Function at 0x401de8
Capabilities:
Get common file path
Get file attributes
Resolve function by parsing pe exports
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x344
mov dword [esp + 4], 0x73eb905d
xor eax, eax
mov dword [esp + 0x14], 9
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x30], 0xb7228d
push ebx
mov dword [esp + 0x44], 0xcc41
mov dword [esp + 0x28], 0xc50133ec
push esi
mov dword [esp + 0x20], 0xe92
push edi
mov dword [esp + 0x44], edx
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x18], eax
jmp 0x401e52
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x10c], 0xeb606930
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x401e3f
mov ecx, dword [esp + 0x10c]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
inc dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
cmp ecx, edx
mov ecx, dword [esp + 0x110]
setg bl
xor edx, edx
cmp ebx, ecx
setge dl
xor ebx, ebx
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp ecx, edx
mov ecx, dword [esp + 0x10]
setl bl
xor edx, edx
cmp ecx, ebx
mov ecx, dword [esp + 0x3c]
setl dl
mov dword [esp + 0x20], edx
xor edx, edx
cmp dword [esp + 0x20], ecx
setne dl
xor edi, edi
mov dword [esp + 0x10c], edx
inc edi
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x38], edi
mov dword [esp + 0x18], eax
jmp 0x401eec
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x50], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x401ee0
mov dword [esp + 0x38], 0xa8eac8b1
mov dword [esp + 0x38], eax
jmp 0x401f40
mov byte [esp + 0x37], al
cmp byte [esp + 0x37], 0
je 0x401f23
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor eax, eax
mov byte [esp + 0x37], al
cmp byte [esp + 0x37], 0
je 0x401f3c
push 0x2222
push eax
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor eax, eax
inc dword [esp + 0x38]
cmp dword [esp + 0x38], eax
jle 0x401f00
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0xc0]
push edi
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x401f79
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xc0]
mov dword [ecx + edx*4], 0x5b57fd54
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x401f63
mov ecx, dword [esp + 0xc0]
mov dword [ecx], eax
mov dword [esp + 0x10], 0x9cc25fa
mov dword [esp + 0x20], 3
mov dword [esp + 0x18], eax
jmp 0x401fb1
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x314], 0x4adf2985
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x401f9e
mov ecx, dword [esp + 0xc0]
mov esi, dword [ecx]
mov edx, esi
mov ecx, dword [esp + 0x10]
sub edx, ecx
jne 0x401fe8
cmp dword [esp + 0x10], eax
mov esi, dword [esp + 0xc0]
jne 0x401fde
mov ecx, eax
cmp dword [esi], eax
je 0x401fe0
mov ecx, edi
mov esi, dword [esi]
cmp ecx, esi
mov ecx, eax
je 0x401fea
mov ecx, edi
xor edx, edx
cmp ecx, esi
setl dl
xor ecx, ecx
sub edx, 8
cmp edx, esi
setge cl
xor ebx, ebx
mov dword [esp + 0x20], ecx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp edx, ecx
setge bl
cmp dword [esp + 0x10], ebx
mov ecx, dword [esp + 0xc0]
jne 0x402021
mov edx, eax
cmp dword [ecx], eax
je 0x402023
mov edx, edi
inc dword [ecx]
cmp dword [ecx], 0x17
mov dword [esp + 0x318], edx
jl 0x401f88
lea ecx, [esp + 0xc0]
call fcn.004014ce
push 2
pop ebx
mov dword [esp + 0x40], 0x9d2e
lea ecx, [esp + 0x1f8]
push ebx
call fcn.004013fc
mov dword [esp + 0x3c], 0x925b0e44
mov dword [esp + 0x18], 0
jmp 0x40207d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1f8]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jl 0x40206b
mov byte [esp + 0x37], 0
cmp byte [esp + 0x37], 0
je 0x40209a
push 0x1336
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov eax, dword [esp + 0x1f8]
lea ecx, [esp + 0x1f8]
mov eax, dword [eax]
mov dword [esp + 0x3c], eax
call fcn.004014ce
push 3
pop esi
mov dword [esp + 0x20], 5
lea ecx, [esp + 0x1ec]
mov dword [esp + 0x10], 0xfffffffb
mov dword [esp + 0x3c], 0
push esi
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x4020f6
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x98], 0xfffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jl 0x4020e3
mov dword [esp + 0x14], eax
jmp 0x402115
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1ec]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x402102
mov dword [esp + 0x10], eax
xor edx, edx
mov ecx, dword [esp + 0x9c]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setge dl
cmp edx, 0xcec7
jne 0x402169
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x98]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub eax, 0xffff
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffffff6
jae 0x402169
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x9c]
mov eax, dword [esp + 0x1ec]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax + 4], ecx
lea ecx, [esp + 0x1ec]
call fcn.004014ce
mov dword [esp + 0x48], 0x616d21b1
mov dword [esp + 0x18], 0x76820624
mov dword [esp + 0x18], 0xfffffff9
jmp 0x4021c3
mov dword [esp + 0x3c], 0xfe1ca2
mov dword [esp + 0x20], 9
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x20], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe3
jne 0x4021a7
xor eax, eax
mov byte [esp + 0x37], al
cmp byte [esp + 0x37], al
je 0x4021e5
push 0x218b
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
xor eax, eax
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa75610]
lea ecx, [esp + 0x28c]
push ecx
lea ecx, [esp + 0x280]
mov dword [esp + 0xfc], eax
push ecx
push eax
lea ecx, [esp + 0x104]
mov dword [esp + 0x108], eax
movdqu xmmword [esp + 0x288], xmm0
mov dword [esp + 0x10c], eax
call fcn.0040191b
xor eax, eax
mov dword [esp + 0x18], 0x4e064826
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0x1d
jg 0x40230c
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa755e0]
lea ecx, [esp + 0x2bc]
push ecx
lea ecx, [esp + 0x2b0]
mov dword [esp + 0x144], eax
push ecx
push eax
lea ecx, [esp + 0x14c]
mov dword [esp + 0x150], eax
movdqu xmmword [esp + 0x2b8], xmm0
mov dword [esp + 0x154], eax
call fcn.0040191b
mov dword [esp + 0x30], 0x6d4f2887
mov dword [esp + 0x10], 7
mov dword [esp + 0x3c], 0
mov dword [esp + 0x30], esi
cmp dword [esp + 0x30], 0
jl 0x4022ee
mov dword [esp + 0x20], 0x245f
xor edx, edx
mov dword [esp + 0x10], 0x4fc2285f
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x3c]
cmp eax, 0x6b8d
mov eax, dword [esp + 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x10], ecx
dec dword [esp + 0x30]
jns 0x4022af
lea ecx, [esp + 0x13c]
call fcn.004014ce
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1d
push 0
pop eax
jle 0x402245
mov byte [esp + 0x37], al
cmp byte [esp + 0x37], 0
je 0x40231f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
xor eax, eax
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
cmp ecx, edx
setle bl
imul ecx, ebx, 0x7fc0
test ecx, ecx
je 0x40234c
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x48]
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0xf4]
mov dword [ecx + 4], edx
mov ecx, dword [esp + 0x24]
sub edx, ecx
je 0x40297a
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x198]
mov dword [esp + 0x10], 0xfffffffb
mov dword [esp + 0x3c], eax
push esi
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x4023c6
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0xa0], 0xfffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x4023b3
mov dword [esp + 0x14], eax
jmp 0x4023e6
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x198]
or dword [ecx + edx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x4023d3
mov dword [esp + 0x10], eax
xor edx, edx
mov ecx, dword [esp + 0xa4]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setge dl
cmp edx, 0xcec7
jne 0x40243a
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0xa4]
mov eax, dword [esp + 0xa0]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub eax, 0xffff
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffffff6
jae 0x40243a
mov eax, dword [esp + 0xa4]
mov ecx, dword [esp + 0xa4]
mov eax, dword [esp + 0x198]
dec ecx
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax + 4], ecx
lea ecx, [esp + 0x198]
call fcn.004014ce
dec dword [esp + 0x20]
lea ecx, [esp + 0x2f8]
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa755d0]
xor eax, eax
push ecx
lea ecx, [esp + 0x2f0]
mov dword [esp + 0x30], 0xd29be1d9
push ecx
push eax
lea ecx, [esp + 0x140]
mov dword [esp + 0x140], eax
movdqu xmmword [esp + 0x2f8], xmm0
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
call fcn.0040191b
xor eax, eax
mov dword [esp + 0x3c], 5
mov dword [esp + 0x14], eax
jmp 0x4024d3
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x7c], 0x648261f9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x4024c3
mov dword [esp + 0x14], eax
jmp 0x4024f2
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x1e0], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x4024df
mov dword [esp + 0x28], eax
jmp 0x40259d
mov dword [esp + 0x14], 0xf2887cf2
mov dword [esp + 0x3c], 0x7d8cf4c5
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 2
jg 0x402599
push edi
lea ecx, [esp + 0x164]
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x18], eax
jmp 0x402547
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x160]
mov dword [ecx + edx*4], 0x46c2e7cc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x402531
mov edx, dword [esp + 0x3c]
xor ebx, ebx
mov ecx, dword [esp + 0x14]
cmp ecx, edx
mov ecx, dword [esp + 0x14]
setl bl
cmp dword [esp + ecx*4 + 0x7c], ebx
je 0x40256e
mov edx, eax
cmp dword [esp + 0x14], eax
je 0x402570
mov edx, edi
mov ecx, dword [esp + 0x160]
cmp dword [esp + 0x84], eax
mov dword [ecx], edx
lea ecx, [esp + 0x160]
call fcn.004014ce
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x40251c
xor eax, eax
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jle 0x402501
cmp dword [esp + 0x28], eax
jne 0x4025b2
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x80]
mov dword [esp + 0x1e4], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x1e8]
cmp dword [esp + 0x80], ecx
jle 0x4025e3
mov edx, edi
cmp dword [esp + 0x1e4], eax
jne 0x4025e5
mov edx, eax
xor ecx, ecx
cmp edx, 0x4e20
setge cl
cmp ecx, dword [esp + 0x7c]
jne 0x402601
mov edx, edi
cmp dword [esp + 0x84], eax
je 0x402603
mov edx, eax
mov eax, dword [esp + 0x80]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x130]
setle cl
xor edx, edx
cmp ecx, dword [eax + 4]
mov eax, dword [esp + 0x7c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x84]
setg cl
xor edx, edx
cmp ecx, 0xffffffff
lea ecx, [esp + 0x130]
setle dl
sub edx, eax
mov dword [esp + 0x3c], edx
call fcn.004014ce
xor eax, eax
mov byte [esp + 0xf], al
mov dword [esp + 0x10], 0xb32a
mov dword [esp + 0x24], 0xfffffff6
mov dword [esp + 0x30], 0x779c
mov dword [esp + 0x14], 0xfffffff8
mov dword [esp + 0x1c], 0x7f39
mov dword [esp + 0x28], 0x36ae3d47
mov dword [esp + 0x18], eax
jmp 0x40269b
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x114], 0x1b5f7a0d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x402688
cmp dword [esp + 0x14], eax
jne 0x4026b1
jbe 0x4026b1
mov esi, eax
cmp dword [esp + 0x10], eax
je 0x4026b3
mov esi, edi
mov ecx, dword [esp + 0x10]
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x14]
cmp esi, ecx
setne dl
xor ebx, ebx
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
cmp ecx, edx
mov ecx, dword [esp + 0x10]
setge bl
xor edx, edx
cmp ebx, ecx
mov ecx, dword [esp + 0x10]
setne dl
xor ebx, ebx
sub edx, 0xa
cmp edx, ecx
setg bl
sub ebx, 0x4fd5
neg ebx
sbb ebx, ebx
inc ebx
imul ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x24]
sub edx, ecx
sub edx, ebx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [esp + 0x30]
cmp edx, 0x1f0ef2f3
setle cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
test ecx, ecx
setns dl
cmp edx, 8
je 0x402760
mov dword [esp + 0x24], edi
dec dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
add ecx, dword [esp + 0x30]
mov dword [esp + 0x114], ecx
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x24], ecx
jmp 0x4027c4
mov byte [esp + 0x37], al
cmp byte [esp + 0x37], al
je 0x402787
push 0x1e6
push 0x6d8
push 0x90c
push 0x2576
push eax
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor eax, eax
mov dword [esp + 0x14], eax
jmp 0x4027bd
mov dword [esp + 0x1c], eax
jmp 0x4027b3
mov dword [esp + 0x20], 0xb3395cc9
mov dword [esp + 0x28], eax
jmp 0x4027a9
dec dword [esp + 0x20]
inc dword [esp + 0x28]
cmp dword [esp + 0x28], eax
jle 0x4027a1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
je 0x402793
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x3b
jl 0x40278d
mov byte [esp + 0x37], al
cmp byte [esp + 0x37], 0
je 0x4027d5
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
cmp byte [esp + 0xf], 0
je 0x40307f
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x148]
mov dword [esp + 0x18], 0x7ab3921d
mov dword [esp + 0x14], 0x44455595
push edi
call fcn.004013fc
mov dword [esp + 0x20], 0xfffffff8
xor eax, eax
mov dword [esp + 0x4c], 0xa05132d7
mov dword [esp + 0x2c], eax
jmp 0x40282c
mov ecx, dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x16c], 0xa631
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 2
jl 0x402819
mov dword [esp + 0x2c], eax
jmp 0x40284c
mov ecx, dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x23c], 6
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 3
jl 0x402839
mov dword [esp + 0x2c], eax
jmp 0x40286f
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x148]
mov dword [ecx + edx*4], 7
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], edi
jl 0x402859
mov dword [esp + 0x2c], eax
jmp 0x40288e
mov ecx, dword [esp + 0x2c]
mov dword [esp + ecx*4 + 0x94], 0xffffffff
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], edi
jl 0x40287b
mov dword [esp + 0x28], eax
jmp 0x4028ef
mov dword [esp + 0x244], 0xfffffffe
mov dword [esp + 0x18], 0xfffffffe
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x14], eax
jmp 0x4028e5
mov dword [esp + 0x3c], 0x9e2a8d3a
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x4028dd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
xor eax, eax
mov ecx, dword [esp + 0x3c]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x4028bb
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jle 0x40289a
mov ecx, dword [esp + 0x28]
xor edx, edx
mov ecx, dword [esp + 0x148]
cmp dword [ecx], eax
setne dl
dec dword [esp + 0x94]
mov eax, dword [esp + 0x170]
mov eax, dword [esp + 0x16c]
xor eax, eax
cmp edx, 0xfffffffd
sete al
add eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x240]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x148]
imul ecx, dword [eax]
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x148]
call fcn.004014ce
xor eax, eax
push eax
push eax
push 0x174b
push eax
push 0x169c
push eax
push 0xf1a
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x40307f
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa75610]
mov dword [esp + 0x2c], 0xfffffff6
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x29c]
push ecx
lea ecx, [esp + 0x290]
mov dword [esp + 0x18], 0x9d2e
push ecx
mov dword [esp + 0x2c], 5
lea ecx, [esp + 0x130]
mov dword [esp + 0x3c], 0x616d21b1
push eax
movdqu xmmword [esp + 0x298], xmm0
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
call fcn.0040191b
mov eax, dword [esp + 0x28]
xor edx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
cmp eax, ecx
setle dl
imul eax, edx, 0x7fc0
test eax, eax
je 0x402a12
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x124]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x24]
sub ecx, eax
je 0x402a80
xor eax, eax
mov dword [esp + 0x20], eax
dec dword [esp + 0x20]
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x402a99
push eax
push eax
push 0x174b
push eax
push 0x169c
push eax
push 0xf1a
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x402a99
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x402a99
push 0x1e7
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x124]
call fcn.004014ce
mov dword [esp + 0x14], 0xf1fe
lea ecx, [esp + 0xa8]
mov dword [esp + 0x38], 0x20fe6e32
push edi
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x18], eax
jmp 0x402ae0
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0xa8]
mov dword [ecx + edx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x402ace
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x38], 0xf
cmp dword [esp + 0x38], 0xfffffff7
jl 0x402c16
mov dword [esp + 0x3c], 0xb363f9e9
mov dword [esp + 0x10], eax
cmp dword [esp + 0x3c], eax
jne 0x402c13
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], eax
jl 0x402c04
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xa8]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x10]
add eax, dword [ecx + edx*4]
je 0x402b5b
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
jmp 0x402bf8
mov dword [esp + 0x30], 0x6840eb44
lea ecx, [esp + 0x1b0]
push 2
call fcn.004013fc
mov dword [esp + 0x18], 0
jmp 0x402b8e
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1b0]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x402b7b
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xa8]
mov edx, dword [esp + 0x30]
add edx, dword [eax + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
cmp eax, dword [esp + 0x30]
je 0x402bcb
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x30]
cmp eax, dword [ecx + esi*4]
lea ecx, [esp + 0x1b0]
mov eax, dword [esp + 0x1b0]
setne dl
mov dword [eax + 4], edx
call fcn.004014ce
dec dword [esp + 0x14]
jns 0x402b25
xor eax, eax
dec dword [esp + 0x38]
cmp dword [esp + 0x38], 0xfffffff7
jge 0x402b01
push 3
pop esi
lea ecx, [esp + 0xa8]
call fcn.004014ce
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa75640]
lea ecx, [esp + 0x2ac]
xor eax, eax
push ecx
mov byte [esp + 0x3f], al
lea ecx, [esp + 0x2a0]
push ecx
mov dword [esp + 0x24], 0xfe6e3245
lea ecx, [esp + 0xe4]
mov dword [esp + 0x1c], 0x8373b2c
mov dword [esp + 0x3c], 0xfffffffe
push eax
movdqu xmmword [esp + 0x2a8], xmm0
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
call fcn.0040191b
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x402d34
mov ecx, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
cmp ecx, edi
setge dl
mov dword [esp + 0x18], edx
xor edx, edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xd8]
mov ecx, dword [ecx]
add ecx, 0x50635c16
cmp ecx, 0xe8f0
mov ecx, dword [esp + 0x30]
setne dl
neg edx
sub edx, 0x985b
neg edx
sbb edx, edx
inc edx
add ecx, edx
je 0x402d34
mov ecx, dword [esp + 0xd8]
cmp dword [ecx], eax
je 0x402d34
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x3c], 0xffffffff
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x18], eax
jne 0x402d1e
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0x3c], 0x5c5bb085
jmp 0x402d45
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x402d45
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea ecx, [esp + 0xd8]
call fcn.004014ce
cmp byte [esp + 0x37], 0
je 0x40307f
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa75600]
lea ecx, [esp + 0x2cc]
push ecx
xor eax, eax
mov dword [esp + 0x34], 0xfffffff9
lea ecx, [esp + 0x2c0]
mov dword [esp + 0x2c], 0xfffffff8
push ecx
mov dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x94]
mov dword [esp + 0x34], 0x25b0d6b1
push eax
movdqu xmmword [esp + 0x2c8], xmm0
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
call fcn.0040191b
xor eax, eax
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x14], eax
jmp 0x402de8
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x308], 0x38a8812e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x402dd5
mov dword [esp + 0x14], eax
jmp 0x402e07
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x320], 0x53ceb4b6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x402df4
cmp dword [esp + 0x2c], eax
je 0x402e1f
mov ecx, dword [esp + 0x2c]
mov edx, edi
mov ecx, dword [esp + 0x2c]
jmp 0x402e21
mov edx, eax
xor ecx, ecx
cmp edx, 0x9271
sete cl
sub ecx, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x2c]
je 0x402e7c
mov dword [esp + 0x20], 8
mov dword [esp + 0x3c], 0x69a3
mov ecx, dword [esp + 0x3c]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp edx, ecx
mov ecx, dword [esp + 0x20]
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
setl bl
sub ebx, 4
neg ebx
sbb ebx, ebx
inc ebx
add ebx, dword [esp + 0x24]
mov dword [esp + 0x28], ebx
jmp 0x402fdd
mov dword [esp + 0x18], 0xfffffffc
lea ecx, [esp + 0x154]
mov dword [esp + 0x20], eax
push esi
call fcn.004013fc
push 8
pop eax
mov dword [esp + 0x210], eax
mov dword [esp + 0x214], eax
mov dword [esp + 0x218], eax
mov dword [esp + 0x21c], eax
xor eax, eax
mov dword [esp + 0x3c], 4
mov dword [esp + 0x14], eax
jmp 0x402ed7
mov ecx, dword [esp + 0x14]
mov dword [esp + ecx*4 + 0x220], 0xf6c0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x402ec4
mov dword [esp + 0x14], eax
jmp 0x402efa
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x154]
mov dword [ecx + edx*4], 0xa655
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x402ee4
cmp dword [esp + 0x18], eax
je 0x402f0a
mov ecx, dword [esp + 0x18]
cmp dword [esp + 0x228], 0xf7c9
jle 0x402f1f
mov esi, eax
cmp dword [esp + 0x18], eax
je 0x402f21
mov esi, edi
mov ecx, dword [esp + 0x28]
xor edx, edx
cmp esi, ecx
setge dl
mov dword [esp + 0x20], edx
xor edx, edx
mov ecx, dword [esp + 0x228]
add ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x154]
mov esi, dword [ecx]
mov ecx, dword [esp + 0x88]
cmp esi, dword [ecx]
setle dl
xor ecx, ecx
cmp edx, esi
setne cl
xor edx, edx
cmp ecx, 0x7aac
sete dl
xor ecx, ecx
cmp edx, 0x18a3
setne cl
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x228]
mov ecx, dword [esp + 0x228]
cmp dword [esp + 0x10], eax
jne 0x402fa0
mov ecx, dword [esp + 0x88]
mov edx, eax
cmp dword [ecx], eax
je 0x402fa2
mov edx, edi
mov ecx, dword [esp + 0x154]
mov ecx, dword [ecx + 4]
imul ecx, edx
mov dword [esp + 0x214], ecx
mov dword [esp + 0x3c], ecx
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x402fcf
push 0x182e
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [esp + 0x154]
call fcn.004014ce
xor eax, eax
mov dword [esp + 0x28], 5
cmp dword [esp + 0x28], eax
je 0x40305f
mov edx, dword [esp + 0x28]
xor ebx, ebx
mov ecx, dword [esp + 0x88]
add edx, dword [ecx]
mov ecx, dword [esp + 0x30]
cmp edx, ecx
mov ecx, dword [esp + 0x88]
setg bl
mov ecx, dword [ecx]
inc ecx
cmp ecx, ebx
jle 0x403015
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
cmp ecx, dword [esp + 0x2c]
jge 0x403026
mov ecx, dword [esp + 0x308]
mov ecx, dword [esp + 0x10]
mov edx, edi
mov ecx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
sub edx, ecx
mov dword [esp + 0x28], edx
xor edx, edx
mov ecx, dword [esp + 0x28]
cmp ecx, 0x61002f44
mov ecx, dword [esp + 0x88]
setle dl
sub edx, dword [ecx + 4]
neg edx
sbb edx, edx
neg edx
sub edx, dword [ecx]
je 0x40305f
mov eax, edi
lea ecx, [esp + 0x88]
mov dword [esp + 0x328], eax
call fcn.004014ce
push 0x1e7
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0xf4]
call fcn.004014ce
mov dword [esp + 0x4c], 0xfffffff8
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x4030ae
push 0x1c78
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x4030c2
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push dword [esp + 0x5c]
lea eax, [esp + 0x5f]
push eax
push dword [esp + 0x4c]
push 0
push 0x1701
call fcn.004089c4
movdqa xmm0, xmmword [0xa75640]
lea ecx, [esp + 0x2fc]
add esp, 0x14
mov dword [esp + 0x18], 0xfe6e3245
xor eax, eax
mov dword [esp + 0x10], 0x8373b2c
mov dword [esp + 0x30], 0xfffffffe
movdqu xmmword [esp + 0x2d8], xmm0
mov dword [esp + 0xb4], eax
push dword [esp + 0x50]
mov dword [esp + 0xbc], eax
push ecx
lea ecx, [esp + 0x2e0]
mov dword [esp + 0xc4], eax
push ecx
push eax
lea ecx, [esp + 0xc4]
call fcn.0040191b
xor eax, eax
cmp dword [esp + 0x18], eax
je 0x4031ec
mov ecx, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
cmp ecx, edi
setge dl
mov dword [esp + 0x18], edx
xor edx, edx
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0xb4]
mov ecx, dword [ecx]
add ecx, 0x50635c16
cmp ecx, 0xe8f0
mov ecx, dword [esp + 0x30]
setne dl
neg edx
sub edx, 0x985b
neg edx
sbb edx, edx
inc edx
add ecx, edx
je 0x4031ec
mov ecx, dword [esp + 0xb4]
cmp dword [ecx], eax
je 0x4031ec
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x44], 0xffffffff
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x18], eax
jne 0x4031d6
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0x44], 0x5c5bb085
jmp 0x4031fd
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x4031fd
push eax
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea ecx, [esp + 0xb4]
call fcn.004014ce
push dword [esp + 0x50]
lea ecx, [esp + 0x30c]
mov dword [esp + 0x18], 0xf6af1124
push ecx
xor eax, eax
mov dword [esp + 0x68], 0xfffffffe
lea ecx, [esp + 0x300]
mov dword [esp + 0x70], eax
push ecx
xorps xmm0, xmm0
mov dword [esp + 0x78], eax
push eax
lea ecx, [esp + 0x78]
mov dword [esp + 0x80], eax
movdqu xmmword [esp + 0x308], xmm0
call fcn.0040191b
mov dword [esp + 0x28], 0xa47cdedf
xor eax, eax
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x38], eax
jmp 0x403299
mov dword [esp + 0x18], 3
mov dword [esp + 0x44], 0xfffffff9
mov dword [esp + 0x18], eax
jmp 0x40328e
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x44], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x16
je 0x403282
dec dword [esp + 0x38]
cmp dword [esp + 0x38], 0xfffffff7
jne 0x40326c
mov dword [esp + 0x24], 0x8b036c86
mov ecx, 0x2d5e48d3
mov dword [esp + 0x268], ecx
mov dword [esp + 0x26c], ecx
mov dword [esp + 0x270], ecx
mov dword [esp + 0x274], ecx
mov ecx, 0xf665683c
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xe8], ecx
mov dword [esp + 0xec], ecx
mov dword [esp + 0xf0], ecx
mov dword [esp + 0xec], eax
jmp 0x403324
cmp byte [esp + 0xf], 0
je 0x403308
push 0x11eb
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x40331d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
xor eax, eax
inc dword [esp + 0xec]
cmp dword [esp + 0xec], 3
mov byte [esp + 0xf], al
jle 0x4032f3
cmp byte [esp + 0xf], 0
je 0x403343
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor eax, eax
mov dword [esp + 0x4c], 0xffffffff
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 8
mov dword [esp + 0x14], 0xfffffffb
jmp 0x403418
mov dword [esp + 0x40], 0xfffffff8
mov dword [esp + 0x18], eax
jmp 0x403382
mov ecx, dword [esp + 0x18]
mov dword [esp + ecx*4 + 0x64], 0xfffffffd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x403372
cmp dword [esp + 0x14], eax
je 0x4033b2
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x64]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x64]
cmp dword [esp + 0x64], eax
je 0x4033f9
mov dword [esp + 0x44], eax
cmp dword [esp + 0x44], eax
je 0x4033ce
cmp dword [esp + 0x14], eax
jne 0x403423
jmp 0x403411
mov dword [esp + 0x40], eax
cmp dword [esp + 0x40], eax
jl 0x403411
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x4033f1
push eax
push 0x2c6
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
xor eax, eax
dec dword [esp + 0x40]
jns 0x4033d8
jmp 0x403411
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x403411
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
dec dword [esp + 0x14]
push 0
pop eax
cmp dword [esp + 0x14], 0xffffffe7
je 0x403364
mov dword [esp + 0x2c], 0xf43b7c7c
lea ecx, [esp + 0x204]
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x40], 4
mov dword [esp + 0x48], edi
mov dword [esp + 0x38], 0xed1d25bb
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x18], 0xf3b0639e
mov dword [esp + 0x14], 3
mov dword [esp + 0x1c], 6
push 2
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x2c], eax
jmp 0x403497
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x204]
mov dword [ecx + edx*4], 0x1f88
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 2
jl 0x403481
mov dword [esp + 0x2c], 0xfffffff7
jmp 0x403586
mov dword [esp + 0x30], 0xd6b65720
mov dword [esp + 0x24], 0x3b1dab55
mov dword [esp + 0x20], 0xffff
cmp dword [esp + 0x30], eax
jne 0x403508
cmp dword [esp + 0x2c], eax
jne 0x403508
dec dword [esp + 0x20]
xor ebx, ebx
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x2c]
cmp ecx, 0xfffffffe
mov ecx, dword [esp + 0x30]
setge bl
xor edx, edx
cmp ebx, ecx
setle dl
cmp dword [esp + 0x20], edx
jne 0x4034f8
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov esi, eax
mov ecx, dword [esp + 0x38]
cmp ecx, dword [esp + 0x10]
je 0x40350a
mov esi, edi
mov ecx, dword [esp + 0x1c]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x24]
setg dl
xor ebx, ebx
cmp edx, ecx
setg bl
sub ebx, dword [esp + 0x10]
mov ecx, dword [esp + 0x40]
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, ecx
jne 0x403539
mov edx, eax
cmp dword [esp + 0x24], eax
je 0x40353b
mov edx, edi
xor ecx, ecx
cmp edx, 0x40b319b
push 2
setl cl
cmp ecx, 0x8ba79672
pop edx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
sub edx, ecx
add edx, dword [esp + 0x30]
cmp edx, edi
jge 0x403570
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
mov ecx, dword [esp + 0x14]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
dec dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0xfffffff5
jne 0x4034ab
mov esi, 0xce086565
cmp dword [esp + 0x18], eax
je 0x40366c
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
cmp dword [esp + 0x48], ecx
je 0x4035b4
cmp dword [esp + 0x48], eax
je 0x4035bc
mov ecx, edi
cmp dword [esp + 0x38], eax
jne 0x4035be
mov ecx, eax
mov dword [esp + 0x48], ecx
mov ecx, dword [esp + 0x48]
sub ecx, 8
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], eax
jne 0x4035df
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0x48]
xor ebx, ebx
mov ecx, dword [esp + 0x10]
cmp edx, ecx
setl bl
add ebx, 0x68191e7b
cmp ebx, dword [esp + 0x1c]
jge 0x4035fe
mov ecx, dword [esp + 0x48]
mov ecx, dword [esp + 0x38]
mov ecx, dword [esp + 0x1c]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x40]
imul ecx, dword [esp + 0x1c]
cmp esi, ecx
mov ecx, dword [esp + 0x204]
sbb esi, esi
add esi, 0xffff3d96
neg esi
sbb esi, esi
inc esi
sub esi, dword [ecx + 4]
mov ecx, dword [esp + 0x40]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setl dl
xor ebx, ebx
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
cmp edx, ecx
setge bl
xor edx, edx
add ebx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x44]
cmp ebx, ecx
setg dl
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0x38]
mov ecx, edi
jmp 0x40366e
mov ecx, eax
mov dword [esp + 0x14], 0x242e
cmp dword [esp + 0x14], ecx
jle 0x403749
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x4036a6
push 0x21cd
push 0xcf1
push eax
push eax
push 0x1897
push 0x208d
call dword [sym.imp.USER32.dll_ToUnicode]
push 3
pop esi
lea ecx, [esp + 0x204]
call fcn.004014ce
mov dword [esp + 0x14], 0xfffffff2
cmp dword [esp + 0x14], 0x17
jne 0x4040ca
mov eax, dword [esp + 0x68]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x38], 0xfc07e17f
lea ecx, [esp + 0x1c8]
mov dword [esp + 0x40], 7
push 0xfffffffffffffff7
pop ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x24], 0x2d2c87a7
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0xf13e13a6
mov dword [esp + 0x30], 0x8fb0b44
mov dword [esp + 0x48], 0x58e92eda
mov dword [esp + 0x44], 0x6501874d
push esi
call fcn.004013fc
mov dword [esp + 0x5c], 5
mov dword [esp + 0x3c], 0x82e77e81
mov dword [esp + 0x18], 0xfffc
mov dword [esp + 0x44], ebx
mov dword [esp + 0x10], 0
jmp 0x403865
mov dword [esp + 0x20], 7
mov dword [esp + 0x30], 0xfffffff6
mov dword [esp + 0x24], 0x3aa5b3e5
push 3
mov dword [esp + 0x50], edi
mov dword [esp + 0x34], eax
pop esi
jmp 0x403781
mov ecx, dword [esp + 0x30]
mov dword [esp + ecx*4 + 0x254], 5
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x40376e
cmp dword [esp + 0x18], eax
je 0x403795
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x20]
xor ebx, ebx
mov ecx, dword [esp + 0x20]
cmp edx, ecx
mov ecx, dword [esp + 0x1c]
setne bl
xor edx, edx
cmp ebx, ecx
setl dl
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], eax
jne 0x4037c1
mov edx, eax
cmp dword [esp + 0x1c], eax
je 0x4037c3
mov edx, edi
mov ecx, dword [esp + 0x10]
add ecx, edx
mov edx, 0xfff9
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x254], ecx
lea edx, [ecx + 0x846]
mov ecx, dword [esp + 0x24]
cmp edx, ecx
mov ecx, dword [esp + 0x24]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, 0xc7f14991
setge dl
cmp ecx, edx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xa875637
setge dl
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], eax
je 0x403825
mov ecx, dword [esp + 0x254]
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x20], 2
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x403849
push eax
push eax
push 0x1d13
push eax
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
inc dword [esp + 0x20]
jmp 0x4036a9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x403852
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x40]
mov edx, 0xffff1ffb
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
sub edx, eax
add edx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, 0xcd21
mov eax, dword [esp + 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x40]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [esp + 0x30]
setge bl
xor ecx, ecx
cmp ebx, eax
setge cl
cmp ecx, dword [esp + 0x5c]
jl 0x4038d9
cmp dword [esp + 0x30], 0
je 0x4038d9
mov esi, edi
jmp 0x4038db
xor esi, esi
dec dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
add ecx, eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x1c8]
imul edx, ecx
mov dword [eax + 4], ecx
lea eax, [esi + 1]
mov ecx, dword [esp + 0x3c]
sub edx, eax
mov eax, dword [esp + 0x38]
neg edx
sbb edx, edx
inc edx
add eax, edx
add ecx, eax
imul ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x1c8]
call fcn.004014ce
mov dword [esp + 0x3c], 0xfa
xor eax, eax
mov dword [esp + 0x1c], 0x83c7730f
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], eax
jmp 0x40395b
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x54], 4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x40394b
mov dword [esp + 0x1c], eax
jmp 0x40397f
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x40397b
push eax
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor eax, eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x403967
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], eax
jl 0x403b62
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x2c], eax
jmp 0x403b4e
mov dword [esp + 0x38], 0xb5131d8b
xor ebx, ebx
mov dword [esp + 0x18], 0xffffffff
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + ecx*4 + 0x54]
mov ecx, dword [esp + 0x2c]
cmp edx, ecx
setge bl
neg ebx
mov dword [esp + 0x38], ebx
je 0x403b00
push edi
lea ecx, [esp + 0x184]
call fcn.004013fc
mov dword [esp + 0x20], 0x8036
mov dword [esp + 0x24], 0xf61949f
mov dword [esp + 0x10], 0
jmp 0x403a0d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x180]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x4039fa
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x403a25
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
cmp dword [esp + 0x2c], 0
jne 0x403a56
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x1c], 0xfff8
mov eax, dword [esp + 0x54]
sbb ecx, ecx
add eax, 2
inc ecx
add eax, ecx
jne 0x403a56
mov eax, dword [esp + 0x180]
cmp dword [eax], 0
jne 0x403a56
xor edx, edx
jmp 0x403a58
mov edx, edi
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, edx
setne cl
imul eax, ecx, 0x511b
sub eax, dword [esp + 0x20]
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x54]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + eax*4 + 0x54]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + eax*4 + 0x54]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + eax*4 + 0x54]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
setle dl
mov dword [esp + 0x18], edx
xor edx, edx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + eax*4 + 0x54]
mov eax, dword [esp + 0x18]
cmp eax, ecx
lea ecx, [esp + 0x180]
setne dl
mov dword [esp + 0x10], edx
call fcn.004014ce
xor eax, eax
jmp 0x403b4a
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jl 0x403b4a
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], eax
jl 0x403b44
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], eax
jl 0x403b3e
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x403b38
push eax
push 0x2174
push eax
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
xor eax, eax
dec dword [esp + 0x38]
jns 0x403b1e
dec dword [esp + 0x18]
jns 0x403b14
dec dword [esp + 0x10]
jns 0x403b0a
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], eax
jle 0x4039a4
dec dword [esp + 0x1c]
jns 0x403993
push 2
pop ebx
mov dword [esp + 0x44], edi
lea ecx, [esp + 0x18c]
push ebx
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x10], eax
jmp 0x403b90
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x18c]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x403b7e
mov ecx, dword [esp + 0x18c]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x18c]
call fcn.004014ce
push 5
pop esi
mov dword [esp + 0x44], esi
xor eax, eax
mov dword [esp + 0x1c], 0xbe1d925b
mov dword [esp + 0x10], eax
jmp 0x403bd6
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x260], 0x261f9c28
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jl 0x403bc3
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], eax
jl 0x403c34
mov dword [esp + 0x24], 9
mov ecx, dword [esp + 0x1c]
cmp dword [esp + ecx*4 + 0x260], eax
jne 0x403c34
mov dword [esp + 0x24], edi
cmp dword [esp + 0x24], eax
jl 0x403c2e
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x403c28
push 0xa38
push 0xf1b
push 0x1998
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
xor eax, eax
dec dword [esp + 0x24]
jns 0x403c05
dec dword [esp + 0x1c]
jns 0x403be6
mov dword [esp + 0x1c], 0xfffffff4
jmp 0x403c4e
mov dword [esp + 0x20], 0xfffc
inc dword [esp + 0x20]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe2
jne 0x403c3e
mov dword [esp + 0x44], 0xffffffff
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x38], 0xfc07e17f
mov dword [esp + 0x40], 7
push 0xfffffffffffffff7
pop ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x24], 0x2d2c87a7
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0xf13e13a6
mov dword [esp + 0x30], 0x8fb0b44
mov dword [esp + 0x48], 0x58e92eda
mov dword [esp + 0x44], 0x6501874d
push 3
call fcn.004013fc
mov dword [esp + 0x5c], esi
mov dword [esp + 0x1c], 0x82e77e81
mov dword [esp + 0x18], 0xfffc
mov dword [esp + 0x44], ebx
mov dword [esp + 0x10], 0
jmp 0x403ce3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1a4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x403cd0
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x40]
mov edx, 0xffff1ffb
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
sub edx, eax
add edx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, 0xcd21
mov eax, dword [esp + 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x40]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [esp + 0x30]
setge bl
xor ecx, ecx
cmp ebx, eax
setge cl
cmp ecx, dword [esp + 0x5c]
jl 0x403d58
cmp dword [esp + 0x30], 0
je 0x403d58
mov esi, edi
jmp 0x403d5a
xor esi, esi
dec dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x48]
add ecx, eax
mov edx, dword [esp + 0x38]
mov eax, dword [esp + 0x1a4]
imul edx, ecx
mov dword [eax + 4], ecx
lea eax, [esi + 1]
mov ecx, dword [esp + 0x1c]
sub edx, eax
mov eax, dword [esp + 0x38]
neg edx
sbb edx, edx
inc edx
add eax, edx
add ecx, eax
imul ecx, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x1a4]
call fcn.004014ce
mov dword [esp + 0x44], 0xa4e66596
xor eax, eax
push 3
mov dword [esp + 0x20], 0xca4f833f
mov dword [esp + 0x14], eax
pop esi
jmp 0x403dd8
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x344], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x403dc9
push 2
pop ebx
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], eax
jl 0x403e05
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x403dff
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor eax, eax
dec dword [esp + 0x1c]
jns 0x403deb
mov dword [esp + 0x1c], eax
jmp 0x403e37
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], 0
je 0x403e33
push eax
push 0x79a
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor eax, eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jle 0x403e0b
mov dword [esp + 0x44], 0x326874be
lea ecx, [esp + 0x230]
push 4
call fcn.004013fc
mov dword [esp + 0x10], 0xffffffff
xor eax, eax
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x24], 0xdc5336de
mov dword [esp + 0x1c], eax
jmp 0x403e89
xor eax, eax
push dword [esp + 0x50]
movdqa xmm0, xmmword [0xa755b0]
lea ecx, [esp + 0x2dc]
push ecx
lea ecx, [esp + 0x2d0]
mov dword [esp + 0x108], eax
push ecx
push eax
lea ecx, [esp + 0x110]
mov dword [esp + 0x114], eax
movdqu xmmword [esp + 0x2d8], xmm0
mov dword [esp + 0x118], eax
call fcn.0040191b
mov dword [esp + 0x10], 0
jmp 0x40412d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x74], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x40411d
mov dword [esp + 0x78], esi
cmp dword [esp + 0x78], 0
jl 0x40415a
mov eax, dword [esp + 0x78]
mov edx, dword [esp + 0x78]
mov ecx, dword [esp + 0x100]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x78]
jns 0x40413f
lea ecx, [esp + 0x100]
call fcn.004014ce
mov dword [esp + 0x14], 0x10
cmp dword [esp + 0x14], 0xfffffff5
jne 0x404325
mov ebx, dword [esp + 0x68]
xor eax, eax
mov dword [esp + 0x60], ebx
mov dword [esp + 0x1c], 6
mov dword [esp + 0x10], eax
jmp 0x4041a0
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0xcc], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x404191
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], esi
jg 0x404210
mov ecx, dword [esp + 0x68]
mov dword [esp + 0x20], 0xfffa
mov dword [esp + 0x4c], 0xd0e101ea
cmp dword [ecx], eax
jne 0x4041f4
mov ecx, dword [esp + 0xcc]
mov esi, eax
mov ecx, dword [esp + 0x14]
mov ecx, dword [esp + 0xcc]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov ecx, dword [esp + 0xd4]
imul ecx, dword [esp + 0x20]
test ecx, ecx
je 0x4041f6
mov esi, edi
mov edx, dword [esp + 0x28]
mov ecx, dword [esp + 0x68]
mov dword [ecx + edx*4], esi
mov dword [esp + 0x4c], esi
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jle 0x4041b0
mov ecx, dword [esp + 0x1c]
mov edx, 0xfffb
cmp edx, ecx
mov esi, 0x3123491
sbb ecx, ecx
xor edx, edx
neg ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
cmp ecx, 0xffffffff
mov dword [ebx + 8], esi
setge dl
xor ecx, ecx
cmp ecx, edx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [esp + 0xcc], ecx
mov ecx, dword [esp + 0x14]
cmp ecx, esi
setle dl
cmp edx, dword [esp + 0x1c]
je 0x4042f2
mov dword [esp + 0x10], 0xa113d7af
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], eax
jne 0x404274
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x68]
cmp dword [ecx], edx
jg 0x40428d
cmp dword [esp + 0xcc], eax
je 0x404295
mov esi, edi
cmp dword [esp + 0x1c], eax
jne 0x404297
mov esi, eax
mov ecx, dword [esp + 0x28]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x68]
setg dl
imul edx, dword [ebx + 8]
sub edx, dword [ecx + 0xc]
mov ecx, dword [esp + 0xcc]
neg edx
sbb edx, edx
xor ebx, ebx
inc edx
cmp edx, ecx
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x10]
setle bl
xor edx, edx
cmp ecx, ebx
mov ebx, dword [esp + 0x60]
mov ecx, dword [esp + 0x10]
setle dl
add edx, 0xf681
sub esi, edx
neg esi
sbb esi, esi
inc esi
mov dword [ebx + 8], esi
sub esi, ecx
sub esi, 9
mov dword [esp + 0x4c], esi
jmp 0x404313
mov dword [esp + 0x3c], 0xfffa
mov dword [esp + 0x1c], 0xa
jmp 0x40430c
inc dword [esp + 0x3c]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffd
jne 0x404304
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff5
push 3
pop esi
je 0x404183
lea ecx, [esp + 0x68]
call fcn.004014ce
mov dword [esp + 0x1c], 0xf43b7c7c
lea ecx, [esp + 0x174]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x40], 4
mov dword [esp + 0x18], edi
mov dword [esp + 0x38], 0xed1d25bb
mov dword [esp + 0x3c], 0xfffffffd
mov dword [esp + 0x48], 0xf3b0639e
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], 6
push 2
call fcn.004013fc
xor eax, eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x10], eax
jmp 0x40439e
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x174]
mov dword [ecx + edx*4], 0x1f88
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x404388
push 0xfffffffffffffff7
pop ebx
mov dword [esp + 0x1c], ebx
jmp 0x40448c
mov dword [esp + 0x10], 0xd6b65720
mov dword [esp + 0x24], 0x3b1dab55
mov dword [esp + 0x20], 0xffff
cmp dword [esp + 0x10], eax
jne 0x40440e
cmp dword [esp + 0x1c], eax
jne 0x40440e
dec dword [esp + 0x20]
xor ebx, ebx
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x1c]
cmp ecx, 0xfffffffe
mov ecx, dword [esp + 0x10]
setge bl
xor edx, edx
cmp ebx, ecx
setle dl
cmp dword [esp + 0x20], edx
jne 0x4043fe
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
mov esi, eax
mov ecx, dword [esp + 0x38]
cmp ecx, dword [esp + 0x30]
je 0x404410
mov esi, edi
mov ecx, dword [esp + 0x14]
xor edx, edx
cmp esi, ecx
mov ecx, dword [esp + 0x24]
setg dl
xor ebx, ebx
cmp edx, ecx
setg bl
sub ebx, dword [esp + 0x30]
mov ecx, dword [esp + 0x40]
neg ebx
sbb ebx, ebx
inc ebx
sub ebx, ecx
jne 0x40443f
mov edx, eax
cmp dword [esp + 0x24], eax
je 0x404441
mov edx, edi
xor ecx, ecx
cmp edx, 0x40b319b
push 2
setl cl
cmp ecx, 0x8ba79672
pop edx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
sub edx, ecx
add edx, dword [esp + 0x10]
cmp edx, edi
jge 0x404476
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x10]
mov ecx, dword [esp + 0x28]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x28], ecx
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff5
jne 0x4043b1
cmp dword [esp + 0x48], eax
je 0x404572
mov ecx, dword [esp + 0x40]
mov ecx, dword [esp + 0x38]
cmp dword [esp + 0x18], ecx
je 0x4044b5
cmp dword [esp + 0x18], eax
je 0x4044bd
mov ecx, edi
cmp dword [esp + 0x38], eax
jne 0x4044bf
mov ecx, eax
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
sub ecx, 8
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x48], ecx
cmp dword [esp + 0x48], eax
jne 0x4044e0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
xor ebx, ebx
mov ecx, dword [esp + 0x30]
cmp edx, ecx
setl bl
add ebx, 0x68191e7b
cmp ebx, dword [esp + 0x14]
jge 0x4044ff
mov ecx, dword [esp + 0x18]
mov ecx, dword [esp + 0x38]
mov edx, 0xce086565
mov ecx, dword [esp + 0x14]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x40]
imul ecx, dword [esp + 0x14]
cmp edx, ecx
mov ecx, dword [esp + 0x174]
sbb esi, esi
add esi, 0xffff3d96
neg esi
sbb esi, esi
inc esi
sub esi, dword [ecx + 4]
mov ecx, dword [esp + 0x40]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, ecx
setl dl
xor ebx, ebx
mov dword [esp + 0x40], edx
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
cmp edx, ecx
setge bl
xor edx, edx
add ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x4c]
cmp ebx, ecx
setg dl
mov dword [esp + 0x38], edx
mov ecx, dword [esp + 0x38]
mov ecx, edi
jmp 0x404574
mov ecx, eax
mov dword [esp + 0x28], 0x242e
cmp dword [esp + 0x28], ecx
jle 0x4045b1
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x4046b1
push 0x21cd
push 0xcf1
push eax
push eax
push 0x1897
push 0x208d
call dword [sym.imp.USER32.dll_ToUnicode]
jmp 0x4046b1
mov dword [esp + 0x20], 7
mov dword [esp + 0x3c], 0xfffffff6
mov dword [esp + 0x24], 0x3aa5b3e5
mov dword [esp + 0x4c], edi
mov dword [esp + 0x10], eax
jmp 0x4045e6
mov ecx, dword [esp + 0x10]
mov dword [esp + ecx*4 + 0x248], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x4045d3
cmp dword [esp + 0x48], eax
je 0x4045fb
mov ecx, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x20]
xor ebx, ebx
mov ecx, dword [esp + 0x20]
cmp edx, ecx
mov ecx, dword [esp + 0x14]
setne bl
xor edx, edx
cmp ebx, ecx
setl dl
mov dword [esp + 0x48], edx
cmp dword [esp + 0x48], eax
jne 0x404627
cmp dword [esp + 0x14], eax
jne 0x404627
mov edi, eax
mov ecx, dword [esp + 0x30]
mov edx, 0xfff9
add ecx, edi
cmp edx, ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x248], ecx
lea edx, [ecx + 0x846]
mov ecx, dword [esp + 0x24]
cmp edx, ecx
mov ecx, dword [esp + 0x24]
setg bl
xor edx, edx
cmp ebx, ecx
mov ecx, 0xc7f14991
setge dl
cmp ecx, edx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xa875637
setge dl
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], eax
je 0x404689
mov ecx, dword [esp + 0x248]
mov ecx, dword [esp + 0x1c]
mov dword [esp + 0x3c], 2
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x4046ad
push eax
push eax
push 0x1d13
push eax
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
inc dword [esp + 0x3c]
lea ecx, [esp + 0x174]
call fcn.004014ce
mov al, byte [esp + 0x5b]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret