Function at 0x1001a0b1
Capabilities:
Check os version
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100849d3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d8
push ebx
push esi
mov dword [esp + 0x14], 1
or esi, 0xffffffff
push edi
mov dword [esp + 0x30], 0x8b0d193e
xor ebx, ebx
mov dword [esp + 0x2c], 0x67d50f82
push 3
mov dword [esp + 0x3c], esi
pop edi
mov dword [esp + 0x34], edi
mov byte [esp + 0x17], bl
mov dword [esp + 0xd8], edx
mov dword [esp + 0x40], ecx
cmp byte [esp + 0x17], bl
je 0x1001a119
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [esp + 0x18], 0xfffffffb
jmp 0x1001a179
mov dword [esp + 0x24], 0x1e124dc4
mov ecx, 0xef6e229e
mov dword [esp + 0x30], 0x6310
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x30]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [esp + 0x24]
imul eax, dword [esp + 0x18], 0x49f8
mov dword [esp + 0x38], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x38]
setle cl
mov dword [esp + 0x38], ecx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff8
jl 0x1001a123
push 2
lea ecx, [esp + 0x88]
call fcn.10018221
mov dword [esp + 0x1ec], ebx
lea eax, [esp + 0x1a8]
push dword [esp + 0x40]
movdqa xmm0, xmmword [0x10007d80]
lea ecx, [esp + 0x94]
push eax
lea eax, [esp + 0x1a0]
mov dword [esp + 0x28], 1
push eax
push ebx
movdqu xmmword [esp + 0x1a8], xmm0
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
call fcn.10019760
mov byte [esp + 0x1ec], 1
mov dword [esp + 0x30], 0xa772
mov dword [esp + 0x38], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001a218
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x84]
mov dword [eax + ecx*4], 0x1928
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001a202
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 1
jg 0x1001a40c
mov edi, dword [esp + 0x84]
push 1
lea ecx, [esp + 0x70]
call fcn.10018221
push 2
lea ecx, [esp + 0x128]
mov byte [esp + 0x1f0], 2
call fcn.10018221
mov dword [esp + 0x2c], 0xc1d9
mov dword [esp + 0x10], ebx
jmp 0x1001a273
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x6c]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001a264
push 2
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001a299
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a283
mov dword [esp + 0x10], ebx
jmp 0x1001a2b8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xf8], 0x4b13b106
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a2a5
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x6c]
mov ecx, dword [edi + 4]
mov dword [eax], ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x6c]
cmp dword [eax], esi
mov eax, dword [esp + 0x84]
setl dl
imul edx, dword [eax + ecx*4]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x124]
setle dl
xor ecx, ecx
cmp edx, 0x718b
setl cl
mov dword [eax], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x90]
mov dword [eax], ecx
mov eax, dword [esp + 0x6c]
mov edx, dword [eax]
xor eax, eax
cmp ecx, edx
setle al
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x20]
setge cl
xor edx, edx
cmp ecx, 0xcecb
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
sub ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x6c]
cmp ecx, dword [eax]
mov eax, dword [esp + 0xfc]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0xd707
jle 0x1001a37f
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x20]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x84]
push 0
cmp dword [ecx + edx*4], eax
mov eax, dword [esp + 0x100]
pop edx
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x84]
setle cl
xor edx, edx
cmp dword [eax + esi*4], ecx
mov eax, dword [esp + 0x38]
setge dl
mov dword [esp + 0x2c], edx
xor edx, edx
cmp dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x124]
call fcn.10018a1e
lea ecx, [esp + 0x6c]
mov byte [esp + 0x1ec], 1
call fcn.10018a1e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
push 0xffffffffffffffff
pop esi
jle 0x1001a235
push 3
pop edi
or esi, esi
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a428
push 0x2632
push 0x373
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
lea ecx, [esp + 0x90]
call fcn.10018a1e
lea ecx, [esp + 0x84]
mov dword [esp + 0x1ec], esi
call fcn.10018a1e
push 1
lea ecx, [esp + 0xcc]
call fcn.10018221
xor edx, edx
inc edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], 0x52509e71
mov dword [esp + 0xc], 0xa97f51ef
mov dword [esp + 0x10], ebx
jmp 0x1001a48c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 0x91a049fe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a476
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jg 0x1001a664
jmp 0x1001a4a5
xor edx, edx
inc edx
mov dword [esp + 0x28], 0x18d9dce
mov dword [esp + 0x1c], 0xb3e713e1
mov dword [esp + 0x20], 0xedf0ebf9
mov dword [esp + 0x24], 5
mov dword [esp + 0x2c], 0xf83943c
cmp dword [esp + 0xc], ebx
je 0x1001a4d9
cmp dword [esp + 0x28], ebx
jne 0x1001a4db
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x28], 0xd870a326
mov eax, dword [esp + 0x28]
inc dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x3b9c309a
setne al
imul eax, eax, 0xb619
test eax, eax
je 0x1001a590
mov dword [esp + 0x30], 0x64e785c2
mov dword [esp + 0x2c], 0xbd1a6f32
mov dword [esp + 0x20], ebx
jmp 0x1001a585
mov dword [esp + 0x34], 0xfebdab6a
mov eax, dword [esp + 0x20]
push 4
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x28]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1001a547
jmp 0x1001a656
mov dword [esp + 0x28], 0x97fb
mov dword [esp + 0x30], 0x1ca8fd5f
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
cmp esi, eax
push 0
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xc34309e9
setne cl
mov dword [esp + 0x34], ecx
xor ecx, ecx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
cmp eax, 1
setle cl
imul ecx, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
cmp eax, 0xc971
mov eax, dword [esp + 0xcc]
setl cl
cmp ecx, 0xc9934b93
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xcc]
mov eax, dword [esp + 0x1c]
cmp eax, dword [ecx + edx*4]
pop ecx
setg cl
xor eax, eax
inc ecx
cmp ecx, 0x567d
setle al
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xc8]
mov eax, dword [ecx]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001a4a2
mov dword [esp + 0x10], ebx
jmp 0x1001a6ba
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], ebx
jl 0x1001a6a4
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a686
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a69e
push 0xc
push 0x1a94
call dword [sym.imp.KERNEL32.dll_Beep]
dec dword [esp + 0xc]
jns 0x1001a674
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a6b6
push ebx
call dword [sym.imp.USER32.dll_DestroyMenu]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001a66a
lea ecx, [esp + 0xc8]
call fcn.10018a1e
mov dword [esp + 0x20], 0xecb45710
lea ecx, [esp + 0x4c]
push edi
call fcn.10018221
mov dword [esp + 0x1ec], edi
lea ecx, [esp + 0x100]
mov dword [esp + 0x10], 0x7df2f4a8
push edi
call fcn.10018221
mov dword [esp + 0x2c], 0x9e149cff
mov dword [esp + 0x10], ebx
jmp 0x1001a71b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x4c]
mov dword [eax + ecx*4], 0xff0ea75c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001a708
mov dword [esp + 0x10], ebx
jmp 0x1001a73d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0x4b2e809b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001a727
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 2
jg 0x1001a809
mov edi, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x4c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
cmp dword [edi + 8], ebx
je 0x1001a7d0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x4c]
cmp dword [eax + ecx*4], ebx
je 0x1001a77e
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
push 0
cmp eax, dword [ecx + edx*4]
mov eax, dword [esp + 0x104]
pop ecx
setg cl
mov dword [eax + 8], ecx
test ecx, ecx
jne 0x1001a7aa
cmp dword [edi + 8], ebx
jne 0x1001a7aa
mov esi, ebx
jmp 0x1001a7ad
xor esi, esi
inc esi
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x4c]
cmp esi, dword [eax + ecx*4]
setg dl
imul eax, edx, 0x3359
test eax, eax
je 0x1001a7d0
cmp dword [edi + 8], ebx
je 0x1001a7d0
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [edi + 8]
inc eax
cmp eax, 0x4eb0
mov eax, dword [esp + 0x4c]
setg cl
xor edx, edx
cmp dword [eax], ecx
setl dl
sub edx, dword [eax + esi*4]
mov dword [esp + 0x2c], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x1001a756
push 3
pop edi
or esi, 0xffffffff
lea ecx, [esp + 0x100]
call fcn.10018a1e
lea ecx, [esp + 0x4c]
mov dword [esp + 0x1ec], esi
call fcn.10018a1e
push 4
mov dword [esp + 0x4c], 0x69b2e414
pop eax
mov dword [esp + 0x34], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a856
push ebx
push 0x1bed
push ebx
push 0x11b0
push 0x26d0
call dword [sym.imp.GDI32.dll_ExtCreatePen]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a879
push ebx
push 0x2577
push ebx
push ebx
push 0x14f6
push 0x2595
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x164]
push 2
call fcn.10018221
mov dword [esp + 0xc], 0x490c4d8e
mov dword [esp + 0xc], ebx
jmp 0x1001a8af
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 0xd3df
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001a899
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0xc], ebx
jmp 0x1001a8f6
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a8f2
push 0xf99
push 0x1d9b
push 0x567
push edi
push 0x19dc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jle 0x1001a8c2
lea ecx, [esp + 0x164]
call fcn.10018a1e
push dword [esp + 0x40]
lea eax, [esp + 0x19c]
mov dword [esp + 0xc0], ebx
push eax
lea eax, [esp + 0x190]
mov dword [esp + 0xc8], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0xd0], ebx
push ebx
lea ecx, [esp + 0xcc]
movdqu xmmword [esp + 0x198], xmm0
call fcn.10019760
push 4
pop eax
mov dword [esp + 0x1ec], eax
lea ecx, [esp + 0x78]
push dword [esp + 0x40]
movdqa xmm0, xmmword [0x10007de0]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x180]
mov dword [esp + 0x4c], 0x540fff06
push eax
push ebx
movdqu xmmword [esp + 0x188], xmm0
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
call fcn.10019760
push 2
lea ecx, [esp + 0xf0]
mov byte [esp + 0x1f0], 5
call fcn.10018221
mov dword [esp + 0xc], ebx
jmp 0x1001a9d3
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 0x76e6bacd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001a9bd
mov eax, dword [esp + 0xec]
mov dword [eax], ebx
mov ecx, dword [eax]
mov eax, dword [esp + 0x78]
mov dword [esp + 0xc], 8
cmp dword [eax + ecx*4], ebx
jne 0x1001aa20
mov dword [esp + 0xc], ebx
jmp 0x1001aa0d
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x78]
cmp dword [eax + ecx*4], ebx
jne 0x1001aa13
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x1001a9fc
mov eax, dword [esp + 0xec]
inc dword [eax]
cmp dword [eax], edi
jle 0x1001a9e3
lea ecx, [esp + 0xec]
call fcn.10018a1e
push 4
pop eax
lea ecx, [esp + 0x78]
mov byte [esp + 0x1ec], al
call fcn.10018a1e
mov dword [esp + 0xc], ebx
jmp 0x1001aa58
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x9c], 0x41b3c692
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001aa45
mov dword [esp + 0x10], 0xc64a6847
mov dword [esp + 0xc], 0xbe1552b9
mov dword [esp + 0xc], ebx
jmp 0x1001aa87
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xa8], 0x738f5859
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001aa74
mov dword [esp + 0x10], 5
cmp dword [esp + 0x10], ebx
jne 0x1001abd3
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x24], 0xbc9b780f
mov dword [esp + 0x34], 0xd976d993
mov dword [esp + 0x34], 0xfffffffe
mov dword [esp + 0x34], 0xfffffff9
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x34], ebx
mov dword [esp + 0x18], 9
jmp 0x1001abbe
mov dword [esp + 0x30], 5
lea ecx, [esp + 0x118]
push edi
call fcn.10018221
mov dword [esp + 0xc], ebx
jmp 0x1001ab12
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 0xb2f14481
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001aafc
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x10]
cmp eax, 0x39e2
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
cmp eax, edx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
sub ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x118]
cmp ecx, dword [eax + 4]
jg 0x1001ab73
cmp dword [esp + 0x18], ebx
je 0x1001ab73
xor ecx, ecx
inc ecx
jmp 0x1001ab75
mov ecx, ebx
mov dword [esp + 0xa8], ecx
mov eax, dword [esp + 0x18]
sub eax, ecx
jne 0x1001ab88
mov eax, dword [esp + 0x10]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001aba4
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push 4
pop eax
lea ecx, [esp + 0x118]
mov byte [esp + 0x1ec], al
call fcn.10018a1e
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe5
jle 0x1001aae1
dec dword [esp + 0x10]
je 0x1001aaa0
mov dword [esp + 0xc], ebx
jmp 0x1001ac03
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001abff
push 0xa17
push 0x1000
push 0x2a7
push 0xc3d
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x19
jne 0x1001abd9
mov dword [esp + 0x20], 2
cmp dword [esp + 0x20], ebx
jl 0x1001b69e
mov esi, dword [esp + 0xbc]
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x10c]
mov dword [esp + 0x10], 0x8c45cdbe
mov dword [esp + 0xc], 1
push 2
call fcn.10018221
mov byte [esp + 0x1ec], 7
mov dword [esp + 0x2c], 7
push 2
mov dword [esp + 0x10], ebx
pop edi
cmp dword [esp + 0xc], edi
jge 0x1001ac83
mov edx, 0xffff
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001ac6b
mov eax, dword [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 0xc], 0xffffffed
cmp dword [esp + 0xc], 0x36
jge 0x1001adb6
mov dword [esp + 0x38], 0xe9734172
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], ebx
jl 0x1001ad9a
push 4
pop ecx
mov dword [esp + 0x18], ebx
jmp 0x1001acd4
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xdc], 0xccb63e8e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001acc1
mov dword [esp + 0xe0], 1
cmp dword [esp + 0xe0], ebx
jl 0x1001ad90
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x13c]
push 3
call fcn.10018221
mov dword [esp + 0x18], ebx
jmp 0x1001ad24
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001ad0e
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 1
jg 0x1001ad74
mov edi, dword [esp + 0x13c]
mov eax, dword [esp + 0xe0]
xor ecx, ecx
mov esi, dword [esp + 0xe0]
mov edx, dword [esp + 0x10c]
mov eax, dword [edx + eax*4]
cmp eax, dword [edi + 8]
setle cl
xor eax, eax
cmp ecx, dword [edx + esi*4]
setle al
mov dword [esp + 0x2c], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x1001ad3d
lea ecx, [esp + 0x13c]
call fcn.10018a1e
dec dword [esp + 0xe0]
jns 0x1001acf2
push 4
pop ecx
dec dword [esp + 0x10]
jns 0x1001acbb
cmp dword [esp + 0x38], ebx
jne 0x1001adaf
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x36
jl 0x1001ac9e
mov esi, dword [esp + 0x30]
push 2
pop edi
push 4
pop eax
lea ecx, [esp + 0x10c]
mov byte [esp + 0x1ec], al
call fcn.10018a1e
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], 8
mov dword [esp + 0x18], 0xfffffffd
mov dword [esp + 0x10], 0x2ff18c9a
mov dword [esp + 0x1c], 0xfffffffb
push 4
mov dword [esp + 0x30], edi
mov dword [esp + 0x10], ebx
pop ecx
jmp 0x1001ae0d
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x5c], 0x5252cb13
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001adfd
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov eax, dword [esp + 0x68]
xor edx, edx
inc edx
cmp eax, edx
setge cl
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1c], 0x23637b30
mov eax, dword [esp + 0x1c]
test eax, eax
setg cl
imul ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x1001ae95
cmp dword [esp + 0x18], ebx
jne 0x1001ae95
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x2c], edx
jmp 0x1001aeda
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
je 0x1001aeb3
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setne dl
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x1c], edx
xor edx, edx
inc edx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001af35
mov dword [esp + 0x18], edx
mov dword [esp + 0x18], ebx
jmp 0x1001af28
mov dword [esp + 0xc], edi
mov dword [esp + 0xc], 0xb
jmp 0x1001af1d
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001af19
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
xor edx, edx
inc edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x16
jl 0x1001aefd
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff7
jle 0x1001aeef
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x9c]
cmp dword [esp + 0x20], ebx
je 0x1001afac
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov edx, dword [esp + eax*4 + 0x9c]
mov eax, dword [esp + 0xa4]
cmp eax, 0x7e434392
setge cl
xor eax, eax
cmp ecx, edx
setne al
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xa4]
add ecx, eax
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x9c], ecx
xor eax, eax
cmp ecx, 0x5206
setle al
xor ecx, ecx
cmp ecx, eax
mov eax, dword [esp + 0x24]
sbb edx, edx
neg edx
cmp edx, eax
setl cl
cmp dword [esp + 0x48], ecx
jge 0x1001afac
xor eax, eax
inc eax
jmp 0x1001afae
mov eax, ebx
mov edx, dword [esp + 0x24]
add edx, eax
mov eax, dword [esp + 0x24]
neg edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov dword [esi + 4], edx
sete cl
xor eax, eax
cmp ecx, 0x1d534a2c
setg al
cmp eax, 9
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x44], eax
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x44]
cmp eax, ecx
setg dl
cmp edx, dword [esp + 0x48]
jl 0x1001b38b
mov dword [esp + 0x10], 0xfffffffc
mov dword [esp + 0x10], ebx
jmp 0x1001b019
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1bc], 0x204e2db5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b006
mov dword [esp + 0x10], ebx
jmp 0x1001b039
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1c8], 0xee41
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b026
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], ebx
jl 0x1001b05e
mov dword [esp + 0x2c], 0x97f0a290
cmp dword [esp + 0x2c], ebx
jne 0x1001b05e
dec dword [esp + 0x10]
jns 0x1001b04a
mov dword [esp + 0x10], ebx
jmp 0x1001b07a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b076
push ebx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 6
jne 0x1001b064
mov dword [esp + 0xd4], 8
mov dword [esp + 0x18], 0xea5d6c05
mov dword [esp + 0x28], 0x27fa3dfa
mov dword [esp + 0x1c], 7
mov dword [esp + 0x24], 0xb0badcab
mov dword [esp + 0x2c], 0x46153b72
mov dword [esp + 0x34], 0x5adf
mov dword [esp + 0xc], ebx
jmp 0x1001b0d5
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1a8], 0xfffffffd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001b0c2
mov dword [esp + 0x18], 0xffffffe4
cmp dword [esp + 0x18], 1
jge 0x1001b20b
mov esi, 0xffff
push 1
lea ecx, [esp + 0xb0]
call fcn.10018221
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001b126
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], 0xe6a4137d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001b110
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xac]
mov edx, dword [eax]
xor eax, eax
cmp edx, 0x4dfd9964
setl al
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, 0xa6d7
je 0x1001b158
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0xac]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x28]
setg dl
sub edx, eax
jne 0x1001b17c
cmp dword [esp + 0x24], ebx
jne 0x1001b17c
mov edx, ebx
jmp 0x1001b17f
xor edx, edx
inc edx
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x18]
jne 0x1001b194
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], esi
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
sub edx, 0xffff08dc
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [esp + 0x1b0], edx
mov eax, dword [esp + 0x24]
cmp edx, eax
mov eax, dword [esp + 0xac]
setne cl
xor edx, edx
cmp ecx, 0xfffffff7
setg dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [esp + 0x1c]
setne cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp dword [esp + 0x2c], eax
setl cl
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xac]
call fcn.10018a1e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1001b0f4
mov esi, dword [esp + 0x30]
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0xd8]
push eax
push ebx
call fcn.1001c402
mov dword [esp + 0x18], 0xffffffff
add esp, 0xc
mov dword [esp + 0x1c], 0xce2949f4
mov dword [esp + 0x10], 0x9d60a221
mov dword [esp + 0x18], ebx
jmp 0x1001b252
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1d4], 0xa2ef
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001b23f
mov edx, 0xffff
cmp dword [esp + 0xc], edx
sbb eax, eax
inc eax
cmp dword [esp + 0xc], eax
jge 0x1001b286
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
add eax, dword [esp + 0xc]
jne 0x1001b286
mov eax, ebx
jmp 0x1001b289
xor eax, eax
inc eax
cmp edx, eax
mov eax, dword [esp + 0xc]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setne dl
add edx, 0xa
cmp edx, 0xfffffff8
ja 0x1001b2f6
mov dword [esp + 0x34], 0xfffffffd
mov dword [esp + 0x34], 0x348f4a8f
mov dword [esp + 0x24], 0x29ef
mov dword [esp + 0xc], ebx
jmp 0x1001b2d2
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1b4], 7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001b2bf
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b2f0
push 0x138b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec dword [esp + 0x24]
jmp 0x1001b331
mov dword [esp + 0x1c], 0x2b8e
xor ecx, ecx
mov dword [esp + 0x28], 0xb8eb
dec dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
add edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
cmp edx, eax
setle cl
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ebx
jmp 0x1001b37f
mov dword [esp + 0x24], 0xfffffff7
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
sub edx, eax
mov eax, dword [esp + 0x24]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [esp + 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x1c], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x1001b337
jmp 0x1001b694
mov dword [esp + 0x10], ebx
xor ecx, ecx
mov dword [esp + 0x58], 9
inc ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x38], 0x91b0
push 4
mov dword [esp + 0x38], 0x2cebb36e
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1001b3c6
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x154], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001b3b7
mov dword [esp + 0x10], 0xffffffe9
cmp dword [esp + 0x10], 0xfffffff7
jl 0x1001b63a
jmp 0x1001b3e4
xor ecx, ecx
inc ecx
mov dword [esp + 0x18], 0xbf2465c
mov dword [esp + 0x24], 0x1ad5b481
mov dword [esp + 0xb8], 0x90f9cf50
push ecx
mov dword [esp + 0x30], 0x4923552e
lea ecx, [esp + 0x134]
mov dword [esp + 0x40], 0xddd2e786
call fcn.10018221
mov dword [esp + 0xc], ebx
jmp 0x1001b435
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x130]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001b422
cmp dword [esp + 0x58], ebx
jne 0x1001b450
cmp dword [esp + 0x10], 0x215e
jne 0x1001b450
mov esi, ebx
jmp 0x1001b453
xor esi, esi
inc esi
cmp dword [esp + 0x154], ebx
je 0x1001b460
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
xor edx, edx
imul ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setl dl
xor eax, eax
cmp esi, edx
setl al
xor ecx, ecx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x58]
cmp dword [esp + 0x3c], eax
setg cl
xor eax, eax
cmp ecx, 0xffffffff
setg al
cmp eax, 0x351
jge 0x1001b4bc
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b61b
push 0x138b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1001b61b
mov dword [esp + 0x3c], 0xfffffffc
mov dword [esp + 0x1c], 0xf7503ae5
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 1
mov dword [esp + 0xc], ebx
jmp 0x1001b4f1
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x170], 0xfffffffe
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001b4de
cmp dword [esp + 0x160], ebx
je 0x1001b558
mov eax, dword [esp + 0x38]
xor ecx, ecx
cmp eax, 0x3765
setne cl
xor eax, eax
cmp ecx, 0x737a30b9
setl al
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setl dl
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
sub eax, 0x682c
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x158]
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
mov edx, 0xa5798870
setne cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, 0x1cc0d681
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x1c], edx
xor edx, edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x6994
setl al
inc eax
jne 0x1001b5ee
mov eax, dword [esp + 0x158]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x3c], 0x2ca82e93
mov ecx, dword [esp + 0x3c]
cmp ecx, edi
mov eax, dword [esp + 0x130]
mov dword [eax], ecx
sbb eax, eax
inc eax
mov dword [esp + 0x170], eax
lea ecx, [esp + 0x130]
call fcn.10018a1e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff7
jge 0x1001b3e1
mov esi, dword [esp + 0x30]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b694
push ebx
call fcn.1001c3d5
pop ecx
push edi
lea ecx, [esp + 0x14c]
call fcn.10018221
mov dword [esp + 0x1c], ebx
jmp 0x1001b675
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1001b65f
mov eax, dword [esp + 0x148]
lea ecx, [esp + 0x148]
mov dword [eax], 0x1c
call fcn.10018a1e
dec dword [esp + 0x20]
jns 0x1001ac27
or dword [esp + 0x1ec], 0xffffffff
lea ecx, [esp + 0xbc]
call fcn.10018a1e
mov eax, dword [esp + 0xd8]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x40]
mov edi, edx
mov esi, eax
call fcn.1001a03f
mov ecx, dword [esp + 0x1e4]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret