Function at 0x10009542
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10076cf0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
push edi
mov dword [esp + 0x40], edx
mov edi, ecx
xor edx, edx
inc edx
push 2
mov dword [esp + 0x24], edx
pop esi
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], 0xfffffff3
push 0
pop ebx
jl 0x100095ce
mov dword [esp + 0x18], 7
mov dword [esp + 0x18], esi
jmp 0x100095b9
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100095b5
push 0x22c
push ebx
push 0x2394
push ebx
push 0x267f
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringW]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff2
jge 0x10009592
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff3
jge 0x10009584
xor edx, edx
inc edx
mov dword [esp + 0x14], 9
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], ebx
jmp 0x100095fb
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xb4], 7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x100095e8
mov eax, dword [esp + 0xb8]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xb8]
mov eax, dword [esp + 0xbc]
cmp dword [esp + 0x20], 6
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp edx, eax
setg cl
imul ecx, dword [esp + 0x14]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], 0xfffffff3
jmp 0x10009690
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], ebx
jl 0x10009688
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10009682
push 0x19ff
push 0x1918
push 0x971
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
dec dword [esp + 0x14]
jns 0x1000965b
mov eax, dword [esp + 0x28]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe2
jge 0x10009651
mov dword [esp + 0x24], 0x9da4d073
xor edx, edx
push 0xfffffffffffffff8
pop eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
cmp eax, 0x69ac
setge dl
xor ecx, ecx
add edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp eax, edx
setle cl
cmp ecx, dword [esp + 0x14]
jl 0x100096e9
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, 0x22350
setl cl
mov dword [esp + 0x28], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10009721
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
push 7
pop ecx
mov dword [esp + 0x2c], ecx
xor eax, eax
mov dword [esp + 0x14], 0xbb11accb
inc eax
mov dword [esp + 0x20], 0xfffffff8
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], 0xa2b82c44
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x34], eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x34], 0x5dd4d14b
mov dword [esp + 0x24], ecx
mov dword [esp + 0x34], 0xfffffff7
cmp dword [esp + 0x14], ebx
je 0x10009784
mov eax, dword [esp + 0x14]
xor eax, eax
inc eax
mov edx, eax
cmp dword [esp + 0x14], ebx
jne 0x10009786
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x18], ebx
jne 0x100097a7
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
sub ecx, 0xcc099a56
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setge dl
sub edx, 0x14055248
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [esp + 0x30], ecx
dec dword [esp + 0x24]
mov esi, dword [esp + 0x14]
neg esi
mov dword [esp + 0x30], 0x583e3585
mov eax, dword [esp + 0x20]
sbb esi, esi
xor ecx, ecx
neg esi
cmp eax, 1
mov eax, dword [esp + 0x30]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
cmp esi, 5
setle cl
xor eax, eax
cmp ecx, 0x69dd
setge al
add edx, eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], edx
xor edx, edx
cmp dword [esp + 0x28], 0x3253674f
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x34], ecx
mov dword [esp + 0x1c], 7
mov dword [esp + 0x28], 0x6c84
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x24], 1
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x34], 0x92079655
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1000988b
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov dword [esp + 0x18], ebx
jmp 0x100099c2
mov dword [esp + 0x20], ebx
jmp 0x100098aa
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x48], 0xe4438bea
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1000989a
cmp dword [esp + 0x48], ebx
je 0x100098bc
xor ecx, ecx
inc ecx
jmp 0x100098be
mov ecx, ebx
mov eax, dword [esp + 0x18]
imul eax, ecx
test eax, eax
je 0x1000999b
mov dword [esp + 0x14], 2
mov dword [esp + 0x30], 8
mov dword [esp + 0x14], 0x18
jmp 0x1000998e
mov dword [esp + 0x30], 0x6dd2
mov dword [esp + 0x20], ebx
jmp 0x10009907
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x114], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x100098f8
mov eax, dword [esp + 0x48]
xor edx, edx
mov dword [esp + 0x24], eax
inc edx
mov eax, dword [esp + 0x14]
xor ecx, ecx
sub edx, eax
add edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
cmp eax, edx
mov eax, dword [esp + 0x50]
setg cl
xor edx, edx
cmp ecx, 9
mov ecx, dword [esp + 0x30]
setle dl
imul edx, eax
mov eax, dword [esp + 0x14]
add ecx, edx
xor edx, edx
imul ecx, eax
mov dword [esp + 0x114], ecx
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x48]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setl dl
mov dword [esp + 0x30], edx
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xa
jge 0x100098ea
jmp 0x100099ba
mov dword [esp + 0x30], 0x5631cd1a
cmp dword [esp + 0x50], ebx
jne 0x100099b3
cmp dword [esp + 0x4c], ebx
jne 0x100099b3
mov eax, ebx
jmp 0x100099b6
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x24]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe4
jge 0x10009894
xor ecx, ecx
inc ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x34], 0xfffffffc
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x34], 0x799333c7
push 2
mov dword [esp + 0x28], 0x95761be3
mov dword [esp + 0x18], ebx
pop edx
jmp 0x10009a10
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x120], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100099fd
mov dword [esp + 0x14], ebx
jmp 0x10009a28
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x64], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10009a1c
inc dword [esp + 0x24]
mov dword [esp + 0x18], ebx
jmp 0x10009a48
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x64], 0xfffffff7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x10009a38
mov dword [esp + 0x34], 0xb2c593c8
mov dword [esp + 0x18], 0x2cf4
mov dword [esp + 0x24], 0x3dfad5be
mov dword [esp + 0x24], 5
mov dword [esp + 0x24], 0xab653b1d
mov dword [esp + 0x34], 0x82104667
mov dword [esp + 0x20], ebx
jmp 0x10009a97
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xd8], 0xf1c946b4
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x10009a84
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x18]
imul ecx, eax, 0xa9bc
mov dword [esp + 0xdc], ecx
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x18], ebx
jmp 0x10009b0d
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x80], 0x7013
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10009afa
mov dword [esp + 0x14], ebx
jmp 0x10009bd5
mov dword [esp + 0x20], 0xba772304
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x10009be0
push 3
lea ecx, [esp + 0x94]
call fcn.100136d3
mov dword [esp + 0x18], ebx
jmp 0x10009b5d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], 0x82ff40fc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10009b47
mov esi, dword [esp + 0x90]
mov dword [esi + 8], ebx
mov dword [esp + 0x18], 0xbd2ab60
mov dword [esp + 0x18], ebx
jmp 0x10009ba6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10009b98
push 0x12fe
push ebx
push 0x1e8a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, dword [esi + 8]
mov eax, dword [esp + eax*4 + 0x80]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x10009b7c
inc dword [esi + 8]
cmp dword [esi + 8], 0
jle 0x10009b6e
lea ecx, [esp + 0x90]
call fcn.10013d7e
dec dword [esp + 0x20]
jns 0x10009b33
cmp dword [esp + 0x20], ebx
jne 0x10009be0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1a
jl 0x10009b1d
mov dword [esp + 0x18], ebx
jmp 0x10009bf9
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x128], 0xf0f5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10009be6
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], 0x5ba7
mov eax, dword [esp + 0x2c]
dec eax
cmp dword [esp + 0x24], eax
je 0x10009c27
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x28], ebx
jne 0x10009c31
mov eax, ebx
jmp 0x10009c34
xor eax, eax
inc eax
mov dword [esp + 0x12c], eax
cmp dword [edi + 0x10], ebx
jne 0x10009c47
xor al, al
jmp 0x1000a573
mov dword [esp + 0x18], 1
lea ecx, [esp + 0xf8]
push 3
call fcn.100136d3
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x10009c81
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x10009c6b
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x18]
mov esi, dword [sym.imp.USER32.dll_GetDC]
neg eax
sbb eax, eax
inc eax
cmp dword [esp + 0x18], eax
jne 0x10009caf
mov dword [esp + 0x2c], 0xd006
dec dword [esp + 0x28]
jmp 0x10009d20
xor ecx, ecx
mov dword [esp + 0x2c], 6
mov dword [esp + 0x1c], ebx
inc ecx
jmp 0x10009ccc
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x6c], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x10009cc0
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, 0x37bb
setle cl
cmp ecx, 0xffffffff
sbb eax, eax
neg eax
cmp eax, 0x9ddcef98
sbb ecx, ecx
xor eax, eax
neg ecx
add ecx, dword [esp + 0x6c]
cmp ecx, 0x37ac
setne al
mov dword [esp + 0x2c], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10009d20
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
lea ecx, [esp + 0xf8]
call fcn.10013d7e
push ebx
lea eax, [esp + 0x44]
push eax
push 0x483a
call fcn.1000c3a4
add esp, 0xc
lea ecx, [esp + 0x54]
push 3
call fcn.100136d3
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10009d63
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x70], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10009d53
mov dword [esp + 0x14], ebx
jmp 0x10009d7e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x54]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10009d6f
mov eax, dword [esp + 0x54]
mov dword [eax], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10009d9d
push ebx
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10009dc3
push ebx
push 0x376
push 0x790
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov eax, dword [esp + 0x54]
inc dword [eax]
mov edx, dword [eax]
test edx, edx
jle 0x10009d8b
xor ecx, ecx
cmp edx, 0xffffffff
setge cl
xor eax, eax
cmp edx, ecx
setl al
cmp eax, 0x4e6d
jg 0x10009df9
mov dword [esp + 0x2c], 0xee1c
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x54]
mov dword [eax], ecx
jmp 0x10009e1e
mov dword [esp + 0x1c], 0x37a5b7d8
mov dword [esp + 0x1c], 0xfffffff1
jmp 0x10009e17
mov eax, dword [esp + 0x54]
cmp dword [eax], ebx
jne 0x10009e1e
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x12
jl 0x10009e0b
lea ecx, [esp + 0x54]
call fcn.10013d7e
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x18], 3
mov dword [esp + 0x1c], ebx
jmp 0x10009e4d
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x3c], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10009e3d
mov dword [esp + 0x14], ebx
jmp 0x10009edd
mov dword [esp + 0x20], 0xb51dba33
mov dword [esp + 0x28], 0xd9b95031
mov dword [esp + 0x2c], 0x32a1
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x10009ed9
mov dword [esp + 0x34], 0xce6bb2f1
mov dword [esp + 0x28], 0xab39
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], 0xfffd
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x3c], ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
dec dword [esp + 0x20]
jns 0x10009e7f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x10009e5d
mov dword [esp + 0x14], ebx
jmp 0x10009f2c
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10009f09
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
mov dword [esp + 0x18], ebx
jmp 0x10009f21
mov dword [esp + 0x2c], 0xfff7
cmp dword [esp + 0x2c], ebx
jne 0x10009f28
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x11
jl 0x10009f0f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jg 0x10009eed
mov dword [esp + 0x2c], 0x75c96dd1
mov dword [esp + 0x34], 4
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10009f5a
push 0x1418
push ebx
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10009f78
push ebx
push ebx
push 0x2ea
push 0x1e68
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
mov dword [esp + 0x44], 0xdf2f4a8b
lea ecx, [esp + 0xc0]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x44], eax
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
push eax
call fcn.100136d3
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
jmp 0x10009fbc
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10009fa6
mov eax, dword [esp + 0xc0]
or ecx, 0xffffffff
sub ecx, dword [eax]
xor eax, eax
cmp ecx, 1
setg al
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x30], eax
jg 0x1000a05b
mov dword [esp + 0x20], 0x10
jmp 0x1000a034
mov dword [esp + 0x18], 0xfebf
mov dword [esp + 0x18], 2
mov dword [esp + 0x18], ebx
jmp 0x1000a029
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1000a025
push ebx
push ebx
push 0xfa5
push ebx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffc
je 0x1000a009
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x2e
jl 0x10009ff3
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1000a09b
push 1
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
jmp 0x1000a09b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1000a072
push 0x66c
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1000a09b
push ebx
push ebx
push 0x90e
push ebx
push 0x1f72
push ebx
push 0xa14
push 0x185a
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0xc0]
call fcn.10013d7e
push ebx
lea eax, [esp + 0x48]
push eax
push 0x20ad
call fcn.100131b7
add esp, 0xc
mov dword [esp + 0x1c], 0xfffffffd
push 3
pop esi
mov dword [esp + 0x1c], esi
jmp 0x1000a0f6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1000a0dc
call dword [sym.imp.USER32.dll_CreateMenu]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1000a0f2
push 0x1bb0
call dword [sym.imp.USER32.dll_MessageBeep]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x11
jle 0x1000a0cb
cmp dword [edi + 0x14], 0x10
jb 0x1000a107
mov ecx, dword [edi]
jmp 0x1000a109
mov ecx, edi
cmp dword [edi + 0x14], 0x10
mov dword [esp + 0x38], ecx
jb 0x1000a117
mov edx, dword [edi]
jmp 0x1000a119
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
cmp ecx, eax
je 0x1000a2ea
push 4
lea ecx, [esp + 0xd0]
call fcn.100136d3
mov dword [esp + 0x144], ebx
lea eax, [esp + 0x114]
push dword [esp + 0x70]
movdqa xmm0, xmmword [0x10008180]
lea ecx, [esp + 0x88]
push eax
lea eax, [esp + 0x10c]
mov dword [esp + 0x34], esi
push eax
push ebx
movdqu xmmword [esp + 0x114], xmm0
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
call fcn.10014f2b
mov dword [esp + 0x2c], 0xc660f7e7
mov dword [esp + 0x2c], 7
mov dword [esp + 0x2c], 0xd857289c
mov dword [esp + 0x28], 0xfffffffa
mov dword [esp + 0x2c], 6
mov dword [esp + 0x1c], ebx
jmp 0x1000a1c6
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1000a1b4
mov eax, dword [esp + 0xcc]
lea ecx, [esp + 0x84]
mov eax, dword [eax + 4]
mov dword [esp + 0x2c], eax
dec dword [esp + 0x28]
call fcn.10013d7e
or dword [esp + 0x144], 0xffffffff
lea ecx, [esp + 0xcc]
call fcn.10013d7e
mov eax, dword [esp + 0x38]
mov al, byte [eax]
cmp al, 0x30
jl 0x1000a22f
cmp al, 0x39
jg 0x1000a22f
lea eax, [esp + 0x40]
push eax
push 0x4539
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.1000cd31
mov ecx, dword [esp + 0x48]
add esp, 0x10
inc ecx
jmp 0x1000a109
xor eax, eax
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], eax
jmp 0x1000a264
mov dword [esp + 0x1c], 7
mov dword [esp + 0x1c], 2
jmp 0x1000a259
push ebx
call fcn.1000a730
dec dword [esp + 0x20]
pop ecx
cmp dword [esp + 0x1c], 0xfffffff2
jge 0x1000a24e
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff3
jge 0x1000a23c
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.1000c278
mov dword [esp + 0x1c], 0x7fb0b029
pop ecx
mov dword [esp + 0x30], 0xffffffff
pop ecx
mov dword [esp + 0x1c], ebx
jmp 0x1000a2a1
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xe0], 0xf84b8114
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1000a28e
mov eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x14], ebx
jmp 0x1000a2de
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0xe0]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xe0], ecx
cmp dword [esp + 0x14], ebx
jne 0x10009c40
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x1000a2ba
jmp 0x10009c40
mov dword [esp + 0x18], 0xfffffff8
xor ecx, ecx
mov dword [esp + 0x2c], 0x9d693ce8
inc ecx
mov dword [esp + 0x1c], ebx
jmp 0x1000a30f
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x68], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1000a303
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1000a32d
push ebx
push 0x5dac
call fcn.1000a78b
pop ecx
pop ecx
mov dword [esp + 0x18], ebx
jmp 0x1000a453
push esi
lea ecx, [esp + 0x78]
call fcn.100136d3
mov dword [esp + 0x28], 0x6ce2e7c5
mov dword [esp + 0x14], ebx
jmp 0x1000a361
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], 0x5610a143
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1000a34e
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x1000a380
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x60], 0xff57440e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1000a370
mov dword [esp + 0x14], ebx
jmp 0x1000a39f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xa8], 0x27b1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1000a38c
cmp dword [esp + 0x18], ebx
jne 0x1000a3e0
mov eax, dword [esp + 0x74]
xor ecx, ecx
mov dword [esp + 0x68], edx
cmp dword [eax], edx
setle cl
cmp ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x74]
jne 0x1000a3c9
cmp dword [eax + 4], ebx
je 0x1000a3d9
cmp dword [eax + 4], ebx
jne 0x1000a3d9
mov dword [esp + 0xac], ebx
mov edx, ebx
jmp 0x1000a3e0
mov dword [esp + 0xac], edx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
test ecx, ecx
setle al
cmp eax, 0xd994
jle 0x1000a404
cmp dword [esp + 0x60], ebx
je 0x1000a404
xor ecx, ecx
inc ecx
jmp 0x1000a406
mov ecx, ebx
mov eax, dword [esp + 0x74]
cmp ecx, dword [eax + 4]
jl 0x1000a41c
cmp dword [esp + 0xac], ebx
jne 0x1000a41c
mov ecx, ebx
jmp 0x1000a41f
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0xad31fc53
mov ecx, 0xf2ca1253
setne al
cmp ecx, eax
lea ecx, [esp + 0x74]
sbb eax, eax
neg eax
add eax, 0x4f957c33
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
call fcn.10013d7e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x10
jg 0x1000a336
push 2
pop esi
mov dword [esp + 0x18], 0xbe1d925b
lea ecx, [esp + 0xec]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0xfd43ddca
push esi
call fcn.100136d3
mov dword [esp + 0x144], 1
lea ecx, [esp + 0x9c]
mov dword [esp + 0x30], 0x7ae9f903
mov dword [esp + 0x24], 0x42c78ef8
mov dword [esp + 0x2c], 8
push 4
call fcn.100136d3
mov dword [esp + 0x14], ebx
jmp 0x1000a4cf
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 0x3f5e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1000a4b9
mov dword [esp + 0x14], ebx
jmp 0x1000a4f1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], 0x4f20077f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1000a4db
mov dword [esp + 0x1c], 1
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
add eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x18]
imul edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x9c]
mov dword [ecx + 4], edx
lea ecx, [esp + 0x9c]
mov dword [esp + 0x1c], 0xf69a7501
call fcn.10013d7e
lea ecx, [esp + 0xec]
call fcn.10013d7e
mov al, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret