Function at 0x10019308
Capabilities:
Access peb ldr_data
Check os version
Create process on windows
Extract resource via kernel32 functions
Get disk information
Get file attributes
Get system information on windows
Log keystrokes
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100756e9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x320
push ebx
mov dword [esp + 8], 9
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x34], ebx
xor edi, edi
mov dword [esp + 0x1c], ebx
inc edi
mov dword [esp + 0x24], 0x3b8c105a
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x24], 0x6bc22736
mov dword [esp + 0x20], 0x245c
mov dword [esp + 0x24], 0x1031c36b
push edi
mov dword [esp + 0x120], edx
call fcn.1001737c
mov dword [esp + 0x2c], 0x53b
mov dword [esp + 0x1c], ebx
jmp 0x1001939a
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1b0]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10019387
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], 0x67d9
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], ebx
jne 0x100193ec
mov eax, ebx
cmp dword [esp + 0x20], ebx
je 0x100193ee
mov eax, edi
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
imul ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x34]
sub eax, ecx
je 0x1001940b
mov ecx, edi
cmp dword [esp + 0x20], ebx
jne 0x1001940d
mov ecx, ebx
mov eax, dword [esp + 0x10]
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x1b0]
mov dword [eax], ecx
mov eax, dword [esp + 0x2c]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 3
setne al
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x24], eax
setl cl
sub ecx, 0x3331e340
je 0x1001947c
cmp dword [esp + 0x2c], ebx
je 0x1001947c
cmp dword [esp + 0x1c], ebx
je 0x1001947c
mov dword [esp + 0x24], 0x5ce4ec6f
mov dword [esp + 0x30], ebx
mov dword [esp + 0x24], ebx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100194db
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x100194db
mov dword [esp + 0x30], 0xfffffffe
mov dword [esp + 0x30], 0x85aa1ede
mov dword [esp + 0x30], 0x81b1d0b8
mov dword [esp + 0x10], 0xf61160dd
mov dword [esp + 0x34], 4
mov dword [esp + 0x30], edi
mov dword [esp + 0x30], 0xc0f86f4c
mov dword [esp + 0x30], 6
mov dword [esp + 0x24], 0xfffffffc
dec dword [esp + 0x24]
mov dword [esp + 0x10], ebx
jmp 0x100194d4
cmp dword [esp + 0x34], ebx
jne 0x100194db
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
jle 0x100194ca
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100194fd
push 0x2277
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
lea ecx, [esp + 0x1b0]
call fcn.10017c12
mov dword [esp + 0x30], 0xcdb8faaa
lea ecx, [esp + 0x158]
mov dword [esp + 0x14], 2
push edi
call fcn.1001737c
mov dword [esp + 0x334], ebx
mov dword [esp + 0x24], 0x954a4377
mov dword [esp + 0x30], 0x1a7dfae3
mov dword [esp + 0x18], ebx
jmp 0x10019559
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 0xf3b1ad31
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10019543
mov dword [esp + 0x18], ebx
jmp 0x10019578
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x12c], 0xd0cd8a6c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10019565
cmp dword [esp + 0x14], ebx
je 0x1001959a
mov dword [esp + 0x24], 2
mov dword [esp + 0x24], 0xb4ffb87
jmp 0x10019736
push 2
lea ecx, [esp + 0x54]
call fcn.1001737c
mov dword [esp + 0x1c], 0xcbadbefc
mov dword [esp + 0x10], ebx
jmp 0x100195c2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x50]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100195b3
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], ebx
jl 0x1001972d
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x2c], 0x2535b5b0
mov dword [esp + 0x18], ebx
jmp 0x10019603
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100195ff
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x100195ed
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], ebx
jl 0x10019723
mov dword [esp + 0x34], 0xffffffff
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
cmp dword [eax + ecx*4], ebx
jne 0x1001966a
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
cmp dword [eax + ecx*4], 0x586f
jl 0x1001964d
mov edx, edi
cmp dword [esp + 0x18], ebx
jne 0x1001964f
mov edx, ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x50]
cmp dword [ecx + eax*4], edx
jne 0x10019664
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x50]
mov eax, ebx
cmp dword [ecx], ebx
je 0x1001966c
mov eax, edi
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
imul ecx, eax
mov eax, dword [esp + 0x50]
mov dword [eax + edx*4], ecx
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, edi
setle cl
xor eax, eax
neg ecx
cmp ecx, 0x9080
setl al
add eax, dword [esp + 0x14]
cmp eax, 0x36fb
jl 0x100196a9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x1c]
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x24]
setle cl
shl ecx, 2
test ecx, ecx
jne 0x100196e4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
mov dword [eax + ecx*4], edi
xor ecx, ecx
mov eax, dword [esp + 0x34]
cmp eax, 0xfffffff9
mov eax, dword [esp + 0x158]
setge cl
mov dword [eax], ecx
test ecx, ecx
je 0x10019710
mov eax, edi
cmp dword [esp + 0x2c], ebx
jne 0x10019712
mov eax, ebx
mov dword [esp + 0x130], eax
dec dword [esp + 0x18]
jns 0x10019617
dec dword [esp + 0x14]
jns 0x100195d7
lea ecx, [esp + 0x50]
call fcn.10017c12
mov eax, dword [esp + 0x158]
xor ecx, ecx
cmp dword [eax], 0xffffffff
mov eax, dword [esp + 0x130]
sete cl
cmp ecx, 0xbd28a218
sbb ecx, ecx
xor edx, edx
inc ecx
add eax, ecx
imul ecx, eax, 0xfea2
imul eax, dword [esp + 0x134], 0x49f7
cmp eax, ecx
lea ecx, [esp + 0x158]
setle dl
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x130]
mov dword [esp + 0x130], eax
mov dword [esp + 0x24], 0x94c655e
or dword [esp + 0x334], 0xffffffff
call fcn.10017c12
mov dword [esp + 0x14], 0x2e08
mov dword [esp + 0x1c], 0xb0befcdf
mov dword [esp + 0x20], 0xc1dfe936
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 0xc0de450b
mov dword [esp + 0x28], edi
mov dword [esp + 0x10], ebx
jmp 0x100197de
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x228], 0x80095520
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100197cb
cmp dword [esp + 0x14], ebx
je 0x100197ef
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x20]
cmp eax, 0xfc9b
setle cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x228], edi
mov dword [esp + 0x14], 0x17
jmp 0x100199e8
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], 0x4499c77e
mov dword [esp + 0x10], 0x5493a50e
mov dword [esp + 0x34], 0xff24264a
mov dword [esp + 0x24], 0xdfef28ed
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x24]
sub eax, 0xb
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, 0xfffffff7
setg cl
cmp ecx, dword [esp + 0x18]
jl 0x100198a4
mov ecx, edi
cmp dword [esp + 0x18], ebx
jne 0x100198a6
mov ecx, ebx
mov eax, dword [esp + 0x20]
neg ecx
xor edx, edx
cmp eax, ecx
setle dl
xor ecx, ecx
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
sub edx, 0x456014ef
cmp edx, 0xc53a
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [esp + 0x20]
jne 0x100198ea
cmp dword [esp + 0x14], ebx
jne 0x100198ee
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
mov ecx, edi
sub ecx, eax
cmp ecx, dword [esp + 0x14]
jge 0x10019907
mov ecx, edi
cmp dword [esp + 0x234], ebx
jne 0x10019909
mov ecx, ebx
xor eax, eax
cmp ecx, 0x206cbc8c
setge al
xor edx, edx
cmp eax, 0x29ef
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
cmp eax, ecx
setle dl
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x2c]
imul eax, dword [esp + 0x1c]
test eax, eax
je 0x1001995f
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
jmp 0x100199d2
push 3
mov dword [esp + 0x24], ebx
pop edx
jmp 0x100199aa
mov dword [esp + 0x18], ebx
jmp 0x10019988
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0x228]
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x228], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jle 0x1001996e
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100199a6
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 3
pop edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jle 0x10019968
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], ebx
jl 0x100199d2
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100199cc
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
dec dword [esp + 0x10]
jns 0x100199ba
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100199e4
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff5
jl 0x10019851
mov dword [esp + 0x1c], 9
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10019a49
mov dword [esp + 0x20], ebx
jmp 0x10019a22
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x138], 2
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10019a0f
mov eax, dword [esp + 0x10]
mov dword [esp + 0x138], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019a45
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff7
jge 0x10019a09
mov dword [esp + 0x34], ebx
lea ecx, [esp + 0x1c8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], 0x3b8c105a
mov dword [esp + 0x24], 0x6bc22736
mov dword [esp + 0x2c], 0x245c
mov dword [esp + 0x24], 0x1031c36b
push edi
call fcn.1001737c
mov dword [esp + 0x20], 0x53b
mov dword [esp + 0x10], ebx
jmp 0x10019aa6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10019a93
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], 0x67d9
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], ebx
jne 0x10019af8
mov eax, ebx
cmp dword [esp + 0x2c], ebx
je 0x10019afa
mov eax, edi
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
imul ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
sub eax, ecx
je 0x10019b17
mov ecx, edi
cmp dword [esp + 0x2c], ebx
jne 0x10019b19
mov ecx, ebx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c8]
add edx, ecx
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x20]
cmp edx, eax
mov eax, dword [esp + 0x1c]
setg cl
xor edx, edx
cmp ecx, 3
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0x3331e340
je 0x10019b83
cmp dword [esp + 0x20], ebx
je 0x10019b83
cmp dword [esp + 0x10], ebx
je 0x10019b83
mov dword [esp + 0x28], 0x5ce4ec6f
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019be2
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x10019be2
mov dword [esp + 0x30], 0xfffffffe
mov dword [esp + 0x30], 0x85aa1ede
mov dword [esp + 0x30], 0x81b1d0b8
mov dword [esp + 0x10], 0xf61160dd
mov dword [esp + 0x28], 4
mov dword [esp + 0x30], edi
mov dword [esp + 0x30], 0xc0f86f4c
mov dword [esp + 0x30], 6
mov dword [esp + 0x24], 0xfffffffc
dec dword [esp + 0x24]
mov dword [esp + 0x10], ebx
jmp 0x10019bdb
cmp dword [esp + 0x28], ebx
jne 0x10019be2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
jle 0x10019bd1
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019bff
push 0x2277
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
lea ecx, [esp + 0x1c8]
call fcn.10017c12
push 2
lea ecx, [esp + 0x1c0]
call fcn.1001737c
push 4
lea ecx, [esp + 0x220]
mov dword [esp + 0x338], edi
call fcn.1001737c
mov dword [esp + 0x14], ebx
jmp 0x10019c4a
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], 0xdf99ff60
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019c34
mov dword [esp + 0x14], ebx
jmp 0x10019c69
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x21c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10019c57
mov esi, dword [esp + 0x1bc]
mov dword [esi + 4], ebx
mov dword [esp + 0x28], 0xec79cf18
mov dword [esp + 0x30], 0x6887e0
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], 0xc73f
mov dword [esp + 0x10], ebx
jmp 0x10019cab
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x84], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019c9c
mov dword [esp + 0x8c], 3
jmp 0x10019d22
mov dword [esp + 0x10], 0xfffffffd
cmp dword [esp + 0x8c], ebx
je 0x10019cde
mov dword [esp + 0x30], 0xffffffff
dec dword [esp + 0x10]
jmp 0x10019cf6
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019cf0
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [esp + 0x28], ebx
jne 0x10019d1b
cmp dword [esi + 4], ebx
jne 0x10019d0a
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x21c]
mov dword [eax + 4], ecx
inc dword [esp + 0x8c]
cmp dword [esp + 0x8c], 0x1c
je 0x10019cbf
inc dword [esp + 0x24]
inc dword [esi + 4]
cmp dword [esi + 4], 0x11
jl 0x10019c7a
lea ecx, [esp + 0x21c]
call fcn.10017c12
or dword [esp + 0x334], 0xffffffff
lea ecx, [esp + 0x1bc]
call fcn.10017c12
push 2
pop esi
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x17c]
push edi
call fcn.1001737c
mov dword [esp + 0x334], esi
mov dword [esp + 0x28], 0x954a4377
mov dword [esp + 0x30], 0x1a7dfae3
mov dword [esp + 0x18], ebx
jmp 0x10019da4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x17c]
mov dword [eax + ecx*4], 0xf3b1ad31
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10019d8e
mov dword [esp + 0x18], ebx
jmp 0x10019dc3
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x14c], 0xd0cd8a6c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10019db0
cmp dword [esp + 0x14], ebx
je 0x10019de1
mov dword [esp + 0x28], esi
mov dword [esp + 0x28], 0xb4ffb87
jmp 0x10019f7b
push esi
lea ecx, [esp + 0x6c]
call fcn.1001737c
mov dword [esp + 0x2c], 0xcbadbefc
mov dword [esp + 0x10], ebx
jmp 0x10019e08
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x68]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019df9
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], ebx
jl 0x10019f72
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x34], 0x2535b5b0
mov dword [esp + 0x18], ebx
jmp 0x10019e48
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019e44
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x10019e32
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], ebx
jl 0x10019f68
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x68]
cmp dword [eax + ecx*4], ebx
jne 0x10019eaf
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x68]
cmp dword [eax + ecx*4], 0x586f
jl 0x10019e92
mov edx, edi
cmp dword [esp + 0x18], ebx
jne 0x10019e94
mov edx, ebx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x68]
cmp dword [ecx + eax*4], edx
jne 0x10019ea9
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x68]
mov eax, ebx
cmp dword [ecx], ebx
je 0x10019eb1
mov eax, edi
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
imul ecx, eax
mov eax, dword [esp + 0x68]
mov dword [eax + edx*4], ecx
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, edi
setle cl
xor eax, eax
neg ecx
cmp ecx, 0x9080
setl al
add eax, dword [esp + 0x14]
cmp eax, 0x36fb
jl 0x10019eee
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x2c]
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x28]
setle cl
shl ecx, 2
test ecx, ecx
jne 0x10019f29
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x68]
mov dword [eax + ecx*4], edi
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp eax, 0xfffffff9
mov eax, dword [esp + 0x17c]
setge cl
mov dword [eax], ecx
test ecx, ecx
je 0x10019f55
mov eax, edi
cmp dword [esp + 0x34], ebx
jne 0x10019f57
mov eax, ebx
mov dword [esp + 0x150], eax
dec dword [esp + 0x18]
jns 0x10019e5c
dec dword [esp + 0x14]
jns 0x10019e1c
lea ecx, [esp + 0x68]
call fcn.10017c12
mov eax, dword [esp + 0x17c]
xor ecx, ecx
cmp dword [eax], 0xffffffff
mov eax, dword [esp + 0x150]
sete cl
cmp ecx, 0xbd28a218
sbb ecx, ecx
xor edx, edx
inc ecx
add eax, ecx
imul ecx, eax, 0xfea2
imul eax, dword [esp + 0x154], 0x49f7
cmp eax, ecx
lea ecx, [esp + 0x17c]
setle dl
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x150]
mov dword [esp + 0x150], eax
mov dword [esp + 0x28], 0x94c655e
or dword [esp + 0x334], 0xffffffff
call fcn.10017c12
mov dword [esp + 0x14], 0xfffffffa
mov dword [esp + 0x10], 7
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], 0x4418f7f2
mov dword [esp + 0x30], edi
mov dword [esp + 0x18], ebx
jmp 0x1001a018
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x3c], 0x261f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001a008
mov dword [esp + 0x18], ebx
jmp 0x1001a034
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x48], 0xccc89593
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001a024
inc dword [esp + 0x3c]
xor ecx, ecx
mov eax, dword [esp + 0x3c]
imul eax, dword [esp + 0x2c]
mov dword [esp + 0x48], eax
mov eax, dword [esp + 0x2c]
cmp eax, 0x23703acb
setne cl
sub ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x2c]
inc dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x3c], ebx
je 0x1001a10f
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x1001a141
mov dword [esp + 0x24], 0x1ce43c7d
mov dword [esp + 0x34], edi
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a0dc
push ebx
push ebx
push 0x2060
push 0x984
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x3c]
mov dword [esp + 0x48], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x34], ecx
dec dword [esp + 0x14]
jns 0x1001a0b2
jmp 0x1001a141
mov dword [esp + 0x24], 0x6104dbc0
mov dword [esp + 0x48], edi
mov eax, dword [esp + 0x48]
imul eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
push 3
pop esi
push esi
lea ecx, [esp + 0x288]
call fcn.1001737c
mov dword [esp + 0x334], esi
lea ecx, [esp + 0xd8]
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x10007a20]
mov eax, 0xd6c0
mov dword [esp + 0x34], 0x3c67ee39
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
lea eax, [esp + 0x2ec]
push eax
lea eax, [esp + 0x2e0]
mov dword [esp + 0x28], 0xffffffff
push eax
push ebx
movdqu xmmword [esp + 0x2e8], xmm0
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
call fcn.10018a0d
mov dword [esp + 0x18], 0xbf3f0790
mov dword [esp + 0x20], ebx
jmp 0x1001a33a
mov dword [esp + 0x14], 0x8eb0
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x20]
cmp dword [esp + eax*4 + 0xb4], ebx
je 0x1001a2f9
mov dword [esp + 0x1c], 2
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 3
cmp dword [esp + 0x1c], ebx
jl 0x1001a32e
mov dword [esp + 0x10], 0x34bf8f0a
mov dword [esp + 0x34], edi
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 3
jg 0x1001a2ed
mov esi, dword [esp + 0xd8]
mov dword [esp + 0x28], 0x643747c9
xor edx, edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0xb4]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0xb4]
cmp eax, 0xfffffff7
setge dl
sub edx, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
test ecx, ecx
setns al
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0xb4]
cmp dword [esp + 0x24], eax
je 0x1001a2a4
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
xor edx, edx
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov ecx, dword [esp + 0xbc]
mov eax, dword [esp + 0x1c]
setg dl
sub edx, 0xfffffffc
neg edx
sbb edx, edx
inc edx
sub ecx, edx
sub eax, ecx
mov dword [esi + 8], ecx
add eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
cmp dword [esi + 0xc], ebx
jne 0x1001a2ed
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x1001a246
dec dword [esp + 0x1c]
jns 0x1001a21c
jmp 0x1001a32e
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a31b
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a32e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jle 0x1001a1e1
mov ecx, dword [esp + 0xbc]
mov eax, dword [esp + 0xd8]
mov dword [eax + 8], ecx
lea ecx, [esp + 0xd8]
call fcn.10017c12
push 2
lea ecx, [esp + 0x1e4]
call fcn.1001737c
push 4
lea ecx, [esp + 0x1fc]
mov byte [esp + 0x338], 4
call fcn.1001737c
mov dword [esp + 0x14], ebx
jmp 0x1001a3a2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], 0xdf99ff60
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001a38c
mov dword [esp + 0x14], ebx
jmp 0x1001a3c1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1f8]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001a3af
mov esi, dword [esp + 0x1e0]
mov dword [esi + 4], ebx
mov dword [esp + 0x28], 0xec79cf18
mov dword [esp + 0x30], 0x6887e0
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], 0xc73f
mov dword [esp + 0x10], ebx
jmp 0x1001a400
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x78], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a3f4
mov dword [esp + 0x80], 3
jmp 0x1001a477
mov dword [esp + 0x10], 0xfffffffd
cmp dword [esp + 0x80], ebx
je 0x1001a433
mov dword [esp + 0x30], 0xffffffff
dec dword [esp + 0x10]
jmp 0x1001a44b
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a445
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [esp + 0x28], ebx
jne 0x1001a470
cmp dword [esi + 4], ebx
jne 0x1001a45f
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x80]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x1f8]
mov dword [eax + 4], ecx
inc dword [esp + 0x80]
cmp dword [esp + 0x80], 0x1c
je 0x1001a414
inc dword [esp + 0x24]
inc dword [esi + 4]
cmp dword [esi + 4], 0x11
jl 0x1001a3d2
lea ecx, [esp + 0x1f8]
call fcn.10017c12
lea ecx, [esp + 0x1e0]
mov byte [esp + 0x334], 3
call fcn.10017c12
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x10007a40]
lea eax, [esp + 0x31c]
push eax
lea eax, [esp + 0x310]
mov dword [esp + 0x108], ebx
push eax
push ebx
lea ecx, [esp + 0x110]
mov dword [esp + 0x114], ebx
movdqu xmmword [esp + 0x318], xmm0
mov dword [esp + 0x118], ebx
call fcn.10018a0d
mov byte [esp + 0x334], 5
mov dword [esp + 0x14], 0xfffffffa
mov dword [esp + 0x10], 7
mov dword [esp + 0x2c], edi
mov dword [esp + 0x28], 0x4418f7f2
mov dword [esp + 0x30], edi
mov dword [esp + 0x18], ebx
jmp 0x1001a537
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x38], 0x261f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001a527
mov dword [esp + 0x18], ebx
jmp 0x1001a553
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x4c], 0xccc89593
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001a543
inc dword [esp + 0x38]
xor ecx, ecx
mov eax, dword [esp + 0x38]
imul eax, dword [esp + 0x2c]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x2c]
cmp eax, 0x23703acb
setne cl
sub ecx, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x2c]
inc dword [esp + 0x10]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x38], ebx
je 0x1001a62e
mov dword [esp + 0x28], ebx
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x1001a660
mov dword [esp + 0x24], 0x1ce43c7d
mov dword [esp + 0x34], edi
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a5fb
push ebx
push ebx
push 0x2060
push 0x984
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x38]
mov dword [esp + 0x4c], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x34], ecx
dec dword [esp + 0x14]
jns 0x1001a5d1
jmp 0x1001a660
mov dword [esp + 0x24], 0x6104dbc0
mov dword [esp + 0x4c], edi
mov eax, dword [esp + 0x4c]
imul eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x9a13
mov esi, 0xeede0b40
mov dword [esp + 0x30], 0xae974ca7
mov dword [esp + 0x1c], 0x5d6c05ba
mov dword [esp + 0x30], 0x7fa3dfad
mov dword [esp + 0x1c], ebx
jmp 0x1001a6d7
push edi
lea ecx, [esp + 0x214]
call fcn.1001737c
mov dword [esp + 0x10], ebx
jmp 0x1001a6b0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x210]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001a69e
mov eax, dword [esp + 0x210]
lea ecx, [esp + 0x210]
mov byte [esp + 0x334], 5
mov dword [eax], ebx
call fcn.10017c12
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe2
jle 0x1001a68b
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x10007a20]
lea ecx, [esp + 0xd0]
mov eax, 0xd6c0
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
lea eax, [esp + 0x2fc]
push eax
lea eax, [esp + 0x2f0]
mov dword [esp + 0x28], 0xffffffff
push eax
push ebx
movdqu xmmword [esp + 0x2f8], xmm0
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
call fcn.10018a0d
mov dword [esp + 0x18], 0xbf3f0790
mov dword [esp + 0x20], ebx
jmp 0x1001a8b8
cmp dword [esp + 0x20], 3
jle 0x1001a75f