Function at 0x1001a59d
Capabilities:
Access peb ldr_data
Check os version
Get disk information
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10085242
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x368
mov dword [esp + 0x10], 0x75c9
or eax, 0xffffffff
mov dword [esp + 0x10], 0xfffffffa
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x38], ecx
inc edi
mov dword [esp + 0xcc], edx
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x268]
mov dword [esp + 0x1c], eax
xor ebx, ebx
mov dword [esp + 0x1c], 0x1fc3eee2
mov dword [esp + 0x1c], 0xf7d65121
mov dword [esp + 0x1c], 0x9d94b4b1
mov dword [esp + 0x1c], 0xf1eb32a8
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0x7858
mov dword [esp + 0x1c], 6
mov dword [esp + 0x1c], 0x90c54408
mov dword [esp + 0x1c], 0x55f07c70
push 2
mov dword [esp + 0x20], ebx
pop esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0x145714ff
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 3
mov dword [esp + 0x1c], 0xfffffff7
mov dword [esp + 0x1c], eax
push 4
mov dword [esp + 0x20], eax
pop eax
push eax
call fcn.100184ce
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0xd4752e4a
mov dword [esp + 0x1c], 0x7fc7
push 4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1001a6aa
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x268]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001a698
dec dword [esp + 0x28]
lea ecx, [esp + 0x268]
call fcn.10018550
mov dword [esp + 0x10], 0xfffffff9
lea ecx, [esp + 0x190]
mov dword [esp + 0x2c], 0x49f4
mov dword [esp + 0x18], 0x97341720
push 3
call fcn.100184ce
mov dword [esp + 0xc], ebx
jmp 0x1001a702
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0xfe24307a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001a6ec
mov dword [esp + 0x10], 0x14
jmp 0x1001a783
mov dword [esp + 0x24], 0xfffffffe
mov dword [esp + 0xc], ebx
jmp 0x1001a734
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x8c], 3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001a721
mov dword [esp + 0x90], edi
xor edx, edx
mov eax, dword [esp + 0x90]
mov eax, dword [esp + 0x90]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x8c]
mov eax, dword [esp + 0x90]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0xfffffffb
setne al
mov dword [esp + 0x18], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x15
jle 0x1001a713
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], ebx
jl 0x1001a7d3
mov dword [esp + 0x10], ebx
jmp 0x1001a7b2
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a7ae
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x1001a79a
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x190]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x18]
jns 0x1001a794
lea ecx, [esp + 0x190]
call fcn.10018550
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x1c], 0x75c9
mov dword [esp + 0x1c], 0xfffffffa
mov dword [esp + 0xc], ebx
mov dword [esp + 0x2c], edi
mov dword [esp + 0xc], 0xffffffe5
jmp 0x1001a88e
mov dword [esp + 0x10], 0xa3df603f
mov dword [esp + 0x10], 0xffffffe9
jmp 0x1001a850
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a82d
push ebx
call dword [sym.imp.USER32.dll_CharNextW]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a84c
push ebx
push ebx
push 0x22b9
push 0x5da
call esi
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xb
jg 0x1001a81c
mov dword [esp + 0x10], ebx
jmp 0x1001a883
mov dword [esp + 0x2c], 0xfffffff6
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a87f
push ebx
push ebx
push 0x2328
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff0
jle 0x1001a85d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffff
jle 0x1001a80a
mov dword [esp + 0x1c], edi
mov dword [esp + 0xc], 0xe55059b8
mov dword [esp + 0x2c], 0xb61bab59
mov dword [esp + 0x24], 0x4678dc2a
mov dword [esp + 0x10], ebx
jmp 0x1001a8cb
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x60], 0x831713b9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001a8bb
mov dword [esp + 0x10], ebx
jmp 0x1001a8ea
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x168], 0xd08e1597
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001a8d7
mov dword [esp + 0x60], ebx
jmp 0x1001aa74
mov dword [esp + 0x10], ebx
mov dword [esp + 0x1c], 0x1abe8f21
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], 0x25155467
mov dword [esp + 0x20], 0xfffffff6
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x34], 0xe57b
mov dword [esp + 0x10], 0xffffffeb
jmp 0x1001a9e0
mov dword [esp + 0x1c], 0x38b6
mov dword [esp + 0x1c], 7
mov dword [esp + 0xc], ebx
jmp 0x1001a968
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2cc], 9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001a955
inc dword [esp + 0x2cc]
mov dword [esp + 0xc], 2
cmp dword [esp + 0xc], ebx
jl 0x1001a9dc
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a9d6
push ebx
push 0x19b9
push 0xd59
push 0x15a6
push 0x241c
push 0x1975
push 0x2655
push 0x1382
push 0x4ae
push 0x1fe7
push 0x1f7a
push 0x2536
push 0x5aa
push 0xbbd
call dword [sym.imp.GDI32.dll_CreateFontA]
dec dword [esp + 0xc]
jns 0x1001a984
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffed
jle 0x1001a93f
mov dword [esp + 0x10], 0xa83
mov dword [esp + 0x28], 0x464d91b0
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
sub edx, eax
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
add eax, dword [esp + 0x28]
inc edx
xor ecx, ecx
cmp eax, 0xffffffff
setg cl
imul ecx, dword [esp + 0x34]
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x168], edx
cmp edx, 0x7282d582
jne 0x1001aa44
mov eax, ebx
cmp dword [esp + 0x16c], ebx
je 0x1001aa46
mov eax, edi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], 0xfffffffe
jle 0x1001aa5d
mov eax, ebx
cmp dword [esp + 0x24], ebx
je 0x1001aa5f
mov eax, edi
xor ecx, ecx
add eax, 0xfffffffd
cmp eax, 0xd77
setne cl
mov dword [esp + 0x28], ecx
dec dword [esp + 0x60]
cmp dword [esp + 0x60], 0xffffffeb
jge 0x1001a8fa
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 0x250]
mov dword [esp + 0x10], 0x5c68ec0a
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x2c], 2
push 2
call fcn.100184ce
mov dword [esp + 0x37c], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001aad0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x250]
mov dword [eax + ecx*4], 6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001aaba
mov dword [esp + 0x10], 3
jmp 0x1001abdf
push dword [esp + 0x38]
movdqa xmm0, xmmword [0x10007c20]
lea eax, [esp + 0x334]
push eax
lea eax, [esp + 0x328]
mov dword [esp + 0x28], 0x3bc6
push eax
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x108]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], 0xfffffff7
push ebx
movdqu xmmword [esp + 0x330], xmm0
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], ebx
call fcn.10019b8a
mov dword [esp + 0xc], 0x44262821
cmp dword [esp + 0x20], ebx
je 0x1001ab7f
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 9
je 0x1001ab64
mov edx, edi
cmp dword [esp + 0x10], ebx
jne 0x1001ab66
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0xfc]
mov edx, edi
setne cl
mov dword [eax + 0xc], ecx
jmp 0x1001ab81
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x20]
setle cl
xor edx, edx
neg ecx
cmp ecx, 0x61718bc6
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x2c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setne cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x24]
setl cl
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xfc]
call fcn.10018550
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe5
jle 0x1001aae4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x250]
or dword [esp + 0x37c], 0xffffffff
mov dword [eax + 4], ecx
lea ecx, [esp + 0x250]
call fcn.10018550
mov dword [esp + 0x1c], 0x1fc3eee2
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], 0xc6d2
mov dword [esp + 0xc], ebx
jmp 0x1001ac39
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xec], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001ac26
mov dword [esp + 0x10], ebx
jmp 0x1001ac92
push 2
lea ecx, [esp + 0x294]
call fcn.100184ce
mov dword [esp + 0x28], edi
mov dword [esp + 0xc], ebx
jmp 0x1001ac73
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x290]
mov dword [eax + ecx*4], 0xb8c3ad3b
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001ac5d
inc dword [esp + 0x28]
lea ecx, [esp + 0x290]
dec dword [esp + 0x18]
call fcn.10018550
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff7
jne 0x1001ac45
mov dword [esp + 0x18], ebx
jmp 0x1001ad3e
mov dword [esp + 0x1c], 0xa3c3d214
lea ecx, [esp + 0x29c]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1c], 0x5c6a3f15
mov dword [esp + 0x1c], 0x51978e60
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x1c], 0xfab8
push 2
call fcn.100184ce
mov dword [esp + 0x28], 0xf7cf8fb6
mov dword [esp + 0xc], ebx
jmp 0x1001ad04
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x29c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001acf2
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x1001ad2a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xec], 0x4d1b40e1
dec dword [esp + 0x10]
jns 0x1001ad15
inc dword [esp + 0x28]
lea ecx, [esp + 0x29c]
call fcn.10018550
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001aca2
mov dword [esp + 0x1c], 0xf7d65121
push 4
mov dword [esp + 0x10], edi
pop eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 0xb5c6eff3
mov dword [esp + 0xc], ebx
jmp 0x1001ad7c
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x360], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001ad69
mov dword [esp + 0xc], ebx
jmp 0x1001adcf
mov dword [esp + 0x1c], 0x70a77c87
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001adc7
push ebx
push 0x9ae
push ebx
push ebx
push 0x1f28
push 0xde5
push 0x24de
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
dec dword [esp + 0x28]
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff6
je 0x1001ad89
mov dword [esp + 0x1c], 0x9d94b4b1
mov dword [esp + 0xc], 0x5596
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], 0xfffffffc
mov dword [esp + 0x2c], 0x2dd78f4f
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 3
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
je 0x1001ae25
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], ebx
jmp 0x1001ae51
mov dword [esp + 0x2c], 0xfff9
cmp dword [esp + 0x2c], ebx
jne 0x1001ae58
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe8
je 0x1001ae3f
push 4
pop esi
mov dword [esp + 0x1c], 0xf1eb32a8
lea ecx, [esp + 0x1a8]
push esi
call fcn.100184ce
mov dword [esp + 0x2c], 0xc1ec2db2
mov dword [esp + 0xc], ebx
jmp 0x1001ae90
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001ae7e
mov eax, dword [esp + 0x1a8]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001aeb6
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea ecx, [esp + 0x1a8]
call fcn.10018550
push dword [esp + 0x38]
movdqa xmm0, xmmword [0x10007c30]
lea eax, [esp + 0x354]
push eax
lea eax, [esp + 0x348]
mov dword [esp + 0x24], 0xffffffff
push eax
mov dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x84]
push ebx
movdqu xmmword [esp + 0x350], xmm0
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
call fcn.10019b8a
push 2
pop esi
mov dword [esp + 0x30], esi
mov dword [esp + 0x20], 0xf592
mov dword [esp + 0x18], ebx
jmp 0x1001b006
mov dword [esp + 0xc], ebx
mov dword [esp + 0x1c], 7
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0xe13a6c9c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 0xa08deb25
mov dword [esp + 0xc], ebx
jmp 0x1001afaa
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x1c], 0xca3c0bf9
mov dword [esp + 0x1c], 0x1247adf1
mov dword [esp + 0x1c], ebx
inc dword [esp + 0x28]
mov dword [esp + 0x10], 0xfffffff2
jmp 0x1001af9f
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001af9b
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xa
jl 0x1001af89
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xe
jge 0x1001af5f
mov dword [esp + 0x10], ebx
jmp 0x1001affb
mov eax, dword [esp + 0x78]
xor ecx, ecx
mov dword [esp + 0x2c], esi
mov dword [eax], 0x1648
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
cmp eax, 0x2b04
setl cl
mov dword [esp + 0x2c], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x1001afb7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x16
jle 0x1001af31
mov dword [esp + 0x18], 3
cmp dword [esp + 0x18], ebx
jl 0x1001b104
mov dword [esp + 0x34], 0x20b8
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x78]
cmp dword [eax + ecx*4], ebx
je 0x1001b051
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x78]
mov dword [esp + 0x28], edi
cmp dword [eax + ecx*4], 0x161e4178
jl 0x1001b055
mov dword [esp + 0x28], ebx
mov esi, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x78]
mov ebx, dword [esp + 0x28]
push 0
cmp ebx, dword [eax + ecx*4]
mov eax, dword [esp + 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x7c]
pop ebx
setge cl
xor edx, edx
sub ecx, 5
cmp dword [eax], ecx
mov eax, dword [esp + 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x78]
setle cl
cmp dword [eax + esi*4], ecx
jl 0x1001b0a1
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
push 4
pop ecx
cmp ecx, eax
mov eax, dword [esp + 0x78]
sbb ecx, ecx
neg ecx
neg ecx
mov dword [eax + edx*4], ecx
mov dword [esp + 0x20], 3
cmp dword [esp + 0x20], ebx
jl 0x1001b0f7
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b0f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
dec dword [esp + 0x20]
jns 0x1001b0d9
dec dword [esp + 0x18]
jns 0x1001b023
push 2
pop esi
lea ecx, [esp + 0x78]
call fcn.10018550
mov dword [esp + 0x1c], ebx
mov eax, 0x256915a
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0xa0], eax
mov dword [esp + 0xc], ebx
jmp 0x1001b147
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2f4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001b138
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b162
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov dword [esp + 0x9c], ebx
jmp 0x1001b269
mov dword [esp + 0x18], 0xf47a6d
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], ebx
jl 0x1001b262
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x30], 8
mov dword [esp + 0x10], ebx
jmp 0x1001b24e
mov dword [esp + 0x34], 0x9b7d6b59
mov eax, dword [esp + 0x10]
neg eax
je 0x1001b1bc
mov eax, dword [esp + 0x18]
mov esi, edi
imul eax, dword [esp + 0x18]
test eax, eax
jne 0x1001b1be
mov esi, ebx
mov eax, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + 0x9c]
sub ecx, eax
mov eax, dword [esp + 0x30]
cmp ecx, 0xffffffff
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
sub esi, ecx
cmp esi, dword [esp + 0x18]
je 0x1001b219
mov dword [esp + 0x30], ebx
jmp 0x1001b1ff
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x2f4], 0x7b445ace
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 3
jl 0x1001b1ec
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b243
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp 0x1001b243
mov dword [esp + 0x28], 0xf2d6273
xor edx, edx
mov dword [esp + 0x28], 0xeab3
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setne dl
mov dword [esp + eax*4 + 0x2f4], edx
dec dword [esp + 0x34]
inc dword [esp + 0x10]
push 2
pop esi
cmp dword [esp + 0x10], esi
jle 0x1001b19d
dec dword [esp + 0x18]
jns 0x1001b184
inc dword [esp + 0x9c]
cmp dword [esp + 0x9c], esi
jle 0x1001b16e
mov dword [esp + 0x1c], 0x7858
lea ecx, [esp + 0x208]
mov dword [esp + 0x1c], 6
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], 0x49fcfbce
push 3
call fcn.100184ce
mov dword [esp + 0xc], ebx
jmp 0x1001b2b8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x208]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001b2a6
cmp dword [esp + 0x18], ebx
je 0x1001b2e0
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x18]
test eax, eax
mov eax, edi
sets cl
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], ebx
jne 0x1001b2e2
mov eax, ebx
cmp eax, dword [esp + 0x18]
jne 0x1001b2f0
mov ecx, ebx
cmp dword [esp + 0x18], ebx
je 0x1001b2f2
mov ecx, edi
mov eax, dword [esp + 0x18]
add eax, ecx
je 0x1001b302
mov esi, edi
cmp dword [esp + 0x18], ebx
jne 0x1001b304
mov esi, ebx
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp esi, eax
setg cl
xor eax, eax
cmp edx, ecx
setg al
xor edx, edx
imul eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x208]
setne cl
mov dword [eax + 4], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b371
push 0x1670
push ebx
push 0x2524
push 0xcdd
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
lea ecx, [esp + 0x208]
call fcn.10018550
push 4
pop esi
mov dword [esp + 0x1c], 0x90c54408
lea ecx, [esp + 0x238]
mov dword [esp + 0x1c], 0x55f07c70
mov dword [esp + 0x18], 0x398
push esi
call fcn.100184ce
mov dword [esp + 0xc], ebx
jmp 0x1001b3bd
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x238]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001b3ab
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b3da
push 0xb0b
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov eax, dword [esp + 0x18]
xor edx, edx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
neg ecx
jne 0x1001b400
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x238]
neg ecx
mov dword [esp + 0x20], eax
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [eax + 4], esi
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp esi, ecx
setg al
imul eax, dword [esp + 0x18]
test eax, eax
je 0x1001b4a4
mov esi, dword [esp + 0x20]
mov dword [esp + 0xc], edi
mov dword [esp + 0x28], 0x205300ce
mov dword [esp + 0x2c], 0x14a9c79e
mov eax, dword [esi + 4]
cmp dword [esp + 0xc], eax
jg 0x1001b469
mov dword [esi + 4], eax
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov ecx, 0x9ef8169c
setle dl
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
imul eax, dword [esi + 4]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x2c], eax
jmp 0x1001b563
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001b4c9
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1c0], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001b4ba
mov esi, dword [esp + 0x20]
cmp dword [esp + 0x1c4], ebx
je 0x1001b4ea
mov dword [esi + 4], 0x7a2e255b
mov dword [esp + 0x28], edi
jmp 0x1001b4ee
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x18]
xor edx, edx
cmp eax, 0xbec1
mov eax, dword [esp + 0x1c4]
setne dl
xor ecx, ecx
imul edx, eax
mov eax, dword [esp + 0x18]
cmp edx, eax
setne cl
xor eax, eax
cmp dword [esp + 0x28], ecx
setle al
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c4]
mov ecx, dword [esp + 0x28]
sub ecx, eax
mov eax, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 8
sbb ecx, ecx
inc ecx
sub ecx, eax
jne 0x1001b545
mov eax, ebx
cmp dword [esi + 4], ebx
je 0x1001b547
mov eax, edi
mov dword [esp + 0x2c], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b563
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
lea ecx, [esp + 0x238]
call fcn.10018550
push 2
pop esi
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0xb4]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0x145714ff
push esi
call fcn.100184ce
mov dword [esp + 0x20], 0xa70a1ee3
mov dword [esp + 0xc], edi
mov dword [esp + 0x28], 0xfffffffd
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1001b5c7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001b5b1
push 4
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x1001b5e6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x3c], 0x13532fe2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001b5d6
mov dword [esp + 0x48], ebx
jmp 0x1001b782