Function at 0x10018f8f
Capabilities:
Create process on windows
Get file system object information
Identify system language via api
Resolve function by parsing pe exports
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10078c02
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
push ebx
push esi
push edi
mov dword [esp + 0x58], ecx
lea ecx, [esp + 0x140]
push 3
mov dword [esp + 0xa8], edx
call fcn.100170ca
xor ebx, ebx
mov dword [esp + 0x18], ebx
jmp 0x10018fea
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10018fd4
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x10019014
push ebx
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x10019035
push 0x1731
push 0x2126
push ebx
push 0x1d3
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [esp + 0x140]
call fcn.1001714c
push 2
lea ecx, [esp + 0x44]
call fcn.100170ca
mov dword [esp + 0x1c4], ebx
mov dword [esp + 0x2c], 0xc05baf43
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001907c
push 0x15ec
push ebx
push 0xba0
push 0x1fc
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019094
push 0x1e5
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov dword [esp + 0x20], 1
mov eax, 0x177e8edf
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x18], 0xe6e3245f
mov dword [esp + 0x18], ebx
jmp 0x100190e2
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100190de
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x100190cb
mov dword [esp + 0x38], ebx
jmp 0x100190ff
mov eax, dword [esp + 0x38]
mov dword [esp + eax*4 + 0x30], 0x40d7
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 1
jl 0x100190ef
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10007c30]
lea eax, [esp + 0x1a4]
push eax
lea eax, [esp + 0x198]
mov dword [esp + 0x1c], 0x1d832937
push eax
mov dword [esp + 0x1c], 0xeb2fc257
lea ecx, [esp + 0x84]
push ebx
movdqu xmmword [esp + 0x1a0], xmm0
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
call fcn.10018639
mov dword [esp + 0x18], ebx
jmp 0x10019176
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x178], 0x25f321ee
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10019163
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
cmp ecx, eax
setg dl
imul edx, dword [esp + 0x10]
test edx, edx
jne 0x1001919f
cmp dword [esp + 0x14], ebx
jne 0x1001919f
mov ecx, ebx
jmp 0x100191a2
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x14]
xor edx, edx
add ecx, 0xfffffffd
cmp ecx, eax
mov eax, dword [esp + 0x78]
setl dl
mov dword [esp + 0x28], edx
mov dword [eax], edx
xor edx, edx
cmp dword [esp + 0x28], edx
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x14]
jne 0x100191de
cmp dword [esp + 0x10], ebx
jne 0x100191de
mov ecx, ebx
jmp 0x100191e1
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
cmp ecx, 1
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setne cl
xor edx, edx
cmp ecx, 0xd857
setle dl
xor ecx, ecx
add edx, 0x9c08
cmp edx, eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x178], 0xf55126ed
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019259
push ebx
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
lea ecx, [esp + 0x78]
call fcn.1001714c
lea eax, [esp + 0x38]
xor cl, cl
push eax
lea edx, [esp + 0x44]
call fcn.1001a733
pop ecx
mov dword [esp + 0x10], 0x5d09ea9
lea ecx, [esp + 0xe0]
push 3
call fcn.100170ca
mov eax, 0xf0720718
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0x1c], 0x631615e8
mov dword [esp + 0x14], ebx
mov dword [esp + 0x2c], 0xae446f9
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x100192e2
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x100192cc
xor ecx, ecx
mov dword [esp + 0x1c], ebx
inc ecx
jmp 0x10019302
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x74], 0xd11e8e10
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x100192f2
mov dword [esp + 0x1c], ebx
jmp 0x1001931d
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xec], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001930e
mov dword [esp + 0xb0], ecx
xor edx, edx
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0xe0]
mov eax, dword [esp + 0x10]
cmp dword [esi + 4], ecx
sete dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, dword [esi + 4]
setle al
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp eax, dword [esi + 4]
jl 0x10019431
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 3
jg 0x100194df
push 2
pop esi
mov dword [esp + 0x28], 0x46aa1dd5
mov dword [esp + 0x1c], ebx
jmp 0x100193e4
mov dword [esp + 0x28], 0xb7228d02
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0xac]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0xac]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], 0xfffffff6
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
mov eax, dword [esp + 0x10]
setle cl
mov dword [esp + eax*4 + 0xac], ecx
mov eax, 0x86fc3314
cmp eax, ecx
sbb eax, eax
neg eax
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x10019382
mov dword [esp + 0x14], ebx
jmp 0x10019417
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019413
push 0x1733
push 0xe77
push 0x7d5
call edi
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x100193f0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x10019374
jmp 0x100194df
mov dword [esp + 0x28], 0x9b6ef542
mov dword [esp + 0x18], ebx
jmp 0x1001944f
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x4c], 0x730e92f9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1001943f
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0x1b
jge 0x100194df
mov esi, dword [esp + 0xe0]
mov dword [esp + 0x28], 9
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001948c
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp eax, 1
setg cl
xor eax, eax
add ecx, dword [esp + 0x4c]
cmp ecx, dword [esi + 8]
mov edx, dword [esp + 0x74]
setle al
cmp eax, 7
sbb eax, eax
inc eax
add edx, eax
mov eax, dword [esp + 0x4c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x4c]
setl cl
sub eax, ecx
sub eax, 0x3b9fe29f
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1b
jl 0x10019468
inc dword [esp + 0xf0]
lea ecx, [esp + 0xe0]
call fcn.1001714c
mov eax, dword [esp + 0x40]
mov dword [eax], ebx
mov dword [esp + 0x14], 0x5b3b9da4
lea ecx, [esp + 0x160]
mov dword [esp + 0x20], 0xfffffff7
mov dword [esp + 0x24], 8
mov dword [esp + 0x2c], 0x23b6182e
push 4
call fcn.100170ca
mov dword [esp + 0x28], 0xe08cccdd
mov dword [esp + 0x18], ebx
jmp 0x1001954a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0x72226312
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10019534
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0x160]
mov dword [esp + 0x24], eax
dec dword [esp + 0x28]
call fcn.1001714c
mov dword [esp + 0x28], 0xf4f88039
mov dword [esp + 0x28], 0x45cb81ec
mov dword [esp + 0x18], 1
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019593
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [esp + 0x18], 0xfffffff4
jmp 0x100195b3
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100195af
push ebx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xa
jg 0x1001959d
mov dword [esp + 0x14], ebx
jmp 0x10019885
mov dword [esp + 0x24], 0x6318
lea ecx, [esp + 0x11c]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 7
mov dword [esp + 0x14], 0xb03b
call fcn.100170ca
mov dword [esp + 0x18], ebx
jmp 0x10019607
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 0x2e5f0e77
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x100195f1
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019620
push ebx
call dword [sym.imp.USER32.dll_CharNextW]
cmp dword [esp + 0x20], ebx
je 0x1001964d
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
sub edx, eax
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
sub ecx, 0xfffc
je 0x1001964d
xor ecx, ecx
inc ecx
jmp 0x1001964f
mov ecx, ebx
mov eax, dword [esp + 0x28]
sub ecx, eax
mov eax, dword [esp + 0x118]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x118]
call fcn.1001714c
mov dword [esp + 0x20], 0x12b57e8b
lea ecx, [esp + 0x154]
mov dword [esp + 0x2c], 0x14d2edc7
xor eax, eax
mov dword [esp + 0x2c], 9
inc eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0xfffffffe
push 3
pop esi
mov dword [esp + 0x2c], esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x2c], 0x819570a5
mov dword [esp + 0x28], 0x101aae4b
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], 0x8ae505b0
mov dword [esp + 0x2c], 0xfa5f9c71
mov dword [esp + 0x2c], 8
mov dword [esp + 0x2c], eax
push eax
call fcn.100170ca
push esi
lea ecx, [esp + 0xf8]
mov byte [esp + 0x1c8], 1
call fcn.100170ca
mov dword [esp + 0x2c], 0x4e630971
xor edx, edx
mov dword [esp + 0x28], 0x701832d7
inc edx
mov dword [esp + 0x1c], ebx
jmp 0x1001971f
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xa0], 0xc789
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001970c
mov dword [esp + 0x1c], ebx
jmp 0x1001973e
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x154]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001972b
mov dword [esp + 0x1c], ebx
jmp 0x1001975d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xf4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001974a
mov eax, dword [esp + 0xf4]
mov ecx, 0xb66c146d
inc dword [eax + 8]
dec dword [esp + 0x28]
mov eax, dword [esp + 0x24]
cmp ecx, eax
lea ecx, [esp + 0xf4]
sbb eax, eax
neg eax
sub eax, 0x7758a8ce
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
call fcn.1001714c
lea ecx, [esp + 0x154]
mov byte [esp + 0x1c4], bl
call fcn.1001714c
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x40]
neg edx
sbb edx, edx
xor eax, eax
neg edx
cmp edx, dword [ecx]
setg al
mov dword [esp + 0x28], eax
mov eax, dword [ecx]
xor ecx, ecx
mov edx, dword [esp + eax*4 + 0x30]
mov eax, dword [esp + 0x28]
cmp eax, 0x1a9c
mov eax, dword [esp + 0x40]
setle cl
add edx, ecx
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x30]
cmp eax, edx
sete cl
cmp ecx, 0xd621
jne 0x10019812
cmp dword [esp + 0x14], ebx
je 0x10019812
xor eax, eax
inc eax
jmp 0x10019814
mov eax, ebx
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x16c]
push 3
call fcn.100170ca
mov dword [esp + 0x28], 0xffbe5849
mov dword [esp + 0x18], ebx
jmp 0x1001984a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0x61c0f806
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10019834
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019863
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [esp + 0x28], 1
lea ecx, [esp + 0x16c]
call fcn.1001714c
mov eax, dword [esp + 0x40]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x30]
inc dword [esp + 0x14]
push 3
cmp dword [esp + 0x18], ebx
jle 0x100195c3
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0x110]
call fcn.100170ca
mov dword [esp + 0x18], ebx
jmp 0x100198be
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x100198ab
cmp dword [esp + 0x10], ebx
je 0x100198e6
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001996e
push ebx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x1001996e
mov dword [esp + 0x28], 0x4d513c61
mov dword [esp + 0x10], 0xffffffe6
cmp dword [esp + 0x10], 2
jne 0x10019966
mov esi, dword [esp + 0x10c]
mov dword [esp + 0x18], 0xfffffff8
mov dword [esi + 4], 0x905d09ea
mov dword [esp + 0x18], ebx
jmp 0x10019954
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001993f
push ebx
push 0x725
push 0x9fe
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019950
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10019919
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
je 0x10019904
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x10c]
call fcn.1001714c
mov dword [esp + 0x14], ebx
jmp 0x10019ace
push 2
lea ecx, [esp + 0x60]
call fcn.100170ca
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x3e58bfc4
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x10], 1
mov dword [esp + 0x18], ebx
jmp 0x100199c7
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 0xac64a684
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x100199b4
mov eax, dword [esp + 0x5c]
mov dword [eax], 0xffffffe2
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x5c]
cmp dword [esi + 4], ebx
jne 0x100199f7
xor eax, eax
cmp dword [esi], 4
sete al
cmp eax, dword [esp + 0x1c]
jle 0x100199f7
mov eax, ebx
jmp 0x100199fa
xor eax, eax
inc eax
mov ecx, dword [esp + 0x24]
xor edx, edx
imul ecx, eax
mov eax, dword [esp + 0x5c]
cmp ecx, dword [eax]
setl dl
cmp edx, dword [esi + 4]
jle 0x10019a1c
cmp dword [esp + 0x10], ebx
je 0x10019a1c
xor edx, edx
inc edx
jmp 0x10019a1e
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, edx
setge cl
imul ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x5c]
imul edx, dword [eax]
mov eax, dword [esp + 0x10]
cmp edx, eax
setl cl
cmp ecx, 8
jle 0x10019a57
cmp dword [esp + 0x10], ebx
je 0x10019a57
mov ecx, ebx
jmp 0x10019a5a
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x10]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x5c]
mov dword [eax], ecx
test ecx, ecx
je 0x10019a8d
cmp dword [esp + 0x24], ebx
je 0x10019a8d
xor eax, eax
inc eax
jmp 0x10019a8f
mov eax, ebx
mov dword [esp + 0x24], eax
xor edx, edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
cmp eax, ecx
lea ecx, [esp + 0x5c]
setle dl
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov byte [esp + 0x1c4], bl
call fcn.1001714c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x30], 0x14af
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10019983
mov esi, dword [esp + 0x40]
mov dword [esp + 0x28], esi
inc dword [esi]
cmp dword [esi], 0
jle 0x100194f8
xor eax, eax
cmp dword [esi], eax
setne al
add eax, 0xfffffffc
cmp eax, dword [esi]
jg 0x10019b0d
cmp dword [esp + 0x30], ebx
mov esi, dword [esp + 0x40]
mov dword [esp + 0x28], esi
je 0x10019b0d
xor eax, eax
inc eax
jmp 0x10019b0f
mov eax, ebx
xor ecx, ecx
cmp dword [esi], eax
mov eax, dword [esp + 0x30]
sete cl
sub eax, dword [esi + 4]
sub eax, ecx
xor edx, edx
imul ecx, eax, 0xa
mov eax, dword [esp + 0x40]
cmp ecx, dword [eax]
setl dl
xor ecx, ecx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x30]
imul edx, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
cmp edx, eax
mov eax, dword [esp + 0x40]
setg cl
cmp ecx, dword [eax]
je 0x10019b56
cmp dword [esi + 4], ebx
jne 0x10019b56
mov ecx, ebx
jmp 0x10019b59
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x30]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x40]
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
cmp ecx, 0x5fcb4448
jl 0x10019b81
cmp dword [esp + 0x30], ebx
jne 0x10019b81
mov ecx, ebx
jmp 0x10019b84
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x40]
xor edx, edx
mov dword [eax], ecx
mov eax, dword [esp + 0x30]
cmp ecx, eax
mov eax, dword [esp + 0x30]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x30]
cmp edx, eax
setl cl
cmp dword [esp + 0x30], ecx
jg 0x10019bbb
mov eax, dword [esp + 0x40]
cmp dword [eax], ebx
je 0x10019bbb
xor edx, edx
inc edx
mov eax, edx
jmp 0x10019bc0
xor edx, edx
mov eax, ebx
inc edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x20], eax
je 0x10019bd2
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x40]
cmp dword [eax], ecx
jg 0x1001a5bb
mov eax, 0xd33a4a9b
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
push 4
mov dword [esp + 0x94], eax
mov dword [esp + 0x1c], ebx
pop esi
jmp 0x10019c23
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x130], 8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10019c10
mov dword [esp + 0x134], 3
cmp dword [esp + 0x134], ebx
jl 0x10019c90
mov dword [esp + 0x18], ebx
jmp 0x10019c53
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x50], 0xd8987f2f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10019c43
mov dword [esp + 0x50], ebx
jmp 0x10019c80
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019c7c
push 0x1ae2
push 0x1a9c
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
inc dword [esp + 0x50]
cmp dword [esp + 0x50], 3
jle 0x10019c60
dec dword [esp + 0x134]
jns 0x10019c3d
mov dword [esp + 0x18], 0x6722525a
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x348f4a8f
cmp dword [esp + 0x10], ebx
je 0x10019cba
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub edx, eax
add edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, edx
setl cl
cmp dword [esp + 0x10], ecx
mov byte [esp + 0xf], bl
je 0x10019d01
cmp byte [esp + 0xf], 0
je 0x10019d36
push ebx
push ebx
push 0xdd5
push 0x1433
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
jmp 0x10019d36
cmp byte [esp + 0xf], 0
je 0x10019d1a
push 0x199a
push ebx
push ebx
push ebx
push ebx
call edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019d36
push 0x19a0
push 0x13cb
push ebx
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc8]
push 9
pop edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0xfffffffe
push esi
call fcn.100170ca
mov dword [esp + 0x10], ebx
jmp 0x10019d76
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019d60
mov dword [esp + 0x1c], ebx
jmp 0x10019e30
mov dword [esp + 0x14], edi
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], ebx
jl 0x10019ded
mov dword [esp + 0x10], 0xf82ff40f
mov dword [esp + 0x10], ebx
jmp 0x10019dd0
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019db7
push ebx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc8]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x10019da5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc8]
cmp dword [eax + ecx*4], ebx
jne 0x10019ded
dec dword [esp + 0x14]
jns 0x10019d97
mov dword [esp + 0x14], 0xfffffffb
jmp 0x10019e25
mov dword [esp + 0x10], 0x35e1f6f0
mov dword [esp + 0x10], ebx
jmp 0x10019e1a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019e16
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x10019e05
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff0
jg 0x10019df7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jge 0x10019d85
lea ecx, [esp + 0xc8]
call fcn.1001714c
push 3
lea ecx, [esp + 0xc0]
call fcn.100170ca
mov dword [esp + 0x10], 0xe1879501
xor edx, edx
mov dword [esp + 0x24], 0xb7f609b2
inc edx
mov dword [esp + 0x20], 0x85ea6eda
mov dword [esp + 0x20], edx
mov dword [esp + 0x14], ebx
jmp 0x10019e8c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xbc]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019e79
mov eax, dword [esp + 0x10]
mov ecx, 0xda22
mov eax, dword [esp + 0x24]
sub ecx, eax
add ecx, dword [esp + 0x10]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp eax, dword [esp + 0x24]
jne 0x10019ec4
cmp dword [esp + 0x10], ebx
jne 0x10019ec4
mov edx, ebx
mov eax, dword [esp + 0x24]
neg edx
mov edi, dword [esp + 0xbc]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov dword [edi + 4], 0x2135
mov esi, dword [edi + 4]
mov eax, 0x842f88d9
setne cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
inc ecx
mov dword [esp + 0x20], eax
xor edx, edx
mov dword [esp + 0x24], 0xcd4a
mov eax, dword [esp + 0x24]
sub ecx, eax
cmp ecx, esi
setge dl
xor eax, eax
add edx, 0xf95e
cmp edx, 0xf4c6
setl al
xor ecx, ecx
add eax, 0x5a165f5c
cmp eax, esi
setl cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
sub ecx, dword [edi + 4]
mov eax, dword [esp + 0xbc]
cmp ecx, dword [eax + 8]
setle dl
xor ecx, ecx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x24]
imul edx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp edx, eax
setge cl
test ecx, ecx
jg 0x10019f6c
cmp dword [esp + 0x24], ebx
jne 0x10019f6c
mov eax, ebx
jmp 0x10019f6f
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019f8b
push ebx
push 0x209d
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
lea ecx, [esp + 0xbc]
call fcn.1001714c
push 3
lea ecx, [esp + 0x104]
call fcn.100170ca
mov byte [esp + 0x1c4], 3
xor ecx, ecx
mov dword [esp + 0x14], ebx
inc ecx
mov dword [esp + 0x1c], 0x513244d5
mov dword [esp + 0x2c], 0xa3b2b4b2
mov dword [esp + 0x20], ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], ebx
jmp 0x10019fe2
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x34], 0x6834
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10019fd2
mov dword [esp + 0x14], ebx
jmp 0x1001a001
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1a0], 0xc6516eae
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019fee
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jg 0x1001a170
mov dword [esp + 0x10], 0x9ea9831
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x1001a132
push ecx
lea ecx, [esp + 0x128]
call fcn.100170ca
mov dword [esp + 0x24], 0x6986
mov dword [esp + 0x1c], ebx
jmp 0x1001a05d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], 0x3eb60693
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x1001a047
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x34]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x34]
sub ecx, eax
mov eax, dword [esp + 0x124]
mov dword [eax], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x1001a119
mov dword [esp + 0x20], 0x702377d6
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x34]
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x34], ecx
xor eax, eax
cmp ecx, 1
setle al
cmp eax, 1
jae 0x1001a0d9
cmp dword [esp + 0x20], ebx
je 0x1001a0d9
xor edx, edx
inc edx
jmp 0x1001a0db
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
sub ecx, 0x2efe8e60
cmp ecx, 0xfffffffb
setne al
cmp eax, dword [esp + 0x20]
jl 0x1001a108
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x34], ebx
jne 0x1001a108
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
dec dword [esp + 0x1c]
jns 0x1001a091
lea ecx, [esp + 0x124]
call fcn.1001714c
dec dword [esp + 0x10]
push 1
pop ecx
jns 0x1001a02c
mov dword [esp + 0x1c], ebx
jmp 0x1001a158
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a154
push 0x1ae2
push 0x1a9c
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xa
jl 0x1001a138
inc dword [esp + 0x14]
push 1
pop ecx
cmp dword [esp + 0x14], ebx
jle 0x1001a016
push 0xfffffffffffffff6
mov dword [esp + 0x18], ebx
pop esi
jmp 0x1001a1c4
mov dword [esp + 0x10], 0xfffffff9
mov dword [esp + 0x20], 0xd0d8167e
mov dword [esp + 0x1a4], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jne 0x1001a179
mov dword [esp + 0x3c], ebx
jmp 0x1001a1e3
mov eax, dword [esp + 0x3c]
mov dword [esp + eax*4 + 0xa8], 0xe3649e8e
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], ecx
jl 0x1001a1d0
push 4
lea ecx, [esp + 0x6c]
call fcn.100170ca
push 4
pop edx
mov byte [esp + 0x1c4], dl
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0x497a847e
mov dword [esp + 0x10], ebx
jmp 0x1001a233
cmp dword [esp + 0x10], edx
jl 0x1001a220
mov dword [esp + 0x2c], 0x4efd0e68
mov dword [esp + 0x20], ebx
jmp 0x1001a5dc
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1ac], 0x580973f9
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1001a5c9
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1ac], edx
mov dword [esi + 4], edx
or dword [esp + 0x1c4], 0xffffffff
lea ecx, [esp + 0x40]
call fcn.1001714c
mov dword [esp + 0x2c], 0x69f4981
mov dword [esp + 0x20], ebx
jmp 0x1001a623
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xd4], 0x352f
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1001a610
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a63f
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
imul eax, dword [esp + 0xdc], 0x65e08ccb
cmp eax, 1
jg 0x1001a656
mov eax, dword [esp + 0xdc]
mov eax, dword [esp + 0xdc]
mov ecx, 0x3e8
mov eax, dword [esp + 0xdc]
sub eax, 0xafbbd0a7
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0xa4]
cdq
idiv ecx
mov ecx, dword [esp + 0x58]
mov esi, edx
mov edi, eax
call fcn.10018f1d
mov ecx, dword [esp + 0x1bc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret