Function at 0x10044565
Capabilities:
Clear file content
Create thread
Enumerate gui resources
Get common file path
Get graphical window text
Resolve function by parsing pe exports
Set registry value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10084307
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
movdqa xmm0, xmmword [0x10007fe0]
lea eax, [esp + 0x1b8]
push ebx
push esi
push edi
mov dword [esp + 0x50], ecx
xor ebx, ebx
push dword [esp + 0x50]
lea ecx, [esp + 0xcc]
mov dword [esp + 0xc8], edx
push eax
lea eax, [esp + 0x1bc]
mov dword [esp + 0xd0], ebx
push eax
push ebx
movdqu xmmword [esp + 0x1c4], xmm0
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
call fcn.10028d1b
mov dword [esp + 0x224], ebx
lea ecx, [esp + 0x154]
xor edi, edi
mov dword [esp + 0x1c], 0x951e
inc edi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], 0x919c44d4
push edi
call fcn.10027b4a
mov dword [esp + 0x2c], 4
mov dword [esp + 0x34], ebx
jmp 0x1004462c
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 0x36572186
inc dword [esp + 0x34]
cmp dword [esp + 0x34], edi
jl 0x10044616
mov esi, dword [esp + 0xc8]
mov ecx, dword [esi + 4]
lea eax, [ecx - 1]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x1004464e
cmp dword [esp + 0x1c], ebx
jne 0x1004464e
mov edi, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
neg eax
cmp eax, 0x244c3f4
setle cl
neg ecx
jne 0x1004466c
cmp dword [esp + 0x1c], ebx
jne 0x1004466c
mov eax, ebx
jmp 0x1004466f
xor eax, eax
inc eax
mov dword [esp + 0x18], eax
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setge dl
xor ecx, ecx
imul edx, dword [esp + 0x1c]
cmp edi, edx
setl cl
xor eax, eax
add ecx, dword [esp + 0x1c]
cmp ecx, 0x39d20578
setl al
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
dec eax
cmp dword [esp + 0x24], eax
jne 0x100446bf
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
mov esi, 0xe1d67a3d
cmp ecx, eax
setg dl
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x154]
xor eax, eax
mov edx, dword [esp + 0x18]
cmp dword [ecx], ebx
mov edi, dword [ecx]
setg al
xor ecx, ecx
sub esi, eax
mov eax, dword [esp + 0x18]
add eax, esi
add edx, eax
cmp edx, edi
setg cl
xor eax, eax
cmp ecx, edi
lea ecx, [esp + 0x154]
setne al
mov dword [esp + 0x18], eax
call fcn.10027bfc
or dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0xc8]
call fcn.10027bfc
mov dword [esp + 0x1c], 0x1928c176
mov dword [esp + 0x10], 0x515466bc
mov dword [esp + 0x24], 0x18bd8502
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10044759
push 0x2595
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor edi, edi
mov dword [esp + 0x1c], 0x16
inc edi
cmp dword [esp + 0x1c], 0x19
jg 0x10044973
mov dword [esp + 0x18], 0xfc3938dd
lea ecx, [esp + 0x190]
mov dword [esp + 0x20], ebx
push 3
call fcn.10027b4a
push 3
lea ecx, [esp + 0x17c]
mov dword [esp + 0x228], edi
call fcn.10027b4a
push 3
mov dword [esp + 0x34], ebx
pop edx
jmp 0x100447bd
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0x105807c
inc dword [esp + 0x30]
cmp dword [esp + 0x30], edx
jl 0x100447a7
mov dword [esp + 0x30], ebx
jmp 0x100447df
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x30]
cmp dword [esp + 0x30], edx
jl 0x100447c9
cmp dword [esp + 0x18], ebx
je 0x1004484c
mov eax, dword [esp + 0x18]
mov ecx, 0x496e854a
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x18]
sub ecx, eax
add ecx, dword [esp + 0x10]
sub ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xef6e229e
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
mov edx, edi
setle cl
mov dword [esp + 0x48], ecx
xor ecx, ecx
cmp dword [esp + 0x48], eax
setg cl
cmp dword [esp + 0x1c], ecx
jge 0x1004484e
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 3
cmp eax, edi
jg 0x10044912
cmp dword [esp + 0x20], ebx
je 0x10044912
mov dword [esp + 0x20], 0x1d
jmp 0x1004489d
mov dword [esp + 0x48], 0x5d06
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x48], edi
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0x1c
jl 0x10044881
mov dword [esp + 0x20], ebx
jmp 0x10044907
mov dword [esp + 0x18], ebx
jmp 0x100448e8
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
jl 0x100448e4
mov esi, dword [esp + 0x178]
mov dword [esi + 8], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100448de
push 0x584
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 2
pop eax
dec dword [esp + 0x10]
jns 0x100448c1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x100448b0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x190]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x20]
push 2
pop eax
cmp dword [esp + 0x20], eax
jle 0x100448aa
jmp 0x1004494a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10044929
push 0x1f58
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1004494a
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
lea ecx, [esp + 0x178]
call fcn.10027bfc
or dword [esp + 0x224], 0xffffffff
lea ecx, [esp + 0x190]
call fcn.10027bfc
inc dword [esp + 0x1c]
jmp 0x10044764
push dword [esp + 0x50]
movdqa xmm0, xmmword [0x10008010]
lea eax, [esp + 0x1d8]
push eax
lea eax, [esp + 0x1cc]
mov dword [esp + 0x3c], 0xffffffff
push eax
mov dword [esp + 0x30], 0x25062d7b
lea ecx, [esp + 0x9c]
push ebx
movdqu xmmword [esp + 0x1d4], xmm0
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
call fcn.10028d1b
mov dword [esp + 0x10], 6
mov dword [esp + 0x38], 0x3fa75c1
mov dword [esp + 0x10], ebx
jmp 0x100449f2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100449e0
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10044a0b
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
lea ecx, [esp + 0x90]
call fcn.10027bfc
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0x13c]
mov dword [esp + 0x38], 0xfce06dfe
push edi
call fcn.10027b4a
mov dword [esp + 0x10], 0x5ccc90a3
mov dword [esp + 0x34], ebx
jmp 0x10044a54
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0x5dcec3d7
inc dword [esp + 0x34]
cmp dword [esp + 0x34], edi
jl 0x10044a3e
mov dword [esp + 0x10], ebx
jmp 0x10044a86
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], ebx
cmp dword [esp + 0x34], ebx
jl 0x10044a82
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], edi
dec dword [esp + 0x34]
jns 0x10044a6e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10044a60
lea ecx, [esp + 0x13c]
call fcn.10027bfc
mov dword [esp + 0x38], edi
mov dword [esp + 0x48], 0x5f5dda30
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x34], 0xfffffff3
jg 0x10045d62
push 7
pop esi
mov dword [esp + 0x30], 0x888a
lea ecx, [esp + 0x148]
push 4
call fcn.10027b4a
mov dword [esp + 0x224], 2
xor edx, edx
mov dword [esp + 0x10], 0xffff
mov dword [esp + 0x24], 0xfffd
mov dword [esp + 0x18], edi
mov dword [esp + 0x2c], 9
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setge dl
imul edx, dword [esp + 0x24]
test edx, edx
je 0x10044cb7
mov dword [esp + 0x2c], 0xd2964071
mov dword [esp + 0x1c], ebx
jmp 0x10044b3d
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x44], 0x9884cb8f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10044b2d
cmp dword [esp + 0x44], ebx
je 0x10044b5d
mov eax, dword [esp + 0x44]
xor ecx, ecx
cmp eax, edi
setge cl
mov dword [esp + 0x44], ecx
jmp 0x10044cc8
push edi
lea ecx, [esp + 0xa0]
call fcn.10027b4a
mov byte [esp + 0x224], 3
lea eax, [esp + 0x1f4]
push dword [esp + 0x50]
movdqa xmm0, xmmword [0x100080c0]
lea ecx, [esp + 0xd8]
push eax
lea eax, [esp + 0x1ec]
mov dword [esp + 0x34], 0x27720104
push eax
push ebx
movdqu xmmword [esp + 0x1f4], xmm0
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
call fcn.10028d1b
mov dword [esp + 0x20], 0x3709e8e5
mov dword [esp + 0x1c], ebx
jmp 0x10044be5
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], 0x44f4
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10044bcf
mov eax, dword [esp + 0x9c]
cmp dword [eax], ebx
je 0x10044c21
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x9c]
cmp dword [eax], ebx
je 0x10044c21
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x9c]
setne dl
add edx, dword [eax]
mov edx, edi
jne 0x10044c23
mov edx, ebx
mov eax, dword [esp + 0x44]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xd4]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setg dl
mov dword [esp + 0x44], edx
test edx, edx
je 0x10044c63
mov eax, edi
cmp dword [esp + 0x10], ebx
jne 0x10044c65
mov eax, ebx
xor edx, edx
cmp eax, 0xffffffff
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
sub edx, 0xd734
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xd9d6
lea ecx, [esp + 0xd4]
setle al
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
call fcn.10027bfc
lea ecx, [esp + 0x9c]
mov byte [esp + 0x224], 2
call fcn.10027bfc
jmp 0x10044cc8
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10044cc8
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov dword [esp + 0x24], 0xe3bc4aee
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], ebx
jmp 0x10044ce9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1f4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10044cda
mov dword [esp + 0x1c], 0x15
jmp 0x10044d49
mov dword [esp + 0x10], 9
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10044d25
push 0x1c0b
push ebx
push 0x24f8
push 0x18d
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [esp + 0x10], ebx
jmp 0x10044d3e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1f4], 0x7a888ada
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10044d2b
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe3
jne 0x10044cfa
push ebx
push 0x7d73
lea eax, [esp + 0xbc]
mov dword [esp + 0x40], 0xc0e42606
push eax
lea eax, [esp + 0x154]
push 0x36ba
push eax
call fcn.10048db8
add esp, 0x14
mov dword [esp + 0x20], 0xb3ae3556
lea ecx, [esp + 0xb8]
push 3
call fcn.10027b4a
mov byte [esp + 0x224], 4
mov dword [esp + 0x38], 0xd0d8167e
mov dword [esp + 0x10], ebx
jmp 0x10044dbd
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], 0x3111738a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10044da7
mov dword [esp + 0x20], ebx
jmp 0x10044df8
mov dword [esp + 0x24], esi
cmp dword [esp + 0x24], ebx
jne 0x10044dff
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10044df4
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff9
je 0x10044dca
mov dword [esp + 0x20], 2
cmp dword [esp + 0x20], ebx
jl 0x1004501e
push dword [esp + 0xb4]
movdqa xmm0, xmmword [0x100080b0]
lea eax, [esp + 0x1e8]
push eax
lea eax, [esp + 0x1dc]
mov dword [esp + 0x20], 0x3f7bf48c
push eax
push ebx
lea ecx, [esp + 0xb8]
mov dword [esp + 0xb8], ebx
movdqu xmmword [esp + 0x1e4], xmm0
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
call fcn.10028d1b
mov dword [esp + 0x10], edi
mov dword [esp + 0x10], 0xa83acdd7
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 2
jg 0x10045008
mov edi, dword [esp + 0xb8]
mov esi, dword [esp + 0xa8]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], 0x13072c02
mov dword [esp + 0x10], ebx
jmp 0x10044eb1
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x11c], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10044e9e
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp dword [edi + 4], 1
mov eax, dword [esp + 0x1c]
setne cl
sub ecx, eax
sub ecx, 0x680a2560
mov dword [esp + 0x11c], ecx
cmp dword [esi + 0xc], ebx
jne 0x10044f0d
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov eax, dword [esi + 0xc]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xb8]
push 0
cmp eax, dword [ecx + edx*4]
mov eax, dword [esp + 0x24]
pop edx
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, 6
setg al
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xb8]
cmp dword [eax + ecx*4], ebx
je 0x10044fd6
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10044fb6
push 0x217b
push ebx
push 0x1b56
push 0x512
push 0x231d
push ebx
push 0x12f8
push 0x16ea
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10044ff6
push 0x148b
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10044ff6
mov dword [esp + 0x10], ebx
jmp 0x10044fef
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x11c], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10044fdc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10044e8c
xor edi, edi
inc edi
lea ecx, [esp + 0xa8]
call fcn.10027bfc
dec dword [esp + 0x20]
jns 0x10044e11
lea ecx, [esp + 0xb8]
mov byte [esp + 0x224], 2
call fcn.10027bfc
push edi
lea ecx, [esp + 0x104]
call fcn.10027b4a
mov byte [esp + 0x224], 5
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 9
mov dword [esp + 0x38], 0x6de6eab3
mov dword [esp + 0x10], ebx
jmp 0x1004507b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0x99ac7894
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10045065
mov dword [esp + 0x10], ebx
jmp 0x100451b0
mov dword [esp + 0x2c], 0xcf456574
lea ecx, [esp + 0x160]
push 4
call fcn.10027b4a
push 4
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x100450bc
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xf0], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100450a9
mov dword [esp + 0x18], ebx
jmp 0x100450da
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100450c8
mov dword [esp + 0xfc], ebx
cmp dword [esp + 0xfc], ebx
jl 0x1004512d
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10045108
push ebx
push 0x20b8
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10045124
push 0xad1
push 0x1b9
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualFree]
dec dword [esp + 0xfc]
jns 0x100450f0
mov dword [esp + 0xfc], edi
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x100]
mov edx, dword [esp + 0x100]
mov eax, dword [eax + ecx*4]
mov dword [edx + esi*4], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0xfc], edi
mov ecx, dword [esp + 0x2c]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x5ab06c0e
setle al
xor ecx, ecx
cmp eax, 0xcf04
setge cl
xor eax, eax
cmp ecx, 0x6eed
setl al
cmp dword [esp + 0x10], eax
je 0x10045192
mov eax, dword [esp + 0xf8]
mov eax, dword [esp + 0x160]
lea ecx, [esp + 0x160]
mov eax, dword [eax + 8]
mov dword [esp + 0x24], eax
call fcn.10027bfc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1004508a
lea ecx, [esp + 0x100]
mov byte [esp + 0x224], 2
call fcn.10027bfc
mov eax, dword [esp + 0x30]
cmp eax, dword [esp + 0x34]
je 0x10045750
mov dword [esp + 0x3c], 0x105a
push 7
mov dword [esp + 0x24], 0x96dd1e1e
pop esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x10], ebx
jmp 0x10045205
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x4c], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100451f9
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x10045292
mov dword [esp + 0x10], 3
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x1004528c
mov dword [esp + 0x24], 0x38367457
mov dword [esp + 0x2c], 0x98963ec5
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x4c], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x4c]
mov ecx, dword [esp + 0x24]
sub ecx, eax
sub ecx, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
cmp eax, 0xfffffffd
setne cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x20]
dec dword [esp + 0x10]
jns 0x10045227
dec dword [esp + 0x20]
jns 0x10045215
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x30], 0xfffffff5
jmp 0x10045740
mov dword [esp + 0x1c], 0x4b7834d8
mov dword [esp + 0x24], ebx
mov dword [esp + 0x38], 0x58382bdb
mov dword [esp + 0x10], ebx
jmp 0x10045301
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x200], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x100452ee
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10045322
push ebx
push ebx
push 0xb60
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push 2
pop eax
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ebx
jl 0x1004546b
mov dword [esp + 0x20], esi
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10045351
push 0x1f76
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 2
pop eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jl 0x10045461
mov dword [esp + 0x18], 0xc23afc37
mov dword [esp + 0x18], ebx
jmp 0x1004544d
mov dword [esp + 0x2c], 0xb6d0374c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10045392
push ebx
push 0xf0b
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 2
pop eax
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], ebx
jl 0x10045449
mov dword [esp + 0x1c], 8
mov dword [esp + 0x1c], ebx
jmp 0x100453cc
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100453c8
push 0x149
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
push 2
pop eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x100453ae
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
jl 0x1004543f
mov eax, 0xe75d
mov dword [esp + 0x10], 0xcc48b164
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 3
jge 0x1004542f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x200], 0x2c9ebf49
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10045410
mov eax, 0xe75d
inc dword [esp + 0x114]
dec dword [esp + 0x1c]
jns 0x100453e1
push 2
pop eax
dec dword [esp + 0x2c]
jns 0x100453a0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x10045370
dec dword [esp + 0x20]
jns 0x1004535f
dec dword [esp + 0x24]
jns 0x10045333
mov dword [esp + 0x1c], ebx
jmp 0x1004562c
mov byte [esp + 0x2b], bl
lea ecx, [esp + 0x1a8]
push edi
call fcn.10027b4a
mov dword [esp + 0x10], ebx
jmp 0x1004549d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1004548b
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100454b6
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100454ca
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
lea ecx, [esp + 0x1a8]
call fcn.10027bfc
cmp byte [esp + 0x2b], 0
je 0x10045618
mov dword [esp + 0x18], 0xa48bbca6
mov dword [esp + 0x18], 3
jmp 0x100455e1
push edi
lea ecx, [esp + 0x5c]
call fcn.10027b4a
mov dword [esp + 0x10], 0xf6085e07
mov dword [esp + 0x24], 0x9031ea06
mov dword [esp + 0x20], ebx
jmp 0x10045529
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x58]
mov dword [eax + ecx*4], 0x82f80c34
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10045516
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp ecx, eax
setne dl
cmp edx, dword [esp + 0x10]
jl 0x10045554
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x58]
cmp dword [ecx], eax
jge 0x10045558
mov eax, ebx
jmp 0x1004555a
mov ecx, dword [esp + 0x58]
mov eax, edi
add eax, 0xffffd286
cmp dword [ecx], eax
jle 0x1004556b
mov eax, ebx
cmp dword [esp + 0x10], ebx
je 0x1004556d
mov eax, edi
cmp eax, dword [esp + 0x10]
jle 0x1004557d
mov eax, dword [esp + 0x58]
mov ecx, edi
cmp dword [eax], ebx
jne 0x1004557f
mov ecx, ebx
mov eax, dword [esp + 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setl cl
xor edx, edx
imul ecx, ecx, 0x13bf
cmp ecx, eax
setne dl
cmp edx, 0x6b37990
jl 0x100455b6
mov ecx, ebx
cmp dword [esp + 0x18], ebx
je 0x100455b8
mov ecx, edi
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x18], ebx
mov dword [eax], ecx
mov eax, dword [esp + 0x58]
mov eax, dword [eax]
je 0x100455d0
mov dword [esp + 0x10], eax
jmp 0x100455d4
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x58]
call fcn.10027bfc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x16
jne 0x100454f6
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x1004560b
push ebx
push 0x184d
push ebx
push ebx
push 0x20f5
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x104c
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x148]
cmp dword [eax + ecx*4], ebx
jne 0x10045637
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x10045474
mov dword [esp + 0x10], 0xf8067e30
lea ecx, [esp + 0x16c]
mov dword [esp + 0x24], ebx
push 3
call fcn.10027b4a
mov dword [esp + 0x18], ebx
jmp 0x1004566d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0x60d2f38d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10045657
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x10045686
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor edx, edx
mov dword [esp + 0x24], 0x9ec4279c
mov eax, dword [esp + 0x10]
cmp eax, edi
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
add edx, 4
cmp eax, edx
mov eax, dword [esp + 0x10]
setg cl
xor edx, edx
cmp ecx, eax
setg dl
mov dword [esp + 0x2c], edx
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, dword [esp + 0x2c]
lea ecx, [esp + 0x16c]
setne dl
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x16c]
mov dword [eax + 8], edx
call fcn.10027bfc
mov dword [esp + 0x24], 0xc6076fda
cmp dword [esp + 0x24], ebx
je 0x10045715
mov eax, dword [esp + 0x1c]
sub eax, 0x15fb
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x1c]
mov eax, edi
jl 0x10045717
mov eax, ebx
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x3c]
sete cl
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
cmp eax, edx
setl cl
mov dword [esp + 0x24], ecx
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xffffffe5
jg 0x100452d4
jmp 0x10045c09
mov dword [esp + 0x10], 0xf8067e30
lea ecx, [esp + 0x124]
mov dword [esp + 0x24], ebx
push 3
call fcn.10027b4a
mov dword [esp + 0x1c], ebx
jmp 0x10045786
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], 0x60d2f38d
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x10045770
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x1004579f
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor edx, edx
mov dword [esp + 0x24], 0x9ec4279c
mov eax, dword [esp + 0x10]
cmp eax, edi
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
add edx, 4
cmp eax, edx
mov eax, dword [esp + 0x10]
setg cl
xor edx, edx
cmp ecx, eax
setg dl
mov dword [esp + 0x3c], edx
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, dword [esp + 0x3c]
lea ecx, [esp + 0x124]
setne dl
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x124]
mov dword [eax + 8], edx
call fcn.10027bfc
mov dword [esp + 0x38], edi
lea ecx, [esp + 0x184]
push 2
call fcn.10027b4a
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10045840
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1004582a
mov eax, dword [esp + 0x184]
lea ecx, [esp + 0x184]
mov dword [eax + 4], ebx
call fcn.10027bfc
mov dword [esp + 0x10], ebx
jmp 0x10045876
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20c], 0xefec
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10045863
mov dword [esp + 0x10], 0xd5e48d32
lea ecx, [esp + 0x19c]
mov dword [esp + 0x3c], ebx
push edi
call fcn.10027b4a
mov byte [esp + 0x224], 6
lea ecx, [esp + 0x130]
push 7
pop esi
mov dword [esp + 0x38], 0xfffffffc
mov dword [esp + 0x38], esi
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x38], 0xffffffff
push edi
call fcn.10027b4a
mov dword [esp + 0x18], ebx
jmp 0x100458e6
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], 0x194ddbc3
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x100458d0
mov dword [esp + 0x18], ebx
jmp 0x10045908
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x100458f2
mov dword [esp + 0x10], 0xe
jmp 0x1004592c
mov dword [esp + 0x3c], 0xffff
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x3c], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 9
jne 0x10045918
mov eax, dword [esp + 0x130]
lea ecx, [esp + 0x130]
dec dword [eax]
call fcn.10027bfc
lea ecx, [esp + 0x19c]
mov byte [esp + 0x224], 2
call fcn.10027bfc
push 0x6393
lea eax, [esp + 0x47]
mov byte [esp + 0x47], bl
push eax
push 0x22e7
push 0x896
push ebx
call fcn.10046738
add esp, 0x14
mov ecx, 0x8ed4a55f
push 2
pop eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], 0xe2bbef7d
mov dword [esp + 0x3c], 0x21f1
mov dword [esp + 0x1c], 0x890c5440
mov dword [esp + 0xe0], ecx
mov dword [esp + 0xe4], ecx
mov dword [esp + 0xe8], ecx
mov dword [esp + 0xec], ecx
lea ecx, [esp + 0x64]
mov dword [esp + 0x20], ebx
push eax
call fcn.10027b4a
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], edi
push 2
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x100459f3
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x88], 0x1145714f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100459e0
mov dword [esp + 0x18], ebx
jmp 0x10045a12
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], 0x4eb0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100459ff
xor edx, edx
mov dword [esp + 0x2c], ebx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp ecx, eax
setl dl
cmp edx, 0xfffc
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x3c]
test eax, eax
setg cl
cmp edx, ecx
jge 0x10045a7f
mov dword [esp + 0x24], 0xffff
mov dword [esp + 0x3c], 0xfffffff9
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x88]
dec dword [esp + 0x88]
dec dword [esp + 0x24]
cmp ecx, eax
mov eax, edi
cmovle eax, ebx
mov dword [esp + 0x3c], eax
jmp 0x10045bfc
mov dword [esp + 0x10], 0xdd48
mov dword [esp + 0x24], 0x336a
mov dword [esp + 0x3c], 0xffff
mov eax, dword [esp + 0x88]
cmp dword [esp + 0x24], ebx
je 0x10045aac
mov ecx, edi
cmp dword [esp + 0x10], ebx
jne 0x10045aae
mov ecx, ebx
mov eax, dword [esp + 0x64]
mov dword [eax], ecx
test ecx, ecx
jne 0x10045ac0
mov edx, ebx
cmp dword [esp + 0x10], ebx
je 0x10045ac2
mov edx, edi
mov eax, dword [esp + 0x30]
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x10]
cmp eax, edx
setle cl
mov dword [esp + 0xec], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
sub dword [esp + 0x1c], eax
mov dword [esp + 0x30], ebx
jmp 0x10045bf2
mov dword [esp + 0x1c], ebx
jmp 0x10045b09
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x54], 8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10045af9
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x10045b30
push ebx
push 0x4eb
push 0x1812
push 0x12a
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x64]
cmp dword [eax + ecx*4], ebx
jne 0x10045bbb
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], 0xfffffffe
mov eax, dword [esp + 0x54]
mov edx, dword [esp + 0x30]
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x54]
cmp eax, dword [ecx + edx*4]
jne 0x10045b69
mov ecx, ebx
cmp dword [esp + 0x54], ebx
je 0x10045b6b
mov ecx, edi
mov eax, dword [esp + 0x10]
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0xec]
cmp edx, eax
mov eax, dword [esp + 0x10]
setl cl
add eax, ecx
je 0x10045b9f
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x64]
cmp dword [eax + ecx*4], ebx
mov ecx, edi
jne 0x10045ba1
mov ecx, ebx
mov eax, 0x16590181
sub eax, ecx
mov ecx, ebx
sub eax, dword [esp + 0x24]
sub eax, dword [esp + 0x10]
add eax, dword [esp + 0xec]
je 0x10045bbd
mov ecx, edi
mov eax, dword [esp + 0x3c]
sub ecx, eax
je 0x10045bd4
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x64]
cmp dword [eax + ecx*4], ebx
mov eax, edi
jne 0x10045bd6
mov eax, ebx
imul ecx, eax, 0xaec2
xor edx, edx
mov eax, dword [esp + 0x38]
cmp ecx, eax
setl dl
mov dword [esp + 0xe0], edx
inc dword [esp + 0x30]
cmp dword [esp + 0x30], edi
jle 0x10045af3
lea ecx, [esp + 0x64]
call fcn.10027bfc
mov dword [esp + 0x24], edi
push edi
lea ecx, [esp + 0x80]
call fcn.10027b4a
mov dword [esp + 0x1c], 2
mov dword [esp + 0x24], edi
mov dword [esp + 0x10], 0xa3f1540e
mov dword [esp + 0x18], ebx
jmp 0x10045c43
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], 0xfff7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10045c30
mov dword [esp + 0x18], ebx
jmp 0x10045c5f
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x70], 0x1cd43096
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10045c4f
mov eax, dword [esp + 0x7c]
xor edx, edx
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x7c]
mov eax, dword [eax]
imul eax, eax
sub ecx, eax
imul ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x7c]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x70]
setg dl
add eax, edx
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x74]
cmp ecx, eax
mov eax, dword [esp + 0x74]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x7c]
mov eax, 0x8df0442e
setge cl
cmp eax, ecx
sbb ecx, ecx
xor eax, eax
neg ecx
imul ecx, dword [edx]
cmp ecx, 0xfffffffa
setle al
mov dword [esp + 0x10], eax
cmp dword [edx], ebx
jne 0x10045ce9
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x7c]
cmp dword [eax], ebx
jne 0x10045cfd
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x74]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x78]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
neg ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x7c]
call fcn.10027bfc
inc dword [esp + 0x48]
lea ecx, [esp + 0x148]
or dword [esp + 0x224], 0xffffffff
call fcn.10027bfc
dec dword [esp + 0x34]
cmp dword [esp + 0x34], 0xfffffff3
jle 0x10044aba
mov eax, dword [esp + 0xc4]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x50]
mov edi, edx
mov esi, eax
call fcn.100444f3
mov ecx, dword [esp + 0x21c]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret