Function at 0x10016b71
Capabilities:
Accept command line arguments
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10071021
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x378
push ebx
push esi
xor eax, eax
mov esi, ecx
mov ecx, dword [0x1182c784]
inc eax
push edi
mov edi, edx
mov dword [esp + 0x80], esi
xor ebx, ebx
mov dword [esp + 0x58], edi
mov dword [esp + 0x40], eax
test al, cl
jne 0x10016be5
or ecx, eax
mov dword [0x1182c784], ecx
mov dword [esp + 0x38c], ebx
call fcn.1001a502
push 0x100723ab
call fcn.1005960e
or dword [esp + 0x390], 0xffffffff
mov esi, dword [esp + 0x84]
pop ecx
imul eax, esi, 0x2710
add eax, edi
mov dword [esp + 0xe4], eax
lea eax, [esp + 0xe4]
push eax
call fcn.1001a56f
push 4
pop ecx
mov eax, dword [eax]
mov dword [esp + 0x30], 0x261f9c28
mov dword [esp + 0x20], 0x87cf2e56
mov dword [esp + 0x30], 0xdc345fe4
mov dword [esp + 0x1c], 0x87a5eafb
mov dword [esp + 0x30], 0x4c5530c4
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x44], 0x9baaa4f6
mov dword [esp + 0x48], 0x1bb39d90
mov dword [esp + 0x3c], eax
mov dword [esp + 0x24], ebx
jmp 0x10016c63
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x2d8], 0x29be1d92
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jl 0x10016c50
inc dword [esp + 0x44]
mov dword [esp + 0x1c], 8
cmp dword [esp + 0x1c], 0xffffffe2
push 3
pop edi
jle 0x10016e95
xor esi, esi
inc esi
push 2
lea ecx, [esp + 0xfc]
call fcn.1001a0d2
push edi
lea ecx, [esp + 0x12c]
mov dword [esp + 0x390], esi
call fcn.1001a0d2
mov byte [esp + 0x38c], 2
mov dword [esp + 0x48], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x10016cd4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x69b4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10016cbe
mov dword [esp + 0x18], ebx
jmp 0x10016cf7
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0xf65ce17c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10016ce1
mov eax, dword [esp + 0x2e4]
mov eax, dword [esp + 0xf8]
cmp dword [eax], ebx
jl 0x10016d20
mov dword [esp + 0x44], 6
inc dword [esp + 0x44]
jmp 0x10016e2e
push esi
lea ecx, [esp + 0x144]
call fcn.1001a0d2
mov dword [esp + 0x14], 0xdcbc3393
xor edx, edx
mov dword [esp + 0x44], 0xfffffff6
inc edx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x24], ebx
jmp 0x10016d5c
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jl 0x10016d4a
mov eax, dword [esp + 0xf8]
cmp dword [eax], ebx
je 0x10016d83
mov eax, dword [esp + 0x140]
xor ecx, ecx
cmp dword [eax], ebx
sete cl
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov edi, dword [esp + 0x128]
mov dword [esp + 0x2d8], ecx
mov esi, dword [eax + 4]
imul eax, ecx, 0x3d3b
add eax, 0xc330
sub eax, dword [edi + 8]
neg eax
sbb eax, eax
inc eax
cmp esi, eax
jl 0x10016dbc
mov eax, ebx
test esi, esi
je 0x10016dbe
mov eax, edx
mov dword [esp + 0x44], eax
cmp dword [esp + 0x44], ebx
je 0x10016dce
cmp dword [esp + 0x14], ebx
jne 0x10016dd0
mov edx, ebx
mov eax, dword [esp + 0x38]
xor esi, esi
sub edx, eax
inc esi
mov dword [esp + 0x44], edx
xor edx, edx
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x140]
cmp dword [eax], esi
mov eax, dword [esp + 0x38]
push dword [esp + 0x140]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [edi + 8]
setg cl
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x4c], eax
call fcn.10059948
pop ecx
push 3
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], ebx
pop edi
cmp dword [esp + 0x128], 0
je 0x10016e5a
push dword [esp + 0x128]
call fcn.10059948
pop ecx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
or dword [esp + 0x38c], 0xffffffff
push dword [esp + 0xf8]
call fcn.10059948
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe2
pop ecx
jg 0x10016c86
jmp 0x10016e98
xor esi, esi
inc esi
cmp dword [esp + 0x3c], 0
je 0x1001728e
push edi
lea ecx, [esp + 0x290]
call fcn.1001a0d2
mov dword [esp + 0x38c], edi
lea eax, [esp + 0x308]
push dword [esp + 0xa0]
movdqa xmm0, xmmword [0x10008220]
lea ecx, [esp + 0x138]
push eax
lea eax, [esp + 0x300]
mov dword [esp + 0x24], 0xd8d13034
push eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x50], 0x69d1fe9
mov dword [esp + 0x30], esi
push ebx
movdqu xmmword [esp + 0x308], xmm0
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], ebx
call fcn.1001fd59
push 4
pop eax
mov byte [esp + 0x38c], al
lea ecx, [esp + 0x110]
push dword [esp + 0xa0]
movdqa xmm0, xmmword [0x10008200]
lea eax, [esp + 0x2fc]
push eax
lea eax, [esp + 0x2f0]
mov dword [esp + 0x34], 0x975a1448
push eax
mov dword [esp + 0x20], 0x8b257695
push ebx
movdqu xmmword [esp + 0x2f8], xmm0
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
call fcn.1001fd59
mov byte [esp + 0x38c], 5
mov dword [esp + 0x28], ebx
jmp 0x10016fa5
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x28c]
mov dword [eax + ecx*4], 0x8885
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jl 0x10016f8f
mov dword [esp + 0x28], ebx
jmp 0x10016fc4
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x2cc], 0x60b0ceaf
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jl 0x10016fb1
mov dword [esp + 0x28], ebx
jmp 0x10016fe0
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x328], ebx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jl 0x10016fd1
mov esi, dword [esp + 0x28c]
xor edx, edx
inc edx
cmp dword [esi + 4], ebx
jne 0x10017053
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
cmp eax, dword [esi + 4]
jg 0x1001700a
mov ecx, ebx
cmp dword [esp + 0x44], ebx
je 0x1001700c
mov ecx, edx
mov eax, dword [esp + 0x24]
add eax, ecx
xor ecx, ecx
cmp eax, edi
mov eax, dword [esp + 0x134]
setge cl
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x2c], 0xfffffff9
sbb eax, eax
xor ecx, ecx
neg eax
sub eax, 0xcac2
cmp eax, 0xffffffff
setne cl
add ecx, dword [esp + 0x24]
cmp ecx, 0x675d
mov ecx, ebx
je 0x10017055
mov ecx, edx
mov eax, dword [esi + 4]
imul eax, ecx
imul eax, eax, 6
test eax, eax
jne 0x1001706a
mov eax, ebx
cmp dword [esp + 0x24], ebx
je 0x1001706c
mov eax, edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov edi, dword [esp + 0x134]
mov dword [esp + 0x2cc], eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
imul eax, dword [edi + 8]
sub eax, 0xfffffff7
neg eax
sbb eax, eax
add eax, 0x96c6c227
neg eax
sbb eax, eax
inc eax
cmp eax, edx
mov eax, dword [esp + 0x28c]
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
mov eax, dword [esp + 0x1c]
add ecx, 0x169df
imul eax, dword [esi + 4]
cmp eax, ecx
jne 0x100171ff
mov dword [esp + 0x14], 0xc2df100f
mov dword [esp + 0x44], edx
mov dword [esp + 0x2c], 0xffffffec
cmp dword [esp + 0x2c], 0xe
jg 0x10017172
jmp 0x100170eb
xor edx, edx
inc edx
push edx
lea ecx, [esp + 0x1a0]
call fcn.1001a0d2
xor edx, edx
mov dword [esp + 0x24], ebx
inc edx
jmp 0x10017117
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], 3
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jl 0x10017101
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x19c]
mov dword [eax], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017141
push ebx
push 0xa40
call dword [sym.imp.USER32.dll_GetWindowInfo]
push dword [esp + 0x19c]
call fcn.10059948
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], ebx
mov dword [esp + 0x1a8], ebx
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0xe
pop ecx
jle 0x100170e8
imul eax, dword [esp + 0x14], 0x1d19182a
mov ecx, dword [esp + 0x110]
mov dword [esp + 0x48], ecx
sub eax, dword [ecx + 8]
mov dword [esp + 0x44], eax
cmp dword [esp + 0x44], 3
mov eax, dword [esp + 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0xc0eb7447
setne al
xor ecx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x14]
cmp dword [edi + 8], eax
mov eax, dword [esp + 0x110]
setle cl
xor edx, edx
cmp ecx, dword [esp + 0x20]
setne dl
add edx, dword [eax]
je 0x100171da
mov eax, dword [esp + 0x134]
cmp dword [eax + 0xc], ebx
jne 0x100171de
mov dword [esp + 0x40], ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp dword [esp + 0x40], eax
mov eax, dword [esp + 0x48]
setg cl
mov dword [eax + 8], ecx
mov dword [esp + 0x330], 0x311489d4
jmp 0x1001724d
mov dword [esp + 0x20], 0xad05
mov dword [esp + 0x14], 0x2c4e
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x14]
mov byte [esp + 0x13], bl
je 0x1001722d
cmp byte [esp + 0x13], 0
je 0x1001724d
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
jmp 0x1001724d
cmp byte [esp + 0x13], 0
je 0x10017241
push 0x37a
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov eax, dword [esp + 0x110]
mov ecx, dword [edi + 8]
mov dword [eax], ecx
cmp dword [esp + 0x110], 0
je 0x10017264
push dword [esp + 0x110]
call fcn.10059948
pop ecx
push dword [esp + 0x134]
call fcn.10059948
pop ecx
push dword [esp + 0x28c]
call fcn.10059948
mov eax, dword [esp + 0x40]
pop ecx
mov dword [esp + 0x25c], eax
jmp 0x100194d5
mov eax, dword [0x1182c784]
test al, 2
jne 0x10017335
or eax, 2
mov dword [0x1182c784], eax
push ebx
mov dword [esp + 0x390], 6
push ebx
mov dword [0x1182c7c0], ebx
mov dword [0x1182c7c4], ebx
call fcn.1001e7e5
mov dword [0x1182c7c0], eax
mov dword [0x1182c7c8], ebx
mov dword [0x1182c7d0], ebx
mov byte [esp + 0x38c], 8
mov ecx, 0x1182c7c8
mov dword [esp + 0x268], eax
lea eax, [esp + 0x268]
push eax
push 0x10
push ebx
lea eax, [esp + 0xe4]
mov dword [0x1182c7dc], 0x3f800000
push eax
mov dword [0x1182c7cc], ebx
call fcn.1001e5bd
push 0x100723a6
mov dword [0x1182c7d4], 7
mov dword [0x1182c7d8], 8
call fcn.1005960e
or dword [esp + 0x390], 0xffffffff
pop ecx
mov dword [esp + 0x28], 2
xor esi, esi
inc esi
xor edx, edx
mov dword [esp + 0x18], esi
mov dword [esp + 0x2c], 0xef874ac
mov dword [esp + 0x4c], 9
mov dword [esp + 0x3c], 0xbd04657e
mov dword [esp + 0x30], edi
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, 0xfffffffa
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
test ecx, ecx
setg al
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x2c], ebx
jne 0x100173a4
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x28], ebx
jne 0x10017bfb
mov dword [esp + 0x20], 0x230e
cmp dword [esp + 0x20], 0xcce
jge 0x10017775
lea eax, [esp + 0x50]
push eax
lea eax, [esp + 0x58]
push eax
push 0x10007920
call fcn.10058e8b
add esp, 0xc
mov dword [esp + 0x22c], esi
lea eax, [esp + 0x22c]
mov dword [esp + 0xbc], ebx
lea ecx, [esp + 0xbc]
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
push eax
push dword [esp + 0x54]
call fcn.1001ac45
mov dword [esp + 0x38c], 9
lea eax, [esp + 0xbc]
push eax
push dword [esp + 0x58]
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x1d4], ebx
mov dword [esp + 0x1d8], ebx
mov dword [esp + 0x1dc], ebx
call fcn.1001ad30
mov byte [esp + 0x38c], 0xb
cmp dword [esp + 0xbc], 0
je 0x1001749f
push dword [esp + 0xbc]
call fcn.10059948
pop ecx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
lea eax, [esp + 0x214]
mov dword [esp + 0x214], ebx
push eax
push dword [esp + 0x54]
lea ecx, [esp + 0xb8]
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
call fcn.1001ac45
mov byte [esp + 0x38c], 0xc
lea eax, [esp + 0xb0]
push eax
push dword [esp + 0x58]
lea ecx, [esp + 0x228]
mov dword [esp + 0x228], ebx
mov dword [esp + 0x22c], ebx
mov dword [esp + 0x230], ebx
call fcn.1001ad30
cmp dword [esp + 0xb0], 0
je 0x10017534
push dword [esp + 0xb0]
call fcn.10059948
pop ecx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov esi, dword [esp + 0x54]
mov ecx, ebx
mov eax, dword [esp + 0x220]
mov edx, dword [esp + 0x50]
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x24], eax
test esi, esi
jle 0x10017598
mov dword [esp + 0x14], eax
mov edi, ebx
test edx, edx
jle 0x10017588
mov ebx, dword [esp + 0x14]
mov eax, dword [ebx]
lea eax, [eax + edi*4]
push eax
push 0x1000780c
call fcn.10058e8b
mov edx, dword [esp + 0x58]
inc edi
pop ecx
pop ecx
cmp edi, edx
jl 0x1001755f
mov esi, dword [esp + 0x54]
xor ebx, ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x3c]
inc ecx
add eax, 0xc
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], eax
cmp ecx, esi
jl 0x10017555
mov edi, dword [esp + 0x1cc]
mov dword [esp + 0x3c], ebx
test esi, esi
jle 0x10017638
mov ecx, dword [esp + 0x24]
mov eax, edi
sub ecx, edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
mov ecx, ebx
mov dword [esp + 0x1c], ecx
test edx, edx
jle 0x10017624
mov ebx, dword [esp + 0x20]
mov eax, dword [ebx + eax]
xor ebx, ebx
cmp dword [eax + ecx*4], ebx
jne 0x10017617
test esi, esi
jle 0x100175f7
mov edx, edi
mov edi, ebx
mov eax, dword [edx]
inc edi
lea edx, [edx + 0xc]
mov dword [eax + ecx*4], ebx
mov esi, dword [esp + 0x54]
cmp edi, esi
jl 0x100175db
mov edx, dword [esp + 0x50]
mov edi, dword [esp + 0x1cc]
mov ecx, ebx
test edx, edx
jle 0x10017613
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
mov dword [eax + ecx*4], ebx
inc ecx
mov edx, dword [esp + 0x50]
cmp ecx, edx
jl 0x10017601
mov esi, dword [esp + 0x54]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, edx
jl 0x100175c5
mov ecx, dword [esp + 0x3c]
add eax, 0xc
inc ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x3c], ecx
cmp ecx, esi
jl 0x100175bb
xor ecx, ecx
mov dword [esp + 0x2c], ebx
inc ecx
mov al, cl
mov byte [esp + 0x13], al
test esi, esi
jle 0x10017701
sub dword [esp + 0x24], edi
mov dword [esp + 0x1c], edi
test al, al
je 0x100176f4
mov dword [esp + 0x14], ebx
test edx, edx
jle 0x100176dd
test al, al
je 0x100176dd
mov ebx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
push 0
mov eax, dword [eax + ebx]
mov ebx, dword [esp + 0x18]
cmp dword [eax + ebx*4], ecx
pop ebx
jne 0x100176cc
mov dword [esp + 0x38], ebx
mov eax, edi
mov dword [esp + 0x3c], edi
mov ebx, dword [esp + 0x14]
mov eax, dword [eax]
push 0
cmp dword [eax + ebx*4], ecx
pop ebx
je 0x100176cc
mov eax, dword [esp + 0x3c]
inc dword [esp + 0x38]
add eax, 0xc
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x38], esi
jl 0x1001768a
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], ebx
mov eax, dword [eax]
cmp dword [eax], ecx
je 0x100176cc
inc dword [esp + 0x38]
add eax, 4
cmp dword [esp + 0x38], edx
jl 0x100176b7
mov byte [esp + 0x13], bl
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, edx
mov al, byte [esp + 0x13]
jl 0x10017665
inc dword [esp + 0x2c]
add dword [esp + 0x1c], 0xc
cmp dword [esp + 0x2c], esi
jl 0x10017655
test al, al
jne 0x10017701
push 0x100078d8
call fcn.10059c06
pop ecx
jmp 0x10017755
push 0x100078a0
call fcn.10059c06
cmp dword [esp + 0x58], 0
pop ecx
mov dword [esp + 0x3c], ebx
jle 0x10017755
cmp dword [esp + 0x50], 0
mov esi, ebx
jle 0x10017738
mov eax, dword [edi]
push dword [eax + esi*4]
push 0x100079d8
call fcn.100597a7
inc esi
pop ecx
pop ecx
cmp esi, dword [esp + 0x50]
jl 0x10017720
push 0x10007779
call fcn.10059c06
mov eax, dword [esp + 0x40]
add edi, 0xc
inc eax
pop ecx
mov dword [esp + 0x3c], eax
cmp eax, dword [esp + 0x54]
jl 0x10017717
lea ecx, [esp + 0x220]
call fcn.1001add2
or dword [esp + 0x38c], 0xffffffff
lea ecx, [esp + 0x1cc]
call fcn.1001add2
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0xc63b
mov dword [esp + 0x18], 0xfffffffc
jmp 0x10017b98
mov dword [esp + 0x38], 7
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x2c], ebx
jmp 0x10017b89
push 2
lea ecx, [esp + 0x8c]
call fcn.1001a0d2
mov dword [esp + 0x38c], 0xd
mov dword [esp + 0x24], ebx
jmp 0x100177e7
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x88]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x100177d1
mov dword [esp + 0x28], ebx
jmp 0x10017b42
mov dword [esp + 0x40], ebx
mov dword [esp + 0x3c], 0xfffffffc
mov dword [esp + 0x48], 0x13a3
cmp dword [esp + 0x48], 0x9e1
jge 0x1001796a
lea eax, [esp + 0x23c]
mov ecx, 0x10663d30
push eax
call fcn.10019717
mov edi, dword [esp + 0x23c]
lea ecx, [esp + 0x16c]
push edi
call fcn.1001a0d2
mov byte [esp + 0x38c], 0xe
test edi, edi
jle 0x10017867
mov esi, dword [esp + 0x16c]
mov ebx, edi
push esi
mov ecx, 0x10663d30
call fcn.10019717
push 4
pop eax
add esi, eax
dec ebx
jne 0x10017854
mov esi, ebx
mov dword [esp + 0x3c], esi
test edi, edi
jle 0x10017930
mov dword [esp + 0x21c], ebx
lea eax, [esp + 0x21c]
mov dword [esp + 0x14c], ebx
push eax
push edi
lea ecx, [esp + 0x154]
mov dword [esp + 0x158], ebx
mov dword [esp + 0x15c], ebx
call fcn.1001ac45
mov eax, esi
mov byte [esp + 0x38c], 0xf
mov ecx, esi
shl eax, 2
mov esi, dword [esp + 0x14c]
cmp dword [esi + eax], 2
jge 0x100178dd
mov ebx, dword [esp + 0x16c]
inc dword [esi + eax]
mov ecx, dword [ebx + eax]
dec ecx
mov eax, ecx
shl eax, 2
cmp dword [esi + eax], 2
jl 0x100178c9
xor ebx, ebx
lea eax, [ecx + 1]
mov ecx, 0x10663c78
push eax
call fcn.10019c69
mov edx, 0x100079c0
mov ecx, eax
call fcn.1001ead8
mov byte [esp + 0x38c], 0xe
test esi, esi
je 0x1001791f
push esi
call fcn.10059948
pop ecx
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
mov esi, dword [esp + 0x3c]
inc esi
mov dword [esp + 0x3c], esi
cmp esi, edi
jl 0x1001787c
push 0x10663c78
call fcn.1001ea64
mov byte [esp + 0x390], 0xd
mov eax, dword [esp + 0x170]
pop ecx
test eax, eax
je 0x1001796a
push eax
call fcn.10059948
pop ecx
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x40], 1
cmp dword [esp + 0x40], ebx
jl 0x10017b3e
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x3c], 0x21c653c2
mov dword [esp + 0x1c], 1
cmp dword [esp + 0x1c], ebx
jl 0x10017b34
mov esi, dword [esp + 0x88]
mov dword [esp + 0x48], esi
push 4
mov dword [esp + 0x28], ebx
pop ecx
jmp 0x100179c9
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x348], 0xc12abb1e
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jl 0x100179b6
mov eax, dword [esp + 0x40]
xor edx, edx
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x88]
cmp dword [ecx + esi*4], eax
mov eax, dword [esp + 0x88]
setg dl
xor ecx, ecx
cmp edx, dword [eax + edi*4]
setg cl
xor edx, edx
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setne dl
xor edi, edi
imul edx, dword [esp + 0x4c]
inc edi
mov dword [esp + 0x24], edx
xor edx, edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x88]
cmp dword [eax + ecx*4], edi
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x48]
setl dl
imul eax, edx
cmp eax, dword [ecx + 4]
jg 0x10017a74
cmp dword [esp + 0x34c], ebx
je 0x10017a7e
mov dword [esp + 0x44], edi
cmp dword [esp + 0x38], ebx
jne 0x10017a82
mov dword [esp + 0x44], ebx
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x88]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x3c], eax
mov esi, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
sub edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
sub edx, 0xdc50
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x88]
setne dl
xor ecx, ecx
cmp dword [eax + esi*4], edx
mov esi, dword [esp + 0x48]
setge cl
mov dword [esp + 0x3c], ecx
mov eax, dword [esp + 0x3c]
sub eax, dword [esi + 4]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x3c], eax
cmp dword [esp + 0x38], ebx
jne 0x10017aff
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x40], ebx
jne 0x10017aff
cmp dword [esi + 4], ebx
jne 0x10017aff
mov edi, ebx
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x30]
mov eax, dword [esp + 0x88]
sub edx, 0x11c7dc5e
neg edx
sbb edx, edx
xor ecx, ecx
mov dword [eax], edi
inc edx
mov eax, dword [esp + 0x24]
cmp eax, edx
setg cl
mov dword [esp + 0x3c], ecx
dec dword [esp + 0x1c]
jns 0x100179ad
dec dword [esp + 0x40]
jns 0x1001797c
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xffffffe7
jl 0x100177f7
dec dword [esp + 0x20]
or dword [esp + 0x38c], 0xffffffff
cmp dword [esp + 0x88], 0
je 0x10017b85
push dword [esp + 0x88]
call fcn.10059948
pop ecx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
dec dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0xffffffe5
je 0x100177b2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x2b
jl 0x10017795
xor esi, esi
inc esi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017bb9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 4
xorps xmm0, xmm0
lea ecx, [esp + 0x17c]
movdqu xmmword [esp + 0x250], xmm0
pop eax
mov dword [esp + 0x14], 0xa065
mov dword [esp + 0x20], 0xeb64d07d
push eax
call fcn.1001a0d2
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x30], 0xfffffff7
mov dword [esp + 0x18], ebx
jmp 0x10017c5b
mov dword [esp + 0x4c], 0xfffffff6
cmp dword [esp + 0x18], ebx
jne 0x10017c28
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
push 4
pop ecx
sub eax, ecx
xor ecx, ecx
cmp eax, 5
mov eax, ebx
setl cl
cmp ecx, 0x90e36f36
jne 0x10017c2a
mov eax, esi
mov ecx, 0xfffc
cmp ecx, eax
mov eax, dword [esp + 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
neg edx
cmp edx, eax
setge cl
mov dword [esp + 0x2c], ecx
jmp 0x10017ba6
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x64], 0x36de
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10017c4b
push 4
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10017c81
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10017c6b
mov eax, dword [esp + 0x68]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jne 0x10017ccc
mov eax, dword [esp + 0x64]
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x68]
mov dword [esp + 0x20], eax
imul eax, dword [esp + 0x20], 7
cmp eax, 7
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xffffffff
mov ecx, ebx
jb 0x10017cce
mov ecx, esi
mov eax, dword [esp + 0x68]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x64]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x8bbd188
setg al
xor edx, edx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x68]
cmp dword [esp + 0x30], eax
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x178]
setl dl
imul ecx, edx
mov dword [eax], ecx
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x68]
push dword [esp + 0x178]
mov dword [esp + 0x34], esi
call fcn.10059948
pop ecx
lea eax, [esp + 0x80]
mov dword [esp + 0x178], ebx
push eax
mov dword [esp + 0x180], ebx
mov dword [esp + 0x184], ebx
call fcn.1001a5d1
push 2
lea ecx, [esp + 0x120]
mov edi, dword [eax]
mov dword [esp + 0x30], 0xb110c93b
mov dword [esp + 0x28], edi
call fcn.1001a0d2
mov dword [esp + 0x30], 0xfffffff7
mov dword [esp + 0x14], ebx
jmp 0x10017d97
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10017d81
push 4
mov dword [esp + 0x30], ebx
pop eax
cmp dword [esp + 0x2c], eax
jg 0x10017e0f
mov edi, dword [esp + 0x11c]
push eax
pop ebx
mov dword [esp + 0x20], 0xfffffffc
xor edx, edx
mov dword [esp + 0x4c], 0xfe012d2c
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setne dl
imul eax, dword [esp + 0x2c]
mov dword [esp + 0x30], edx
xor edx, edx
sub eax, dword [esp + 0x2c]
cmp dword [esp + 0x30], eax
mov eax, dword [esp + 0x4c]
setne dl
xor ecx, ecx
cmp edx, eax
mov dword [edi + 4], edx
setl cl
mov dword [esp + 0x30], ecx
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], ebx
jle 0x10017db4
mov edi, dword [esp + 0x24]
xor ebx, ebx
cmp dword [esp + 0x11c], 0
je 0x10017e3b
push dword [esp + 0x11c]
call fcn.10059948
pop ecx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov al, byte [ebp + 0xc]
test al, al
jne 0x10017e4a
test edi, edi
jne 0x10018156
lea ecx, [esp + 0x360]
mov dl, al
push ecx
mov ecx, dword [esp + 0x84]
call fcn.10009d7c
mov esi, eax
lea edi, [esp + 0x250]
pop ecx
push 2
lea ecx, [esp + 0x1b8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
inc esi
pop edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], 0xcae7bf19
push edi
call fcn.1001a0d2
mov dword [esp + 0x20], 0xfe3d2f55
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x1c], 0xfffffff7
mov dword [esp + 0x14], ebx
jmp 0x10017ec1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1b4]
mov dword [eax + ecx*4], 0x64939e63
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10017eab
cmp dword [esp + 0x18], ebx
jne 0x10017ed1
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
dec eax
neg eax
sbb eax, eax
inc eax
sub eax, 0x6917900f
je 0x10017ee8
cmp dword [esp + 0x18], ebx
jne 0x10017ef0
mov eax, ebx
cmp dword [esp + 0x18], ebx
je 0x10017ef2
mov eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1b4]
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], 0xf6b903cf
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
xor edx, edx
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp edx, eax
mov eax, dword [esp + 0x18]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
push dword [esp + 0x1b4]
setge dl
neg edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
call fcn.10059948
cmp byte [ebp + 0xc], 0
pop ecx
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x1b8], ebx
mov dword [esp + 0x1bc], ebx
je 0x10018152
cmp dword [esp + 0x254], 0
je 0x10018152
mov dword [esp + 0x30], 0x78948018
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017fbf
push ebx
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10018007
push 0xa6f
push 0x5d5
push 0x1353
push 0x780
push 0x1d71
push 0x2578
push 0x1b41
push 0x345
push 0x150
push 0x21ad
push 0x1970
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x258]
mov dword [esp + 0x260], eax
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0xfffffff8
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0xe1265ab3
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0xfffffff7
push 0xfffffffffffffffb
pop ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x30], 0xfffffffa
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x230]
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0x7fe64fd9
mov dword [esp + 0x30], 0x18e418a5
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0xb58e17c1
mov dword [esp + 0x30], 3
mov dword [esp + 0x30], edi
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0xfffffffc
mov dword [esp + 0x30], 0x3f6085e0
mov dword [esp + 0x30], 0x13d0bb94
mov dword [esp + 0x30], 9
mov dword [esp + 0x30], 0x9e071a05
mov dword [esp + 0x30], 0xa130dfdd
mov dword [esp + 0x30], 0xbf58
mov dword [esp + 0x30], 0xc6dd3ed2
mov dword [esp + 0x30], ebx
push eax
call fcn.1001a0d2
xor edx, edx
inc edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x18], ebx
jmp 0x100180f4
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x358], 6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x100180e1
mov dword [esp + 0x18], ebx
jmp 0x10018116
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x230]
mov dword [eax + ecx*4], 0x6496
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10018100
mov eax, dword [esp + 0x230]
push eax
dec dword [eax]
call fcn.10059948
mov eax, dword [esp + 0x258]
xor esi, esi
pop ecx
mov dword [esp + 0x230], ebx
inc esi
mov dword [esp + 0x234], ebx
mov dword [esp + 0x238], ebx
mov dword [esp + 0x264], eax
mov edi, dword [esp + 0x24]
push 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x10018176
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x370], 0xc85f70ad
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10018163
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], ebx
jl 0x100181b6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001819b
call dword [sym.imp.USER32.dll_GetCapture]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100181ad
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
dec dword [esp + 0x14]
jns 0x1001818a
push 4
pop ecx
test edi, edi
jne 0x10018cd7
cmp dword [esp + 0x24c], edi
jle 0x10018cd7
push ecx
mov dword [esp + 0x18], 0xa065
lea ecx, [esp + 0x194]
mov dword [esp + 0x24], 0xeb64d07d
call fcn.1001a0d2
mov dword [esp + 0x38c], 0x10
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x30], 0xfffffff7
mov dword [esp + 0x18], ebx
jmp 0x10018219
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x5c], 0x36de
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10018209
mov dword [esp + 0x30], 0x1ef7
cmp dword [esp + 0x30], 0x986
jge 0x10018380
lea eax, [esp + 0x7c]
push eax
push 0x10007810
call fcn.10058e8b
pop ecx
jmp 0x1001836e
dec eax
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x200]
push eax
lea eax, [esp + 0x70]
push eax
push 0x1000797c
call fcn.10058e8b
add esp, 0xc
lea ecx, [esp + 0x184]
push dword [esp + 0x6c]
call fcn.1001a0d2
cmp dword [esp + 0x6c], 0
mov edi, ebx
mov dword [esp + 0x14], ebx
jle 0x100182d3
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x184]
mov ecx, ebx
mov dword [esp + 0x48], ebx
push ecx
push 0x10007810
call fcn.10058e8b
mov edx, dword [esp + 0x28]
pop ecx
pop ecx
mov ecx, dword [esp + 0x48]
mov eax, dword [ecx]
cmp eax, dword [edx + ebx]
jge 0x100182c1
mov eax, edi
mov dword [esp + 0x14], edi
shl eax, 2
mov dword [esp + 0x20], eax
push 4
pop eax
inc edi
add ecx, eax
mov dword [esp + 0x48], ecx
cmp edi, dword [esp + 0x6c]
jl 0x10018298
xor ebx, ebx
mov edi, dword [esp + 0x6c]
xorps xmm0, xmm0
movlpd qword [esp + 0x30], xmm0
mov ecx, ebx
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x30]
test edi, edi
jle 0x10018339
mov ebx, dword [esp + 0x184]
mov dword [esp + 0x1c], edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
cmp ecx, edx
je 0x1001832e
mov eax, dword [esp + 0x200]
sub eax, dword [ebx + ecx*4]
mov edi, dword [esp + 0x14]
cdq
idiv dword [ebx + edi*4]
mov edi, dword [esp + 0x6c]
cdq
add dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
adc eax, edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x20], eax
inc ecx
cmp ecx, edi
jl 0x10018301
mov edx, dword [esp + 0x1c]
xor ebx, ebx
push eax
push edx
push 0x10007848
call fcn.100597a7
mov eax, dword [esp + 0x190]
add esp, 0xc
test eax, eax
je 0x1001836f
push eax
call fcn.10059948
mov dword [esp + 0x188], ebx
mov dword [esp + 0x18c], ebx
mov dword [esp + 0x190], ebx
pop ecx
mov eax, dword [esp + 0x7c]
test eax, eax
jne 0x1001824b
dec eax
mov dword [esp + 0x7c], eax
push 4
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x1001839f
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10018389
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jne 0x100183ea
mov eax, dword [esp + 0x5c]
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x20], eax
imul eax, dword [esp + 0x20], 7
cmp eax, 7
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xffffffff
mov ecx, ebx
jb 0x100183ec
mov ecx, esi
mov eax, dword [esp + 0x60]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x5c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x60]
setle cl
xor edx, edx
cmp ecx, 0x8bbd188
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x60]
imul ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x190]
mov dword [eax], ecx
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x30], esi
or dword [esp + 0x38c], 0xffffffff
push dword [esp + 0x190]
call fcn.10059948
mov dword [esp + 0x194], ebx
mov dword [esp + 0x198], ebx
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x34], 0x168d
cmp dword [esp + 0x34], 0x1160
pop ecx
jge 0x10018585
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x80]
push eax
push 0x100079c4
call fcn.10058e8b
mov eax, dword [esp + 0x88]
xor ecx, ecx
push 4
pop edx
mul edx
mov edi, ebx
mov dword [esp + 0x5c], edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10052d07
mov ecx, eax
mov dword [esp + 0x44], ebx
mov eax, dword [esp + 0x8c]
add esp, 0x14
mov dword [esp + 0x20], ecx
test eax, eax
jle 0x10018508
mov ebx, ecx
push ebx
push 0x1000780c
call fcn.10058e8b
pop ecx
pop ecx
push 4
pop eax
add ebx, eax
inc edi
mov eax, dword [esp + 0x78]
cmp edi, eax
jl 0x100184e3
mov edi, dword [esp + 0x4c]
xor ebx, ebx
mov ecx, dword [esp + 0x20]
lea edx, [ecx + eax*4]
mov byte [esp + 0x208], bl
push dword [esp + 0x208]
mov eax, edx
sub eax, ecx
sar eax, 2
push eax
call fcn.100206d7
pop ecx
pop ecx
mov ecx, dword [esp + 0x94]
cmp ecx, dword [esp + 0xf4]
jle 0x10018578
mov edi, dword [esp + 0x78]
sub ecx, dword [esp + 0xf4]
mov dword [esp + 0x94], ecx
lea edx, [edi - 1]
test edx, edx
js 0x1001856d
mov ebx, dword [esp + 0x20]
mov eax, esi
push 0
sub eax, dword [ebx + edx*4]
add ecx, eax
mov dword [esp + 0x98], ecx
pop ebx
test ecx, ecx
jle 0x10018571
dec edx
jns 0x10018551
test ecx, ecx
jg 0x10018575
sub edi, edx
jmp 0x10018578
or edi, 0xffffffff
push edi
push 0x10007894
call fcn.100597a7
pop ecx
pop ecx
mov dword [esp + 0x30], 0x16e2
cmp dword [esp + 0x30], 0x8d5
jge 0x10018665
lea eax, [esp + 0x158]
push eax
push ecx
lea eax, [esp + 0xa0]
mov ecx, 0x10663d30
push eax
call fcn.1001996c
pop ecx
mov ecx, eax
call fcn.1001996c
mov edi, dword [esp + 0x98]
mov ecx, edi
sub ecx, dword [esp + 0x158]
mov eax, dword [esp + 0x9c]
sbb eax, dword [esp + 0x15c]
push ebx
push 0xa
push eax
push ecx
mov dword [esp + 0x30], edi
call fcn.10070580
or eax, edx
je 0x1001863e
push ebx
push 0xa
push dword [esp + 0xa4]
push edi
call fcn.10070580
or eax, edx
je 0x10018637
mov eax, dword [esp + 0x20]
cdq
add edi, eax
mov eax, dword [esp + 0x9c]
mov ecx, edi
adc eax, edx
sub ecx, dword [esp + 0x158]
push ebx
mov dword [esp + 0xa0], eax
sbb eax, dword [esp + 0x160]
push 0xa
push eax
push ecx
call fcn.10070580
or eax, edx
jne 0x100185ee
mov dword [esp + 0x98], edi
mov eax, dword [esp + 0x20]
cdq
push edx
push eax
push dword [esp + 0xa4]
push edi
call fcn.100704d0
push edx
push eax
mov ecx, 0x10663c78
call fcn.10019e8d
push eax
call fcn.1001ea64
pop ecx
movdqa xmm0, xmmword [0x10008240]
lea eax, [esp + 0x328]
push 3
pop edi
push dword [esp + 0xd8]
mov dword [esp + 0x20], edi
lea ecx, [esp + 0xcc]
push eax
lea eax, [esp + 0x320]
mov dword [esp + 0x1c], 5
push eax
push ebx
movdqu xmmword [esp + 0x328], xmm0
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
call fcn.1001fd59
push edi
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x390], 0x11
call fcn.1001a0d2
push esi
lea ecx, [esp + 0x244]
mov byte [esp + 0x390], 0x12
call fcn.1001a0d2
mov dword [esp + 0x28], ebx
jmp 0x10018707
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], 0x75d5f8d9
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jl 0x100186f1
xor edx, edx
mov dword [esp + 0x28], ebx
inc edx
jmp 0x1001872c
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x240]
mov dword [eax + ecx*4], 0xac895352
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edx
jl 0x10018716
mov dword [esp + 0x28], ebx
jmp 0x1001874b
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x334], 0x8700d35
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jl 0x10018738
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001876a
push 0x1af8
call dword [sym.imp.USER32.dll_MessageBeep]
xor edx, edx
inc edx
mov dword [esp + 0x1c], 0x720e
cmp dword [esp + 0x1c], ebx
jne 0x10018799
mov eax, dword [esp + 0x1c]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
add ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc8]
mov dword [eax + 8], ecx
mov eax, dword [esp + 0x1a8]
mov dword [eax + 8], ebx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x240]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xffffffff
jae 0x100187c4
cmp dword [ecx], ebx
jne 0x100187c6
mov edx, ebx
push 4
pop eax
cmp eax, edx
sbb eax, eax
inc eax
mov dword [esp + 0x334], eax
test ecx, ecx
je 0x100187f5
push ecx
call fcn.10059948
pop ecx
mov dword [esp + 0x240], ebx
mov dword [esp + 0x244], ebx
mov dword [esp + 0x248], ebx
push dword [esp + 0x1a8]
call fcn.10059948
or dword [esp + 0x390], 0xffffffff
cmp dword [esp + 0xcc], 0
pop ecx
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1ac], ebx
mov dword [esp + 0x1b0], ebx
je 0x1001884b
push dword [esp + 0xc8]
call fcn.10059948
pop ecx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov eax, 0x2db8e964
mov dword [esp + 0x26c], eax
mov dword [esp + 0x270], eax
mov dword [esp + 0x274], eax
mov dword [esp + 0x278], eax
push 2
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
pop ecx
jmp 0x10018889
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x70], 0xe0648261
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x10018879
mov dword [esp + 0x18], ebx
jmp 0x100188a4
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x298], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x10018895
mov dword [esp + 0x70], ebx
jmp 0x10018a37
xor esi, esi
mov dword [esp + 0x4c], 0xa5b7
inc esi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x48], 0xffffffff
lea ecx, [esp + 0x1c0]
push esi
call fcn.1001a0d2
mov dword [esp + 0x38c], 0x13
lea ecx, [esp + 0x160]
push 4
mov dword [esp + 0x24], esi
pop eax
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x20], 0x7a5eafb5
mov dword [esp + 0x3c], eax
push 2
call fcn.1001a0d2
xor edx, edx
mov dword [esp + 0x14], 0x23703acb
mov dword [esp + 0x18], ebx
inc edx
jmp 0x10018932
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c0]
mov dword [eax + ecx*4], 0xca27
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001891c
mov dword [esp + 0x18], ebx
jmp 0x10018954
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0x40e13f5e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001893e
mov eax, dword [esp + 0x74]
xor edx, edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x160]
mov dword [eax + 4], ecx
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x274]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x4c]
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setle dl
sub eax, 0xa103363
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
mov eax, dword [esp + 0x1c0]
setle cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [esp + 0x48]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [esp + 0x1c]
mov dword [esp + 0x26c], ecx
mov dword [esp + 0x20], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100189e7
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
push dword [esp + 0x160]
call fcn.10059948
or dword [esp + 0x390], 0xffffffff
pop ecx
push dword [esp + 0x1c0]
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ebx
call fcn.10059948
mov dword [esp + 0x1c4], ebx
mov dword [esp + 0x1c8], ebx
mov dword [esp + 0x1cc], ebx
inc dword [esp + 0x74]
pop ecx
cmp dword [esp + 0x70], 0x17
jg 0x100188b3
mov eax, dword [esp + 0x70]
xor edx, edx
mov eax, dword [esp + 0x298]
mov ecx, dword [esp + 0x29c]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x26c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x70]
setge cl
xor edx, edx
cmp ecx, 0xc7d75752
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x26c]
setle cl
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov ecx, dword [esp + 0x250]
setne dl
mov dword [esp + 0x70], edx
test ecx, ecx
je 0x10018cd3
call fcn.10016b40
push dword [esp + 0xd8]
movdqa xmm0, xmmword [0x100081d0]
lea ecx, [esp + 0x108]
mov edi, eax
mov dword [esp + 0x20], 0x5d6c05ba
lea eax, [esp + 0x31c]
mov dword [esp + 0x34], ebx
push eax
lea eax, [esp + 0x310]
mov dword [esp + 0x10c], ebx
push eax
push ebx
movdqu xmmword [esp + 0x318], xmm0
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
call fcn.1001fd59
mov dword [esp + 0x38c], 0x14
mov dword [esp + 0x1c], 0xffffffe6
cmp dword [esp + 0x1c], 0xd
jg 0x10018c8e
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], 0x3248c66
mov dword [esp + 0x27c], ebx
mov dword [esp + 0x280], ebx
mov dword [esp + 0x284], ebx
mov dword [esp + 0x288], ebx
mov dword [esp + 0x38], 0x653b
mov dword [esp + 0x30], ebx
mov dword [esp + 0x14], ebx
jmp 0x10018b71
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2d4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10018b5e
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jg 0x10018c7f
mov dword [esp + 0x30], ecx
mov dword [esp + 0x4c], 0x6fe23a26
mov dword [esp + 0x4c], 0x65256810
push ecx
mov dword [esp + 0x24], 0xfffffff8
lea ecx, [esp + 0x1dc]
mov dword [esp + 0x24], 3
call fcn.1001a0d2
xor edx, edx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10018bdd
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1d8]
mov dword [eax + ecx*4], 0xa9bca7b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10018bc7
mov eax, dword [esp + 0x30]
neg eax
mov dword [esp + 0x288], eax
je 0x10018bfa
dec dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x288], eax
jge 0x10018c14
cmp dword [esp + 0x288], ebx
je 0x10018c1a
cmp dword [esp + 0x20], ebx
jne 0x10018c1c
mov edx, ebx
xor eax, eax
cmp edx, 0x7d6c5051
setge al
mov dword [esp + 0x30], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10018c42
push 0x12f2
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
cmp dword [esp + 0x1d8], 0
je 0x10018c6e
push dword [esp + 0x1d8]
call fcn.10059948
pop ecx
mov dword [esp + 0x1d8], ebx
mov dword [esp + 0x1dc], ebx
mov dword [esp + 0x1e0], ebx
inc dword [esp + 0x24]
push 1
pop ecx
cmp dword [esp + 0x24], ebx
jle 0x10018b85
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xd
jle 0x10018b28
or dword [esp + 0x38c], 0xffffffff
cmp dword [esp + 0x104], 0
je 0x10018cc2
push dword [esp + 0x104]
call fcn.10059948
pop ecx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
lea eax, [esp + 0x80]
push eax
call fcn.1001a5d1
mov dword [eax], edi
jmp 0x10018cd7
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x24c]
call fcn.10013027
mov dword [esp + 0x30], 0xea75c96d
xor esi, esi
mov dword [esp + 0x30], 0xffffffff
inc esi
mov dword [esp + 0x30], 0xb108f825
mov dword [esp + 0x30], 0x2d4ea680
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0x61be360d
mov dword [esp + 0x20], 0x4a6b2c4e
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 2
jge 0x10018d36
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x340], esi
inc dword [esp + 0x14]
jmp 0x10018d1e
inc dword [esp + 0x20]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10018d51
push ebx
push 0xc45
call dword [sym.imp.USER32.dll_RemovePropA]
test edi, edi
je 0x100194a3
push 4
pop eax
push eax
lea ecx, [esp + 0x1e8]
call fcn.1001a0d2
mov dword [esp + 0x30], 0x16e0
cmp dword [esp + 0x30], 0x603
jge 0x10018eec
lea eax, [esp + 0x84]
push eax
push 0x10007810
call fcn.10058e8b
mov eax, dword [esp + 0x8c]
pop ecx
pop ecx
test eax, eax
je 0x10018ee4
dec eax
mov dword [esp + 0x84], eax
lea eax, [esp + 0xe8]
push eax
lea eax, [esp + 0x214]
push eax
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x224]
push eax
push 0x1000796c
call fcn.10058e8b
add esp, 0x14
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x20c]
push eax
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0xe4]
push eax
lea eax, [esp + 0x100]
push eax
push 0x100079dc
call fcn.10058e8b
mov eax, dword [esp + 0xf8]
add esp, 0x1c
mov esi, dword [esp + 0x218]
mov cl, 1
mov edx, dword [esp + 0xec]
sub eax, esi
add edx, eax
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0xec], edx
cmp edx, eax
jl 0x10018e4a
cmp edx, dword [esp + 0xe0]
jle 0x10018e4c
mov cl, bl
cmp esi, dword [esp + 0xdc]
jne 0x10018e68
cmp eax, dword [esp + 0xe0]
jne 0x10018e68
xor eax, eax
movzx ecx, cl
test esi, esi
cmovg ecx, eax
mov eax, dword [esp + 0xe8]
mov esi, dword [esp + 0x210]
sub eax, esi
mov edx, dword [esp + 0xd4]
add edx, eax
mov eax, dword [esp + 0x204]
mov dword [esp + 0xd4], edx
cmp edx, eax
jl 0x10018e9c
cmp edx, dword [esp + 0xf0]
jle 0x10018e9e
mov cl, bl
cmp esi, dword [esp + 0xe8]
jne 0x10018ebc
cmp eax, dword [esp + 0xf0]
jne 0x10018ebc
movzx eax, cl
xor ecx, ecx
test esi, esi
cmovg eax, ecx
mov cl, al
test cl, cl
mov edx, 0x100079f8
mov eax, 0x100079f4
cmove eax, edx
push eax
call fcn.10059c06
mov eax, dword [esp + 0x88]
pop ecx
test eax, eax
jne 0x10018da2
xor esi, esi
inc esi
dec eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x18], ebx
jmp 0x10018f05
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x2b0], 0x64a6847d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10018ef2
push 4
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10018f27
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1e4]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10018f15
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10018f3e
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov esi, dword [esp + 0x1e4]
push 2
pop edx
mov dword [esi + 0xc], edx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x14], ebx
jmp 0x10018f6c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1f0], 7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10018f59
mov dword [esp + 0x1f4], ebx
jmp 0x100190f2
mov dword [esp + 0x1c], 0xf90edcad
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], ebx
jl 0x100190dc
mov dword [esp + 0x24], 0xffffffff
push 4
pop eax
mov dword [esp + 0x2bc], eax
mov dword [esp + 0x2c0], eax
mov dword [esp + 0x2c4], eax
mov dword [esp + 0x2c8], eax
mov dword [esp + 0x20], 0x57440e70
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10018fdf
push ebx
push ebx
push 0x1d31
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 2
pop edx
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], ebx
jl 0x100190c3
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x30], 0x42506ed5
mov dword [esp + 0x2c], ebx
jmp 0x100190af
xor ecx, ecx
mov dword [esp + 0x30], 9
mov dword [esp + 0x14], ebx
inc ecx
jmp 0x1001902a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x20c], 0xfffffff8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10019017
mov eax, dword [esp + 0x2c]
xor edx, edx
push 2
mov eax, dword [esp + eax*4 + 0x2b4]
mov ecx, dword [esp + 0x1f4]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov ecx, 0xbc0d133f
setl dl
xor eax, eax
mov dword [esp + 0x210], edx
cmp edx, 0xffffffff
setl al
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x2c0]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0xffffffff
pop edx
setl al
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + eax*4 + 0x2b0]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + eax*4 + 0x2b0]
sub eax, 0x885c
mov dword [esp + 0x30], eax
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], edx
jle 0x10019006
dec dword [esp + 0x24]
jns 0x10018fed
dec dword [esp + 0x1c]
jns 0x10018f95
cmp dword [esp + 0x1c], ebx
jne 0x100190dc
cmp dword [esi + 0xc], ebx
jne 0x100190dc
mov ecx, ebx
jmp 0x100190df
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0xffffffff
setg al
mov dword [esp + 0x30], eax
inc dword [esp + 0x1f4]
cmp dword [esp + 0x1f4], edx
jle 0x10018f7f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019118
push 0xd04
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 2
pop edx
dec dword [esi + 0xc]
jns 0x10018f4b
push dword [esp + 0x1e4]
call fcn.10059948
mov edx, dword [esp + 0x5c]
pop ecx
mov ecx, edi
mov dword [esp + 0x1e4], ebx
mov dword [esp + 0x1e8], ebx
mov dword [esp + 0x1ec], ebx
call fcn.10016b67
mov dword [esp + 0x18], 0x730f94f3
mov edi, eax
mov dword [esp + 0x24], 0x19583e35
mov dword [esp + 0x38], 0xd54ba4fd
mov dword [esp + 0x25c], edi
mov dword [esp + 0x14], ebx
jmp 0x10019188
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xa4], 0xec2e0cf5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019175
mov dword [esp + 0x18], ebx
jmp 0x1001946f
mov dword [esp + 0x40], 0xfffffffe
mov dword [esp + 0x1c], 0x6a6f4dad
mov dword [esp + 0x44], 0x8158
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x58], 0x237eebdc
mov dword [esp + 0x40], 2
cmp dword [esp + 0x40], ebx
jl 0x100193ac
xor edx, edx
inc edx
mov dword [esp + 0x2c], 0x865425a8
push 8
pop eax
mov dword [esp + 0x2a0], eax
mov dword [esp + 0x2a4], eax
mov dword [esp + 0x2a8], eax
mov dword [esp + 0x2ac], eax
mov dword [esp + 0x14], ebx
jmp 0x10019215
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xa0], 0xe26e1651
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10019202
mov dword [esp + 0x2c], ebx
jmp 0x1001937e
mov dword [esp + 0x28], 0xc7af5af8
mov dword [esp + 0x20], 0xfffffff6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019248
call dword [sym.imp.USER32.dll_CreateMenu]
xor edx, edx
inc edx
mov dword [esp + 0x28], ebx
jmp 0x1001936f
mov dword [esp + 0x38], 0x223fa3a9
mov dword [esp + 0x58], 6
mov dword [esp + 0x30], edx
mov dword [esp + 0x38], ebx
jmp 0x10019333
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x1001932f
mov eax, dword [esp + 0x2c]
cmp dword [esp + eax*4 + 0xa4], ebx
je 0x100192be
mov ecx, dword [esp + 0xa4]
mov eax, dword [esp + 0x40]
imul ecx, eax
mov dword [esp + 0x2a0], ecx
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov eax, dword [esp + 0x28]
cmp eax, 0x589d
setne cl
sub ecx, dword [esp + 0x2c]
jne 0x100192c0
mov edx, ebx
mov eax, dword [esp + 0x58]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0xfffffff8
jl 0x100192d4
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
push 1
mov eax, dword [esp + eax*4 + 0xa8]
cmp eax, 0x808a
sete cl
xor eax, eax
cmp ecx, 0xffffffff
setl al
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, 0xb979cd32
setle dl
cmp eax, edx
pop edx
sbb eax, eax
add eax, 0xb2512f10
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0xa0], eax
dec dword [esp + 0x1c]
jns 0x10019284
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 2
jle 0x1001926e
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x40]
test eax, eax
setg cl
sub ecx, dword [esp + 0xa4]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2a0], eax
mov dword [esp + 0x38], eax
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jle 0x10019251
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 2
jle 0x10019224
mov eax, dword [esp + 0x40]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0xa4]
cmp eax, 0xe188
setne cl
mov dword [esp + 0x24], ecx
dec dword [esp + 0x40]
jns 0x100191d5
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
mov esi, dword [esp + eax*4 + 0xa4]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
cmp ecx, eax
setne dl
cmp edx, esi
jne 0x100193d2
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x40]
xor edx, edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x40], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x40]
cmp ecx, eax
setg dl
mov dword [esp + 0x24], edx
xor edx, edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0xa4]
mov dword [esp + 0x1c], 0xfffffff8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0xa4]
mov eax, dword [esp + 0x1c]
sub eax, 0x41324a7
cmp eax, ecx
mov eax, dword [esp + 0x18]
setge dl
cmp dword [esp + eax*4 + 0xa4], edx
jg 0x1001943b
cmp dword [esp + 0x44], ebx
je 0x1001943b
xor eax, eax
inc eax
jmp 0x1001943d
mov eax, ebx
mov dword [esp + 0x20], eax
xor ecx, ecx
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x44]
cmp eax, 0xffffffff
mov eax, dword [esp + 0x38]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x44]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x58], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10019198
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019494
push ebx
push ebx
push 0x1927
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [esp + 0xe4]
push eax
call fcn.1001a56f
mov dword [eax], edi
mov dword [esp + 0x58], 9
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100194c2
push ebx
push 0x5ac
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100194d5
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov eax, dword [ebp + 8]
lea esi, [esp + 0x25c]
mov ecx, dword [esp + 0x384]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret