Function at 0x1001d1c5
Capabilities:
Create process on windows
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008a566
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
push ebx
mov dword [esp + 0x78], edx
xor ebx, ebx
push esi
mov dword [esp + 0x38], 0xcce1
push edi
mov dword [esp + 0x68], ecx
mov dword [esp + 0x1c], ebx
jmp 0x1001d214
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xd4], 0xe1757117
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001d201
mov dword [esp + 0xd8], ebx
jmp 0x1001d234
cmp dword [esp + 0xd8], ebx
jne 0x1001d23e
dec dword [esp + 0xd8]
cmp dword [esp + 0xd8], 0xfffffffb
jne 0x1001d224
cmp dword [ecx + 0x10], ebx
jne 0x1001d24a
xor al, al
jmp 0x1001ee44
mov dword [esp + 0x24], 0xcd16
lea ecx, [esp + 0xc8]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x30], 0xc7b7f609
mov dword [esp + 0x14], ebx
mov dword [esp + 0x20], 0x4b0ad8ea
push 2
call fcn.1001b2a6
push 0xffffffffffffffff
mov dword [esp + 0x20], 0x5d177cce
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001d29b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001d289
cmp dword [esp + 0x24], ebx
jne 0x1001d2c6
mov eax, dword [esp + 0x24]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
je 0x1001d2ca
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0xc8]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov edx, dword [eax + 4]
cmp edx, 1
sete cl
xor eax, eax
cmp ecx, edx
setle al
xor ecx, ecx
cmp eax, 0x498d20b
mov eax, dword [esp + 0x24]
setl cl
add ecx, edx
xor edx, edx
cmp ecx, eax
setne dl
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc8]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [eax]
jne 0x1001d459
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 1
jg 0x1001d40d
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001d353
push 0x1c58
push 0xca5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetMessageA]
mov dword [esp + 0x24], ebx
jmp 0x1001d385
mov dword [esp + 0x20], 1
mov esi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc8]
mov edx, dword [esp + 0xc8]
mov eax, dword [eax + ecx*4]
mov dword [edx + esi*4], eax
mov dword [esp + 0x20], eax
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 1
jle 0x1001d359
mov dword [esp + 0x10], ebx
jmp 0x1001d3f1
mov dword [esp + 0x30], ebx
jmp 0x1001d3e6
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001d3bd
push ebx
push 0x553
push 0x11b4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001d3e2
push ebx
push 0x1568
push 0x165b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 1
jle 0x1001d398
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jle 0x1001d392
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jle 0x1001d331
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor esi, esi
inc esi
lea ecx, [esp + 0xc8]
call fcn.1001bad3
or ecx, 0xffffffff
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], 0x2c58fb77
mov dword [esp + 0x38], 0xfffa
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], 0x576c5165
mov dword [esp + 0x14], 0x7084bc9c
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x1c], ebx
jmp 0x1001d495
xor esi, esi
mov dword [esp + 0x10], ebx
inc esi
jmp 0x1001d47e
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001d47a
push 0x20b7
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x1001d462
jmp 0x1001d410
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1c8], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001d486
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], 0xfffffff9
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c8], ecx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001d4f4
push ebx
call dword [sym.imp.USER32.dll_RegisterClassA]
mov dword [esp + 0x1c], ebx
jmp 0x1001d50d
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x148], 0xda3c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001d4fa
mov ecx, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x24]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov dword [esp + 0x30], 0x98a8
mov dword [esp + 0x14], 0xfffffffe
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x30], ebx
je 0x1001d65c
push 2
pop eax
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x18c]
mov dword [esp + 0x10], 6
mov dword [esp + 0x1c], 0x55fd0a32
mov dword [esp + 0x1c], esi
push eax
call fcn.1001b2a6
mov dword [esp + 0x1c], ebx
jmp 0x1001d59c
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18c]
mov dword [eax + ecx*4], 0x2e166580
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001d586
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001d5c0
push ebx
push ebx
push 0xf5b
push 0x2386
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
mov eax, dword [esp + 0x10]
xor edx, edx
cmp eax, 6
setle dl
xor ecx, ecx
imul edx, dword [esp + 0x10]
imul edx, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
neg eax
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x2c]
imul ecx, dword [esp + 0x30]
sub ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18c]
add ecx, 0xfff7
mov dword [eax + 4], ecx
lea ecx, [esp + 0x18c]
call fcn.1001bad3
jmp 0x1001d68e
mov dword [esp + 0x1c], ebx
jmp 0x1001d687
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001d683
push 0x92
push 0x196c
push esi
push ebx
push 0x2cc
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xc
jl 0x1001d662
cmp dword [esp + 0x28], ebx
je 0x1001d6ff
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, 0x364d64ea
mov ecx, 0xa5720fbc
setne al
sub eax, dword [esp + 0x24]
add eax, 0x40e1
sub ecx, eax
mov dword [esp + 0x148], eax
add ecx, dword [esp + 0x28]
cmp ecx, 0xfffffffe
mov ecx, dword [esp + 0x38]
sbb eax, eax
neg eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x38]
je 0x1001d6e8
mov eax, dword [esp + 0x148]
mov ecx, dword [esp + 0x28]
xor edx, edx
mov eax, dword [esp + 0x24]
cmp eax, ecx
setge dl
sub edx, dword [esp + 0x24]
mov edx, esi
jne 0x1001d701
mov edx, ebx
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x24], ecx
mov dword [esp + 0x3c], 0x39b642c
mov dword [esp + 0x3c], 0xd837bc75
mov dword [esp + 0x1c], 0xfffffff9
mov dword [esp + 0x28], ebx
jmp 0x1001d741
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x224], 0x1d976ff5
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jl 0x1001d72e
inc dword [esp + 0x1c]
mov dword [esp + 0x1c], 0xb
jmp 0x1001d76f
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001d76b
push 0x174d
call dword [sym.imp.USER32.dll_PostQuitMessage]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x23
jg 0x1001d756
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0xf0]
push dword [esp + 0x70]
xorps xmm0, xmm0
mov dword [esp + 0xf4], ebx
movdqu xmmword [esp + 0x210], xmm0
mov dword [eax], ebx
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x214]
mov dword [esp + 0xfc], ebx
push eax
push ebx
mov dword [esp + 0x108], ebx
call fcn.1001c86e
mov eax, dword [esp + 0xf0]
lea ecx, [esp + 0xf0]
mov dword [esp + 0x3c], 0xd96753f3
or dword [esp + 0x23c], 0xffffffff
mov dword [eax + 8], ebx
call fcn.1001bad3
mov dword [esp + 0x2c], 0xfffffff8
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x30], 0xffffffff
push 2
call fcn.1001b2a6
mov dword [esp + 0x24], 7
mov dword [esp + 0x2c], 0xfffffff7
push 4
mov dword [esp + 0x2c], 0x3ff56644
pop ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1001d845
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xe0], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001d832
mov dword [esp + 0x10], ebx
jmp 0x1001d867
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1b0]
mov dword [eax + ecx*4], 0x279c4185
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001d851
mov eax, dword [esp + 0xe8]
xor ecx, ecx
mov eax, dword [esp + 0xec]
cmp eax, 0xca98
mov edx, dword [esp + 0x1b0]
setg cl
mov dword [edx + 4], ecx
test ecx, ecx
jne 0x1001d89f
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xe8]
mov eax, dword [esp + 0xe8]
mov dword [esp + 0x38], 0x3295
or eax, 0xffffffff
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], 0x918cb0b9
cmp dword [esp + 0xe8], ebx
je 0x1001d8ce
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
xor ecx, ecx
inc eax
mov dword [edx + 4], esi
cmp eax, 0x969b42c5
setne cl
sub ecx, dword [esp + 0xe8]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xb59
jg 0x1001d8fb
mov eax, esi
cmp dword [edx + 4], ebx
jne 0x1001d8fd
mov eax, ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ebx
jmp 0x1001d963
mov dword [esp + 0x14], 9
xor ecx, ecx
mov dword [esp + 0x3c], 0x64f5774
mov dword [esp + 0x20], 0x41ab
dec dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xe8]
mov eax, dword [edx + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, 0x4a9b
setl al
mov dword [esp + 0x20], eax
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x12
jle 0x1001d907
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x1b0]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0xe8]
mov eax, dword [esp + 0x2c]
mov dword [edx + 4], 0xfffffffc
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
call fcn.1001bad3
mov dword [esp + 0x20], 4
mov dword [esp + 0x10], 0xfff6
mov dword [esp + 0x38], 0xdd35930c
mov dword [esp + 0x28], ebx
jmp 0x1001d9d1
mov eax, dword [esp + 0x28]
mov dword [esp + eax*4 + 0x98], ebx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jl 0x1001d9c2
push esi
cmp dword [esp + 0x14], ebx
je 0x1001dc6d
lea ecx, [esp + 0x90]
call fcn.1001b2a6
push esi
lea ecx, [esp + 0x100]
mov dword [esp + 0x240], 2
call fcn.1001b2a6
xor edx, edx
mov byte [esp + 0x23c], 3
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001da2e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x8c]
mov dword [eax + ecx*4], 0x83c8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001da18
mov dword [esp + 0x10], ebx
jmp 0x1001da50
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], 0x720725fc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001da3a
mov dword [esp + 0x10], 0xfffffffc
jmp 0x1001dc42
mov dword [esp + 0x24], 2
mov dword [esp + 0x38], 0xd2d97b6e
mov dword [esp + 0x20], 0x144d9913
mov dword [esp + 0x20], edx
mov dword [esp + 0x20], 0x6a54ee8
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jl 0x1001dc3e
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x13c]
mov dword [esp + 0x14], 8
push 2
call fcn.1001b2a6
mov dword [esp + 0x28], ebx
jmp 0x1001dacf
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0x7dc23988
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jl 0x1001dab9
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xfc]
mov dword [eax], 1
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x8c]
mov eax, dword [ecx + eax*4]
dec eax
cmp eax, dword [ecx]
je 0x1001db0e
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
mov esi, dword [esp + 0x24]
neg edx
mov eax, dword [esp + 0x24]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [esp + 0x8c]
setl cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
setge dl
add edx, 0x423b19d8
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x13c]
mov dword [eax], ecx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x8c]
cmp dword [eax + ecx*4], ebx
jne 0x1001db81
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
dec edx
cmp eax, edx
mov eax, dword [esp + 0x8c]
setle cl
xor edx, edx
cmp ecx, dword [eax]
setge dl
mov dword [esp + 0x9c], edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x8c]
mov dword [esp + 0x20], edx
xor edx, edx
mov esi, dword [esp + 0x20]
cmp dword [eax + ecx*4], esi
mov eax, dword [esp + 0xfc]
sete dl
mov dword [eax], edx
mov eax, dword [esp + 0x38]
imul eax, edx
test eax, eax
jne 0x1001dbeb
mov eax, dword [esp + 0xfc]
cmp dword [eax], ebx
jne 0x1001dbeb
mov ecx, ebx
jmp 0x1001dbee
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x14]
sub eax, ecx
imul eax, dword [esp + 0x38]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x8c]
sub ecx, dword [eax]
mov eax, dword [esp + 0x13c]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [eax]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x13c]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
call fcn.1001bad3
dec dword [esp + 0x24]
jns 0x1001da95
xor edx, edx
inc edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x20
jl 0x1001da63
lea ecx, [esp + 0xfc]
call fcn.1001bad3
or dword [esp + 0x23c], 0xffffffff
lea ecx, [esp + 0x8c]
jmp 0x1001dd05
lea ecx, [esp + 0x178]
call fcn.1001b2a6
mov dword [esp + 0x20], 0x91be676c
mov dword [esp + 0x20], 0xffbebd5d
mov dword [esp + 0x28], ebx
jmp 0x1001dca5
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 1
jl 0x1001dc8f
mov eax, dword [esp + 0x98]
mov eax, dword [esp + 0x9c]
imul eax, dword [esp + 0x38], 0x22a8
cmp eax, 0xfffffff7
mov eax, dword [esp + 0x174]
sbb ecx, ecx
neg ecx
sub ecx, dword [eax]
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
test eax, eax
setle cl
cmp ecx, 1
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp eax, ecx
lea ecx, [esp + 0x174]
setl dl
mov dword [esp + 0x38], edx
call fcn.1001bad3
push 0xfffffffffffffff6
pop eax
mov dword [esp + 0x9c], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], 0x3fa3a92b
mov dword [esp + 0x28], 0x585ca258
mov eax, dword [esp + 0x10]
push 2
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], ebx
pop esi
jmp 0x1001df65
mov dword [esp + 0x30], 0xfffffffd
mov dword [esp + 0x34], 0x2570
mov dword [esp + 0x30], 0xffffffe9
cmp dword [esp + 0x30], 0x11
jl 0x1001df61
mov dword [esp + 0x14], 0x23afc371
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0xffffffe8
jg 0x1001df4f
or esi, 0xffffffff
mov dword [esp + 0x2c], esi
lea ecx, [esp + 0x1bc]
push 4
call fcn.1001b2a6
push 4
pop edx
mov dword [esp + 0x23c], edx
mov dword [esp + 0x28], ebx
jmp 0x1001ddb5
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edx
jl 0x1001dd9f
mov dword [esp + 0x2c], 8
jmp 0x1001df23
push dword [esp + 0x70]
movdqa xmm0, xmmword [0x1000a7d0]
lea eax, [esp + 0x210]
push eax
lea eax, [esp + 0x204]
mov dword [esp + 0x120], ebx
push eax
push ebx
lea ecx, [esp + 0x128]
mov dword [esp + 0x12c], ebx
movdqu xmmword [esp + 0x20c], xmm0
mov dword [esp + 0x130], ebx
call fcn.1001c86e
mov byte [esp + 0x23c], 5
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x38], 0xd35da2
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], 0xffffffe8
cmp dword [esp + 0x24], 0xe
jne 0x1001df0b
mov dword [esp + 0x1c], 1
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 3
jg 0x1001def1
mov esi, dword [esp + 0x118]
push 3
lea ecx, [esp + 0x1a8]
call fcn.1001b2a6
mov dword [esp + 0x28], ebx
jmp 0x1001de8a
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 0x475761ac
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jl 0x1001de74
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001dea9
push ebx
push ebx
push 0x75b
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a4]
mov dword [esi + 0xc], 0xa567
mov dword [eax + 8], ecx
lea ecx, [esp + 0x1a4]
call fcn.1001bad3
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x1001de60
mov dword [esp + 0x28], 0x64de8cc1
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xe
je 0x1001de42
or esi, 0xffffffff
lea ecx, [esp + 0x118]
mov byte [esp + 0x23c], 4
call fcn.1001bad3
dec dword [esp + 0x2c]
cmp dword [esp + 0x2c], esi
jg 0x1001ddc8
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x23c], esi
call fcn.1001bad3
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe8
jle 0x1001dd7d
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0x11
jge 0x1001dd63
push 2
pop esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jne 0x1001dd40
xor ecx, ecx
inc ecx
or edx, 0xffffffff
mov dword [esp + 0x34], ecx
mov dword [esp + 0x10], 0x25b9b55b
mov dword [esp + 0x20], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], 0xba7c3387
mov dword [esp + 0x34], 0x395830af
mov dword [esp + 0x38], ecx
mov dword [esp + 0x14], ebx
jmp 0x1001dfb2
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x88], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001dfa3
mov dword [esp + 0x10], 0xfffffff8
cmp dword [esp + 0x10], 0xe
jge 0x1001e164
jmp 0x1001dfd0
or edx, 0xffffffff
mov dword [esp + 0x2c], 0x3f0bc502
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x1d0]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], edx
mov dword [esp + 0x34], 0xfadbacd6
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], 0x82ea9177
push esi
call fcn.1001b2a6
mov dword [esp + 0x23c], 6
mov dword [esp + 0x34], ebx
mov dword [esp + 0x14], ebx
jmp 0x1001e02d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1d0]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001e01a
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov dword [esp + 0x88], ebx
dec dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
imul edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
neg edx
cmp edx, eax
setl cl
or edx, 0xffffffff
cmp ecx, edx
sbb eax, eax
neg eax
cmp edx, eax
mov eax, dword [esp + 0x28]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x10], 0xfffffffa
test eax, eax
setg cl
cmp ecx, 0xd162c5d1
sbb eax, eax
inc eax
add eax, dword [esp + 0x10]
je 0x1001e0e7
push esi
lea ecx, [esp + 0x154]
call fcn.1001b2a6
mov dword [esp + 0x34], 0xfffffffe
mov dword [esp + 0x14], ebx
jmp 0x1001e0c5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0xbebf0a0c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001e0af
mov eax, dword [esp + 0x150]
lea ecx, [esp + 0x150]
mov eax, dword [eax + 4]
mov dword [esp + 0x34], eax
call fcn.1001bad3
jmp 0x1001e138
mov dword [esp + 0x14], 0x70cc321a
xor ecx, ecx
mov dword [esp + 0x20], 0x804524be
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov dword [esp + 0x88], edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x14]
cmp edx, eax
setne cl
sub ecx, 0x7a05
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
dec dword [esp + 0x38]
lea ecx, [esp + 0x1d0]
or eax, 0xffffffff
mov dword [esp + 0x23c], eax
call fcn.1001bad3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xe
push 1
pop ecx
jl 0x1001dfcd
mov dword [esp + 0x14], 0x7186
mov dword [esp + 0x2c], 0xedade098
mov dword [esp + 0x10], ebx
jmp 0x1001e186
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001e17a
mov dword [esp + 0x10], ebx
jmp 0x1001e1a2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x64], 0x523dd972
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001e192
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x2c], 0xaee5a986
mov eax, dword [esp + 0x14]
sub eax, 0xadb8
neg eax
sbb eax, eax
inc eax
cmp dword [esp + 0x2c], eax
je 0x1001e1d8
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x44]
xor edx, edx
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x44]
cmp ecx, eax
setl dl
mov dword [esp + 0x64], edx
cmp dword [esp + 0x44], ebx
jne 0x1001e1fd
mov eax, dword [esp + 0x44]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], 0x33e7a329
mov dword [esp + 0x34], 0xfffffffa
mov dword [esp + 0x2c], 0x36c1418e
cmp dword [esp + 0x10], ebx
je 0x1001e2a8
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
sub ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x64]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, eax
mov eax, dword [esp + 0x64]
cmp ecx, eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
setg dl
add ecx, edx
xor edx, edx
cmp ecx, eax
setl dl
xor eax, eax
test edx, edx
setle al
xor edx, edx
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x64]
imul ecx, eax
mov eax, dword [esp + 0x10]
cmp eax, ecx
setg dl
sub edx, 0x8940
neg edx
sbb edx, edx
inc edx
add edx, dword [esp + 0x10]
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
add eax, 0xa3ce
jne 0x1001e2ac
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x14]
push dword [esp + 0x70]
movdqa xmm0, xmmword [0x1000a7d0]
setle dl
xor ecx, ecx
mov dword [esp + 0x12c], ebx
cmp edx, eax
mov dword [esp + 0x130], ebx
lea eax, [esp + 0x200]
mov dword [esp + 0x134], ebx
push eax
setne cl
lea eax, [esp + 0x1f4]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x130]
push eax
push ebx
movdqu xmmword [esp + 0x1fc], xmm0
call fcn.1001c86e
xor ecx, ecx
mov dword [esp + 0x23c], 7
mov dword [esp + 0x14], ebx
inc ecx
jmp 0x1001e331
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x48], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001e325
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x2c], 6
jle 0x1001e7bd
jmp 0x1001e34b
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], 0x252cb136
mov dword [esp + 0x14], ebx
jmp 0x1001e36c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x21c], 0x342e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001e359
mov dword [esp + 0x10], ecx
cmp dword [esp + 0x10], ebx
jl 0x1001e3b5
cmp dword [esp + 0x10], ebx
jne 0x1001e3b2
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e3ac
push ebx
call edi
push eax
push 0x1f6b
push 0x20d
push 0x126b
push 0x128e
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
dec dword [esp + 0x10]
jns 0x1001e37c
xor ecx, ecx
inc ecx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001e3f1
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0x65352f76
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e3ed
push 0x1e90
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
xor ecx, ecx
inc ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jle 0x1001e3bf
mov dword [esp + 0x1c], 0x7ad95e17
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x168]
push 3
call fcn.1001b2a6
or eax, 0xffffffff
mov byte [esp + 0x23c], 8
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x15c]
push 4
call fcn.1001b2a6
or eax, 0xffffffff
mov dword [esp + 0x34], eax
mov dword [esp + 0x10], ebx
jmp 0x1001e451
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], 0xac9d73df
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001e43b
mov dword [esp + 0x10], ebx
jmp 0x1001e474
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], 0xb94b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001e45e
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x168]
sub ecx, 0x534de6f8
neg ecx
sbb ecx, ecx
add ecx, 0x8d97
mov dword [eax + 4], ecx
xor eax, eax
test ecx, ecx
setne al
xor ecx, ecx
cmp eax, 0x20b50f6b
setl cl
xor edx, edx
add ecx, dword [esp + 0x1c]
imul ecx, dword [esp + 0x1c]
imul ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
jne 0x1001e4f1
cmp dword [esp + 0x14], ebx
jne 0x1001e4f1
mov edx, ebx
jmp 0x1001e4f4
xor edx, edx
inc edx
mov eax, dword [esp + 0x15c]
xor ecx, ecx
neg edx
cmp edx, dword [eax + 8]
setge cl
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x15c]
call fcn.1001bad3
lea ecx, [esp + 0x168]
mov byte [esp + 0x23c], 7
call fcn.1001bad3
push esi
lea ecx, [esp + 0xb4]
call fcn.1001b2a6
or eax, 0xffffffff
mov byte [esp + 0x23c], 9
push 0x3e84
mov dword [esp + 0x44], eax
lea eax, [esp + 0x1e0]
push 0x14d7
push eax
lea eax, [esp + 0xbc]
mov dword [esp + 0x40], 0xb5ad8edc
push ebx
push eax
call fcn.1002104e
add esp, 0x14
mov dword [esp + 0x1c], 0xfffffff0
jmp 0x1001e59b
lea eax, [esp + 0x40]
mov dword [esp + 0x20], 0xfffffffe
push eax
mov dword [esp + 0x24], 1
push ebx
call fcn.1001ee97
inc dword [esp + 0x24]
pop ecx
pop ecx
cmp dword [esp + 0x1c], 6
jg 0x1001e57a
mov dword [esp + 0x30], 0x12
cmp dword [esp + 0x30], 0x13
jg 0x1001e79a
mov dword [esp + 0x10], 0xd9978317
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x20], 0xca8e
push 4
call fcn.1001b2a6
xor ecx, ecx
mov byte [esp + 0x23c], 0xa
inc ecx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x58], ebx
jmp 0x1001e5f8
mov eax, dword [esp + 0x58]
mov dword [esp + eax*4 + 0x78], 0xc30bca0b
inc dword [esp + 0x58]
cmp dword [esp + 0x58], ecx
jl 0x1001e5e8
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x1e4]
push ebx
push eax
call fcn.10020b98
add esp, 0xc
mov dword [esp + 0x40], ebx
jmp 0x1001e76a
mov dword [esp + 0x28], ebx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e63b
push 0x11bd
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
mov eax, dword [esp + 0x40]
cmp dword [esp + eax*4 + 0x48], ebx
je 0x1001e75c
mov dword [esp + 0x14], 0xadfb1af9
cmp dword [esp + 0x78], ebx
je 0x1001e65f
mov eax, dword [esp + 0x40]
mov eax, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x40]
mov eax, dword [esp + eax*4 + 0x48]
mov ecx, dword [esp + 0xb0]
mov eax, dword [esp + 0x14]
cmp eax, dword [ecx + 4]
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
imul ecx, dword [esp + 0x30]
test ecx, ecx
je 0x1001e696
mov eax, dword [esp + 0x78]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x40]
mov esi, dword [esp + eax*4 + 0x48]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xb0]
sub edx, dword [eax]
mov eax, dword [esp + 0x40]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [esp + eax*4 + 0x48]
cmp edx, esi
setl cl
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov eax, dword [esp + 0xb0]
setge dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x40]
mov edx, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x28]
test eax, eax
sets cl
sub edx, ecx
mov dword [esp + 0x20], edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
mov dword [esp + eax*4 + 0x48], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x78], ebx
jne 0x1001e726
cmp dword [esp + 0x34], ebx
jne 0x1001e726
mov edx, ebx
jmp 0x1001e729
xor edx, edx
inc edx
mov eax, dword [esp + 0xb0]
xor ecx, ecx
cmp dword [eax], edx
mov eax, dword [esp + 0x28]
sete cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x38]
add edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
jmp 0x1001e766
mov eax, dword [esp + 0x128]
inc dword [eax + 0xc]
inc dword [esp + 0x40]
cmp dword [esp + 0x40], ebx
jle 0x1001e61d
lea ecx, [esp + 0x1e0]
mov byte [esp + 0x23c], 9
call fcn.1001bad3
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0x13
jle 0x1001e5b5
push 2
pop esi
lea ecx, [esp + 0xb0]
mov byte [esp + 0x23c], 7
call fcn.1001bad3
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 6
jg 0x1001e348
or eax, 0xffffffff
lea ecx, [esp + 0x128]
mov dword [esp + 0x23c], eax
call fcn.1001bad3
mov dword [esp + 0x14], 0xfffffffe
lea ecx, [esp + 0x180]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], 0xf5e3d1aa
push 1
call fcn.1001b2a6
mov dword [esp + 0x14], ebx
jmp 0x1001e811
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0x8a6ebbfa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001e7fb
mov dword [esp + 0x14], 0xffffffe8
jmp 0x1001e90a
mov dword [esp + 0x2c], 0x34e6d4f2
mov dword [esp + 0x3c], 0xfffffffc
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e84c
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [esp + 0x2c]
cmp eax, dword [esp + 0x1c]
je 0x1001e900
mov dword [esp + 0x38], 0x703acb6d
mov dword [esp + 0x3c], 0x122d800
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x1c]
imul edx, eax, 0x2d53bc18
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setne dl
or eax, 0xffffffff
cmp eax, edx
mov eax, dword [esp + 0x2c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x180]
setg cl
add ecx, ecx
mov dword [eax], ecx
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
add edx, 0x74f0
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], al
je 0x1001e906
push 0x1292
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x1001e906
cmp dword [esp + 0x1c], ebx
jne 0x1001e915
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe4
jle 0x1001e825
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e929
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
lea ecx, [esp + 0x180]
call fcn.1001bad3
mov eax, dword [esp + 0x68]
cmp dword [eax + 0x14], 0x10
jb 0x1001e943
mov ecx, dword [eax]
jmp 0x1001e945
mov ecx, eax
or edi, 0xffffffff
cmp dword [eax + 0x14], 0x10
mov dword [esp + 0x74], ecx
jb 0x1001e956
mov edx, dword [eax]
jmp 0x1001e958
mov edx, eax
mov eax, dword [eax + 0x10]
add eax, edx
cmp ecx, eax
je 0x1001ed84
mov dword [esp + 0x124], 0xfffffff7
xor ecx, ecx
mov dword [esp + 0x138], 0xfffffff9
inc ecx
mov dword [esp + 0x134], ecx
mov dword [esp + 0x50], edi
mov dword [esp + 0x14], ebx
jmp 0x1001e99f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x70], 0xe2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001e98f
lea eax, [esp + 0x138]
push eax
push ebx
push 0x6729
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x144]
push eax
lea eax, [esp + 0x138]
push eax
call fcn.100218c7
add esp, 0x18
mov dword [esp + 0x50], ebx
jmp 0x1001e9e4
mov eax, dword [esp + 0x50]
cmp dword [esp + eax*4 + 0x70], ebx
jne 0x1001e9ea
inc dword [esp + 0x50]
cmp dword [esp + 0x50], ebx
jle 0x1001e9d6
mov eax, dword [esp + 0x74]
mov al, byte [eax]
cmp al, 0x30
jl 0x1001eb48
cmp al, 0x39
jg 0x1001eb48
mov dword [esp + 0x3c], 7
xor ecx, ecx
mov dword [esp + 0x3c], 0xfffffffa
inc ecx
mov dword [esp + 0x14], 0x8b108f82
mov dword [esp + 0x3c], edi
mov dword [esp + 0x3c], 0xfc3eee2f
mov dword [esp + 0x2c], 0xf7d65121
mov dword [esp + 0x34], 0x99d94b4b
mov dword [esp + 0x34], 0xf1eb32a8
mov dword [esp + 0x34], 0xfffffffc
mov dword [esp + 0x34], 0xfffffffb
mov dword [esp + 0x14], 0x3c407858
mov dword [esp + 0x34], ecx
push 0xfffffffffffffff6
pop eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x108], ecx
mov dword [esp + 0x10c], ecx
mov dword [esp + 0x110], ecx
mov dword [esp + 0x114], ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x14], ebx
jmp 0x1001ea9c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x7c], 0x537c57f3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001ea8c
inc dword [esp + 0x7c]
mov eax, dword [esp + 0x10c]
mov eax, dword [esp + 0x114]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jne 0x1001eae6
mov eax, dword [esp + 0x7c]
xor ecx, ecx
mov edx, ebx
cmp edx, eax
setge cl
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x10c]
add eax, dword [esp + 0x14]
jne 0x1001eae6
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x110]
xor edx, edx
add eax, 0x7fc0336a
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x3c]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x9711
setge al
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x80]
push eax
push 0x5457
push ebx
lea eax, [esp + 0x80]
push eax
push 0x2851
call fcn.1002061c
mov ecx, dword [esp + 0x88]
add esp, 0x14
mov eax, dword [esp + 0x68]
inc ecx
jmp 0x1001e948
mov eax, 0x5bb2c213
mov dword [esp + 0xa0], eax
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0x14], ebx
jmp 0x1001eb7f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x5c], 0x351f2000
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001eb6f
mov dword [esp + 0x5c], ebx
jmp 0x1001ed1b
mov dword [esp + 0x4c], 0x7a73d2d6
mov dword [esp + 0x84], 0x370cc321
mov dword [esp + 0x68], 0x5848308f
mov dword [esp + 0x20], 0x4be18a16
mov dword [esp + 0x4c], ecx
cmp dword [esp + 0x4c], ebx
jl 0x1001ecfc
mov dword [esp + 0x14], 0x95ff
mov eax, dword [esp + 0x5c]
cmp dword [esp + eax*4 + 0xa0], ebx
jne 0x1001ecde
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x84], eax
mov ecx, dword [esp + 0x84]
mov eax, dword [esp + 0x5c]
cmp ecx, eax
mov eax, dword [esp + 0x4c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x5c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x4c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xeabfd090
setg cl
sub ecx, 0xfb29d945
neg ecx
sbb ecx, ecx
add ecx, 0xfde0
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [esp + 0x68], eax
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x5c]
neg ecx
sbb ecx, ecx
neg ecx
mov eax, dword [esp + eax*4 + 0xa0]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xf2dc
mov eax, dword [esp + 0x20]
setle cl
sub ecx, eax
xor eax, eax
cmp ecx, 0x492a4153
mov ecx, 0xe7528acb
setg al
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x4c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x5c]
setle cl
mov dword [esp + 0x3c], ecx
xor ecx, ecx
cmp dword [esp + 0x3c], eax
mov eax, dword [esp + 0x5c]
setg cl
add ecx, 0xfcb6
mov eax, dword [esp + eax*4 + 0xa0]
imul eax, ecx
imul eax, eax, 0x2467
test eax, eax
jne 0x1001ecde
cmp dword [esp + 0xa0], ebx
jne 0x1001ecde
mov eax, ebx
jmp 0x1001ece1
xor eax, eax
inc eax
mov ecx, dword [esp + 0x20]
add ecx, eax
mov eax, dword [esp + 0x5c]
mov dword [esp + eax*4 + 0xa0], ecx
dec dword [esp + 0x4c]
jns 0x1001ebbf
lea eax, [esp + 0x84]
push eax
push ebx
lea eax, [esp + 0x54]
push 0x4c3a
push eax
call fcn.10020734
add esp, 0x10
inc dword [esp + 0x5c]
push 3
pop ecx
cmp dword [esp + 0x5c], ecx
jle 0x1001eb8e
mov eax, dword [esp + 0x80]
mov dword [eax], ebx
mov dword [esp + 0x3c], 0xcce1
mov dword [esp + 0x14], ebx
jmp 0x1001ed52
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xbc], 0xe1757117
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001ed3f
mov dword [esp + 0xc0], ebx
jmp 0x1001ed75
cmp dword [esp + 0xc0], ebx
jne 0x1001d243
dec dword [esp + 0xc0]
cmp dword [esp + 0xc0], 0xfffffffb
jne 0x1001ed61
jmp 0x1001d243
push esi
lea ecx, [esp + 0x19c]
call fcn.1001b2a6
xor edx, edx
mov dword [esp + 0x23c], 0xb
inc edx
mov dword [esp + 0x54], edx
mov dword [esp + 0x14], ebx
jmp 0x1001edbb
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001eda9
mov dword [esp + 0x54], ebx
jmp 0x1001ee30
mov dword [esp + 0x6c], 0x7a888ada
mov dword [esp + 0x6c], edx
cmp dword [esp + 0x6c], ebx
jl 0x1001ee2c
push 0xd66
mov dword [esp + 0x18], 0x5efa20bd
push ebx
call fcn.10020794
pop ecx
pop ecx
mov dword [esp + 0x14], ebx
jmp 0x1001ee1d
push ebx
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x74]
push eax
push 0x68a2
lea eax, [esp + 0x1a8]
push 0x5892
push eax
call fcn.1002032f
add esp, 0x18
inc dword [esp + 0x14]
xor edx, edx
inc edx
cmp dword [esp + 0x14], edx
jle 0x1001edf4
dec dword [esp + 0x6c]
jns 0x1001edd9
inc dword [esp + 0x54]
cmp dword [esp + 0x54], edx
jle 0x1001edc7
lea ecx, [esp + 0x198]
call fcn.1001bad3
mov al, 1
mov ecx, dword [esp + 0x234]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret