + 0x10c]
call fcn.1004fc57
pop ecx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], ebx
cmp dword [esp + 0x1cc], 0
je 0x10041687
push edi
lea ecx, [esp + 0x128]
call fcn.1000ecc1
mov dword [esp + 0x20], 0xffff
mov dword [esp + 0x28], 0x5d732ada
mov dword [esp + 0x38], 0x617c0ec0
mov dword [esp + 0x14], ebx
jmp 0x10041376
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], 0x91a0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10041360
mov dword [esp + 0x14], ebx
jmp 0x10041392
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x40], 0xb02971c1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10041382
mov dword [esp + 0x40], 1
cmp dword [esp + 0x40], ebx
jl 0x100413c0
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100413ba
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
dec dword [esp + 0x40]
jns 0x100413a7
mov eax, dword [esp + 0x40]
xor edx, edx
mov eax, dword [esp + 0x40]
inc edx
sub edx, eax
mov eax, dword [esp + 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x40]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x124]
setne cl
cmp ecx, dword [eax]
jge 0x10041412
cmp dword [esp + 0x38], ebx
je 0x10041412
xor eax, eax
inc eax
jmp 0x10041414
mov eax, ebx
add eax, 0xffff1fae
cmp eax, 1
jle 0x1004142e
mov eax, dword [esp + 0x124]
cmp dword [eax + 4], ebx
jne 0x1004142e
mov eax, dword [esp + 0x40]
imul eax, dword [esp + 0x38], 0xfffffffb
push dword [esp + 0x124]
mov dword [esp + 0x44], eax
call fcn.1004fc57
pop ecx
mov ecx, dword [esp + 0x1cc]
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
call fcn.1003f6de
or ecx, 0xffffffff
mov dword [esp + 0x30], eax
mov dword [esp + 0x10], ecx
xor eax, eax
mov dword [esp + 0x20], 0xf2e5664d
inc eax
mov dword [esp + 0x20], 0xba07e4fc
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0x3d37a5b7
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 6
mov dword [esp + 0x20], 0x2db8e964
mov dword [esp + 0x20], ecx
mov dword [esp + 0x20], 0x89fff12f
mov dword [esp + 0x20], 0x4ea14c55
mov dword [esp + 0x20], ecx
mov dword [esp + 0x20], 4
mov dword [esp + 0x20], 0xa023703a
mov dword [esp + 0x20], 0x4bda99da
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x20], 0xebbfad0d
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x180]
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x20], 0x95e04a27
mov dword [esp + 0x20], ebx
push esi
call fcn.1000ecc1
mov dword [esp + 0x3cc], 0xe
mov dword [esp + 0x10], ebx
jmp 0x10041533
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1004151d
mov dword [esp + 0x10], 0xfffffffa
jmp 0x1004160b
xor eax, eax
lea ecx, [esp + 0x168]
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x20], ebx
push eax
call fcn.1000ecc1
xor edx, edx
mov dword [esp + 0x20], 0xf08664a1
inc edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], 0xa1d127a4
mov dword [esp + 0x14], ebx
jmp 0x10041596
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2e0], 0xfe30
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10041583
mov dword [esp + 0x14], ebx
jmp 0x100415b8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100415a2
mov eax, dword [esp + 0x168]
mov edx, dword [eax]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
dec dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp eax, 0xffffffff
push dword [esp + 0x168]
setl cl
imul ecx, edx
mov dword [esp + 0x40], ecx
call fcn.1004fc57
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
inc dword [esp + 0x14]
pop ecx
cmp dword [esp + 0x10], 0x14
je 0x10041546
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004163e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x114f
push 0x1019
push 0x189d
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
or dword [esp + 0x3cc], 0xffffffff
cmp dword [esp + 0x180], 0
je 0x10041672
push dword [esp + 0x180]
call fcn.1004fc57
pop ecx
mov dword [esp + 0x180], ebx
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], ebx
lea eax, [esp + 0x6c]
push eax
call fcn.10042da6
mov ecx, dword [esp + 0x30]
mov dword [eax], ecx
jmp 0x10041687
push 3
pop esi
lea ecx, [esp + 0x1c8]
call fcn.1003af9c
push 1
lea ecx, [esp + 0x1c0]
call fcn.1000ecc1
push edi
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x3d0], 0xf
call fcn.1000ecc1
mov byte [esp + 0x3cc], 0x10
lea ecx, [esp + 0x198]
mov dword [esp + 0x20], 5
push 1
call fcn.1000ecc1
xor edx, edx
mov dword [esp + 0x20], 0x6088b922
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x100416fa
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x100416e8
mov dword [esp + 0x1c], ebx
jmp 0x1004171c
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1b0]
mov dword [eax + ecx*4], 0x6e87
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10041706
mov dword [esp + 0x1c], ebx
jmp 0x1004173e
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x10041728
mov eax, dword [esp + 0x198]
inc dword [eax]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1004176b
push 0x1c11
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [esp + 0x198]
call fcn.1004fc57
cmp dword [esp + 0x1b4], 0
pop ecx
mov dword [esp + 0x198], ebx
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x1a0], ebx
je 0x100417b9
push dword [esp + 0x1b0]
call fcn.1004fc57
pop ecx
mov dword [esp + 0x1b0], ebx
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x1b8], ebx
or dword [esp + 0x3cc], 0xffffffff
cmp dword [esp + 0x1bc], 0
je 0x100417ed
push dword [esp + 0x1bc]
call fcn.1004fc57
pop ecx
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x1c0], ebx
mov dword [esp + 0x1c4], ebx
cmp dword [esp + 0x30], 0
je 0x10041b8a
push edi
lea ecx, [esp + 0x104]
call fcn.1000ecc1
mov dword [esp + 0x3cc], 0x11
lea ecx, [esp + 0x118]
mov dword [esp + 0x34], 0xfffffff6
mov dword [esp + 0x14], 0xaa0d
push 1
call fcn.1000ecc1
mov dword [esp + 0x2c], 0xfffffff9
mov dword [esp + 0x3c], esi
mov dword [esp + 0x14], ebx
jmp 0x10041856
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10041840
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x1004187b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 0x2d3f5047
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10041865
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x100]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esi + 4]
dec eax
sub edx, eax
mov eax, dword [esp + 0x118]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [esi + 4]
setl cl
mov dword [eax], ecx
mov dword [esp + 0x14], ebx
jmp 0x10041a01
mov dword [esp + 0x38], ebx
mov dword [esp + 0x10], ebx
jmp 0x100418d7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x78], 0xce30
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100418c7
mov eax, dword [esp + 0x7c]
mov dword [esp + 0x38], eax
cmp dword [esp + 0x34], ebx
je 0x10041903
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x78]
mov eax, dword [esp + 0x2c]
xor edx, edx
test eax, eax
mov eax, dword [esp + 0x7c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0xe289
jne 0x100419eb
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], 0xffffffea
jmp 0x100419de
mov dword [esp + 0x10], 1
mov dword [esp + 0x28], 0x2959af2c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x118]
mov dword [eax], ecx
test ecx, ecx
je 0x1004196a
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], ebx
je 0x1004196a
xor esi, esi
inc esi
jmp 0x1004196c
mov esi, ebx
cmp dword [esp + 0x24], ebx
je 0x1004199b
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [esp + 0x24]
sub edx, eax
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp edx, eax
setne cl
cmp ecx, 1
ja 0x1004199b
cmp dword [esp + 0x38], ebx
je 0x1004199b
xor ecx, ecx
inc ecx
jmp 0x1004199d
mov ecx, ebx
xor eax, eax
cmp ecx, 0x7629
sete al
imul eax, esi
test eax, eax
je 0x100419b5
cmp dword [esp + 0x24], ebx
jne 0x100419b9
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x7c]
xor edx, edx
mov eax, dword [esp + 0x100]
cmp dword [eax], ecx
mov eax, dword [esp + 0x24]
setge dl
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x3c], eax
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 6
jl 0x1004193a
jmp 0x100419fd
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100419fd
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xa
jle 0x100418bd
push dword [esp + 0x118]
call fcn.1004fc57
or dword [esp + 0x3d0], 0xffffffff
pop ecx
push dword [esp + 0x100]
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
call fcn.1004fc57
mov edx, dword [esp + 0x4c]
pop ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
call fcn.1096f000
mov dword [esp + 0x28], 0xb90d
mov esi, eax
mov dword [esp + 0x20], 0xeac45307
xor eax, eax
mov dword [esp + 0x20], 0xffffffff
inc eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0x6c516535
mov dword [esp + 0x20], 4
mov dword [esp + 0x20], 0x981ff29a
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0x7b722ba7
mov dword [esp + 0x20], 3
mov dword [esp + 0x1f0], esi
cmp dword [esp + 0x28], ebx
je 0x10041adb
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10041b7b
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
jmp 0x10041b7b
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10008010]
lea ecx, [esp + 0xec]
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x24], 0xcccddd1d
mov dword [esp + 0x24], 0x6c902daf
mov dword [esp + 0x24], 0x84bc9c3
mov dword [esp + 0x24], eax
lea eax, [esp + 0x284]
push eax
lea eax, [esp + 0x278]
mov dword [esp + 0x28], 0xfffffffa
push eax
push ebx
movdqu xmmword [esp + 0x280], xmm0
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
call fcn.10033f8d
mov eax, dword [esp + 0x28]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0xe8]
push eax
dec dword [eax]
call fcn.1004fc57
pop ecx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
lea eax, [esp + 0xb8]
push eax
call fcn.1004258c
mov dword [eax], esi
mov dword [esp + 0x20], 0xfffffffd
lea ecx, [esp + 0x24c]
mov dword [esp + 0x20], 0xb50bf34f
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0xdd688769
push 3
call fcn.1000ecc1
mov dword [esp + 0x20], 0xfffffffe
mov eax, 0x878ed7c3
mov dword [esp + 0x23c], eax
mov dword [esp + 0x240], eax
mov dword [esp + 0x244], eax
mov dword [esp + 0x248], eax
mov dword [esp + 0x10], ebx
jmp 0x10041bf9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x24c]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10041be3
dec dword [esp + 0x248]
mov dword [esp + 0x48], 0x1a43
cmp dword [esp + 0x48], 0x833
jge 0x10041e8c
push 0x108a7688
push 0x108a6a50
push 0x10007f7c
call fcn.1004f8bb
mov esi, dword [0x108a6a54]
add esp, 0xc
push ebx
push edi
push esi
push dword [0x108a6a50]
call fcn.10066f70
or eax, edx
push ebx
push edi
push esi
push dword [0x108a6a50]
jne 0x10041c67
call fcn.10066ec0
mov dword [0x108a7618], eax
mov dword [0x108a761c], edx
jmp 0x10041c81
call fcn.10066ec0
mov esi, eax
mov ecx, edx
add esi, 1
mov dword [0x108a7618], esi
adc ecx, ebx
mov dword [0x108a761c], ecx
mov dword [0x108a6d7c], edx
mov dword [0x108a6d78], eax
jmp 0x10041e64
add ecx, 0xffffffff
push 0x108a6c68
adc edx, 0xffffffff
mov dword [0x108a7688], ecx
push 0x108a7620
push 0x10007f7c
mov dword [0x108a768c], edx
call fcn.1004f8bb
mov eax, dword [0x108a7620]
add esp, 0xc
mov edx, dword [0x108a6c6c]
mov ecx, eax
mov dword [esp + 0x2c], eax
mov eax, dword [0x108a6c68]
add ecx, eax
mov dword [esp + 0x38], eax
mov eax, dword [0x108a7624]
push ebx
mov dword [esp + 0x34], eax
adc eax, edx
push edi
push eax
push ecx
mov dword [esp + 0x24], edx
call fcn.10066f70
mov ecx, eax
mov dword [esp + 0x1c], eax
or ecx, edx
mov dword [esp + 0x20], edx
jne 0x10041d25
mov eax, dword [0x108a7618]
mov esi, dword [0x108a6d78]
mov dword [esp + 0x34], eax
mov dword [0x108a7628], eax
mov eax, dword [0x108a761c]
mov dword [esp + 0x24], eax
mov dword [0x108a762c], eax
mov eax, dword [0x108a6d7c]
jmp 0x10041d4c
mov eax, dword [0x108a6d78]
mov esi, dword [0x108a7618]
mov dword [esp + 0x34], eax
mov dword [0x108a7628], eax
mov eax, dword [0x108a6d7c]
mov dword [esp + 0x24], eax
mov dword [0x108a762c], eax
mov eax, dword [0x108a761c]
mov ecx, dword [esp + 0x30]
mov dword [0x108a6acc], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x2c]
sub eax, 1
mov dword [0x108a6ac8], esi
push ebx
sbb ecx, ebx
mov dword [esp + 0x2c], esi
push edi
push ecx
push eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], ecx
call fcn.10066f70
or eax, edx
push ebx
push edi
push dword [esp + 0x38]
jne 0x10041daf
add esi, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
adc dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
push eax
call fcn.10066ec0
push edx
push eax
push dword [esp + 0x18]
push esi
call fcn.10053b90
mov esi, eax
mov edi, edx
jmp 0x10041df8
mov eax, dword [esp + 0x38]
push eax
call fcn.10066ec0
mov esi, eax
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x24]
mov edi, edx
push eax
push dword [esp + 0x38]
add esi, 1
mov ecx, edi
adc ecx, ebx
push ecx
push esi
call fcn.10053b90
push dword [esp + 0x10]
mov esi, eax
mov dword [esp + 0x40], edx
push dword [esp + 0x2c]
push edi
push dword [esp + 0x54]
call fcn.10053b90
mov edi, dword [esp + 0x3c]
add esi, eax
adc edi, edx
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
sub eax, 1
push ebx
push 2
sbb ecx, ebx
push ecx
push eax
call fcn.10066ec0
add esi, eax
mov eax, dword [esp + 0x1c]
adc edi, edx
or eax, dword [esp + 0x20]
jne 0x10041e26
add esi, 1
adc edi, ebx
push edi
push esi
jmp 0x10041e54
mov ecx, dword [0x108a6a54]
mov eax, dword [0x108a6a50]
push ecx
push eax
push ecx
push eax
call fcn.10053b90
add eax, 1
push ebx
push 2
adc edx, ebx
push edx
push eax
call fcn.10066ec0
add eax, esi
adc edx, edi
add eax, 1
adc edx, ebx
push edx
push eax
push 0x10007874
call fcn.1004faef
add esp, 0xc
push 2
pop edi
mov ecx, dword [0x108a7688]
mov eax, ecx
mov edx, dword [0x108a768c]
or eax, edx
jne 0x10041c91
add ecx, 0xffffffff
mov dword [0x108a7688], ecx
adc edx, 0xffffffff
mov dword [0x108a768c], edx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10041e9d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp dword [esp + 0x24c], 0
je 0x10041eb4
push dword [esp + 0x24c]
call fcn.1004fc57
pop ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0x1f0]
mov ecx, dword [esp + 0x3c4]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret