Function at 0x10018946
Capabilities:
Check for time delay via gettickcount
Get geographical location
Modify service
Read .ini file
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008507a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x390
push ebx
push esi
xor esi, esi
mov dword [esp + 0x7c], ecx
push edi
inc esi
mov dword [esp + 0x110], edx
push esi
lea ecx, [esp + 0x2b0]
call fcn.10016b30
xor ebx, ebx
mov dword [esp + 0x10], ebx
jmp 0x100189a3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2ac]
mov dword [eax + ecx*4], 0xd3df75dc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001898d
mov dword [esp + 0x10], ebx
jmp 0x100189bf
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x40], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x100189af
mov edi, dword [sym.imp.USER32.dll_GetMenu]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x40], ebx
jmp 0x100189ea
mov byte [esp + 0x37], bl
cmp byte [esp + 0x37], bl
je 0x100189e6
call esi
push eax
call edi
inc dword [esp + 0x40]
cmp dword [esp + 0x40], ebx
jle 0x100189d7
lea ecx, [esp + 0x2ac]
call fcn.1001734d
mov dword [esp + 0x1c], 0x4438bea1
lea ecx, [esp + 0x280]
xor eax, eax
mov dword [esp + 0x24], 5
inc eax
mov dword [esp + 0x2c], 0x9105fa2e
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], eax
push eax
call fcn.10016b30
xor edx, edx
mov dword [esp + 0x3a4], ebx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x10018a4f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x140], 0x66de6b93
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018a3c
mov dword [esp + 0x10], ebx
jmp 0x10018a6d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x280]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018a5b
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x1c]
imul eax, eax, 0x2206
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
cmp eax, 2
mov eax, dword [esp + 0x1c]
setge cl
add eax, 0x84e4f353
add eax, ecx
mov dword [esp + 0x140], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x10018b5c
jmp 0x10018ae2
xor edx, edx
inc edx
mov dword [esp + 0x30], 0xfffffffa
lea ecx, [esp + 0x218]
mov dword [esp + 0x30], 0x33bab721
push edx
call fcn.10016b30
mov eax, 0x9f94ad8a
mov dword [esp + 0x1ac], eax
mov dword [esp + 0x1b0], eax
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b8], eax
mov dword [esp + 0x14], ebx
jmp 0x10018b3c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x218]
mov dword [eax + ecx*4], 0xcd1ac8c6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10018b26
inc dword [esp + 0x1b0]
lea ecx, [esp + 0x218]
call fcn.1001734d
dec dword [esp + 0x10]
jns 0x10018adf
or dword [esp + 0x3a4], 0xffffffff
lea ecx, [esp + 0x280]
call fcn.1001734d
push dword [esp + 0x80]
movdqa xmm0, xmmword [0x10007f10]
lea eax, [esp + 0x31c]
push eax
lea eax, [esp + 0x310]
mov dword [esp + 0x38], 1
push eax
mov dword [esp + 0x3c], 0x69ad59e5
lea ecx, [esp + 0x16c]
push ebx
movdqu xmmword [esp + 0x318], xmm0
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x178], ebx
call fcn.100180db
mov dword [esp + 0x30], 0x1d01
lea ecx, [esp + 0x160]
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0xfffffff8
mov dword [esp + 0x24], 0x9105fa2e
mov dword [esp + 0x30], 0x811fc80a
inc dword [esp + 0x24]
mov eax, dword [esp + 0x160]
mov dword [eax], 0xa6b719d8
call fcn.1001734d
push 1
lea ecx, [esp + 0x234]
call fcn.10016b30
mov dword [esp + 0x14], 0x4e2db58
mov byte [esp + 0x37], bl
cmp byte [esp + 0x37], 0
je 0x10018c33
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov dword [esp + 0x14], 2
jmp 0x10018c62
mov dword [esp + 0x24], 5
mov byte [esp + 0x37], bl
cmp byte [esp + 0x37], 0
je 0x10018c56
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff0
jne 0x10018c3d
mov dword [esp + 0x10], ebx
jmp 0x10018c85
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x230]
mov dword [eax + ecx*4], 0xd3df75dc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10018c6f
mov dword [esp + 0x10], ebx
jmp 0x10018ca2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x50], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10018c92
mov dword [esp + 0x50], ebx
jmp 0x10018ed6
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0x2c], 0x11721670
mov dword [esp + 0x24], 0x104acd6b
mov dword [esp + 0x14], ebx
jmp 0x10018ce0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x60], 0xb5f7a0d7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10018cd0
mov dword [esp + 0x10], ebx
jmp 0x10018e51
mov dword [esp + 0x1c], 0xf4a8b108
mov dword [esp + 0x14], ebx
jmp 0x10018d11
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x364], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10018cfe
cmp dword [esp + 0x1c], ebx
jne 0x10018e5c
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
add eax, 0xffff7060
cmp eax, dword [esp + 0x10]
jl 0x10018d45
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub eax, 0x74b28ed4
jne 0x10018e34
cmp dword [esp + 0x10], ebx
jne 0x10018e34
mov dword [esp + 0x20], 0xbe360de5
mov dword [esp + 0x14], ebx
jmp 0x10018d7f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1f4], 0x36ae3d47
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10018d6c
xor ecx, ecx
mov dword [esp + 0x20], 0x33c7d24b
mov eax, dword [esp + 0x20]
add eax, 5
cmp eax, 0xffffffff
mov eax, dword [esp + 0x20]
setle cl
cmp ecx, 0xfffd
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, 0xb80ebbd4
setl dl
cmp eax, edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x370]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x1fc]
setge cl
imul eax, ecx
test eax, eax
jne 0x10018ded
cmp dword [esp + 0x1fc], ebx
jne 0x10018ded
mov eax, ebx
jmp 0x10018df0
xor eax, eax
inc eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1c], 0x16
jmp 0x10018e2b
mov dword [esp + 0x14], ebx
jmp 0x10018e17
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x334], 0x61e3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10018e04
cmp dword [esp + 0x33c], ebx
jne 0x10018e4d
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffef
je 0x10018dfe
jmp 0x10018e4d
mov byte [esp + 0x37], bl
cmp byte [esp + 0x37], 0
je 0x10018e47
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
cmp dword [esp + 0x10], ebx
jne 0x10018e5c
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffd
jge 0x10018cf0
inc dword [esp + 0x24]
push 2
mov byte [esp + 0x1f], bl
pop ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x10], ebx
jmp 0x10018e84
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x34c], 0x2c70bb74
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10018e71
mov dword [esp + 0x10], ebx
jmp 0x10018e9f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x28c], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10018e90
inc dword [esp + 0x294]
mov byte [esp + 0x37], bl
cmp byte [esp + 0x37], 0
je 0x10018ec6
push ebx
push 0x208e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp byte [esp + 0x1b], 0
je 0x10018ed2
call esi
push eax
call edi
inc dword [esp + 0x50]
cmp dword [esp + 0x50], ebx
jle 0x10018cb2
lea ecx, [esp + 0x230]
call fcn.1001734d
mov dword [esp + 0x1c], 7
mov dword [esp + 0x20], 3
push 0xfffffffffffffff2
mov dword [esp + 0x28], 0xfffffffa
mov dword [esp + 0x20], 0xffffffe5
pop edi
jmp 0x10018ff8
mov dword [esp + 0x28], 0x13dce9d0
mov dword [esp + 0x14], ebx
jmp 0x10018f35
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x158], 0xea66
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10018f22
mov dword [esp + 0x28], ebx
jmp 0x10018fe9
mov dword [esp + 0x14], 1
mov dword [esp + 0x14], 0xd
jmp 0x10018fb4
mov dword [esp + 0x10], 0xfffffff7
mov dword [esp + 0x10], ebx
jmp 0x10018f78
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x158], 0xb60e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10018f65
mov dword [esp + 0x10], ebx
jmp 0x10018faa
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10018fa6
push 0x1fcb
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x10018f85
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff6
jl 0x10018f57
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x158]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x158]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], 0xffffffff
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xffffffe9
jl 0x10018f45
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jg 0x10018f14
mov dword [esp + 0x10], 0xdd1e1e87
mov dword [esp + 0x20], 0x6373a4c9
mov dword [esp + 0x14], ebx
jmp 0x1001902b
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x340], 0xde574131
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019018
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffff
jb 0x1001904d
cmp dword [esp + 0x10], ebx
jne 0x1001904d
xor edi, edi
mov edx, ebx
inc edi
jmp 0x10019052
xor edi, edi
inc edi
mov edx, edi
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0xab227d3
setl al
xor edx, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, edi
setl al
imul eax, dword [esp + 0x10]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x344], eax
mov dword [esp + 0x10], 0x19
jmp 0x100190da
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100190d6
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x22ea
push 0x24d3
push 0x18f2
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c
jle 0x100190ae
push 4
lea ecx, [esp + 0x6c]
call fcn.10016b30
mov dword [esp + 0x3a4], edi
lea eax, [esp + 0x2f8]
push dword [esp + 0x60]
movdqa xmm0, xmmword [0x10007f00]
lea ecx, [esp + 0xd8]
push eax
lea eax, [esp + 0x2f0]
mov dword [esp + 0x28], 0xb51dba33
push eax
mov dword [esp + 0x28], 0xab72b21a
push ebx
movdqu xmmword [esp + 0x2f8], xmm0
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
call fcn.100180db
mov dword [esp + 0x24], 0x586fd5d7
mov ecx, 0xfffffc28
mov dword [esp + 0x24], 6
xor edx, edx
mov dword [esp + 0x2c], 0x9b780f88
mov eax, dword [esp + 0x20]
inc dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xd4]
cmp ecx, dword [eax]
setl dl
xor eax, eax
cmp edx, edi
setge al
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x24], eax
mov eax, dword [esp + 0x20]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0xd4]
setle dl
xor ecx, ecx
cmp edx, dword [eax + 8]
setle cl
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], 3
cmp dword [esp + 0x1c], ebx
jl 0x100191ea
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0xd4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x1c]
jns 0x100191cf
lea ecx, [esp + 0xd4]
call fcn.1001734d
push dword [esp + 0x60]
movdqa xmm0, xmmword [0x10007ef0]
lea eax, [esp + 0x2dc]
push eax
lea eax, [esp + 0x2d0]
mov dword [esp + 0x10c], ebx
push eax
push ebx
lea ecx, [esp + 0x114]
mov dword [esp + 0x118], ebx
movdqu xmmword [esp + 0x2d8], xmm0
mov dword [esp + 0x11c], ebx
call fcn.100180db
mov byte [esp + 0x3a4], 2
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0x7f39cee2
mov dword [esp + 0x2c], 0x33ecdc0f
mov dword [esp + 0x3c], 0x2a93
mov dword [esp + 0x10], ebx
jmp 0x1001927e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x134], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001926b
mov dword [esp + 0x10], ebx
jmp 0x1001929e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1bc], 0x900b0881
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001928b
mov dword [esp + 0x1c], ebx
jmp 0x1001946d
mov dword [esp + 0x10], 0x256a9ef7
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], 0xa117216
mov dword [esp + 0x14], 0x52b3395c
mov dword [esp + 0x30], 0x2d863e32
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0x67519ba6
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x100193b7
mov dword [esp + 0x14], 0xfffffffc
xor edx, edx
mov eax, dword [esp + 0x10]
mov ecx, 0x4fd5
mov eax, dword [esp + 0x10]
cmp eax, 0xdd48
mov eax, dword [esp + 0x20]
setl dl
sub ecx, edx
xor edx, edx
add ecx, eax
mov dword [esp + 0x1c0], ecx
mov eax, dword [esp + 0x28]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0x7fc0
setg al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c0]
sub eax, 0x6717b38e
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x134]
mov eax, dword [esp + 0x134]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x138]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x134]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
dec dword [esp + 0x10]
jns 0x100192f0
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x10019469
push 2
lea ecx, [esp + 0x278]
call fcn.10016b30
push 2
mov dword [esp + 0x34], 0x7d051992
mov dword [esp + 0x18], ebx
pop edx
jmp 0x100193fe
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x274]
mov dword [eax + ecx*4], 0x5d3c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100193e8
mov dword [esp + 0x14], ebx
jmp 0x1001944d
mov dword [esp + 0x30], 0x8f98
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], ebx
jmp 0x10019433
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x374], 0xffffffff
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jl 0x10019420
dec dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x134]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jle 0x1001940a
lea ecx, [esp + 0x274]
call fcn.1001734d
dec dword [esp + 0x10]
jns 0x100193c9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x100192ae
mov dword [esp + 0x10], ebx
jmp 0x10019491
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xbc], 0x64a6847d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001947e
mov dword [esp + 0x10], ebx
jmp 0x100194b1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x68]
mov dword [eax + ecx*4], 0xb871c7bf
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001949e
push dword [esp + 0x60]
movdqa xmm0, xmmword [0x10007f60]
lea eax, [esp + 0x2ec]
push eax
lea eax, [esp + 0x2e0]
mov dword [esp + 0x100], ebx
push eax
push ebx
lea ecx, [esp + 0x108]
mov dword [esp + 0x10c], ebx
movdqu xmmword [esp + 0x2e8], xmm0
mov dword [esp + 0x110], ebx
call fcn.100180db
mov eax, dword [esp + 0xf8]
mov dword [esp + 0x20], 0x3b6182ea
mov dword [eax + 0xc], ebx
mov dword [esp + 0x20], 3
cmp dword [esp + 0x20], ebx
jl 0x10019539
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10019533
call esi
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
dec dword [esp + 0x20]
jns 0x1001951f
lea ecx, [esp + 0xf8]
call fcn.1001734d
xor esi, esi
mov dword [esp + 0x10], ebx
inc esi
jmp 0x1001955e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001954e
mov edi, dword [esp + 0x68]
mov eax, 0x4a87fce6
mov dword [esp + 0x30], edi
mov dword [edi], 2
mov dword [esp + 0x90], eax
lea ecx, [esp + 0x84]
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
push 3
call fcn.10016b30
mov byte [esp + 0x3a4], 3
lea ecx, [esp + 0x2a0]
mov dword [esp + 0x1c], 0xba394643
mov dword [esp + 0x14], 0xfffffffe
mov dword [esp + 0x14], 0x15b45bea
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x38], esi
push 2
call fcn.10016b30
mov byte [esp + 0x3a4], 4
mov dword [esp + 0x10], ebx
jmp 0x100195ff
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x84]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x100195ed
mov dword [esp + 0x10], ebx
jmp 0x10019622
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x2a0]
mov dword [eax + ecx*4], 0xb82aec7f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001960c
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001963f
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x100198b1
mov edi, dword [esp + 0x84]
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x14], 0x684a08de
mov dword [esp + 0x28], 0x369e
mov dword [esp + 0x14], ebx
jmp 0x1001968d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x38c], 0xb4ff5102
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001967a
dec dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x1c]
imul edx, dword [esp + 0x14], 0xfffc
mov eax, dword [esp + 0x84]
sub edx, dword [eax + ecx*4]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [edi + 4]
jge 0x10019823
mov dword [esp + 0x28], 0x95d
lea ecx, [esp + 0x248]
mov dword [esp + 0x38], ebx
push 2
call fcn.10016b30
push 2
mov dword [esp + 0x14], ebx
pop edx
jmp 0x100196f2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x16c], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100196e3
mov dword [esp + 0x10], ebx
jmp 0x10019714
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x248]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100196fe
mov eax, dword [esp + 0x20]
xor edx, edx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setg dl
cmp edx, esi
jle 0x100197f4
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x170], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x14]
sub ecx, eax
sub ecx, dword [esp + 0x20]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
sub ecx, 0xb03c3fa3
neg ecx
push 0
sbb ecx, ecx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x88]
pop ecx
setne cl
sub ecx, dword [eax + edx*4]
mov eax, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x3c], ecx
xor ecx, ecx
cmp dword [esp + 0x3c], eax
mov eax, dword [esp + 0x84]
setle cl
cmp ecx, dword [eax]
jle 0x100197c1
cmp dword [esp + 0x170], ebx
jne 0x100197c1
mov esi, ebx
jmp 0x100197c4
xor esi, esi
inc esi
mov edx, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
sub esi, eax
mov eax, dword [esp + 0x84]
cmp esi, dword [eax + edx*4]
setle cl
xor esi, esi
mov dword [esp + 0x14], ecx
inc esi
imul eax, dword [esp + 0x14], 0xfffa
mov ecx, esi
cmp eax, dword [esp + 0x28]
jle 0x100197f6
mov ecx, ebx
mov eax, dword [esp + 0x38]
imul eax, ecx
test eax, eax
jne 0x10019805
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x16c]
mov eax, dword [esp + 0x84]
mov dword [eax + edx*4], ecx
lea ecx, [esp + 0x248]
jmp 0x1001989e
push dword [esp + 0x60]
movdqa xmm0, xmmword [0x10007f70]
lea eax, [esp + 0x30c]
push eax
lea eax, [esp + 0x300]
mov dword [esp + 0x40], esi
push eax
push ebx
lea ecx, [esp + 0x184]
mov dword [esp + 0x184], ebx
movdqu xmmword [esp + 0x308], xmm0
mov dword [esp + 0x188], ebx
mov dword [esp + 0x18c], ebx
call fcn.100180db
mov dword [esp + 0x38], 0xfffffff8
inc dword [esp + 0x28]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10019897
push 0x2378
push ebx
push 0x65a
push ebx
call dword [sym.imp.USER32.dll_LoadStringA]
lea ecx, [esp + 0x174]
call fcn.1001734d
dec dword [esp + 0x1c]
jns 0x10019658
mov edi, dword [esp + 0x30]
lea ecx, [esp + 0x2a0]
call fcn.1001734d
lea ecx, [esp + 0x84]
mov byte [esp + 0x3a4], 2
call fcn.1001734d
mov dword [esp + 0x2c], 0x84868fda
mov dword [esp + 0x38], 0xbadbefc7
mov dword [esp + 0x14], ebx
jmp 0x100198f3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x4c], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100198e7
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx]
mov esi, dword [ecx]
xor ecx, ecx
mov dword [esp + eax*4 + 0xbc], 0x3d9b9503
mov eax, dword [esp + 0x9c]
cmp eax, 0x2a30
setg cl
xor edx, edx
cmp ecx, dword [edi + 4]
setl dl
xor eax, eax
imul edx, esi
cmp esi, 6
setne al
xor ecx, ecx
add eax, 0x3d9b9503
add eax, edx
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, dword [edi + 8]
setne al
mov dword [esp + 0x9c], eax
cmp eax, dword [esp + 0x4c]
jg 0x10019962
cmp dword [esp + 0x2c], ebx
jne 0x10019b69
jmp 0x10019af5
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x3c], ebx
cmp dword [esp + 0x24], ebx
jne 0x100199bc
mov eax, dword [esp + 0x68]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0xbc]
mov ecx, dword [esp + 0x38]
sub ecx, eax
mov eax, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], ebx
je 0x10019a25
mov eax, dword [esp + 0x14]
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x104]
push 3
pop edx
mov dword [esp + 0x44], edx
mov dword [eax], edx
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sub ecx, eax
mov eax, dword [esp + 0x68]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 3
setne dl
add edx, dword [eax + 0xc]
xor eax, eax
cmp edx, 0x2ca1
setge al
xor ecx, ecx
imul edx, eax, 0xffff
mov dword [esp + 0x98], edx
mov eax, dword [esp + 0x2c]
cmp edx, eax
setg cl
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x1c], 0x10
jmp 0x10019aea
mov ecx, ebx
jmp 0x100199bf
mov dword [esp + 0x20], 0x1b63
mov dword [esp + 0x24], 1
mov dword [esp + 0x14], ebx
jmp 0x10019a52
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x19c], 0xd553b787
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019a3f
cmp dword [esp + 0x4c], ebx
je 0x10019acc
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp dword [edi + 4], eax
mov eax, 0x5a6edb5b
setne cl
sub eax, ecx
mov ecx, dword [esp + 0x20]
add ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x20]
jle 0x10019a87
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], 0x4f79aabf
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x68]
add ecx, 0x17887b34
mov dword [esp + 0x19c], ecx
mov eax, dword [eax]
mov edx, dword [esp + eax*4 + 0xbc]
xor eax, eax
cmp ecx, 0x59016633
setle al
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [esp + 0xc4]
jle 0x10019ad3
mov eax, dword [esp + 0x19c]
mov eax, dword [esp + 0x4c]
xor ecx, ecx
cmp eax, 0xffffffff
setge cl
mov dword [esp + 0x9c], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x22
jne 0x10019a29
mov eax, dword [esp + 0x44]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x68]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0xbc]
cmp dword [esp + 0xc4], 7
jl 0x10019b27
mov eax, dword [esp + 0x4c]
mov ecx, dword [esp + 0x68]
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x44], eax
mov eax, dword [ecx]
mov eax, dword [esp + eax*4 + 0xbc]
mov ecx, dword [esp + 0x44]
sub ecx, eax
je 0x10019b4a
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x9c]
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x68]
push 1
pop esi
dec dword [eax]
mov eax, 0x4a87fce6
jns 0x10019577
mov dword [esp + 0x28], 0xa61928c1
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], 0x10
push 0xfffffffffffffff9
pop edi
jg 0x10019bf3
xor esi, esi
inc esi
push esi
lea ecx, [esp + 0x184]
call fcn.10016b30
mov dword [esp + 0x14], ebx
jmp 0x10019bab
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xaa9ac70c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10019b95
mov eax, dword [esp + 0x180]
mov dword [eax], edi
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10019bcc
push ebx
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov eax, dword [esp + 0x180]
inc dword [eax]
cmp dword [eax], 0x10
jl 0x10019bba
lea ecx, [esp + 0x180]
call fcn.1001734d
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x10
jle 0x10019b82
jmp 0x10019bf6
xor esi, esi
inc esi
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10019c07
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
lea ecx, [esp + 0x104]
call fcn.1001734d
or dword [esp + 0x3a4], 0xffffffff
lea ecx, [esp + 0x68]
call fcn.1001734d
mov dword [esp + 0x1c], 0x824a8c6a
mov dword [esp + 0x24], 0xa2d34caa
mov dword [esp + 0x30], 4
mov dword [esp + 0x20], 0xb6b7be2d
mov dword [esp + 0x14], ebx
jmp 0x10019c5d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x380], 0xe31bb000
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019c4a
mov dword [esp + 0x1c], ebx
jmp 0x10019cfc
mov dword [esp + 0x14], 0x7b1891f7
mov dword [esp + 0x14], ebx
jmp 0x10019c8a
cmp dword [esp + 0x14], esi
jl 0x10019c7b
cmp dword [esp + 0x1c], 0x1d
jge 0x10019c6d
dec dword [esp + 0x20]
lea ecx, [esp + 0x1dc]
push 3
call fcn.10016b30
mov dword [esp + 0x3a4], 5
lea ecx, [esp + 0x25c]
mov dword [esp + 0x14], 0x8ade19d2
mov dword [esp + 0x30], 0xffffffff
push 3
call fcn.10016b30
mov dword [esp + 0x30], 0xe1c97412
push 3
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x14], ebx
pop edx
jmp 0x10019d71
cmp dword [esp + 0x10], edx
jl 0x10019d5b