Function at 0x100183e4
Capabilities:
Get file size
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007fdfd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x270
mov dword [esp + 0x5c], edx
push ebx
mov dword [esp + 8], 0x3cdf
xor ebx, ebx
mov dword [esp + 0x14], 0xffffffff
push esi
mov dword [esp + 0xc], 3
push edi
mov dword [esp + 0x38], 0x5d580090
mov edi, ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x58], edi
mov dword [esp + 0x14], ebx
jmp 0x1001844e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x5c], 0x4c996e15
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001843e
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], 0xfffffff9
push 2
pop esi
cmp dword [esp + 0x10], ebx
jne 0x1001848f
mov dword [esp + 0x34], 0x2eda8ed4
dec dword [esp + 0x34]
jmp 0x1001867f
push dword [esp + 0x5c]
movdqa xmm0, xmmword [0x10007f40]
lea eax, [esp + 0x238]
push eax
lea eax, [esp + 0x22c]
mov dword [esp + 0x40], 4
push eax
push ebx
lea ecx, [esp + 0xa8]
mov dword [esp + 0xa8], ebx
movdqu xmmword [esp + 0x234], xmm0
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
call fcn.100179c3
mov dword [esp + 0x284], ebx
lea ecx, [esp + 0x128]
mov dword [esp + 0x38], 0xcf16
push esi
call fcn.10016382
mov byte [esp + 0x284], 1
mov dword [esp + 0x14], ebx
jmp 0x1001851e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0xce71
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10018508
mov dword [esp + 0x10], 0x17
jmp 0x10018599
mov dword [esp + 0x38], 0xfffffff9
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x38], 0x5f84255e
mov dword [esp + 0x38], 0x61e70716
mov dword [esp + 0x38], 0x9e62b560
push esi
call fcn.10016382
mov dword [esp + 0x34], 0x45beac3e
mov dword [esp + 0x14], ebx
jmp 0x1001857f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1b0]
mov dword [eax + ecx*4], 0x41b87000
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10018569
inc dword [esp + 0x34]
lea ecx, [esp + 0x1b0]
call fcn.10016404
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jne 0x1001852e
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 3
jg 0x1001865f
mov ecx, dword [esp + 0x128]
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x100185e3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1a0], 0x84a08deb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100185d0
dec dword [ecx + 4]
xor edx, edx
mov esi, dword [esp + 0x10]
mov ecx, dword [esp + 0x98]
mov eax, dword [esp + 0x34]
cmp dword [ecx + esi*4], eax
sete dl
neg edx
je 0x10018612
cmp dword [esp + 0x10], ebx
je 0x10018612
xor edi, edi
inc edi
jmp 0x10018614
mov edi, ebx
mov dword [esp + 0x1a4], edi
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x98]
push 2
cmp dword [edx + eax*4], edi
setl cl
xor eax, eax
cmp ecx, 0x9e4a0435
mov ecx, dword [esp + 0x20]
setne al
imul eax, dword [edx + esi*4]
pop esi
mov dword [esp + 0x20], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x100185ba
mov edi, dword [esp + 0x58]
lea ecx, [esp + 0x128]
call fcn.10016404
or dword [esp + 0x284], 0xffffffff
lea ecx, [esp + 0x98]
call fcn.10016404
cmp dword [edi + 0x10], ebx
jne 0x1001868b
xor al, al
jmp 0x1001a0a2
push 3
lea ecx, [esp + 0x80]
call fcn.10016382
mov dword [esp + 0x1c], 0xfffffff7
mov dword [esp + 0x10], ebx
jmp 0x100186ba
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], 0x540d7f82
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x100186a7
mov dword [esp + 0x10], ebx
jmp 0x100186d7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x3c], 0xd8a87013
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100186c7
mov dword [esp + 0x3c], esi
cmp dword [esp + 0x3c], ebx
jl 0x1001880c
mov edi, dword [esp + 0x7c]
mov dword [esp + 0x24], 7
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x10018719
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xc0], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10018706
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x7c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [edi + 4]
add eax, 0xfffff190
add eax, ecx
jne 0x10018778
mov eax, dword [esp + 0x3c]
add eax, dword [esp + 0x3c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x7c]
mov eax, dword [ecx + eax*4]
imul eax, dword [ecx + edx*4]
imul eax, eax, 0x9919
test eax, eax
jne 0x10018778
mov edx, ebx
jmp 0x1001877b
xor edx, edx
inc edx
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x7c]
sub edx, dword [eax + ecx*4]
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x7c]
cmp dword [eax + ecx*4], ebx
jne 0x100187a1
cmp dword [esp + 0x24], ebx
jne 0x100187a1
mov esi, ebx
jmp 0x100187a4
xor esi, esi
inc esi
mov eax, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x7c]
cmp dword [eax + ecx*4], 6
sete dl
xor eax, eax
cmp esi, edx
sete al
cmp dword [esp + 0x1c], 0xfffffff7
mov dword [esp + 0x34], eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp dword [esp + 0x34], eax
setg cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x3c]
imul edx, eax
mov eax, dword [esp + 0x3c]
cmp edx, eax
setl cl
mov dword [esp + 0xc0], ecx
mov dword [esp + 0x34], ebx
dec dword [esp + 0x3c]
jns 0x100186f0
mov edi, dword [esp + 0x58]
lea ecx, [esp + 0x7c]
call fcn.10016404
mov dword [esp + 0x14], 6
mov dword [esp + 0x14], ebx
jmp 0x1001883b
cmp byte [esp + 0x2f], 0
je 0x10018837
push ebx
push 0x215e
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1a
mov byte [esp + 0x2f], bl
jl 0x10018823
cmp byte [esp + 0x2f], 0
je 0x1001885a
push 0x18aa
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0x158]
mov dword [esp + 0x10], 0xb34e6d4f
push 4
call fcn.10016382
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x24], 0x9f08664a
mov dword [esp + 0x28], 0x3d1aa12a
mov dword [esp + 0x34], 0xa6ebbfad
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x100188b8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x100188a2
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
neg eax
cmp eax, 0xff12
mov eax, dword [esp + 0x10]
setle cl
xor edx, edx
cmp eax, ecx
setle dl
xor ecx, ecx
imul edx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0x34], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x24]
setle dl
sub edx, dword [esp + 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
imul ecx, dword [esp + 0x10]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0xc
jle 0x100189f2
mov esi, 0xb404
mov dword [esp + 0x1c], 0xfffffffe
xor ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], 0xfef5379a
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x158]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
neg eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x30]
jle 0x1001897d
cmp dword [esp + 0x1c], ebx
jne 0x1001897f
mov ecx, ebx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
add eax, ecx
imul eax, dword [esp + 0x1c]
imul eax, eax, 7
test eax, eax
je 0x100189ab
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], 0xa3f0bde8
jmp 0x100189e3
mov dword [esp + 0x17c], esi
mov dword [esp + 0x180], esi
mov dword [esp + 0x184], esi
mov dword [esp + 0x188], esi
cmp dword [esp + 0x17c], ebx
jne 0x100189f2
mov byte [esp + 0x2f], bl
cmp byte [esp + 0x2f], 0
je 0x100189e3
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xc
jg 0x10018936
lea ecx, [esp + 0x158]
call fcn.10016404
push 0x2bec
push ebx
push 0x7b9f
push 0x165
call fcn.1001a0f5
add esp, 0x10
mov byte [esp + 0xf], bl
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x140]
push 1
call fcn.10016382
push 2
pop esi
push 4
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x288], esi
call fcn.10016382
mov byte [esp + 0x284], 3
mov dword [esp + 0x18], ebx
jmp 0x10018a62
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x74], 0xe8cff0ea
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10018a52
mov dword [esp + 0x18], ebx
jmp 0x10018a84
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0x88999d94
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10018a6e
mov dword [esp + 0x18], ebx
jmp 0x10018aa3
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1dc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10018a91
mov dword [esp + 0x74], 0x13
jmp 0x10018b4c
mov dword [esp + 0x38], 0xbef7d651
lea ecx, [esp + 0x1e8]
mov dword [esp + 0x30], ebx
push esi
call fcn.10016382
mov dword [esp + 0x20], 0x5b054dbb
mov dword [esp + 0x34], 0xbd48
mov dword [esp + 0x28], 1
mov dword [esp + 0x14], ebx
jmp 0x10018b04
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1e8]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10018aee
mov eax, dword [esp + 0x74]
cmp dword [esp + 0x30], ebx
je 0x10018b1c
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
dec dword [esp + 0x20]
test eax, eax
js 0x10018b31
xor ecx, ecx
inc ecx
jmp 0x10018b33
mov ecx, ebx
mov eax, dword [esp + 0x140]
mov dword [eax], ecx
lea ecx, [esp + 0x1e8]
call fcn.10016404
inc dword [esp + 0x74]
cmp dword [esp + 0x74], 0x17
jl 0x10018ab7
mov byte [esp + 0x2f], bl
cmp byte [esp + 0x2f], 0
je 0x10018b70
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
lea ecx, [esp + 0x1dc]
call fcn.10016404
or dword [esp + 0x284], 0xffffffff
lea ecx, [esp + 0x140]
call fcn.10016404
cmp byte [esp + 0xf], 0
je 0x10018bae
push ebx
push 0x1565
push ebx
push 0xa33
push 0x180b
call dword [sym.imp.GDI32.dll_ExtCreatePen]
push ebx
lea eax, [esp + 0x6c]
push eax
push 0x62ca
push 0x6cfd
push 0x401
call fcn.1001c46f
add esp, 0x14
cmp dword [edi + 0x14], 0x10
jb 0x10018bd9
mov esi, dword [edi]
mov dword [esp + 0x34], esi
jmp 0x10018bdf
mov esi, edi
mov dword [esp + 0x34], edi
cmp dword [edi + 0x14], 0x10
jb 0x10018be9
mov ecx, dword [edi]
jmp 0x10018beb
mov ecx, edi
mov eax, dword [edi + 0x10]
add eax, ecx
cmp esi, eax
je 0x1001a01e
push 3
lea ecx, [esp + 0xd0]
call fcn.10016382
mov dword [esp + 0x284], 4
push 3
mov dword [esp + 0x18], 0x7563ffa
mov dword [esp + 0x14], ebx
pop edx
jmp 0x10018c35
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1bc], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018c22
mov dword [esp + 0x10], ebx
jmp 0x10018c57
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 0xcd453606
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018c41
mov eax, dword [esp + 0xcc]
push 2
pop edi
mov dword [eax], edi
push edi
lea ecx, [esp + 0xfc]
call fcn.10016382
mov byte [esp + 0x284], 5
mov dword [esp + 0x14], ebx
jmp 0x10018c9a
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x1738ab65
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10018c84
mov eax, dword [esp + 0xf8]
mov dword [eax], edi
push 3
lea ecx, [esp + 0x114]
call fcn.10016382
mov dword [esp + 0x14], ebx
jmp 0x10018cd3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10018cbd
mov edx, dword [esp + 0x110]
mov dword [edx + 8], edi
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [eax]
mov ecx, dword [esp + eax*4 + 0x1bc]
mov edi, dword [esp + 0xf8]
mov eax, dword [edi]
dec dword [edx + 8]
mov dword [esp + eax*4 + 0x1bc], ecx
mov dword [esp + 0x30], ecx
jns 0x10018ce4
lea ecx, [esp + 0x110]
call fcn.10016404
dec dword [edi]
push 2
pop edi
jns 0x10018ca9
lea ecx, [esp + 0xf8]
mov byte [esp + 0x284], 4
call fcn.10016404
mov eax, dword [esp + 0xcc]
dec dword [eax]
jns 0x10018c69
push 0xffffffffffffffee
mov dword [esp + 0x18], ebx
pop edi
jmp 0x10018d77
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10018d73
push ebx
push ebx
push 0x1a9d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x10018d54
or dword [esp + 0x284], 0xffffffff
lea ecx, [esp + 0xcc]
call fcn.10016404
mov dword [esp + 0x24], 8
mov dword [esp + 0x10], 0x18d5
mov dword [esp + 0x18], 0x7a329ef
mov dword [esp + 0x30], 0x8fa48a2b
mov dword [esp + 0x24], ebx
jmp 0x10018e9f
mov dword [esp + 0x14], ebx
jmp 0x10018dd0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x6c], 0xf33f23e9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10018dc0
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
cmp eax, dword [esp + 0x10]
je 0x10018ded
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x6c]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 1
setge al
cmp eax, dword [esp + 0x6c]
je 0x10018e30
cmp dword [esp + 0x10], ebx
je 0x10018e30
xor ecx, ecx
inc ecx
jmp 0x10018e32
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfb02
setge al
mov dword [esp + 0x30], eax
mov dword [esp + 0x18], ebx
jmp 0x10018e94
mov dword [esp + 0x10], ebx
jmp 0x10018e67
cmp byte [esp + 0xf], 0
je 0x10018e63
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
mov byte [esp + 0xf], bl
jle 0x10018e4d
cmp byte [esp + 0xf], 0
je 0x10018e90
push 0x1788
push 0xc1f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x10018e47
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x15
jle 0x10018dba
push dword [esp + 0x5c]
movdqa xmm0, xmmword [0x10007f20]
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x20c]
mov dword [esp + 0x18], 0x324ec2e0
push eax
push ebx
lea ecx, [esp + 0xfc]
mov dword [esp + 0xfc], ebx
movdqu xmmword [esp + 0x214], xmm0
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
call fcn.100179c3
mov dword [esp + 0x284], 6
mov dword [esp + 0x28], 0x4e2e0f61
mov dword [esp + 0x24], 0x25b9b55b
mov dword [esp + 0x30], 8
mov dword [esp + 0x14], ebx
jmp 0x10018f35
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x268], 0x8935
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10018f22
mov dword [esp + 0x24], 0xffffffe4
jmp 0x10018f85
mov dword [esp + 0x14], 0x417be18
mov dword [esp + 0x14], ebx
jmp 0x10018f72
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10018f6e
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x10018f54
mov dword [esp + 0x30], 1
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jl 0x10018f46
mov dword [esp + 0x10], 0x5464b5f5
mov dword [esp + 0x28], 0xfffffff7
cmp dword [esp + 0x10], ebx
je 0x10018fbe
mov dword [esp + 0x30], 1
mov dword [esp + 0x20], 0xa2c7c8a6
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], eax
jmp 0x100190eb
mov dword [esp + 0x20], 0xffb91e60
mov dword [esp + 0x14], 0x9d8d9242
mov dword [esp + 0x18], 0x1b16eb2d
mov dword [esp + 0x14], 0xa0148014
mov dword [esp + 0x14], 0xbe6286c8
mov dword [esp + 0x30], 0xfffffffe
mov dword [esp + 0x14], 2
mov dword [esp + 0x14], ebx
jmp 0x1001900f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x24c], 0xac92d14b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10018ffc
mov dword [esp + 0x10], ebx
jmp 0x100190b2
mov dword [esp + 0x1c], ebx
xor edx, edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp eax, ecx
setge dl
xor ecx, ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
test eax, eax
sets cl
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x28]
test eax, eax
jne 0x1001908f
cmp dword [esp + 0x254], ebx
jne 0x1001908f
mov eax, ebx
jmp 0x10019092
xor eax, eax
inc eax
xor ecx, ecx
cmp eax, 0x634
mov eax, dword [esp + 0x10]
sete cl
sub eax, ecx
sub eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x19
jge 0x1001901f
mov dword [esp + 0x18], ebx
jmp 0x100190e4
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100190e0
push 0x9df
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe3
jg 0x100190c3
mov dword [esp + 0x10], 0xfffffffd
cmp dword [esp + 0x10], 0xffffffe7
jl 0x100198cc
mov edi, dword [esp + 0xec]
mov dword [esp + 0x38], edi
mov dword [esp + 0x14], 0xcd329b3a
mov dword [esp + 0x20], 1
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x10019137
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x50], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10019127
push 2
mov dword [esp + 0x1c], ebx
pop esi
jmp 0x1001915a
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1a8], 0x64a11600
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10019147
mov dword [esp + 0x50], ebx
jmp 0x10019259
mov dword [esp + 0x18], ebx
mov dword [esp + 0x44], 1
mov dword [esp + 0x44], 0x6a7f4ea1
mov dword [esp + 0x44], 1
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x44], esi
mov dword [esp + 0x44], 0xcb6d64bd
mov dword [esp + 0x44], 0x37ae9f90
mov dword [esp + 0x44], 0xfffffff9
mov dword [esp + 0x44], 3
mov dword [esp + 0x1c], 0x9a1d127a
mov dword [esp + 0x24], ebx
jmp 0x100191d2
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x244], 0x122d800f
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x100191bf
mov dword [esp + 0x18], ebx
jmp 0x1001924a
mov dword [esp + 0x30], 0xf3d3
mov eax, dword [esp + 0x30]
add eax, dword [esp + 0x50]
je 0x1001921c
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x18]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
imul ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x18]
add ecx, 0xca27
je 0x1001921c
xor edx, edx
inc edx
jmp 0x1001921e
mov edx, ebx
mov eax, dword [esp + 0x50]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [esp + 0x1ac], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xb
je 0x100191de
inc dword [esp + 0x1c]
dec dword [esp + 0x50]
cmp dword [esp + 0x50], 0xffffffe3
jge 0x10019169
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019277
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadIconA]
push esi
lea ecx, [esp + 0x150]
call fcn.10016382
mov byte [esp + 0x284], 7
mov dword [esp + 0x18], 1
dec dword [esp + 0x18]
mov dword [esp + 0x18], ebx
jmp 0x1001930b
push dword [esp + 0x5c]
movdqa xmm0, xmmword [0x10007f60]
lea eax, [esp + 0x248]
push eax
lea eax, [esp + 0x23c]
mov dword [esp + 0xb8], ebx
push eax
push ebx
lea ecx, [esp + 0xc0]
mov dword [esp + 0xc4], ebx
movdqu xmmword [esp + 0x244], xmm0
mov dword [esp + 0xc8], ebx
call fcn.100179c3
mov byte [esp + 0x284], 9
mov eax, dword [esp + 0xb0]
mov dword [esp + 0x20], 0xffffffff
mov dword [eax], 0xffffffea
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019946
push 0x1d6c
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov eax, dword [esp + 0xb0]
inc dword [eax]
cmp dword [eax], 0xfffffff5
jle 0x10019930
mov dword [esp + 0x20], 3
cmp dword [esp + 0x20], ebx
jl 0x10019a5b
mov dword [esp + 0x14], 0xef6b8f3d
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019997
push 0x266c
push 0x2505
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], ebx
jl 0x10019a51
mov dword [esp + 0x28], 0xd29729c
mov dword [esp + 0x28], ebx
jmp 0x10019a0f
push 4
lea ecx, [esp + 0x108]
call fcn.10016382
mov dword [esp + 0x1c], ebx
jmp 0x100199e1
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 0x7597a61e
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x100199cb
mov eax, dword [esp + 0x104]
mov dword [eax + 0xc], 3
dec dword [eax + 0xc]
jns 0x100199f6
cmp dword [esp + 0x14], ebx
lea ecx, [esp + 0x104]
call fcn.10016404
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jle 0x100199b7
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019a47
push 0x1684
push ebx
push ebx
push 0x5f9
push 0xc09
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
dec dword [esp + 0x14]
jns 0x100199a9
dec dword [esp + 0x20]
jns 0x10019966
lea ecx, [esp + 0xb0]
mov byte [esp + 0x284], 6
call fcn.10016404
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019a8d
push 0x332a
push 0x5330
push ebx
call fcn.1001b3db
add esp, 0xc
or dword [esp + 0x284], 0xffffffff
lea ecx, [esp + 0xec]
call fcn.10016404
mov al, byte [esi]
cmp al, 0x30
jl 0x10019bd6
cmp al, 0x39
jg 0x10019bd6
mov dword [esp + 0x1c], 0x6f93bd5d
xor edx, edx
mov dword [esp + 0x20], 0xc2f5a260
inc edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x10], ebx
jmp 0x10019ae0
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x48], 0x849
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10019ad0
mov dword [esp + 0x10], ebx
jmp 0x10019aff
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x25c], 0xe91c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019aec
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x48], ebx
jne 0x10019b36
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x1c], ebx
je 0x10019b2a
mov ecx, edx
cmp dword [esp + 0x48], ebx
jne 0x10019b2c
mov ecx, ebx
mov eax, dword [esp + 0x1c]
sub ecx, eax
jne 0x10019b36
mov edx, ebx
mov eax, dword [esp + 0x48]
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xffffffff
jge 0x10019b50
cmp dword [esp + 0x48], ebx
jne 0x10019b50
mov eax, ebx
jmp 0x10019b53
xor eax, eax
inc eax
cmp eax, 0xd96711db
mov eax, dword [esp + 0x1c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x48]
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x48]
cmp edx, eax
setge cl
cmp ecx, dword [esp + 0x1c]
jge 0x10019b82
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x34]
cmp eax, 0x668d
push ebx
setle cl
push 0x32c8
push 0x31bb
mov dword [esp + 0x2c], ecx
call fcn.1001b00a
mov edx, dword [esp + 0x74]
add esp, 0xc
movsx eax, byte [esi]
mov edi, dword [esp + 0x58]
imul ecx, dword [edx], 0xa
add ecx, 0xffffffd0
add eax, ecx
inc esi
mov dword [edx], eax
mov dword [esp + 0x34], esi
jmp 0x10018bdf
mov dword [esp + 0x10], 0x3cdf
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], 3
mov dword [esp + 0x38], 0x5d580090
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], ebx
jmp 0x10019c13
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xe8], 0x4c996e15
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10019c00
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
push 0xfffffffffffffff9
pop esi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], ebx
jne 0x10019c5f
lea eax, [esp + 0xbc]
mov dword [esp + 0xbc], 0x2eda8ed4
push ebx
push eax
call fcn.1001b28f
pop ecx
pop ecx
jmp 0x10019e71
push dword [esp + 0xe8]
movdqa xmm0, xmmword [0x10007f40]
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0x1fc]
mov dword [esp + 0x40], 4
push eax
push ebx
lea ecx, [esp + 0xb4]
mov dword [esp + 0xb4], ebx
movdqu xmmword [esp + 0x204], xmm0
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
call fcn.100179c3
mov dword [esp + 0x284], 0xa
lea ecx, [esp + 0x164]
mov dword [esp + 0x38], 0xcf16
push 2
call fcn.10016382
mov byte [esp + 0x284], 0xb
mov dword [esp + 0x1c], ebx
jmp 0x10019cf6
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 0xce71
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10019ce0
mov dword [esp + 0x10], 0x17
jmp 0x10019d8d
mov dword [esp + 0x38], esi
lea ecx, [esp + 0x194]
mov dword [esp + 0x38], 0x5f84255e
mov dword [esp + 0x38], 0x61e70716
mov dword [esp + 0x38], 0x9e62b560
push 2
call fcn.10016382
lea eax, [esp + 0x194]
mov byte [esp + 0x284], 0xc
push eax
push 0x35a1
push ebx
push 0x3ced
lea eax, [esp + 0x1e8]
mov dword [esp + 0x68], 0x45beac3e
push eax
push 0x2646
push 0x6055
call fcn.1001bfcb
add esp, 0x1c
lea ecx, [esp + 0x194]
inc dword [esp + 0x58]
mov byte [esp + 0x284], 0xb
call fcn.10016404
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jne 0x10019d0a
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 3
jg 0x10019e51
mov ecx, dword [esp + 0x164]
mov dword [esp + 0x30], ecx
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x44], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x10019ddb
cmp dword [esp + 0x1c], 2
jl 0x10019dc8
lea ecx, [esp + 0x164]
call fcn.10016404
or dword [esp + 0x284], 0xffffffff
lea ecx, [esp + 0xa4]
call fcn.10016404
mov eax, dword [esp + 0x68]
lea ecx, [esp + 0x88]
push 3
mov dword [eax], ebx
call fcn.10016382
mov dword [esp + 0x20], 0xfffffff7
mov dword [esp + 0x10], ebx
jmp 0x10019ea9
cmp dword [esp + 0x10], 3
jl 0x10019e93
push 1
lea ecx, [esp + 0x174]
call fcn.10016382
mov dword [esp + 0x284], 0xd
mov dword [esp + 0x1c], ebx
jmp 0x1001a04f
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x170]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x1001a03d
mov eax, dword [esp + 0x170]
push ebx
push 0x4c90
dec dword [eax]
lea eax, [esp + 0x5f]
push eax
push 0x789f
push 0x1c25
push 0x4cb6
push 0x71d9
push 0x7ed6
push 0xd3d
mov byte [esp + 0x7b], bl
call fcn.1001bbf8
add esp, 0x24
lea ecx, [esp + 0x170]
call fcn.10016404
mov al, 1
mov ecx, dword [esp + 0x27c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret