Function at 0x10030fbf
Capabilities:
Create pipe
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007dc37
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf8
push ebx
push esi
push edi
push 2
mov esi, ecx
mov dword [esp + 0x54], edx
pop edi
push edi
lea ecx, [esp + 0xcc]
mov dword [esp + 0x38], esi
call fcn.10024520
mov dword [esp + 0x14], 0xeef20fe6
xor ebx, ebx
mov dword [esp + 0x2c], 0xfffffffd
mov dword [esp + 0x14], ebx
jmp 0x1003102b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 0x571177e8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10031015
mov dword [esp + 0x14], ebx
jmp 0x10031047
mov dword [esp + 0x28], 0x363f
inc dword [esp + 0x28]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jle 0x10031037
lea ecx, [esp + 0xc8]
call fcn.100245d2
mov dword [esp + 0x68], 0x4a8c6a53
mov dword [esp + 0x5c], 0xfffffff9
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x10031086
push ebx
push 0x1d0e
push 0x20f3
push ebx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push 0x1891
lea eax, [esp + 0x60]
push eax
push 0x1ecd
lea eax, [esp + 0x74]
push ebx
push eax
call fcn.1003466d
mov dword [esp + 0x24], 0x7e17
add esp, 0x14
mov dword [esp + 0x20], 0xa7525d2d
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x30], 4
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100310dd
push 0x21d1
push 0x114f
call dword [sym.imp.USER32.dll_SetCaretPos]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x18], ebx
jne 0x100310ff
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
setg dl
mov dword [esp + 0x24], edx
xor edx, edx
cmp ecx, eax
setge dl
xor eax, eax
cmp dword [esp + 0x24], edx
setle al
sub eax, dword [esp + 0x30]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], 0xfffffffd
jl 0x10031181
mov dword [esp + 0x24], 0x4ddc8777
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1003115d
push 0x86d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [esp + 0x20], 1
cmp dword [esp + 0x20], 0x89d9e62b
mov eax, dword [esp + 0x10]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
mov dword [esp + 0x24], ecx
jmp 0x100311b1
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100311b1
push ebx
push 0x383
push 0xaee
push 0x7f5
push 0x1435
push 0xa7b
push 0x15d5
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
cmp dword [esi + 0x10], ebx
jne 0x100311bd
xor al, al
jmp 0x10031bf0
push edi
lea ecx, [esp + 0xac]
call fcn.10024520
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x2c], 0xedfa
mov dword [esp + 0x10], ebx
jmp 0x100311f2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xf4], 0x85f70ad6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x100311df
mov dword [esp + 0x10], ebx
jmp 0x10031215
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], 0x20f89b54
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100311ff
mov eax, dword [esp + 0xa8]
mov dword [esp + 0x30], eax
mov dword [eax + 4], ebx
mov dword [esp + 0x18], 9
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1003124d
push ebx
push ebx
push 0xf14
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], ebx
jl 0x100313ce
mov dword [esp + 0x20], 0xd962ee6d
lea ecx, [esp + 0x84]
push 3
call fcn.10024520
mov dword [esp + 0x14], ebx
jmp 0x1003128d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x84]
mov dword [eax + ecx*4], 0xa9f8d19c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10031277
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100312a6
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
mov dword [esp + 0x20], edi
cmp dword [esp + 0x20], ebx
jl 0x100313b4
mov dword [esp + 0x1c], 5
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], ebx
jl 0x100313aa
mov dword [esp + 0x14], 0x3631e19e
mov dword [esp + 0x48], 0x17a68fa
inc dword [esp + 0x14]
mov dword [esp + 0x14], ebx
jmp 0x10031396
mov dword [esp + 0x10], 0xfffffffb
mov dword [esp + 0x28], 0xe11914cc
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], ebx
jl 0x1003138e
mov edi, dword [esp + 0x84]
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0xf4], ebx
jne 0x10031323
cmp dword [esp + 0x10], ebx
jne 0x10031323
mov esi, ebx
jmp 0x10031326
xor esi, esi
inc esi
mov dword [esp + 0x28], 0x3b15a8d
cmp dword [esp + 0x28], 1
jne 0x10031340
cmp dword [esp + 0x18], ebx
je 0x10031340
xor eax, eax
inc eax
jmp 0x10031342
mov eax, ebx
xor edx, edx
cmp eax, 7
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 0x8e60
jle 0x10031367
cmp dword [esp + 0x14], ebx
jne 0x10031367
mov eax, ebx
jmp 0x1003136a
xor eax, eax
inc eax
add eax, esi
mov dword [edi + 4], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10031385
push 0x1d7f
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
dec dword [esp + 0x10]
jns 0x1003130c
push 2
pop edi
dec dword [esp + 0x48]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x100312e7
dec dword [esp + 0x1c]
jns 0x100312ca
dec dword [esp + 0x20]
jns 0x100312b4
lea ecx, [esp + 0x84]
call fcn.100245d2
dec dword [esp + 0x18]
jns 0x1003125b
mov eax, dword [esp + 0x30]
inc dword [eax + 4]
cmp dword [eax + 4], edi
jle 0x10031229
or esi, 0xffffffff
lea ecx, [esp + 0xa8]
mov dword [esp + 0x10c], esi
call fcn.100245d2
mov eax, dword [esp + 0x50]
lea ecx, [esp + 0x9c]
push 3
mov dword [eax], ebx
mov dword [esp + 0x44], 0x76820624
call fcn.10024520
push ebx
lea eax, [esp + 0x64]
mov dword [esp + 0x110], 1
push eax
lea eax, [esp + 0xa4]
push eax
call fcn.10034145
add esp, 0xc
mov dword [esp + 0x40], 0xd
jmp 0x10031442
push ebx
call fcn.10031c43
inc dword [esp + 0x44]
pop ecx
cmp dword [esp + 0x40], 0x17
jge 0x10031437
lea eax, [esp + 0x9c]
push eax
push 0x6e28
push 0x2a36
push 0x3f0a
push 0x364b
push 0x4415
push 0x6f5a
push 0x693
push 0x7001
push 0x34e7
push 0x79d
push 0x30d
push ebx
lea eax, [esp + 0x74]
push 0x1c73
push eax
call fcn.10034a13
add esp, 0x3c
mov dword [esp + 0x10c], esi
lea ecx, [esp + 0x9c]
call fcn.100245d2
mov dword [esp + 0x2c], esi
mov dword [esp + 0x2c], 0x8a6b950b
mov dword [esp + 0x30], esi
mov dword [esp + 0x18], ebx
jmp 0x100314d4
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x3c], 0xc75b57fd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x100314c4
push 0xfffffffffffffff8
mov dword [esp + 0x40], ebx
pop eax
jmp 0x1003154d
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
inc dword [esp + 0x30]
cmp dword [esp + 0x3c], ebx
je 0x10031536
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10031549
push ebx
push 0x13e9
push ebx
push 0x1980
push 0x13df
call dword [sym.imp.GDI32.dll_ExtCreatePen]
jmp 0x10031546
mov dword [esp + 0x28], 0xaf42
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
push 0xfffffffffffffff8
pop eax
dec dword [esp + 0x3c]
cmp dword [esp + 0x3c], 0xffffffef
jne 0x100314e4
mov eax, dword [esp + 0x34]
cmp dword [eax + 0x14], 0x10
jb 0x10031562
mov esi, dword [eax]
jmp 0x10031564
mov esi, eax
cmp dword [eax + 0x14], 0x10
jb 0x1003156e
mov ecx, dword [eax]
jmp 0x10031570
mov ecx, eax
mov eax, dword [eax + 0x10]
add eax, ecx
cmp esi, eax
je 0x10031a34
push 3
lea ecx, [esp + 0xb8]
call fcn.10024520
push 0x2542
push 0x204b
push 0x59b2
push 0x30e9
push 0x370e
lea eax, [esp + 0xc8]
mov dword [esp + 0x120], edi
push eax
push 0x7886
push 0x211a
push 0x5d55
lea eax, [esp + 0x68]
mov dword [esp + 0x34], 0x394643cd
push eax
mov dword [esp + 0x4c], 0x25189d9e
mov dword [esp + 0x54], 0xafa0b2b0
mov dword [esp + 0x54], 0x875f
push ebx
call fcn.10033f88
add esp, 0x2c
mov dword [esp + 0x44], ebx
jmp 0x10031606
mov eax, dword [esp + 0x44]
mov dword [esp + eax*4 + 0x64], 0x457a23a
inc dword [esp + 0x44]
cmp dword [esp + 0x44], 1
jl 0x100315f6
mov dword [esp + 0x10], ebx
jmp 0x10031757
mov dword [esp + 0x30], 0xcd49
mov dword [esp + 0x14], 0x1874da8
mov dword [esp + 0x2c], 0xfffffffd
mov dword [esp + 0x28], 0xd3b0
mov dword [esp + 0x18], ebx
jmp 0x1003164c
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x58], 0x47f59ec1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1003163c
cmp dword [esp + 0x30], ebx
je 0x10031679
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x10]
jg 0x10031679
xor eax, eax
inc eax
jmp 0x1003167b
mov eax, ebx
add eax, 0x87a7
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0x5ebd
test eax, eax
je 0x1003169b
cmp dword [esp + 0x10], ebx
je 0x1003169b
xor edx, edx
inc edx
jmp 0x1003169d
mov edx, ebx
mov ecx, dword [esp + 0xb4]
mov eax, dword [ecx + 4]
imul eax, edx
mov dword [esp + 0x58], eax
imul eax, eax, 0xcec7
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp dword [ecx + 8], eax
mov eax, dword [esp + 0x30]
sete dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [esp + 0x24], ecx
mov dword [esp + 0x14], ebx
jmp 0x1003174d
push dword [esp + 0x60]
movdqa xmm0, xmmword [0x10007e90]
lea eax, [esp + 0xf8]
push eax
lea eax, [esp + 0xec]
mov dword [esp + 0x34], 0x40f213ed
push eax
mov dword [esp + 0x38], 0xa0435e45
lea ecx, [esp + 0x78]
mov dword [esp + 0x38], 0x6c8c
push ebx
movdqu xmmword [esp + 0xf4], xmm0
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
call fcn.1002573b
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x6c]
mov dword [esp + eax*4 + 0x58], 0x78b15b45
inc dword [esp + 0x28]
call fcn.100245d2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x100316d7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x10031616
mov dword [esp + 0x64], 0xe161e417
lea ecx, [esp + 0xb4]
or dword [esp + 0x10c], 0xffffffff
call fcn.100245d2
mov al, byte [esi]
cmp al, 0x30
jl 0x100317f9
cmp al, 0x39
jg 0x100317f9
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], 0xfffffff2
jmp 0x100317b9
push 0x2c1d
lea eax, [esp + 0x3f]
mov byte [esp + 0x3f], bl
push eax
push ebx
push 0x42cb
call fcn.10031f19
add esp, 0x10
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff8
jl 0x10031799
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100317de
push ebx
push 0x2405
push 0x55ed
call fcn.10034799
add esp, 0xc
mov edx, dword [esp + 0x50]
movsx eax, byte [esi]
imul ecx, dword [edx], 0xa
add ecx, 0xffffffd0
add eax, ecx
inc esi
mov dword [edx], eax
mov eax, dword [esp + 0x34]
jmp 0x10031564
push 0x9b8
push 0x1424
push 0x174e
lea eax, [esp + 0x5c]
push eax
push 0x596c
push ebx
push 0x7509
push 0x12f3
call fcn.10031cdb
mov dword [esp + 0x30], 0xfffa
lea ecx, [esp + 0x98]
mov dword [esp + 0x38], 0x19716e28
add esp, 0x20
mov dword [esp + 0x20], 9
xor eax, eax
inc eax
mov dword [esp + 0x48], 0x5fef4072
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], 0xde726f2c
mov dword [esp + 0x28], 0xfff8
push eax
call fcn.10024520
mov dword [esp + 0x14], 0xd85d5fca
xor edx, edx
inc edx
mov dword [esp + 0x30], edx
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x34], 0x7898a801
mov dword [esp + 0x24], 0xfffffffc
mov dword [esp + 0x24], edx
mov dword [esp + 0x24], 0xffff
mov dword [esp + 0x1c], ebx
jmp 0x100318ae
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x54], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x100318a2
mov dword [esp + 0x1c], ebx
jmp 0x100318cd
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x78]
mov dword [eax + ecx*4], 0xfffc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x100318ba
mov dword [esp + 0x1c], ebx
jmp 0x100318e8
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xc0], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x100318d9
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setne dl
xor ecx, ecx
sub eax, edx
cmp eax, 0x44fa3fda
setge cl
xor edx, edx
mov dword [esp + 0x18], ecx
inc edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x20], edx
jge 0x10031932
mov eax, ebx
cmp dword [esp + 0x20], ebx
je 0x10031934
mov eax, edx
xor ecx, ecx
cmp eax, 0x27eed050
setge cl
xor eax, eax
sub ecx, dword [esp + 0x48]
cmp ecx, 0xcc9d
setl al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x34], 7
mov eax, dword [esp + 0x34]
imul eax, dword [esp + 0x10]
test eax, eax
je 0x1003198a
mov eax, edx
cmp dword [esp + 0x10], ebx
jne 0x1003198c
mov eax, ebx
cmp eax, dword [esp + 0x20]
jge 0x10031998
cmp dword [esp + 0x10], ebx
je 0x1003199a
mov ebx, edx
mov dword [esp + 0x54], ebx
xor edx, edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x78]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x30]
add ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
cmp ecx, eax
mov eax, dword [esp + 0x78]
setge dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [esp + 0x48]
setge cl
sub ecx, eax
mov eax, dword [esp + 0x2c]
cmp ecx, 0xfff6
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x28], 1
jl 0x100319fc
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x54]
xor ecx, ecx
cmp eax, 0x53bc
setl cl
cmp ecx, 0xfffffff7
jle 0x10031a13
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x78]
mov eax, dword [esp + 0x28]
mov dword [esp + 0xc0], eax
dec dword [esp + 0x24]
call fcn.100245d2
jmp 0x100311b6
mov dword [esp + 0x14], 0xfffffffc
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x10031a5a
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x4c], 0x2799ac78
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10031a4a
mov dword [esp + 0x14], ebx
jmp 0x10031bcb
mov dword [esp + 0x1c], 0xf38c0887
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x4c], ebx
je 0x10031abd
mov dword [esp + 0x20], 0xc7555b7c
mov dword [esp + 0x2c], 4
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x10031b83
mov dword [esp + 0x2c], 0x5f0b
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x2c], 1
dec dword [esp + 0x20]
jns 0x10031a9a
jmp 0x10031b83
mov dword [esp + 0x20], 0xfffffffd
lea ecx, [esp + 0x90]
push edi
call fcn.10024520
mov dword [esp + 0x18], ebx
jmp 0x10031aeb
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x90]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10031ad8
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x20]
jne 0x10031b0d
mov eax, dword [esp + 0x4c]
cmp dword [esp + 0x20], 0xfbde283b
ja 0x10031b0d
mov edx, ebx
jmp 0x10031b10
xor edx, edx
inc edx
mov eax, dword [esp + 0x4c]
xor ecx, ecx
cmp eax, edx
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
setl cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x10], ecx
mov dword [esp + 0x1c], ebx
jmp 0x10031b71
mov dword [esp + 0x24], 0xbfe7
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jne 0x10031b53
cmp dword [esp + 0x10], ebx
jne 0x10031b53
mov eax, ebx
jmp 0x10031b56
xor eax, eax
inc eax
xor ecx, ecx
cmp eax, 0xffffffff
mov eax, dword [esp + 0x90]
setne cl
mov dword [eax], ecx
cmp dword [esp + 0x14], ebx
jne 0x10031b77
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jle 0x10031b37
lea ecx, [esp + 0x90]
call fcn.100245d2
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x10031bc7
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x10031ba7
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0x4c], ebx
jne 0x10031ba7
dec dword [esp + 0x10]
jns 0x10031b97
mov dword [esp + 0x10], ebx
jmp 0x10031bbb
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x4c], ebx
jne 0x10031bc1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10031bad
dec dword [esp + 0x1c]
jns 0x10031b8d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x10031a6a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10031bee
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
mov al, 1
mov ecx, dword [esp + 0x104]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret