Function at 0x10018cb0
Capabilities:
Resolve function by parsing pe exports
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008761e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2d8
push ebx
push esi
push edi
push 0xfffffffffffffff9
pop esi
mov dword [esp + 0x10], esi
xor ebx, ebx
mov dword [esp + 0x18], 0xc9fb37b0
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], 0xba4d3ec9
push 1
mov dword [esp + 0x30], 0x333ee676
mov dword [esp + 0xe8], edx
mov dword [esp + 0xfc], ecx
mov dword [esp + 0x14], ebx
pop edi
jmp 0x10018ddd
mov dword [esp + 0x20], 0x3672d714
xor edx, edx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], 0x93876a47
mov dword [esp + 0x24], 0x56e623b2
mov eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
setg dl
sub edx, dword [esp + 0x18]
neg edx
sbb edx, edx
add edx, 0x1731903f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
neg edx
cmp eax, edx
setle cl
sub ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xf82d
test eax, eax
jne 0x10018da8
mov ecx, ebx
cmp dword [esp + 0x20], ebx
je 0x10018daa
mov ecx, edi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], ecx
jg 0x10018dc8
mov edx, ebx
cmp dword [esp + 0x18], ebx
je 0x10018dca
mov edx, edi
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x24], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jg 0x10018d17
mov dword [esp + 0x10], 6
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 0xea53061e
mov dword [esp + 0x2c], 0x31fadacd
mov dword [esp + 0x2c], 0xfffffffa
mov dword [esp + 0x24], 0x9e885dc1
mov dword [esp + 0x20], ebx
jmp 0x10018e31
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x280], 0x5cb5542a
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10018e1e
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x10018e4c
push ebx
push ebx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], edi
jle 0x10018e62
mov eax, edi
cmp dword [esp + 0x18], ebx
jne 0x10018e64
mov eax, ebx
mov dword [esp + 0x2c], eax
xor edx, edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x284], eax
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
cmp ecx, eax
push edi
setl dl
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], 0xe83c7730
mov dword [esp + 0x38], 0xe52d8cb4
call fcn.10016c3e
mov dword [esp + 0x2ec], ebx
lea ecx, [esp + 0x1ec]
push 2
mov dword [esp + 0x30], 0x31d8b9db
pop esi
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 0x9f6a715c
mov dword [esp + 0x28], 0xbf495e3b
push esi
call fcn.10016c3e
mov dword [esp + 0x28], 0x75d5f8d9
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 8
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], 0xc7153413
mov dword [esp + 0x1c], ebx
jmp 0x10018f13
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2b0], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x10018f04
mov dword [esp + 0x1c], ebx
jmp 0x10018f36
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], 0x6db6d037
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10018f20
mov dword [esp + 0x1c], ebx
jmp 0x10018f58
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1ec]
mov dword [eax + ecx*4], 0x82bd
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10018f42
mov dword [esp + 0x1c], ebx
jmp 0x10018f73
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x13c], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10018f64
mov dword [esp + 0x20], ebx
jmp 0x10018faa
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x10], ebx
jmp 0x10018f9c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x29c], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10018f8d
dec dword [esp + 0x2c]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jle 0x10018f7f
mov eax, dword [esp + 0x24]
sub eax, 0x43de4f81
mov dword [esp + 0x20], eax
jne 0x10018fda
mov dword [esp + 0x2c], 0xffff
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov eax, ebx
cmp dword [esp + 0x140], ebx
je 0x10018fdc
mov eax, edi
mov dword [esp + 0x13c], eax
lea ecx, [esp + 0x1ec]
call fcn.1001742d
or dword [esp + 0x2ec], 0xffffffff
lea ecx, [esp + 0x1bc]
call fcn.1001742d
mov dword [esp + 0x30], 0xfffffff9
lea ecx, [esp + 0x58]
push edi
call fcn.10016c3e
mov dword [esp + 0x1c], 0x7c7ce53d
mov dword [esp + 0x30], 0xe197e7c1
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x28], 0xe60e4510
mov dword [esp + 0x20], ebx
jmp 0x1001904e
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x58]
mov dword [eax + ecx*4], 0xa5d6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x1001903b
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x100192b5
mov dword [esp + 0x10], 0xa1e1c5a3
mov dword [esp + 0x34], 0x9edb9cc5
mov dword [esp + 0x20], ebx
jmp 0x10019088
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x54], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10019078
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x58]
mov eax, dword [ecx + eax*4]
add eax, dword [ecx + edx*4]
xor edx, edx
cmp eax, 0x23a266d2
mov eax, dword [esp + 0x1c]
mov edi, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
setl dl
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x58]
mov dword [esp + 0x24], eax
imul eax, edx, 0xa9b
xor edx, edx
cmp eax, dword [esi + ecx*4]
mov eax, dword [esi + edi*4]
mov ecx, dword [esp + 0x24]
setne dl
sub eax, edx
sub eax, dword [esi + ecx*4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
je 0x1001923e
mov dword [esp + 0x20], 0x37d6c505
xor edi, edi
mov dword [esp + 0x2c], 0x903a798b
inc edi
mov dword [esp + 0x30], ebx
jmp 0x10019232
mov dword [esp + 0x34], 0x546153b
mov dword [esp + 0x20], ebx
jmp 0x1001913b
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x8c], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10019128
mov eax, dword [esp + 0x54]
mov dword [esp + 0x20], 9
mov ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 8
setge al
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x1001922e
mov dword [esp + 0x24], 0xbf68d270
mov dword [esp + 0x10], ebx
jmp 0x1001921a
mov dword [esp + 0x2c], 0x76fef6f1
mov eax, dword [esp + 0x24]
neg eax
push 2
sbb eax, eax
inc eax
mov dword [esp + 0x90], eax
mov esi, dword [esp + 0x14]
imul eax, eax, 0xfffffff8
pop ecx
cmp ecx, eax
mov eax, dword [esp + 0x58]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax + esi*4]
setl dl
cmp edx, dword [esp + 0x20]
jne 0x100191c7
mov esi, edi
cmp dword [esp + 0x8c], ebx
jne 0x100191c9
mov esi, ebx
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x58]
cmp esi, dword [eax + ecx*4]
setne dl
add edx, 3
mov dword [esp + 0x2c], edx
xor edx, edx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x58]
cmp dword [eax + ecx*4], 0xfffffff9
setge dl
xor ecx, ecx
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x18]
sub edx, eax
mov eax, dword [esp + 0x24]
cmp edx, eax
setg cl
mov dword [esp + 0x2c], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10019182
dec dword [esp + 0x20]
jns 0x10019171
inc dword [esp + 0x30]
cmp dword [esp + 0x30], ebx
jle 0x1001911a
jmp 0x100192a8
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x1c]
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x58]
push 0
cmp eax, dword [ecx + edx*4]
mov eax, dword [esp + 0x38]
pop ecx
setne cl
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x30]
setge dl
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, dword [esp + 0x30]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x58]
setle cl
xor edx, edx
cmp dword [eax], ecx
setge dl
xor edi, edi
add edx, dword [eax + esi*4]
inc edi
mov dword [esp + 0x18], edx
dec dword [esp + 0x1c]
jns 0x10019062
push 2
pop esi
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100192c7
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
lea ecx, [esp + 0x58]
call fcn.1001742d
mov dword [esp + 0x2c], 0xc9fb37b0
lea ecx, [esp + 0x18c]
mov dword [esp + 0x10], 0x99841b3c
push esi
call fcn.10016c3e
mov dword [esp + 0x2ec], edi
mov dword [esp + 0x20], ebx
jmp 0x10019310
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18c]
mov dword [eax + ecx*4], 3
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x100192fa
mov dword [esp + 0x10], 7
jmp 0x1001933c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019338
push 0x21fe
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff8
jge 0x10019320
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], ebx
jl 0x100193ab
push 3
lea ecx, [esp + 0x178]
call fcn.10016c3e
mov dword [esp + 0x20], ebx
jmp 0x10019377
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10019361
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [esp + 0x174]
add ecx, 5
mov dword [eax + 4], ecx
lea ecx, [esp + 0x174]
call fcn.1001742d
dec dword [esp + 0x10]
jns 0x1001934d
or dword [esp + 0x2ec], 0xffffffff
lea ecx, [esp + 0x18c]
call fcn.1001742d
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 0xba4d3ec9
mov dword [esp + 0x24], 0x333ee676
mov dword [esp + 0x30], ebx
jmp 0x1001981a
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x1e4]
mov dword [esp + 0x2c], 0xfe7d8a87
call fcn.10016c3e
mov dword [esp + 0x28], 0xfc0272a
mov dword [esp + 0x28], edi
mov dword [esp + 0x10], ebx
jmp 0x10019420
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], 0x5ba7723
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001940a
mov dword [esp + 0x10], ebx
jmp 0x1001943f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x144], 0xffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001942c
dec dword [esp + 0x144]
lea ecx, [esp + 0x1e0]
call fcn.1001742d
mov dword [esp + 0x18], 0x3672d714
lea ecx, [esp + 0x9c]
push 3
call fcn.10016c3e
mov dword [esp + 0x2ec], esi
lea ecx, [esp + 0xb4]
mov dword [esp + 0x1c], 0x1cecb457
mov dword [esp + 0x10], 0xffffffff
push esi
call fcn.10016c3e
mov byte [esp + 0x2ec], 3
mov dword [esp + 0x10], ebx
jmp 0x100194b6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], 0xfffc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x100194a0
mov dword [esp + 0x10], ebx
jmp 0x100194d5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x100194c3
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x1c], ebx
jl 0x1001973c
mov dword [esp + 0x20], 0xc829ed89
lea ecx, [esp + 0x168]
push 3
call fcn.10016c3e
mov dword [esp + 0x10], ebx
jmp 0x1001951b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019505
cmp dword [esp + 0x1c], ebx
jne 0x10019538
mov eax, dword [esp + 0x1c]
mov edx, ebx
cmp dword [esp + 0x1c], 0x47d1afd0
je 0x1001953a
mov edx, edi
mov edi, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov esi, dword [esp + 0x9c]
mov eax, dword [esp + 0x9c]
mov eax, dword [eax + ecx*4]
mov dword [esi + edi*4], eax
mov eax, dword [esp + 0x20]
add eax, edx
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
add ecx, dword [esp + 0x1c]
cmp ecx, 0xfff7
setne al
xor edx, edx
cmp dword [esi + edi*4], eax
mov eax, dword [esp + 0xb4]
setle dl
xor ecx, ecx
mov esi, dword [eax]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, esi
setne al
xor ecx, ecx
cmp eax, esi
setg cl
add ecx, esi
cmp ecx, 0xfffffffa
sbb eax, eax
neg eax
cmp eax, dword [esp + 0x20]
jle 0x10019686
mov dword [esp + 0x2c], 0x7a9b65ca
mov dword [esp + 0x10], ebx
jmp 0x100195dd
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100195d9
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe2
jl 0x100195c7
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xb4]
mov ecx, dword [eax]
mov eax, dword [esp + 0x9c]
cmp ecx, dword [eax + edx*4]
jl 0x1001960a
cmp dword [esp + 0x10], ebx
je 0x1001960a
xor edi, edi
inc edi
mov ecx, edi
jmp 0x1001960f
xor edi, edi
mov ecx, ebx
inc edi
mov esi, dword [esp + 0x1c]
xor eax, eax
test ecx, ecx
sete al
xor ecx, ecx
cmp eax, 0xde45
mov eax, dword [esp + 0x9c]
setne cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
mov eax, dword [esp + 0x2c]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
jne 0x10019650
mov edx, ebx
cmp dword [esp + 0x2c], ebx
je 0x10019652
mov edx, edi
mov eax, dword [esp + 0x2c]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
setge cl
sub ecx, 0x63e8
neg ecx
sbb ecx, ecx
inc ecx
cmp edi, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [esp + 0xb4]
setl dl
mov dword [eax], edx
jmp 0x10019716
mov dword [esp + 0x24], 0xbc71f8b1
mov dword [esp + 0x10], ebx
jmp 0x100196a7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x244], 0x5746ac1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019694
xor edi, edi
mov dword [esp + 0x10], ebx
inc edi
jmp 0x100196c3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x74], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100196b7
dec dword [esp + 0x74]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24c]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x9c]
mov edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
neg edx
cmp edx, eax
sete cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, 0x46ed
mov eax, dword [esp + 0xb4]
setle cl
mov dword [eax], ecx
lea ecx, [esp + 0x168]
cmp dword [esp + 0x20], ebx
jne 0x10019734
call fcn.1001742d
dec dword [esp + 0x1c]
jns 0x100194e9
jmp 0x10019739
call fcn.1001742d
push 2
pop esi
lea ecx, [esp + 0xb4]
call fcn.1001742d
or dword [esp + 0x2ec], 0xffffffff
lea ecx, [esp + 0x9c]
call fcn.1001742d
mov dword [esp + 0x24], ebx
xor edx, edx
mov dword [esp + 0x2c], 0x93876a47
mov dword [esp + 0x24], 0x56e623b2
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
cmp eax, ecx
setg dl
sub edx, dword [esp + 0x2c]
neg edx
sbb edx, edx
add edx, 0x1731903f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
neg edx
cmp eax, edx
setle cl
sub ecx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xf82d
test eax, eax
jne 0x100197e5
mov ecx, ebx
cmp dword [esp + 0x18], ebx
je 0x100197e7
mov ecx, edi
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ecx
jg 0x10019805
mov edx, ebx
cmp dword [esp + 0x2c], ebx
je 0x10019807
mov edx, edi
mov eax, dword [esp + 0x30]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x24], ecx
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 4
push edi
jg 0x100193e0
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x160]
call fcn.10016c3e
mov dword [esp + 0x24], 0x8d3a18e4
mov dword [esp + 0x24], 0x33582f80
mov dword [esp + 0x10], ebx
jmp 0x10019862
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], 3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001984c
mov dword [esp + 0x10], ebx
jmp 0x1001987d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x25c], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001986e
mov edi, dword [esp + 0x18]
mov ecx, 0xeb9ae77a
mov eax, dword [esp + 0x15c]
mov esi, dword [esp + 0x18]
mov dword [eax], edi
mov dword [esp + 0x264], esi
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
lea ecx, [esp + 0x15c]
setne dl
xor eax, eax
cmp edx, edi
setne al
sub eax, esi
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
call fcn.1001742d
mov dword [esp + 0x30], 0x40d7f825
push 7
mov dword [esp + 0x3c], 0x2314af12
pop edi
mov dword [esp + 0x3c], edi
push 4
pop esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x2c], 0x86992f1e
mov dword [esp + 0x24], 0xfff9
mov dword [esp + 0x1c], 6
mov dword [esp + 0x28], 0xaacc
mov dword [esp + 0x30], 0xfffffffd
jmp 0x10019a4e
mov dword [esp + 0x10], 0xd05ba772
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x34], 9
mov dword [esp + 0x10], ebx
jmp 0x100199e4
mov dword [esp + 0x34], 0xc2184e5a
mov dword [esp + 0x18], ebx
jmp 0x10019964
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xc4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10019955
cmp dword [esp + 0x10], ebx
jne 0x100199ce
cmp dword [esp + 0x30], ebx
je 0x100199c0
dec dword [esp + 0x2c]
je 0x100199b5
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc4]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x34], ebx
jne 0x100199ce
mov edx, ebx
jmp 0x100199d1
xor edx, edx
inc edx
mov eax, dword [esp + 0x38]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x34], ecx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe6
jg 0x10019947
cmp dword [esp + 0x30], ebx
jne 0x100199ff
cmp dword [esp + 0x1c], ebx
jne 0x100199ff
mov edx, ebx
jmp 0x10019a02
xor edx, edx
inc edx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, 0x8bb6
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
setg cl
xor edx, edx
cmp eax, ecx
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
cmp edx, eax
mov eax, dword [esp + 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x20], ecx
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0x14
jl 0x10019926
push 3
mov dword [esp + 0x34], edi
lea ecx, [esp + 0x100]
pop edi
push edi
call fcn.10016c3e
mov dword [esp + 0x2ec], esi
xor esi, esi
mov dword [esp + 0x24], 0x23ed15d
inc esi
mov dword [esp + 0x28], 0xf90a
mov dword [esp + 0x38], 0x5ea2
mov dword [esp + 0x34], ebx
push 2
mov dword [esp + 0x40], ebx
pop eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x18], ebx
jmp 0x10019ab4
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x40], 0xb8fa48a2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10019aa4
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x24]
je 0x10019ac8
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], 0xdb75
xor edx, edx
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp ecx, eax
setl dl
mov dword [esp + 0x3c], edx
mov dword [esp + 0x18], ebx
jmp 0x10019afb
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10019ae9
mov dword [esp + 0x2c], 0xa7bc6c89
lea ecx, [esp + 0xc8]
push esi
call fcn.10016c3e
mov dword [esp + 0x10], ebx
jmp 0x10019b2c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], 0xe1757117
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10019b1c
mov dword [esp + 0x10], ebx
jmp 0x10019b4e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 0xf1eb7e59
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019b38
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x4c], 0x1b
jmp 0x10019d44
mov dword [esp + 0x18], 5
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
jmp 0x10019b8d
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x78], 0x82b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10019b7d
mov eax, dword [esp + 0x4c]
xor ecx, ecx
cmp eax, 0x4bb4
setg cl
imul eax, ecx, 3
test eax, eax
je 0x10019bb0
mov eax, esi
cmp dword [esp + 0x48], ebx
jne 0x10019bb2
mov eax, ebx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x48], esi
mov eax, dword [esp + 0x4c]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, 0xba5616d2
sbb eax, eax
xor edx, edx
neg eax
lea ecx, [eax - 0x7f3c88fe]
mov eax, dword [esp + 0x78]
cmp ecx, eax
mov eax, dword [esp + 0x4c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc8]
setle cl
mov dword [eax], ecx
mov eax, dword [esp + 0x78]
add eax, ecx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x48]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
cmp eax, 0xd476
jne 0x10019c24
mov eax, ebx
cmp dword [esp + 0x4c], ebx
je 0x10019c26
mov eax, esi
imul ecx, eax, 0x43c6
xor edx, edx
mov eax, dword [esp + 0x4c]
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, 0x4c01e07a
setg al
cmp eax, 0xccce
jge 0x10019d18
or eax, 0xffffffff
xor edx, edx
mov dword [esp + 0x12c], eax
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x20], 0x23a55a41
mov ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0x28]
cmp ecx, eax
mov eax, dword [esp + 0xc8]
setl dl
mov dword [esp + 0x24], edx
xor edx, edx
mov ecx, dword [esp + 0x12c]
mov esi, dword [eax]
mov eax, dword [esp + 0x24]
cmp eax, ecx
setne dl
xor eax, eax
sub edx, esi
cmp edx, 0x4c99
setg al
xor ecx, ecx
cmp esi, eax
mov eax, dword [esp + 0x18]
setne cl
xor esi, esi
inc esi
mov edx, esi
sub edx, ecx
mov ecx, dword [esp + 0x2c]
sub edx, eax
mov eax, dword [esp + 0xc8]
add ecx, edx
imul edx, ecx, 0x2cc
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setg cl
mov dword [esp + 0x20], ecx
mov dword [esp + 0x20], 0xfffffff7
jmp 0x10019d0f
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019d0b
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x13
je 0x10019cfa
jmp 0x10019d40
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019d2b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019d40
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
dec dword [esp + 0x4c]
cmp dword [esp + 0x4c], 0x11
jg 0x10019b67
lea ecx, [esp + 0xc8]
call fcn.1001742d
mov dword [esp + 0x30], ebx
cmp dword [esp + 0x30], 7
je 0x1001a0fe
mov esi, dword [esp + 0xfc]
push 0xfffffffffffffff6
pop eax
mov dword [esp + 0x7c], eax
xor ecx, ecx
mov dword [esp + 0x80], eax
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 0x849b76ee
mov eax, dword [esp + 0x88]
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x84]
add edx, dword [esp + 0x7c]
mov eax, dword [esp + 0x84]
neg edx
cmp eax, edx
mov eax, dword [esp + 0x24]
setle cl
xor edx, edx
sub eax, ecx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x80]
cmp ecx, eax
setle dl
imul eax, dword [esp + 0x84], 0x5416
mov ecx, dword [esp + 0x80]
add eax, 0x3051
add eax, edx
imul ecx, eax
mov dword [esp + 0x84], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019e10
push ebx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 2
pop ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x20], 0x56a218f0
mov dword [esp + 0x28], 0xac789480
mov dword [esp + 0x28], 0xa12b57e8
mov dword [esp + 0x28], 0xfffffffa
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
jmp 0x10019e5c
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x2bc], 0x19ac196a
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10019e49
dec dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x10]
je 0x10019e7d
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp dword [esi + 4], ebx
je 0x1001a0c5
mov dword [esp + 0x1c], 0xac204e2
mov dword [esp + 0x18], 0xfffffffc
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], 0xa6c65b0b
mov dword [esp + 0x38], 0xe7bf
mov dword [esp + 0x1c], ebx
jmp 0x10019ee3
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019edf
push 0x1d0
push 0x1fa7
push 0x2516
push 0xee2
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Rectangle]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 9
jge 0x10019eb0
cmp dword [esp + 0x1c], ebx
jne 0x10019f66
mov eax, dword [esp + 0x18]
xor edx, edx
add eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x18]
cmp eax, 0x361a6b71
setl dl
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [esp + 0x1c]
setg cl
xor edx, edx
cmp ecx, 0xae7
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x1c]
setle cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp dword [esp + 0x28], eax
setg cl
add ecx, 0x4e5062a
jne 0x10019f57
cmp dword [esp + 0x2c], ebx
jne 0x10019f57
mov ecx, ebx
jmp 0x10019f5a
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x1c]
add eax, ecx
jne 0x10019f66
mov ecx, ebx
jmp 0x10019f69
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x1c]
xor edx, edx
cmp ecx, eax
setg dl
sub edx, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x2c]
jne 0x10019f9d
cmp dword [esp + 0x1c], ebx
je 0x10019f9d
xor ecx, ecx
inc ecx
jmp 0x10019f9f
mov ecx, ebx
mov eax, dword [esp + 0x38]
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x28], 0x4cd021aa
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019fc8
push ebx
push 0x2f
call edi
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov dword [esp + 0x10], ebx
jmp 0x1001a0b8
push dword [esp + 0x40]
movdqa xmm0, xmmword [0x100083b0]
lea eax, [esp + 0x238]
push eax
lea eax, [esp + 0x22c]
mov dword [esp + 0x98], ebx
push eax
push ebx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa4], ebx
movdqu xmmword [esp + 0x234], xmm0
mov dword [esp + 0xa8], ebx
call fcn.1001815d
mov eax, dword [esp + 0x90]
mov dword [eax], ebx
mov dword [esp + 0x18], ebx
jmp 0x1001a03a
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x268], 0xffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001a027
xor eax, eax
inc eax
sub eax, dword [esi + 4]
je 0x1001a05f
mov eax, dword [esp + 0x268]
mov eax, dword [esp + 0x28]
add eax, dword [esp + 0x10]
je 0x1001a05f
xor edx, edx
inc edx
jmp 0x1001a061
mov edx, ebx
mov eax, dword [esp + 0x90]
xor ecx, ecx
cmp edx, dword [eax]
sete cl
sub ecx, 0x30fc
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x20], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a096
push 0x60c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [esp + 0x90]
inc dword [eax]
cmp dword [eax], 0xf
jne 0x1001a021
lea ecx, [esp + 0x90]
call fcn.1001742d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 8
jne 0x10019fd1
jmp 0x1001a0ef
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ecx
jg 0x1001a0ef
push 2
pop ebx
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0xfc]
mov ecx, dword [esi + 4]
mov dword [eax + edx*4], ecx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1001a0d2
xor ebx, ebx
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 7
jne 0x10019d71
or dword [esp + 0x2ec], 0xffffffff
lea ecx, [esp + 0xfc]
call fcn.1001742d
xor esi, esi
mov dword [esp + 0x20], 0xe83c7730
inc esi
mov dword [esp + 0x38], 0xe52d8cb4
push esi
lea ecx, [esp + 0x1fc]
call fcn.10016c3e
mov dword [esp + 0x2ec], 5
lea ecx, [esp + 0x1a4]
push 2
mov dword [esp + 0x28], 0x31d8b9db
pop eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x28], 0x9f6a715c
mov dword [esp + 0x28], 0xbf495e3b
push eax
call fcn.10016c3e
mov dword [esp + 0x28], 0x75d5f8d9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x3c], 8
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x24], 0xc7153413
mov dword [esp + 0x1c], ebx
jmp 0x1001a1a2
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2d4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001a193
mov dword [esp + 0x1c], ebx
jmp 0x1001a1c5
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1f8]
mov dword [eax + ecx*4], 0x6db6d037
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001a1af
push 2
mov dword [esp + 0x20], ebx
pop edx
jmp 0x1001a1ea
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 0x82bd
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001a1d4
mov dword [esp + 0x1c], ebx
jmp 0x1001a205
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x154], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001a1f6
mov dword [esp + 0x20], ebx
jmp 0x1001a23c
mov dword [esp + 0x3c], 0xfffffff6
mov dword [esp + 0x18], ebx
jmp 0x1001a22e
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x294], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001a21f
dec dword [esp + 0x24]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jle 0x1001a211
mov eax, dword [esp + 0x28]
sub eax, 0x43de4f81
mov dword [esp + 0x20], eax
jne 0x1001a26c
mov dword [esp + 0x24], 0xffff
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
mov eax, ebx
cmp dword [esp + 0x158], ebx
je 0x1001a26e
mov eax, esi
mov dword [esp + 0x154], eax
lea ecx, [esp + 0x1a4]
call fcn.1001742d
or dword [esp + 0x2ec], 0xffffffff
lea ecx, [esp + 0x1f8]
call fcn.1001742d
mov dword [esp + 0x34], 6
mov dword [esp + 0x2c], 0xfffffff9
mov dword [esp + 0x28], esi
mov dword [esp + 0x28], 0xea53061e
mov dword [esp + 0x24], 0x31fadacd
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x28], 0x9e885dc1
mov dword [esp + 0x18], ebx
jmp 0x1001a2e2
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x250], 0x5cb5542a
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001a2cf
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a2fe
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], esi
jle 0x1001a314
mov eax, esi
cmp dword [esp + 0x2c], ebx
jne 0x1001a316
mov eax, ebx
movdqa xmm0, xmmword [0x10008380]
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x254], eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
cmp ecx, eax
push dword [esp + 0x40]
setl dl
mov dword [esp + 0x124], ebx
mov dword [esp + 0x2c], edx
lea eax, [esp + 0x228]
mov dword [esp + 0x2c], esi
lea ecx, [esp + 0x124]
push eax
mov dword [esp + 0x30], 0xf46db505
lea eax, [esp + 0x21c]
mov dword [esp + 0x30], ebx
push eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x34], 0xee7d214c
mov dword [esp + 0x34], ebx
push ebx
movdqu xmmword [esp + 0x224], xmm0
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
call fcn.1001815d
mov dword [esp + 0x28], 0xcba86ba4
lea ecx, [esp + 0x120]
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0xfffffffb
dec dword [esp + 0x24]
mov dword [esp + 0x28], 0xedb39523
call fcn.1001742d
mov dword [esp + 0xf0], 0xfffffff9
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x20], 0xe83c7730
mov dword [esp + 0x38], 0xe52d8cb4
push esi
call fcn.10016c3e
mov dword [esp + 0x2ec], 6
lea ecx, [esp + 0x1d4]
push 2
mov dword [esp + 0x28], 0x31d8b9db
pop eax
mov dword [esp + 0x28], esi
mov dword [esp + 0x28], 0x9f6a715c
mov dword [esp + 0x28], 0xbf495e3b
push eax
call fcn.10016c3e
mov dword [esp + 0x28], 0x75d5f8d9
mov dword [esp + 0x28], ebx
mov dword [esp + 0x3c], 8
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x24], 0xc7153413
mov dword [esp + 0x1c], ebx
jmp 0x1001a46b
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2c8], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001a45c
mov dword [esp + 0x1c], ebx
jmp 0x1001a48e