Function at 0x10015377
Capabilities:
Get common file path
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006a107
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x268
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x48], ecx
push 2
lea ecx, [esp + 0xbc]
mov dword [esp + 0x3c], edi
call fcn.100177e1
xor ebx, ebx
mov dword [esp + 0x14], 0x13532fe2
push 1
mov dword [esp + 0x14], ebx
pop edx
jmp 0x100153d8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100153c6
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x10015417
mov dword [esp + 0x1c], 0x252604
mov dword [esp + 0x1c], ebx
jmp 0x1001540b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xb8]
cmp dword [eax + ecx*4], ebx
jne 0x10015411
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x100153f7
dec dword [esp + 0x14]
jns 0x100153e9
cmp dword [esp + 0xb8], ebx
je 0x10015442
push dword [esp + 0xb8]
call fcn.10050fba
pop ecx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0x20], 0xfffffffe
mov dword [esp + 0x2c], 0x2395
cmp dword [esp + 0x2c], 0xeaa
jge 0x100155cc
lea eax, [esp + 0x34]
push eax
push 0x10007b84
call fcn.1005076b
pop ecx
pop ecx
push dword [esp + 0x34]
lea ecx, [esp + 0x90]
call fcn.100177e1
mov dword [esp + 0x27c], ebx
mov edi, ebx
mov ecx, dword [esp + 0x34]
test ecx, ecx
jle 0x100154b2
mov esi, dword [esp + 0x8c]
push esi
push 0x10007b84
call fcn.1005076b
pop ecx
pop ecx
mov ecx, dword [esp + 0x34]
inc edi
add esi, 4
cmp edi, ecx
jl 0x10015499
lea eax, [ecx + 1]
mov dword [esp + 0x60], ebx
mov dword [esp + 0x1a0], eax
lea eax, [esp + 0x1a0]
push eax
push ecx
lea ecx, [esp + 0x68]
mov dword [esp + 0x6c], ebx
mov dword [esp + 0x70], ebx
call fcn.1001815a
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x60]
lea ecx, [eax + 1]
test eax, eax
jle 0x10015519
mov edi, dword [esp + 0x8c]
mov edx, esi
sub edi, esi
mov esi, ebx
cmp dword [edi + edx], ebx
jne 0x100154ff
mov ecx, ebx
jmp 0x10015500
inc ecx
cmp dword [edx], ecx
mov eax, ecx
cmovl eax, dword [edx]
inc esi
mov dword [edx], eax
add edx, 4
mov eax, dword [esp + 0x34]
cmp esi, eax
jl 0x100154f6
mov esi, dword [esp + 0x60]
lea edx, [eax - 1]
lea ecx, [eax + 1]
test edx, edx
js 0x10015556
mov eax, dword [esp + 0x8c]
lea edi, [esi + edx*4]
sub eax, esi
mov dword [esp + 0x2c], eax
mov esi, eax
cmp dword [edi + esi], ebx
jne 0x1001553e
mov ecx, ebx
jmp 0x1001553f
inc ecx
cmp dword [edi], ecx
mov eax, ecx
cmovl eax, dword [edi]
mov dword [edi], eax
sub edi, 4
dec edx
jns 0x10015535
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x60]
mov edi, ebx
test eax, eax
jle 0x10015572
push dword [esi + edi*4]
push 0x10007c0c
call fcn.10050db3
inc edi
pop ecx
pop ecx
cmp edi, dword [esp + 0x34]
jl 0x1001555c
push 0x10007aed
call fcn.10051176
pop ecx
test esi, esi
je 0x10015594
push esi
call fcn.10050fba
pop ecx
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
or dword [esp + 0x27c], 0xffffffff
cmp dword [esp + 0x8c], 0
je 0x100155c8
push dword [esp + 0x8c]
call fcn.10050fba
pop ecx
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov edi, dword [esp + 0x38]
push 3
lea ecx, [esp + 0x9c]
call fcn.100177e1
mov dword [esp + 0x14], 0x79655965
mov dword [esp + 0xc], 0xfffffffc
mov dword [esp + 0x2c], 4
mov dword [esp + 0x10], ebx
jmp 0x1001560e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0xbf889e02
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x100155f8
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x20]
test eax, eax
setns cl
xor edx, edx
sub ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
imul ecx, ecx, 0xbf9f
add ecx, 2
cmp eax, ecx
setg dl
xor ecx, ecx
imul edx, dword [esp + 0x20]
sub edx, dword [esp + 0x20]
add edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp edx, eax
mov esi, dword [esp + 0x98]
setle cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov edx, dword [esi + 8]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [esp + 0x98]
setle cl
imul ecx, dword [eax]
cmp ecx, edx
jl 0x1001574e
mov dword [esp + 0x1c], 0xadc1094d
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x1c], 0xb1b0cadf
mov eax, dword [esp + 0xc]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
cmp dword [esp + 0x20], ecx
jge 0x100156bd
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
dec dword [esp + 0x24]
jmp 0x100157dc
push 2
mov dword [esp + 0x34], 0xad38
mov dword [esp + 0x10], ebx
pop esi
jmp 0x10015743
mov dword [esp + 0x24], 0x7c1b
mov dword [esp + 0x2c], 0xb5bcdcec
mov dword [esp + 0x1c], ebx
jmp 0x10015739
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
neg edx
mov eax, dword [esp + 0x98]
sbb edx, edx
inc edx
mov dword [eax + ecx*4], edx
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x24], ebx
jne 0x1001573f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x100156e4
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x100156ce
jmp 0x100157dc
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x20], ebx
jmp 0x1001576b
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1b0], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1001575c
xor ecx, ecx
mov dword [esp + 0x20], ebx
inc ecx
jmp 0x1001578e
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x178], 0xfffffff9
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x1001577b
mov edx, dword [esp + 0x1b0]
mov ecx, dword [esp + 0x1b0]
neg edx
mov eax, dword [esp + 0x24]
sbb edx, edx
sub ecx, eax
mov eax, dword [esp + 0x2c]
neg edx
add eax, edx
mov dword [esi + 8], ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0x20]
mov dword [esp + 0x178], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100157f9
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
push dword [esp + 0x98]
call fcn.10050fba
mov eax, dword [0x10fbc4a0]
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
pop ecx
test al, 1
jne 0x100158c0
xor ecx, ecx
inc ecx
or eax, ecx
mov dword [0x10fbc4a0], eax
push ebx
mov dword [esp + 0x280], ecx
push ebx
mov dword [0x10fbc4b0], ebx
mov dword [0x10fbc4b4], ebx
call fcn.1001bbab
mov dword [0x10fbc4b0], eax
mov dword [0x10fbc4b8], ebx
mov dword [0x10fbc4c0], ebx
mov byte [esp + 0x27c], 3
mov ecx, 0x10fbc4b8
mov dword [esp + 0x148], eax
lea eax, [esp + 0x148]
push eax
push 0x10
push ebx
lea eax, [esp + 0x224]
mov dword [0x10fbc4cc], 0x3f800000
push eax
mov dword [0x10fbc4bc], ebx
call fcn.1001b958
push 0x1006b1e3
mov dword [0x10fbc4c4], 7
mov dword [0x10fbc4c8], 8
call fcn.10050d89
or dword [esp + 0x280], 0xffffffff
pop ecx
imul eax, dword [esp + 0x48], 0x2710
add eax, edi
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x7c]
push eax
call fcn.10017b03
push 2
pop edi
push edi
mov esi, dword [eax]
lea ecx, [esp + 0xe0]
call fcn.100177e1
mov dword [esp + 0x1c], 0xdf1febae
mov dword [esp + 0x10], ebx
jmp 0x1001590e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100158f8
xor edx, edx
inc edx
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], ebx
jl 0x10015960
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], ebx
jmp 0x10015954
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xdc]
cmp dword [eax + ecx*4], ebx
jne 0x1001595a
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10015950
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
xor edx, edx
inc edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x1001592b
dec dword [esp + 0x1c]
jns 0x10015921
cmp dword [esp + 0xdc], 0
je 0x1001598f
push dword [esp + 0xdc]
call fcn.10050fba
xor edx, edx
mov dword [esp + 0xe0], ebx
pop ecx
mov dword [esp + 0xe0], ebx
inc edx
mov dword [esp + 0xe4], ebx
test esi, esi
je 0x10015bfe
mov dword [esp + 0x10], 0x1f2c29a
mov dword [esp + 0x10], ebx
jmp 0x100159b4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1a4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x100159a5
mov dword [esp + 0x10], ebx
jmp 0x10015aed
mov dword [esp + 0x20], 0x54fddd3f
mov dword [esp + 0x20], ebx
jmp 0x10015ac5
mov dword [esp + 0x1c], edx
lea ecx, [esp + 0xe8]
push 3
call fcn.100177e1
push 3
mov dword [esp + 0x20], ebx
pop edx
jmp 0x10015a06
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0x38330377
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x100159f0
mov dword [esp + 0x1c], ebx
jmp 0x10015a8c
mov dword [esp + 0xc], 0x8a012e1d
mov dword [esp + 0x28], edx
mov dword [esp + 0xc], ebx
jmp 0x10015a40
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x1a4], ebx
jne 0x10015a46
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x1a4]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x10015a24
mov dword [esp + 0xc], edi
cmp dword [esp + 0xc], ebx
jl 0x10015a88
mov dword [esp + 0x28], 0xfffffff9
mov dword [esp + 0x28], 4
mov dword [esp + 0x38], 0xffffffff
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + eax*4 + 0x1a4]
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1a4], ecx
dec dword [esp + 0x38]
dec dword [esp + 0xc]
jns 0x10015a50
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x10015a12
cmp dword [esp + 0xe8], 0
je 0x10015abe
push dword [esp + 0xe8]
call fcn.10050fba
pop ecx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
inc dword [esp + 0x20]
push 1
pop edx
cmp dword [esp + 0x20], edi
jle 0x100159d5
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10015ae6
push 0xe26
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
inc dword [esp + 0x10]
push 1
pop edx
cmp dword [esp + 0x10], edi
jle 0x100159c4
mov eax, 0x7412df3d
mov dword [esp + 0x14], 0xffff
mov dword [esp + 0x10c], eax
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x118], eax
xor eax, eax
inc eax
mov dword [esp + 0x18c], esi
push eax
call fcn.100177e1
mov dword [esp + 0x2c], 0xfffffffb
mov dword [esp + 0xc], ebx
jmp 0x10015b58
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1f0], 0xed9ba07e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10015b45
xor edx, edx
mov dword [esp + 0xc], ebx
inc edx
jmp 0x10015b7a
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1d4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10015b68
dec dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x10c]
mov eax, dword [esp + 0x1f4]
mov eax, dword [esp + 0x1f8]
dec dword [esp + 0x10c]
mov eax, dword [esp + 0x10c]
mov eax, dword [esp + 0x1f0]
cmp eax, 0x12f3
mov dword [esp + 0x1f8], eax
setge cl
xor ebx, ebx
imul ecx, dword [esp + 0x10c]
mov eax, dword [esp + 0x1d4]
cmp ecx, edx
mov edx, dword [esp + 0x14]
setl bl
xor ecx, ecx
mov dword [eax], ebx
sub edx, ebx
mov eax, dword [esp + 0x14]
cmp edx, eax
push dword [esp + 0x1d4]
setge cl
mov dword [esp + 0x30], ecx
call fcn.10050fba
pop ecx
jmp 0x100170ab
mov eax, dword [0x10fbc4a0]
test al, 2
jne 0x10015ca1
or eax, edi
mov dword [0x10fbc4a0], eax
push ebx
mov dword [esp + 0x280], 4
push ebx
mov dword [0x10fbc470], ebx
mov dword [0x10fbc474], ebx
call fcn.1001bbab
mov dword [0x10fbc470], eax
mov dword [0x10fbc478], ebx
mov dword [0x10fbc480], ebx
mov byte [esp + 0x27c], 6
mov ecx, 0x10fbc478
mov dword [esp + 0x198], eax
lea eax, [esp + 0x198]
push eax
push 0x10
push ebx
lea eax, [esp + 0x78]
mov dword [0x10fbc48c], 0x3f800000
push eax
mov dword [0x10fbc47c], ebx
call fcn.1001b958
push 0x1006b1de
mov dword [0x10fbc484], 7
mov dword [0x10fbc488], 8
call fcn.10050d89
or dword [esp + 0x280], 0xffffffff
pop ecx
mov dword [esp + 0x1c], 0x1c2a2c7c
xor edx, edx
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0x955a
mov dword [esp + 0x2c], 0xfa014801
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setne dl
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
cmp dword [esp + 0xc], 0xfffffffb
sbb eax, eax
neg eax
jne 0x10015d00
cmp dword [esp + 0x10], ebx
je 0x10015d00
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10015d02
mov ecx, ebx
xor eax, eax
test ecx, ecx
setns al
sub eax, 6
add eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
add eax, 0x26dbd90e
neg eax
sbb eax, eax
inc eax
cmp eax, 0xfffffff7
jb 0x10015d30
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
cmp eax, ecx
setne dl
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], ebx
jmp 0x10015d65
mov dword [esp + 0x10], 0x7ba96689
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x2c
jne 0x10015d51
xorps xmm0, xmm0
lea ecx, [esp + 0x100]
movdqu xmmword [esp + 0x11c], xmm0
mov dword [esp + 0x30], 0x20f89b54
mov dword [esp + 0x1c], ebx
push 3
call fcn.100177e1
mov dword [esp + 0x27c], 7
lea eax, [esp + 0x23c]
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0x10008220]
lea ecx, [esp + 0xb0]
push eax
lea eax, [esp + 0x234]
mov dword [esp + 0x34], 0x364d64ea
push eax
mov dword [esp + 0x34], 0x2da3c3d2
push ebx
movdqu xmmword [esp + 0x23c], xmm0
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
call fcn.1001cdd2
mov dword [esp + 0x28], 0x56fe
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], 0xde47
mov dword [esp + 0xc], ebx
jmp 0x10015e24
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0x369bd69
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10015e0e
mov dword [esp + 0xc], ebx
jmp 0x10015e44
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x23c], 0x858905b8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10015e31
mov eax, dword [esp + 0x30]
xor edx, edx
mov esi, dword [esp + 0xac]
xor ecx, ecx
mov dword [esp + 0x1c], eax
inc edx
mov eax, dword [esp + 0x1c]
cmp eax, edx
setl cl
mov dword [esi + 4], ecx
cmp dword [esp + 0x1c], edx
jge 0x10015eb8
inc dword [esp + 0x14]
xor edx, edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esi + 4]
setne dl
mov dword [esp + 0x23c], edx
add eax, edx
mov ecx, dword [esp + 0x30]
imul ecx, eax
mov eax, dword [esp + 0x1c]
sub eax, ecx
cmp eax, dword [esp + 0x2c]
jle 0x10015ead
cmp dword [esp + 0x30], ebx
jne 0x10015ead
mov eax, ebx
jmp 0x10015eb0
xor eax, eax
inc eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
je 0x10015ec7
cmp dword [esp + 0x23c], ebx
jne 0x10015ecd
cmp dword [esp + 0x24], ebx
je 0x10015edb
mov dword [esp + 0x24], 0xffffffff
dec dword [esp + 0x24]
jmp 0x10015ef3
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10015ef3
push 0xa50
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
push dword [esp + 0xac]
call fcn.10050fba
or dword [esp + 0x280], 0xffffffff
cmp dword [esp + 0x104], 0
pop ecx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
je 0x10015f49
push dword [esp + 0x100]
call fcn.10050fba
pop ecx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
lea eax, [esp + 0x48]
push eax
call fcn.10017b65
cmp byte [ebp + 0xc], 0
push 0xa
pop edi
mov esi, dword [eax]
mov dword [esp + 0x30], esi
jne 0x10015f6a
test esi, esi
jne 0x10016a43
mov dword [esp + 0xc], 0x43eb
mov dword [esp + 0x20], 0x46a1
mov dword [esp + 0x24], 0xc28cae2f
mov dword [esp + 0x24], 6
mov dword [esp + 0x12c], 0xffffffff
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x20]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0xc]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor esi, esi
inc esi
cmp ecx, esi
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x2aa9
mov eax, 0x83111739
setge cl
xor edx, edx
sub eax, ecx
cmp eax, esi
mov eax, dword [esp + 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [esp + 0xc]
je 0x10016009
mov dword [esp + 0x24], 0xffff
dec dword [esp + 0x24]
jmp 0x1001618d
mov dword [esp + 0x14], 0xfffffffd
mov dword [esp + 0x1c], 0x9622cfb6
mov dword [esp + 0x28], 0xfecf
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10016034
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
mov dword [esp + 0x20], 0xffffffe3
jmp 0x10016182
push esi
lea ecx, [esp + 0x84]
call fcn.100177e1
mov dword [esp + 0x10], 0x62a4b15
xor edx, edx
mov dword [esp + 0x24], 0x9b2c3978
inc edx
mov dword [esp + 0x2c], 0xa4d24406
mov dword [esp + 0x10], ebx
jmp 0x10016085
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x80]
mov dword [eax + ecx*4], 0xae8b0121
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001606f
mov eax, dword [esp + 0x80]
xor ecx, ecx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], 0x2fc53d8b
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x14]
cmp eax, 0x52e2
setge cl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
inc ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x80]
setl dl
mov dword [esp + 0x2c], edx
xor edx, edx
cmp ecx, dword [eax]
setl dl
xor eax, eax
cmp dword [esp + 0x2c], edx
setge al
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setge dl
imul edx, dword [esp + 0xc]
mov eax, dword [esp + 0x80]
add edx, dword [eax]
xor eax, eax
cmp edx, 0x5691f3a4
setg al
xor edx, edx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
imul ecx, dword [esp + 0x12c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setl dl
sub edx, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
neg edx
push dword [esp + 0x80]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [esp + 0x30], ecx
call fcn.10050fba
pop ecx
push 1
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
inc dword [esp + 0x24]
pop esi
cmp dword [esp + 0x20], 0x21
jl 0x10016041
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x260]
mov ecx, dword [esp + 0x48]
push eax
call fcn.100099fd
mov esi, eax
lea edi, [esp + 0x120]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x28], 0x1b15
cmp dword [esp + 0x28], 0xd3b
jge 0x10016319
push 0x1065ec2c
push ecx
push 0x1065e9a4
mov ecx, 0x1065c990
call fcn.1001716d
pop ecx
mov ecx, eax
call fcn.1001716d
mov eax, dword [0x1065e9a4]
test eax, eax
je 0x1001621b
push 0xa
pop esi
cdq
mov ecx, 0x10fbbc48
idiv esi
lea eax, [esp + 0x168]
push eax
mov dword [esp + 0x16c], edx
call fcn.1001783f
mov eax, dword [0x1065e9a4]
cdq
idiv esi
mov dword [0x1065e9a4], eax
test eax, eax
jne 0x100161ee
mov edx, dword [0x10fbbc4c]
mov eax, edx
mov ecx, dword [0x10fbbc48]
sub eax, ecx
mov byte [esp + 0x19c], bl
push dword [esp + 0x19c]
sar eax, 2
push eax
call fcn.1001d2ab
or edi, 0xffffffff
pop ecx
or eax, edi
mov dword [esp + 0x14], edi
pop ecx
mov dword [esp + 0x14], eax
jmp 0x10016257
mov edi, dword [esp + 0x10]
call fcn.100152fb
mov ecx, eax
mov esi, edx
mov eax, dword [0x1065ec2c]
cdq
cmp esi, edx
jg 0x10016286
jl 0x10016270
cmp ecx, eax
ja 0x10016286
cmp esi, dword [esp + 0x14]
jl 0x10016286
jg 0x1001627c
cmp ecx, edi
jbe 0x10016286
mov edi, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x10], edi
mov edx, dword [0x10fbbc4c]
mov esi, dword [0x10fbbc48]
mov byte [esp + 0x53], bl
cmp esi, edx
je 0x10016302
lea ecx, [edx - 4]
cmp esi, ecx
je 0x10016302
jmp 0x100162a7
cmp ecx, esi
je 0x100162e6
mov edi, ecx
sub ecx, 4
mov eax, dword [ecx]
cmp eax, dword [edi]
jge 0x100162a3
mov esi, edx
mov dword [esp + 0x28], eax
lea esi, [esi - 4]
cmp eax, dword [esi]
jge 0x100162b8
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [esp + 0x28]
mov dword [esi], eax
jmp 0x100162dd
sub edx, 4
cmp edi, edx
je 0x10016253
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [edi], eax
add edi, 4
mov dword [edx], ecx
cmp edi, edx
jne 0x100162cb
jmp 0x10016253
cmp esi, edx
je 0x100162fe
sub edx, 4
cmp esi, edx
je 0x100162fe
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [esi], eax
add esi, 4
mov dword [edx], ecx
jmp 0x100162e6
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov ecx, 0x1065c8d8
push eax
push edi
call fcn.1001747a
push eax
call fcn.1001be35
pop ecx
push 2
lea ecx, [esp + 0x150]
call fcn.100177e1
push 4
lea ecx, [esp + 0x140]
mov dword [esp + 0x280], 8
call fcn.100177e1
push 3
lea ecx, [esp + 0x134]
mov byte [esp + 0x280], 9
call fcn.100177e1
mov dword [esp + 0x20], ebx
jmp 0x10016372
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 0xa87013dc
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1001635c
mov dword [esp + 0x20], ebx
jmp 0x10016395
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0xab60e704
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1001637f
mov dword [esp + 0x20], ebx
jmp 0x100163b8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0x9d6b9c2d
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x100163a2
mov edi, dword [esp + 0x14c]
xor ecx, ecx
mov esi, dword [esp + 0x13c]
mov eax, dword [edi + 4]
mov dword [esi + 8], eax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
xor eax, eax
inc eax
cmp dword [edi + 4], eax
mov eax, dword [esp + 0x130]
setle cl
push eax
mov dword [eax], ecx
call fcn.10050fba
pop ecx
push esi
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
call fcn.10050fba
pop ecx
or esi, 0xffffffff
mov dword [esp + 0x13c], ebx
push edi
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x280], esi
call fcn.10050fba
cmp byte [ebp + 0xc], 0
pop ecx
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
je 0x10016575
cmp dword [esp + 0x124], 0
je 0x10016575
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], 0xffffffef
jmp 0x1001648e
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001648a
push 0x69d
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 7
jl 0x10016471
mov dword [esp + 0xc], ebx
jmp 0x100164b3
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100164af
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe4
jle 0x1001649b
mov eax, dword [esp + 0x128]
lea ecx, [esp + 0xc4]
push 2
pop edi
push edi
mov dword [esp + 0x194], eax
call fcn.100177e1
xor edx, edx
mov dword [esp + 0x14], 0x13532fe2
mov dword [esp + 0x10], ebx
inc edx
cmp dword [esp + 0x10], edi
jge 0x10016501
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc4]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
jmp 0x100164e7
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x10016539
mov dword [esp + 0x10], 0x252604
mov dword [esp + 0x10], ebx
jmp 0x1001652d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc4]
cmp dword [eax + ecx*4], ebx
jne 0x10016533
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x10016519
dec dword [esp + 0x14]
jns 0x1001650b
cmp dword [esp + 0xc4], 0
je 0x10016565
push dword [esp + 0xc4]
call fcn.10050fba
pop ecx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov eax, dword [esp + 0x124]
mov dword [esp + 0x194], eax
jmp 0x10016578
push 2
pop edi
cmp dword [esp + 0x30], 0
jne 0x10016a40
cmp dword [esp + 0x11c], 0
jle 0x10016a40
mov dword [esp + 0x10], 0x13638ecf
mov dword [esp + 0x14], 0x17b722ba
mov dword [esp + 0x10], 0x3342eb9
cmp dword [esp + 0x10], ebx
je 0x100165d4
mov dword [esp + 0x24], 0x6535
xor edi, edi
mov eax, dword [esp + 0x24]
inc edi
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], edi
jmp 0x10016653
mov dword [esp + 0x20], 0x89b5
lea ecx, [esp + 0x70]
mov dword [esp + 0xc], esi
push edi
call fcn.100177e1
mov dword [esp + 0x28], 0xa7da828c
mov dword [esp + 0x1c], ebx
jmp 0x1001660b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x70]
mov dword [eax + ecx*4], 0x27720104
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x100165f8
cmp dword [esp + 0x20], ebx
je 0x100166a1
mov dword [esp + 0x28], 0xfffffff7
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
xor edi, edi
inc edi
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x70], 0
mov dword [esp + 0xc], eax
je 0x10016653
push dword [esp + 0x70]
call fcn.10050fba
pop ecx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
push 0xfffffffffffffff7
pop eax
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0xd0]
mov dword [esp + 0x28], 0x79b38951
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0xb2c57e71
mov dword [esp + 0x1c], 0xb441a62a
mov dword [esp + 0x10], 0xa4ba31e4
push 4
call fcn.100177e1
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], 9
mov dword [esp + 0xc], ebx
jmp 0x100167cd
mov dword [esp + 0x1c], 0x31966c47
mov dword [esp + 0x24], 0xf4cc511e
cmp dword [esp + 0x10], ebx
jne 0x100166e1
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, 9
setge cl
imul ecx, dword [esp + 0x24]
test ecx, ecx
jne 0x100166e1
mov edx, ebx
inc ecx
jmp 0x100166e6
xor ecx, ecx
inc ecx
mov edx, ecx
cmp dword [esp + 0x20], ecx
sbb eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
mov eax, esi
setg cl
xor edx, edx
sub eax, ecx
inc edx
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], edx
jg 0x1001662b
xor edi, edi
inc edi
push 2
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x1001673d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1c0], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001672e
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0x70]
cmp dword [eax + ecx*4], 0xbb30b137
setne dl
mov dword [esp + 0x1c0], edx
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0x24]
setl dl
sub eax, edx
je 0x1001678c
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x14]
cmp ecx, eax
setge dl
cmp edx, dword [esp + 0x20]
mov edx, edi
jg 0x1001678e
mov edx, ebx
mov eax, dword [esp + 0x1c4]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x70]
setge cl
imul ecx, dword [eax]
mov dword [esp + 0x28], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jle 0x10016725
jmp 0x1001662e
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x210], 0xb363
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x100167ba
mov dword [esp + 0xc], ebx
jmp 0x100167f0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 0x694a61bf
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x100167da
mov eax, dword [esp + 0xd0]
mov dword [esp + 0x210], 0x2c0d37ad
cmp dword [eax], ebx
je 0x10016815
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov ecx, edi
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
inc dword [esp + 0x24]
test eax, eax
mov edx, dword [esp + 0xd0]
cmovne ecx, ebx
mov eax, dword [edx]
add eax, ecx
xor ecx, ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [edx + 8]
setg cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
setge dl
neg esi
sbb esi, esi
xor ecx, ecx
neg esi
sub esi, edx
cmp esi, eax
mov eax, dword [esp + 0xd0]
push eax
setge cl
mov dword [eax], ecx
call fcn.10050fba
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0x14], ebx
pop ecx
push 0xfffffffffffffffc
pop eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x1e0], ebx
mov dword [esp + 0x1e4], ebx
mov dword [esp + 0x1e8], ebx
mov dword [esp + 0x1ec], ebx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ebx
jmp 0x100168f6
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x24c], 0xae649f6d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x100168e3
mov dword [esp + 0x254], 0xfffd
xor edx, edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1e0], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], ebx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
cmp eax, ecx
setl dl
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x28], edx
cmp dword [esp + 0x120], eax
je 0x10016a40
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0xf4]
mov dword [esp + 0x24], 0x74aa0d72
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x2c], 0x401d1b98
mov dword [esp + 0x28], 8
push edi
call fcn.100177e1
xor edx, edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10016998
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 0xce3051eb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10016982
mov eax, dword [esp + 0x30]
xor edx, edx
dec dword [esp + 0x24]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], 0x1651
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
sub eax, 0x217c
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
cmp eax, ecx
mov eax, dword [esp + 0xf4]
setle dl
mov dword [eax], edx
test edx, edx
jne 0x100169f9
cmp dword [esp + 0x10], ebx
jne 0x100169f9
mov eax, ebx
jmp 0x100169fc
xor eax, eax
inc eax
push dword [esp + 0xf4]
mov dword [esp + 0x2c], eax
call fcn.10050fba
pop ecx
mov ecx, dword [esp + 0x120]
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
call fcn.100152bb
mov esi, eax
lea eax, [esp + 0x48]
push eax
mov dword [esp + 0x34], esi
call fcn.10017b65
mov dword [eax], esi
push 0xa
pop edi
mov dword [esp + 0xc], 0xb9f9b31
mov dword [esp + 0x28], 0x1780
cmp dword [esp + 0x28], 0x7e0
jge 0x10016b2c
lea eax, [esp + 0x3c]
push eax
push 0x10007b84
call fcn.1005076b
pop ecx
pop ecx
push dword [esp + 0x3c]
lea ecx, [esp + 0x160]
call fcn.100177e1
mov dword [esp + 0x27c], edi
cmp dword [esp + 0x3c], 0
mov esi, dword [esp + 0x15c]
mov dword [esp + 0x28], ebx
jle 0x10016ab6
mov edi, esi
push edi
push 0x10007b84
call fcn.1005076b
inc ebx
add edi, 4
pop ecx
pop ecx
cmp ebx, dword [esp + 0x3c]
jl 0x10016a9d
xor ebx, ebx
push dword [esp + 0x160]
push esi
call fcn.1001c065
cmp dword [esp + 0x44], 0
mov edx, ebx
pop ecx
pop ecx
mov edi, ebx
mov ecx, ebx
jle 0x10016af7
mov ebx, dword [esi]
jmp 0x10016ada
inc edx
mov ebx, dword [esi + edx*4]
add ebx, 5
cmp ebx, dword [esi + ecx*4]
jl 0x10016ad6
mov eax, ecx
sub eax, edx
inc eax
cmp edi, eax
cmovg eax, edi
inc ecx
mov edi, eax
cmp ecx, dword [esp + 0x3c]
jl 0x10016add
xor ebx, ebx
push edi
push 0x10007bb4
call fcn.10050db3
or dword [esp + 0x284], 0xffffffff
pop ecx
pop ecx
test esi, esi
je 0x10016b2c
push esi
call fcn.10050fba
pop ecx
mov dword [esp + 0x15c], ebx
mov dword [esp + 0x160], ebx
mov dword [esp + 0x164], ebx
mov dword [esp + 0x24], 4
mov dword [esp + 0x28], 0xa6ca0cec
mov dword [esp + 0x28], 0xffffffff
push 0xfffffffffffffffe
mov dword [esp + 0x10], ebx
pop esi
cmp dword [esp + 0xc], esi
jne 0x10016bb4
xor edx, edx
mov dword [esp + 0x14], esi
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x2c], ebx
je 0x10016b85
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
lea ecx, [edx + 1]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
sub ecx, eax
cmp ecx, 7
jl 0x10016ba3
mov eax, ebx
cmp dword [esp + 0x24], ebx
je 0x10016ba6
lea eax, [edx + 1]
mov dword [esp + 0x28], eax
dec dword [esp + 0xc]
cmp dword [esp + 0xc], esi
je 0x10016b53
lea ecx, [esp + 0x11c]
call fcn.100119df
xor eax, eax
mov dword [esp + 0xc], 9
inc eax
lea ecx, [esp + 0x54]
push eax
call fcn.100177e1
mov dword [esp + 0x27c], 0xb
xor edx, edx
mov dword [esp + 0x1c], 0x8e045dce
inc edx
mov dword [esp + 0x2c], 0x8af16de6
mov dword [esp + 0x24], 0x2657
mov dword [esp + 0x14], ebx
jmp 0x10016c14
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x54]
mov dword [eax + ecx*4], 0x3f0d3ecf
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10016c01
mov dword [esp + 0xc], 0x14
cmp dword [esp + 0xc], 0xfffffff4
jg 0x10016dca
jmp 0x10016c32
xor edx, edx
inc edx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
jmp 0x10016c4c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x40], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10016c3c
cmp dword [esp + 0x40], ebx
jne 0x10016c74
mov eax, dword [esp + 0x54]
mov ecx, edx
sub ecx, dword [eax]
xor eax, eax
cmp ecx, 0x5f9c7104
setne al
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x44]
mov dword [esp + 0x40], edx
mov eax, dword [esp + 0xc]
cmp dword [esp + 0xc], 0x66ef
jg 0x10016ce0
mov dword [esp + 0x44], edx
cmp dword [esp + 0x24], edx
jge 0x10016cb3
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
imul eax, dword [eax], 6
test eax, eax
je 0x10016cbb
mov ecx, edx
cmp dword [esp + 0x44], ebx
jne 0x10016cbd
mov ecx, ebx
mov eax, dword [esp + 0x2c]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
add ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
jmp 0x10016dbb
mov dword [esp + 0x28], edx
lea ecx, [esp + 0x16c]
mov dword [esp + 0x14], 0xd45eb447
push 3
call fcn.100177e1
mov dword [esp + 0x14], ebx
jmp 0x10016d16
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0x2a44bf8e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10016d00
mov eax, dword [esp + 0x10]
mov ecx, 0xfffc
mov eax, dword [esp + 0x10]
sub ecx, eax
jne 0x10016d3b
cmp dword [esp + 0x24], ebx
jne 0x10016d3b
xor esi, esi
mov edx, ebx
inc esi
jmp 0x10016d40
xor esi, esi
inc esi
mov edx, esi
mov eax, dword [esp + 0x54]
xor ecx, ecx
push 0
cmp edx, dword [eax]
mov eax, dword [esp + 0x44]
setne cl
sub eax, ecx
mov eax, dword [esp + 0x28]
pop ecx
sets cl
add eax, ecx
cmp eax, dword [esp + 0x44]
jle 0x10016d6b
mov edx, esi
cmp dword [esp + 0xc], ebx
jne 0x10016d6d
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
sete cl
imul ecx, dword [esp + 0x28]
mov dword [esp + 0x44], ecx
mov dword [esp + 0x14], 0xb0b030bf
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x16c]
push eax
mov dword [eax + 4], 0x9b5f
call fcn.10050fba
pop ecx
mov dword [esp + 0x16c], ebx
mov dword [esp + 0x170], ebx
mov dword [esp + 0x174], ebx
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff4
jle 0x10016c2f
or dword [esp + 0x27c], 0xffffffff
cmp dword [esp + 0x54], 0
je 0x10016def
push dword [esp + 0x54]
call fcn.10050fba
pop ecx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
mov dword [esp + 0x5c], ebx
mov edi, dword [esp + 0x30]
test edi, edi
je 0x100170ab
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0x10008200]
lea eax, [esp + 0x230]
push eax
lea eax, [esp + 0x224]
mov dword [esp + 0x184], ebx
push eax
push ebx
lea ecx, [esp + 0x18c]
mov dword [esp + 0x190], ebx
movdqu xmmword [esp + 0x22c], xmm0
mov dword [esp + 0x194], ebx
call fcn.1001cdd2
push 2
lea ecx, [esp + 0x1cc]
mov dword [esp + 0x280], 0xc
call fcn.100177e1
mov byte [esp + 0x27c], 0xd
mov dword [esp + 0x14], ebx
jmp 0x10016e7f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c8]
mov dword [eax + ecx*4], 4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10016e69
mov esi, dword [esp + 0x1c8]
xor edi, edi
inc edi
mov dword [esi + 4], 3
mov dword [esp + 0x14], edi
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10016ebc
push 0x1369
push 0x12eb
push 0x78b
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 3
jg 0x10017052
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10016ee7
push 0x173a
push ebx
push 0x8ac
call dword [sym.imp.GDI32.dll_Polygon]
mov dword [esp + 0x28], 0x2189
cmp dword [esp + 0x28], 0x55c
jge 0x1001702f
lea eax, [esp + 0x200]
push eax
lea eax, [esp + 0x1bc]
push eax
lea eax, [esp + 0x54]
push eax
push 0x10007c70
call fcn.1005076b
add esp, 0x10
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
call fcn.1001bb80
mov dword [esp + 0xa4], eax
mov byte [esp + 0x27c], 0xe
mov cl, bl
mov eax, dword [esp + 0x4c]
mov byte [esp + 0x1b], cl
test eax, eax
je 0x10016fff
xor ebx, ebx
inc ebx
dec eax
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x188]
push eax
lea eax, [esp + 0x15c]
push eax
push 0x10007bc4
call fcn.1005076b
movd xmm1, dword [esp + 0x164]
add esp, 0xc
cvtdq2pd xmm1, xmm1
ucomisd xmm1, qword [esp + 0x1b8]
lahf
test ah, 0x44
jp 0x10016f9c
mov cl, bl
mov byte [esp + 0x1b], cl
jmp 0x10016ff1
movd xmm0, dword [esp + 0x188]
subsd xmm1, qword [esp + 0x1b8]
cvtdq2pd xmm0, xmm0
movzx eax, byte [0x10fbbc62]
push eax
lea eax, [esp + 0x20c]
push eax
push ecx
lea eax, [esp + 0x264]
subsd xmm0, qword [esp + 0x20c]
push eax
lea ecx, [esp + 0xb4]
divsd xmm0, xmm1
movsd qword [esp + 0x218], xmm0
call fcn.1001c3be
mov cl, byte [esp + 0x1b]
mov eax, dword [esp + 0x4c]
test eax, eax
jne 0x10016f56
xor ebx, ebx
dec eax
mov dword [esp + 0x4c], eax
movzx eax, cl
add eax, dword [esp + 0xa8]
push eax
push 0x10007bb4
call fcn.10050db3
pop ecx
pop ecx
lea ecx, [esp + 0xa4]
mov byte [esp + 0x27c], 0xd
call fcn.10017bc7
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10017040
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x10016ecb
xor edi, edi
inc edi
dec dword [esi + 4]
jns 0x10016e97
push dword [esp + 0x1c8]
call fcn.10050fba
or dword [esp + 0x280], 0xffffffff
cmp dword [esp + 0x180], 0
mov edi, dword [esp + 0x34]
pop ecx
je 0x1001708b
push dword [esp + 0x17c]
call fcn.10050fba
pop ecx
mov edx, dword [esp + 0x38]
mov ecx, edi
call fcn.100152f1
mov esi, eax
lea eax, [esp + 0x7c]
push eax
mov dword [esp + 0x190], esi
call fcn.10017b03
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0x18c]
mov ecx, dword [esp + 0x274]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret