Function at 0x10019d51
Capabilities:
Get session user name
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007e01a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x298
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x5c], edx
xor ebx, ebx
mov dword [esp + 0x70], esi
push edi
cmp dword [esi + 0x10], ebx
jne 0x10019d8d
xor al, al
jmp 0x1001ba7e
push dword [esp + 0x78]
movdqa xmm0, xmmword [0x10007d00]
lea eax, [esp + 0x270]
push eax
lea eax, [esp + 0x264]
mov dword [esp + 0x20], ebx
push eax
mov dword [esp + 0x18], 0x141b6ba0
lea ecx, [esp + 0x88]
push ebx
movdqu xmmword [esp + 0x26c], xmm0
mov dword [esp + 0x8c], ebx
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
call fcn.10019468
mov dword [esp + 0x2ac], ebx
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0xffffffe6
push 1
pop edx
jge 0x10019e70
push 3
lea ecx, [esp + 0x170]
call fcn.10017d9e
mov dword [esp + 0x10], ebx
jmp 0x10019e1f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0xd16df251
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019e09
xor ecx, ecx
mov dword [esp + 0x10], ebx
inc ecx
jmp 0x10019e42
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x120], 0xfffffff8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10019e2f
mov eax, dword [esp + 0x16c]
lea ecx, [esp + 0x16c]
mov dword [eax + 8], 0xffffffea
call fcn.10017e20
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe6
jl 0x10019df5
xor edx, edx
inc edx
mov dword [esp + 0x18], 3
cmp dword [esp + 0x18], ebx
jl 0x10019f24
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x7c]
cmp dword [eax + ecx*4], ebx
je 0x10019e9b
cmp dword [esp + 0xc], ebx
jne 0x10019f20
jmp 0x10019f13
mov dword [esp + 0x1c], edx
mov dword [esp + 0xc], 3
cmp dword [esp + 0xc], ebx
jl 0x10019f13
mov edi, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x7c]
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov esi, dword [edx + eax*4]
mov eax, dword [esp + 0x1c]
neg esi
cmp dword [edx + edi*4], eax
mov eax, dword [esp + 0x7c]
setge cl
xor edx, edx
cmp ecx, esi
mov ecx, dword [esp + 0x2c]
setle dl
mov dword [eax + ecx*4], edx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019f0d
push 0x206a
push 0x2448
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
dec dword [esp + 0xc]
jns 0x10019ead
dec dword [esp + 0x18]
push 1
pop edx
jns 0x10019e82
mov esi, dword [esp + 0x74]
or dword [esp + 0x2ac], 0xffffffff
lea ecx, [esp + 0x7c]
call fcn.10017e20
mov eax, dword [esp + 0x60]
mov dword [eax], ebx
cmp dword [esi + 0x14], 0x10
jb 0x10019f45
mov ecx, dword [esi]
jmp 0x10019f47
mov ecx, esi
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x58], ecx
jb 0x10019f55
mov edx, dword [esi]
jmp 0x10019f57
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, eax
je 0x1001b8ec
push dword [esp + 0x120]
movdqa xmm0, xmmword [0x10007c90]
lea eax, [esp + 0x250]
push eax
lea eax, [esp + 0x244]
mov dword [esp + 0x14], ebx
push eax
push ebx
lea ecx, [esp + 0x140]
mov dword [esp + 0x140], ebx
movdqu xmmword [esp + 0x24c], xmm0
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
call fcn.10019468
xor eax, eax
inc eax
mov dword [esp + 0x2ac], eax
mov dword [esp + 0x18], eax
push 2
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], ebx
pop esi
jmp 0x10019fe0
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x21c], 0x19583e35
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10019fcd
xor edi, edi
mov dword [esp + 0xc], 0xfffffff6
inc edi
cmp dword [esp + 0xc], 0xfffffff0
jle 0x1001a067
push 3
lea ecx, [esp + 0x1b8]
call fcn.10017d9e
mov dword [esp + 0x20], 0x79cd329b
mov dword [esp + 0x10], ebx
jmp 0x1001a02a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1b4]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a014
mov ecx, dword [esp + 0x1b4]
mov dword [ecx + 4], ebx
mov eax, edi
sub eax, dword [ecx + 4]
sub eax, 0xfffffffa
neg eax
sbb eax, eax
inc eax
inc dword [ecx + 4]
cmp dword [ecx + 4], 3
mov dword [esp + 0x18], eax
jle 0x1001a03b
lea ecx, [esp + 0x1b4]
call fcn.10017e20
dec dword [esp + 0xc]
jmp 0x10019ff1
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0x12
jle 0x1001a1eb
mov dword [esp + 0x20], 0xfb07
lea ecx, [esp + 0x154]
mov dword [esp + 0x30], 0xfffffffe
push 3
call fcn.10017d9e
mov byte [esp + 0x2ac], 2
lea ecx, [esp + 0x184]
mov dword [esp + 0x28], edi
push 2
call fcn.10017d9e
mov dword [esp + 0x10], ebx
jmp 0x1001a0ca
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a0b4
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 2
jge 0x1001a0f8
push 8
pop edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001a0df
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a10a
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
dec dword [esp + 0x28]
jne 0x1001a126
mov eax, dword [esp + 0x30]
mov dword [esp + 0x21c], eax
test eax, eax
jne 0x1001a126
xor ecx, ecx
mov esi, ebx
inc ecx
jmp 0x1001a12b
xor ecx, ecx
inc ecx
mov esi, ecx
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x154]
mov edi, dword [esp + 0x184]
mov dword [eax + 4], 0x4325
xor eax, eax
cmp dword [edi + 4], ecx
setne al
xor ecx, ecx
cmp eax, 0xe188
mov eax, dword [esp + 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x30]
setle dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, 0x17f72684
setge al
xor ecx, ecx
imul eax, eax, 0x4325
inc ecx
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, esi
cmp eax, dword [esp + 0x18]
je 0x1001a1a1
mov eax, ebx
cmp dword [edi + 4], ebx
je 0x1001a1a3
mov eax, ecx
mov ecx, 0xb16aac89
cmp ecx, eax
lea ecx, [esp + 0x184]
sbb eax, eax
inc eax
sub eax, dword [edi + 4]
mov dword [esp + 0x24], eax
call fcn.10017e20
xor eax, eax
lea ecx, [esp + 0x154]
inc eax
mov byte [esp + 0x2ac], al
call fcn.10017e20
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x12
push 1
pop edi
jg 0x1001a076
push 2
pop esi
or edi, 0xffffffff
lea ecx, [esp + 0x130]
mov dword [esp + 0x2ac], edi
call fcn.10017e20
mov eax, dword [esp + 0x58]
mov al, byte [eax]
cmp al, 0x30
jl 0x1001b6d9
cmp al, 0x39
jg 0x1001b6d9
mov dword [esp + 0x20], edi
xor ecx, ecx
mov dword [esp + 0x1c], 0xe60f951f
inc ecx
mov dword [esp + 0x20], 0x2a1e9487
mov dword [esp + 0x20], 0x10e164ca
mov dword [esp + 0x20], 0x96e6c8ca
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ecx
mov dword [esp + 0xc], ebx
jmp 0x1001a25c
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x70], 0xd29729cf
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001a24c
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x210]
dec dword [esp + 0x28]
push 3
call fcn.10017d9e
push 3
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001a294
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xdc], 0x69fdf99f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a281
mov dword [esp + 0x10], ebx
jmp 0x1001a2b6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x210]
mov dword [eax + ecx*4], 0xfffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a2a0
mov dword [esp + 0xe0], 0xfffffff7
jmp 0x1001a31a
mov dword [esp + 0x1c], 0x3292c5eb
mov dword [esp + 0xc], 0x2b96ce02
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, 0xe4f1
setle cl
cmp ecx, edx
jle 0x1001a301
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, 0xd945
setl cl
mov dword [esp + 0x2c], ecx
dec dword [esp + 0xe0]
cmp dword [esp + 0xe0], 0xfffffff1
je 0x1001a2c9
lea ecx, [esp + 0x210]
call fcn.10017e20
mov dword [esp + 0x20], 0x5dce
lea ecx, [esp + 0xf4]
mov dword [esp + 0x10], 0xfffffff8
xor eax, eax
mov dword [esp + 0x18], 3
inc eax
mov dword [esp + 0x50], 0x4ddbc370
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0xd8], 5
mov dword [esp + 0x30], esi
push eax
call fcn.10017d9e
mov dword [esp + 0x2ac], 3
mov dword [esp + 0xec], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x10], ebx
jmp 0x1001a3a2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x88], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001a393
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001a3c7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a3b1
mov dword [esp + 0x10], 0xfffffffb
cmp dword [esp + 0x10], 0x14
jne 0x1001a74e
push dword [esp + 0x70]
movdqa xmm0, xmmword [0x10007d10]
lea eax, [esp + 0x260]
mov dword [esp + 0x24], 0x9a97
lea ecx, [esp + 0xd0]
mov dword [esp + 0x48], edi
push eax
mov dword [esp + 0x2c], edi
lea eax, [esp + 0x254]
mov dword [esp + 0x24], ebx
push eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x68], 3
mov dword [esp + 0x50], 0x9c45c1d1
push ebx
movdqu xmmword [esp + 0x25c], xmm0
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
call fcn.10019468
mov byte [esp + 0x2ac], 4
mov dword [esp + 0x44], 0xdce9db3f
mov dword [esp + 0xc], ebx
jmp 0x1001a478
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x148], 0xa5d8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001a465
mov ecx, dword [esp + 0xf4]
mov edx, dword [ecx]
lea eax, [edx - 1]
mov dword [ecx], eax
cmp edx, 0x3cb5af9f
je 0x1001a49c
xor eax, eax
lea esi, [eax + 1]
jmp 0x1001a49e
mov esi, ebx
mov eax, dword [esp + 0xd8]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
cmp eax, 0xfffffff8
setl cl
xor eax, eax
sub ecx, dword [esp + 0x24]
cmp ecx, 0xd338
setge al
xor edx, edx
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
cmp eax, ecx
setl dl
imul edx, dword [esp + 0x10]
add edx, 0x224
je 0x1001a4e4
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0x148]
sub eax, dword [esp + 0x30]
cmp esi, eax
jle 0x1001a5e1
cmp dword [esp + 0x14c], ebx
je 0x1001a5e1
xor eax, eax
mov dword [esp + 0x28], 0x15ea3766
inc eax
mov dword [esp + 0x5c], 0xfffffffc
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0xfffffffe
je 0x1001a728
mov esi, dword [esp + 0xcc]
push 8
pop ebx
mov dword [esp + 0xc], 0xfffffffd
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xec]
sub ecx, eax
jne 0x1001a567
mov eax, dword [esp + 0x28]
cmp eax, ebx
setne cl
cmp ecx, 0x7828e972
jle 0x1001a563
mov eax, dword [esp + 0x148]
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0x2c]
cmp ecx, eax
setg dl
sub edx, 4
sub edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x148]
mov eax, dword [esp + 0xc]
cmp eax, ecx
mov eax, dword [esp + 0xf4]
setl dl
xor ecx, ecx
test edx, edx
setns cl
xor edx, edx
cmp ecx, dword [eax]
setg dl
xor eax, eax
cmp edx, dword [esi + 4]
mov dword [esp + 0x8c], edx
setl al
mov dword [esp + 0x5c], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffe
jne 0x1001a530
xor ebx, ebx
jmp 0x1001a728
xor eax, eax
mov dword [esp + 0x28], 0xfffffffb
inc eax
lea ecx, [esp + 0x90]
push eax
call fcn.10017d9e
mov dword [esp + 0x24], 0xaa3630dd
xor edx, edx
mov dword [esp + 0x1c], 6
inc edx
mov dword [esp + 0xc], ebx
jmp 0x1001a628
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], 0x43c7d870
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001a612
mov eax, dword [esp + 0xf4]
cmp dword [eax], ebx
jne 0x1001a6a4
mov eax, dword [esp + 0x50]
xor edx, edx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x90]
cmp eax, dword [ecx]
mov esi, dword [ecx]
mov eax, dword [esp + 0x24]
setle dl
mov dword [esp + 0x44], edx
xor edx, edx
cmp dword [esp + 0x44], eax
mov eax, dword [esp + 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, esi
setne al
xor ecx, ecx
cmp eax, esi
setl cl
add ecx, dword [esp + 0x1c]
je 0x1001a685
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x8c]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x90]
cmp dword [eax], ebx
mov eax, dword [esp + 0x88]
setne cl
xor edx, edx
imul ecx, ecx, 0xffff02c4
cmp ecx, eax
mov eax, dword [esp + 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setl cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
cmp dword [esp + 0x20], eax
mov eax, dword [esp + 0x90]
setle cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [esp + 0x88]
setne dl
mov dword [esp + 0x20], edx
xor edx, edx
cmp dword [esp + 0x20], 0x2d9fb0e7
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x90]
setg cl
mov dword [eax], ecx
lea ecx, [esp + 0x90]
call fcn.10017e20
lea ecx, [esp + 0xcc]
mov byte [esp + 0x2ac], 3
call fcn.10017e20
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x14
je 0x1001a3e0
push 2
pop esi
lea ecx, [esp + 0xf4]
mov dword [esp + 0x2ac], edi
call fcn.10017e20
mov dword [esp + 0x20], 0x90c4d8e5
mov dword [esp + 0x1c], 0xcaa8e55a
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 3
jge 0x1001a792
push 8
pop ecx
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x64], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a77f
mov dword [esp + 0x10], ebx
jmp 0x1001a7a7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1f0], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001a798
mov dword [esp + 0x6c], 0xffffffef
cmp dword [esp + 0x6c], 0xfffffff1
je 0x1001a8d2
xor edx, edx
inc edx
mov dword [esp + 0xc], edi
mov dword [esp + 0x30], edx
mov dword [esp + 0xc], ebx
jmp 0x1001a7e4
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x284], 0x740826f3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001a7d1
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 0xf
jg 0x1001a8c3
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x24], 0xe31bb000
mov dword [esp + 0x20], 0x1edd1edb
mov dword [esp + 0x44], 6
mov dword [esp + 0x10], ebx
jmp 0x1001a82f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x294], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a820
cmp dword [esp + 0x18], ebx
je 0x1001a867
cmp dword [esp + 0x6c], ebx
jne 0x1001a84e
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x30]
imul eax, dword [esp + 0x24], 0xfffffff6
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x6c]
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
cmp eax, edx
mov eax, dword [esp + 0x6c]
setle cl
xor edx, edx
cmp ecx, 0x71c2
push 1
setl dl
add eax, edx
xor edx, edx
mov dword [esp + 0x28c], eax
mov ecx, eax
mov eax, dword [esp + 0x70]
shl ecx, 2
cmp ecx, eax
setne dl
mov dword [esp + 0x1f4], edx
mov eax, dword [esp + 0x34]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xf
pop edx
jle 0x1001a7fa
inc dword [esp + 0x6c]
cmp dword [esp + 0x6c], 0xfffffff1
jne 0x1001a7c3
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a8f9
push 0x4c6
push 0x2468
push ebx
push ebx
push 0x22b7
push 0x23df
call dword [sym.imp.USER32.dll_ToUnicode]
mov dword [esp + 0x20], 0x35f394a2
mov dword [esp + 0x10], 0xfffffff6
mov dword [esp + 0x1c], 0x23b6182e
mov dword [esp + 0xc], 0x516a205b
mov dword [esp + 0x2c], 5
mov dword [esp + 0x20], 0xfffffffc
mov eax, dword [esp + 0x10]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x9884
setle cl
xor eax, eax
cmp ecx, 0xfffffff9
setl al
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
sub eax, 0x6b17
jne 0x1001a964
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], 0x8f98
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001a9c2
push 0x231c
push 0xb53
push 0x18f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push 3
mov dword [esp + 0x24], 0xe31d8329
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001a9e6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x104], 0xe1757117
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a9d3
xor ecx, ecx
mov dword [esp + 0x10], ebx
inc ecx
jmp 0x1001aa04
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xe8], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001a9f5
mov dword [esp + 0x10c], 0xfffffffb
jmp 0x1001aa43
mov dword [esp + 0xc], 0xd37ad43
mov dword [esp + 0xc], ebx
jmp 0x1001aa36
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0xe8], ebx
jne 0x1001aa3c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x1001aa25
dec dword [esp + 0x10c]
cmp dword [esp + 0x10c], 0xffffffed
jl 0x1001aa17
mov dword [esp + 0x20], edi
mov dword [esp + 0x10], 0x2cb51dba
mov dword [esp + 0x20], edi
mov dword [esp + 0xc], ebx
jmp 0x1001aa76
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1d0], 0xfff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001aa63
dec dword [esp + 0x1d8]
mov dword [esp + 0x10], ebx
jmp 0x1001ab1c
mov dword [esp + 0xc], ebx
jmp 0x1001aaa3
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x54], 0xfffffff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001aa93
mov dword [esp + 0x54], edx
cmp dword [esp + 0x54], ebx
jl 0x1001ab18
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
jl 0x1001ab0f
mov dword [esp + 0x18], 0x50315362
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], ebx
jl 0x1001aaf3
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001aaea
push 0x1724
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
dec dword [esp + 0x18]
jns 0x1001aad3
push 3
pop edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x1d0]
mov eax, dword [esp + 0x54]
mov dword [esp + eax*4 + 0x1d0], ecx
dec dword [esp + 0xc]
jns 0x1001aac1
dec dword [esp + 0x54]
jns 0x1001aab3
xor ecx, ecx
inc ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x1001aa8d
mov dword [esp + 0x20], 0x144ad72d
mov dword [esp + 0x10], 0xfffffff6
mov dword [esp + 0x1c], 0x23b6182e
mov dword [esp + 0xc], 0x516a205b
mov dword [esp + 0x2c], 5
mov dword [esp + 0x20], 0xfffffffc
mov eax, dword [esp + 0x10]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, 0x9884
setle cl
xor eax, eax
cmp ecx, 0xfffffff9
setl al
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
sub eax, 0x6b17
jne 0x1001ab91
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], 0x8f98
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001abef
push 0x231c
push 0xb53
push 0x18f1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
push dword [esp + 0x70]
movdqa xmm0, xmmword [0x10007cc0]
lea eax, [esp + 0x280]
push eax
lea eax, [esp + 0x274]
mov dword [esp + 0x28], edi
push eax
mov dword [esp + 0x1c], ebx
lea ecx, [esp + 0x120]
mov dword [esp + 0x18], 0xe9934b0b
push ebx
movdqu xmmword [esp + 0x27c], xmm0
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
call fcn.10019468
mov dword [esp + 0x2ac], 5
mov dword [esp + 0x20], 0xff18c9a0
cmp dword [esp + 0x10], ebx
je 0x1001ad2d
push 4
lea ecx, [esp + 0xa0]
call fcn.10017d9e
mov dword [esp + 0xc], ebx
jmp 0x1001ac8d
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001ac77
mov eax, dword [esp + 0x9c]
mov dword [eax], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001ad18
mov dword [esp + 0x1c], 0xfffffffb
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x9c]
cmp dword [eax + ecx*4], ebx
jne 0x1001acdd
mov eax, dword [esp + 0x10]
xor eax, eax
inc eax
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x114]
mov dword [eax + 4], ecx
jne 0x1001acdd
xor ecx, ecx
mov eax, ebx
inc ecx
jmp 0x1001ace2
xor ecx, ecx
inc ecx
mov eax, ecx
cmp eax, dword [esp + 0x10]
mov eax, dword [esp + 0x9c]
jle 0x1001acf3
cmp dword [eax], ebx
je 0x1001acf7
cmp dword [eax], ebx
jne 0x1001acf9
mov ecx, ebx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x9c]
mov eax, dword [eax]
add eax, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x1001aca3
lea ecx, [esp + 0x9c]
call fcn.10017e20
jmp 0x1001ad7e
mov dword [esp + 0x20], 0xe3bf118c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001ad4b
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [esp + 0xc], ebx
jmp 0x1001ad77
mov dword [esp + 0x38], 0x1966
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001ad6b
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x38], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x17
je 0x1001ad51
lea ecx, [esp + 0x114]
mov dword [esp + 0x2ac], edi
call fcn.10017e20
mov dword [esp + 0x20], 0xcc590f02
lea ecx, [esp + 0x204]
push 3
call fcn.10017d9e
xor eax, eax
mov dword [esp + 0x2ac], 6
inc eax
lea ecx, [esp + 0x19c]
push eax
call fcn.10017d9e
xor edx, edx
mov dword [esp + 0xc], 0x3606de71
mov dword [esp + 0xc], ebx
inc edx
jmp 0x1001ade5
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001add3
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001ae02
push ebx
push 0x762
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], ebx
jl 0x1001ae3a
mov dword [esp + 0x10], 0x1738ab65
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x1001ae34
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x19c]
cmp dword [eax + ecx*4], ebx
jne 0x1001ae34
dec dword [esp + 0x10]
jns 0x1001ae1e
dec dword [esp + 0xc]
jns 0x1001ae0c
lea ecx, [esp + 0x19c]
call fcn.10017e20
mov dword [esp + 0x20], 0xf8ee1d11
lea ecx, [esp + 0x160]
mov dword [esp + 0x20], 9
push esi
call fcn.10017d9e
xor ecx, ecx
mov dword [esp + 0x10], ebx
inc ecx
jmp 0x1001ae7b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x228], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001ae6c
mov dword [esp + 0x10], ebx
jmp 0x1001ae99
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001ae87
mov esi, dword [esp + 0x160]
mov dword [esi + 4], ebx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001aec2
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
inc dword [esi + 4]
cmp dword [esi + 4], 0
jle 0x1001aea9
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001aede
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea ecx, [esp + 0x160]
call fcn.10017e20
xor eax, eax
mov dword [esp + 0x20], edi
inc eax
mov dword [esp + 0x110], edi
mov dword [esp + 0x10], 0x13dd33a4
lea ecx, [esp + 0x13c]
push eax
call fcn.10017d9e
mov byte [esp + 0x2ac], 7
lea ecx, [esp + 0x178]
mov dword [esp + 0x2c], 0x2674
mov dword [esp + 0x1c], 0x9ff40b36
push 2
call fcn.10017d9e
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001af52
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001af3c
mov dword [esp + 0x10], ebx
jmp 0x1001af74
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001af5e
mov dword [esp + 0x10], ebx
jmp 0x1001afb0
mov dword [esp + 0x1c], 0x1d89
mov dword [esp + 0x20], 0x5efa20bd
mov eax, dword [esp + 0x1c]
imul eax, dword [esp + 0x10]
test eax, eax
je 0x1001afa6
mov eax, edx
cmp dword [esp + 0x1c], ebx
jne 0x1001afa8
mov eax, ebx
mov dword [esp + 0x20], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffef
jge 0x1001af81
mov dword [esp + 0x10], 0xd
cmp dword [esp + 0x10], 0xfffffff9
je 0x1001b1ae
jmp 0x1001afcf
xor edx, edx
inc edx
mov dword [esp + 0x18], 0x51d52aa0
mov dword [esp + 0xc], edi
imul eax, dword [esp + 0x18], 0xca7
push 8
pop ecx
add eax, dword [esp + 0x10]
cmp ecx, eax
sbb eax, eax
neg eax
imul eax, dword [esp + 0x18]
test eax, eax
jne 0x1001b001
cmp dword [esp + 0x18], ebx
jne 0x1001b001
mov edx, ebx
mov eax, dword [esp + 0x18]
mov ecx, 0xfff7
sub ecx, eax
imul ecx, edx
test ecx, ecx
je 0x1001b0cb
mov dword [esp + 0x1c], 0xd29ed7d4
mov dword [esp + 0xc], ebx
jmp 0x1001b038
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1f8], 0x451d77f1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001b025
mov dword [esp + 0x18], ebx
jmp 0x1001b06a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b066
push 0x1bb6
push ebx
push 0x149a
push 0x26e9
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1001b045
mov dword [esp + 0x18], ebx
jmp 0x1001b0c0
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1fc]
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
sub edx, eax
mov eax, dword [esp + 0x1f8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [esp + 0x13c]
setge cl
imul ecx, dword [eax + esi*4]
mov dword [esp + 0x20], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1001b076
jmp 0x1001b19f
mov dword [esp + 0x30], edi
mov dword [esp + 0x50], 0x8636eebc
mov dword [esp + 0x1c], 0xefce06df
mov dword [esp + 0x1c], 0xbbb785aa
mov dword [esp + 0x20], 0xfffffffe
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x50]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
sub eax, 0xa
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x13c]
mov ecx, dword [esp + 0xc]
dec ecx
mov esi, dword [eax]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
setl dl
xor ecx, ecx
cmp edx, esi
setle cl
xor eax, eax
cmp ecx, 0xfff6
setne al
cmp eax, esi
jl 0x1001b15d
cmp dword [esp + 0xc], ebx
jne 0x1001b15d
mov edx, ebx
jmp 0x1001b162
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
test eax, eax
sets cl
imul eax, ecx, 0xfffffffd
xor ecx, ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x50]
cmp edx, eax
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x178]
setl cl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
mov dword [eax], edx
mov dword [esp + 0x20], edx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff9
jne 0x1001afcc
lea ecx, [esp + 0x178]
call fcn.10017e20
lea ecx, [esp + 0x13c]
mov byte [esp + 0x2ac], 6
call fcn.10017e20
mov dword [esp + 0x18], 6
lea ecx, [esp + 0x190]
push 3
call fcn.10017d9e
mov dword [esp + 0x10], 0xecf04b06
xor edi, edi
mov dword [esp + 0x1c], 5
inc edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 3
jge 0x1001b21a
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], edi
inc dword [esp + 0xc]
jmp 0x1001b1ff
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b235
push 0x16cf
push 0x11b0
call dword [sym.imp.USER32.dll_SetCaretPos]
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x190]
mov dword [esi + 8], eax
test eax, eax
je 0x1001b2da
push 6
pop eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0xb0fe2cf4
mov dword [esp + 0x18], 9
jmp 0x1001b294
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b27a
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b290
push 0x1e70
call dword [sym.imp.GDI32.dll_GetStockObject]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1c
je 0x1001b268
mov eax, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
add ecx, dword [esi + 8]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
cmp dword [esi + 8], eax
jle 0x1001b2d1
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
jmp 0x1001b3fc
mov dword [esp + 0x24], 0xc3ae5071
xor edx, edx
mov dword [esp + 0xc], 0xfffffff7
inc edx
mov dword [esp + 0x28], 0xfffffffe
mov dword [esp + 0x20], ebx
mov dword [esp + 0x10], 0xfffffffa
jmp 0x1001b38c
mov dword [esp + 0x30], 2
mov dword [esp + 0x18], 0x17
jmp 0x1001b381
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
cmp dword [esp + 0x30], 0x16de
jg 0x1001b370
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
inc dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0x24]
cmovg edx, ebx
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
mov dword [esp + 0xc], ecx
inc edx
mov eax, dword [esp + 0xc]
mov ecx, ebx
cmp dword [esi + 8], ebx
je 0x1001b372
mov ecx, edx
xor eax, eax
cmp ecx, dword [esi + 8]
setg al
mov dword [esi + 8], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x2a
jge 0x1001b318
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jg 0x1001b306
mov dword [esp + 0x1c], 0x7ee8c4b0
cmp dword [esp + 0x1c], ebx
je 0x1001b3ac
mov eax, edx
cmp dword [esp + 0x28], ebx
jne 0x1001b3ae
mov eax, ebx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0xfffffff9
mov eax, dword [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
dec eax
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x28]
jge 0x1001b3f1
mov eax, dword [esp + 0xc]
imul eax, dword [esp + 0x24], 0x85aa
xor edi, edi
inc edi
mov dword [esp + 0x20], eax
lea ecx, [esp + 0x190]
call fcn.10017e20
lea eax, [esp + 0xf0]
push eax
lea eax, [esp + 0x208]
push ebx
push eax
call fcn.1001dc3c
mov dword [esp + 0x18], 0x951ad386
add esp, 0xc
mov dword [esp + 0x1e0], 0xffffffff
mov dword [esp + 0x1e4], 0xffffffff
mov dword [esp + 0x1e8], 0xffffffff
mov dword [esp + 0x1ec], 0xffffffff
mov dword [esp + 0x28], 0x8217
mov dword [esp + 0x20], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001b47e
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xa8], 0xffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001b46b
mov eax, dword [esp + 0xb0]
mov dword [esp + 0xc], eax
mov dword [esp + 0xc], ebx
jmp 0x1001b5ec
mov dword [esp + 0x10], 0xfffffffc
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1001b5e8
push 2
lea ecx, [esp + 0x1ac]
call fcn.10017d9e
mov dword [esp + 0x18], ebx
jmp 0x1001b4e1
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001b4cf
mov esi, dword [esp + 0x1a8]
xor eax, eax
inc eax
mov dword [esp + 0x1e8], eax
mov dword [esi + 4], ebx
mov dword [esp + 0x1c], eax
xor edx, edx
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0xa8]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0xa8]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x28]
imul ecx, eax, 0xbc69
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setg dl
add edx, dword [esp + 0x10]
cmp edx, dword [esi + 4]
je 0x1001b594
mov eax, dword [esp + 0x10]
mov edx, dword [esp + eax*4 + 0xa8]
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xa8], edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x28]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, edx
mov dword [esp + 0x1c], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b5bf
push 0xd28
call dword [sym.imp.GDI32.dll_GetStockObject]
jmp 0x1001b5bf
mov dword [esp + 0x20], 0xfffffff7
xor ecx, ecx
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0xb0]
imul eax, dword [esi + 4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp eax, dword [esi + 4]
setle cl
mov dword [esp + 0x1c], ecx
inc dword [esi + 4]
cmp dword [esi + 4], 2
push 1
pop eax
jle 0x1001b4fc
lea ecx, [esp + 0x1a8]
call fcn.10017e20
dec dword [esp + 0x10]
push 1
pop edi
jns 0x1001b4bb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x1001b499
push 0x468d
lea eax, [esp + 0x114]
push eax
push ebx
push 0x152d
push 0x3e0e
push 0x1ae1
push 0x5f4b
call fcn.1001e09b
or dword [esp + 0x2c8], 0xffffffff
lea ecx, [esp + 0x220]
add esp, 0x1c
call fcn.10017e20
push ebx
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x60]
push eax
call fcn.1001da74
mov dword [esp + 0x30], 0xffffffff
add esp, 0xc
mov dword [esp + 0x20], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001b66d
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x27c], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001b65e
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b69a
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push ebx
push 0x1650
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ebx
jl 0x1001b6cb
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001b6bb
cmp dword [esp + 0x20], ebx
jne 0x1001b6c1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], eax
jle 0x1001b6b1
mov dword [esp + 0x38], ebx
dec dword [esp + 0x24]
jns 0x1001b6a7
mov ecx, dword [esp + 0x58]
mov esi, dword [esp + 0x74]
inc ecx
jmp 0x10019f47
push dword [esp + 0xf0]
movdqa xmm0, xmmword [0x10007d00]
lea eax, [esp + 0x240]
push eax
lea eax, [esp + 0x234]
mov dword [esp + 0x3c], ebx
push eax
mov dword [esp + 0x48], 0x141b6ba0
lea ecx, [esp + 0xcc]
push ebx
movdqu xmmword [esp + 0x23c], xmm0
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
call fcn.10019468
push 8
pop eax
mov dword [esp + 0x2ac], eax
mov dword [esp + 0x34], ebx
jmp 0x1001b832
push 3
lea ecx, [esp + 0x128]
call fcn.10017d9e
lea eax, [esp + 0x48]
mov byte [esp + 0x2ac], 9
push eax
lea eax, [esp + 0x128]
push ebx
push eax
call fcn.1001d621
xor edx, edx
mov dword [esp + 0x54], ebx
add esp, 0xc
inc edx
jmp 0x1001b78a
mov eax, dword [esp + 0x48]
mov dword [esp + eax*4 + 0x100], 0xfffffff8
inc dword [esp + 0x48]
cmp dword [esp + 0x48], edx
jl 0x1001b777
mov eax, dword [esp + 0x124]
mov dword [eax + 8], 0xffffffea
jmp 0x1001b809
xor ecx, ecx
mov dword [esp + 0x24], 0xfc1da7bc
mov eax, dword [esp + 0x34]
cmp eax, edx
setge cl
sub ecx, 0x1aa5bbe7
je 0x1001b7bf
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x100]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov edx, dword [esi]
add eax, 0x2c2b87db
neg eax
push 1
sbb eax, eax
xor ecx, ecx
neg eax
imul edx, eax
mov eax, dword [esp + 0x28]
cmp edx, eax
pop edx
setne cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [esp + 0x3c], eax
inc dword [esi]
mov esi, dword [esp + 0x124]
add esi, 8
cmp dword [esi], 0xfffffffa
je 0x1001b7a0
push 8
pop eax
lea ecx, [esp + 0x124]
mov byte [esp + 0x2ac], al
call fcn.10017e20
dec dword [esp + 0x34]
cmp dword [esp + 0x34], 0xffffffe6
jl 0x1001b742
mov dword [esp + 0x34], 3
cmp dword [esp + 0x34], ebx
jl 0x1001b8ad
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0xc0]
cmp dword [eax + ecx*4], ebx
je 0x1001b863
cmp dword [esp + 0x3c], ebx
jne 0x1001b8ad
jmp 0x1001b8a7
xor eax, eax
inc eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x3c], 3
cmp dword [esp + 0x3c], ebx
jl 0x1001b8a7
push ebx
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0xcc]
push eax
lea eax, [esp + 0x88]
push eax
call fcn.1001bb3a
push ebx
call fcn.1001e942
add esp, 0x18
dec dword [esp + 0x3c]
jns 0x1001b878
dec dword [esp + 0x34]
jns 0x1001b84b
lea ecx, [esp + 0xc0]
mov dword [esp + 0x2ac], edi
call fcn.10017e20
lea eax, [esp + 0x60]
push eax
push 0x3061
push 0x1282
push 0x7c77
push ebx
push 0x672f
push 0x5f9c
call fcn.1001e542
add esp, 0x1c
jmp 0x10019d86
mov dword [esp + 0x10], 0x2cb51dba
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001b915
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1c0], 0xfff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001b902
dec dword [esp + 0x1c8]
push 3
mov dword [esp + 0x14], ebx
pop edx
cmp dword [esp + 0x10], edx
jg 0x1001b9d0
xor ecx, ecx
inc ecx
mov dword [esp + 0xc], ebx
jmp 0x1001b94d
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x4c], 0xfffffff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001b93d
mov dword [esp + 0x4c], edx
cmp dword [esp + 0x4c], ebx
jl 0x1001b9c2
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
jl 0x1001b9b9
mov dword [esp + 0x24], 0x50315362
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], ebx
jl 0x1001b99d
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001b994
push 0x1724
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
dec dword [esp + 0x24]
jns 0x1001b97d
push 3
pop edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x1c0]
mov eax, dword [esp + 0x4c]
mov dword [esp + eax*4 + 0x1c0], ecx
dec dword [esp + 0xc]
jns 0x1001b96b
dec dword [esp + 0x4c]
jns 0x1001b95d
xor ecx, ecx
inc ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x1001b937
push 2
lea ecx, [esp + 0xb8]
call fcn.10017d9e
xor ecx, ecx
mov dword [esp + 0x2ac], 0xa
mov dword [esp + 0x40], ebx
inc ecx
jmp 0x1001ba01
mov eax, dword [esp + 0x40]
mov dword [esp + eax*4 + 0x224], ecx
inc dword [esp + 0x40]
cmp dword [esp + 0x40], ecx
jl 0x1001b9f2
lea eax, [esp + 0xb4]
push eax
lea eax, [esp + 0x44]
push ebx
push eax
call fcn.1001bad1
mov eax, dword [esp + 0xc0]
add esp, 0xc
mov dword [eax + 4], ebx
jmp 0x1001ba4b
push 0x46fd
push 0x49c
push ebx
push 0x476d
call fcn.1001d7cc
mov eax, dword [esp + 0xc4]
add esp, 0x10
inc dword [eax + 4]
mov eax, dword [esp + 0xb4]
cmp dword [eax + 4], ebx
jle 0x1001ba29
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001ba6f
push ebx
push 0x11c4
call fcn.1001d9fa
pop ecx
pop ecx
lea ecx, [esp + 0xb4]
call fcn.10017e20
xor eax, eax
inc eax
mov ecx, dword [esp + 0x2a4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret