Function at 0x1001a244
Capabilities:
Create directory
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100834c5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c8
push ebx
push esi
push edi
push 2
pop esi
mov dword [esp + 0x58], ecx
xor ebx, ebx
mov dword [esp + 0x34], ebx
lea ecx, [esp + 0xa0]
push esi
mov dword [esp + 0x90], edx
call fcn.1001831b
push 4
mov dword [esp + 0x2c], 0x33563700
pop edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x1001a2bc
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xa0]
mov dword [eax + ecx*4], 0x25d16df2
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001a2a6
mov dword [esp + 0x1c], ebx
jmp 0x1001a2db
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x124], 0x3717be9f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001a2c8
mov dword [esp + 0x1c], ebx
jmp 0x1001a2fa
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x174], 0xfffffffc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001a2e7
mov edx, dword [esp + 0xa0]
mov eax, dword [esp + 0x34]
mov dword [edx + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
add eax, dword [esp + 0x34]
jne 0x1001a326
cmp dword [edx + 4], ebx
je 0x1001a32a
mov eax, dword [esp + 0x10]
mov eax, dword [edx + 4]
xor ecx, ecx
mov edx, dword [edx + 4]
mov dword [esp + 0x128], eax
mov dword [esp + 0x174], ebx
mov eax, dword [esp + 0x10]
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, edx
mov ecx, 0xaa810d21
setge al
add eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0xa0]
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
add ecx, 0xffff68c1
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xa0]
call fcn.10018bdb
mov dword [esp + 0x28], 0x5c6e
lea ecx, [esp + 0x158]
mov dword [esp + 0x20], 0xfffffffe
mov dword [esp + 0x18], 0xfffffffc
mov dword [esp + 0x34], 0xd64ea33a
mov dword [esp + 0x24], 0x1914cc5c
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x30], 0xa68f
mov dword [esp + 0x30], 0xffffffff
push edi
call fcn.1001831b
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001a3f3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 0x50e8f7cf
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001a3dd
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x20]
push 1
pop edi
cmp eax, dword [esp + 0x18]
jne 0x1001a413
mov eax, ebx
cmp dword [esp + 0x20], ebx
je 0x1001a415
mov eax, edi
mov dword [esp + 0x34], eax
mov edx, edi
cmp dword [esp + 0x34], ebx
jne 0x1001a423
mov edx, ebx
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x6d40
setle al
sub eax, dword [esp + 0x18]
jne 0x1001a447
mov edx, ebx
cmp dword [esp + 0x18], ebx
je 0x1001a449
mov edx, edi
xor ecx, ecx
mov dword [esp + 0x28], 0xa835a23e
mov eax, dword [esp + 0x18]
cmp edx, eax
mov eax, dword [esp + 0x28]
setge cl
xor edx, edx
cmp ecx, 6
setl dl
xor ecx, ecx
cmp eax, 0x3de0369b
setl cl
sub ecx, edx
sub ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf1540ee1
ja 0x1001a491
mov eax, ebx
cmp dword [esp + 0x24], ebx
je 0x1001a493
mov eax, edi
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
sub edx, 0x743c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x158]
inc dword [esp + 0x1c]
call fcn.10018bdb
mov dword [esp + 0x18], 0xe1757117
mov dword [esp + 0x1c], 0xfffffffa
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x28], 0x66b7a7bc
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0xff2d4e20
mov dword [esp + 0x10], ebx
jmp 0x1001a50a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x188], 0x66bd5d51
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001a4f7
mov dword [esp + 0x18], ebx
jmp 0x1001a673
mov dword [esp + 0x20], ebx
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x10], ebx
jmp 0x1001a53e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1a0], 0xbb9a67b9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001a52b
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x20]
add edx, dword [esp + 0x1c]
add edx, dword [esp + 0x18]
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setl cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jle 0x1001a599
mov ecx, ebx
cmp dword [esp + 0x18], ebx
je 0x1001a59b
mov ecx, edi
mov eax, dword [esp + 0x18]
xor edx, edx
add eax, ecx
imul ecx, eax, 0x5616
mov eax, dword [esp + 0x18]
cmp eax, ecx
setl dl
cmp edx, dword [esp + 0x20]
jle 0x1001a5c0
mov ecx, ebx
cmp dword [esp + 0x20], ebx
je 0x1001a5c2
mov ecx, edi
mov eax, dword [esp + 0x20]
imul eax, ecx
xor ecx, ecx
cmp eax, 0x4286
mov eax, dword [esp + 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setge dl
neg edx
mov dword [esp + 0x2c], edx
xor edx, edx
cmp eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], ebx
jmp 0x1001a669
mov dword [esp + 0x30], 0xa22f0f5b
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], edi
mov dword [esp + 0x30], 0x85ca7db
mov dword [esp + 0x30], 0x9278a491
mov dword [esp + 0x30], edi
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0xca380790
mov dword [esp + 0x28], edi
mov dword [esp + 0x10], ebx
jmp 0x1001a65b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x180], 0xbc9ee521
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001a648
dec dword [esp + 0x28]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x1001a606
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x18
jg 0x1001a519
mov dword [esp + 0x1c], edi
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x24], 0xf199314e
mov dword [esp + 0x2c], 0x9e63a5be
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a6b4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x34]
sub ecx, eax
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x10], 0xb13e
mov dword [esp + 0x30], 8
mov dword [esp + 0x20], ebx
jmp 0x1001a72b
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1a8], 0xb50bf34f
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1001a718
cmp dword [esp + 0x10], ebx
je 0x1001a77a
mov dword [esp + 0x10], ebx
jmp 0x1001a772
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a753
push 0x26ae
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a76e
push 0xe86
push 0x26fb
push ebx
call dword [sym.imp.USER32.dll_EnableMenuItem]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x1001a73e
jmp 0x1001a786
mov dword [esp + 0x28], 0x836b16b
dec dword [esp + 0x28]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a797
push ebx
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [esp + 0x1c], 0x110c93b4
mov dword [esp + 0x34], 0xfffffffd
mov dword [esp + 0x10], edi
mov dword [esp + 0x10], ebx
jmp 0x1001a7c4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x150], 0xf9b3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001a7b1
mov dword [esp + 0x10], ebx
jmp 0x1001a7e1
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x150], ebx
jne 0x1001a7e7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x1001a7d0
mov dword [esp + 0x10], 0xfffffff8
mov dword [esp + 0x24], 0x1355fff
mov dword [esp + 0x18], 0x11f3813b
mov dword [esp + 0x1c], 0xfffb
mov dword [esp + 0x20], 0xc8f94914
mov dword [esp + 0x1c], ebx
jmp 0x1001a825
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x5c], 0xfffffffe
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1001a815
mov dword [esp + 0x1c], ebx
jmp 0x1001a841
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x84], edi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001a832
mov dword [esp + 0x1c], ebx
jmp 0x1001a85d
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x6c], 0x4060a3b7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1001a84d
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x88]
sete cl
xor edx, edx
cmp ecx, 0xffffffff
setne dl
sub edx, 0x11ff
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x18]
jg 0x1001a8a9
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x68]
xor ecx, ecx
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x60]
mov dword [esp + 0x1c], eax
mov edx, dword [esp + 0x1c]
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, edx
setg cl
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
je 0x1001a8e9
mov edx, edi
cmp dword [esp + 0x18], ebx
jne 0x1001a8eb
mov edx, ebx
dec dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x84]
cmp edx, eax
mov eax, dword [esp + 0x24]
setne cl
xor edx, edx
imul ecx, ecx, 0xf2c9
cmp eax, ecx
setg dl
mov dword [esp + 0x6c], edx
mov dword [esp + 0x10], ebx
jmp 0x1001a96d
mov dword [esp + 0x18], ebx
jmp 0x1001a962
mov dword [esp + 0x1c], ebx
jmp 0x1001a957
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a93a
push 0x4a9
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov dword [esp + 0x20], ebx
jmp 0x1001a94c
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x5c], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1001a940
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x30
jle 0x1001a924
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffd
jl 0x1001a91e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x10
jne 0x1001a918
mov dword [esp + 0x30], edi
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a989
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001a99b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 7
pop ecx
mov dword [esp + 0x30], ecx
mov eax, 0xb948214d
mov dword [esp + 0x2c], 9
mov dword [esp + 0x24], 0x8fb0b44c
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
push 0xfffffffffffffff6
pop esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
mov dword [esp + 0x11c], eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x28], 0x69a4575f
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0x88a3
mov dword [esp + 0x24], 0xa6c9
mov dword [esp + 0x1c], ebx
jmp 0x1001aa1c
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x70], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001aa10
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setle dl
sub edx, 0x8af16de6
neg edx
sbb edx, edx
inc edx
cmp edx, 0x3ae5
je 0x1001aa55
mov eax, dword [esp + 0x18]
mov dword [esp + 0x118], ebx
xor ecx, ecx
mov eax, dword [esp + 0x10]
test eax, eax
mov eax, dword [esp + 0x18]
sets cl
cmp ecx, 0xb5009892
sbb edx, edx
xor ecx, ecx
add edx, 0xffff
cmp edx, eax
setne cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
cmp eax, 0xffffffff
mov dword [esp + 0x70], eax
sete cl
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], ebx
je 0x1001ab50
mov dword [esp + 0x24], 0xdf607dbc
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x28], 0xf643d9d7
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x70]
test eax, eax
jne 0x1001ab39
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x70]
add edx, 0xffff664c
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov edx, ebx
setle cl
cmp ecx, dword [esp + 0x2c]
je 0x1001ab3b
mov edx, edi
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x10], ecx
dec dword [esp + 0x28]
jmp 0x1001aba3
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x108]
push 2
call fcn.1001831b
mov dword [esp + 0x10], ebx
jmp 0x1001ab7f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x108]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001ab6c
inc dword [esp + 0x24]
lea ecx, [esp + 0x108]
mov eax, dword [esp + 0x108]
mov dword [eax], 7
call fcn.10018bdb
mov dword [esp + 0x30], 0xfffffff7
lea ecx, [esp + 0x138]
push edi
call fcn.1001831b
mov dword [esp + 0x1dc], ebx
mov dword [esp + 0x18], ebx
jmp 0x1001abdb
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0x5b57fd54
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001abc5
mov dword [esp + 0x18], ebx
jmp 0x1001abf7
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x4c], 0x4c506d44
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001abe7
mov dword [esp + 0x50], ebx
cmp dword [esp + 0x50], ebx
jg 0x1001ac7f
push 4
lea ecx, [esp + 0x100]
call fcn.1001831b
mov dword [esp + 0x10], ebx
jmp 0x1001ac32
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001ac1c
mov esi, dword [esp + 0xfc]
mov dword [esi + 0xc], ebx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001ac61
push ebx
push 0x11ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
dec dword [esi + 0xc]
jns 0x1001ac43
lea ecx, [esp + 0xfc]
call fcn.10018bdb
inc dword [esp + 0x50]
cmp dword [esp + 0x50], ebx
jle 0x1001ac08
push 0xfffffffffffffff6
pop esi
or dword [esp + 0x1dc], 0xffffffff
lea ecx, [esp + 0x138]
call fcn.10018bdb
mov dword [esp + 0x20], 0xf5540d7f
mov dword [esp + 0x38], 6
mov dword [esp + 0x38], 0x54e7
mov dword [esp + 0x38], 9
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x38], 0xf6f4846e
push 3
pop edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x10], 0xbe776e9f
mov dword [esp + 0x38], edi
mov dword [esp + 0x38], 0xfffffffb
mov dword [esp + 0x38], 0xd38c4615
mov dword [esp + 0x38], 0xfffffffe
mov dword [esp + 0x38], 0x86e89be3
mov dword [esp + 0x38], 0xfffffffa
mov dword [esp + 0x38], 0xd7279364
mov dword [esp + 0x20], ebx
jmp 0x1001ad84
mov dword [esp + 0x18], 7
mov dword [esp + 0x38], 0x13735ca7
mov dword [esp + 0x10], ebx
jmp 0x1001ad39
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xc4], 0xf47073e7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001ad26
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
je 0x1001ad5a
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], ebx
jmp 0x1001ad7a
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0xc4]
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xc4], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x1001ad60
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x14
jne 0x1001ad10
mov dword [esp + 0x38], 0xed40a165
mov dword [esp + 0x24], 0xda862840
mov dword [esp + 0x24], 0x6bde64f
mov dword [esp + 0x24], 0x90f1d898
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], edi
mov dword [esp + 0x28], 0x6076fda0
mov dword [esp + 0x10], ebx
jmp 0x1001add8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xf0], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001adc5
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [esp + 0xf4], eax
mov eax, dword [esp + 0x28]
setne cl
xor edx, edx
cmp eax, ecx
mov ecx, dword [esp + 0x20]
setle dl
imul ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], edx
xor edx, edx
cmp ecx, eax
setl dl
xor eax, eax
cmp dword [esp + 0x2c], edx
setle al
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
add eax, 6
add eax, ecx
cmp eax, dword [esp + 0x20]
jl 0x1001aec1
mov dword [esp + 0x2c], 0x59ea4d59
mov dword [esp + 0x10], ebx
jmp 0x1001ae9f
push edi
lea ecx, [esp + 0xd0]
call fcn.1001831b
mov dword [esp + 0x20], ebx
jmp 0x1001ae7a
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x1001ae64
mov eax, dword [esp + 0xcc]
lea ecx, [esp + 0xcc]
mov eax, dword [eax]
neg eax
mov dword [esp + 0x2c], eax
call fcn.10018bdb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 6
jg 0x1001ae51
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001aee1
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
jmp 0x1001aee1
mov eax, dword [esp + 0xf4]
mov dword [esp + 0xf8], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001aee1
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0xb8]
mov dword [esp + 0x20], edi
push edi
call fcn.1001831b
mov dword [esp + 0x1dc], 2
lea ecx, [esp + 0x40]
mov dword [esp + 0x18], 0x5ca9869e
push 4
call fcn.1001831b
mov dword [esp + 0x18], ebx
jmp 0x1001af2c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001af1a
mov dword [esp + 0x18], ebx
jmp 0x1001af4b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
mov dword [eax + ecx*4], 0xaeb59008
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001af38
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x1c], 3
push 3
sbb edx, edx
mov esi, dword [eax]
inc edx
mov eax, dword [esp + 0x44]
cmp edx, esi
lea ecx, [esi - 1]
mov dword [eax], ecx
mov ecx, edi
mov eax, dword [esp + 0xbc]
cmovle ecx, ebx
pop esi
mov dword [eax], ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], esi
cmp dword [esp + 0x20], ebx
jl 0x1001b10b
mov dword [esp + 0x2c], 0x4f89c894
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001afbe
push 0x953
push 0x5e7
push 0x2eb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
cmp dword [eax + ecx*4], ebx
je 0x1001b004
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], ebx
jl 0x1001b101
mov dword [esp + 0x28], 7
mov dword [esp + 0x28], 0xffffffff
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
dec dword [esp + 0x18]
jns 0x1001afe1
jmp 0x1001b101
mov dword [esp + 0x24], 8
mov dword [esp + 0x28], 0xa381e168
mov dword [esp + 0x28], 0xe341f56a
mov dword [esp + 0x1c], ebx
jmp 0x1001b0f3
mov dword [esp + 0x18], ebx
jmp 0x1001b0e5
mov dword [esp + 0x28], 0xcd953295
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b047
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x40]
cmp dword [eax + ecx*4], 0xfa7a
je 0x1001b06f
mov ecx, dword [esp + 0x20]
mov edx, ebx
mov eax, dword [esp + 0x40]
cmp dword [eax + ecx*4], ebx
je 0x1001b071
mov edx, edi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x40]
cmp edx, dword [eax + ecx*4 + 4]
jg 0x1001b083
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], 4
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x40]
add edx, dword [eax + ecx*4]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
mov dword [eax + ecx*4], edx
xor ecx, ecx
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x24]
cmp eax, 0x5c25cceb
mov eax, dword [esp + 0xb8]
setne cl
mov dword [eax + edx*4], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1001b02e
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jle 0x1001b025
mov eax, dword [esp + 0x24]
dec dword [esp + 0x20]
jns 0x1001af8e
lea ecx, [esp + 0x40]
call fcn.10018bdb
or dword [esp + 0x1dc], 0xffffffff
lea ecx, [esp + 0xb8]
call fcn.10018bdb
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x144]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x24], 0xcce005ab
mov dword [esp + 0x10], 0xa860b4ff
push esi
call fcn.1001831b
mov dword [esp + 0x10], ebx
jmp 0x1001b16d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0xab274bf9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001b157
mov dword [esp + 0x10], edi
mov dword [esp + 0x10], ebx
jmp 0x1001b1d5
mov dword [esp + 0x24], 0x35ca
mov dword [esp + 0x18], ebx
jmp 0x1001b19a
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1b4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001b18b
mov dword [esp + 0x18], ebx
jmp 0x1001b1b2
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x54], esi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001b1a6
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b1cd
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
dec dword [esp + 0x54]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff1
jle 0x1001b17d
lea ecx, [esp + 0x144]
call fcn.10018bdb
mov dword [esp + 0x10], ebx
jmp 0x1001b201
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x190], 0x7a81a82e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001b1ee
push 4
lea ecx, [esp + 0xdc]
call fcn.1001831b
push edi
lea ecx, [esp + 0xb0]
mov dword [esp + 0x1e0], esi
call fcn.1001831b
mov dword [esp + 0x24], 0xe5077045
mov dword [esp + 0x18], ebx
jmp 0x1001b24e
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], 0x313d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001b238
mov dword [esp + 0x18], ebx
jmp 0x1001b271