Function at 0x10019103
Capabilities:
Access peb ldr_data
Check os version
Compare security identifiers
Extract resource via kernel32 functions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10085c09
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x230
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x10], 0x2afe
mov dword [esp + 0xc], 0xfffffff8
mov dword [esp + 0x20], 0x5c5735e4
mov dword [esp + 0x28], 0xd8a94b2a
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], 2
push ebx
mov dword [esp + 0x30], 0xfffffffb
xor ebx, ebx
mov eax, dword [esp + 0x14]
push esi
mov dword [esp + 0x14], 8
mov esi, edx
push edi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x48], ecx
cmp dword [esp + 0x18], ebx
je 0x100191a6
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], ebx
je 0x100191a6
xor eax, eax
inc eax
jmp 0x100191a8
mov eax, ebx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], ebx
je 0x100192a4
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x100191dd
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x118], 1
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x100191ca
mov dword [esp + 0x2c], ebx
jmp 0x10019202
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100191fe
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0x18
je 0x100191ea
mov eax, dword [esp + 0x118]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x118]
cmp eax, 1
mov eax, dword [esp + 0x118]
setle cl
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x120]
add ecx, 9
cmp ecx, 0xc36b
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
add eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
mov eax, dword [esp + 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [esp + 0x118]
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
sub eax, 0xcc0e
je 0x1001929c
cmp dword [esp + 0x28], ebx
je 0x1001929c
xor eax, eax
inc eax
jmp 0x1001929e
mov eax, ebx
mov dword [esp + 0x34], eax
jmp 0x100192ed
mov dword [esp + 0x18], 0xd
jmp 0x100192e6
mov dword [esp + 0x34], 0x32f82966
mov dword [esp + 0x28], 0x71d0c0b8
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100192e2
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x100192ae
mov dword [esp + 0x20], ebx
jmp 0x10019306
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xe4], 0xfffffff9
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x100192f3
mov dword [esp + 0x34], ebx
cmp dword [esp + 0x34], 0xfffffffc
jg 0x1001a820
push 3
pop ecx
mov dword [esp + 0x2c], 0x5d09ea9
mov dword [esp + 0x14], 0x48aab564
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 0xb61943ec
mov dword [esp + 0x20], ebx
jmp 0x10019351
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x4c], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x10019345
mov dword [esp + 0x4c], 0xd
jmp 0x10019545
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x10019386
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x180], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x10019373
mov dword [esp + 0x10], ebx
jmp 0x10019537
mov dword [esp + 0x30], 1
mov dword [esp + 0x18], 0x7f4a7d2a
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x30], ebx
jl 0x1001951d
mov dword [esp + 0x24], 0x365653d4
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], ebx
jl 0x10019513
mov dword [esp + 0x20], ebx
jmp 0x100193e3
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x190], 0xb9567464
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x100193d0
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x180], ebx
jne 0x10019439
mov eax, dword [esp + 0x188]
xor edx, edx
mov ecx, 0x6974
sub ecx, eax
mov eax, dword [esp + 0x50]
cmp eax, ecx
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x10]
setl dl
mov dword [esp + 0x28], edx
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
sete cl
sub eax, ecx
jne 0x10019439
mov ecx, ebx
jmp 0x1001943c
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x9953
push 3
setge al
xor edx, edx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, 0x5169
mov eax, dword [esp + 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x184]
mov eax, dword [esp + 0x1c]
sub eax, 0x1162d50c
cmp eax, ecx
mov eax, dword [esp + 0x54]
pop ecx
setl dl
imul edx, eax
mov eax, dword [esp + 0x10]
imul eax, edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], ebx
jmp 0x10019503
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebx
jmp 0x100194bf
mov eax, dword [esp + 0x2c]
mov dword [esp + eax*4 + 0x180], ebx
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 4
jl 0x100194b0
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
jl 0x100194ff
dec dword [esp + 0x194]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100194f6
push 0x1552
push ebx
push 0xe08
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
dec dword [esp + 0x20]
jns 0x100194d0
push 3
pop ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jle 0x100194a6
dec dword [esp + 0x24]
jns 0x100193ca
dec dword [esp + 0x30]
jns 0x100193b4
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019533
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 3
pop ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jle 0x10019396
dec dword [esp + 0x4c]
cmp dword [esp + 0x4c], 0xffffffe4
jge 0x10019365
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x10c]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x14], 0x7bb34e4a
mov eax, dword [esp + 0x14]
mov dword [esp + 0x50], eax
mov dword [esp + 0x20], ebx
push 1
call fcn.1001740b
mov dword [esp + 0x14], ebx
jmp 0x10019596
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], 0x97f6af11
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10019580
mov eax, dword [esp + 0x10c]
mov dword [eax], 0xfffffffe
mov dword [esp + 0x14], 0xfa75c19c
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100195d8
push 0x21b6
push 0x10d7
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov dword [esp + 0x14], 0xffffffec
jmp 0x10019623
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019600
push 0xc7b
push 0x815
call edi
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001961f
push 0x102
push ebx
push 0xb92
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x18
jle 0x100195e2
mov eax, dword [esp + 0x10c]
inc dword [eax]
cmp dword [eax], 0x1a
jl 0x100195aa
lea ecx, [esp + 0x10c]
call fcn.1001748d
push 3
pop ecx
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], ebx
jl 0x1001a80d
push dword [esp + 0x48]
lea eax, [esp + 0x1f8]
mov dword [esp + 0xa0], ebx
push eax
lea eax, [esp + 0x1ec]
mov dword [esp + 0xa8], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0xb0], ebx
push ebx
lea ecx, [esp + 0xac]
movdqu xmmword [esp + 0x1f4], xmm0
call fcn.100188ff
mov dword [esp + 0x244], ebx
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x30], 1
mov dword [esp + 0x28], 0xffffffff
mov dword [eax], ebx
mov dword [esp + 0x30], ebx
jmp 0x100197bd
mov dword [esp + 0x14], 7
mov dword [esp + 0x28], 8
mov dword [esp + 0x14], ebx
jmp 0x100196ed
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x21c], 0x7631615e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x100196da
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019706
push ebx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [esp + 0x14], ebx
jmp 0x100197ae
push 1
lea ecx, [esp + 0x1cc]
call fcn.1001740b
mov byte [esp + 0x244], 1
lea ecx, [esp + 0x14c]
mov dword [esp + 0x28], 0x8d7cbae8
push 1
call fcn.1001740b
xor edx, edx
mov dword [esp + 0x18], ebx
inc edx
jmp 0x1001975a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c8]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10019744
mov dword [esp + 0x18], ebx
jmp 0x1001977c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 0xc7ba3f30
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10019766
mov eax, dword [esp + 0x14c]
lea ecx, [esp + 0x14c]
dec dword [eax]
call fcn.1001748d
lea ecx, [esp + 0x1c8]
mov byte [esp + 0x244], bl
call fcn.1001748d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x1001970f
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 3
jle 0x100196c4
or dword [esp + 0x244], 0xffffffff
lea ecx, [esp + 0x9c]
call fcn.1001748d
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + eax*4 + 0xe4]
cmp eax, dword [esp + 0x2c]
je 0x100197f8
cmp dword [esp + 0x2c], ebx
je 0x100197f8
xor ecx, ecx
inc ecx
jmp 0x100197fa
mov ecx, ebx
mov eax, dword [esp + 0x2c]
xor edx, edx
push 2
mov eax, dword [esp + eax*4 + 0xe8]
cmp ecx, eax
setg dl
xor ecx, ecx
add edx, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + eax*4 + 0xe8]
cmp eax, 0xffffffff
setl cl
xor eax, eax
neg ecx
cmp ecx, edx
setl al
xor ecx, ecx
cmp eax, 0x693009c
mov eax, dword [esp + 0x30]
setl cl
mov eax, dword [esp + eax*4 + 0xe8]
add ecx, eax
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0xe8], ecx
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x1a0]
mov dword [esp + 0x1c], 0xfe0a8eac
call fcn.1001740b
push 2
pop edx
mov dword [esp + 0x244], edx
mov dword [esp + 0x28], 0x3a67d62
mov dword [esp + 0x14], ebx
jmp 0x10019896
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], 0xe2ad
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10019880
mov dword [esp + 0x18], 0x11
jmp 0x100198b6
mov dword [esp + 0x28], 0x8876942a
inc dword [esp + 0x28]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1b
jle 0x100198a6
mov dword [esp + 0x18], 0xfffffffe
cmp dword [esp + 0x18], 0xffffffee
jle 0x10019a7b
push 3
lea ecx, [esp + 0x144]
call fcn.1001740b
push 3
lea ecx, [esp + 0x168]
mov byte [esp + 0x248], 3
call fcn.1001740b
mov byte [esp + 0x244], 4
lea eax, [esp + 0x214]
push dword [esp + 0x48]
movdqa xmm0, xmmword [0x10007aa0]
lea ecx, [esp + 0xc4]
push eax
lea eax, [esp + 0x20c]
mov dword [esp + 0x40], 0xc98072f2
push eax
push ebx
movdqu xmmword [esp + 0x214], xmm0
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
call fcn.100188ff
push 3
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001996a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10019954
mov dword [esp + 0x10], ebx
jmp 0x1001998c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10019976
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100199ab
push ebx
push ebx
push 0x3c7
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov esi, dword [esp + 0x164]
mov edi, dword [esp + 0xc0]
mov dword [esi + 8], ebx
mov dword [esp + 0x1c], 7
mov dword [esp + 0x28], 0xfffd
cmp dword [esp + 0x1c], ebx
jne 0x10019a1e
cmp dword [esi + 8], ebx
jne 0x10019a1e
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 8]
mov ecx, dword [esp + 0x140]
mov eax, dword [esp + 0x18]
cmp eax, dword [ecx + edx*4]
jl 0x100199f8
cmp dword [esp + 0x18], ebx
jne 0x100199f8
mov ecx, ebx
jmp 0x100199fb
xor ecx, ecx
inc ecx
mov eax, dword [esi + 8]
imul eax, ecx
test eax, eax
je 0x10019a10
cmp dword [esp + 0x18], ebx
je 0x10019a10
xor eax, eax
inc eax
jmp 0x10019a12
mov eax, ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x18]
inc dword [esi + 8]
cmp dword [esi + 8], 2
mov dword [esp + 0x28], 1
jle 0x100199bc
lea ecx, [esp + 0xc0]
call fcn.1001748d
lea ecx, [esp + 0x164]
call fcn.1001748d
lea ecx, [esp + 0x140]
mov byte [esp + 0x244], 2
call fcn.1001748d
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffee
jg 0x100198d0
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
or dword [esp + 0x244], 0xffffffff
lea ecx, [esp + 0x19c]
call fcn.1001748d
mov dword [esp + 0x20], ebx
jmp 0x1001a7f6
mov dword [esp + 0x28], ebx
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], ebx
push ecx
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x2c], ebx
call fcn.1001740b
mov dword [esp + 0x28], 0x8fe4de5a
mov dword [esp + 0x14], ebx
jmp 0x10019ae1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1a8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019ace
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019afa
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
lea ecx, [esp + 0x1a8]
call fcn.1001748d
push 2
lea ecx, [esp + 0x138]
call fcn.1001740b
push 5
pop eax
mov dword [esp + 0x244], eax
mov dword [esp + 0x18], 0x5540d7f8
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], 0xfffffffb
jmp 0x10019bd2
mov dword [esp + 0x10], ebx
jmp 0x10019b50
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x100], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019b3d
mov dword [esp + 0x10], ebx
jmp 0x10019b70
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1c0], 0xf88039d6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019b5d
mov eax, dword [esp + 0x108]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x104]
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0x108]
sub esi, eax
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp eax, ecx
mov ecx, dword [esp + 0x100]
mov eax, dword [esp + 0x18]
setl dl
imul edx, esi
sub ecx, edx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
add ecx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x1c4], ecx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff0
jle 0x10019b37
mov dword [esp + 0x14], ebx
jmp 0x10019bf9
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0x93046aa1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019be3
mov dword [esp + 0x28], 0xe19f23e5
mov dword [esp + 0x14], ebx
jmp 0x10019c1e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3c], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10019c0e
mov dword [esp + 0x3c], ebx
jmp 0x10019cd5
mov dword [esp + 0x10], 0xffffffff
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x10]
neg esi
mov eax, dword [esp + 0x10]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x3c]
setne cl
xor edx, edx
cmp ecx, 0x3267e6aa
setle dl
xor ecx, ecx
cmp eax, esi
setge cl
xor eax, eax
cmp ecx, edx
setg al
xor ecx, ecx
cmp eax, 0x5420
mov eax, dword [esp + 0x10]
setle cl
add eax, ecx
xor ecx, ecx
cmp eax, 0xc975
setle cl
cmp ecx, 0x8018d9dc
jne 0x10019cc9
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], 0x1c
jne 0x10019c2e
mov dword [esp + 0x28], ebx
jmp 0x1001a7d3
mov dword [esp + 0x24], 1
mov dword [esp + 0x14], ebx
jmp 0x10019d0a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x214], 0x8bbca631
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019cf7
mov dword [esp + 0x24], 1
cmp dword [esp + 0x24], ebx
jl 0x10019d31
mov dword [esp + 0x1c], 2
dec dword [esp + 0x1c]
dec dword [esp + 0x24]
jns 0x10019d1f
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ebx
jmp 0x10019d52
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x90], 0x973063d6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019d3f
mov dword [esp + 0x30], 6
lea ecx, [esp + 0x84]
push 2
call fcn.1001740b
mov byte [esp + 0x244], 6
lea eax, [esp + 0x204]
push dword [esp + 0x48]
movdqa xmm0, xmmword [0x10007b10]
lea ecx, [esp + 0xb8]
push eax
lea eax, [esp + 0x1fc]
mov dword [esp + 0xbc], ebx
push eax
push ebx
movdqu xmmword [esp + 0x204], xmm0
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
call fcn.100188ff
mov byte [esp + 0x244], 7
lea eax, [esp + 0x1e4]
push dword [esp + 0x48]
movdqa xmm0, xmmword [0x10007aa0]
lea ecx, [esp + 0xac]
push eax
lea eax, [esp + 0x1dc]
mov dword [esp + 0x18], 0x5d3e9973
push eax
mov dword [esp + 0x44], 7
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
push ebx
movdqu xmmword [esp + 0x1e4], xmm0
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
call fcn.100188ff
mov dword [esp + 0x14], ebx
jmp 0x10019e41
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x84]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019e2b
mov esi, dword [esp + 0xb4]
mov eax, dword [esp + 0x84]
mov eax, dword [eax]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x30]
sub eax, dword [esi + 8]
jne 0x10019ebd
mov ecx, dword [esp + 0x84]
mov eax, dword [ecx]
mov dword [esi + 8], eax
test eax, eax
je 0x10019eb9
xor eax, eax
cmp dword [ecx], 1
setge al
xor ecx, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x84]
mov eax, dword [eax]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x30]
cmp dword [esi + 8], eax
setle cl
imul eax, ecx, 0x7504
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x84]
add ecx, dword [eax]
jne 0x10019ebd
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x24], ebx
jmp 0x10019f3c
mov dword [esp + 0x14], 0xfffffff6
mov dword [esp + 0x18], 0x39a53aa4
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], eax
jle 0x10019f24
mov eax, dword [esp + 0x10]
mov dword [esi + 8], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x14]
imul eax, dword [ecx + 8]
test eax, eax
je 0x10019f24
xor edx, edx
inc edx
jmp 0x10019f26
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 5
mov dword [esp + 0x38], eax
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x2a
jle 0x10019ecb
lea ecx, [esp + 0xa8]
call fcn.1001748d
lea ecx, [esp + 0xb4]
call fcn.1001748d
lea ecx, [esp + 0x84]
mov byte [esp + 0x244], 5
call fcn.1001748d
push 3
pop ecx
mov dword [esp + 0x98], ebx
cmp dword [esp + 0x98], ecx
jg 0x1001a5ca
xor esi, esi
inc esi
mov dword [esp + 0x38], 0xc7ba3f30
mov byte [esp + 0x40], bl
mov dword [esp + 0x1c], 0x48aab564
mov dword [esp + 0x18], esi
mov dword [esp + 0x18], 0xb61943ec
mov dword [esp + 0x14], ebx
jmp 0x10019fbb
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x54], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019faf
mov dword [esp + 0x54], 0xd
jmp 0x1001a1a8
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x10019ff0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x170], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10019fdd
mov dword [esp + 0x10], ebx
jmp 0x1001a19a
mov dword [esp + 0x38], esi
mov dword [esp + 0x24], 0x7f4a7d2a
mov dword [esp + 0x38], ecx
cmp dword [esp + 0x38], ebx
jl 0x1001a180
mov dword [esp + 0x30], 0x365653d4
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x30], ebx
jl 0x1001a176
mov dword [esp + 0x14], ebx
jmp 0x1001a049
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b4], 0xb9567464
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001a036
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x170], ebx
jne 0x1001a09d
mov eax, dword [esp + 0x178]
xor edx, edx
mov ecx, 0x6974
sub ecx, eax
mov eax, dword [esp + 0x58]
cmp eax, ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
setl dl
mov dword [esp + 0x1c], edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
sete cl
sub eax, ecx
mov ecx, ebx
je 0x1001a09f
mov ecx, esi
xor eax, eax
cmp ecx, 0x9953
push 3
setge al
xor edx, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp eax, 0x5169
mov eax, dword [esp + 0x3c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x174]
mov eax, dword [esp + 0x28]
sub eax, 0x1162d50c
cmp eax, ecx
mov eax, dword [esp + 0x5c]
pop ecx
setl dl
imul edx, eax
mov eax, dword [esp + 0x10]
imul eax, edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], ebx
jmp 0x1001a166
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ebx
jmp 0x1001a122
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x170], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001a113
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
jl 0x1001a162
dec dword [esp + 0x1b8]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a159
push 0x1552
push ebx
push 0xe08
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
dec dword [esp + 0x18]
jns 0x1001a133
push 3
pop ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jle 0x1001a109
dec dword [esp + 0x30]
jns 0x1001a030
dec dword [esp + 0x38]
jns 0x1001a01a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a196
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push 3
pop ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jle 0x1001a000
dec dword [esp + 0x54]
cmp dword [esp + 0x54], 0xffffffe4
jge 0x10019fcf
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x1c], 0x7bb34e4a
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x58], eax
lea eax, [esp + 0x40]
push ebx
push eax
call fcn.1001af3d
pop ecx
pop ecx
push 3
pop ecx
mov dword [esp + 0x38], ecx
cmp dword [esp + 0x38], ebx
jl 0x1001a5b6
mov dword [esp + 0x1c], 0xe3556834
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a217
push ebx
push 0x20b5
push 0x170
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBColorTable]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a233
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
lea eax, [esp + 0x43]
mov byte [esp + 0x43], bl
push eax
push 0x31af
push ebx
call fcn.1001cde5
add esp, 0xc
lea ecx, [esp + 0xcc]
push esi
call fcn.1001740b
mov byte [esp + 0x244], 8
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001a279
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x68], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001a269
mov dword [esp + 0x10], ebx
jmp 0x1001a299
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xcc]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001a286
mov dword [esp + 0x68], ebx
jmp 0x1001a3c0
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x128]
push 3
call fcn.1001740b
mov dword [esp + 0x1c], ebx
jmp 0x1001a2d6
cmp dword [esp + 0x1c], 3
jl 0x1001a2c0
cmp dword [esp + 0x68], 0x1d
jg 0x1001a2a8
lea ecx, [esp + 0xcc]
mov byte [esp + 0x244], 5
call fcn.1001748d
mov byte [esp + 0x41], bl
lea ecx, [esp + 0x158]
mov dword [esp + 0x18], 0x32b1cecb
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], 0xb72b
push 4
call fcn.1001740b
push 4
mov dword [esp + 0x34], 0xffff
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001a422
cmp dword [esp + 0x10], edx
jl 0x1001a416
inc dword [esp + 0x98]
cmp dword [esp + 0x98], ecx
jle 0x10019f89
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1001a5e8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001a5d8
mov dword [esp + 0x10], ebx
jmp 0x1001a608
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x228], 0xfe6966ef
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001a5f5
mov dword [esp + 0x44], 0x14
jmp 0x1001a76e
mov dword [esp + 0x18], 0xeede0b40
mov dword [esp + 0x1c], ebx
jmp 0x1001a63d
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x80], 0xf307d7c1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x1001a62a
mov dword [esp + 0x18], 0x16
jmp 0x1001a75f
mov dword [esp + 0x10], 0xfffffff6
mov dword [esp + 0x10], 0xffffffff
jmp 0x1001a750
mov dword [esp + 0x1c], 0x3418eb0b
mov dword [esp + 0x1c], ebx
jmp 0x1001a684
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x60], 0xfffffffc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001a674
mov dword [esp + 0x60], ebx
jmp 0x1001a6b0
mov dword [esp + 0x1c], 0x23a266d2
mov eax, dword [esp + 0x60]
mov eax, dword [esp + eax*4 + 0x80]
mov dword [esp + 0x1c], 0xb963ab1
inc dword [esp + 0x60]
cmp dword [esp + 0x60], ebx
jle 0x1001a691
mov eax, dword [esp + 0x80]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x18], 1
jle 0x1001a712
mov dword [esp + 0x24], 0xffffffee
jmp 0x1001a709
mov dword [esp + 0x38], 0x3d975123
xor edx, edx
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setg dl
mov dword [esp + 0x60], edx
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffe3
jge 0x1001a6d2
jmp 0x1001a74c
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a724
push ebx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a74c
push 0xbe7
push ebx
push ebx
push 0xce1
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1b
je 0x1001a666
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffef
jne 0x1001a651
inc dword [esp + 0x44]
cmp dword [esp + 0x44], 0x1d
je 0x1001a61c
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov dword [esp + eax*4 + 0xe4], 0xfffffff8
mov eax, dword [esp + 0x2c]
cmp eax, 1
mov eax, dword [esp + 0x20]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x134]
setl dl
mov dword [eax], edx
xor eax, eax
cmp edx, 0xcaa7
sete al
add eax, 0x71dc
je 0x1001a7c5
cmp dword [esp + 0x2c], ebx
je 0x1001a7c5
xor eax, eax
inc eax
jmp 0x1001a7c7
mov eax, ebx
dec eax
mov dword [esp + 0x90], eax
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jle 0x10019ce9
or dword [esp + 0x244], 0xffffffff
lea ecx, [esp + 0x134]
call fcn.1001748d
inc dword [esp + 0x20]
push 3
pop ecx
cmp dword [esp + 0x20], ecx
jle 0x10019a98
dec dword [esp + 0x2c]
jns 0x10019659
dec dword [esp + 0x34]
cmp dword [esp + 0x34], 0xfffffffc
jle 0x1001931f
mov esi, dword [esp + 0x5c]
push ebx
push 0x5f09
lea eax, [esp + 0x4a]
mov byte [esp + 0x4a], bl
push eax
push 0x5465
call fcn.1001cb31
mov dword [esp + 0x2c], 0xffff
lea ecx, [esp + 0x104]
mov dword [esp + 0x30], 0x874b28e
xor edi, edi
mov dword [esp + 0x6c], 0xf07c70ab
add esp, 0x10
mov dword [esp + 0x5c], ebx
inc edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], 0x714ffd81
mov dword [esp + 0x34], 0x74579933
mov dword [esp + 0x14], 0x5e495761
mov dword [esp + 0x24], 0xfffffffb
push 2
call fcn.1001740b
mov dword [esp + 0x28], 0x537c
mov dword [esp + 0x38], 0xfffffffc
push 2
mov dword [esp + 0x14], 0x6717
pop edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], ebx
jmp 0x1001a8c4
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x34]
cmp dword [esp + 0x34], edx
jl 0x1001a8b2
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x5c]
dec dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xf4]
cmp dword [eax + 4], ebx
je 0x1001a8fe
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0xf4]
mov dword [eax], edi
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a933
push 0x118b
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea ecx, [esp + 0xf4]
call fcn.1001748d
mov eax, esi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x48]
mov esi, edx
mov edi, eax
call fcn.10019091
mov ecx, dword [esp + 0x23c]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret