Function at 0x1000e48e
Capabilities:
Access peb ldr_data
Check os version
Create directory
Get session user name
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10071769
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2d8
push ebx
push esi
xor eax, eax
mov dword [esp + 0x98], edx
push edi
mov esi, ecx
mov dword [esp + 0x18], 3
inc eax
mov dword [esp + 0x10], 0x58b39d20
push eax
lea ecx, [esp + 0xb0]
mov dword [esp + 0x40], esi
call fcn.10009afa
xor ebx, ebx
lea ecx, [esp + 0xe4]
push 3
mov dword [esp + 0x2f0], ebx
call fcn.10009afa
xor eax, eax
lea ecx, [esp + 0xb8]
inc eax
push eax
mov byte [esp + 0x2f0], al
call fcn.10009afa
push 2
pop ecx
mov byte [esp + 0x2ec], cl
or edi, 0xffffffff
mov dword [esp + 0x30], ebx
mov dword [esp + 0x40], 0x31b54653
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 0x6d0a
mov dword [esp + 0x1c], 0x7fb90efd
mov dword [esp + 0xc], ebx
jmp 0x1000e54f
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x118], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1000e540
xor edx, edx
mov dword [esp + 0xc], ebx
inc edx
jmp 0x1000e575
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], 0xd28e4879
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1000e55f
mov dword [esp + 0xc], ebx
jmp 0x1000e597
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0xac8e4c12
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1000e581
mov dword [esp + 0xc], ebx
jmp 0x1000e5ba
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1000e5a4
push 2
mov dword [esp + 0x10], ebx
pop ecx
jmp 0x1000e5d8
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xc4], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1000e5c9
mov dword [esp + 0xc], ebx
jmp 0x1000e5f3
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xd8], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1000e5e4
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ecx
jl 0x1000eacf
push dword [esp + 0xd8]
movdqa xmm0, xmmword [0x10008080]
lea eax, [esp + 0x198]
push eax
lea eax, [esp + 0x18c]
mov dword [esp + 0x38], 9
push eax
mov dword [esp + 0x44], 0x68be135e
lea ecx, [esp + 0xac]
mov dword [esp + 0x2c], edi
mov dword [esp + 0x38], 0x60cbeb96
push ebx
movdqu xmmword [esp + 0x194], xmm0
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
call fcn.1000da92
mov byte [esp + 0x2ec], 3
mov dword [esp + 0x24], 4
mov dword [esp + 0x2c], 0x1a2f
cmp dword [esp + 0x2c], 0xb42
jge 0x1000e8a1
movdqa xmm0, xmmword [0x10008000]
mov al, bl
movdqu xmmword [esp + 0x1e0], xmm0
mov dword [esp + 0xc], eax
lea eax, [esp + 0x4c]
movdqa xmm0, xmmword [0x100080b0]
movdqu xmmword [esp + 0x1f0], xmm0
push eax
movdqa xmm0, xmmword [0x10008090]
movdqu xmmword [esp + 0x1c4], xmm0
push 0x10007814
movdqa xmm0, xmmword [0x100080a0]
movdqu xmmword [esp + 0x1d8], xmm0
call fcn.10057e4b
pop ecx
pop ecx
mov ecx, dword [esp + 0x4c]
mov edi, ebx
test ecx, ecx
jle 0x1000e718
lea esi, [esp + 0x270]
push esi
push 0x10007900
call fcn.10057e4b
pop ecx
pop ecx
mov ecx, dword [esp + 0x4c]
inc edi
add esi, 0xb
cmp edi, ecx
jl 0x1000e6ff
mov edi, ebx
test ecx, ecx
jle 0x1000e7d3
lea esi, [esp + 0x200]
push esi
push 0x10007900
call fcn.10057e4b
pop ecx
pop ecx
mov ecx, dword [esp + 0x4c]
inc edi
add esi, 0xb
cmp edi, ecx
jl 0x1000e729
test ecx, ecx
jle 0x1000e7d3
mov esi, ebx
mov dword [esp + 0x2c], ecx
lea eax, [esp + 0x200]
xor edi, edi
mov edx, ebx
add eax, esi
mov ebx, dword [esp + 0xc]
inc edi
cmp byte [edx + eax], 0x78
jne 0x1000e782
lea eax, [edx + esi]
movzx ebx, bl
cmp byte [esp + eax + 0x270], 0x2a
lea eax, [esp + 0x200]
cmove ebx, edi
add eax, esi
inc edx
cmp edx, ecx
jl 0x1000e762
add esi, 0xb
mov dword [esp + 0xc], ebx
dec dword [esp + 0x2c]
push 0
pop ebx
jne 0x1000e750
mov eax, dword [esp + 0xc]
test al, al
je 0x1000e7d3
mov esi, ebx
mov edi, ecx
lea eax, [esp + 0x270]
mov edx, ebx
add eax, esi
cmp byte [edx + eax], 0x2a
jne 0x1000e7c8
lea eax, [edx + esi]
mov byte [esp + eax + 0x200], 0x2a
lea eax, [esp + 0x270]
add eax, esi
inc edx
cmp edx, ecx
jl 0x1000e7ae
add esi, 0xb
dec edi
jne 0x1000e7a3
mov dword [esp + 0x48], ebx
test ecx, ecx
jle 0x1000e87a
lea eax, [esp + 0x200]
mov dword [esp + 0x2c], eax
mov edx, ebx
cmp byte [eax + edx], 0x78
jne 0x1000e85d
mov eax, ebx
mov edi, ebx
mov dword [esp + 0x90], eax
mov esi, dword [esp + edi + 0x1e0]
add esi, dword [esp + 0x48]
mov dword [esp + 0xc], esi
mov esi, dword [esp + edi + 0x1c0]
add esi, edx
cmp dword [esp + 0xc], 0
jl 0x1000e84a
cmp dword [esp + 0xc], ecx
jge 0x1000e84a
test esi, esi
js 0x1000e84a
cmp esi, ecx
jge 0x1000e84a
imul eax, dword [esp + 0xc], 0xb
add eax, esi
cmp byte [esp + eax + 0x270], 0x2a
mov eax, dword [esp + 0x90]
jne 0x1000e84a
inc eax
mov dword [esp + 0x90], eax
add edi, 4
cmp edi, 0x20
jl 0x1000e7fd
mov esi, dword [esp + 0x2c]
add al, 0x30
mov byte [esi + edx], al
mov eax, esi
inc edx
cmp edx, ecx
jl 0x1000e7ec
mov esi, dword [esp + 0x48]
add eax, 0xb
inc esi
mov dword [esp + 0x2c], eax
mov dword [esp + 0x48], esi
cmp esi, ecx
jl 0x1000e7ea
mov edi, ebx
test ecx, ecx
jle 0x1000e89e
lea esi, [esp + 0x200]
push esi
push 0x10007904
call fcn.10058066
inc edi
add esi, 0xb
pop ecx
pop ecx
cmp edi, dword [esp + 0x4c]
jl 0x1000e887
or edi, 0xffffffff
mov dword [esp + 0x48], edi
cmp dword [esp + 0x30], ebx
jne 0x1000e965
inc dword [esp + 0x10]
mov dword [esp + 0x2c], 0xfffffff6
cmp dword [esp + 0x2c], ebx
je 0x1000e8ee
mov eax, dword [esp + 0x10]
mov dword [esp + 0x118], eax
mov eax, dword [esp + 0xac]
mov dword [eax], edi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
dec ecx
je 0x1000e8ee
xor esi, esi
inc esi
mov edx, esi
jmp 0x1000e8f3
xor esi, esi
mov edx, ebx
inc esi
add edx, 0xffff0001
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0xe4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [eax]
mov eax, dword [esp + 0x18]
cmp edx, eax
setle cl
cmp ecx, dword [esp + 0x30]
jne 0x1000e927
mov edx, esi
cmp dword [esp + 0x124], ebx
jne 0x1000e929
mov edx, ebx
mov eax, dword [esp + 0xb8]
xor ecx, ecx
cmp edx, 0xd67a
setg cl
mov dword [eax], edx
xor edx, edx
mov eax, dword [esp + 0xe4]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x776e9f81
jle 0x1000e965
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x1000e96a
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [esp + 0x18]
imul eax, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xa0]
cmp dword [eax], ebx
je 0x1000e9b3
mov eax, dword [esp + 0x124]
xor edx, edx
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0xa0]
setle dl
mov dword [eax + 8], edx
jmp 0x1000ea93
mov dword [esp + 0x30], 0x13735ca7
lea ecx, [esp + 0x128]
mov dword [esp + 0x2c], 0x9ce07b88
push edx
call fcn.10009afa
xor edx, edx
mov dword [esp + 0x20], ebx
inc edx
jmp 0x1000e9ef
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1000e9d9
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xac]
mov dword [eax], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x38], ebx
je 0x1000ea18
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x124]
xor edx, edx
mov dword [esp + 0x120], ebx
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
mov esi, dword [esp + 0x48]
sub esi, eax
mov eax, dword [esp + 0xb8]
mov dword [eax], esi
mov dword [esp + 0xc4], esi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setle dl
xor eax, eax
neg edx
cmp esi, 0xba43
setg al
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x128]
push eax
setg cl
mov dword [eax], ecx
call fcn.100581d7
mov eax, dword [esp + 0xa4]
pop ecx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
push eax
mov byte [esp + 0x2f0], 2
call fcn.100581d7
pop ecx
push 2
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
inc dword [esp + 0x1c]
pop eax
cmp dword [esp + 0x18], eax
jge 0x1000e607
mov esi, dword [esp + 0x3c]
xor edx, edx
inc edx
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x1c]
test eax, eax
jne 0x1000eb38
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xb8]
mov dword [eax], ecx
mov dword [esp + 0x124], ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x124]
cmp eax, dword [esp + 0x40]
jl 0x1000eb07
mov eax, dword [esp + 0x120]
mov eax, dword [esp + 0x124]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc4]
mov eax, dword [esp + 0xc4]
cmp eax, edx
mov eax, dword [esp + 0xac]
setg cl
mov dword [eax], ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc4]
cmp dword [esp + 0xb8], 0
mov dword [esp + 0xc4], eax
je 0x1000eb72
push dword [esp + 0xb8]
call fcn.100581d7
pop ecx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
cmp dword [esp + 0xe4], 0
je 0x1000eb9e
push dword [esp + 0xe4]
call fcn.100581d7
pop ecx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
mov dword [esp + 0x2ec], edi
cmp dword [esp + 0xac], 0
je 0x1000ebd1
push dword [esp + 0xac]
call fcn.100581d7
pop ecx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0xb4], ebx
cmp dword [esi + 0x10], ebx
jne 0x1000ebdd
xor al, al
jmp 0x1000fab6
push 2
pop eax
mov dword [esp + 0x1c], 0xfffffffb
lea ecx, [esp + 0xf4]
mov dword [esp + 0x18], ebx
push eax
call fcn.10009afa
mov dword [esp + 0x38], edi
mov dword [esp + 0x24], 0xfffffff9
mov dword [esp + 0x24], 0x145b
cmp dword [esp + 0x24], 0x555
jge 0x1000ec9f
lea eax, [esp + 0x148]
push eax
lea eax, [esp + 0x148]
push eax
lea eax, [esp + 0x140]
push eax
push 0x10007908
call fcn.10057e4b
movd xmm1, dword [esp + 0x148]
add esp, 0x10
movd xmm0, dword [esp + 0x148]
mov eax, ebx
cvtdq2pd xmm0, xmm0
cvtdq2pd xmm1, xmm1
mulsd xmm1, xmm0
movd xmm0, dword [esp + 0x144]
cvtdq2pd xmm0, xmm0
divsd xmm1, qword [0x10007fd0]
comisd xmm1, xmm0
jbe 0x1000ec92
subsd xmm1, xmm0
cvttsd2si eax, xmm1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
comisd xmm1, xmm0
jbe 0x1000ec92
inc eax
push eax
push 0x1000781c
call fcn.10058066
pop ecx
pop ecx
push 2
mov dword [esp + 0x24], ebx
pop edx
jmp 0x1000ecba
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1000eca8
mov dword [esp + 0x1c], 0x16
jmp 0x1000ed43
mov dword [esp + 0x10], 0xffab8c3a
mov dword [esp + 0x24], 9
mov dword [esp + 0x28], 0xb78acc4b
mov dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x10]
add ecx, dword [esp + 0x18]
cmp dword [esp + 0x24], 3
mov eax, dword [esp + 0xf4]
mov dword [eax], ecx
je 0x1000ed11
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
je 0x1000ed11
xor eax, eax
inc eax
jmp 0x1000ed13
mov eax, ebx
mov ecx, dword [esp + 0x10]
xor edx, edx
add ecx, eax
imul eax, dword [esp + 0x10], 0x314a
cmp ecx, eax
mov ecx, dword [esp + 0xf4]
setl dl
sub edx, dword [ecx]
neg edx
sbb edx, edx
xor eax, eax
inc edx
test edx, edx
setle al
mov dword [ecx], eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x1000ecca
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x18], ebx
je 0x1000ed65
mov eax, dword [esp + 0x18]
shl eax, 3
test eax, eax
je 0x1000ed65
xor eax, eax
lea esi, [eax + 1]
jmp 0x1000ed67
mov esi, ebx
mov dword [esp + 0x1c], 8
xor ecx, ecx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xf4]
mov dword [eax + 4], edx
mov eax, dword [esp + 0x38]
cmp esi, eax
push dword [esp + 0xf4]
setge cl
xor eax, eax
cmp ecx, 0x4465
setg al
sub edx, eax
mov dword [esp + 0x1c], edx
call fcn.100581d7
xor eax, eax
mov dword [esp + 0xf8], ebx
pop ecx
inc eax
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
lea ecx, [esp + 0xcc]
mov dword [esp + 0x1c], 0x971c
mov dword [esp + 0x28], edi
push eax
call fcn.10009afa
mov dword [esp + 0x24], 0x857b1a09
xor edx, edx
mov dword [esp + 0x10], 0xeb61943e
inc edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x38], 0x97fb
mov dword [esp + 0x24], 0xc6aa
mov dword [esp + 0x20], ebx
jmp 0x1000ee1a
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 0x6548aab5
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1000ee04
cmp dword [esp + 0x1c], ebx
jne 0x1000ee4f
mov eax, dword [esp + 0x1c]
dec eax
neg eax
sbb eax, eax
neg eax
add eax, dword [esp + 0x1c]
jne 0x1000ee4f
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], al
je 0x1000efbc
call fcn.1000de21
jmp 0x1000efbc
mov dword [esp + 0x18], 0xfffffff7
mov dword [esp + 0x20], 0x5d73
mov dword [esp + 0x30], 0xfffffffd
mov dword [esp + 0xc], ebx
jmp 0x1000ee80
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x14c], 0xfffffff6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1000ee6d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xcc]
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
sub ecx, eax
imul ecx, dword [esp + 0x20]
cmp ecx, edx
je 0x1000eeab
mov eax, edx
cmp dword [esp + 0x20], ebx
jne 0x1000eead
mov eax, ebx
mov dword [esp + 0x24], eax
xor edx, edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov dword [esp + 0x18], edi
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
add eax, ecx
mov dword [esp + 0x14c], eax
mov ecx, dword [esp + 0x10]
imul ecx, eax
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
setle dl
mov dword [esp + 0x24], edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x28]
setle dl
xor ecx, ecx
cmp edx, dword [esp + 0x24]
setge cl
sub eax, ecx
mov ecx, dword [esp + 0x1c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x18], 0x594484f7
cmp dword [esp + 0x18], 0x5c2f4fe1
jl 0x1000efa7
mov eax, dword [esp + 0x14c]
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
sub eax, 9
jne 0x1000ef5b
cmp dword [esp + 0x1c], ebx
jne 0x1000ef5b
xor esi, esi
mov ecx, ebx
inc esi
jmp 0x1000ef60
xor esi, esi
inc esi
mov ecx, esi
mov eax, dword [esp + 0x18]
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x14c]
add ecx, eax
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0xcc]
setg dl
mov dword [eax], edx
inc edx
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [esp + 0x14c], edx
mov eax, dword [esp + 0x38]
cmp edx, eax
mov edx, esi
setg cl
cmp ecx, dword [esp + 0x30]
jg 0x1000efa9
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [esp + 0x38]
mov dword [esp + 0x24], ecx
cmp dword [esp + 0xcc], 0
je 0x1000efe8
push dword [esp + 0xcc]
call fcn.100581d7
pop ecx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
push dword [esp + 0xd8]
movdqa xmm0, xmmword [0x10008010]
lea eax, [esp + 0x1a8]
push eax
lea eax, [esp + 0x19c]
mov dword [esp + 0x20], 0x77e8edf1
push eax
push ebx
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], ebx
movdqu xmmword [esp + 0x1a4], xmm0
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
call fcn.1000da92
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [esp + 0x18], ebx
je 0x1000f0a9
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000f08d
push 0x12c8
push ebx
push 0x177b
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
jmp 0x1000f08d
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000f0a0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0x80]
jmp 0x1000f0fd
mov dword [esp + 0x24], 0x9989d221
mov dword [esp + 0x18], 0x14
jmp 0x1000f0e8
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x1000f0dd
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x80]
cmp dword [eax + ecx*4], ebx
jne 0x1000f0e4
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jle 0x1000f0c9
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xa
je 0x1000f0bb
mov ecx, dword [esp + 0x80]
mov eax, dword [ecx + 8]
mov dword [esp + 0x24], eax
test ecx, ecx
je 0x1000f11d
push ecx
call fcn.100581d7
pop ecx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
lea ecx, [esp + 0x9c]
call fcn.1000de34
mov dword [esp + 0xc], 0x4768
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], ebx
jmp 0x1000f147
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x50], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1000f13b
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000f170
push 0x19a9
push 0xe18
push ebx
push ebx
push 0x1564
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x50]
cmp eax, dword [esp + 0x58]
jl 0x1000f186
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0xc]
sub ecx, eax
cmp ecx, dword [esp + 0xc]
je 0x1000f2ab
push 3
lea ecx, [esp + 0x104]
call fcn.10009afa
mov dword [esp + 0x10], ebx
jmp 0x1000f1ec
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0xb0d5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1000f1d6
mov dword [esp + 0xc], 8
cmp dword [esp + 0xc], 0x17
jne 0x1000f276
push 2
pop eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
jl 0x1000f232
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000f229
push ebx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
dec dword [esp + 0x1c]
jns 0x1000f217
push 2
pop eax
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], eax
jg 0x1000f26b
mov esi, dword [esp + 0x100]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000f25e
xor eax, eax
inc eax
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
push 2
pop eax
inc dword [esi + 4]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x1000f243
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x17
je 0x1000f205
cmp dword [esp + 0x100], 0
je 0x1000f377
push dword [esp + 0x100]
call fcn.100581d7
pop ecx
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
jmp 0x1000f377
mov dword [esp + 0x40], 0xfffffff7
mov dword [esp + 0x20], 0x7f668cde
mov dword [esp + 0x10], ebx
jmp 0x1000f2d4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1a4], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1000f2c1
mov dword [esp + 0xc], ebx
jmp 0x1000f36c
mov dword [esp + 0x10], 0x3e8af804
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000f309
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [esp + 0x50]
xor edx, edx
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x40]
imul ecx, dword [esp + 0x20], 0x91c6
mov eax, dword [esp + 0x20]
cmp ecx, eax
setle dl
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1ac], eax
test eax, eax
jne 0x1000f361
cmp dword [esp + 0x54], ebx
jne 0x1000f361
mov eax, ebx
jmp 0x1000f364
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x39
jge 0x1000f2e4
push 2
mov dword [esp + 0x20], 0xc184c506
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x1000f39b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x164], 0xb57f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1000f388
xor edx, edx
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x1000f3c4
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + eax*4 + 0x164]
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x164], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x1000f3aa
mov eax, dword [esp + 0x3c]
cmp dword [eax + 0x14], 0x10
jb 0x1000f3d8
mov ecx, dword [eax]
jmp 0x1000f3da
mov ecx, eax
cmp dword [eax + 0x14], 0x10
mov dword [esp + 0x8c], ecx
jb 0x1000f3eb
mov edx, dword [eax]
jmp 0x1000f3ed
mov edx, eax
mov eax, dword [eax + 0x10]
add eax, edx
cmp ecx, eax
je 0x1000f650
mov al, byte [ecx]
cmp al, 0x30
jl 0x1000f4ea
cmp al, 0x39
jg 0x1000f4ea
mov dword [esp + 0x20], 0xfffffffc
xor ecx, ecx
mov dword [esp + 0x24], 0xf0415773
inc ecx
mov dword [esp + 0x10], ebx
jmp 0x1000f435
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], 0xfb6f65e7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1000f425
mov eax, dword [esp + 0x44]
xor edx, edx
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x44]
cmp ecx, eax
mov eax, dword [esp + 0x44]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x44]
setge cl
xor edx, edx
cmp ecx, eax
setge dl
mov dword [esp + 0x44], edx
mov eax, dword [esp + 0x20]
imul eax, edx
test eax, eax
jne 0x1000f477
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
push 2
pop ecx
cmp ecx, eax
mov eax, dword [esp + 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setl dl
add edx, dword [esp + 0x20]
mov dword [esp + 0x24], edx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000f4b1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [esp + 0x8c]
push eax
push ebx
push 0x4593
push 0x7c91
lea eax, [esp + 0xac]
push 0x4e3
push eax
call fcn.10014374
mov ecx, dword [esp + 0xa4]
add esp, 0x18
mov eax, dword [esp + 0x3c]
inc ecx
jmp 0x1000f3da
mov eax, 0x3b26bdde
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0x28], 8
mov dword [esp + 0x28], 0xfffffffa
mov dword [esp + 0x10], ebx
jmp 0x1000f528
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1b0], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1000f515
mov dword [esp + 0x74], ebx
cmp dword [esp + 0x74], 0xffffffec
jl 0x1000f642
mov esi, 0x15fb26c4
push 2
pop ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x16c], esi
mov dword [esp + 0x170], esi
mov dword [esp + 0x174], esi
mov dword [esp + 0x178], esi
mov dword [esp + 0x10], ebx
jmp 0x1000f57b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xdc], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1000f56c
mov eax, dword [esp + 0x70]
xor edx, edx
mov dword [esp + 0x1b0], eax
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x6c]
cmp eax, ecx
mov eax, dword [esp + 0x74]
setne dl
xor ecx, ecx
add edx, 5
cmp edx, eax
mov eax, dword [esp + 0xdc]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x74]
setge dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0xdc]
mov eax, dword [esp + 0xe0]
setl cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x74]
sub ecx, eax
mov eax, dword [esp + 0xdc]
imul eax, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xdc]
cmp dword [esp + 0x6c], eax
jg 0x1000f627
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1000f61e
call fcn.1000e009
mov dword [esp + 0x16c], ebx
jmp 0x1000f633
mov dword [esp + 0x24], 0x9192
mov dword [esp + 0x24], ebx
dec dword [esp + 0x74]
cmp dword [esp + 0x74], 0xffffffec
jge 0x1000f543
mov eax, dword [esp + 0x9c]
mov dword [eax], ebx
jmp 0x1000ebd6
xor eax, eax
lea ecx, [esp + 0x10c]
inc eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], 0x336de018
push 2
mov dword [esp + 0xf4], 0x5bfb66fe
mov dword [esp + 0x138], eax
pop eax
push eax
call fcn.10009afa
push 4
pop esi
push 2
mov dword [esp + 0x2f0], esi
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1000f6b4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1000f69e
cmp dword [esp + 0x34], ebx
je 0x1000f70a
mov eax, dword [esp + 0x34]
mov dword [esp + 0x94], eax
mov eax, dword [esp + 0x94]
cmp dword [esp + 0x34], eax
jle 0x1000f6e5
cmp dword [esp + 0x34], ebx
jne 0x1000f6e5
xor ecx, ecx
mov eax, ebx
inc ecx
jmp 0x1000f6ea
xor ecx, ecx
inc ecx
mov eax, ecx
cmp eax, 6
sbb eax, eax
neg eax
mov dword [esp + 0x98], eax
mov eax, dword [esp + 0x98]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
dec eax
jne 0x1000f70c
mov ecx, ebx
mov eax, dword [esp + 0x34]
xor edx, edx
cmp edx, eax
mov eax, dword [esp + 0x34]
sbb edx, edx
add eax, ecx
xor ecx, ecx
inc edx
cmp edx, eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x98]
sete cl
push eax
lea eax, [esp + 0xa0]
mov dword [esp + 0xf8], ecx
push eax
lea eax, [esp + 0x118]
push eax
lea edx, [esp + 0x100]
lea ecx, [esp + 0x144]
call fcn.1000e12a
or dword [esp + 0x2fc], 0xffffffff
add esp, 0x10
cmp dword [esp + 0x10c], 0
je 0x1000f792
push dword [esp + 0x10c]
call fcn.100581d7
pop ecx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], ebx
xor eax, eax
mov dword [esp + 0xc], 0x6fe7d8a8
inc eax
lea ecx, [esp + 0x158]
push eax
call fcn.10009afa
mov dword [esp + 0x24], 0x596def04
mov dword [esp + 0x18], ebx
jmp 0x1000f7c8
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x5c], 0x540d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1000f7b8
xor edx, edx
mov dword [esp + 0x18], ebx
inc edx
jmp 0x1000f7ed
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 0xa58de38
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1000f7d7
mov dword [esp + 0xc], ebx
jmp 0x1000fa91
mov dword [esp + 0x18], 0x5b3b9da4
mov dword [esp + 0x20], 0x33c8a0c0
mov dword [esp + 0x3c], 0x61e9426
mov dword [esp + 0x38], 0xbeba
mov dword [esp + 0x18], 3
cmp dword [esp + 0x18], ebx
jl 0x1000fa8d
mov dword [esp + 0x1c], 0xffffffff
push 2
mov dword [esp + 0x14], 0xe4c12f69
mov dword [esp + 0x20], ebx
pop ecx
jmp 0x1000f85a
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x13c], 5
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1000f847
mov dword [esp + 0x1c], ebx
jmp 0x1000f879
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x17c], 0xdb4546b7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1000f866
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x5c], ecx
mov dword [esp + 0x1c], 3
cmp dword [esp + 0x1c], ebx
jl 0x1000fa83
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], edx
xor edx, edx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x5c], ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x60]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x5c]
sub edx, eax
mov eax, dword [esp + 0x18]
cmp edx, eax
mov eax, dword [esp + 0xc]
setge cl
cmp ecx, dword [esp + eax*4 + 0x5c]
jle 0x1000f901
cmp dword [esp + 0x24], ebx
jne 0x1000f901
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
cmp eax, ecx
setge dl
mov dword [esp + 0x140], edx
mov eax, dword [esp + 0xc]
sub edx, eax
sub edx, 0xfffffff9
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x1c]
test eax, eax
jne 0x1000f96b
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0x5c], ebx
jne 0x1000f96b
xor ecx, ecx
mov eax, ebx
inc ecx
jmp 0x1000f970
xor ecx, ecx
inc ecx
mov eax, ecx
cmp eax, dword [esp + 0xc]
jg 0x1000f97a
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x13c], ebx
je 0x1000f9f8
mov dword [esp + 0x20], 0x14
jmp 0x1000f9ef
mov edx, dword [esp + 0x140]
mov eax, dword [esp + 0xc]
neg edx
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, 0xb39
setle cl
xor eax, eax
add ecx, dword [esp + 0x60]
cmp edx, ecx
sete al
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
jle 0x1000f9da
cmp dword [esp + 0xc], ebx
je 0x1000f9da
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1000f9dc
mov ecx, ebx
xor eax, eax
cmp ecx, 0x7d38
setle al
mov dword [esp + 0x28], eax
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0x13
je 0x1000f991
jmp 0x1000fa76
mov dword [esp + 0x10], ebx
jmp 0x1000fa0a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x7c], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1000f9fe
cmp dword [esp + 0xc], ebx
je 0x1000fa1a
mov eax, dword [esp + 0x7c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
mov edx, dword [esp + 0x180]
sub edx, eax
mov eax, dword [esp + 0x7c]
sub edx, eax
mov eax, dword [esp + 0x7c]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x158]
setge cl
sub ecx, 0x451c
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [esp + 0x10], ecx
dec dword [esp + 0x1c]
push 1
pop edx
jns 0x1000f8a1
dec dword [esp + 0x18]
jns 0x1000f82e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jle 0x1000f7fc
cmp dword [esp + 0x158], 0
je 0x1000fab3
push dword [esp + 0x158]
call fcn.100581d7
pop ecx
xor eax, eax
inc eax
mov ecx, dword [esp + 0x2e4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret