Function at 0x100182e2
Capabilities:
Check os version
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007bc23
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0x14], 0x834504cd
push edi
xor ecx, ecx
mov dword [esp + 0x34], ebx
mov edi, edx
mov dword [esp + 0x6c], edi
cmp dword [esp + 0x18], ecx
je 0x10018337
mov dword [esp + 0x1c], 7
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
jmp 0x1001847a
push 2
lea ecx, [esp + 0x118]
call fcn.10015fe6
xor edx, edx
mov dword [esp + 0x24], edx
jmp 0x10018363
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 0x11738ab6
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001834d
xor ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], edx
jl 0x1001846c
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], edx
jl 0x10018462
mov dword [esp + 0x24], 8
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], edx
jl 0x10018454
mov dword [esp + 0x20], 0x1c71bc7d
mov dword [esp + 0x20], edx
jmp 0x1001842d
mov dword [esp + 0x14], 0x7182b474
mov dword [esp + 0x14], edx
jmp 0x100183e2
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x100183da
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
xor edx, edx
inc ecx
mov eax, dword [esp + 0x20]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jle 0x100183c3
mov dword [esp + 0x14], edx
jmp 0x10018423
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x1001841f
push edx
push 0x851
push edx
push 0x223a
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawTextExW]
xor ecx, ecx
xor edx, edx
inc ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jle 0x100183ee
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jle 0x100183b5
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x1001844a
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor ecx, ecx
xor edx, edx
inc ecx
dec dword [esp + 0x24]
jns 0x100183a7
mov eax, dword [esp + 0x24]
dec dword [esp + 0x1c]
jns 0x10018391
dec dword [esp + 0x18]
jns 0x1001837b
lea ecx, [esp + 0x114]
call fcn.1001606b
xor ecx, ecx
mov dword [esp + 0x1c], 0x2c70bb74
mov eax, 0x961c0f80
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov dword [esp + 0x18], ecx
jmp 0x100184b8
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x110], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x100184a9
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], ecx
jl 0x100184e2
mov dword [esp + 0x48], 1
mov eax, dword [esp + 0x48]
mov dword [esp + 0xf0], eax
dec dword [esp + 0x1c]
jns 0x100184c9
push 0x5f4d
push ecx
lea eax, [esp + 0x67]
mov byte [esp + 0x67], cl
push eax
call fcn.100191e9
xor ecx, ecx
add esp, 0xc
cmp dword [ebx + 0x10], ecx
jne 0x10018507
xor al, al
jmp 0x1001900c
mov dword [esp + 0x30], 0x367f5ed9
mov dword [esp + 0x54], 0x9f6d4a0d
mov dword [esp + 0x44], 0xfffffff7
mov dword [esp + 0x40], 1
cmp dword [esp + 0x54], ecx
je 0x1001854c
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x54], ecx
cmp dword [esp + 0x54], ecx
je 0x1001854c
xor eax, eax
inc eax
jmp 0x1001854e
mov eax, ecx
mov dword [esp + 0x40], eax
xor edx, edx
mov dword [esp + 0x30], 0x8974b66
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x44]
cmp ecx, eax
mov ecx, dword [esp + 0x30]
setge dl
imul eax, edx, 0x4d07
sub ecx, eax
mov eax, dword [esp + 0x44]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, eax
mov eax, dword [esp + 0x44]
cmp ecx, eax
setle dl
cmp edx, dword [esp + 0x44]
jne 0x100185da
cmp dword [esp + 0x54], 0
jne 0x100185da
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x100185b0
mov edx, 0xb6
xor cl, cl
call fcn.10017e4d
mov dword [esp + 0x30], 0x1b
jmp 0x100185ce
mov dword [esp + 0x48], 0xfff7
mov dword [esp + 0x48], 0xddc4ea3c
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xf
jne 0x100185ba
jmp 0x1001866e
lea eax, [esp + 0x54]
mov dword [esp + 0x84], 0xffffffff
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0xa4], 0xfffffffa
push eax
push 0x21bf
lea eax, [esp + 0x50]
xor esi, esi
push eax
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0xb4]
push eax
push 0x720d
lea eax, [esp + 0x5c]
push esi
push eax
call fcn.1001be78
add esp, 0x24
mov dword [esp + 0x40], 0xffffffec
jmp 0x10018667
lea eax, [esp + 0x40]
mov dword [esp + 0x94], esi
push eax
lea eax, [esp + 0xa0]
mov dword [esp + 0xa0], 0x6014efc7
push eax
lea eax, [esp + 0x9c]
push esi
push eax
call fcn.1001ba51
add esp, 0x10
inc dword [esp + 0x40]
cmp dword [esp + 0x40], 5
jl 0x10018633
mov dword [esp + 0x30], 0
jmp 0x100186a8
push 0x3c20
push 0
lea eax, [esp + 0x98]
mov dword [esp + 0x98], 0x3620
push eax
lea eax, [esp + 0x4c]
push 0x2423
push eax
call fcn.1001bde4
add esp, 0x14
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0x16
jg 0x10018678
and dword [edi], 0
lea ecx, [esp + 0x70]
mov dword [esp + 0x3c], 2
mov dword [esp + 0x68], 1
mov dword [esp + 0x50], 0xfffffffb
mov dword [esp + 0x2c], 0xd0e75d
mov dword [esp + 0x64], 0xa2b82c44
mov dword [esp + 0x14], 0x5248
push 1
call fcn.10015fe6
xor eax, eax
mov dword [esp + 0x144], eax
push 0x1c6c
push eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x12c]
push eax
lea eax, [esp + 0x7c]
mov dword [esp + 0xb8], 0xfffffffd
push eax
call fcn.1001a698
mov eax, dword [esp + 0x4c]
add esp, 0x10
mov dword [esp + 0x68], eax
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x50]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x64], eax
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x14], 0x8e503485
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x70]
mov dword [eax], ecx
mov dword [esp + 0x2c], 0
cmp dword [esp + 0x2c], 0
jg 0x10018a28
mov dword [esp + 0x28], 0xf12afbca
mov dword [esp + 0xa4], 0xfffffff6
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x64]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x70]
mov dword [eax + ecx*4], edx
xor edx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x50]
cmp eax, ecx
mov eax, dword [esp + 0x64]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
sete cl
imul ecx, ecx, 0x6cad
sub ecx, eax
mov dword [esp + 0x68], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x50]
neg eax
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x70]
cmp dword [eax], 0xe0c80d67
je 0x100187f7
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
xor ebx, ebx
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x3c]
cmp dword [ecx + edx*4], eax
mov eax, dword [esp + 0x50]
setl bl
xor ecx, ecx
cmp ebx, eax
setge cl
mov dword [esp + 0x28], ecx
imul eax, dword [esp + 0x28], 0x906e
xor ebx, ebx
mov dword [esp + 0x50], eax
mov dword [esp + 0x28], ebx
jmp 0x10018a08
lea eax, [esp + 0x68]
mov dword [esp + 0x7c], 0xfffffffe
push eax
lea eax, [esp + 0x54]
mov dword [esp + 0x84], 0x8eb26348
push eax
push 0x4bb
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x38]
push eax
push 0x939
lea eax, [esp + 0x88]
push eax
push ebx
lea eax, [esp + 0x9c]
push eax
lea eax, [esp + 0xc8]
push eax
call fcn.1001a713
add esp, 0x28
mov dword [esp + 0x4c], ebx
cmp dword [esp + 0x4c], ebx
jl 0x10018a04
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x98], 0xb75e0bd0
mov dword [esp + 0x3c], ebx
cmp dword [esp + 0x3c], ebx
jl 0x100188d7
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100188d1
push 0x2b79
push 0x22d8
push 0x207c
push ebx
call fcn.10019161
add esp, 0x10
dec dword [esp + 0x3c]
jns 0x100188ae
mov dword [esp + 0x14], ebx
jmp 0x100189f0
mov dword [esp + 0x18], 0x16fbb122
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x4c], eax
jl 0x100188fa
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x28], eax
je 0x10018912
cmp dword [esp + 0x80], ebx
je 0x10018912
xor edx, edx
inc edx
jmp 0x10018914
mov edx, ebx
mov ecx, dword [esp + 0x28]
xor ebx, ebx
mov eax, dword [esp + 0x70]
cmp dword [eax + ecx*4], edx
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [esp + 0x70]
setl cl
cmp dword [eax + edx*4], ecx
jle 0x1001894f
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x70]
cmp dword [eax + ecx*4], 0
je 0x1001894f
xor edi, edi
inc edi
jmp 0x10018951
xor edi, edi
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov esi, dword [esp + 0x4c]
mov eax, dword [esp + 0x70]
cmp edi, dword [eax + ecx*4]
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x70]
cmp edx, dword [eax]
mov eax, dword [esp + 0x64]
setle cl
xor edx, edx
cmp ecx, 0xffffffff
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [esp + 0x7c]
setl bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [esp + 0x70]
setg cl
xor ebx, ebx
mov dword [eax + esi*4], ecx
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0xa4]
push eax
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x50]
push eax
push 0x163f
lea eax, [esp + 0x80]
push eax
push ebx
lea eax, [esp + 0x74]
push eax
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0x9c]
push eax
call fcn.1001aa2f
add esp, 0x30
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x100188e0
dec dword [esp + 0x4c]
jns 0x10018891
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ebx
jle 0x10018831
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], ebx
jle 0x10018779
mov ebx, dword [esp + 0x34]
mov edi, dword [esp + 0x6c]
or dword [esp + 0x144], 0xffffffff
lea ecx, [esp + 0x70]
call fcn.1001606b
cmp dword [ebx + 0x14], 0x10
jb 0x10018a43
mov esi, dword [ebx]
jmp 0x10018a45
mov esi, ebx
cmp dword [ebx + 0x14], 0x10
jb 0x10018a4f
mov ecx, dword [ebx]
jmp 0x10018a51
mov ecx, ebx
mov eax, dword [ebx + 0x10]
add eax, ecx
cmp esi, eax
je 0x10018e09
push 0
lea eax, [esp + 0xac]
mov dword [esp + 0xac], 0xb26bdde0
push eax
push 0xc7a
push 0x334e
call fcn.1001ad73
mov al, byte [esi]
add esp, 0x10
cmp al, 0x30
jl 0x10018bae
cmp al, 0x39
jg 0x10018bae
xor ecx, ecx
mov dword [esp + 0x38], 0x7e2799ac
mov dword [esp + 0x18], ecx
jmp 0x10018aba
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x100], 0xd19ac196
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10018aa7
mov dword [esp + 0x38], ecx
cmp dword [esp + 0x38], 0xffffffea
jl 0x10018b58
mov dword [esp + 0x58], 0x8b72fd49
mov dword [esp + 0x58], ecx
jmp 0x10018b2c
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x1c], 1
cmp dword [esp + 0x1c], ecx
jl 0x10018b24
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x10018b04
push ecx
call fcn.1001a9d7
pop ecx
xor ecx, ecx
mov byte [esp + 0x13], cl
cmp byte [esp + 0x13], 0
je 0x10018b1e
push ecx
push 0x5d4d
call fcn.1001a642
pop ecx
pop ecx
xor ecx, ecx
dec dword [esp + 0x1c]
jns 0x10018af0
mov eax, dword [esp + 0x58]
inc dword [esp + 0x58]
cmp dword [esp + 0x58], 0xe
jge 0x10018ade
lea eax, [esp + 0x38]
push eax
push ecx
lea eax, [esp + 0x60]
push eax
call fcn.1001a3ab
add esp, 0xc
dec dword [esp + 0x38]
cmp dword [esp + 0x38], 0xffffffea
push 0
pop ecx
jge 0x10018ad0
mov dword [esp + 0x38], 0xfffffff8
jmp 0x10018b94
mov dword [esp + 0x18], ecx
jmp 0x10018b7b
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x12c], 5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10018b68
mov eax, dword [esp + 0x100]
mov dword [esp + 0x130], eax
dec dword [esp + 0x38]
cmp dword [esp + 0x38], 0xffffffef
jl 0x10018b62
imul ecx, dword [edi], 0xa
movsx eax, byte [esi]
add eax, 0xffffffd0
add eax, ecx
inc esi
mov dword [edi], eax
jmp 0x10018a45
mov dword [esp + 0x1c], 0xfc07
lea ecx, [esp + 0xe0]
mov dword [esp + 0x48], 0x51da622a
mov dword [esp + 0x34], 0x40ed3c15
push 2
call fcn.10015fe6
mov dword [esp + 0x144], 1
lea ecx, [esp + 0xbc]
mov dword [esp + 0x18], 0xffffffff
push 2
call fcn.10015fe6
lea eax, [esp + 0xe0]
mov byte [esp + 0x144], 2
push eax
push 0x7603
push 0x5078
push 0x7b9f
xor ebx, ebx
lea eax, [esp + 0x70]
push ebx
push 0xaf5
push 0x3b2f
push 0x1ec5
push eax
call fcn.1001a46a
add esp, 0x24
mov dword [esp + 0x60], ebx
jmp 0x10018c4f
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0xbc]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x60]
cmp dword [esp + 0x60], 2
jl 0x10018c39
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0xe0]
push 4
pop edi
add edx, edi
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov dword [eax + 4], edx
mov eax, dword [esp + 0x1c]
cmp edx, eax
mov eax, dword [esp + 0xbc]
setl cl
xor edx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov esi, dword [eax + 4]
mov eax, dword [esp + 0x48]
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x1c]
setge cl
xor edx, edx
cmp eax, ecx
setge dl
sub edx, esi
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, esi
setge al
sub eax, dword [esp + 0x1c]
je 0x10018cd8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10018d57
push ebx
call fcn.1001a885
pop ecx
jmp 0x10018d57
mov dword [esp + 0x34], edi
lea ecx, [esp + 0xc8]
mov dword [esp + 0x34], 0xbde64f6c
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], 0x56095dbc
push 1
call fcn.10015fe6
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10018d1a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x120], 0x255ebda1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10018d07
mov dword [esp + 0x14], ebx
jmp 0x10018d3c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 0x9e4a0435
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10018d26
mov eax, dword [esp + 0xc8]
lea ecx, [esp + 0xc8]
inc dword [eax]
call fcn.1001606b
lea ecx, [esp + 0xbc]
call fcn.1001606b
or dword [esp + 0x144], 0xffffffff
lea ecx, [esp + 0xe0]
call fcn.1001606b
mov eax, dword [esp + 0x6c]
lea ecx, [esp + 0xd4]
push 3
pop esi
push esi
mov dword [eax], ebx
call fcn.10015fe6
push 0x24e6
push 0x1c12
lea eax, [esp + 0xdc]
mov dword [esp + 0x14c], esi
push eax
lea eax, [esp + 0x108]
mov dword [esp + 0x2c], 0x838a1f94
push eax
push ebx
push 0x3f5
call fcn.100190af
add esp, 0x18
mov dword [esp + 0x20], ebx
jmp 0x10018de0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], 0x4a53aa9a
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x10018dca
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10018df8
push ebx
call fcn.1001b2aa
pop ecx
lea ecx, [esp + 0xd4]
call fcn.1001606b
jmp 0x10018500
mov dword [esp + 0x24], 0xfe0a8eac
xor ebx, ebx
mov dword [esp + 0x6c], 1
mov dword [esp + 0x20], 6
mov dword [esp + 0x1c], 1
mov dword [esp + 0x34], ebx
mov dword [esp + 0x48], 0x2d4ad446
mov dword [esp + 0x18], ebx
jmp 0x10018e50
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x88], 0xd79339b8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10018e3d
mov dword [esp + 0x24], 0xd
cmp dword [esp + 0x24], 0xf
je 0x10019006
push 4
pop edi
or esi, 0xffffffff
mov dword [esp + 0x14], esi
mov dword [esp + 0x8c], 0x56979f9f
mov dword [esp + 0x18], ebx
jmp 0x10018e98
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x108], 0xf51b4373
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10018e85
inc dword [esp + 0x14]
cmp dword [esp + 0x20], ebx
jne 0x10018ead
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x14], ebx
je 0x10018f18
mov eax, dword [esp + 0x14]
mov ecx, 0xffff1a79
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x6c], eax
mov eax, dword [esp + 0x14]
sub ecx, eax
sub ecx, dword [esp + 0x6c]
add ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
cmp ecx, 0xffff
sbb eax, eax
neg eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x20]
jne 0x10018f0c
cmp dword [esp + 0x20], ebx
jne 0x10018f0c
mov eax, ebx
jmp 0x10018f0f
xor eax, eax
inc eax
neg eax
je 0x10018f18
xor ecx, ecx
inc ecx
jmp 0x10018f1a
mov ecx, ebx
mov eax, dword [esp + 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x88], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
sub eax, 3
je 0x10018f7c
mov dword [esp + 0x34], 1
lea edx, [esp + 0x8c]
mov dword [esp + 0x34], 0xbde6b786
mov cl, 1
mov dword [esp + 0x34], esi
mov dword [esp + 0x34], esi
call fcn.10017e4d
jmp 0x10018fe9
push 3
lea ecx, [esp + 0xb4]
call fcn.10015fe6
push 0x4290
lea eax, [esp + 0x12c]
mov dword [esp + 0x148], edi
push eax
lea eax, [esp + 0xb8]
push ebx
push eax
call fcn.1001b9d7
mov eax, dword [esp + 0xc0]
add esp, 0x10
cmp dword [eax], ebx
je 0x10018fcd
lea eax, [esp + 0x5e]
mov byte [esp + 0x5e], bl
push eax
push ebx
call fcn.1001b67c
pop ecx
pop ecx
jmp 0x10018fd6
cmp dword [esp + 0x108], ebx
jne 0x10018ffa
lea ecx, [esp + 0xb0]
mov dword [esp + 0x144], esi
call fcn.1001606b
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xf
jne 0x10018e70
jmp 0x10019006
lea ecx, [esp + 0xb0]
call fcn.1001606b
dec dword [esp + 0x48]
mov al, 1
mov ecx, dword [esp + 0x13c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret