Function at 0x1004a29b
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100867c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x258
push ebx
push esi
push edi
mov dword [esp + 0x8c], ecx
lea ecx, [esp + 0x118]
mov dword [esp + 0x2c], 0x507e
push 3
mov dword [esp + 0xd8], edx
call fcn.100289a7
mov dword [esp + 0x38], 5
xor ebx, ebx
mov dword [esp + 0x20], 0x68e1
mov dword [esp + 0x18], 0xe5aba8d6
mov dword [esp + 0x28], 0xa0b8914b
push 3
mov dword [esp + 0x2c], 0x2bac4117
mov dword [esp + 0x18], ebx
pop esi
jmp 0x1004a32c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 0x3cc92ea2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1004a316
mov dword [esp + 0x14], ebx
jmp 0x1004a348
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x64], 0xd88c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1004a338
cmp dword [esp + 0x2c], ebx
jne 0x1004a3f3
mov eax, dword [esp + 0x20]
dec dword [esp + 0x20]
test eax, eax
je 0x1004a3c7
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x118]
cmp dword [eax], ecx
setge dl
mov dword [esp + 0x28], edx
mov ecx, dword [esp + 0x28]
imul ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
test ecx, ecx
setg al
xor ecx, ecx
cmp eax, 4
mov eax, dword [esp + 0x64]
setg cl
sub ecx, 0x87d3
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov ecx, dword [esp + 0x2c]
neg eax
sbb eax, eax
add eax, 0xffff753f
add ecx, eax
cmp ecx, dword [esp + 0x18]
je 0x1004a3c7
xor ecx, ecx
inc ecx
jmp 0x1004a3c9
mov ecx, ebx
mov eax, dword [esp + 0x2c]
imul eax, ecx
cmp eax, 0xa82
jne 0x1004a3db
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x118]
mov eax, dword [esp + 0x38]
cmp dword [ecx + 8], eax
jl 0x1004a3f3
mov ecx, ebx
jmp 0x1004a3f6
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x64]
add ecx, 0xffff66b8
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
setge dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
lea ecx, [esp + 0x118]
setl dl
xor eax, eax
cmp edx, 0xffffffff
setg al
mov dword [esp + 0x28], eax
call fcn.10028a59
mov dword [esp + 0x20], 0x6d60
lea ecx, [esp + 0xbc]
push esi
call fcn.100289a7
push esi
lea ecx, [esp + 0xe0]
mov dword [esp + 0x270], ebx
call fcn.100289a7
mov byte [esp + 0x26c], 1
lea ecx, [esp + 0x100]
mov dword [esp + 0x18], 0x46bc2273
push 1
call fcn.100289a7
mov dword [esp + 0x2c], 0x9ed7d413
mov dword [esp + 0x34], 0x7557bc77
mov dword [esp + 0x28], 0x8f9
push 3
mov dword [esp + 0x3c], 5
mov dword [esp + 0x20], ebx
pop edx
jmp 0x1004a4b7
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xbc]
mov dword [eax + ecx*4], 0x451d52aa
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1004a4a1
xor edi, edi
mov dword [esp + 0x1c], ebx
inc edi
cmp dword [esp + 0x1c], edx
jge 0x1004a4de
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x1c]
jmp 0x1004a4c4
mov dword [esp + 0x1c], ebx
jmp 0x1004a4fa
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0x5c2f1fcc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1004a4e4
mov dword [esp + 0x1c], ebx
jmp 0x1004a519
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x140], 7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1004a506
cmp dword [esp + 0x20], ebx
jne 0x1004a568
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0xdc]
mov esi, dword [eax]
cmp edx, esi
mov eax, dword [esp + 0xdc]
mov edx, edi
cmovne edx, ebx
lea ecx, [esi + 1]
mov dword [eax], ecx
mov ecx, dword [esp + 0xbc]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x20]
mov eax, dword [ecx + 4]
mov ecx, ebx
imul eax, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
je 0x1004a56a
mov ecx, edi
mov esi, dword [esp + 0x100]
xor eax, eax
cmp ecx, 0x2845
setle al
xor ecx, ecx
cmp eax, dword [esi]
setne cl
xor edx, edx
cmp ecx, 0x6fa66fa4
setl dl
xor eax, eax
cmp edx, dword [esi]
mov edx, dword [esi]
setg al
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], edx
jne 0x1004a5b4
mov eax, dword [esp + 0xbc]
cmp dword [eax + 4], ebx
jne 0x1004a5b4
xor esi, esi
mov eax, ebx
inc esi
jmp 0x1004a5b9
xor esi, esi
inc esi
mov eax, esi
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
add eax, edx
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [esp + 0x140]
mov dword [esp + 0x34], ecx
je 0x1004a64c
mov dword [esp + 0x20], esi
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x2c], 0xef61160d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004a5ff
push 0x22ea
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [esp + 0x100]
cmp dword [eax], ebx
je 0x1004a612
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
xor ecx, ecx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp eax, 0x2012
mov eax, dword [esp + 0xbc]
setg cl
mov dword [eax + 4], ecx
jmp 0x1004a71c
push 4
mov dword [esp + 0x30], 0xed5a0a0d
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x1004a670
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x228], 0x71521f00
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1004a65d
mov dword [esp + 0x14], ebx
jmp 0x1004a68f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1fc], 0x97a0ede8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1004a67c
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004a6aa
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov eax, dword [esp + 0x234]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x144], 0xe4e98e2c
mov eax, dword [esp + 0x20]
sbb ecx, ecx
neg ecx
add eax, ecx
jne 0x1004a6d0
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x204]
xor edx, edx
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
cmp eax, ecx
setle dl
add edx, dword [esp + 0x28]
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x234]
mov eax, dword [esp + 0x2c]
add ecx, eax
mov eax, dword [esp + 0x208]
dec dword [esp + 0x28]
cmp ecx, eax
mov eax, esi
cmovg eax, ebx
mov dword [esp + 0x208], eax
lea ecx, [esp + 0x100]
call fcn.10028a59
lea ecx, [esp + 0xdc]
call fcn.10028a59
or dword [esp + 0x26c], 0xffffffff
lea ecx, [esp + 0xbc]
call fcn.10028a59
mov dword [esp + 0x28], 0xfcb50bf3
lea ecx, [esp + 0x20c]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0x7b051af7
mov dword [esp + 0x1c], 0x76f5020f
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x38], 0xb287
mov dword [esp + 0x2c], 0x3334
mov dword [esp + 0x30], 0xb4028481
mov dword [esp + 0x30], 0x67df2ddf
mov dword [esp + 0x30], 5
mov dword [esp + 0x30], 0x84cbf776
mov dword [esp + 0x30], 0x7e1289ed
push esi
call fcn.100289a7
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0x2efaadad
mov dword [esp + 0x18], 0x3d0097e4
mov dword [esp + 0x14], ebx
jmp 0x1004a7db
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x7c], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1004a7cf
mov dword [esp + 0x14], ebx
jmp 0x1004a7fe
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20c]
mov dword [eax + ecx*4], 3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1004a7e8
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x1c], ebx
jmp 0x1004a97b
mov dword [esp + 0x14], 0xa5ea964a
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x7c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
sub ecx, eax
mov eax, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
mov eax, dword [esp + eax*4 + 0x7c]
inc ecx
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x7c]
cmp eax, edx
mov eax, dword [esp + 0x1c]
setg cl
xor edx, edx
sub eax, ecx
imul ecx, eax, 0x40c1
mov eax, dword [esp + 0x38]
cmp ecx, eax
setg dl
imul edx, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
xor edx, edx
mov ecx, dword [esp + 0x88]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setg dl
cmp dword [esp + 0x24], edx
jge 0x1004a89c
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x7c]
cmp dword [esp + 0x20], ebx
mov byte [esp + 0x13], bl
je 0x1004a8f1
cmp byte [esp + 0x13], 0
je 0x1004a8c4
push ebx
push 0x1c52
push 0x249a
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov dword [esp + 0x14], 0xb
jmp 0x1004a8e8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004a8e4
push 0x6e2
call dword [sym.imp.USER32.dll_GetQueueStatus]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x23
jle 0x1004a8ce
jmp 0x1004a900
cmp byte [esp + 0x13], 0
je 0x1004a900
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 0x14], ebx
jmp 0x1004a970
mov dword [esp + 0x24], 3
cmp dword [esp + 0x24], ebx
jl 0x1004a96c
mov eax, dword [esp + 0x24]
mov eax, dword [esp + eax*4 + 0x7c]
cmp eax, dword [esp + 0x2c]
jg 0x1004a94f
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov edx, dword [esp + eax*4 + 0x7c]
mov eax, dword [esp + 0x1c]
sub edx, 2
mov eax, dword [esp + eax*4 + 0x7c]
cmp eax, edx
setle cl
cmp ecx, 0xfffffff8
ja 0x1004a94f
mov eax, dword [esp + 0x24]
cmp dword [esp + eax*4 + 0x7c], ebx
jne 0x1004a94f
mov eax, ebx
jmp 0x1004a952
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + eax*4 + 0x7c]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x7c], ecx
dec dword [esp + 0x24]
jns 0x1004a914
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x1004a906
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x1004a813
inc dword [esp + 0x18]
lea ecx, [esp + 0x20c]
call fcn.10028a59
mov dword [esp + 0x30], 0xffffffff
xor ecx, ecx
mov dword [esp + 0x28], 0xf0f5ebe
inc ecx
push 3
pop edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x1004a9d2
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3c], 0x244c3f4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1004a9c2
mov dword [esp + 0x14], ebx
jmp 0x1004a9f1
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1dc], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1004a9de
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], 0xffffffe8
jmp 0x1004ab06
mov dword [esp + 0x38], ecx
mov dword [esp + 0x20], 0xe9f81a77
mov dword [esp + 0x18], ebx
jmp 0x1004aa41
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x9c], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1004aa32
mov eax, dword [esp + 0xa0]
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x1e0]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
add eax, 0x4846e1d6
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x9c]
add eax, dword [esp + 0x20]
je 0x1004aac7
mov dword [esp + 0x38], 4
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1e0], eax
mov eax, dword [esp + 0xa0]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
jmp 0x1004aae6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004aae6
push 0x742
push 0x67a
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], ebx
jmp 0x1004aafc
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x3c], 0x654a1373
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jl 0x1004aaec
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0xffffffea
jge 0x1004aa20
mov dword [esp + 0x30], ecx
mov dword [esp + 0x30], 9
mov dword [esp + 0x30], ecx
push ecx
mov dword [esp + 0x34], 0x6e74e800
lea ecx, [esp + 0x1ac]
call fcn.100289a7
mov dword [esp + 0x14], ebx
jmp 0x1004ab52
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], 0x9f9b3198
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1004ab3c
mov dword [esp + 0x14], ebx
jmp 0x1004ab6f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x68], 0x8094a188
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1004ab5f
mov dword [esp + 0x6c], ebx
cmp dword [esp + 0x6c], ebx
jl 0x1004ab9b
mov eax, dword [esp + 0x6c]
mov edx, dword [esp + 0x6c]
mov ecx, dword [esp + 0x1a8]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x6c]
jns 0x1004ab80
lea ecx, [esp + 0x1a8]
call fcn.10028a59
push 3
lea ecx, [esp + 0x1d4]
call fcn.100289a7
mov dword [esp + 0x26c], 2
mov dword [esp + 0x14], 0x2e91a04
mov dword [esp + 0x38], 0xc857617
mov dword [esp + 0x14], ebx
jmp 0x1004ac68
push 1
lea ecx, [esp + 0x1b8]
call fcn.100289a7
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x1004ac0b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1b4]
mov dword [eax + ecx*4], 0x24f84b81
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1004abf5
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x1004ac58
mov dword [esp + 0x38], 9
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004ac40
push 0x105f
push ebx
push 0xa0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x1b4]
mov dword [eax + edx*4], ecx
dec dword [esp + 0x18]
jns 0x1004ac1c
lea ecx, [esp + 0x1b4]
call fcn.10028a59
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe5
je 0x1004abd9
mov dword [esp + 0x14], 0xfffffff4
jmp 0x1004ad61
push 3
lea ecx, [esp + 0x194]
call fcn.100289a7
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], ebx
jmp 0x1004acae
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0x88eb9876
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1004ac98
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004acc8
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x1004ad51
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], ebx
jne 0x1004acf8
mov ecx, ebx
jmp 0x1004acfb
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x190]
xor edx, edx
cmp ecx, dword [eax]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
setg dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [esp + 0x38], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004ad4b
push ebx
push 0x1708
push ebx
push 0x1335
push 0x2520
call dword [sym.imp.GDI32.dll_ExtCreatePen]
dec dword [esp + 0x18]
jns 0x1004acd6
lea ecx, [esp + 0x190]
call fcn.10028a59
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe3
jl 0x1004ac80
mov dword [esp + 0x38], 0xfffffff6
lea ecx, [esp + 0x16c]
push 2
call fcn.100289a7
mov dword [esp + 0x18], 0xfffffffc
mov dword [esp + 0x18], ebx
jmp 0x1004ada6
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0x571177e8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1004ad90
mov dword [esp + 0x18], ebx
jmp 0x1004adc7
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x16c]
cmp dword [eax + ecx*4], ebx
jne 0x1004adce
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x1004adb3
lea ecx, [esp + 0x16c]
call fcn.10028a59
push 3
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x1004adf6
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xe8], 7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1004ade3
mov dword [esp + 0x20], 0x57a55752
mov dword [esp + 0x1c], ebx
jmp 0x1004ae1d
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xa4], 0xd7f825e
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1004ae0a
mov dword [esp + 0x1c], ebx
jmp 0x1004ae39
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x5c], 0x87013dce
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1004ae29
mov dword [esp + 0x1c], ebx
jmp 0x1004ae52
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x70], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1004ae46
mov dword [esp + 0x60], 2
cmp dword [esp + 0x60], ebx
jl 0x1004aeb8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004ae7e
push ebx
push 0x1ec7
push ebx
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004aeb2
push 0x631
push 0x790
push 0x98f
push 0x2603
push 0x1866
push ebx
push ebx
push ebx
push ebx
call edi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
dec dword [esp + 0x60]
jns 0x1004ae66
mov dword [esp + 0x74], 2
cmp dword [esp + 0x74], ebx
jl 0x1004aff0
mov dword [esp + 0x1c], 0xd2ab60e7
mov dword [esp + 0x20], 0x5aba9a98
mov dword [esp + 0x1c], ebx
jmp 0x1004afce
mov eax, dword [esp + eax*4 + 0xa4]
xor ecx, ecx
mov eax, dword [esp + 0x74]
inc ecx
sub ecx, eax
xor edx, edx
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setg dl
sub edx, dword [esp + 0x1c]
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
add eax, 0x5721
jne 0x1004af1b
cmp dword [esp + 0x20], ebx
jne 0x1004af1b
mov ecx, ebx
jmp 0x1004af1e
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x1c]
xor edx, edx
cmp ecx, 0xe67e
setg dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x5c]
sub edx, eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0xa4]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x792891f4
setle al
sub eax, dword [esp + 0xa4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x74]
mov edx, dword [esp + eax*4 + 0xa4]
xor eax, eax
mov ecx, dword [esp + 0x20]
add ecx, 0xe769
imul ecx, dword [esp + 0x1c]
cmp edx, ecx
sete al
xor edx, edx
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x5c]
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x1c]
neg ecx
mov eax, dword [esp + eax*4 + 0x5c]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x5c]
cmp eax, edx
mov eax, dword [esp + 0x1c]
setle cl
xor edx, edx
cmp ecx, 0x59141a9
setge dl
mov dword [esp + eax*4 + 0x5c], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
mov eax, dword [esp + 0x74]
jle 0x1004aee3
cmp dword [esp + eax*4 + 0xa4], ebx
jne 0x1004aff0
dec dword [esp + 0x74]
jns 0x1004aeca
mov dword [esp + 0x14], ebx
jmp 0x1004b00c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1d0]
mov dword [eax + ecx*4], 0xecb302af
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004aff6
mov dword [esp + 0x28], 2
cmp dword [esp + 0x28], ebx
jl 0x1004b671
mov dword [esp + 0x30], 0xe864896e
mov dword [esp + 0x34], 1
mov dword [esp + 0x1c], 0xc0021fbb
mov dword [esp + 0x30], 0xfffb
mov dword [esp + 0x18], ebx
jmp 0x1004b05e
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x238], 0x585ed065
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1004b04b
mov dword [esp + 0x34], ebx
cmp dword [esp + 0x34], 2
jne 0x1004b2fc
mov dword [esp + 0x24], 0x2d149feb
lea ecx, [esp + 0xb0]
mov dword [esp + 0x14], 0xffffffff
push 3
call fcn.100289a7
mov byte [esp + 0x26c], 3
mov dword [esp + 0x30], ebx
mov dword [esp + 0x58], 0x479b69b2
mov dword [esp + 0x30], 0x73468807
mov dword [esp + 0x14], ebx
jmp 0x1004b0ca
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb0]
mov dword [eax + ecx*4], 0xe814b733
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1004b0b4
mov dword [esp + 0x14], ebx
jmp 0x1004b0e3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x54], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1004b0d7
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], 2
cmp dword [esp + 0x24], ebx
jl 0x1004b2d3
mov dword [esp + 0x4c], 0xffffffff
lea ecx, [esp + 0x10c]
mov dword [esp + 0x20], 0x47d1afd0
mov dword [esp + 0x4c], 0x70cadd63
push 2
call fcn.100289a7
mov dword [esp + 0x18], 0x1e69d086
mov dword [esp + 0x2c], ebx
jmp 0x1004b14e
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 2
jl 0x1004b138
dec dword [esp + 0x54]
xor edx, edx
mov edi, dword [esp + 0x54]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0xb0]
cmp dword [ecx + eax*4], 0xbf9a
setl dl
xor eax, eax
cmp dword [ecx + esi*4], edx
setg al
cmp eax, edi
je 0x1004b255
mov dword [esp + 0x4c], 0x982b
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x2c], 0xcab43068
mov dword [esp + 0x2c], ebx
jmp 0x1004b1b9
mov eax, dword [esp + 0x2c]
mov dword [esp + eax*4 + 0x250], 0xfffffffe
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 4
jl 0x1004b1a6
mov eax, dword [esp + 0x10c]
inc dword [eax]
jne 0x1004b23e
cmp dword [esp + 0x20], ebx
jne 0x1004b1d5
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x1c], 5
jle 0x1004b1e6
cmp dword [esp + 0x4c], ebx
jne 0x1004b1e6
xor edx, edx
inc edx
mov esi, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x14]
cmp edx, eax
mov eax, dword [esp + 0x54]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xb0]
setl dl
xor ecx, ecx
cmp dword [eax + esi*4], edx
mov eax, dword [esp + 0x58]
setle cl
mov dword [esp + 0x4c], ecx
xor ecx, ecx
cmp dword [esp + 0x4c], eax
setne cl
imul ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x20]
inc ecx
cmp ecx, 0xffae3c77
sbb ecx, ecx
inc ecx
sub eax, ecx
jne 0x1004b23e
xor edx, edx
inc edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xb0]
mov dword [eax + ecx*4], edx
mov dword [esp + 0x14], edx
jmp 0x1004b27d
mov esi, 0xc7e9a03a
mov dword [esp + 0x130], esi
mov dword [esp + 0x134], esi
mov dword [esp + 0x138], esi
mov dword [esp + 0x13c], esi
inc dword [esp + 0x138]
mov dword [esp + 0x18], 0xffffffe7
cmp dword [esp + 0x18], 0x33
je 0x1004b2bd
mov ecx, dword [esp + 0x10c]
mov eax, dword [ecx + 4]
mov dword [esp + 0x4c], 0xbff0
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x30], 0xfff9
mov dword [esp + 0x14], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x33
jne 0x1004b293
lea ecx, [esp + 0x10c]
call fcn.10028a59
dec dword [esp + 0x24]
jns 0x1004b104
lea ecx, [esp + 0xb0]
mov byte [esp + 0x26c], 2
call fcn.10028a59
inc dword [esp + 0x34]
cmp dword [esp + 0x34], 2
je 0x1004b074
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0xc407858f
mov dword [esp + 0x30], 0x24b5
mov dword [esp + 0x58], 3
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004b332
push 0xce1
call dword [sym.imp.USER32.dll_MessageBeep]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + eax*4 + 0xe8]
mov eax, dword [esp + 0x28]
imul ecx, dword [esp + eax*4 + 0xe8]
test ecx, ecx
jne 0x1004b398
mov eax, dword [esp + 0x28]
mov eax, dword [esp + eax*4 + 0xe8]
mov eax, dword [esp + 0x28]
xor ecx, ecx
push 2
mov eax, dword [esp + eax*4 + 0xec]
cmp eax, 0x71dfd947
sete cl
cmp ecx, 0xffffffff
lea ecx, [esp + 0x94]
sbb eax, eax
neg eax
imul eax, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x18], 0xe8cff0ea
mov dword [esp + 0x20], 0x8999d94b
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 0xfffffff7
call fcn.100289a7
mov byte [esp + 0x26c], 4
mov dword [esp + 0x34], 0x38140a97
mov dword [esp + 0x30], 0xa600
mov dword [esp + 0x18], ebx
jmp 0x1004b41f
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], 0x5741311e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1004b409
mov dword [esp + 0x14], ebx
jmp 0x1004b443
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004b43f
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnregisterClassA]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff7
je 0x1004b42c
cmp dword [esp + 0x14], ebx
jne 0x1004b4cc
cmp dword [esp + 0x1c], ebx
jne 0x1004b45a
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x24], ebx
jne 0x1004b4cc
mov dword [esp + 0x34], ebx
jmp 0x1004b49a
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x90]
cmp dword [eax + ecx*4], ebx
jne 0x1004b4a1
inc dword [esp + 0x34]
cmp dword [esp + 0x34], 1
jle 0x1004b486
mov dword [esp + 0x1c], ebx
jmp 0x1004b4c0
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x90]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jle 0x1004b4a7
jmp 0x1004b635
mov dword [esp + 0x18], 0x846b51f0
lea ecx, [esp + 0x19c]
mov dword [esp + 0x20], 0x336
push 1
call fcn.100289a7
xor edx, edx
mov dword [esp + 0x24], ebx
inc edx
jmp 0x1004b509
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], 0x9242039c
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jl 0x1004b4f3
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], ebx
jl 0x1004b58d
mov dword [esp + 0x14], 8
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x90]
mov eax, dword [esp + 0x90]
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [edx + esi*4], eax
mov eax, dword [esp + 0x18]
cmp eax, 0x2803
setge cl
imul ecx, dword [edx + esi*4]
test ecx, ecx
je 0x1004b55e
cmp dword [esp + 0x20], ebx
je 0x1004b55e
xor edx, edx
inc edx
jmp 0x1004b560
mov edx, ebx
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp edx, eax
setge cl
mov dword [esp + 0x14], ecx
dec dword [esp + 0x24]
jns 0x1004b519
mov ecx, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x18]
cmp ecx, eax
setne dl
mov dword [esp + 0x14], edx
xor edx, edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x20]
cmp esi, ecx
mov eax, dword [esp + 0x19c]
setg dl
mov dword [eax], esi
mov eax, dword [esp + 0x90]
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [esp + 0x18]
cmp edx, eax
setle cl
add ecx, dword [esp + 0x2c]
add ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
neg ecx
mov dword [esp + 0x58], ecx
xor ecx, ecx
cmp dword [esp + 0x58], eax
mov eax, dword [esp + 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [esp + 0x34]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
dec dword [esp + 0x34]
cmp eax, ecx
je 0x1004b623
xor eax, eax
inc eax
jmp 0x1004b625
mov eax, ebx
lea ecx, [esp + 0x19c]
mov dword [esp + 0x1c], eax
call fcn.10028a59
lea ecx, [esp + 0x90]
mov byte [esp + 0x26c], 2
call fcn.10028a59
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004b661
push ebx
push ebx
call edi
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
dec dword [esp + 0x28]
jns 0x1004b025
mov esi, dword [sym.imp.USER32.dll_GetDC]
push 4
lea ecx, [esp + 0x188]
call fcn.100289a7
mov byte [esp + 0x26c], 5
lea ecx, [esp + 0x148]
mov dword [esp + 0x28], 0x19d29be1
push 1
call fcn.100289a7
push 4
mov dword [esp + 0x20], ebx
pop edx
jmp 0x1004b6b8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1004b6a6
mov dword [esp + 0x1c], ebx
jmp 0x1004b6d7
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1e8], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1004b6c4
mov dword [esp + 0x1c], ebx
jmp 0x1004b6fa
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0xc01e
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x1004b6e4
push 3
mov dword [esp + 0x2c], ebx
pop ecx
jmp 0x1004b7ea
mov dword [esp + 0x18], 0x4e6d4f28
mov dword [esp + 0x30], 0xd5493e6
mov dword [esp + 0x30], 0x6a7f4ea1
mov dword [esp + 0x30], 0xfffffffa
mov dword [esp + 0x30], 0x13f5e3d1
mov dword [esp + 0x30], 0xcaea0a9f
mov dword [esp + 0x20], ebx
jmp 0x1004b756
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x244], 0x3703acb6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x1004b743
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
jl 0x1004b7dd
mov dword [esp + 0x20], ebx
jmp 0x1004b77f
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xc8], 0xba07e4fc
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x1004b76c
mov dword [esp + 0xcc], ebx
jmp 0x1004b7ce
mov dword [esp + 0x30], ebx
xor edx, edx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1ec], 0xffff0005
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x184]
push 3
cmp dword [eax + ecx*4], 0x3ddc
pop ecx
setge dl
mov dword [esp + 0x30], edx
mov eax, dword [esp + 0x18]
inc dword [esp + 0xcc]
cmp dword [esp + 0xcc], ecx
jle 0x1004b78e
dec dword [esp + 0x18]
jns 0x1004b766
mov eax, dword [esp + 0x148]
inc dword [eax]
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ecx
jle 0x1004b70d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1004b80e
push ebx
push ebx
push ebx
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
lea ecx, [esp + 0x148]
call fcn.10028a59
lea ecx, [esp + 0x184]
call fcn.10028a59
dec dword [esp + 0x38]
lea ecx, [esp + 0x1d0]
or dword [esp + 0x26c], 0xffffffff
call fcn.10028a59
mov dword [esp + 0x18], 0xfffffff8
mov dword [esp + 0x18], ebx
jmp 0x1004b8aa
push 1
lea ecx, [esp + 0x158]
call fcn.100289a7
mov dword [esp + 0x30], 8
mov dword [esp + 0x20], ebx
jmp 0x1004b87e
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 0xaa9ac70c
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x1004b868
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x154]
or dword [esp + 0x26c], 0xffffffff
mov dword [eax], 0xffffffe9
call fcn.10028a59
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffe
jge 0x1004b84c
xor ecx, ecx
mov dword [esp + 0x1c], 0xfb0b0297
inc ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x30], 0xb817
mov dword [esp + 0x20], ebx
jmp 0x1004b8de
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x40], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x1004b8ce
mov dword [esp + 0x1c], ebx
jmp 0x1004bacb