Function at 0x1001b270
Capabilities:
Allocate thread local storage
Resolve function by parsing pe exports
Start service
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10069ccb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2f8
push ebx
push esi
push edi
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0x70]
push 2
mov dword [esp + 0x50], edx
call fcn.1000b514
xor ebx, ebx
lea ecx, [esp + 0x16c]
mov dword [esp + 0x30c], ebx
mov dword [esp + 0x24], 0xfffffff8
mov dword [esp + 0x28], 0x9f08664a
push 1
call fcn.1000b514
mov byte [esp + 0x30c], 1
mov dword [esp + 0x10], ebx
jmp 0x1001b2ef
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xf4], 0x648261f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001b2dc
mov dword [esp + 0x10], ebx
jmp 0x1001b30f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov dword [eax + ecx*4], 0xd29be1d9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001b2fc
mov dword [esp + 0x10], ebx
jmp 0x1001b32f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x294], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b31c
mov dword [esp + 0x10], ebx
jmp 0x1001b352
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0xfbaa6dce
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001b33c
mov eax, dword [esp + 0x70]
mov dword [eax], ebx
push 1
lea ecx, [esp + 0x80]
call fcn.1000b514
mov byte [esp + 0x30c], 2
lea ecx, [esp + 0x94]
mov dword [esp + 0x18], 0xfffffffb
push 1
call fcn.1000b514
push 3
lea ecx, [esp + 0xd4]
mov byte [esp + 0x310], 3
call fcn.1000b514
mov byte [esp + 0x30c], 4
xor edx, edx
mov dword [esp + 0x34], 0x3003
inc edx
mov dword [esp + 0x274], ebx
mov dword [esp + 0x278], ebx
mov dword [esp + 0x27c], ebx
mov dword [esp + 0x280], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001b3e9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], 2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001b3d6
mov dword [esp + 0x10], ebx
jmp 0x1001b40b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x94]
mov dword [eax + ecx*4], 0xf4c59cdc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001b3f5
mov dword [esp + 0x10], ebx
jmp 0x1001b42d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b417
mov eax, dword [esp + 0x7c]
mov dword [eax], ebx
mov dword [esp + 0x1c], 0xb5d1cb6a
lea ecx, [esp + 0x1a8]
push 3
call fcn.1000b514
push 3
mov byte [esp + 0x310], 5
mov dword [esp + 0x1c], ebx
pop edi
jmp 0x1001b477
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], 0x737e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001b461
mov eax, dword [esp + 0x70]
mov ecx, 0xfff7
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0xf4]
sub ecx, eax
jne 0x1001b49f
mov eax, dword [esp + 0x7c]
cmp dword [eax], ebx
jne 0x1001b49f
mov eax, ebx
jmp 0x1001b4a2
xor eax, eax
inc eax
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x94]
mov dword [eax], ecx
mov dword [esp + 0x30], 0x1910
cmp dword [esp + 0x30], 0x12b6
jge 0x1001b6b6
push 2
lea ecx, [esp + 0x1f4]
call fcn.1004c037
lea ecx, [esp + 0x1f0]
mov byte [0x1006f004], bl
call fcn.1004c092
lea eax, [esp + 0x68]
mov ecx, 0x1065aef0
push eax
call fcn.1001d7f5
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], ebx
call fcn.1001efb1
mov dword [esp + 0x3c], eax
mov edi, ebx
mov dword [esp + 0xc8], ebx
mov esi, ebx
mov dword [esp + 0xc0], edi
mov dword [esp + 0xc4], esi
xor eax, eax
mov byte [esp + 0x30c], 7
inc eax
mov dword [esp + 0x6c], eax
cmp dword [esp + 0x68], eax
jl 0x1001b5e0
lea eax, [esp + 0x104]
mov ecx, 0x1065aef0
push eax
call fcn.1001d7f5
lea eax, [esp + 0x104]
push eax
lea ecx, [esp + 0x40]
call fcn.1001dec6
test eax, eax
je 0x1001b59d
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x3c]
push dword [eax + 4]
call fcn.1001e583
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0xc0]
mov dword [eax + 4], eax
mov eax, dword [esp + 0x3c]
mov dword [eax], eax
mov eax, dword [esp + 0x3c]
mov dword [eax + 8], eax
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x44], ebx
call fcn.1001dd40
jmp 0x1001b5bf
movzx eax, byte [0x12045dfa]
push eax
lea eax, [esp + 0x108]
push eax
push ecx
lea eax, [esp + 0x2d4]
push eax
lea ecx, [esp + 0x4c]
call fcn.1001f546
mov eax, dword [esp + 0x6c]
inc eax
mov dword [esp + 0x6c], eax
cmp eax, dword [esp + 0x68]
jle 0x1001b53b
mov esi, dword [esp + 0xc4]
mov edi, dword [esp + 0xc0]
sub esi, edi
sar esi, 2
test esi, esi
jne 0x1001b5fa
mov edx, 0x1000799c
mov ecx, 0x1065ae38
call fcn.1000ebd6
jmp 0x1001b66a
push esi
call fcn.1001d90a
push eax
call fcn.1000eba4
xor eax, eax
mov dword [esp + 0x34], ebx
inc eax
pop ecx
dec esi
je 0x1001b646
push dword [edi + ebx*4]
push ecx
push eax
mov ecx, 0x1065ae38
call fcn.1001da2d
mov edx, 0x10007a74
mov ecx, eax
call fcn.1000ebd6
pop ecx
mov ecx, eax
call fcn.1001da2d
push eax
call fcn.1000eba4
mov eax, dword [edi + ebx*4]
inc eax
inc ebx
pop ecx
cmp ebx, esi
jb 0x1001b611
xor ebx, ebx
push dword [esp + 0x68]
push ecx
push eax
mov ecx, 0x1065ae38
call fcn.1001da2d
mov edx, 0x10007a74
mov ecx, eax
call fcn.1000ebd6
pop ecx
mov ecx, eax
call fcn.1001da2d
push eax
call fcn.1000eba4
pop ecx
test edi, edi
je 0x1001b691
push edi
call fcn.10050ee7
pop ecx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x3c]
push eax
push dword [eax]
lea eax, [esp + 0x294]
push eax
call fcn.1001ea26
push dword [esp + 0x3c]
call fcn.10050ee7
pop ecx
push 3
pop edi
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x1001b7cf
mov dword [esp + 0x28], 0xf3cc
xor ecx, ecx
mov dword [esp + 0x20], ebx
inc ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0xc], 9
mov dword [esp + 0x30], 0xfffffffd
mov dword [esp + 0x28], 0x497140da
mov dword [esp + 0x10], 0xffffffff
cmp dword [esp + 0x20], ebx
jne 0x1001b705
inc dword [esp + 0xc]
mov esi, ebx
je 0x1001b707
mov esi, ecx
mov eax, dword [esp + 0x94]
cmp dword [eax], ecx
jle 0x1001b720
mov eax, dword [esp + 0xd0]
cmp dword [eax + 4], ebx
jne 0x1001b720
mov ecx, ebx
mov eax, dword [esp + 0x20]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x70]
setle dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [esp + 0x1c]
setl cl
xor edx, edx
imul ecx, ecx, 0xffff
cmp ecx, eax
setge dl
xor eax, eax
cmp esi, edx
setne al
add eax, dword [esp + 0x1c]
je 0x1001b75a
cmp dword [esp + 0x30], ebx
jne 0x1001b769
mov eax, dword [esp + 0x94]
cmp dword [eax], ebx
jne 0x1001b769
mov ecx, ebx
jmp 0x1001b76c
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x294]
sub ecx, eax
jne 0x1001b781
cmp dword [esp + 0x34], ebx
jne 0x1001b781
mov eax, ebx
jmp 0x1001b784
xor eax, eax
inc eax
dec dword [esp + 0x2c]
xor ecx, ecx
cmp eax, 0x385fae11
mov eax, dword [esp + 0x7c]
setge cl
sub ecx, 0xfffb
add ecx, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
add ecx, 5
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, dword [eax]
mov eax, dword [esp + 0xd0]
setle dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [esp + 0x10], ecx
dec dword [esp + 0x18]
jns 0x1001b6c4
mov byte [esp + 0x30c], 4
cmp dword [esp + 0x1a8], 0
je 0x1001b803
push dword [esp + 0x1a8]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1ac], ebx
mov dword [esp + 0x1b0], ebx
mov eax, dword [esp + 0x7c]
inc dword [eax]
cmp dword [eax], 0
jle 0x1001b43a
mov eax, dword [esp + 0x70]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0xf4]
mov eax, dword [esp + 0x16c]
mov edx, dword [eax]
test edx, edx
mov eax, dword [esp + 0x7c]
setne cl
mov esi, dword [eax]
imul eax, ecx, 0xa
xor ecx, ecx
cmp eax, edi
setl cl
imul ecx, edx
sub ecx, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, esi
jle 0x1001b858
test esi, esi
je 0x1001b858
xor eax, eax
inc eax
jmp 0x1001b85a
mov eax, ebx
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x94]
setns cl
mov dword [eax], ecx
mov eax, dword [esp + 0x274]
cmp dword [esp + 0xd0], 0
mov dword [esp + 0x294], 1
je 0x1001b8a8
push dword [esp + 0xd0]
call fcn.10050ee7
pop ecx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
push dword [esp + 0x94]
call fcn.10050ee7
pop ecx
mov byte [esp + 0x30c], 1
push dword [esp + 0x7c]
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
call fcn.10050ee7
mov eax, dword [esp + 0x74]
pop ecx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
inc dword [eax]
cmp dword [eax], 0
mov dword [esp + 0x84], ebx
jle 0x1001b35f
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b90e
call dword [sym.imp.KERNEL32.dll_GetVersion]
push dword [esp + 0x16c]
call fcn.10050ee7
or dword [esp + 0x310], 0xffffffff
pop ecx
push dword [esp + 0x70]
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
mov dword [esp + 0x178], ebx
call fcn.10050ee7
mov eax, dword [0x12045e38]
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
pop ecx
push 8
pop esi
test al, 1
jne 0x1001b9f0
or eax, 1
mov dword [0x12045e38], eax
push ebx
mov dword [esp + 0x310], esi
push ebx
mov dword [0x12045e40], ebx
mov dword [0x12045e44], ebx
call fcn.1001f204
mov dword [0x12045e40], eax
mov dword [0x12045e48], ebx
mov dword [0x12045e50], ebx
mov byte [esp + 0x30c], 0xa
mov ecx, 0x12045e48
mov dword [esp + 0x1ec], eax
lea eax, [esp + 0x1ec]
push eax
push 0x10
push ebx
lea eax, [esp + 0x29c]
mov dword [0x12045e5c], 0x3f800000
push eax
mov dword [0x12045e4c], ebx
call fcn.1001efdc
push 0x1006ab67
mov dword [0x12045e54], 7
mov dword [0x12045e58], esi
call fcn.10050b5c
or dword [esp + 0x310], 0xffffffff
pop ecx
xor edx, edx
mov dword [esp + 0x18], 0x67e307b
mov dword [esp + 0x2c], 0x9193
mov esi, 0xffff
mov dword [esp + 0x1c], 0x9478c9df
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, esi
setle cl
sub eax, ecx
sub eax, 0x6d39c7c6
add eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [esp + 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x18]
setne cl
add eax, 0x6ff5
add ecx, eax
xor edx, edx
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setge dl
cmp esi, edx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, 0xa277ebd0
setg dl
cmp eax, edx
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
je 0x1001bab3
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], 0x5aee0cd9
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001bafb
push 0x27a
push ebx
push ebx
push ebx
push 0xa25
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x1001bafb
mov dword [esp + 0xc], ebx
cmp dword [esp + 0x2c], ebx
jne 0x1001badd
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
cmp eax, 0xfffffffd
setne cl
cmp ecx, edi
ja 0x1001badd
mov eax, ebx
jmp 0x1001bae0
xor eax, eax
inc eax
mov dword [esp + 0x1c], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001bafb
push 0x2605
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
imul eax, dword [esp + 0x48], 0x2710
lea ecx, [esp + 0x19c]
mov dword [esp + 0x1c], 0x9f2b7826
push 1
add eax, dword [esp + 0x50]
mov dword [esp + 0xe0], eax
mov dword [esp + 0x24], 0x399841b3
call fcn.1000b514
push 2
lea ecx, [esp + 0x118]
mov dword [esp + 0x310], 0xb
call fcn.1000b514
push 0xc
pop eax
xor edx, edx
mov byte [esp + 0x30c], al
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001bb6e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], 0x9b69b2e4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001bb58
mov dword [esp + 0x10], ebx
jmp 0x1001bb90
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 0x6f9f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001bb7a
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 0x1c
jg 0x1001bdaf
mov dword [esp + 0x1c], 0x57102d14
mov dword [esp + 0x18], ebx
jmp 0x1001bbc3
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x2e4], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001bbb4
mov dword [esp + 0x1c], ebx
jmp 0x1001bd93
push 3
lea ecx, [esp + 0x188]
call fcn.1000b514
mov byte [esp + 0x30c], 0xd
push 9
mov dword [esp + 0x10], 0x46b6eb6b
pop edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], ebx
jmp 0x1001bc10
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001bbfe
mov dword [esp + 0xc], 2
cmp dword [esp + 0xc], ebx
jl 0x1001bd3d
mov esi, dword [esp + 0x114]
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x154]
mov dword [esp + 0x28], 0xfffffff7
mov dword [esp + 0x28], 0xc865b49d
mov dword [esp + 0x28], ebx
push 3
call fcn.1000b514
mov byte [esp + 0x30c], 0xe
lea ecx, [esp + 0x1d8]
mov dword [esp + 0x28], 1
push 3
call fcn.1000b514
push 3
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001bc8f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001bc7d
mov dword [esp + 0x10], ebx
jmp 0x1001bcae
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2d0], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001bc9b
mov dword [esp + 0x10], ebx
jmp 0x1001bcd1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1d8]
mov dword [eax + ecx*4], 0x96c9f93b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001bcbb
mov eax, dword [esp + 0x1d8]
inc dword [esi + 4]
push eax
inc dword [eax]
call fcn.10050ee7
mov byte [esp + 0x310], 0xd
cmp dword [esp + 0x158], 0
pop ecx
mov dword [esp + 0x1d8], ebx
mov dword [esp + 0x1dc], ebx
mov dword [esp + 0x1e0], ebx
je 0x1001bd33
push dword [esp + 0x154]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ebx
mov dword [esp + 0x15c], ebx
dec dword [esp + 0xc]
jns 0x1001bc30
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001bd56
push ebx
push ebx
push 0x3ff
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push 0xc
pop eax
mov byte [esp + 0x30c], al
cmp dword [esp + 0x184], 0
je 0x1001bd8c
push dword [esp + 0x184]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], ebx
mov dword [esp + 0x18c], ebx
inc dword [esp + 0x1c]
xor edx, edx
inc edx
cmp dword [esp + 0x1c], edx
je 0x1001bbd3
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x1c
jle 0x1001bba6
push 3
pop edi
cmp dword [esp + 0x114], 0
je 0x1001bddb
push dword [esp + 0x114]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
or dword [esp + 0x30c], 0xffffffff
cmp dword [esp + 0x19c], 0
je 0x1001be0f
push dword [esp + 0x19c]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x19c], ebx
mov dword [esp + 0x1a0], ebx
mov dword [esp + 0x1a4], ebx
lea eax, [esp + 0xdc]
push eax
call fcn.1001df44
push 2
pop edx
mov esi, dword [eax]
mov dword [esp + 0x10], 0x42eb90da
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], 0xfc42ff18
mov dword [esp + 0x20], ebx
jmp 0x1001be4e
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x284], 5
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1001be3b
push 0xffffffffffffffef
pop eax
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], eax
jne 0x1001beb4
mov dword [esp + 0x2c], 1
xor ecx, ecx
mov dword [esp + 0x1c], 0xfffffff6
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
dec dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp eax, 1
setge cl
mov dword [esp + 0x24], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffef
je 0x1001be61
mov dword [esp + 0x18], ebx
jmp 0x1001becd
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x284], 0x9c3997b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001beba
test esi, esi
je 0x1001c492
push 1
lea ecx, [esp + 0x124]
call fcn.1000b514
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x1001bf0d
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0xcf5720e8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x1001bef7
mov dword [esp + 0x18], ebx
jmp 0x1001bf2e
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x120]
cmp dword [eax + ecx*4], ebx
jne 0x1001bf34
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1001bf1a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001bf46
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [esp + 0x120], 0
je 0x1001bf72
push dword [esp + 0x120]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x10], 0x70ad6f2e
xor edx, edx
mov dword [esp + 0xc], 0x12c51978
inc edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x24], 0xdb5df1d9
mov dword [esp + 0x144], esi
cmp dword [esp + 0x10], ebx
je 0x1001c3ad
push 4
lea ecx, [esp + 0x130]
call fcn.1000b514
mov dword [esp + 0x30c], 0xf
mov dword [esp + 0x20], ebx
jmp 0x1001bfd4
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x12c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1001bfc1
mov dword [esp + 0x10], ebx
jmp 0x1001c383
mov dword [esp + 0x18], ebx
mov dword [esp + 0x4c], 0xfffffff9
mov byte [esp + 0x17], bl
mov dword [esp + 0x24], 0x1743
cmp dword [esp + 0x24], 0xb00
jge 0x1001c1c0
call fcn.10052884
push eax
push 0x10007a78
push 0x10007a7c
call fcn.100531ee
add esp, 0xc
call fcn.10052884
add eax, 0x20
push eax
push 0x10007a84
push 0x10007a88
call fcn.100531ee
add esp, 0xc
lea eax, [esp + 0x38]
push eax
push 0x1000793c
call fcn.1005274a
mov eax, dword [esp + 0x40]
pop ecx
pop ecx
test eax, eax
je 0x1001c1c0
push eax
lea ecx, [esp + 0x164]
call fcn.1000b514
mov byte [esp + 0x30c], 0x10
mov esi, dword [esp + 0x38]
mov dword [esp + 0x24], ebx
test esi, esi
jle 0x1001c09b
mov edi, dword [esp + 0x160]
push edi
mov ecx, 0x1065aef0
call fcn.1000b0f2
mov esi, dword [esp + 0x38]
inc ebx
add edi, 4
cmp ebx, esi
jl 0x1001c082
xor ebx, ebx
mov edi, ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa0], edi
mov dword [esp + 0xa8], ebx
mov byte [esp + 0x30c], 0x11
mov dword [esp + 0xbc], esi
test esi, esi
jle 0x1001c10a
mov ebx, dword [esp + 0x160]
mov eax, dword [ebx + esi*4 - 4]
lea ecx, [esp + 0xbc]
push ecx
push ecx
lea ecx, [esp + 0xa8]
lea eax, [edi + eax*4]
push eax
lea eax, [esp + 0x2ac]
push eax
call fcn.1001e3ff
mov edi, dword [esp + 0xa0]
dec esi
mov dword [esp + 0xbc], esi
test esi, esi
jg 0x1001c0cc
mov esi, dword [esp + 0x38]
xor ebx, ebx
lea eax, [esi - 1]
mov dword [esp + 0x24], ebx
test eax, eax
jle 0x1001c13c
push dword [edi + ebx*4]
mov ecx, 0x1065ae38
call fcn.1000b2ed
mov edx, 0x10007a90
mov ecx, eax
call fcn.1000ebd6
mov esi, dword [esp + 0x38]
inc ebx
lea eax, [esi - 1]
cmp ebx, eax
jl 0x1001c115
xor ebx, ebx
push dword [edi + esi*4 - 4]
mov ecx, 0x1065ae38
call fcn.1000b2ed
push eax
call fcn.1000eba4
pop ecx
test edi, edi
je 0x1001c171
push edi
call fcn.10050ee7
pop ecx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov byte [esp + 0x30c], 0xf
mov eax, dword [esp + 0x160]
test eax, eax
je 0x1001c1a0
push eax
call fcn.10050ee7
pop ecx
mov dword [esp + 0x160], ebx
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
lea eax, [esp + 0x38]
push eax
push 0x1000793c
call fcn.1005274a
mov eax, dword [esp + 0x40]
pop ecx
pop ecx
test eax, eax
jne 0x1001c05a
push 3
pop edi
cmp byte [esp + 0x17], 0
je 0x1001c1d7
push 0x26a
push 0x130a
call dword [sym.imp.GDI32.dll_SetROP2]
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], ebx
jl 0x1001c37f
mov dword [esp + 0x1c], 0xfffffff8
lea ecx, [esp + 0xe8]
mov dword [esp + 0x2c], 0xe8f7cf8
mov dword [esp + 0x2c], 0xfffffffe
push 1
call fcn.1000b514
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], ebx
jmp 0x1001c22f
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0x4818a88a
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x1001c219
mov dword [esp + 0x1c], ebx
jmp 0x1001c255
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x12c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x1001c23c
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], ebx
jl 0x1001c349
cmp dword [esp + 0x18], ebx
je 0x1001c27a
cmp dword [esp + 0xc], ebx
je 0x1001c27a
xor ecx, ecx
inc ecx
jmp 0x1001c27c
mov ecx, ebx
mov eax, dword [esp + 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
sub edx, 0x33f667bd
cmp eax, edx
mov eax, dword [esp + 0x12c]
setle cl
cmp ecx, edi
sbb ecx, ecx
neg ecx
cmp ecx, dword [eax]
jg 0x1001c2b2
cmp dword [eax], 0
jne 0x1001c2b2
mov edx, ebx
jmp 0x1001c2b5
xor edx, edx
inc edx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
setl cl
inc ecx
imul eax, ecx, 0xb9c2
test eax, eax
je 0x1001c2e0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x12c]
cmp dword [eax + ecx*4], ebx
je 0x1001c2e0
xor eax, eax
inc eax
jmp 0x1001c2e2
mov eax, ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0x1a01
jne 0x1001c303
cmp dword [esp + 0x18], ebx
je 0x1001c303
xor ecx, ecx
inc ecx
jmp 0x1001c305
mov ecx, ebx
mov eax, dword [esp + 0xe8]
mov dword [eax], ecx
test ecx, ecx
je 0x1001c316
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xe8]
cmp dword [eax], 0xffffffff
mov eax, dword [esp + 0x12c]
setne dl
add edx, dword [eax + ecx*4]
mov dword [esp + 0x4c], edx
dec dword [esp + 0x1c]
jns 0x1001c269
cmp dword [esp + 0xe8], 0
je 0x1001c375
push dword [esp + 0xe8]
call fcn.10050ee7
pop ecx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
dec dword [esp + 0x18]
jns 0x1001c1e5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x1001bfe4
cmp dword [esp + 0x12c], 0
je 0x1001d77b
push dword [esp + 0x12c]
call fcn.10050ee7
pop ecx
jmp 0x1001d77b
push 3
mov dword [esp + 0x20], ebx
pop ecx
jmp 0x1001c3c9
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x88], 0xd061
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1001c3b6
mov dword [esp + 0x1c], ebx
jmp 0x1001c3e4
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2b4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1001c3d5
mov eax, dword [esp + 0x8c]
cmp dword [esp + 0x10], ebx
je 0x1001c402
mov eax, edx
cmp dword [esp + 0x88], ebx
jne 0x1001c404
mov eax, ebx
mov ecx, dword [esp + 0x8c]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, eax
mov eax, dword [esp + 0x10]
add eax, ecx
cmp eax, dword [esp + 0xc]
jg 0x1001c42e
cmp dword [esp + 0x88], ebx
jne 0x1001c42e
cmp dword [esp + 0xc], ebx
je 0x1001c430
mov ebx, edx
mov eax, dword [esp + 0x88]
sub eax, ebx
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setg cl
sub ecx, 0xfffffff9
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x2b8], ecx
cmp ecx, dword [esp + 0x8c]
je 0x1001c461
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x88]
xor ecx, ecx
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x90]
cmp eax, edx
setg cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
jmp 0x1001d77b
mov dword [esp + 0x24], 0xb58e
lea ecx, [esp + 0x178]
mov dword [esp + 0x18], 0x59e57ad9
push edx
call fcn.1000b514
mov dword [esp + 0xc], ebx
jmp 0x1001c4c8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x178]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001c4b5
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], ebx
jmp 0x1001c4f8
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001c4f4
push 0x446
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x1001c4dd
cmp dword [esp + 0x178], 0
je 0x1001c52b
push dword [esp + 0x178]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x178], ebx
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x180], ebx
mov eax, dword [0x12045e38]
test al, 2
jne 0x1001c5d2
or eax, 2
mov dword [0x12045e38], eax
push ebx
mov dword [esp + 0x310], 0x12
push ebx
mov dword [0x12045e60], ebx
mov dword [0x12045e64], ebx
call fcn.1001f204
mov dword [0x12045e60], eax
mov dword [0x12045e68], ebx
mov dword [0x12045e70], ebx
mov byte [esp + 0x30c], 0x14
mov ecx, 0x12045e68
mov dword [esp + 0x200], eax
lea eax, [esp + 0x200]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1dc]
mov dword [0x12045e7c], 0x3f800000
push eax
mov dword [0x12045e6c], ebx
call fcn.1001efdc
push 0x1006ab62
mov dword [0x12045e74], 7
mov dword [0x12045e78], 8
call fcn.10050b5c
or dword [esp + 0x310], 0xffffffff
pop ecx
mov dword [esp + 0xc], 0xfffffffd
mov dword [esp + 0x24], 0x23fe5e81
mov dword [esp + 0xc], 0xffffffeb
cmp dword [esp + 0xc], 1
jg 0x1001c630
mov dword [esp + 0x24], 0x89351f20
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], 1
cmp dword [esp + 0x24], ebx
jne 0x1001c630
mov ecx, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x34]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xffffffff
setne al
mov dword [esp + 0x24], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jle 0x1001c5f1
mov eax, 0xdcba86ba
xorps xmm0, xmm0
movdqu xmmword [esp + 0x1c0], xmm0
mov dword [esp + 0x18], 0xfffe
xor edx, edx
mov dword [esp + 0x24], 0x61f66568
mov dword [esp + 0x144], eax
mov dword [esp + 0x148], eax
mov dword [esp + 0x14c], eax
mov dword [esp + 0x150], eax
mov dword [esp + 0x28], 9
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setg dl
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], ebx
jmp 0x1001c769
mov dword [esp + 0x28], 0x94dd
lea ecx, [esp + 0x190]
mov dword [esp + 0x28], 0x822e6e7f
push 1
call fcn.1000b514
push 1
lea ecx, [esp + 0x1f8]
mov dword [esp + 0x310], 0x15
call fcn.1000b514
xor edx, edx
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x1001c6e4
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x190]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001c6d1
mov dword [esp + 0x1c], ebx
jmp 0x1001c706
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1f4]
mov dword [eax + ecx*4], 0x821342f3
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001c6f0
mov eax, dword [esp + 0x1f4]
push eax
dec dword [eax]
call fcn.10050ee7
or dword [esp + 0x310], 0xffffffff
cmp dword [esp + 0x194], 0
pop ecx
mov dword [esp + 0x1f4], ebx
mov dword [esp + 0x1f8], ebx
mov dword [esp + 0x1fc], ebx
je 0x1001c765
push dword [esp + 0x190]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x190], ebx
mov dword [esp + 0x194], ebx
mov dword [esp + 0x198], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x28
je 0x1001c691
lea eax, [esp + 0x48]
push eax
call fcn.1001dfa6
mov esi, dword [eax]
mov dword [esp + 0x24], 0x1de4
cmp dword [esp + 0x24], 0xafc
mov dword [esp + 0x2c], esi
jge 0x1001c84d
lea eax, [esp + 0xe4]
push eax
push 0x1000793c
call fcn.1005274a
xor eax, eax
inc eax
pop ecx
pop ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0xe4], eax
jl 0x1001c84d
mov ecx, eax
call fcn.1001af17
mov esi, eax
mov dword [esp + 0x30], esi
lea eax, [esp + 0xb8]
push eax
push 0x1000793c
call fcn.1005274a
pop ecx
pop ecx
mov ecx, esi
mov dword [esp + 0x24], 1
mov esi, dword [esp + 0xb8]
mov edi, ebx
cmp ecx, esi
jge 0x1001c81f
mov ebx, dword [esp + 0x24]
lea eax, [ecx + edi]
add edi, ecx
sub esi, eax
inc ebx
mov ecx, ebx
call fcn.1001af17
mov ecx, eax
lea edx, [ecx + edi]
cmp edx, esi
jl 0x1001c7fe
mov dword [esp + 0xb8], esi
xor ebx, ebx
mov ecx, esi
call fcn.1001af2f
push eax
push 0x1000796c
call fcn.10050d7d
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x38]
inc eax
pop ecx
pop ecx
mov dword [esp + 0xc], eax
cmp eax, dword [esp + 0xe4]
jle 0x1001c7cf
mov esi, dword [esp + 0x2c]
push 3
lea ecx, [esp + 0xfc]
call fcn.1000b514
mov dword [esp + 0xc], 0x94643cdf
mov dword [esp + 0xc], ebx
jmp 0x1001c87f
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x10c93b4e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001c869
mov dword [esp + 0xc], ebx
jmp 0x1001c933
mov dword [esp + 0x10], 0x17f75960
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1001c905
mov dword [esp + 0x1c], 0xa622a149
mov dword [esp + 0x1c], ebx
jmp 0x1001c8d5
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001c8d1
push ebx
push ebx
push 0x8e9
push 0x1ed8
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x1001c8b3
mov dword [esp + 0x1c], ebx
jmp 0x1001c8f8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0xf90a2337
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001c8e2
dec dword [esp + 0x10]
jns 0x1001c8a5
mov dword [esp + 0x10], ebx
jmp 0x1001c928
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0xf8]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0x10]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x1001c90b
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x1001c88f
cmp dword [esp + 0xf8], 0
je 0x1001c96a
push dword [esp + 0xf8]
call fcn.10050ee7
pop ecx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
cmp byte [ebp + 0xc], 0
jne 0x1001c978
test esi, esi
jne 0x1001d24b
mov dword [esp + 0xc], 0xfffffff6
mov dword [esp + 0xc], ebx
jmp 0x1001c999
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2c0], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001c986
mov dword [esp + 0xc], ebx
jmp 0x1001c9c0
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001c9bc
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jle 0x1001c9a6
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x2f0]
mov ecx, dword [esp + 0x48]
push eax
call fcn.1000fa67
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0x1c4]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x1001cb28
cmp dword [esp + 0x1c8], 0
je 0x1001cb28
push 2
mov dword [esp + 0x28], 3
mov dword [esp + 0x10], ebx
pop ecx
jmp 0x1001ca25
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x230], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001ca12
mov eax, dword [esp + 0x230]
sub eax, dword [esp + 0x230]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001ca5d
push ebx
push 0x1254
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 2
pop ecx
mov eax, dword [esp + 0x1cc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x148], eax
mov dword [esp + 0xc], ebx
jmp 0x1001ca85
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x54], 0x7d8a8701
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001ca75
xor edx, edx
inc edx
cmp dword [esp + 0x10], ebx
mov dword [esp + 0x10], ebx
je 0x1001cb14
jmp 0x1001cacd
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x54], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001cac2
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
neg ecx
mov dword [esp + eax*4 + 0x54], ecx
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff0
jl 0x1001caac
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x1001ca9a
jmp 0x1001cb1a
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x54], ebx
jne 0x1001cb1a
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x54], ebx
je 0x1001caf1
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x54]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x54]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x54]
cmp eax, edx
mov eax, dword [esp + 0x10]
setge cl
mov dword [esp + eax*4 + 0x54], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x1001cad5
mov eax, dword [esp + 0x1c8]
mov dword [esp + 0x14c], eax
cmp dword [esp + 0x2c], 0
jne 0x1001d24b
cmp dword [esp + 0x1c0], 0
jle 0x1001d24b
mov dword [esp + 0x18], 0x5d811f07
mov dword [esp + 0x20], 0xfff7
mov dword [esp + 0x1c], ebx
jmp 0x1001cb6a
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2d8], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001cb57
mov dword [esp + 0x1c], ebx
jmp 0x1001cb8a
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x208], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1001cb77
mov dword [esp + 0x20c], 2
cmp dword [esp + 0x20c], ebx
jl 0x1001cc10
mov dword [esp + 0xc], ebx
mov dword [esp + 0x28], 0x2a2b3b7b
mov dword [esp + 0xc], ebx
jmp 0x1001cbca
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xe0], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001cbb7
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001cbe4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov dword [esp + 0xc], 2
cmp dword [esp + 0xc], ebx
jl 0x1001cc07
mov dword [esp + 0x28], 0xbfc3
inc dword [esp + 0xe0]
dec dword [esp + 0xc]
jns 0x1001cbf2
dec dword [esp + 0x20c]
jns 0x1001cba5
mov dword [esp + 0x18], ebx
jmp 0x1001cc3c
mov dword [esp + 0x28], 0x6e229edc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0x208]
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x208], ecx
inc dword [esp + 0x20]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x1001cc16
push 1
lea ecx, [esp + 0x13c]
call fcn.1000b514
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001cc75
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0xcf5720e8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001cc5f
mov dword [esp + 0x18], ebx
jmp 0x1001cc96
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x138]
cmp dword [eax + ecx*4], ebx
jne 0x1001cc9c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1001cc82
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001ccae
push ebx
call dword [sym.imp.USER32.dll_DestroyIcon]
cmp dword [esp + 0x138], 0
je 0x1001ccda
push dword [esp + 0x138]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebx
push 4
lea ecx, [esp + 0x60]
call fcn.1000b514
mov dword [esp + 0x30c], 0x16
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001cd11
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001ccfe
push 3
pop eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jl 0x1001d00b
mov edi, 0x1000793c
mov dword [esp + 0x1c], 0xa9ef72d4
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 0x80735653
mov dword [esp + 0x1c], ebx
jmp 0x1001cff7
mov dword [esp + 0x10], 0x2bbef7d6
lea ecx, [esp + 0x108]
push 4
call fcn.1000b514
mov byte [esp + 0x30c], 0x17
mov dword [esp + 0xc], ebx
jmp 0x1001cd85
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001cd6f
mov dword [esp + 0x10], 3
cmp dword [esp + 0x10], ebx
jl 0x1001cfbc
xor ecx, ecx
inc ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0xc], 0x27d373ee
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0x1c]
je 0x1001cdc7
mov esi, ecx
cmp dword [esp + 0x1c], ebx
jne 0x1001cdc9
mov esi, ebx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x5c]
push 0
cmp dword [ecx + eax*4], 1
sbb eax, eax
neg eax
cmp dword [ecx + edx*4], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x60]
pop edx
setg dl
mov dword [eax + ecx*4], edx
xor eax, eax
cmp esi, 0x360d
mov dword [esp + 0x34], edx
setne al
imul eax, dword [esp + 0xc]
cmp dword [esp + 0x34], eax
jl 0x1001cf36
cmp dword [esp + 0x1c], ebx
je 0x1001cf36
mov eax, dword [esp + 0x5c]
mov ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x108]
mov dword [eax + 4], ecx
mov dword [esp + 0x24], 0x21b4
cmp dword [esp + 0x24], 0x1148
jge 0x1001cf2e
cmp dword [esp + 0x18], ebx
je 0x1001cf47
cmp dword [esp + 0x1c], ebx
je 0x1001cf47
mov eax, ebx
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0xfffffffe
jne 0x1001cfb2
mov byte [esp + 0x30c], 0x16
cmp dword [esp + 0x108], 0
je 0x1001cff0
push dword [esp + 0x108]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
inc dword [esp + 0x1c]
push 3
pop eax
cmp dword [esp + 0x1c], eax
jle 0x1001cd4b
dec dword [esp + 0x20]
jns 0x1001cd2e
or dword [esp + 0x30c], 0xffffffff
cmp dword [esp + 0x5c], 0
je 0x1001d030
push dword [esp + 0x5c]
call fcn.10050ee7
pop ecx
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
cmp dword [esp + 0x1c4], 0
je 0x1001d24b
xor ecx, ecx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
inc ecx
jmp 0x1001d057
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x44], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1001d04b
mov dword [esp + 0x1c], ebx
jmp 0x1001d076
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1d4], 0xfffffffb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1001d063
mov dword [esp + 0x44], ebx
cmp dword [esp + 0x44], 8
jge 0x1001d20b
push 0xfffffffffffffffa
pop edi
mov dword [esp + 0x30], edi
lea ecx, [esp + 0xac]
push 3
call fcn.1000b514
mov dword [esp + 0x30c], 0x18
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x30], 0xffff
push 2
call fcn.1000b514
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001d0dd
mov dword [esp + 0x18], ebx
jmp 0x1001d226
push 2
lea ecx, [esp + 0x21c]
call fcn.1000b514
mov dword [esp + 0x30c], 0x19
lea eax, [esp + 0x2b4]
push dword [esp + 0x1d0]
movdqa xmm0, xmmword [0x10007e20]
lea ecx, [esp + 0x228]
push eax
lea eax, [esp + 0x2ac]
mov dword [esp + 0x28], 0x13638ecf
push eax
push ebx
movdqu xmmword [esp + 0x2b4], xmm0
mov dword [esp + 0x234], ebx
mov dword [esp + 0x238], ebx
mov dword [esp + 0x23c], ebx
call fcn.1000f644
mov byte [esp + 0x30c], 0x1a
mov dword [esp + 0xc], ebx
jmp 0x1001d2da
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x218]
mov dword [eax + ecx*4], 0x342eb90d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001d2c4
xor ecx, ecx
mov dword [esp + 0x20], ebx
inc ecx
jmp 0x1001d601
mov dword [esp + 0x18], 0x82eac453
mov dword [esp + 0x28], ecx
mov dword [esp + 0x28], 0xb168f92
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x28], 0x1ccb
cmp dword [esp + 0x28], 0x57a
jge 0x1001d4d2
push ecx
lea ecx, [esp + 0x26c]
call fcn.1001e008
push 0x10007aac
mov byte [esp + 0x310], 0x1b
call fcn.10050980
mov edi, dword [esp + 0x26c]
pop ecx
push eax
push 0x10007aac
mov ecx, edi
call fcn.1000b7f0
push 0x10007ab4
lea ecx, [edi + 0x18]
call fcn.1001d79f
push 0x10007ac0
lea ecx, [edi + 0x30]
call fcn.1001d79f
push 0x10007ac8
lea ecx, [edi + 0x48]
call fcn.1001d79f
push 0x10007ad0
lea ecx, [edi + 0x60]
call fcn.1001d79f
push 0x10007ad4
lea ecx, [edi + 0x78]
call fcn.1001d79f
push 0x10007adc
lea ecx, [edi + 0x90]
call fcn.1001d79f
push 0x10007ae4
lea ecx, [edi + 0xa8]
call fcn.1001d79f
push 0x10007aec
lea ecx, [edi + 0xc0]
call fcn.1001d79f
push 0x10007af8
lea ecx, [edi + 0xd8]
call fcn.1001d79f
push 0x10007b00
lea ecx, [edi + 0xf0]
call fcn.1001d79f
push 0x10007b0c
lea ecx, [edi + 0x108]
call fcn.1001d79f
push ebx
push ebx
lea ecx, [esp + 0x240]
mov dword [esp + 0x250], ebx
mov dword [esp + 0x254], ebx
call fcn.1000b869
lea edx, [esp + 0x238]
mov byte [esp + 0x30c], 0x1c
mov ecx, 0x1065aef0
call fcn.1000e9c7
mov dword [esp + 0x30], ebx
mov esi, ebx
cmp dword [esp + 0x24c], 0x10
lea eax, [esp + 0x238]
push dword [esp + 0x248]
cmovae eax, dword [esp + 0x23c]
push eax
push dword [edi + 0x10]
push ecx
mov ecx, edi
call fcn.1001e05f
test eax, eax
je 0x1001d46a
push 0xc
inc esi
add edi, 0x18
pop eax
cmp esi, eax
jl 0x1001d42f
jmp 0x1001d46e
mov dword [esp + 0x30], esi
lea eax, [esp + 0x1e4]
mov ecx, 0x1065aef0
push eax
call fcn.1000b0f2
mov eax, dword [esp + 0x1e4]
add eax, dword [esp + 0x30]
push 0xc
pop ecx
cdq
idiv ecx
mov ecx, 0x1065ae38
imul edx, edx, 0x18
add edx, dword [esp + 0x268]
call fcn.1001f2a6
push eax
call fcn.1000eba4
pop ecx
push ebx
push 1
lea ecx, [esp + 0x240]
call fcn.1000b869
lea ecx, [esp + 0x268]
mov byte [esp + 0x30c], 0x1a
call fcn.1001e7ab
xor ecx, ecx
inc ecx
mov dword [esp + 0xc], ebx
jmp 0x1001d4eb
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xcc], 5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001d4d8
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
jl 0x1001d587
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001d51d
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x50], 0xfffffff6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001d50d
mov dword [esp + 0x50], ecx
cmp dword [esp + 0x50], ebx
jl 0x1001d557
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x218]
cmp dword [eax + ecx*4], ebx
jne 0x1001d557
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001d551
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
dec dword [esp + 0x50]
jns 0x1001d52d
mov dword [esp + 0x1c], ebx
jmp 0x1001d573
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x218]
mov dword [eax + ecx*4], 0xa205b290
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001d55d
dec dword [esp + 0x18]
push 1
pop ecx
jns 0x1001d4ff
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001d5a2
push ebx
push 0x2198
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor ecx, ecx
inc ecx
mov dword [esp + 0x18], ebx
jmp 0x1001d5f7
mov dword [esp + 0xc], 0xfffffff7
mov dword [esp + 0x28], 0xb17b722b
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], ecx
cmp dword [esp + 0xc], ebx
jl 0x1001d5f3
mov dword [esp + 0x28], 0x8e9934b0
mov dword [esp + 0x28], 0xd68f985
mov dword [esp + 0x28], 2
mov dword [esp + 0x28], 3
dec dword [esp + 0xcc]
dec dword [esp + 0xc]
jns 0x1001d5c6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jle 0x1001d5a8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jle 0x1001d2ed
lea ecx, [esp + 0x224]
call fcn.1000ba67
or dword [esp + 0x30c], 0xffffffff
lea ecx, [esp + 0x218]
call fcn.1000ba67
lea ecx, [esp + 0x1c0]
call fcn.100171a7
push 2
lea ecx, [esp + 0x260]
call fcn.1000b514
mov dword [esp + 0xc], ebx
mov dword [esp + 0x30], 0xf6ef
mov dword [esp + 0xc], ebx
jmp 0x1001d66d
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x25c]
mov dword [eax + ecx*4], 0x571177e8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001d657
xor edx, edx
inc edx
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
jl 0x1001d6c9
mov ecx, dword [esp + 0x25c]
mov dword [esp + 0x18], 0xccce1e2c
mov dword [esp + 0x34], 0x3e64f147
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], ebx
jl 0x1001d6ac
dec dword [esp + 0x30]
dec dword [esp + 0x18]
jns 0x1001d6a2
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
mov dword [ecx + 4], edx
dec dword [esp + 0xc]
jns 0x1001d688
lea ecx, [esp + 0x25c]
call fcn.1000ba67
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x1001d700
mov edx, dword [esp + 0x4c]
mov ecx, eax
call fcn.1001af0d
mov esi, eax
lea eax, [esp + 0xdc]
push eax
mov dword [esp + 0x148], esi
call fcn.1001df44
mov dword [eax], esi
push 3
lea ecx, [esp + 0x254]
call fcn.1000b514
mov dword [esp + 0xc], 1
mov dword [esp + 0xc], ebx
jmp 0x1001d732
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x250]
mov dword [eax + ecx*4], 2
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001d71c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001d74b
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov dword [esp + 0xc], 2
cmp dword [esp + 0xc], ebx
jl 0x1001d76f
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x250]
cmp dword [eax + ecx*4], ebx
jne 0x1001d76f
dec dword [esp + 0xc]
jns 0x1001d759
lea ecx, [esp + 0x250]
call fcn.1000ba67
mov eax, dword [ebp + 8]
lea esi, [esp + 0x144]
mov ecx, dword [esp + 0x304]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret