Function at 0x1003bb4d
Capabilities:
Delete registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10069cdf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f8
mov dword [esp + 0x3c], ecx
mov eax, 0xcfdfe92
mov dword [esp + 0x18], 0xdcad2086
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x14], 0xfffffff9
mov dword [esp + 0x20], 0x4a41637c
mov dword [esp + 0x20], 0xfa32a17d
mov dword [esp + 0x20], 5
mov dword [esp + 0x80], eax
push ebx
mov dword [esp + 0x88], eax
xor ebx, ebx
mov dword [esp + 0x8c], eax
push esi
mov dword [esp + 0x94], eax
mov esi, edx
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x4c], esi
mov dword [esp + 0x10], ebx
jmp 0x1003bbeb
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1f0], 0x1f145ba1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1003bbd8
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x24], 7
push 1
sbb eax, eax
inc eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
pop edi
cmp dword [esp + 0x24], eax
jge 0x1003bc17
mov ecx, edi
cmp dword [esp + 0x24], ebx
jne 0x1003bc19
mov ecx, ebx
mov eax, 0xa2cb
sub eax, ecx
xor ecx, ecx
cmp eax, 0x2b21a35c
setg cl
mov dword [esp + 0x20], ecx
inc dword [esp + 0x28]
mov eax, dword [0x10f74580]
test al, 1
jne 0x1003bcd4
or eax, edi
mov dword [0x10f74580], eax
push ebx
mov dword [esp + 0x210], ebx
push ebx
mov dword [0x10f74560], ebx
mov dword [0x10f74564], ebx
call fcn.1003e181
mov dword [0x10f74560], eax
mov dword [0x10f74568], ebx
mov dword [0x10f74570], ebx
mov byte [esp + 0x20c], 2
mov ecx, 0x10f74568
mov dword [esp + 0xa8], eax
lea eax, [esp + 0xa8]
push eax
push 0x10
push ebx
lea eax, [esp + 0x148]
mov dword [0x10f7457c], 0x3f800000
push eax
mov dword [0x10f7456c], ebx
call fcn.1003df59
push 0x1006a219
mov dword [0x10f74574], 7
mov dword [0x10f74578], 8
call fcn.1004e2dc
or dword [esp + 0x210], 0xffffffff
pop ecx
imul eax, dword [esp + 0x48], 0x2710
push 3
add eax, esi
mov dword [esp + 0x5c], eax
mov dword [esp + 0x40], 0xffff
mov dword [esp + 0x20], 0xfffffff7
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x2c], 0xe813a3db
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x38], 0x251c6076
mov dword [esp + 0x1c], 4
mov dword [esp + 0x28], 0xfffffffb
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x14], ebx
pop esi
jmp 0x1003bd46
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x14c], 0x62d7bc3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003bd33
cmp dword [esp + 0x3c], ebx
jne 0x1003bdb6
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], edi
cmp dword [esp + 0x28], ebx
jne 0x1003bd6c
mov eax, ebx
cmp dword [esp + 0x18], ebx
je 0x1003bd6e
mov eax, edi
mov dword [esp + 0x1c], 0xfffffffc
xor edx, edx
dec dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
cmp eax, ecx
mov eax, dword [esp + 0x24]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x1c]
setl cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x20]
setge cl
sub ecx, dword [esp + 0x150]
mov dword [esp + 0x18], ecx
je 0x1003bdbe
mov ecx, edi
cmp dword [esp + 0x30], ebx
jne 0x1003bdc0
mov ecx, ebx
xor eax, eax
cmp ecx, 0x56237581
setl al
cmp dword [esp + 0x3c], eax
je 0x1003bdd9
mov eax, edi
cmp dword [esp + 0x1c], ebx
jne 0x1003bddb
mov eax, ebx
mov dword [esp + 0x14c], eax
lea eax, [esp + 0x58]
push eax
call fcn.1003d70e
mov eax, dword [eax]
test eax, eax
je 0x1003be92
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x8c], eax
mov dword [esp + 0x10], ebx
jmp 0x1003be1e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x194], 0x648261f9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003be0b
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x1003be71
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 2
cmp dword [esp + 0x24], ebx
jl 0x1003be60
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003be5a
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
dec dword [esp + 0x24]
jns 0x1003be48
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x194]
dec dword [esp + 0x10]
jns 0x1003be32
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003d34e
push 0x520
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
jmp 0x1003d34e
mov eax, dword [0x10f74580]
test al, 2
jne 0x1003bf35
or eax, 2
mov dword [0x10f74580], eax
push ebx
mov dword [esp + 0x210], esi
push ebx
mov dword [0x10f74540], ebx
mov dword [0x10f74544], ebx
call fcn.1003e181
mov dword [0x10f74540], eax
mov dword [0x10f74548], ebx
mov dword [0x10f74550], ebx
mov byte [esp + 0x20c], 5
mov ecx, 0x10f74548
mov dword [esp + 0xa4], eax
lea eax, [esp + 0xa4]
push eax
push 0x10
push ebx
lea eax, [esp + 0x130]
mov dword [0x10f7455c], 0x3f800000
push eax
mov dword [0x10f7454c], ebx
call fcn.1003df59
push 0x1006a214
mov dword [0x10f74554], 7
mov dword [0x10f74558], 8
call fcn.1004e2dc
or dword [esp + 0x210], 0xffffffff
pop ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 0xfffffff1
je 0x1003c0bb
mov eax, 0x13a4
mov dword [esp + 0xe8], eax
mov dword [esp + 0xec], eax
mov dword [esp + 0xf0], eax
mov dword [esp + 0xf4], eax
mov dword [esp + 0x10], 0x3111738a
mov dword [esp + 0x20], 0x18f9
cmp dword [esp + 0x20], 0x5b4
jge 0x1003c03e
lea eax, [esp + 0x5c]
mov ecx, 0x1065a640
push eax
call fcn.1000ed83
mov dword [esp + 0x20], ebx
mov dword [esp + 0x184], 0xf
mov dword [esp + 0x180], ebx
mov byte [esp + 0x170], bl
mov dword [esp + 0x20c], 6
mov esi, dword [esp + 0x5c]
test esi, esi
je 0x1003c020
lea edx, [esp + 0x170]
mov ecx, 0x1065a640
dec esi
call fcn.100301f7
mov edx, 0x1000b84c
lea ecx, [esp + 0x170]
call fcn.1003e3ad
test al, al
je 0x1003c008
lea eax, [esp + 0x9c]
mov ecx, 0x1065a640
push eax
call fcn.1000ed83
add ebx, dword [esp + 0x9c]
jmp 0x1003c01a
push ebx
mov ecx, 0x1065a598
call fcn.1000ef7e
push eax
call fcn.1001268a
pop ecx
test esi, esi
jne 0x1003bfc6
xor ebx, ebx
or dword [esp + 0x20c], 0xffffffff
lea ecx, [esp + 0x170]
push ebx
dec esi
push edi
mov dword [esp + 0x64], esi
call fcn.1000f54a
push 3
pop esi
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], ebx
jl 0x1003c086
mov dword [esp + 0x18], 0xd0d3f7bf
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0xe8], ebx
jne 0x1003c086
mov dword [esp + 0x18], ebx
jmp 0x1003c07a
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0xe8], ebx
jne 0x1003c080
cmp dword [esp + 0x24], ebx
jne 0x1003c080
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1003c063
dec dword [esp + 0x10]
jns 0x1003c048
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c0a7
push 0x1f30
push ebx
push 0x1b9b
push 0xe0f
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
dec dword [esp + 0x24]
mov eax, 0x13a4
cmp dword [esp + 0x24], 0xfffffff1
jne 0x1003bf4d
mov esi, dword [sym.imp.USER32.dll_InsertMenuA]
xorps xmm0, xmm0
movdqu xmmword [esp + 0xac], xmm0
mov dword [esp + 0x1c], 0xeb90da11
mov dword [esp + 0x18], 0x9d44f4cc
mov dword [esp + 0x1c], ebx
jmp 0x1003c2b0
mov dword [esp + 0x24], 0xcb8f6c21
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
je 0x1003c135
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x1c]
jne 0x1003c118
cmp dword [esp + 0x1c], ebx
je 0x1003c120
mov edx, edi
cmp dword [esp + 0x1c], ebx
jne 0x1003c122
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, edi
setg cl
cmp ecx, dword [esp + 0x24]
jg 0x1003c137
mov eax, ebx
xor edx, edx
cmp eax, 0x118c
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xcc8af953
setne al
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
add ecx, 0xffffd6a7
imul ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
cmp eax, 0xe7aebb1b
jne 0x1003c1a6
cmp dword [esp + 0x28], ebx
je 0x1003c1cf
cmp dword [esp + 0x24], ebx
je 0x1003c1cf
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c2ac
push ebx
push ebx
push 0x25ff
push 0x255
push ebx
call esi
jmp 0x1003c2ac
mov dword [esp + 0x20], 0x12cd0ab8
mov dword [esp + 0x10], ebx
jmp 0x1003c1f0
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x164], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003c1dd
cmp dword [esp + 0x1c], ebx
je 0x1003c248
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x1c]
push 0
pop eax
sets al
xor edx, edx
cmp eax, 0x2b3f
setle dl
xor ecx, ecx
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x16c]
cmp edx, eax
mov eax, 0xae88b149
setne cl
cmp eax, ecx
mov eax, dword [esp + 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov edx, edi
setne cl
cmp ecx, dword [esp + 0x16c]
je 0x1003c24a
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
sub edx, 6
cmp edx, 0x3a099773
setne al
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0xffffffe9
jmp 0x1003c2a5
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c2a1
push 0x200c
push 0xa51
push 0x17bc
push 0x1cd5
call dword [sym.imp.USER32.dll_CheckRadioButton]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff7
jne 0x1003c27c
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff0
jne 0x1003c0e6
lea eax, [esp + 0x48]
push eax
call fcn.1003d770
mov ecx, dword [eax]
mov al, byte [ebp + 0xc]
mov dword [esp + 0x34], ecx
test al, al
jne 0x1003c2da
test ecx, ecx
jne 0x1003cbf2
mov dword [esp + 0x1c], 0xeb90da11
mov dword [esp + 0x18], 0x9d44f4cc
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0xfffffff0
je 0x1003c4d1
mov dword [esp + 0x24], 0xcb8f6c21
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
je 0x1003c348
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x1c]
jne 0x1003c32b
cmp dword [esp + 0x1c], ebx
je 0x1003c333
mov edx, edi
cmp dword [esp + 0x1c], ebx
jne 0x1003c335
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, edi
setg cl
cmp ecx, dword [esp + 0x24]
jg 0x1003c34a
mov eax, ebx
xor edx, edx
cmp eax, 0x118c
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0xcc8af953
setne al
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
add ecx, 0xffffd6a7
imul ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
cmp eax, 0xe7aebb1b
jne 0x1003c3b9
cmp dword [esp + 0x28], ebx
je 0x1003c3e2
cmp dword [esp + 0x24], ebx
je 0x1003c3e2
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c4bf
push ebx
push ebx
push 0x25ff
push 0x255
push ebx
call esi
jmp 0x1003c4bf
mov dword [esp + 0x20], 0x12cd0ab8
mov dword [esp + 0x10], ebx
jmp 0x1003c403
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x188], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003c3f0
cmp dword [esp + 0x1c], ebx
je 0x1003c45b
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x1c]
push 0
pop eax
sets al
xor edx, edx
cmp eax, 0x2b3f
setle dl
xor ecx, ecx
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x190]
cmp edx, eax
mov eax, 0xae88b149
setne cl
cmp eax, ecx
mov eax, dword [esp + 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov edx, edi
setne cl
cmp ecx, dword [esp + 0x190]
je 0x1003c45d
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
setle dl
xor eax, eax
sub edx, 6
cmp edx, 0x3a099773
setne al
mov dword [esp + 0x20], eax
mov dword [esp + 0x18], 0xffffffe9
jmp 0x1003c4b8
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c4b4
push 0x200c
push 0xa51
push 0x17bc
push 0x1cd5
call dword [sym.imp.USER32.dll_CheckRadioButton]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff7
jne 0x1003c48f
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff0
jne 0x1003c2f9
mov al, byte [ebp + 0xc]
lea ecx, [esp + 0x1e0]
mov dl, al
push ecx
mov ecx, dword [esp + 0x4c]
call fcn.10030e6a
mov esi, eax
lea edi, [esp + 0xb0]
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
or esi, 0xffffffff
xor edi, edi
mov dword [esp + 0x1c], esi
inc edi
mov dword [esp + 0x10], 0xc007c7be
mov dword [esp + 0x18], 5
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], 0x24061354
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 2
jge 0x1003c531
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x50], edi
inc dword [esp + 0x10]
jmp 0x1003c51c
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jne 0x1003c572
mov eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, esi
setge cl
add ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x18]
jge 0x1003c576
cmp dword [esp + 0x1c], ebx
je 0x1003c576
mov edx, edi
jmp 0x1003c578
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [esp + 0x1c], ecx
je 0x1003c591
mov edx, ebx
cmp dword [esp + 0x1c], ebx
je 0x1003c593
mov edx, edi
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x1003c727
mov dword [esp + 0x28], 0xc9333376
mov dword [esp + 0x38], ebx
mov dword [esp + 0x10], ebx
jmp 0x1003c5d0
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1d4], 0xd241d88c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003c5bd
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], ebx
jl 0x1003c721
mov dword [esp + 0x30], 0xaa9c4ad1
mov dword [esp + 0x3c], esi
mov dword [esp + 0x2c], 0x785e8a77
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], ebx
jl 0x1003c717
mov dword [esp + 0x24], 0xfffb
mov dword [esp + 0x10], ebx
jmp 0x1003c6f7
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x50]
neg eax
jne 0x1003c6b0
xor ecx, ecx
mov dword [esp + 0x30], 0xf1ba
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x50]
test eax, eax
setns cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setle dl
mov dword [esp + 0x3c], edx
xor edx, edx
mov ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
cmp ecx, eax
mov eax, dword [esp + 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x30]
setg cl
mov dword [esp + 0x3c], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x24]
setge cl
xor edx, edx
cmp ecx, 0x7a76
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp edi, ecx
sbb eax, eax
neg eax
add eax, 0x7cd2bab9
jne 0x1003c6b0
mov eax, dword [esp + 0x18]
mov ecx, ebx
cmp dword [esp + eax*4 + 0x50], ebx
je 0x1003c6b2
mov ecx, edi
xor eax, eax
cmp ecx, 0x3d2f
setge al
add eax, dword [esp + 0x2c]
je 0x1003c6eb
cmp dword [esp + 0x24], ebx
jne 0x1003c701
mov dword [esp + 0x24], ebx
jmp 0x1003c6e3
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0x50]
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x50], ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jle 0x1003c6cf
jmp 0x1003c6f3
mov dword [esp + 0x30], esi
dec dword [esp + 0x30]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x1003c618
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x50], ecx
dec dword [esp + 0x18]
jns 0x1003c607
dec dword [esp + 0x1c]
jns 0x1003c5e5
inc dword [esp + 0x20]
jmp 0x1003c73b
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c73b
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp byte [ebp + 0xc], 0
je 0x1003c761
mov ecx, dword [esp + 0xb4]
test ecx, ecx
je 0x1003c761
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], ecx
mov esi, dword [esp + 0x34]
test esi, esi
jne 0x1003cbf2
cmp dword [esp + 0xac], esi
jle 0x1003cbf2
mov dword [esp + 0x2c], edi
push 3
mov dword [esp + 0x24], 0xe1d925b0
mov dword [esp + 0x14], ebx
pop esi
jmp 0x1003c7a2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1a0], 0x37d45db3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003c78f
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1a4], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c7ce
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
push 2
lea ecx, [esp + 0x15c]
call fcn.1000f1b6
mov dword [esp + 0x24], 0xb02971c
mov dword [esp + 0x10], ebx
jmp 0x1003c7fd
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x158]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003c7ea
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c817
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [esp + 0x24], ebx
jmp 0x1003c847
mov dword [esp + 0x10], ebx
jmp 0x1003c832
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xbc], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1003c823
mov dword [esp + 0xbc], 0x14768c0a
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jle 0x1003c81d
lea ecx, [esp + 0x158]
call fcn.1000f212
mov dword [esp + 0x2c], 0x862fd41e
mov dword [esp + 0x2c], 0xf57a7c20
mov dword [esp + 0x24], 0x67f5ed9a
mov dword [esp + 0x10], 0xb95
mov dword [esp + 0x18], 0x3ff14eb4
mov dword [esp + 0x20], 0xbefcdf11
mov dword [esp + 0x2c], 9
mov dword [esp + 0x18], ebx
jmp 0x1003c8aa
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1c8], 0x167fa5c6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1003c897
mov dword [esp + 0x18], ebx
jmp 0x1003c8c5
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x130], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1003c8b6
dec dword [esp + 0x20]
mov dword [esp + 0x18], ebx
jmp 0x1003c988
mov dword [esp + 0x2c], 0xfffd
lea ecx, [esp + 0x140]
mov dword [esp + 0x20], 0xfffffff6
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x20], 0x83800955
push esi
call fcn.1000f1b6
mov dword [esp + 0x10], ebx
jmp 0x1003c925
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], 0xce3d9786
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1003c90f
mov dword [esp + 0x24], ebx
jmp 0x1003c96a
mov dword [esp + 0x10], ebx
jmp 0x1003c959
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003c955
push ebx
push 7
push 0x2645
push 0x1348
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xd
jle 0x1003c937
cmp dword [esp + 0x2c], ebx
jne 0x1003c971
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffe8
jne 0x1003c931
dec dword [esp + 0x138]
lea ecx, [esp + 0x140]
call fcn.1000f212
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffeb
je 0x1003c8d8
cmp dword [esp + 0xb0], 0
je 0x1003cbf2
push 4
pop ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x2c], 0x48a2b8ea
mov dword [esp + 0x10], ebx
jmp 0x1003c9c9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1b8], 0xe5e53494
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1003c9b6
mov dword [esp + 0x18], ebx
jmp 0x1003ca87
mov dword [esp + 0x28], 0xfff8
cmp dword [esp + 0x18], ebx
je 0x1003ca33
mov eax, dword [esp + 0x28]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setne dl
sub edx, 0xe243
je 0x1003ca11
mov eax, edi
cmp dword [esp + 0x28], ebx
jne 0x1003ca13
mov eax, ebx
mov dword [esp + 0x1b8], eax
dec eax
cmp eax, dword [esp + 0x28]
jg 0x1003ca29
mov eax, edi
cmp dword [esp + 0x28], ebx
jne 0x1003ca2b
mov eax, ebx
cmp eax, dword [esp + 0x18]
mov eax, edi
jge 0x1003ca35
mov eax, ebx
mov dword [esp + 0x2c], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003ca83
push 0x813
push 0x475
push ebx
push ebx
push 0x1c7a
push 0x1fcf
push 0x281
push 0x1998
push 0x5b0
push 0x7d5
push 0x60d
push 0x1fb5
push 0x9d8
call dword [sym.imp.GDI32.dll_StretchDIBits]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x19
jle 0x1003c9d8
mov ecx, dword [esp + 0xb0]
call fcn.1003bb01
mov esi, eax
mov eax, 0xffff
mov dword [esp + 0xc0], eax
mov dword [esp + 0xc4], eax
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0x2c], edi
mov dword [esp + 0x34], esi
mov dword [esp + 0x10], ebx
jmp 0x1003cae2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x80], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003cacf
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003cb00
push ebx
push 0xebc
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov dword [esp + 0x80], 0xfffffff7
jmp 0x1003cbd8
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0xf8]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x30], 0xf9d4
push 3
call fcn.1000f1b6
mov dword [esp + 0x10], ebx
jmp 0x1003cb52
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003cb3c
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], 0x145ba13b
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x88]
inc dword [esp + 0xc4]
mov edx, dword [esp + 0xc4]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xf8]
mov dword [eax + 8], ecx
xor eax, eax
cmp ecx, 0xf88
setle al
xor ecx, ecx
add eax, dword [esp + 0x38]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x84]
cmp edx, eax
mov eax, dword [esp + 0x38]
setl cl
xor edx, edx
cmp ecx, dword [esp + 0x2c]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xf8]
call fcn.1000f212
dec dword [esp + 0x80]
cmp dword [esp + 0x80], 0xffffffed
je 0x1003cb10
lea eax, [esp + 0x48]
push eax
call fcn.1003d770
mov dword [eax], esi
mov dword [esp + 0x2c], 0x1e46
cmp dword [esp + 0x2c], 0xff4
jge 0x1003ce10
mov dword [esp + 0x74], 0xf
mov dword [esp + 0x70], ebx
mov byte [esp + 0x60], bl
push 0x1000b0e5
lea ecx, [esp + 0xd4]
mov dword [esp + 0x210], 7
call fcn.1000ed12
lea eax, [esp + 0x44]
mov byte [esp + 0x20c], 8
mov esi, 0x1065a640
push eax
mov ecx, esi
call fcn.1000ed83
mov eax, dword [esp + 0x44]
jmp 0x1003cde2
dec eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x7c]
push eax
push ecx
lea eax, [esp + 0x128]
mov ecx, esi
push eax
call fcn.1000ed83
pop ecx
mov ecx, eax
call fcn.1000ed83
push 0xffffffffffffffff
push ecx
push ecx
call fcn.1003d408
mov eax, dword [0x1065a640]
push 0xa
mov ecx, dword [eax + 4]
add ecx, esi
call fcn.10010a6c
movzx eax, al
lea edx, [esp + 0x60]
push eax
mov ecx, esi
call fcn.1003e5c7
cmp dword [esp + 0xe8], 0x10
lea eax, [esp + 0xd4]
pop ecx
cmovae eax, dword [esp + 0xd0]
mov ecx, ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0x28], ebx
mov byte [eax], bl
cmp dword [esp + 0x74], 0x10
lea eax, [esp + 0x60]
cmovae eax, dword [esp + 0x60]
cmp byte [ecx + eax], 0x20
jne 0x1003cce3
push 0x20
jmp 0x1003cda3
cmp dword [esp + 0x74], 0x10
lea eax, [esp + 0x60]
push ebx
cmovae eax, dword [esp + 0x64]
movsx eax, byte [ecx + eax]
push eax
call fcn.10051870
pop ecx
push eax
mov ecx, 0x10659c9c
call fcn.1003d38f
cmp dword [esp + 0x74], 0x10
lea ecx, [esp + 0x60]
mov dword [esp + 0x20], eax
lea esi, [esp + 0x60]
cmovae ecx, dword [esp + 0x60]
mov eax, dword [esp + 0x28]
cmovae esi, dword [esp + 0x60]
movsx eax, byte [eax + ecx]
push eax
call fcn.10051870
pop ecx
mov ecx, dword [esp + 0x28]
movsx ecx, byte [ecx + esi]
cmp ecx, eax
mov eax, dword [esp + 0x20]
mov ecx, 0x10659c9c
jne 0x1003cd76
cmp dword [0x10659cb0], 0x10
cmovae ecx, dword [0x10659c9c]
xor edx, edx
add eax, dword [esp + 0x7c]
div dword [0x10659cac]
movsx eax, byte [edx + ecx]
push eax
call fcn.10051a11
pop ecx
mov byte [esp + 0x2c], al
push dword [esp + 0x2c]
jmp 0x1003cda3
cmp dword [0x10659cb0], 0x10
cmovae ecx, dword [0x10659c9c]
xor edx, edx
add eax, dword [esp + 0x7c]
div dword [0x10659cac]
movsx eax, byte [edx + ecx]
push eax
call fcn.10051870
pop ecx
mov byte [esp + 0x44], al
push dword [esp + 0x44]
push edi
lea ecx, [esp + 0xd8]
call fcn.10011d64
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x70]
inc ecx
dec eax
mov dword [esp + 0x28], ecx
cmp ecx, eax
jbe 0x1003ccc8
lea edx, [esp + 0xd0]
call fcn.1003e1b5
push eax
call fcn.1001268a
mov eax, dword [esp + 0x34]
mov esi, 0x1065a640
pop ecx
test eax, eax
jne 0x1003cc56
push ebx
dec eax
lea ecx, [esp + 0xd4]
push edi
mov dword [esp + 0x4c], eax
call fcn.1000f54a
or dword [esp + 0x20c], 0xffffffff
lea ecx, [esp + 0x60]
push ebx
push edi
call fcn.1000f54a
mov dword [esp + 0x1c], 0x80444555
lea ecx, [esp + 0x104]
mov dword [esp + 0x28], 0xe39f3faa
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], 0xf5452fa8
push 2
call fcn.1000f1b6
mov dword [esp + 0x10], ebx
jmp 0x1003ce5a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003ce44
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003ce7b
push ebx
push ebx
push 0x13c5
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp dword [esp + 0x1c], ebx
jne 0x1003ce85
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
add ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setne dl
xor ecx, ecx
imul edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x2301355f
setne al
cmp dword [esp + 0x1c], eax
jge 0x1003cee5
cmp dword [esp + 0x28], ebx
je 0x1003cee5
mov eax, edi
cmp dword [esp + 0x1c], ebx
jne 0x1003cee7
mov eax, ebx
cmp eax, 0xd7af2c9a
sbb eax, eax
neg eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
add eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0x85299dad
mov eax, dword [esp + 0x104]
sbb ecx, ecx
neg ecx
mov dword [eax + 4], ecx
lea ecx, [esp + 0x104]
call fcn.1000f212
lea ecx, [esp + 0xac]
call fcn.100379d2
mov dword [esp + 0x38], 0x56915a13
mov dword [esp + 0x20], 0xcce57bf5
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], 2
mov dword [esp + 0x2c], 0x1b37
cmp dword [esp + 0x2c], 0x4fb
jge 0x1003d0ba
lea eax, [esp + 0x78]
mov ecx, 0x1065a640
push eax
call fcn.1000ed83
mov esi, dword [esp + 0x78]
test esi, esi
jle 0x1003cfa0
mov ebx, esi
lea eax, [esp + 0xa0]
mov ecx, 0x1065a640
push eax
call fcn.1000ed83
lea eax, [esp + 0xa0]
mov ecx, 0x10f744c0
push eax
call fcn.1003d65d
dec ebx
jne 0x1003cf79
mov ecx, dword [0x10f744c0]
mov eax, dword [ecx]
dec eax
cmp eax, 0xf
jl 0x1003cfc7
push 0xf
mov ecx, 0x1065a598
call fcn.1000ef7e
push eax
call fcn.1001268a
pop ecx
mov ecx, dword [0x10f744c0]
cmp esi, edi
jne 0x1003cff6
mov eax, dword [ecx]
cmp eax, 0x10
jl 0x1003cfd6
push 0xf
jmp 0x1003cfdf
cmp eax, 0xf
jg 0x1003cff6
add eax, 0xf
push eax
mov ecx, 0x1065a598
call fcn.1000ef7e
push eax
call fcn.1001268a
pop ecx
mov ecx, dword [0x10f744c0]
mov eax, dword [esp + 0x78]
mov esi, ebx
dec eax
test eax, eax
jle 0x1003d034
mov ebx, eax
mov eax, dword [ecx + esi*4 + 4]
sub eax, dword [ecx + esi*4]
cmp eax, 0xf
jle 0x1003d02d
mov eax, dword [ecx + esi*4]
mov ecx, 0x1065a598
add eax, 0xf
push eax
call fcn.1000ef7e
push eax
call fcn.1001268a
pop ecx
mov ecx, dword [0x10f744c0]
inc esi
cmp esi, ebx
jl 0x1003d003
xor ebx, ebx
mov edx, dword [0x10f744c4]
mov esi, edx
sub esi, ecx
sar esi, 2
cmp esi, 2
jb 0x1003d078
mov eax, dword [ecx + esi*4 - 4]
sub eax, dword [ecx + esi*4 - 8]
cmp eax, 0xf
jle 0x1003d078
mov eax, dword [ecx + esi*4 - 8]
mov ecx, 0x1065a598
add eax, 0xf
push eax
call fcn.1000ef7e
push eax
call fcn.1001268a
mov edx, dword [0x10f744c4]
pop ecx
mov ecx, dword [0x10f744c0]
sub edx, ecx
sar edx, 2
cmp edx, 2
jb 0x1003d0a7
push 0x5a
pop eax
sub eax, dword [ecx + edx*4 - 4]
cmp eax, 0xf
jle 0x1003d0a7
mov eax, dword [ecx + edx*4 - 4]
mov ecx, 0x1065a598
add eax, 0xf
push eax
call fcn.1000ef7e
push eax
call fcn.1001268a
pop ecx
push 0x5a
mov ecx, 0x1065a598
call fcn.1000ef7e
push eax
call fcn.1001268a
pop ecx
push 6
pop edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x10], 0xe4a6
mov dword [esp + 0x30], ebx
mov dword [esp + 0x18], ebx
jmp 0x1003d0ee
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1ac], 0x1328f6c7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1003d0db
mov dword [esp + 0x18], ebx
jmp 0x1003d10b
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x40], 0x4c6a37d7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1003d0fb
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x38]
dec dword [esp + 0x40]
cmp eax, ecx
mov eax, edi
cmovg eax, ebx
xor ecx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x3c]
sub eax, edx
imul eax, dword [esp + 0x28]
sub eax, 0xa
cmp eax, 0xffffffff
mov eax, dword [esp + 0x10]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x1ac]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [esp + 0x40]
jge 0x1003d179
cmp dword [esp + 0x40], ebx
jne 0x1003d179
mov dword [esp + 0x20], ebx
jmp 0x1003d17d
mov dword [esp + 0x20], edi
mov esi, dword [esp + 0x34]
test esi, esi
je 0x1003d34e
mov dword [esp + 0x28], 0xa9c4c8d3
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], 8
mov dword [esp + 0x2c], 0xe23a266d
mov dword [esp + 0x38], ebx
mov dword [esp + 0x30], 3
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], 0x4ab6
mov dword [esp + 0x10], ebx
jmp 0x1003d1e2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x128], 0xd6b65720
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003d1cf
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003d1fb
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
cmp dword [esp + 0x28], ebx
jne 0x1003d20d
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x128], eax
mov eax, dword [esp + 0x34]
inc dword [esp + 0x34]
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x2c], ebx
je 0x1003d23a
mov ecx, edi
cmp dword [esp + 0x30], ebx
jne 0x1003d23c
mov ecx, ebx
mov edx, dword [esp + 0x4c]
xor eax, eax
cmp ecx, edi
mov ecx, esi
sete al
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x38], ebx
call fcn.1003bb43
mov dword [esp + 0x10], 0x4b4e1265
mov esi, eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], 0xfffffffd
mov dword [esp + 0x4c], 0xcabebf3b
mov dword [esp + 0x8c], esi
mov dword [esp + 0x10], ebx
jmp 0x1003d2a0
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x110], 0x55950707
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1003d28d
mov dword [esp + 0x10], edi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x114], eax
test eax, eax
je 0x1003d2c3
cmp dword [esp + 0x114], ebx
jne 0x1003d2c5
mov edi, ebx
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x582f80c3
jle 0x1003d322
mov dword [esp + 0x34], 0x814b11f3
cmp dword [esp + 0x10], ebx
je 0x1003d2fa
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x114]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x114], eax
mov dword [esp + 0x4c], eax
jmp 0x1003d342
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1003d342
push 0x6d0
push 0xb42
push 0x18d2
call dword [sym.imp.KERNEL32.dll_HeapCreate]
lea eax, [esp + 0x58]
push eax
call fcn.1003d70e
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0x8c]
mov ecx, dword [esp + 0x204]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret