Function at 0x10018d29
Capabilities:
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008d811
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f0
push ebx
push esi
push edi
mov dword [esp + 0x20], 0xfd3df75d
mov dword [esp + 0x2c], 0x26ed4bca
push 0
mov dword [esp + 0x28], 0x1ae9c7d4
mov dword [esp + 0x14], 0xffffffff
pop ebx
mov dword [esp + 0x20], 8
cmp dword [esp + 0x20], 0xffffffe2
push 1
mov dword [esp + 0x84], ecx
mov dword [esp + 0x78], edx
pop ecx
jg 0x10018f5b
mov dword [esp + 0x1c], 0x35f394a2
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], 0xc12a7b09
mov dword [esp + 0x10], ebx
jmp 0x10018dbb
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x54], 0x9f3923bf
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10018dab
mov dword [esp + 0x1c], 0xa
jmp 0x10018f1d
mov dword [esp + 0x28], 0x78c0
mov dword [esp + 0x24], 0xf157
mov dword [esp + 0x10], 0x8ce324e8
mov dword [esp + 0x38], 0x1ed5297f
mov dword [esp + 0x10], 0xfffffff8
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x28], ebx
jne 0x10018e65
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
je 0x10018e1f
mov edx, ecx
cmp dword [esp + 0x1c], ebx
jne 0x10018e21
mov edx, ebx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [esp + 0x20]
jne 0x10018e36
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
add eax, 0x1369
jne 0x10018e4d
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
dec dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x18], 8
mov eax, dword [esp + 0x18]
cmp eax, 0x2a05008d
setg cl
xor esi, esi
mov dword [esp + 0x10], ecx
inc esi
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x38]
cmp eax, esi
setl cl
xor edx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setl dl
mov dword [esp + 0x24], edx
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
cmp eax, ecx
setg dl
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], ebx
je 0x10018ed4
xor ecx, ecx
inc ecx
mov dword [esp + 0x38], ecx
cmp dword [esp + 0x38], ebx
jne 0x10018f28
jmp 0x10018f19
mov dword [esp + 0x24], esi
cmp dword [esp + 0x24], ebx
je 0x10018ef7
mov dword [esp + 0x10], 0xfa62
mov eax, dword [esp + 0x24]
imul eax, dword [esp + 0x10]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
xor ecx, ecx
sub eax, dword [esp + 0x28]
cmp eax, 0xca07
setg cl
imul ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov eax, dword [esp + 0x14]
inc ecx
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe9
jg 0x10018dce
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x10018f49
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10018f43
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
dec dword [esp + 0x1c]
jns 0x10018f32
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe2
push 1
pop ecx
jle 0x10018d91
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x30], 0x7289
mov dword [esp + 0x28], 0x9ba87a5
mov dword [esp + 0x38], 0xde8aff65
mov dword [esp + 0x10], ebx
jmp 0x10018f99
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x4c], 0xe0648261
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10018f89
mov dword [esp + 0x4c], ebx
cmp dword [esp + 0x4c], 0xffffffef
jge 0x100190ba
jmp 0x10018fb4
xor ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], 0x1cb6a7f4
mov dword [esp + 0x38], 0xa0a9
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ebx
jmp 0x10018fe2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x70], 3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10018fd2
mov eax, dword [esp + 0x4c]
sub eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x38], 0xfffffff8
cmp dword [esp + 0x28], ebx
je 0x10019037
mov eax, dword [esp + 0x24]
mov edx, 0x83f7
sub edx, eax
xor ecx, ecx
mov eax, dword [esp + 0x4c]
cmp edx, eax
setge cl
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
je 0x10019037
xor ecx, ecx
inc ecx
jmp 0x10019039
mov ecx, ebx
mov eax, dword [esp + 0x4c]
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x4c]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [esp + 0x70], edx
mov eax, dword [esp + 0x24]
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 5
setl al
xor edx, edx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
cmp ecx, eax
setl dl
sub edx, 7
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0xfffffffb
setge al
xor edx, edx
cmp eax, 0x67d3d8e1
mov eax, dword [esp + 0x20]
setne dl
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xffffffff
setl al
sub eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
dec dword [esp + 0x4c]
cmp dword [esp + 0x4c], 0xffffffef
jl 0x10018fb1
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], eax
mov dword [esp + 0x28], 0xc75b57fd
mov dword [esp + 0x2c], 0xa4e86524
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 0xe49a2f38
mov dword [esp + 0x28], ebx
jmp 0x10019175
mov dword [esp + 0x10], 0xfffffff7
mov ecx, 0xfb817071
mov dword [esp + 0x38], 0x63a74adf
mov dword [esp + 0x38], 0xe779066
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
sub ecx, eax
jne 0x10019132
cmp dword [esp + 0x10], ebx
jne 0x10019132
mov eax, ebx
jmp 0x10019135
xor eax, eax
inc eax
cmp eax, 0x81f3403c
mov eax, dword [esp + 0x10]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setg cl
xor edx, edx
mov dword [esp + 0x38], ecx
mov ecx, 0xffff
mov eax, dword [esp + 0x28]
sub ecx, eax
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x38], ecx
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xfffffffa
jg 0x100190eb
push dword [esp + 0x54]
lea eax, [esp + 0x1a0]
mov dword [esp + 0x40], 0x1e29ea41
push eax
lea eax, [esp + 0x194]
mov dword [esp + 0x60], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0x68], ebx
push ebx
lea ecx, [esp + 0x68]
mov dword [esp + 0x70], ebx
movdqu xmmword [esp + 0x19c], xmm0
call fcn.100181fb
mov dword [esp + 0x204], ebx
lea ecx, [esp + 0xd8]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 1
push 0xfffffffffffffffc
mov dword [esp + 0x34], 0xfffffffe
pop esi
mov dword [esp + 0x18], 0xe623b26d
mov dword [esp + 0x38], esi
mov dword [esp + 0x1c], 0xe2caeaba
push 2
call fcn.10016bef
xor edx, edx
inc edx
mov byte [esp + 0x204], dl
mov dword [esp + 0x24], edx
mov dword [esp + 0x34], esi
mov dword [esp + 0x10], ebx
jmp 0x10019229
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xd8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019216
mov eax, dword [esp + 0x58]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [eax], edx
mov eax, 0xc2e607d1
mov dword [esp + 0x20], 0xe29ea414
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001928b
push ebx
push 0x1a50
push 0x1f7a
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov eax, dword [esp + 0x20]
mov ecx, 0x22dbaac2
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x14]
sub edx, eax
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
sub ecx, eax
inc edx
cmp ecx, 0x8e486aeb
sbb eax, eax
inc eax
sub edx, eax
neg edx
sbb edx, edx
inc edx
cmp edx, 0x4292
jl 0x1001937c
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0xfffffffe
mov dword [esp + 0x18], 1
mov dword [esp + 0x2c], 0x74d4b4b2
mov dword [esp + 0x10], ebx
jmp 0x1001930e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1dc], 0xc328129e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x100192fb
mov eax, dword [esp + 0x20]
xor edx, edx
mov esi, dword [esp + 0x24]
mov dword [esp + 0xb0], esi
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x20]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x20]
imul ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
setne dl
xor ecx, ecx
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
cmp edx, eax
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0xd8]
setle cl
add ecx, esi
add edx, ecx
neg edx
mov dword [eax], edx
dec dword [esp + 0x24]
cmp dword [esp + 0xa8], ebx
jne 0x1001948a
jmp 0x10019476
xor esi, esi
mov dword [esp + 0x2c], 0x2cf2
inc esi
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], ebx
jl 0x10019476
mov dword [esp + 0x20], esi
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100193b2
push 0x19b0
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [esp + 0x28], esi
cmp dword [esp + 0x28], ebx
jl 0x1001946c
push 3
lea ecx, [esp + 0x130]
call fcn.10016bef
push 3
mov dword [esp + 0x14], ebx
pop edx
jmp 0x100193e9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100193d7
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x28]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xac]
cmp eax, ecx
mov ecx, dword [esp + 0x1c]
setl dl
imul eax, edx, 0xfffd
xor edx, edx
sub ecx, eax
sub ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x12c]
setge dl
xor ecx, ecx
mov esi, dword [eax + 8]
mov eax, dword [esp + 0x2c]
sub esi, edx
cmp esi, eax
mov eax, dword [esp + 0xd8]
setne cl
mov dword [eax + edi*4], ecx
lea ecx, [esp + 0x12c]
call fcn.1001744a
dec dword [esp + 0x28]
jns 0x100193c0
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor esi, esi
inc esi
dec dword [esp + 0x18]
jns 0x10019395
mov eax, dword [esp + 0x58]
dec dword [eax]
cmp dword [eax], 0xfffffff0
mov eax, 0xc2e607d1
jg 0x10019241
lea ecx, [esp + 0xd8]
call fcn.1001744a
or esi, 0xffffffff
lea ecx, [esp + 0x58]
mov dword [esp + 0x204], esi
call fcn.1001744a
mov dword [esp + 0x40], 0x1dfe0091
lea ecx, [esp + 0xf0]
push 1
call fcn.10016bef
push 2
pop eax
push eax
lea ecx, [esp + 0x174]
mov dword [esp + 0x208], eax
call fcn.10016bef
mov byte [esp + 0x204], 3
lea eax, [esp + 0x1bc]
push dword [esp + 0x54]
movdqa xmm0, xmmword [0x10007d90]
lea ecx, [esp + 0xd0]
push eax
lea eax, [esp + 0x1b4]
mov dword [esp + 0x28], 7
push eax
mov dword [esp + 0x3c], 9
mov dword [esp + 0x34], 0x7c7be0
mov dword [esp + 0x3c], 0x5f4e26c1
push ebx
movdqu xmmword [esp + 0x1bc], xmm0
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
call fcn.100181fb
mov byte [esp + 0x204], 4
mov dword [esp + 0x10], ebx
jmp 0x10019569
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x170]
mov dword [eax + ecx*4], 0xd3df
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019553
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jl 0x1001967b
mov dword [esp + 0x18], eax
lea ecx, [esp + 0x15c]
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0xd7d711e7
mov dword [esp + 0x10], 0xacff8ee1
mov dword [esp + 0x30], esi
push eax
call fcn.10016bef
xor edx, edx
mov dword [esp + 0x30], 0x7a912e75
mov dword [esp + 0x10], ebx
inc edx
jmp 0x100195d1
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], 0x60ed
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100195bb
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], ebx
jl 0x10019636
mov dword [esp + 0x30], 0xc157
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], ebx
jmp 0x10019606
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1d4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100195f7
mov dword [esp + 0x14], ebx
jmp 0x10019626
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x16c], 0x498e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10019613
inc dword [esp + 0x24]
dec dword [esp + 0x18]
jns 0x100195e1
mov dword [esp + 0x28], ebx
jmp 0x1001965c
mov dword [esp + 0x24], 3
mov dword [esp + 0x10], ebx
jmp 0x10019652
dec dword [esp + 0x24]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x1001964a
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edx
jle 0x1001963c
lea ecx, [esp + 0x15c]
call fcn.1001744a
dec dword [esp + 0x20]
push 1
pop eax
jns 0x10019581
lea ecx, [esp + 0xcc]
call fcn.1001744a
lea ecx, [esp + 0x170]
mov byte [esp + 0x204], 2
call fcn.1001744a
push ebx
lea eax, [esp + 0x80]
push eax
lea eax, [esp + 0xf8]
push eax
call fcn.1001d3c3
mov dword [esp + 0x20], 0x38ecf54c
add esp, 0xc
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x30], 0x3ea3a722
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x14]
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp eax, 7
mov eax, dword [esp + 0x14]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setge cl
neg ecx
mov dword [esp + 0x34], ecx
xor ecx, ecx
cmp dword [esp + 0x34], eax
setl cl
imul ecx, dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
je 0x100198cc
push 3
lea ecx, [esp + 0xe8]
call fcn.10016bef
mov byte [esp + 0x204], 5
xor esi, esi
mov dword [esp + 0x24], 0xffff
inc esi
mov dword [esp + 0x34], 0xfffffff7
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 3
jge 0x1001976e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
jmp 0x10019753
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0xfffffff1
jge 0x100198a4
mov edi, dword [esp + 0xe4]
push dword [esp + 0x7c]
movdqa xmm0, xmmword [0x10007cf0]
lea eax, [esp + 0x190]
push eax
lea eax, [esp + 0x184]
mov dword [esp + 0x20], 0xffffffff
push eax
mov dword [esp + 0x38], 0xffffffff
lea ecx, [esp + 0x94]
push ebx
movdqu xmmword [esp + 0x18c], xmm0
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
call fcn.100181fb
mov dword [esp + 0x2c], 8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x88]
sub ecx, 0xfff7
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax + 4], ecx
jne 0x10019815
mov ecx, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov ecx, ebx
setne dl
add edx, dword [esp + 0x24]
je 0x10019817
mov ecx, esi
mov eax, dword [esp + 0x18]
add ecx, 0x477ae271
mov dword [esp + 0x2c], eax
xor edx, edx
mov esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
neg esi
cmp ecx, eax
mov dword [edi + 8], esi
setl dl
xor eax, eax
cmp esi, edx
setne al
xor ecx, ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x34], eax
setne cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x34], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019886
push 0x96e
push 0x156
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_LineTo]
lea ecx, [esp + 0x88]
call fcn.1001744a
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff1
push 1
pop esi
jl 0x10019784
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100198b6
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0xe4]
mov byte [esp + 0x204], 2
call fcn.1001744a
jmp 0x10019915
mov dword [esp + 0x1c], ebx
jmp 0x1001990e
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100198f2
push ebx
push ebx
push 0xfdd
push 0x413
call edi
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001990a
push ebx
push ebx
call edi
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe3
jl 0x100198d2
mov eax, dword [esp + 0x1c]
or edi, 0xffffffff
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], edi
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019937
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001994f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 0x7974
lea eax, [esp + 0xf4]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x4c]
push eax
push ebx
call fcn.1001c406
add esp, 0x14
lea ecx, [esp + 0x114]
push 4
call fcn.10016bef
mov dword [esp + 0x28], 0x29000d4e
mov dword [esp + 0x34], edi
mov dword [esp + 0x10], ebx
jmp 0x100199a5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 0x3b910207
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001998f
mov dword [esp + 0x28], ebx
mov edx, 0xe7e55059
jmp 0x100199cd
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], edx
mov dword [esp + 0x34], edx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 3
jle 0x100199b7
lea ecx, [esp + 0x114]
call fcn.1001744a
mov dword [esp + 0x3c], ebx
jmp 0x1001a7aa
mov dword [esp + 0x20], 0xb910
mov dword [esp + 0x34], 0xfffffffa
cmp dword [esp + 0x20], ebx
je 0x10019a13
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019a3d
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x10019a3d
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
mov dword [esp + 0x20], ebx
jmp 0x10019a36
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019a32
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffe5
jne 0x10019a21
mov dword [esp + 0x20], 0x76fbfcc0
xor esi, esi
mov dword [esp + 0x28], 0x66d9918c
inc esi
mov dword [esp + 0x18], 0xfffffffc
mov dword [esp + 0x24], 0x7dfe4d9e
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], 0x14b58e17
mov dword [esp + 0x38], 0xa1245c81
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019aaf
push ebx
push ebx
call dword [sym.imp.GDI32.dll_RectInRegion]
mov dword [esp + 0x10], ebx
jmp 0x10019ac8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x168], 0xeb5a40a7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019ab5
mov dword [esp + 0x40], 0xffffffea
jmp 0x1001a38c
lea ecx, [esp + 0x154]
call fcn.10016bef
mov byte [esp + 0x204], 6
mov dword [esp + 0x10], esi
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x24], 5
mov dword [esp + 0x10], ebx
jmp 0x10019b18
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1e8], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10019b09
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019b3a
push 0x15c4
push 0x11f0
call dword [sym.imp.KERNEL32.dll_Beep]
cmp dword [esp + 0x28], ebx
je 0x10019bb0
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019b52
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x28], 3
cmp dword [esp + 0x28], ebx
jl 0x10019bb8
push esi
lea ecx, [esp + 0x148]
call fcn.10016bef
mov dword [esp + 0x10], ebx
jmp 0x10019b89
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019b73
mov eax, dword [esp + 0x144]
lea ecx, [esp + 0x144]
mov dword [eax], edi
mov dword [esp + 0x24], edi
call fcn.1001744a
dec dword [esp + 0x28]
jns 0x10019b60
jmp 0x10019bb8
mov dword [esp + 0x24], 0x72c25fcc
mov dword [esp + 0x14], ebx
jmp 0x10019bd4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019bbe
push esi
lea ecx, [esp + 0x100]
call fcn.10016bef
mov dword [esp + 0x14], 2
xor edx, edx
mov dword [esp + 0x30], 0xfffffff7
inc edx
mov dword [esp + 0x30], 0x588e1b61
mov dword [esp + 0x30], 0xe1abe8f2
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], ebx
jmp 0x10019c2b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], 0x1713b910
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10019c15
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x10019ce6
mov dword [esp + 0x24], 0x78dc2a82
mov dword [esp + 0x18], 5
mov dword [esp + 0x2c], 0xf63069be
mov dword [esp + 0x10], ebx
jmp 0x10019c70
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x19c], 0x80e0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10019c5d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xfc]
cmp dword [eax + ecx*4], ebx
je 0x10019c92
mov eax, edx
cmp dword [esp + 0x1a4], ebx
jne 0x10019c94
mov eax, ebx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
jne 0x10019cc3
mov dword [esp + 0x18], 0xfffffffe
cmp dword [esp + 0x18], edx
sbb eax, eax
inc eax
imul eax, eax, 0xdbf0
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
dec dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x19c], ebx
jne 0x10019ce6
dec dword [esp + 0x14]
jns 0x10019c3f
lea ecx, [esp + 0xfc]
call fcn.1001744a
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x10019d0a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x84], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10019cfb
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
cmp eax, 0x663c10b4
setg cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x20]
sub eax, 0x2d9c
jne 0x10019d46
mov eax, ebx
cmp dword [esp + 0x28], ebx
je 0x10019d48
mov eax, edx
xor edx, edx
cmp eax, 0xfc3e
mov eax, dword [esp + 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [esp + 0x3c]
jl 0x10019d75
mov eax, dword [esp + 0x150]
cmp dword [eax], ebx
jne 0x10019d75
xor esi, esi
mov eax, ebx
inc esi
jmp 0x10019d7a
xor esi, esi
inc esi
mov eax, esi
mov dword [esp + 0x84], eax
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], ebx
jl 0x1001a374
mov dword [esp + 0x18], 0xa41449c9
lea ecx, [esp + 0x108]
mov dword [esp + 0x24], edi
push 3
call fcn.10016bef
push 2
lea ecx, [esp + 0xb8]
mov byte [esp + 0x208], 7
call fcn.10016bef
mov dword [esp + 0x14], ebx
jmp 0x10019ddb
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0x2d714f98
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019dc5
mov dword [esp + 0x14], ebx
jmp 0x10019dfa
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019de8
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x108]
mov dword [eax + 8], ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xb4]
mov eax, dword [eax]
sub eax, ecx
mov ecx, dword [esp + 0x24]
imul ecx, dword [esp + 0x18]
imul ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xfffffffa
setge al
xor ecx, ecx
cmp eax, 0xdf60
mov eax, dword [esp + 0xb4]
setg cl
imul ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
lea ecx, [esp + 0xb4]
call fcn.1001744a
lea ecx, [esp + 0x108]
mov byte [esp + 0x204], 6
call fcn.1001744a
mov dword [esp + 0x30], 0xfffffffd
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x1001a366
mov dword [esp + 0x34], 0x36c8609e
mov dword [esp + 0x20], 0xa9bdba76
mov dword [esp + 0x20], ebx
jmp 0x10019eb6
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1c8], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10019ea7
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
je 0x10019ee5
mov dword [esp + 0x20], ebx
jmp 0x10019edc
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1c8], esi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10019ecd
jmp 0x10019ef7
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019ef7
push ebx
call dword [sym.imp.USER32.dll_SetKeyboardState]
mov dword [esp + 0x34], 0x7c747caf
lea ecx, [esp + 0xc0]
mov dword [esp + 0x1c], edi
push 3
call fcn.10016bef
mov byte [esp + 0x204], 8
mov dword [esp + 0x24], 0xbb94d0f
mov dword [esp + 0x34], 0x132d7af2
mov dword [esp + 0x2c], 0x7904
mov dword [esp + 0x38], esi
mov dword [esp + 0x20], ebx
jmp 0x10019f4d
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10019f3b
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x10019fe9
push 3
lea ecx, [esp + 0x124]
call fcn.10016bef
push 3
mov dword [esp + 0x24], ebx
pop edx
jmp 0x10019f93
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x10019f7d
mov dword [esp + 0x1c], ebx
jmp 0x10019fb5
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0x7dc4b4e1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x10019f9f
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019fdb
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
lea ecx, [esp + 0x120]
call fcn.1001744a
jmp 0x1001a014
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a014
push 0x90
push ebx
push ebx
push ebx
push ebx
push 0x94d
push 0x258e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindowEx]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0xc0]
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
setne dl
mov dword [esp + 0x24], edx
xor edx, edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x2c]
add ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc0]
imul ecx, dword [eax]
test ecx, ecx
jne 0x1001a071
mov eax, ebx
cmp dword [esp + 0x24], ebx
je 0x1001a073
mov eax, esi
mov edx, dword [esp + 0x2c]
xor ecx, ecx
add edx, eax
mov eax, dword [esp + 0x2c]
cmp edx, eax
setle cl
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0xc0]
mov byte [esp + 0x204], 6
call fcn.1001744a
mov dword [esp + 0x20], ebx
jmp 0x1001a352
mov dword [esp + 0x34], 0x125dbf60
mov dword [esp + 0x18], 0xfffffff6
mov dword [esp + 0x14], ebx
jmp 0x1001a0ca
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1bc], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001a0bb
mov dword [esp + 0x18], ebx
jmp 0x1001a152
mov dword [esp + 0x14], 0xe1265ab3
mov dword [esp + 0x14], ebx
jmp 0x1001a127
mov dword [esp + 0x1c], 0xae77ab39
mov dword [esp + 0x1c], ebx
jmp 0x1001a11c
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a10b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x1bc], ebx
jne 0x1001a123
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x1001a0f3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x1001a0e5
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a14e
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xd
je 0x1001a0d7
push 4
pop esi
mov dword [esp + 0x34], 0xf5349dda
lea ecx, [esp + 0x138]
mov dword [esp + 0x34], 0x4c38db0
push esi
call fcn.10016bef
mov dword [esp + 0x14], 0x29000d4e
mov dword [esp + 0x34], edi
mov dword [esp + 0x18], ebx
jmp 0x1001a1a5
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0x3b910207
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001a18f
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 3
jg 0x1001a1d8
mov edx, 0xe7e55059
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], edx
mov dword [esp + 0x34], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x1001a1bb
lea ecx, [esp + 0x138]
call fcn.1001744a
mov dword [esp + 0x34], 0x47311ebc
lea ecx, [esp + 0x98]
mov dword [esp + 0x94], 0x71e9572a
mov dword [esp + 0x14], 0x6ec7516a
push esi
call fcn.10016bef
xor edx, edx
inc edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x34], 0xfffffffa
mov dword [esp + 0x24], 0x31966c47
mov dword [esp + 0x38], 0xfff7
mov dword [esp + 0x24], edi
mov dword [esp + 0x34], edx
mov dword [esp + 0x18], ebx
jmp 0x1001a24b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001a239
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, 0xa7b7e80d
setge dl
sub eax, edx
je 0x1001a27e
cmp dword [esp + 0x14], ebx
je 0x1001a27e
xor esi, esi
inc esi
mov edx, esi
jmp 0x1001a283
xor esi, esi
mov edx, ebx
inc esi
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x98]
setle cl
xor edx, edx
mov dword [eax], ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
neg eax
cmp esi, eax
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x98]
mov eax, dword [eax + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, dword [esp + 0x14]
jge 0x1001a30e
mov ecx, esi
cmp dword [esp + 0x24], ebx
jne 0x1001a310
mov ecx, ebx
push 0xfffffffffffffff7
pop eax
sub eax, ecx
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x98]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x98]
call fcn.1001744a
push 0x20a2
push 0x4a23
lea eax, [esp + 0x9c]
push eax
push ebx
call fcn.1001b3a4
add esp, 0x10
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1001a0a5
dec dword [esp + 0x10]
jns 0x10019e91
mov eax, dword [esp + 0x30]
dec dword [esp + 0x28]
jns 0x10019d8f
lea ecx, [esp + 0x150]
mov byte [esp + 0x204], 2
call fcn.1001744a
inc dword [esp + 0x40]
cmp dword [esp + 0x40], 0x1a
push 3
jg 0x10019adb
mov dword [esp + 0x20], 0x61ee
lea ecx, [esp + 0x68]
mov dword [esp + 0x18], 0xc8cac31e
pop eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x30], ebx
push eax
call fcn.10016bef
mov dword [esp + 0x2c], 0x785b8eeb
mov dword [esp + 0x34], 9
mov dword [esp + 0x30], 0xfffc
mov dword [esp + 0x18], ebx
jmp 0x1001a3f9
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], 0x7afff16c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001a3e6
cmp dword [esp + 0x1c], ebx
jne 0x1001a492
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edi
setl al
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x10]
jle 0x1001a469
mov eax, esi
cmp dword [esp + 0x18], ebx
jne 0x1001a46b
mov eax, ebx
cmp eax, 0xee879096
sbb eax, eax
neg eax
cmp eax, 0xad21
jne 0x1001a483
mov eax, esi
cmp dword [esp + 0x10], ebx
jne 0x1001a485
mov eax, ebx
add eax, 0x757a
cmp eax, dword [esp + 0x1c]
mov eax, ebx
je 0x1001a494
mov eax, esi
mov ecx, dword [esp + 0x10]
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setne cl
mov dword [esp + 0x30], ecx
xor ecx, ecx
cmp dword [esp + 0x30], eax
setle cl
cmp ecx, 0xfffffff8
jl 0x1001a4ca
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
add ecx, ecx
mov dword [eax + 8], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x20], ebx
jmp 0x1001a615
mov dword [esp + 0x1c], 0x7710
mov dword [esp + 0x18], esi
cmp dword [esp + 0x1c], ebx
je 0x1001a601
mov dword [esp + 0x18], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x30], 4
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 2
jg 0x1001a611
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [esp + 0x1c], ebx
jmp 0x1001a5e2
mov dword [esp + 0x24], 8
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov edx, dword [esp + 0x64]
mov eax, dword [eax + ecx*4]
mov dword [edx + esi*4], eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
neg eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp eax, 0xdeec
setge cl
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
add ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
add eax, 0xeafa
add eax, ecx
cmp eax, dword [esp + 0x18]
jne 0x1001a5c6
mov dword [esp + 0x30], 0xed9c
cmp dword [esp + 0x30], ebx
jne 0x1001a5ed
jmp 0x1001a5de
mov dword [esp + 0x18], 0x175ef58e
mov dword [esp + 0x30], ebx
inc dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x1b
jne 0x1001a538
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x1001a519
xor esi, esi
inc esi
jmp 0x1001a611
mov dword [esp + 0x30], 0xffff
mov dword [esp + 0x30], 6
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff8
je 0x1001a4e4
lea ecx, [esp + 0x64]
call fcn.1001744a
mov dword [esp + 0x34], 0xfffffffd
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x30], 0x7289
mov dword [esp + 0x10], 0x9ba87a5
mov dword [esp + 0x30], 0xde8aff65
mov dword [esp + 0x18], ebx
jmp 0x1001a667
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x44], 0xe0648261
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001a657
mov dword [esp + 0x44], ebx
jmp 0x1001a778
xor ecx, ecx
inc ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], 0x1cb6a7f4
mov dword [esp + 0x30], 0xa0a9
mov dword [esp + 0x18], ecx
mov dword [esp + 0x18], ebx
jmp 0x1001a6a8
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x78], 3
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001a698
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x44]
sub ecx, eax
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], 0xfffffff8
cmp dword [esp + 0x10], ebx
je 0x1001a701
mov eax, dword [esp + 0x24]
mov edx, 0x83f7
sub edx, eax
xor ecx, ecx
mov eax, dword [esp + 0x44]
cmp edx, eax
setge cl
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
je 0x1001a701
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1001a703
mov ecx, ebx
mov eax, dword [esp + 0x44]
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x44]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [esp + 0x78], edx
mov eax, dword [esp + 0x24]
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, 5
setl al
xor edx, edx
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
cmp ecx, eax
setl dl
sub edx, 7
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0xfffffffb
setge al
xor edx, edx
cmp eax, 0x67d3d8e1
mov eax, dword [esp + 0x34]
setne dl
xor ecx, ecx
neg edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, edi
setl al
sub eax, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
dec dword [esp + 0x44]
cmp dword [esp + 0x44], 0xffffffef
jl 0x1001a677
mov eax, dword [esp + 0x10]
mov dword [esp + 0x30], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a7a6
xor eax, eax
inc eax
push eax
push 0x4e4
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], 0xd
jl 0x100199e9
lea ecx, [esp + 0xf0]
mov dword [esp + 0x204], edi
call fcn.1001744a
mov eax, dword [esp + 0x74]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x80]
mov esi, edx
mov edi, eax
call fcn.10018cb7
mov ecx, dword [esp + 0x1fc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret