Function at 0x10018f03
Capabilities:
Delete file
Get session user name
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10064b95
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x268
mov dword [esp + 0x38], ecx
push ebx
mov dword [esp + 8], 0x3d78
xor ebx, ebx
mov dword [esp + 0x18], ebx
push esi
mov dword [esp + 0x20], 0x4292978d
mov esi, edx
mov dword [esp + 0x18], 0xffffffff
push edi
mov dword [esp + 0x40], esi
mov dword [esp + 0x18], ebx
jmp 0x10018f68
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x100], 0x93876a47
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10018f55
mov dword [esp + 0x18], ebx
jmp 0x10018f88
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1d0], 0xb333ee6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10018f75
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x10018fa4
push 0x1e30
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
je 0x10018fb2
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov edx, 0xce6e
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x104]
mov dword [esp + 0x100], 0xce6f
mov eax, dword [esp + 0x20]
sub edx, eax
mov dword [esp + 0x1d0], edx
mov eax, dword [esp + 0x24]
cmp edx, eax
setge cl
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10019025
mov dword [esp + 0x20], 0xffffffff
dec dword [esp + 0x20]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x10019021
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x19
jle 0x10019003
mov eax, dword [0x1060efe0]
xor edi, edi
inc edi
test al, 1
jne 0x100190cb
or eax, edi
mov dword [0x1060efe0], eax
push ebx
mov dword [esp + 0x280], ebx
push ebx
mov dword [0x1060efa0], ebx
mov dword [0x1060efa4], ebx
call fcn.1001cc9f
mov dword [0x1060efa0], eax
mov dword [0x1060efa8], ebx
mov dword [0x1060efb0], ebx
mov byte [esp + 0x27c], 2
mov ecx, 0x1060efa8
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x7c]
push eax
push 0x10
push ebx
lea eax, [esp + 0x190]
mov dword [0x1060efbc], 0x3f800000
push eax
mov dword [0x1060efac], ebx
call fcn.1001ca77
push 0x10065994
mov dword [0x1060efb4], 7
mov dword [0x1060efb8], 8
call fcn.1004f3ac
or dword [esp + 0x280], 0xffffffff
pop ecx
imul eax, dword [esp + 0x44], 0x2710
add eax, esi
mov dword [esp + 0x64], eax
mov dword [esp + 0x18], edi
mov dword [esp + 0x20], 0x5fc6
cmp dword [esp + 0x20], 0x6331
jle 0x10019146
push 0x995
call dword [sym.imp.USER32.dll_IsZoomed]
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0x1e8]
and eax, esi
cdq
push edx
push eax
call fcn.1000d25a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001911b
mov eax, dword [eax]
push eax
call fcn.1004f3d6
pop ecx
push ebx
push 1
lea ecx, [esp + 0x1f0]
call fcn.1001aeef
inc edi
cmp edi, 0x787b
jl 0x100190fe
inc esi
cmp esi, 0xd6d
jl 0x100190fc
xor edi, edi
inc edi
mov dword [esp + 0x24], 2
cmp dword [esp + 0x20], 0x5c1e
jge 0x10019163
push 0x100087d8
call fcn.1004f3d6
pop ecx
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x138]
push 4
call fcn.1001aa9f
push 4
lea ecx, [esp + 0x18c]
mov dword [esp + 0x280], 5
call fcn.1001aa9f
mov dword [esp + 0xc], ebx
jmp 0x100191ae
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10019198
mov dword [esp + 0xc], ebx
jmp 0x100191d1
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x188]
mov dword [eax + ecx*4], 0x2afd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x100191bb
cmp dword [esp + 0x18], ebx
je 0x1001922f
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setge dl
sub edx, 0x2c5d177c
neg edx
sbb edx, edx
xor eax, eax
inc edx
sub edx, dword [esp + 0x18]
cmp edx, 0x4aaf
mov edx, edi
setg al
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jne 0x10019231
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x138]
sete cl
mov dword [eax + 4], ecx
lea ecx, [esp + 0x188]
call fcn.1001ab21
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x138]
call fcn.1001ab21
lea eax, [esp + 0x64]
push eax
call fcn.1001ab63
mov eax, dword [eax]
test eax, eax
je 0x10019282
mov dword [esp + 0x8c], eax
jmp 0x1001a7cb
mov dword [esp + 0x10], 0xfffffffc
mov esi, 0xffff
mov dword [esp + 0x34], 0xf6b8f3d4
mov dword [esp + 0x34], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], 7
mov dword [esp + 0x10], ebx
jmp 0x100192bc
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1c4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x100192ad
mov dword [esp + 0x10], ebx
jmp 0x100192e4
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x1c4]
mov dword [esp + 0x1c], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x100192c9
inc dword [esp + 0x20]
mov eax, dword [0x1060efe0]
test al, 2
jne 0x10019396
or eax, 2
mov dword [0x1060efe0], eax
push ebx
mov dword [esp + 0x280], 6
push ebx
mov dword [0x1060eff0], ebx
mov dword [0x1060eff4], ebx
call fcn.1001cc9f
mov dword [0x1060eff0], eax
mov dword [0x1060eff8], ebx
mov dword [0x1060f000], ebx
mov byte [esp + 0x27c], 8
mov ecx, 0x1060eff8
mov dword [esp + 0xa4], eax
lea eax, [esp + 0xa4]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1a0]
mov dword [0x1060f00c], 0x3f800000
push eax
mov dword [0x1060effc], ebx
call fcn.1001ca77
push 0x1006598f
mov dword [0x1060f004], 7
mov dword [0x1060f008], 8
call fcn.1004f3ac
or dword [esp + 0x280], 0xffffffff
pop ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0x6c], xmm0
mov dword [esp + 0xc], 0xb26bdde0
mov dword [esp + 0x20], 0x3d3
cmp dword [esp + 0x20], 0x3f4
jle 0x10019407
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x200]
cdq
push edx
push eax
call fcn.1000d25a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100193dc
mov eax, dword [eax]
push eax
call fcn.1004f3d6
pop ecx
push ebx
push 1
lea ecx, [esp + 0x208]
call fcn.1001aeef
inc edi
cmp edi, 0x6ee6
jl 0x100193bd
inc esi
cmp esi, 0x6a8e
jl 0x100193bb
xor edi, edi
inc edi
mov dword [esp + 0x18], 0xc39d
cmp dword [esp + 0x20], 0x15c
jge 0x10019424
push 0x10008838
call fcn.1004f3d6
pop ecx
or dword [esp + 0x27c], 0xffffffff
mov dword [esp + 0x28], 6
mov dword [esp + 0x1c], 0xaa473ecf
mov dword [esp + 0x1c], 0x4bae914
mov dword [esp + 0x1c], 0x698b42d
mov dword [esp + 0x10], ebx
jmp 0x10019465
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xb4], 0x4891023f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019452
mov dword [esp + 0xc], 0x1a
jmp 0x10019654
push edi
lea ecx, [esp + 0x10c]
call fcn.1001aa9f
mov dword [esp + 0x27c], 0xb
mov dword [esp + 0x10], 0xfffffffa
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], ebx
jmp 0x100194c1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0x18d58162
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100194ab
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x100195dc
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], 0x6b6d
cmp dword [esp + 0x1c], 0x6c6a
jle 0x1001955e
mov dword [esp + 0x24], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], 0x7f25
mov esi, dword [esp + 0x2c]
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x218]
cdq
push edx
push eax
call fcn.1000d25a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10019524
mov eax, dword [eax]
push eax
call fcn.1004f3d6
pop ecx
push ebx
push 1
lea ecx, [esp + 0x220]
call fcn.1001aeef
inc edi
cmp edi, 0x1d66
jl 0x10019505
mov esi, dword [esp + 0x24]
add dword [esp + 0x2c], esi
dec dword [esp + 0x20]
jne 0x100194ff
inc esi
mov dword [esp + 0x24], esi
cmp esi, 0x1f10
jl 0x100194f3
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x108]
imul eax, dword [eax + ecx*4], 0xffff
mov ecx, 0xf4a8fe24
sub eax, 0x4172
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x28], eax
cmp dword [esp + 0x1c], 0x6b3b
jge 0x100195ad
push 0x10008888
call fcn.1004f3d6
pop ecx
mov dword [esp + 0x27c], 0xb
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100195cf
push ebx
push 0x1559
call dword [sym.imp.USER32.dll_SetMenu]
dec dword [esp + 0x10]
jns 0x100194d5
xor edi, edi
inc edi
mov dword [esp + 0x28], 4
xor edx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0xb8]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb8]
setg dl
neg ecx
mov dword [esp + 0x1c], edx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov ecx, dword [esp + 0x18]
setg dl
sub ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp edx, ecx
lea ecx, [esp + 0x108]
setge al
mov dword [esp + 0x28], eax
or dword [esp + 0x27c], 0xffffffff
call fcn.1001ab21
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe3
jg 0x10019479
cmp dword [esp + 0xc], ebx
jne 0x100196a0
mov eax, dword [esp + 0xb8]
xor ecx, ecx
cmp eax, 0xffffffff
setle cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setge dl
mov dword [esp + 0x1c], edx
mov edx, ebx
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
je 0x100196a2
mov edx, edi
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setl cl
xor edx, edx
cmp eax, ecx
setne dl
xor ecx, ecx
add edx, dword [esp + 0xc]
imul edx, dword [esp + 0x18]
mov eax, dword [esp + 0xb8]
cmp eax, edx
setg cl
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x44]
push eax
call fcn.1001abc5
push edi
lea ecx, [esp + 0x148]
mov esi, dword [eax]
mov eax, 0xffff
mov dword [esp + 0x14], 0xfffffff6
mov dword [esp + 0x154], eax
mov dword [esp + 0x158], eax
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
call fcn.1001aa9f
mov dword [esp + 0x24], edi
mov dword [esp + 0xc], ebx
jmp 0x10019745
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0x3ed23c5a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001972f
mov dword [esp + 0xc], ebx
jmp 0x10019764
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x198], 0xcbdb62b2
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10019751
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001977e
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov dword [esp + 0x10], ebx
jmp 0x10019865
mov dword [esp + 0xc], 0x3a18e418
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 0x9904
mov dword [esp + 0x20], 0xe526954e
mov dword [esp + 0x30], edi
cmp dword [esp + 0x10], ebx
je 0x10019804
xor ecx, ecx
mov dword [esp + 0x15c], 0x1355fff6
mov eax, dword [esp + 0xc]
cmp eax, 0x1355fff6
setne cl
neg ecx
sub ecx, 0x5452fa81
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
cmp eax, ecx
setg dl
add edx, dword [esp + 0x1c]
je 0x100197f0
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x144]
mov eax, dword [eax]
mov dword [esp + 0x1a0], eax
cmp dword [esp + 0x28], ebx
jne 0x1001985b
mov eax, dword [esp + 0x198]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
dec dword [esp + 0x24]
cmp eax, ecx
mov eax, edi
cmove eax, ebx
xor edx, edx
cmp eax, 0xfffffff9
setne dl
xor ecx, ecx
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
cmp edx, eax
mov eax, ebx
setge cl
cmp ecx, dword [esp + 0x18]
jne 0x1001985d
mov eax, edi
mov dword [esp + 0x30], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe9
jl 0x10019787
lea ecx, [esp + 0x144]
call fcn.1001ab21
cmp byte [ebp + 0xc], 0
jne 0x1001988a
test esi, esi
jne 0x10019db1
mov dword [esp + 0xc], 0x2cb5
lea ecx, [esp + 0x16c]
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x34], 0xddac0faa
mov dword [esp + 0x34], 3
push 4
call fcn.1001aa9f
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
jmp 0x100198e4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100198ce
cmp dword [esp + 0xc], ebx
jne 0x10019922
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp ecx, eax
setl dl
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], ebx
je 0x10019916
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x16c]
mov eax, dword [esp + 0xc]
add eax, dword [esp + 0xc]
mov dword [esp + 0x30], eax
dec dword [esp + 0x1c]
call fcn.1001ab21
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x260]
mov ecx, dword [esp + 0x44]
push eax
call fcn.1000d2d5
mov esi, eax
lea edi, [esp + 0x70]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
mov dword [esp + 0xc], 0x6de713a4
mov dword [esp + 0x10], ebx
inc edi
jmp 0x10019982
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x68], 0x35568345
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10019972
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001999b
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov dword [esp + 0xc], ebx
jmp 0x10019a11
push 2
lea ecx, [esp + 0xc4]
call fcn.1001aa9f
mov dword [esp + 0x10], ebx
jmp 0x100199cb
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 0x1738ab65
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100199b5
mov eax, dword [esp + 0xc0]
mov dword [eax], ebx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100199f3
push 0x18a3
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov eax, dword [esp + 0xc0]
inc dword [eax]
cmp dword [eax], 0
jle 0x100199db
lea ecx, [esp + 0xc0]
call fcn.1001ab21
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x100199a1
cmp byte [ebp + 0xc], 0
je 0x10019dad
cmp dword [esp + 0x74], 0
je 0x10019dad
mov dword [esp + 0x10], 0xd2e8
lea ecx, [esp + 0xe4]
mov dword [esp + 0xc], 0xfffffff6
push 4
call fcn.1001aa9f
push 3
lea ecx, [esp + 0xac]
mov dword [esp + 0x280], 0xe
call fcn.1001aa9f
push edi
lea ecx, [esp + 0x130]
mov byte [esp + 0x280], 0xf
call fcn.1001aa9f
mov dword [esp + 0x34], 0xd293d0ae
mov dword [esp + 0x18], ebx
jmp 0x10019a9c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0xe92f9e84
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10019a86
mov dword [esp + 0x18], ebx
jmp 0x10019abc
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xa8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10019aa9
mov dword [esp + 0x18], ebx
jmp 0x10019adb
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10019ac9
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0xc], ebx
je 0x10019afb
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x10], edi
jne 0x10019b0d
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe4]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], 0x622c
xor eax, eax
cmp ecx, 0xffffffff
setg al
xor edx, edx
cmp eax, 0xfffffffb
mov eax, dword [esp + 0xa8]
setne dl
xor ecx, ecx
cmp edx, 0xfffffffd
setge cl
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x12c]
mov dword [eax], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xa8]
cmp dword [eax + 8], ebx
je 0x10019b95
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019be7
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x10019be7
mov dword [esp + 0x10], 0xb9fe29f1
xor edx, edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa8]
cmp ecx, dword [eax]
mov eax, dword [esp + 0xe4]
setg dl
mov dword [eax + 0xc], edx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x10019be7
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019be1
push ebx
push ebx
push 0x1a30
push 0x131
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
dec dword [esp + 0x10]
jns 0x10019bc3
lea ecx, [esp + 0x12c]
call fcn.1001ab21
lea ecx, [esp + 0xa8]
call fcn.1001ab21
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0xe4]
call fcn.1001ab21
mov dword [esp + 0x10], 0x36c0
cmp dword [esp + 0x10], 0x3a24
jle 0x10019cc1
mov edi, ebx
mov dword [esp + 0x28], ebx
mov eax, edi
mov dword [esp + 0x20], 0x42d1
mov dword [esp + 0x24], eax
mov esi, ebx
mov dword [esp + 0x1c], ebx
add eax, esi
mov edi, ebx
mov dword [esp + 0x30], eax
mov esi, eax
mov eax, esi
lea ecx, [esp + 0x248]
or eax, edi
cdq
push edx
push eax
call fcn.1000d25a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10019c6a
mov eax, dword [eax]
push eax
call fcn.1004f3d6
pop ecx
push ebx
push 1
lea ecx, [esp + 0x250]
call fcn.1001aeef
inc edi
cmp edi, 0x3e57
jl 0x10019c4d
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
inc esi
mov dword [esp + 0x1c], esi
cmp esi, 0x4e86
jl 0x10019c43
dec eax
dec dword [esp + 0x20]
mov dword [esp + 0x24], eax
jne 0x10019c3d
mov edi, dword [esp + 0x28]
inc edi
mov dword [esp + 0x28], edi
cmp edi, 0x5e4e
jl 0x10019c2f
xor edi, edi
inc edi
cmp dword [esp + 0x10], 0x35a7
mov eax, dword [esp + 0x78]
mov dword [esp + 0x90], eax
jge 0x10019ce1
push 0x100088c4
call fcn.1004f3d6
pop ecx
or dword [esp + 0x27c], 0xffffffff
mov dword [esp + 0x18], 7
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0xffffffee
jne 0x10019da2
mov esi, 0xffff
mov dword [esp + 0xc], 0xfffffff8
mov dword [esp + 0xc], ebx
jmp 0x10019d8c
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x30], edi
mov dword [esp + 0x10], 0xffffffea
jmp 0x10019d81
mov dword [esp + 0x1c], 0x50f82bae
mov eax, dword [esp + 0xc]
cmp esi, eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0xfff815bc
setge al
xor ecx, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x30]
setle cl
imul eax, ecx, 0x9051
sub eax, 0x6f9b6917
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x30], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffeb
jge 0x10019d29
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffec
je 0x10019d13
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffee
je 0x10019d05
mov eax, dword [esp + 0x74]
mov dword [esp + 0x94], eax
mov esi, dword [esp + 0x2c]
push 3
lea ecx, [esp + 0x17c]
call fcn.1001aa9f
mov dword [esp + 0x20], 0xdf3d37a5
mov dword [esp + 0xc], ebx
jmp 0x10019de3
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0x8261f9c2
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10019dcd
mov dword [esp + 0xc], ebx
jmp 0x10019e00
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x3c], 0x9be1d925
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10019df0
mov dword [esp + 0x3c], ebx
jmp 0x10019e2e
mov dword [esp + 0x1c], 0xf2e5
inc dword [esp + 0x1c]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019e2a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], 2
jle 0x10019e0c
dec dword [esp + 0x20]
lea ecx, [esp + 0x178]
call fcn.1001ab21
test esi, esi
jne 0x1001a179
cmp dword [esp + 0x6c], esi
jle 0x1001a179
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], 0xef9a8551
mov dword [esp + 0x1c], 7
mov dword [esp + 0xc], edi
mov dword [esp + 0xc], ebx
jmp 0x10019e85
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x48], 0x7822
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10019e75
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x48], ebx
je 0x10019eb6
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], 0xdd972c40
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov dword [esp + 0xc], 2
cmp dword [esp + 0xc], ebx
jl 0x10019f07
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019f01
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
dec dword [esp + 0xc]
jns 0x10019ef0
mov dword [esp + 0x34], 0xbaf43b7c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019f2d
push 0x389
push ebx
push ebx
push 0x1378
push ebx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019f3f
push ebx
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
push 4
pop esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x30], 0x3af72b57
mov dword [esp + 0x1c], 0x94d2b5f7
mov dword [esp + 0x10], ebx
jmp 0x10019f68
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x38], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10019f5c
mov dword [esp + 0x18], ebx
jmp 0x10019f8b
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019f87
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff2
jge 0x10019f74
mov dword [esp + 0x18], ebx
jmp 0x1001a03b
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1001a02d
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x38]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x38]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x38]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x38]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x38]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setg cl
cmp ecx, dword [esp + eax*4 + 0x38]
jle 0x1001a01e
mov dword [esp + 0x1c], 5
mov dword [esp + 0x20], 0x72c40a98
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
jmp 0x1001a029
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
jne 0x1001a087
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10019fac
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x10019f9b
cmp dword [esp + 0x70], 0
je 0x1001a179
mov dword [esp + 0x18], edi
lea ecx, [esp + 0x114]
mov dword [esp + 0x1c], 2
push esi
call fcn.1001aa9f
push esi
lea ecx, [esp + 0x164]
mov dword [esp + 0x280], 0x12
call fcn.1001aa9f
mov dword [esp + 0xc], ebx
jmp 0x1001a0a8
push 0x2389
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001a092
mov dword [esp + 0xc], ebx
jmp 0x1001a0ca
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0x2afd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001a0b4
cmp dword [esp + 0x18], ebx
je 0x1001a127
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setge dl
sub edx, 0x2c5d177c
neg edx
sbb edx, edx
xor eax, eax
inc edx
sub edx, dword [esp + 0x18]
cmp edx, 0x4aaf
mov edx, edi
setg al
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jne 0x1001a129
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x114]
sete cl
mov dword [eax + 4], ecx
lea ecx, [esp + 0x160]
call fcn.1001ab21
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x114]
call fcn.1001ab21
mov ecx, dword [esp + 0x70]
call fcn.10018ed2
mov esi, eax
lea eax, [esp + 0x44]
push eax
mov dword [esp + 0x30], esi
call fcn.1001abc5
mov dword [eax], esi
mov dword [esp + 0x1c], 0x5e60
cmp dword [esp + 0x1c], 0x5ec1
jle 0x1001a1d7
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0x230]
xor eax, esi
cdq
push edx
push eax
call fcn.1000d25a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a1ac
mov eax, dword [eax]
push eax
call fcn.1004f3d6
pop ecx
push ebx
push 1
lea ecx, [esp + 0x238]
call fcn.1001aeef
inc edi
cmp edi, 0x6b71
jl 0x1001a18f
inc esi
cmp esi, 0x2fc9
jl 0x1001a18d
xor edi, edi
inc edi
mov dword [esp + 0x10], 0xdb3ae355
mov dword [esp + 0x18], 0xfaf07207
mov dword [esp + 0x30], 0xa2e71cc
mov dword [esp + 0x10], 6
cmp dword [esp + 0x10], edi
jge 0x1001a324
mov esi, 0x83111738
push 2
lea ecx, [esp + 0x9c]
call fcn.1001aa9f
mov dword [esp + 0x54], esi
mov eax, 0xed09eb81
mov dword [esp + 0x58], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x60], esi
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
push 2
mov dword [esp + 0x100], eax
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1001a264
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0x3eb9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001a24e
mov dword [esp + 0x58], edi
cmp dword [esp + 0x58], ebx
jl 0x1001a2bd
mov dword [esp + 0xc], 0x9ce456
mov dword [esp + 0xc], ebx
jmp 0x1001a298
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0x1324
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001a282
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x98]
mov eax, dword [eax + ecx*4]
neg eax
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
dec dword [esp + 0x58]
jns 0x1001a274
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x98]
cmp dword [esp + 0x58], 3
mov eax, dword [eax + 4]
mov dword [esp + 0xf0], eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, dword [esp + 0xf0]
setl cl
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x98]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
call fcn.1001ab21
dec dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001a206
cmp dword [esp + 0x1c], 0x5df8
jge 0x1001a339
push 0x10008914
call fcn.1004f3d6
pop ecx
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.10014572
mov dword [esp + 0x10], 0xe87df2f4
lea ecx, [esp + 0x120]
push 2
call fcn.1001aa9f
mov dword [esp + 0x27c], 0x15
mov dword [esp + 0x1c], 0x3ee76373
mov dword [esp + 0x18], 0x81438367
mov dword [esp + 0x34], 0x17b38e51
mov dword [esp + 0x34], 0xfffffffe
mov dword [esp + 0xc], ebx
jmp 0x1001a3a4
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x120]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001a391
mov edi, dword [esp + 0x120]
xor edx, edx
mov ecx, dword [edi]
mov esi, dword [edi + 4]
lea eax, [ecx + 0x74b2]
cmp eax, ecx
setle dl
xor ecx, ecx
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x18]
cmp esi, eax
mov eax, esi
setne cl
xor edx, edx
neg eax
cmp eax, ecx
lea eax, [esi + esi]
setne dl
xor ecx, ecx
neg edx
cmp esi, eax
mov eax, dword [esp + 0x18]
setne cl
mov dword [esp + 0x30], edx
xor edx, edx
cmp ecx, dword [esp + 0x30]
setne dl
xor ecx, ecx
sub edx, esi
cmp edx, eax
mov eax, dword [esp + 0x10]
setle cl
dec dword [esp + 0x10]
cmp eax, ecx
jle 0x1001a425
mov dword [esp + 0x30], 0x311e2db8
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
jmp 0x1001a5c5
push dword [esp + 0x68]
movdqa xmm0, xmmword [0x1000be20]
lea eax, [esp + 0x1b8]
push eax
lea eax, [esp + 0x1ac]
mov dword [esp + 0x28], ebx
push eax
push ebx
lea ecx, [esp + 0xe8]
mov dword [esp + 0xe8], ebx
movdqu xmmword [esp + 0x1b4], xmm0
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
call fcn.1001d49c
mov byte [esp + 0x27c], 0x16
mov dword [esp + 0x24], 0xda781b5f
mov dword [esp + 0x28], 0xc0c8
mov dword [esp + 0x1c], 0x887e981c
cmp dword [esp + 0x20], ebx
je 0x1001a515
push dword [esp + 0x68]
movdqa xmm0, xmmword [0x1000be10]
lea eax, [esp + 0x1c8]
push eax
lea eax, [esp + 0x1bc]
mov dword [esp + 0x38], ebx
push eax
push ebx
lea ecx, [esp + 0xdc]
mov dword [esp + 0xdc], ebx
movdqu xmmword [esp + 0x1c4], xmm0
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
call fcn.1001d49c
mov dword [esp + 0x34], ebx
mov dword [esp + 0x10], 0xffffffe9
jmp 0x1001a4f9
cmp dword [esp + 0x30], ebx
jne 0x1001a500
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xb
jg 0x1001a4ef
inc dword [esp + 0x28]
lea ecx, [esp + 0xcc]
call fcn.1001ab21
jmp 0x1001a5b9
mov dword [esp + 0xc], 0xffffffff
xor edx, edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
cmp eax, 5
mov eax, dword [esp + 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x59ce7900
setl al
xor edx, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x28]
cmp eax, dword [edi + 4]
mov eax, dword [esp + 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
imul ecx, ecx, 0x2e9a
neg eax
cmp eax, ecx
jl 0x1001a5a5
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
imul eax, dword [esp + 0xc], 0x9d8d
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xd8]
call fcn.1001ab21
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a5db
push 0x1555
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x120]
call fcn.1001ab21
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x1001a615
mov edx, dword [esp + 0x40]
call fcn.10018ef9
mov esi, eax
lea eax, [esp + 0x64]
push eax
mov dword [esp + 0x90], esi
call fcn.1001ab63
mov dword [eax], esi
mov dword [esp + 0x10], 0xf6af1124
mov dword [esp + 0x10], 0xfffffff2
jmp 0x1001a7c0
push 4
lea ecx, [esp + 0x84]
call fcn.1001aa9f
mov dword [esp + 0xc], 4
mov dword [esp + 0xc], ebx
jmp 0x1001a65c
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x80]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001a646
push 3
mov dword [esp + 0x10], ebx
pop ecx
jmp 0x1001a67f
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1dc], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001a66c
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], ecx
jg 0x1001a79d
mov edi, dword [esp + 0x80]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x40], 6
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
jl 0x1001a70d
mov dword [esp + 0x2c], 0x4f98cafa
xor edx, edx
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
cmp eax, ecx
setge dl
xor ecx, ecx
sub edx, dword [esp + 0x2c]
imul edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp edx, dword [edi + 0xc]
setg cl
sub ecx, eax
mov eax, dword [esp + 0x80]
mov dword [esp + 0x40], ecx
xor ecx, ecx
cmp dword [esp + 0x40], 0x1dfe
setg cl
mov dword [eax + esi*4], ecx
cmp dword [esp + 0x2c], ebx
jne 0x1001a70d
dec dword [esp + 0x18]
jns 0x1001a6b0
cmp dword [edi + 0xc], ebx
je 0x1001a760
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, dword [edi + 0xc]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0x80]
setg cl
imul esi, ecx
xor edx, edx
test esi, esi
mov dword [eax + 8], esi
mov eax, dword [esp + 0x10]
sete dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp dword [esp + 0xc], ecx
jl 0x1001a74b
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub eax, 0xca862934
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x1e0], eax
mov eax, dword [esp + 0x10]
neg eax
push 3
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp ecx, eax
pop ecx
setne dl
xor eax, eax
cmp edx, 0x8d8ef068
setne al
mov dword [esp + 0x40], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jle 0x1001a69a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a7b0
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
lea ecx, [esp + 0x80]
call fcn.1001ab21
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1b
je 0x1001a62a
mov eax, dword [ebp + 8]
lea esi, [esp + 0x8c]
mov ecx, dword [esp + 0x274]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret