Function at 0x100142ad
Capabilities:
Create process on windows
Delete directory
Delete registry value
Query or enumerate registry value
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100679dc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x440
push ebx
push esi
push edi
mov dword [esp + 0x50], ecx
lea ecx, [esp + 0x154]
push 4
mov dword [esp + 0x2c], edx
call fcn.100166bf
xor ebx, ebx
mov dword [esp + 0x10], ebx
jmp 0x10014305
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 0xa049fe38
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100142ef
mov edi, dword [sym.imp.USER32.dll_MessageBeep]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x10014323
push 0x13c
call edi
mov esi, dword [esp + 0x154]
xor edx, edx
inc edx
mov eax, 0x9dce
mov dword [esi + 0xc], 0xfffffff8
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], 0x17
cmp dword [esp + 0x10], 0x12
jl 0x100144a6
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x10014379
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1b0], 0x9f23e525
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x10014366
mov dword [esp + 0x20], ebx
jmp 0x10014487
mov dword [esp + 0x18], 9
xor ecx, ecx
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x1b4]
mov eax, dword [esp + 0x14]
cmp eax, edx
setl cl
add ecx, dword [esp + 0x20]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x20]
imul eax, eax, 0xffff
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
add eax, dword [esp + 0x20]
cmp eax, 0xffffffff
jb 0x100143db
mov eax, edx
cmp dword [esp + 0x14], ebx
jne 0x100143dd
mov eax, ebx
cmp eax, dword [esp + 0x24]
jg 0x10014440
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0x23
jne 0x1001443a
mov dword [esp + 0x18], ebx
jmp 0x1001440a
cmp byte [esp + 0xf], bl
je 0x10014406
push ebx
push 0xbb9
call dword [sym.imp.USER32.dll_EndPaint]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x3c
mov byte [esp + 0xf], bl
jg 0x100143f4
cmp byte [esp + 0xf], bl
je 0x1001442c
push 0x62e
push 0x392
push ebx
call dword [sym.imp.GDI32.dll_OffsetRgn]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x23
je 0x100143ee
xor edx, edx
inc edx
mov eax, dword [esp + 0x24]
jmp 0x10014483
mov dword [esp + 0x1c], 4
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
cmp eax, 0x5674
mov eax, dword [esp + 0x24]
setle cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [esp + 0x1c], ecx
inc edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], edx
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffef
jge 0x10014389
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0x12
jge 0x10014358
mov eax, 0x9dce
inc dword [esi + 0xc]
cmp dword [esi + 0xc], 0xffffffff
jle 0x10014339
lea ecx, [esp + 0x154]
call fcn.100167a4
mov dword [esp + 0x18], 0xac204e2d
mov dword [esp + 0x18], ebx
jmp 0x10014507
mov dword [esp + 0x24], 0x7f0a
mov dword [esp + 0x24], 0xe17ca002
cmp dword [esp + 0x24], ebx
je 0x10014503
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x10014503
push ebx
push 0x1c09
push 0x1a12
push 0x1e44
call dword [sym.imp.GDI32.dll_SetPixel]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x17
jg 0x100144cd
mov dword [esp + 0x18], 0x1a
jmp 0x1001453c
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0x3e95aad8
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe9
jg 0x10014518
mov eax, dword [0x10b62858]
xor esi, esi
inc esi
test al, 1
jne 0x100145e8
or eax, esi
mov dword [0x10b62858], eax
push ebx
mov dword [esp + 0x458], ebx
push ebx
mov dword [0x10b62880], ebx
mov dword [0x10b62884], ebx
call fcn.1001ae58
mov dword [0x10b62880], eax
mov dword [0x10b62888], ebx
mov dword [0x10b62890], ebx
mov byte [esp + 0x454], 2
mov ecx, 0x10b62888
mov dword [esp + 0xd0], eax
lea eax, [esp + 0xd0]
push eax
push 0x10
push ebx
lea eax, [esp + 0x17c]
mov dword [0x10b6289c], 0x3f800000
push eax
mov dword [0x10b6288c], ebx
call fcn.1001ac30
push 0x10068925
mov dword [0x10b62894], 7
mov dword [0x10b62898], 8
call fcn.1004f4b2
or dword [esp + 0x458], 0xffffffff
pop ecx
mov dword [esp + 0x10], 0xe8cff0ea
mov dword [esp + 0x44], 0xb51f
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x1c], 0xd863e320
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], ebx
jmp 0x10014899
mov dword [esp + 0x14], 0xfffffffe
lea ecx, [esp + 0x124]
push 4
call fcn.100166bf
mov dword [esp + 0x454], 3
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x1c], 0x4191
mov dword [esp + 0x20], ebx
jmp 0x10014666
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x10014650
mov dword [esp + 0x14], ebx
jmp 0x1001485c
push esi
lea ecx, [esp + 0xc8]
call fcn.100166bf
mov byte [esp + 0x454], 4
lea ecx, [esp + 0x13c]
mov dword [esp + 0x18], 0xbef7d651
push 4
call fcn.100166bf
mov byte [esp + 0x454], 5
mov dword [esp + 0x18], ebx
jmp 0x100146c2
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x100146af
mov dword [esp + 0x18], ebx
jmp 0x100146e4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0xf5d3cc11
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x100146ce
mov eax, dword [esp + 0xc4]
cmp dword [eax], ebx
jne 0x10014869
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x10014838
mov dword [esp + 0x20], 0xe5c285ce
xor ecx, ecx
mov dword [esp + 0x30], 0xf2a6add3
mov dword [esp + 0x2c], 0xffffffff
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xc4]
mov edx, dword [eax]
or eax, 0xffffffff
sub eax, edx
cmp eax, edx
setge cl
xor eax, eax
add ecx, edx
cmp eax, ecx
mov ecx, dword [esp + 0x18]
sbb eax, eax
neg eax
sub ecx, eax
sub ecx, dword [esp + 0x14]
jne 0x1001475b
mov edx, ebx
cmp dword [esp + 0x14], ebx
je 0x1001475d
mov edx, esi
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x407858f9
setl al
cmp dword [esp + 0x20], eax
jne 0x10014816
cmp dword [esp + 0x10], ebx
je 0x10014816
push 2
lea ecx, [esp + 0x110]
call fcn.100166bf
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x20], ebx
jmp 0x100147b9
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], 0x938140a9
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x100147a3
mov eax, dword [esp + 0x10c]
mov dword [eax], esi
mov eax, dword [esp + 0x124]
cmp esi, dword [eax + 0xc]
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
cmp eax, 0xb08
mov eax, dword [esp + 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0x10c]
call fcn.100167a4
jmp 0x1001482a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001482a
push ebx
push 0x58
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
inc dword [esp + 0x1c]
dec dword [esp + 0x18]
jns 0x10014708
lea ecx, [esp + 0x13c]
call fcn.100167a4
lea ecx, [esp + 0xc4]
mov byte [esp + 0x454], 3
call fcn.100167a4
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe6
jle 0x10014676
jmp 0x10014881
lea ecx, [esp + 0x13c]
call fcn.100167a4
lea ecx, [esp + 0xc4]
call fcn.100167a4
or dword [esp + 0x454], 0xffffffff
lea ecx, [esp + 0x124]
call fcn.100167a4
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffb
je 0x10014619
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100148c5
push ebx
push 0x12c8
push 0x2562
push 0x24b0
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
imul eax, dword [esp + 0x50], 0x2710
add eax, dword [esp + 0x28]
mov dword [esp + 0x60], eax
lea eax, [esp + 0x60]
push eax
call fcn.10016a2b
mov esi, dword [eax]
mov dword [esp + 0x1c], 0x5720
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100148fb
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001490e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test esi, esi
je 0x10014ba0
mov dword [esp + 0x14], 0xa4f833fc
xor edi, edi
mov dword [esp + 0x28], 0x6a3735b2
inc edi
mov dword [esp + 0x28], 0x2038e85a
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 0x302aff63
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], 8
mov dword [esp + 0x18], ebx
jmp 0x10014963
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x64], 0xfffffffc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10014953
mov dword [esp + 0x18], ebx
jmp 0x10014982
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xb4], 0x4157736
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001496f
mov dword [esp + 0x14], ebx
jmp 0x10014a22
push dword [esp + 0xb4]
movdqa xmm0, xmmword [0x10007d00]
lea eax, [esp + 0x1d0]
push eax
lea eax, [esp + 0x1c4]
mov dword [esp + 0x98], ebx
push eax
push ebx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa4], ebx
movdqu xmmword [esp + 0x1cc], xmm0
mov dword [esp + 0xa8], ebx
call fcn.1001bc45
mov ecx, dword [esp + 0x90]
mov dword [ecx + 8], ebx
mov dword [esp + 0x10], 0xfffffff6
mov dword [esp + 0x10], ebx
jmp 0x10014a03
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x64], 0xf14c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100149f3
inc dword [ecx + 8]
cmp dword [ecx + 8], 0
jle 0x100149e5
lea ecx, [esp + 0x90]
call fcn.100167a4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x10014991
mov dword [esp + 0x14], ebx
jmp 0x10014a9c
mov dword [esp + 0x10], 0xfd947597
mov dword [esp + 0x28], 0xf3e76e5b
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 0x74e80031
mov dword [esp + 0x28], edi
mov dword [esp + 0x6c], 0xffffffff
mov dword [esp + 0x70], 0xffffffff
mov dword [esp + 0x74], 0xffffffff
mov dword [esp + 0x78], 0xffffffff
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x10014a94
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x64], ebx
jne 0x10014a94
dec dword [esp + 0x10]
jns 0x10014a84
inc dword [esp + 0x1c]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x10014a32
mov dword [esp + 0x10], edi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x10], ebx
jmp 0x10014ac3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x190], 0x90da1152
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10014ab0
mov eax, dword [esp + 0x194]
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], 6
jmp 0x10014b90
mov dword [esp + 0x14], 0xc4530722
mov dword [esp + 0x28], 0x9855
mov dword [esp + 0x1c], 0x331c587c
mov dword [esp + 0x14], ebx
jmp 0x10014b69
mov dword [esp + 0x24], 0xfffffff6
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
sub ecx, eax
je 0x10014b20
mov ecx, edi
cmp dword [esp + 0x28], ebx
jne 0x10014b22
mov ecx, ebx
mov eax, dword [esp + 0x24]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
jne 0x10014b43
mov eax, dword [esp + 0x194]
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp eax, 0xb168f92
mov eax, dword [esp + 0x14]
setle cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xc
jne 0x10014b00
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10014b8c
push 0x1d86
push 0x10a4
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x11
jg 0x10014ae2
jmp 0x10015fae
mov dword [esp + 0x20], 0xc70bb743
xor esi, esi
mov dword [esp + 0x1c], ebx
inc esi
mov dword [esp + 0x10], ebx
jmp 0x10014bc1
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x4c], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10014bb5
mov dword [esp + 0x20], ebx
jmp 0x10014cbd
mov dword [esp + 0x10], 9
mov dword [esp + 0x18], 0x67e307b5
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x10014c10
mov dword [esp + 0x14], ebx
jmp 0x10014c00
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x68], 0xc427
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10014bf0
inc dword [esp + 0x68]
dec dword [esp + 0x10]
jns 0x10014bea
mov dword [esp + 0x18], ebx
jmp 0x10014caf
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x4c], ebx
jne 0x10014c3f
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x4c]
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
sub ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x1c], ecx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10014cab
push 0x540
push 0x2003
push 0x16e8
push 0xbd1
push 0x2421
call dword [sym.imp.GDI32.dll_IntersectClipRect]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x10014c19
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x10014bd0
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10014ce2
push 0x2bb
push 0x19b9
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov eax, dword [0x10b62858]
test al, 2
jne 0x10014d89
or eax, 2
mov dword [0x10b62858], eax
push ebx
mov dword [esp + 0x458], 6
push ebx
mov dword [0x10b628a0], ebx
mov dword [0x10b628a4], ebx
call fcn.1001ae58
mov dword [0x10b628a0], eax
mov dword [0x10b628a8], ebx
mov dword [0x10b628b0], ebx
mov byte [esp + 0x454], 8
mov ecx, 0x10b628a8
mov dword [esp + 0xac], eax
lea eax, [esp + 0xac]
push eax
push 0x10
push ebx
lea eax, [esp + 0x198]
mov dword [0x10b628bc], 0x3f800000
push eax
mov dword [0x10b628ac], ebx
call fcn.1001ac30
push 0x10068920
mov dword [0x10b628b4], 7
mov dword [0x10b628b8], 8
call fcn.1004f4b2
or dword [esp + 0x458], 0xffffffff
pop ecx
push 2
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x10014da9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1a8], 0xf6af
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10014d96
mov dword [esp + 0x10], ebx
mov edx, 0xffff
jmp 0x10014dc9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1a8], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10014dba
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10014de0
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
lea eax, [esp + 0x50]
xorps xmm0, xmm0
push eax
movdqu xmmword [esp + 0x80], xmm0
call fcn.10016a8d
mov esi, dword [eax]
mov dword [esp + 0x10], 0x9ad59e57
mov dword [esp + 0x24], esi
mov dword [esp + 0x10], ebx
jmp 0x10014e1d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1cc], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10014e0a
mov dword [esp + 0x10], ebx
jmp 0x10014e69
mov dword [esp + 0x30], 0xa290be4
mov dword [esp + 0x30], 2
cmp dword [esp + 0x30], ebx
jl 0x10014e58
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10014e52
push ebx
call dword [sym.imp.GDI32.dll_GetObjectType]
dec dword [esp + 0x30]
jns 0x10014e40
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x1cc], ebx
jne 0x10014e70
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x10014e2a
cmp dword [esp + 0x10], ebx
mov byte [esp + 0xf], bl
je 0x10014e8f
cmp byte [esp + 0xf], 0
je 0x10014eaa
push ebx
push 0xb03
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x10014eaa
cmp byte [esp + 0xf], 0
je 0x10014eaa
push ebx
push ebx
push ebx
push ebx
push 0x288
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov cl, byte [ebp + 0xc]
test cl, cl
jne 0x10014eb9
test esi, esi
jne 0x10015654
mov dword [esp + 0x10], ebx
push 4
mov dword [esp + 0x20], 0xfffffff9
pop esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0x2d9e
push 3
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10014ef8
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1d8], 2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10014ee5
mov dword [esp + 0x18], ebx
jmp 0x10014f17
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1e4], 0x9ba07e4f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10014f04
mov dword [esp + 0x18], ebx
jmp 0x10014f33
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x5c], 0xf12f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10014f23
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10014f4f
push 0x13c
call edi
mov cl, byte [ebp + 0xc]
mov dword [esp + 0x10], ebx
jmp 0x10014f99
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0xf4c59cdc
mov dword [esp + 0x1c], 0x6c2e7ccc
mov dword [esp + 0x1c], 9
mov dword [esp + 0x1c], 0xfffffff7
mov dword [esp + 0x1c], 1
mov dword [esp + 0x1c], 0x6fd43ddc
dec dword [esp + 0x5c]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x10014f55
lea eax, [esp + 0x1f0]
mov dl, cl
mov ecx, dword [esp + 0x50]
push eax
call fcn.10009484
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0x80]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
je 0x10015284
cmp dword [esp + 0x84], 0
je 0x10015284
push 7
pop eax
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x100]
mov dword [esp + 0x160], eax
xor edi, edi
mov dword [esp + 0x164], eax
inc edi
mov dword [esp + 0x168], eax
mov dword [esp + 0x16c], eax
push edi
call fcn.100166bf
mov dword [esp + 0x454], 9
mov dword [esp + 0x10], ebx
jmp 0x1001503d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0x3eb61943
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10015027
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setne cl
mov dword [esp + 0x1c], ecx
xor ecx, ecx
cmp eax, 0x768c
setne cl
cmp ecx, dword [esp + 0x1c]
je 0x1001507b
cmp dword [esp + 0x18], ebx
jne 0x10015085
cmp dword [esp + 0x18], ebx
je 0x10015117
mov dword [esp + 0x1c], 0xfffffffc
lea ecx, [esp + 0xf4]
push edi
call fcn.100166bf
mov dword [esp + 0x10], ebx
jmp 0x100150b2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100150a0
mov eax, dword [esp + 0x1c]
xor edx, edx
cmp eax, 0x5d56
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, 0x9dce
setl cl
sub eax, ecx
mov ecx, 0xfff6
sub eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0xf4]
setge cl
mov dword [eax], ecx
lea ecx, [esp + 0xf4]
call fcn.100167a4
jmp 0x100151ad
push 3
mov dword [esp + 0x20], 0x942796a4
mov dword [esp + 0x1c], ebx
pop ecx
jmp 0x10015196
mov dword [esp + 0x14], 0xfffffffc
mov dword [esp + 0x14], ebx
jmp 0x10015149
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x160], 0x1d7feae2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10015136
mov dword [esp + 0x14], ebx
jmp 0x1001518c
mov dword [esp + 0x30], 0x4a7d2ae8
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001516f
push ebx
call esi
push 3
pop ecx
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x30], ebx
jl 0x10015188
mov eax, dword [esp + 0x100]
mov dword [eax], edi
dec dword [esp + 0x30]
jns 0x10015179
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jle 0x10015156
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jle 0x10015128
imul eax, dword [esp + 0x1c], 0xc197
add eax, 0xe7ea
mov dword [esp + 0x1c], eax
or dword [esp + 0x454], 0xffffffff
lea ecx, [esp + 0x100]
call fcn.100167a4
mov eax, dword [esp + 0x88]
lea ecx, [esp + 0x19c]
push 2
mov dword [esp + 0x74], eax
call fcn.100166bf
mov dword [esp + 0x10], 0x4801897a
mov dword [esp + 0x10], ebx
jmp 0x100151fa
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100151e8
mov dword [esp + 0x10], ebx
jmp 0x10015267
mov dword [esp + 0x30], 0xdc7555b7
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10015225
push 0x16a3
call dword [sym.imp.GDI32.dll_RealizePalette]
mov dword [esp + 0x30], edi
cmp dword [esp + 0x30], ebx
jl 0x10015263
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10015246
push ebx
push 0xb75
call dword [sym.imp.USER32.dll_DrawFocusRect]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001525d
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
dec dword [esp + 0x30]
jns 0x1001522f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x10015207
lea ecx, [esp + 0x19c]
call fcn.100167a4
mov eax, dword [esp + 0x84]
mov dword [esp + 0x74], eax
mov edi, dword [esp + 0x24]
test edi, edi
jne 0x10015658
cmp dword [esp + 0x7c], edi
jle 0x10015658
push 2
lea ecx, [esp + 0x11c]
call fcn.100166bf
mov dword [esp + 0x14], ebx
jmp 0x100152c1
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xe0], 0xc0ae9714
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x100152ae
mov dword [esp + 0x14], ebx
jmp 0x100152e4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100152ce
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001530b
push 0x1ce8
push 0x1e3b
push 0x22a4
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [esp + 0x118]
mov dword [ecx + 4], ebx
mov eax, dword [ecx + 4]
inc dword [ecx + 4]
cmp dword [ecx + 4], 1
mov dword [esp + eax*4 + 0xe0], 1
jl 0x10015315
lea ecx, [esp + 0x118]
call fcn.100167a4
mov dword [esp + 0x10], 0xfff8
inc dword [esp + 0x10]
mov dword [esp + 0x10], 0xfffffffc
jmp 0x10015373
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10015361
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001536f
push ebx
call esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x16
jle 0x1001534e
mov dword [esp + 0x14], 0xe8cff0ea
xor esi, esi
inc esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x2c], 0x856cd833
mov dword [esp + 0x30], esi
mov dword [esp + 0x1c], 0xf5d3cc11
mov dword [esp + 0x44], 0xd005
mov dword [esp + 0x14], 0xffffffeb
jmp 0x10015534
mov dword [esp + 0x44], 0x779c63c4
mov dword [esp + 0x10], 7
mov dword [esp + 0x40], 6
mov dword [esp + 0x20], 5
cmp dword [esp + 0x44], ebx
je 0x100153f0
mov dword [esp + 0x10], 0xc25b
mov eax, dword [esp + 0x10]
mov dword [esp + 0x40], eax
mov eax, esi
cmp dword [esp + 0x40], ebx
jne 0x100153f2
mov eax, ebx
neg eax
je 0x10015453
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
cmp eax, 0xec58
setg cl
cmp ecx, dword [esp + 0x44]
jg 0x10015416
mov eax, ebx
cmp dword [esp + 0x44], ebx
je 0x10015418
mov eax, esi
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0xf7bd
jl 0x1001542e
mov eax, esi
cmp dword [esp + 0x40], ebx
jne 0x10015430
mov eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub eax, 0x335900b
je 0x10015447
mov eax, esi
cmp dword [esp + 0x10], ebx
jne 0x10015449
mov eax, ebx
dec eax
cmp eax, 0xf2f37fc0
mov eax, esi
jbe 0x10015455
mov eax, ebx
xor edx, edx
cmp eax, 9
setg dl
xor ecx, ecx
add edx, dword [esp + 0x14]
mov eax, dword [esp + 0x44]
cmp edx, eax
setge cl
xor edx, edx
imul ecx, dword [esp + 0x14]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setl dl
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], eax
mov dword [esp + 0x20], ebx
jmp 0x10015525
mov dword [esp + 0x40], ebx
mov dword [esp + 0x40], ebx
jmp 0x100154b2
mov eax, dword [esp + 0x40]
mov dword [esp + eax*4 + 0x9c], esi
inc dword [esp + 0x40]
cmp dword [esp + 0x40], 3
jl 0x100154a3
mov eax, dword [esp + 0x10]
xor edx, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0xa4]
mov eax, dword [esp + 0x9c]
cmp eax, ecx
mov eax, dword [esp + 0x9c]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x44]
setne cl
mov dword [esp + 0x40], ecx
xor ecx, ecx
cmp dword [esp + 0x40], eax
sete cl
xor eax, eax
imul ecx, dword [esp + 0x9c]
test ecx, ecx
setns al
xor ecx, ecx
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
cmp eax, 0x52b3
setne cl
mov dword [esp + 0x40], ecx
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffee
jge 0x10015499
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 6
jne 0x100153b2
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
imul eax, dword [esp + 0x14]
cmp eax, 7
je 0x1001555d
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
sub eax, 0x3c1d
neg eax
sbb eax, eax
neg eax
inc eax
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x18]
imul ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setl dl
sub edx, dword [esp + 0x30]
neg edx
sbb edx, edx
inc edx
cmp dword [esp + 0x80], 0
mov dword [esp + 0x30], edx
je 0x10015658
mov dword [esp + 0x20], 0xb96ca2cb
mov dword [esp + 0x1c], 0xfff8
mov dword [esp + 0x30], ebx
jmp 0x100155d8
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x8c], 0xfffffff8
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x100155c5
mov eax, dword [esp + 0x20]
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setge dl
add edx, dword [esp + 0x20]
mov dword [esp + 0x8c], edx
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x10015636
mov dword [esp + 0x24], 0xbfc4f27d
mov dword [esp + 0x24], 0x5362daab
inc dword [esp + 0x1c]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10015630
push 0x44b
call dword [sym.imp.USER32.dll_HideCaret]
dec dword [esp + 0x20]
jns 0x10015606
mov ecx, dword [esp + 0x80]
call fcn.10014268
mov esi, eax
lea eax, [esp + 0x50]
push eax
mov dword [esp + 0x28], esi
call fcn.10016a8d
mov dword [eax], esi
mov edi, dword [esp + 0x24]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], 0xa
jmp 0x1001579d
push 2
lea ecx, [esp + 0xec]
call fcn.100166bf
push 2
lea ecx, [esp + 0x134]
mov dword [esp + 0x458], 0xa
call fcn.100166bf
push 0xfffffffffffffff9
pop esi
mov dword [esp + 0x30], esi
push 2
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
pop edx
jmp 0x100156b6
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100156a4
mov dword [esp + 0x14], ebx
jmp 0x100156d8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0x88a137b1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100156c2
mov esi, dword [esp + 0x130]
mov dword [esi + 4], ebx
mov dword [esp + 0x1c], 3
mov dword [esp + 0x1c], 0x437f1bd5
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
je 0x1001570a
mov eax, dword [esp + 0x18]
mov ecx, dword [esi + 4]
xor edx, edx
mov eax, dword [esp + 0xe8]
cmp dword [eax + ecx*4], ebx
mov eax, dword [esp + 0x18]
setge dl
imul edx, ecx
imul ecx, edx, 0x7e0f
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0xe8]
setge dl
sub edx, dword [eax + ecx*4]
add edx, 0x7e3b31b3
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp eax, 0xba00b6fb
setne cl
inc dword [esi + 4]
cmp dword [esi + 4], 1
mov dword [esp + 0x1c], ecx
jle 0x100156e8
lea ecx, [esp + 0x130]
call fcn.100167a4
or dword [esp + 0x454], 0xffffffff
lea ecx, [esp + 0xe8]
call fcn.100167a4
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff4
je 0x10015669
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x7c]
mov dword [esp + 0x18], eax
call fcn.1001048f
mov dword [esp + 0x20], ebx
xor edx, edx
mov dword [esp + 0x30], 0xdf7cd95d
mov dword [esp + 0x14], 0x9b2b534
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0x20]
cmp eax, 0xac46
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, 0x7689351f
setg cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x14], 9
sub edx, eax
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x20], ebx
je 0x100158d5
xor esi, esi
mov dword [esp + 0x1c], 5
mov dword [esp + 0x30], ebx
inc esi
jmp 0x1001585c
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0xa8], 0x72ee72c3
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x10015849
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], 0xfffffff7
mov ecx, dword [esp + 0xa8]
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, 0xffff
setge dl
cmp eax, edx
mov eax, dword [esp + 0x14]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
cmp eax, edx
setge cl
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100158ed
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x100158ed
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100158ea
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
xor esi, esi
inc esi
test edi, edi
je 0x10015bf8
push 2
lea ecx, [esp + 0x14c]
call fcn.100166bf
mov dword [esp + 0x454], 0xb
mov dword [esp + 0x14], 0xf46db505
mov dword [esp + 0x30], ebx
jmp 0x10015932
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0xd5e4
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 2
jl 0x1001591c
mov dword [esp + 0x14], ebx
jmp 0x10015a15
mov dword [esp + 0x2c], 0x558bac04
mov dword [esp + 0x10], esi
mov dword [esp + 0x30], ebx
jmp 0x10015967
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x200], 0xffffffff
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 4
jl 0x10015954
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001598f
push 0x1479
push ebx
push 0x12dd
push 0xe68
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x2c], ebx
jl 0x10015a11
mov dword [esp + 0x30], ebx
mov dword [esp + 0x44], 0x71867b8f
mov dword [esp + 0x30], ebx
jmp 0x100159f0
inc dword [esp + 0x10]
mov dword [esp + 0x10], ebx
jmp 0x100159e6
mov dword [esp + 0x44], 3
cmp dword [esp + 0x44], ebx
jl 0x100159e2
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100159dc
push ebx
push esi
push 0x21db
push ebx
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
dec dword [esp + 0x44]
jns 0x100159c3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x100159b5
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jle 0x100159ab
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x148]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x2c]
jns 0x10015999
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x10015942
mov dword [esp + 0x14], 0xfffffff0
cmp dword [esp + 0x14], 3
jne 0x10015bc7
mov dword [esp + 0x1c], 0xfffffffb
mov dword [esp + 0x1c], 0x146c
cmp dword [esp + 0x1c], 0xd1e
jge 0x10015bac
call fcn.1004ef25
push eax
push 0x1000776c
push 0x10007770
call fcn.1004f750
add esp, 0xc
call fcn.1004ef25
add eax, 0x20
push eax
push 0x10007778
push 0x1000777c
call fcn.1004f750
add esp, 0xc
jmp 0x10015b8a
mov edi, dword [esp + 0xbc]
mov esi, dword [esp + 0xb8]
cmp edi, ebx
jg 0x10015b0c
jl 0x10015aa1
cmp esi, 0x65
jae 0x10015b0c
push ebx
push 0xa
push edi
push esi
call fcn.10062760
mov dword [esp + 0x1c], ebx
xor ebx, ebx
push ebx
push 0xa
push edx
push eax
mov dword [esp + 0x3c], ecx
call fcn.10067150
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], ecx
cmp eax, ecx
mov ecx, dword [esp + 0x1c]
jne 0x10015afc
cmp ecx, edx
jne 0x10015afc
push ebx
push 0x65
push edi
push esi
call fcn.100670a0
push ebx
push 0xa
push edx
push eax
call fcn.10067150
mov ecx, dword [esp + 0x2c]
sub ecx, eax
mov eax, dword [esp + 0x1c]
push ebx
push 0x65
sbb eax, edx
push eax
push ecx
jmp 0x10015b6e
sub dword [esp + 0x30], eax
push ebx
push 0x65
sbb edx, ecx
push edx
push dword [esp + 0x3c]
jmp 0x10015b6e
push ebx
push 0xa
push edi
push esi
call fcn.10062760
mov dword [esp + 0x1c], ebx
xor ebx, ebx
push ebx
push 0xa
push edx
push eax
mov dword [esp + 0x3c], ecx
call fcn.10067150
mov ecx, eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], ecx
cmp eax, ecx
mov ecx, dword [esp + 0x1c]
jne 0x10015b60
cmp ecx, edx
jne 0x10015b60
push ebx
push 0x65
push edi
push esi
call fcn.100670a0
push ebx
push 0xa
push edx
push eax
call fcn.10067150
mov ecx, dword [esp + 0x2c]
sub ecx, eax
mov eax, dword [esp + 0x1c]
jmp 0x10015af3
sub dword [esp + 0x30], eax
push ebx
push 0x65
sbb edx, ecx
push edx
push dword [esp + 0x3c]
call fcn.10054580
add eax, esi
mov ecx, 0x10659b98
adc edx, edi
push edx
push eax
call fcn.10016481
push eax
call fcn.1001b109
pop ecx
lea eax, [esp + 0xb8]
mov ecx, 0x10659c50
push eax
call fcn.1001619f
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x10015a88
mov dword [esp + 0x1c], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
je 0x10015a32
mov edi, dword [esp + 0x24]
or dword [esp + 0x454], 0xffffffff
lea ecx, [esp + 0x148]
call fcn.100167a4
mov edx, dword [esp + 0x28]
mov ecx, edi
call fcn.100142a3
mov esi, eax
lea eax, [esp + 0x60]
push eax
mov dword [esp + 0x70], esi
call fcn.10016a2b
mov dword [eax], esi
mov dword [esp + 0x10], 3
xor edi, edi
push 9
mov dword [esp + 0x28], 0xffffffff
inc edi
pop esi
mov dword [esp + 0x28], esi
push 0xfffffffffffffffd
pop eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x1c], 0x6cf6
mov dword [esp + 0x10], 0xfffffff5
cmp dword [esp + 0x10], 6
jne 0x10015cc4
mov dword [esp + 0x28], 0xf40f
lea ecx, [esp + 0x174]
mov dword [esp + 0x24], 0xcea445a8
push 2
call fcn.100166bf
mov dword [esp + 0x24], 0xf06e85fc
mov dword [esp + 0x24], 0xf59f89f2
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0x24], ebx
jmp 0x10015c8e
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x10015c7c
mov ecx, dword [esp + 0x28]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, edi
lea ecx, [esp + 0x174]
sete al
imul eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
call fcn.100167a4
inc dword [esp + 0x10]
jmp 0x10015c35
mov dword [esp + 0x24], ebx
jmp 0x10015e7a
mov dword [esp + 0x28], 2
mov dword [esp + 0x28], 0xfffffffa
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 0x15a7
cmp dword [esp + 0x28], 0x702
jge 0x10015e08
lea eax, [esp + 0x54]
push eax
push 0x10007720
call fcn.1004edeb
pop ecx
pop ecx
jmp 0x10015df4
dec eax
mov dword [esp + 0x28], ebx
mov dword [esp + 0x54], eax
mov eax, dword [0x10b627f4]
mov dword [0x10b627f8], eax
lea eax, [esp + 0x48]
push eax
push 0x10007720
call fcn.1004edeb
movd xmm0, dword [esp + 0x50]
cvtdq2pd xmm0, xmm0
movsd qword [esp], xmm0
call fcn.1004e444
fstp qword [esp + 0x38]
cvttsd2si eax, qword [esp + 0x38]
mov esi, edi
pop ecx
pop ecx
mov dword [esp + 0x58], esi
cmp eax, edi
mov edi, dword [esp + 0x48]
jl 0x10015dbd
cvttsd2si ebx, qword [esp + 0x30]
mov eax, edi
cdq
idiv esi
test edx, edx
jne 0x10015db2
lea eax, [esp + 0x58]
mov ecx, 0x10b627f4
push eax
call fcn.1001672b
mov esi, dword [esp + 0x58]
mov ecx, esi
mov edi, dword [esp + 0x48]
imul ecx, esi
cmp ecx, edi
je 0x10015db2
mov eax, edi
mov ecx, 0x10b627f4
cdq
idiv esi
mov dword [esp + 0xd4], eax
lea eax, [esp + 0xd4]
push eax
call fcn.1001672b
mov edi, dword [esp + 0x48]
inc esi
mov dword [esp + 0x58], esi
cmp esi, ebx
jle 0x10015d67
xor ebx, ebx
mov eax, dword [0x10b627f8]
mov ecx, ebx
mov edx, dword [0x10b627f4]
sub eax, edx
mov esi, dword [esp + 0x28]
sar eax, 2
test eax, eax
je 0x10015de4
cmp dword [edx + ecx*4], edi
je 0x10015ddf
add esi, dword [edx + ecx*4]
inc ecx
cmp ecx, eax
jb 0x10015dd7
push esi
push 0x1000774c
call fcn.1004f4dc
pop ecx
pop ecx
push 1
pop edi
mov eax, dword [esp + 0x54]
test eax, eax
jne 0x10015d11
dec eax
xor edi, edi
mov dword [esp + 0x54], eax
inc edi
mov dword [esp + 0x28], 0x3e8ea471
lea ecx, [esp + 0x180]
push edi
call fcn.100166bf
mov dword [esp + 0x28], 0x56a96dad
mov dword [esp + 0x14], ebx
jmp 0x10015e41
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xa259c42f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10015e2b
mov dword [esp + 0x14], ebx
jmp 0x10015e60
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b8], 0xa770aacc
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10015e4d
inc dword [esp + 0x1c]
lea ecx, [esp + 0x180]
call fcn.100167a4
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff3
jl 0x10015ccd
mov dword [esp + 0x28], 0x25db
cmp dword [esp + 0x28], 0x136c
jge 0x10015fae
call fcn.1004ef25
push eax
push 0x1000776c
push 0x10007770
call fcn.1004f750
add esp, 0xc
call fcn.1004ef25
add eax, 0x20
push eax
push 0x10007778
push 0x1000777c
call fcn.1004f750
add esp, 0xc
lea eax, [esp + 0xb0]
mov ecx, 0x10659c50
push eax
call fcn.1001605f
mov edi, dword [esp + 0xb0]
mov dword [esp + 0x28], edi
test edi, edi
jle 0x10015fae
lea eax, [esp + 0xdc]
mov ecx, 0x10659c50
push eax
call fcn.1001605f
push 0x234
lea eax, [esp + 0x214]
push ebx
push eax
call fcn.10046701
mov esi, dword [esp + 0xe8]
add esp, 0xc
test esi, esi
jle 0x10015f49
lea eax, [esp + 0xe4]
mov ecx, 0x10659c50
push eax
call fcn.1001605f
mov eax, dword [esp + 0xe4]
inc dword [esp + eax*4 + 0x444]
dec esi
jne 0x10015f26
lea eax, [esp + 0xc0]
mov ecx, 0x10659c50
push eax
mov edi, ebx
call fcn.1001605f
mov esi, dword [esp + 0xc0]
test esi, esi
jle 0x10015f92
lea eax, [esp + 0xd8]
mov ecx, 0x10659c50
push eax
call fcn.1001605f
mov eax, dword [esp + 0xd8]
lea ecx, [esp + 0x444]
shl eax, 2
sub ecx, eax
add edi, dword [ecx]
dec esi
jne 0x10015f68
push edi
mov ecx, 0x10659b98
call fcn.1001636f
push eax
call fcn.1001b109
dec dword [esp + 0x2c]
pop ecx
jne 0x10015ef3
mov eax, dword [ebp + 8]
lea esi, [esp + 0x6c]
mov ecx, dword [esp + 0x44c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret