Function at 0x100176be
Capabilities:
Extract resource via kernel32 functions
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006ca30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c0
push ebx
push esi
mov dword [esp + 0x54], ecx
mov esi, edx
push edi
mov dword [esp + 0x1c], 0xfffffff6
xor ebx, ebx
push 2
mov dword [esp + 0x14], 0xb0121307
mov dword [esp + 0x58], esi
mov dword [esp + 0x24], ebx
pop ecx
jmp 0x10017713
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x4c], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x10017707
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x1001772a
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esp + 0x1c], ebx
jmp 0x100177ec
mov dword [esp + 0x28], 0x9973063d
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + eax*4 + 0x4c]
cmp eax, 0xae2f
setne cl
add ecx, dword [esp + 0x1c]
jne 0x10017781
cmp dword [esp + 0x50], ebx
jne 0x10017781
mov eax, dword [esp + 0x1c]
cmp dword [esp + eax*4 + 0x4c], ebx
jne 0x10017781
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x4c]
cmp edx, eax
mov eax, dword [esp + 0x1c]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
add edx, dword [esp + eax*4 + 0x4c]
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x10]
cmp eax, 0x2a3
setg cl
xor eax, eax
cmp edx, ecx
setne al
imul eax, dword [esp + 0x4c]
mov dword [esp + 0x28], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x100177e8
push ebx
xor eax, eax
inc eax
push eax
push 0x2003
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
inc dword [esp + 0x1c]
xor edx, edx
inc edx
cmp dword [esp + 0x1c], edx
jle 0x10017733
mov eax, dword [0x107e8db8]
push 8
pop edi
test dl, al
jne 0x1001789a
or eax, edx
mov dword [0x107e8db8], eax
push ebx
mov dword [esp + 0x2d8], ebx
push ebx
mov dword [0x107e8d90], ebx
mov dword [0x107e8d94], ebx
call fcn.1001ec98
mov dword [0x107e8d90], eax
mov dword [0x107e8d98], ebx
mov dword [0x107e8da0], ebx
mov byte [esp + 0x2d4], 2
mov ecx, 0x107e8d98
mov dword [esp + 0x1e4], eax
lea eax, [esp + 0x1e4]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1ec]
mov dword [0x107e8dac], 0x3f800000
push eax
mov dword [0x107e8d9c], ebx
call fcn.1001ea45
push 0x1006da02
mov dword [0x107e8da4], 7
mov dword [0x107e8da8], edi
call fcn.10052a02
or dword [esp + 0x2d8], 0xffffffff
pop ecx
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x184]
mov dword [esp + 0x2c], 0xb7c7ce53
mov dword [esp + 0x2c], 0x7eede0b4
mov dword [esp + 0x2c], edi
mov dword [esp + 0x2c], 0x5a9c4c8d
mov dword [esp + 0x2c], 0x4bf8f0aa
push 3
call fcn.1001a4ba
push 0xfffffffffffffff6
mov dword [esp + 0x14], 0xfffffffb
pop edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], ebx
jmp 0x100178fb
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x100178e5
dec dword [esp + 0x10]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10017920
push ebx
push ebx
push 0x2101
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
cmp dword [esp + 0x184], 0
je 0x1001794c
push dword [esp + 0x184]
call fcn.10052bc8
pop ecx
mov dword [esp + 0x184], ebx
mov dword [esp + 0x188], ebx
mov dword [esp + 0x18c], ebx
imul eax, dword [esp + 0x58], 0x2710
lea ecx, [esp + 0x160]
add eax, esi
mov dword [esp + 0xcc], eax
xor eax, eax
inc eax
mov dword [esp + 0x18], 0xb26bdde0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], edi
push eax
call fcn.1001a4ba
xor edx, edx
mov dword [esp + 0x20], ebx
inc edx
jmp 0x1001799c
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0xae5a
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x10017986
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100179c8
push 0x1aba
push ebx
push ebx
push 0x105b
push ebx
push 0x8ee
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor edx, edx
inc edx
mov dword [esp + 0x18], edi
jmp 0x10017a8d
mov dword [esp + 0x24], edx
inc dword [esp + 0x24]
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], ebx
jg 0x10017a89
mov dword [esp + 0x34], 0xb9e9d60a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10017a0a
push 0xe1b
push 0x548
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x10017a78
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x10017a5c
mov dword [esp + 0x30], 0x8fdeb772
mov dword [esp + 0x30], ebx
jmp 0x10017a50
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x20], ebx
jmp 0x10017a46
dec dword [esp + 0x34]
mov eax, dword [esp + 0x20]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x10017a3a
inc dword [esp + 0x30]
cmp dword [esp + 0x30], ebx
jle 0x10017a2c
dec dword [esp + 0x10]
jns 0x10017a1e
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10017a72
push 0x1794
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
dec dword [esp + 0x1c]
jns 0x10017a14
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jle 0x100179e7
xor edx, edx
inc edx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffef
jl 0x100179d1
cmp dword [esp + 0x160], 0
je 0x10017ac4
push dword [esp + 0x160]
call fcn.10052bc8
pop ecx
mov dword [esp + 0x160], ebx
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
lea eax, [esp + 0xcc]
push eax
call fcn.1001a76b
push 2
pop ecx
mov edi, dword [eax]
mov eax, 0x40fc0272
mov dword [esp + 0xa4], eax
mov dword [esp + 0xa8], eax
mov dword [esp + 0xac], eax
mov dword [esp + 0xb0], eax
mov dword [esp + 0x10], 0x314af12a
mov dword [esp + 0x34], 0x2b4b5a9c
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x28], 0xfffffffb
mov dword [esp + 0x20], ebx
jmp 0x10017b38
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1a0], 8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x10017b25
mov esi, dword [esp + 0xac]
neg esi
sbb esi, esi
neg esi
cmp dword [esp + 0xb0], ebx
jne 0x10017ba7
mov eax, dword [esp + 0xac]
mov ecx, 0xec2184e5
cmp ecx, eax
mov eax, dword [esp + 0xa4]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
neg ecx
mov dword [esp + 0x10], ecx
xor ecx, ecx
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xac]
sub edx, eax
mov eax, dword [esp + 0xac]
cmp edx, eax
setg cl
mov dword [esp + 0x1a4], ecx
test ecx, ecx
jne 0x10017ba7
xor edx, edx
mov eax, ebx
inc edx
jmp 0x10017bac
xor edx, edx
inc edx
mov eax, edx
mov dword [esp + 0x34], eax
xor ecx, ecx
mov eax, dword [esp + 0x34]
sub eax, 0x45a8
cmp eax, 0x7758
setne cl
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
jne 0x10017bd4
mov eax, dword [esp + 0xa8]
mov eax, dword [esp + 0x1a0]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xb0]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x34], ebx
jne 0x10017bff
mov ecx, ebx
cmp dword [esp + 0x1a4], ebx
je 0x10017c01
mov ecx, edx
imul ecx, esi
xor eax, eax
cmp ecx, 0x8701
setl al
add eax, dword [esp + 0xac]
mov dword [esp + 0x28], eax
test edi, edi
je 0x10017f15
push 2
pop eax
push eax
lea ecx, [esp + 0x104]
call fcn.1001a4ba
push 2
mov dword [esp + 0x58], 0xa5043c4a
mov dword [esp + 0x24], ebx
pop edx
jmp 0x10017c59
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0xac64a684
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x10017c43
mov eax, dword [esp + 0x100]
mov dword [eax], ebx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10017c7b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov eax, dword [esp + 0x100]
inc dword [eax]
cmp dword [eax], 0x16
jne 0x10017c68
push eax
mov dword [eax], 5
call fcn.10052bc8
movdqa xmm0, xmmword [0x1000b8d0]
xor eax, eax
pop ecx
push dword [esp + 0x1e0]
inc eax
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
lea ecx, [esp + 0x128]
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x284]
push eax
lea eax, [esp + 0x278]
mov dword [esp + 0x18], 0xad72d767
push eax
push ebx
mov dword [esp + 0x1c4], edi
movdqu xmmword [esp + 0x280], xmm0
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
mov dword [esp + 0x13c], ebx
call fcn.100200dd
push 3
pop esi
mov dword [esp + 0x2d4], esi
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
mov eax, 0xfffe
setle cl
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x18]
je 0x10017d68
mov dword [esp + 0x28], 0xf4727cad
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
jmp 0x10017ef5
push 2
pop eax
mov dword [esp + 0x38], 0x196e86ff
lea ecx, [esp + 0x234]
mov dword [esp + 0x30], 0xfffffffe
push eax
call fcn.1001a4ba
mov dword [esp + 0x1f8], ebx
mov dword [esp + 0x1fc], ebx
mov dword [esp + 0x200], ebx
mov dword [esp + 0x204], ebx
mov dword [esp + 0x18], ebx
jmp 0x10017dbd
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x240], 0xfffffff6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10017daa
push 2
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10017de3
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x234]
mov dword [eax + ecx*4], 0x1acae7bf
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10017dcd
inc dword [esp + 0x248]
mov dword [esp + 0x18], esi
jmp 0x10017ed3
mov dword [esp + 0x20], 0x9ced66e5
mov dword [esp + 0x34], 0x903cfcb8
mov dword [esp + 0x28], 0x5126ed4b
dec dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x124]
mov dword [eax], ecx
xor ecx, ecx
mov dword [esp + 0x34], 0x2f34c933
mov eax, dword [esp + 0x34]
cmp eax, 0x8d6d
setne cl
xor eax, eax
cmp ecx, 0xe588
setge al
sub eax, 8
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x248]
imul eax, dword [esp + 0x20]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 9
setle dl
xor ecx, ecx
sub edx, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
cmp edx, eax
setne cl
imul ecx, dword [esp + 0x248]
mov dword [esp + 0x200], ecx
mov dword [esp + 0x30], esi
cmp dword [esp + 0x30], ebx
jl 0x10017ecf
mov eax, dword [esp + 0x30]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x1f8]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x30]
sete dl
mov dword [esp + eax*4 + 0x1f8], edx
mov dword [esp + 0x10], 0xbdbfad24
dec dword [esp + 0x30]
jns 0x10017ea0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x16
jne 0x10017df9
cmp dword [esp + 0x234], 0
je 0x10017ef5
push dword [esp + 0x234]
call fcn.10052bc8
pop ecx
cmp dword [esp + 0x124], 0
je 0x10019b6b
push dword [esp + 0x124]
call fcn.10052bc8
pop ecx
jmp 0x10019b6b
mov dword [esp + 0x18], 0xc3707822
mov dword [esp + 0x34], 5
mov dword [esp + 0x24], 0xfffffffe
mov dword [esp + 0x34], 0xcc2fdcb
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x34]
sub ecx, eax
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
push 0xfffffffffffffff7
pop eax
mov dword [esp + 0x34], 0x57511ecb
mov dword [esp + 0x24], eax
jmp 0x10017fa0
mov dword [esp + 0x10], eax
inc dword [esp + 0x34]
inc dword [esp + 0x10]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 9
jge 0x10017f90
mov eax, dword [0x107e8db8]
push 4
pop esi
test al, 2
jne 0x10018050
or eax, 2
mov dword [0x107e8db8], eax
push ebx
mov dword [esp + 0x2d8], esi
push ebx
mov dword [0x107e8dd0], ebx
mov dword [0x107e8dd4], ebx
call fcn.1001ec98
mov dword [0x107e8dd0], eax
mov dword [0x107e8dd8], ebx
mov dword [0x107e8de0], ebx
mov byte [esp + 0x2d4], 6
mov ecx, 0x107e8dd8
mov dword [esp + 0x1c0], eax
lea eax, [esp + 0x1c0]
push eax
push 0x10
push ebx
lea eax, [esp + 0x1d0]
mov dword [0x107e8dec], 0x3f800000
push eax
mov dword [0x107e8ddc], ebx
call fcn.1001ea45
push 0x1006d9fd
mov dword [0x107e8de4], 7
mov dword [0x107e8de8], 8
call fcn.10052a02
or dword [esp + 0x2d8], 0xffffffff
xor edx, edx
pop ecx
inc edx
push 2
pop eax
mov dword [esp + 0x18], edx
lea ecx, [esp + 0xb4]
mov dword [esp + 0x38], edx
push eax
call fcn.1001a4ba
push 3
pop edi
mov dword [esp + 0x2d4], 7
mov dword [esp + 0x28], edi
push 2
mov dword [esp + 0x30], 5
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x100180a1
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], 0xfb133d7b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001808b
xor ecx, ecx
mov dword [esp + 0x18], ebx
inc ecx
jmp 0x100180bf
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xc8], esi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x100180b0
mov dword [esp + 0x34], 0x169c
cmp dword [esp + 0x34], 0xcaa
jge 0x10018128
lea eax, [esp + 0xd4]
mov ecx, 0x1065e1b0
push eax
call fcn.10019c2c
mov eax, dword [esp + 0xd4]
and eax, 0x80000001
jns 0x100180fc
dec eax
or eax, 0xfffffffe
inc eax
mov ecx, 0x1065e0f8
jne 0x10018114
push 2
pop eax
mov edx, 0x1000b2ec
cmp dword [esp + 0xd4], eax
jne 0x10018119
mov edx, 0x1000b2e8
call fcn.1001edaf
push eax
call fcn.1001ed7d
pop ecx
push 2
pop edx
mov dword [esp + 0x18], ebx
mov ecx, 0xffff
cmp dword [esp + 0x18], 0xfffffff0
jl 0x10018397
mov dword [esp + 0x24], 0x6de713a4
mov dword [esp + 0x20], 0xb8378c3
mov dword [esp + 0x2c], 0x4c396c7b
mov dword [esp + 0x24], 0x19
jmp 0x10018378
mov dword [esp + 0x1c], 0x8d526d2e
mov dword [esp + 0x10], 0xcbd0d794
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 5
jge 0x10018371
xor edi, edi
inc edi
mov dword [esp + 0x30], 0x4ed09eb8
mov dword [esp + 0x34], 0x648a5746
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], ebx
jmp 0x100181bc
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x214], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100181a9
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 0x38b36ced
imul ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x100181fb
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
cmp edi, eax
mov eax, dword [esp + 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setne cl
mov dword [esp + 0x34], ecx
xor ecx, ecx
mov eax, dword [esp + 0x34]
cmp eax, 0xee3
mov eax, dword [esp + 0x30]
setne cl
xor edx, edx
cmp ecx, 3
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0xd029
je 0x100182f3
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x1001827c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x208], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001826d
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x18], ebx
je 0x10018294
mov eax, dword [esp + 0x208]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x20c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x210]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
cmp ecx, eax
setne dl
mov dword [esp + 0x34], edx
mov eax, dword [esp + 0x34]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
sub eax, 0x328dfe90
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x38], eax
dec dword [esp + 0x214]
jmp 0x1001835a
mov dword [esp + 0x30], 0xc1e9
mov dword [esp + 0x30], 0xc4ee
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xb4]
mov dword [eax], ecx
cmp dword [esp + 0x30], ecx
jg 0x1001834e
mov eax, dword [esp + 0xb4]
xor ecx, ecx
cmp dword [eax], ebx
sete cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esp + 0x2c]
jne 0x1001833a
mov eax, ebx
cmp dword [esp + 0x10], ebx
je 0x1001833c
mov eax, edi
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
jne 0x1001834a
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], eax
inc dword [esp + 0x1c]
mov ecx, 0xffff
cmp dword [esp + 0x1c], 5
push 2
pop edx
jl 0x1001818b
dec dword [esp + 0x24]
push 2
pop edx
cmp dword [esp + 0x24], esi
jge 0x10018161
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff0
push 2
pop edx
jge 0x1001813c
push 3
pop edi
mov eax, dword [esp + 0xc8]
mov eax, dword [esp + 0xb4]
mov eax, dword [eax]
mov dword [esp + 0xc8], eax
test eax, eax
jne 0x100183bc
cmp dword [esp + 0x38], ebx
jne 0x100183bc
mov ecx, ebx
jmp 0x100183c1
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [esp + 0x28]
imul eax, ecx
mov dword [esp + 0x28], eax
or dword [esp + 0x2d4], 0xffffffff
push dword [esp + 0xb4]
call fcn.10052bc8
mov dword [esp + 0xb8], ebx
xorps xmm0, xmm0
mov dword [esp + 0xbc], ebx
xor eax, eax
mov dword [esp + 0xc0], ebx
inc eax
movdqu xmmword [esp + 0x194], xmm0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x14], 0xa9ef72d4
mov dword [esp + 0x2c], eax
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x1001842a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x288], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001841b
push 2
mov dword [esp + 0x24], ebx
pop eax
jmp 0x10018466
inc dword [esp + 0x28]
mov dword [esp + 0x10], ebx
jmp 0x1001845c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018458
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 2
pop eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x10018443
inc dword [esp + 0x20]
cmp dword [esp + 0x20], eax
jle 0x10018439
lea eax, [esp + 0x58]
push eax
call fcn.1001a7cd
mov esi, dword [eax]
mov dword [esp + 0x2c], 0x18ab
cmp dword [esp + 0x2c], 0x10b2
mov dword [esp + 0x20], esi
jge 0x100185fa
lea eax, [esp + 0xc4]
push eax
push 0x1000b2f0
call fcn.1005233b
pop ecx
mov edi, 0x1065f290
pop ecx
mov esi, edi
push esi
push 0x1000b2f0
call fcn.1005233b
add esi, 4
pop ecx
pop ecx
cmp esi, 0x1065f2b4
jl 0x100184ad
mov ecx, dword [esp + 0xc4]
xor eax, eax
push 4
inc eax
pop esi
xor edx, edx
movzx eax, al
cmp ecx, dword [edi]
cmovge eax, edx
add edi, esi
cmp edi, 0x1065f2b4
jl 0x100184d2
test al, al
je 0x100184f9
push 0x1000b214
call fcn.10052d37
jmp 0x100185f2
mov eax, 0x3b9aca00
mov ecx, ebx
mov esi, eax
mov dword [esp + 0x10], eax
mov edx, dword [ecx*4 + 0x1065f290]
cmp edx, esi
jg 0x10018517
mov esi, edx
mov dword [esp + 0x10], ecx
inc ecx
cmp ecx, 9
jl 0x10018506
mov eax, dword [esp + 0xc4]
cdq
idiv esi
mov edi, edx
mov esi, eax
test edi, edi
jne 0x10018551
test esi, esi
jle 0x100185eb
mov edi, dword [esp + 0x10]
inc edi
push edi
push 0x1000b2f0
call fcn.10052a2c
pop ecx
pop ecx
dec esi
jne 0x1001853c
jmp 0x100185eb
mov eax, dword [esp + 0x10]
dec esi
add edi, dword [eax*4 + 0x1065f290]
mov eax, 0x3b9aca00
mov dword [esp + 0x28], eax
mov ecx, eax
mov eax, ebx
mov edx, dword [eax*4 + 0x1065f290]
cmp edx, edi
jg 0x1001857d
mov dword [esp + 0x28], edx
mov ecx, eax
jmp 0x10018581
mov edx, dword [esp + 0x28]
inc eax
cmp eax, 9
jl 0x1001856a
movd xmm0, edx
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x1000b878]
lahf
test ah, 0x44
jp 0x100185b3
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
ucomisd xmm0, qword [0x1000b878]
lahf
test ah, 0x44
jnp 0x100185d1
cmp ecx, dword [esp + 0x10]
je 0x100185d1
lea eax, [ecx + 1]
sub edi, edx
push eax
push 0x1000b2f0
call fcn.10052a2c
pop ecx
pop ecx
test edi, edi
jne 0x10018551
jmp 0x100185d2
inc esi
test esi, esi
jle 0x100185eb
mov edi, dword [esp + 0x10]
inc edi
push edi
push 0x1000b2f0
call fcn.10052a2c
pop ecx
pop ecx
dec esi
jne 0x100185db
push 0xa
call fcn.10052d2e
mov esi, dword [esp + 0x24]
pop ecx
push 3
pop edi
mov dword [esp + 0x10], 0xd1e1e87d
lea ecx, [esp + 0x154]
mov dword [esp + 0x28], 0xfffffff6
push edi
call fcn.1001a4ba
mov dword [esp + 0x18], ebx
jmp 0x1001862c
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x2a0], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x1001861d
mov dword [esp + 0x18], ebx
jmp 0x1001864b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x154]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10018638
push 2
mov dword [esp + 0x14], ebx
pop eax
jmp 0x1001867d
inc dword [esp + 0x28]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018679
push ebx
push 0x1748
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push 2
pop eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x1001865a
cmp dword [esp + 0x154], 0
je 0x100186af
push dword [esp + 0x154]
call fcn.10052bc8
pop ecx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ebx
mov dword [esp + 0x15c], ebx
cmp byte [ebp + 0xc], 0
jne 0x100186bd
test esi, esi
jne 0x10018bd2
mov dword [esp + 0x1c], 0x3e86
lea ecx, [esp + 0x13c]
mov dword [esp + 0x10], 0xc013
push edi
call fcn.1001a4ba
xor edx, edx
inc edx
mov dword [esp + 0x3c], edx
mov dword [esp + 0x28], 8
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x1001870a
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x8c], 0x197cbb4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x100186f7
mov dword [esp + 0x18], ebx
jmp 0x1001872c
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10018716
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018748
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommState]
xor edx, edx
inc edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
neg eax
add eax, 0x8d23
imul eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x1c]
jle 0x10018783
mov ecx, edx
cmp dword [esp + 0x10], ebx
jne 0x10018785
mov ecx, ebx
mov eax, dword [esp + 0x90]
add eax, 0xfffa
add ecx, eax
mov eax, dword [esp + 0x13c]
mov dword [eax], ecx
cmp dword [esp + 0x1c], ecx
jle 0x100187a9
mov eax, dword [esp + 0x90]
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x90]
cmp ecx, eax
mov eax, dword [esp + 0x94]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x90]
setge cl
xor edx, edx
dec ecx
cmp ecx, eax
mov eax, dword [esp + 0x90]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setge cl
xor edx, edx
cmp ecx, 0xc0ce
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x90]
setle cl
imul ecx, eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x90]
imul ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x90]
sub ecx, eax
mov eax, dword [esp + 0x1c]
cmp ecx, 0xfffffffd
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setne dl
imul edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
cmp ecx, 0x3dcedb1a
jle 0x10018852
mov eax, dword [esp + 0x28]
push dword [esp + 0x13c]
xor eax, eax
inc eax
mov dword [esp + 0x30], eax
call fcn.10052bc8
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x2bc]
pop ecx
mov ecx, dword [esp + 0x58]
push eax
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
call fcn.1000d0fa
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0x194]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x10018bcb
cmp dword [esp + 0x198], 0
je 0x10018bcb
or eax, 0xffffffff
mov dword [esp + 0x68], eax
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x18], 0x7e6a
mov dword [esp + 0x24], 0x6b3e713e
mov dword [esp + 0x2c], 0x13aabdc9
mov eax, dword [esp + 0x70]
cmp eax, dword [esp + 0x70]
je 0x10018905
cmp dword [esp + 0x70], ebx
je 0x10018905
mov dword [esp + 0x2c], 0xc34eea2a
mov eax, dword [esp + 0x70]
push 3
mov dword [esp + 0x30], eax
pop edi
jmp 0x10018960
mov dword [esp + 0x2c], 0x2760
push 3
mov dword [esp + 0x34], 0xfffffffb
mov dword [esp + 0x14], ebx
pop edi
jmp 0x10018931
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x294], 2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001891e
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001894b
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x70], eax
add eax, 0xfff8
mov dword [esp + 0x24], eax
inc dword [esp + 0x30]
mov dword [esp + 0x24], 0xffffffec
jmp 0x10018ad1
push dword [esp + 0x1c4]
movdqa xmm0, xmmword [0x1000b8b0]
lea ecx, [esp + 0x9c]
xor eax, eax
mov dword [esp + 0x9c], ebx
inc eax
mov dword [esp + 0xa0], ebx
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x274]
push eax
lea eax, [esp + 0x268]
mov dword [esp + 0xa8], ebx
push eax
push ebx
movdqu xmmword [esp + 0x270], xmm0
call fcn.100200dd
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], ebx
jl 0x100189da
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x68], 0xf8716b5b
dec dword [esp + 0x18]
jns 0x100189c8
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0xffffffed
jg 0x10018aa1
push 2
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x10018a02
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], 0x58efa97f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x100189f2
mov dword [esp + 0x48], edi
cmp dword [esp + 0x48], ebx
jl 0x10018a8a
mov esi, dword [esp + 0x98]
mov dword [esp + 0x2c], edi
xor ecx, ecx
mov eax, dword [esp + 0x48]
push 0xfffffffffffffffe
pop edx
mov eax, dword [esp + eax*4 + 0x68]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + eax*4 + 0x68]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + eax*4 + 0x68]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + eax*4 + 0x68]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + eax*4 + 0x68]
sub edx, eax
mov eax, dword [esp + 0x48]
cmp edx, eax
mov eax, dword [esp + 0x48]
setge cl
xor edx, edx
add ecx, 0x215f
mov dword [esp + eax*4 + 0x68], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], 0xadaa237f
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
cmp ecx, eax
setg dl
mov dword [esi + 0xc], edx
dec dword [esp + 0x48]
jns 0x10018a19
push 2
pop ecx
mov dword [esp + 0x6c], 8
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffed
jle 0x100189ec
cmp dword [esp + 0x98], 0
je 0x10018acd
push dword [esp + 0x98]
call fcn.10052bc8
pop ecx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff9
jg 0x1001896d
mov eax, dword [esp + 0x19c]
mov dword [esp + 0x24], 0x708ef6b8
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1b8], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x51a
setl al
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
je 0x10018b3a
mov dword [esp + 0x28], 7
dec dword [esp + 0x28]
jmp 0x10018bb3
mov dword [esp + 0x2c], ebx
xor ecx, ecx
mov dword [esp + 0x28], 0x9a488d51
inc ecx
mov dword [esp + 0x28], 0x186e1459
mov dword [esp + 0x3c], 0xba1dd793
mov dword [esp + 0x10], ebx
jmp 0x10018b72
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1dc], 0xb7c39c9d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10018b5f
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1dc]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x30]
mov dword [esp + 0x28], eax
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x198]
mov dword [esp + 0x1bc], eax
jmp 0x10018bce
push 3
pop edi
mov esi, dword [esp + 0x20]
mov dword [esp + 0x2c], 0x8a8f
lea ecx, [esp + 0x178]
mov dword [esp + 0x2c], 0x8094a188
mov dword [esp + 0x2c], 0xfffffffb
push edi
call fcn.1001a4ba
mov dword [esp + 0x28], 4
mov dword [esp + 0x18], ebx
jmp 0x10018c1b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10018c05
push 2
mov dword [esp + 0x1c], ebx
pop ecx
jmp 0x10018c3d
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x280], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x10018c2a
dec dword [esp + 0x28]
cmp dword [esp + 0x178], 0
je 0x10018c76
push dword [esp + 0x178]
call fcn.10052bc8
pop ecx
push 2
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x180], ebx
mov dword [esp + 0x184], ebx
pop ecx
test esi, esi
jne 0x10019787
cmp dword [esp + 0x190], esi
jle 0x10019787
mov dword [esp + 0x1c], 0x6dd1e1e8
push ecx
mov dword [esp + 0x1c], 0xfffffff7
lea ecx, [esp + 0xe0]
mov dword [esp + 0x28], 0x6ae3
call fcn.1001a4ba
push 2
mov dword [esp + 0x30], 0xfffffffe
mov dword [esp + 0x14], ebx
pop edx
jmp 0x10018cd7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], 0x7c8a36a7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018cc1
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
jne 0x10018d07
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
je 0x10018d21
mov eax, dword [esp + 0x18]
mov eax, 0xffff
cmp dword [esp + 0x1c], eax
je 0x10018d30
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x1c], ebx
je 0x10018d47
cmp dword [esp + 0x24], ebx
je 0x10018d47
xor edx, edx
inc edx
mov eax, edx
jmp 0x10018d4c
xor edx, edx
mov eax, ebx
inc edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x1c], eax
jl 0x10018d99
mov dword [esp + 0x28], 0xeeda781b
mov dword [esp + 0x28], 0xe33ecdc0
mov dword [esp + 0x1c], ebx
jmp 0x10018d8e
mov dword [esp + 0x2c], 0x73c12d49
cmp dword [esp + 0x18], ebx
jne 0x10018e33
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x28], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x10018d70
jmp 0x10018e33
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], edx
mov dword [esp + 0x28], 0x6e6af575
mov eax, dword [esp + 0x18]
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
je 0x10018df8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xdc]
cmp dword [eax], ecx
jne 0x10018dce
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x30], ebx
je 0x10018de0
mov ecx, edx
cmp dword [esp + 0x1c], ebx
jne 0x10018de2
mov ecx, ebx
mov eax, dword [esp + 0x30]
add eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
xor edx, edx
test eax, eax
mov eax, dword [esp + 0x2c]
sets dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0x8020
cmp dword [esp + 0x30], ecx
jge 0x10018e25
cmp dword [esp + 0x10], ebx
je 0x10018e25
xor eax, eax
inc eax
jmp 0x10018e27
mov eax, ebx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
cmp dword [esp + 0xdc], 0
je 0x10018e5f
push dword [esp + 0xdc]
call fcn.10052bc8
pop ecx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
push edi
lea ecx, [esp + 0x14c]
call fcn.1001a4ba
push edi
lea ecx, [esp + 0x134]
mov dword [esp + 0x2d8], 8
call fcn.1001a4ba
mov byte [esp + 0x2d4], 9
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x10018eb0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0xb9b55bb2
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10018e9a
mov dword [esp + 0x1c], ebx
jmp 0x10018ed2
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0xe2236432
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10018ebc
xor ecx, ecx
mov dword [esp + 0x1c], ebx
inc ecx
cmp dword [esp + 0x1c], edi
jge 0x10018ef6
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2ac], ecx
inc dword [esp + 0x1c]
jmp 0x10018edf
mov esi, dword [esp + 0x130]
push 2
pop eax
mov dword [esp + 0x38], esi
mov dword [esi + 4], eax
push ecx
lea ecx, [esp + 0x11c]
call fcn.1001a4ba
mov byte [esp + 0x2d4], 0xa
mov dword [esp + 0x2c], 0x1bdb
cmp dword [esp + 0x2c], 0x10a3
jge 0x1001901c
push 2
pop eax
push eax
lea ecx, [esp + 0x1cc]
call fcn.1004d991
lea ecx, [esp + 0x1c8]
mov byte [section..data], bl
call fcn.1004d9ec
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
call fcn.1001ec6d
mov dword [esp + 0x60], eax
lea eax, [esp + 0x5c]
mov byte [esp + 0x2d4], 0xb
push eax
mov ecx, 0x1065e1b0
call fcn.10019d6c
or edi, 0xffffffff
or esi, edi
jmp 0x10018fec
dec eax
mov ecx, 0x1065e1b0
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x40]
push eax
call fcn.10019d6c
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x64]
call fcn.1001a896
test eax, eax
lea ecx, [esp + 0x60]
lea eax, [esp + 0x40]
push eax
je 0x10018fbb
call fcn.1001a82f
inc dword [eax]
jmp 0x10018fc6
call fcn.1001a82f
mov dword [eax], 1
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x64]
call fcn.1001a82f
cmp dword [eax], esi
jle 0x10018fec
lea eax, [esp + 0x40]
push eax
lea ecx, [esp + 0x64]
call fcn.1001a82f
mov edi, dword [esp + 0x40]
mov esi, dword [eax]
mov eax, dword [esp + 0x5c]
test eax, eax
jne 0x10018f83
dec eax
mov ecx, 0x1065e0f8
push edi
mov dword [esp + 0x60], eax
call fcn.1001a163
push eax
call fcn.1001ed7d
pop ecx
lea ecx, [esp + 0x60]
mov byte [esp + 0x2d4], 0xa
call fcn.1001a67d
xor edx, edx
inc edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x2c], 0xdbdf7cd9
mov dword [esp + 0x2c], 0x7b30498d
mov dword [esp + 0x2c], 0x34c266d8
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x10], ebx
jmp 0x1001905b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10019049
mov eax, dword [esp + 0x118]
mov dword [eax], ebx
mov dword [esp + 0x2c], 0xc3f0
mov dword [esp + 0x2c], 0xe81a7ecc
mov dword [esp + 0x2c], 0x231e
cmp dword [esp + 0x2c], 0xb4e
jge 0x100191a2
push ecx
lea ecx, [esp + 0x1d4]
call fcn.1001a914
lea eax, [esp + 0xc0]
mov byte [esp + 0x2d4], 0xc
push eax
push 0x1000b2ac
call fcn.1005233b
xor eax, eax
inc eax
pop ecx
pop ecx
mov dword [esp + 0x7c], eax
cmp dword [esp + 0xc0], eax
jl 0x1001910d
mov esi, dword [esp + 0x1d0]
lea eax, [esp + 0x1cc]
push eax
push 0x1000b1e0
call fcn.1005233b
pop ecx
pop ecx
imul ecx, dword [esp + 0x1cc], 0xc
lea eax, [esp + 0x7c]
push eax
add ecx, 0xfffffff4
add ecx, esi
call fcn.1001a5b4
mov eax, dword [esp + 0x7c]
inc eax
mov dword [esp + 0x7c], eax
cmp eax, dword [esp + 0xc0]
jle 0x100190d0
mov eax, dword [esp + 0x1d0]
push 2
mov esi, dword [eax + 4]
lea ecx, [eax + 0xc]
sub esi, dword [eax]
pop eax
sar esi, 2
mov edx, eax
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
lea ecx, [ecx + 0xc]
sar eax, 2
cmp eax, esi
cmovb esi, eax
dec edx
jne 0x10019124
push esi
push 0x1000b2ac
mov dword [esp + 0x44], esi
call fcn.10052a2c
mov edi, ebx
pop ecx
pop ecx
test esi, esi
jle 0x1001918e
mov ebx, dword [esp + 0x1d0]
push 3
mov dword [esp + 0x30], ebx
pop esi
mov eax, dword [ebx]
push dword [eax + edi*4]
push 0x1000b220
call fcn.10052a2c
lea ebx, [ebx + 0xc]
pop ecx
pop ecx
dec esi
jne 0x1001915c
push 0x1000b14d
call fcn.10052d37
mov ebx, dword [esp + 0x1d4]
inc edi
pop ecx
cmp edi, dword [esp + 0x3c]
jl 0x10019155
xor ebx, ebx
lea ecx, [esp + 0x1d0]
mov byte [esp + 0x2d4], 0xa
call fcn.1001b055
mov dword [esp + 0x2c], 0xdcd16652
lea ecx, [esp + 0x10c]
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x2c], ebx
push 4
call fcn.1001a4ba
mov dword [esp + 0x2c], 0x73df2ef5
mov dword [esp + 0x10], ebx
jmp 0x100191e8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], 0xad8ea5f3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x100191d2
inc dword [esp + 0x28]
cmp dword [esp + 0x10c], 0
je 0x1001921f
push dword [esp + 0x10c]
call fcn.10052bc8
pop ecx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x114], ebx
mov eax, dword [esp + 0x118]
inc dword [eax]
cmp dword [eax], 2
jle 0x1001906a
push eax
mov byte [esp + 0x2d8], 9
call fcn.10052bc8
mov eax, dword [esp + 0x3c]
pop ecx
push 1
mov dword [esp + 0x11c], ebx
dec dword [eax + 4]
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
pop ecx
jns 0x10018f07
push dword [esp + 0x130]
call fcn.10052bc8
or dword [esp + 0x2d8], 0xffffffff
cmp dword [esp + 0x14c], 0
pop ecx
mov dword [esp + 0x130], ebx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
je 0x100192bb
push dword [esp + 0x148]
call fcn.10052bc8
pop ecx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x150], ebx
xor ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x10], ebx
jmp 0x100192e3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xd8], 0x55cc25b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x100192d0
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 0xfffffff0
jge 0x1001936e
mov dword [esp + 0x38], 0x7603
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x24]
sub ecx, eax
mov dword [esp + 0xd8], ecx
jne 0x10019313
mov eax, dword [esp + 0x38]
cmp dword [esp + 0xd8], 0xfffffffb
push 1
sbb eax, eax
inc eax
neg eax
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0x97515801
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xee34
setge cl
xor edx, edx
imul ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], eax
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xfffffff0
pop ecx
jl 0x100192f4
mov dword [esp + 0x24], 0xfb0b
mov dword [esp + 0x1c], 0xb055cc25
mov dword [esp + 0x18], ebx
jmp 0x10019397
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x250], 0x4f84b811
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10019384
mov dword [esp + 0x18], ebx
jmp 0x100193b7
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xd0], 9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x100193a4
cmp dword [esp + 0x24], ebx
je 0x100193e5
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001955f
push ecx
lea ecx, [esp + 0xec]
call fcn.1001a4ba
xor edx, edx
inc edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x2c], 0x23579942
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x28], 9
mov dword [esp + 0x34], 0x4a53e8af
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x10], ebx
jmp 0x1001943d
lea ecx, [esp + 0x190]
call fcn.10014494
push 0xfffffffffffffff7
pop edi
mov dword [esp + 0x28], edi
xor eax, eax
mov dword [esp + 0x2c], 0xde19d29b
inc eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0xfffffff9
mov dword [esp + 0x20], eax
push 2
mov dword [esp + 0x2c], 6
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x100197d5
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x22c], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x100197c6
inc dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x230]
imul edx, eax
mov eax, dword [esp + 0x20]
neg eax
cmp eax, edx
setne cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x22c], eax
test esi, esi
je 0x10019918
mov dword [esp + 0x10], edi
mov dword [esp + 0x10], 0xfffffffb
jmp 0x1001984d
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019835
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019849
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x11
jne 0x10019823
mov edx, dword [esp + 0x54]
mov ecx, esi
call fcn.100176b4
mov esi, eax
lea ecx, [esp + 0xf4]
xor eax, eax
mov dword [esp + 0x1b4], esi
inc eax
push eax
call fcn.1001a4ba
xor edx, edx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001989f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 0x9f9b3198
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10019889
mov dword [esp + 0x20], ebx
jmp 0x100198d7
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0xf4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100198d3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x100198ab
cmp dword [esp + 0xf4], 0
je 0x10019909
push dword [esp + 0xf4]
call fcn.10052bc8
pop ecx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
lea eax, [esp + 0xcc]
push eax
call fcn.1001a76b
mov dword [eax], esi
mov dword [esp + 0x1c], 0x462d5e48
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x1001994e
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001994a
push 0x161
push 0x2087
push ebx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff1
jg 0x1001992e
mov dword [esp + 0x1c], 5
cmp dword [esp + 0x1c], 0xfffffffc
jle 0x10019b6b
mov edi, 0x5b40194d
push 2
mov dword [esp + 0x1ec], edi
lea ecx, [esp + 0x84]
pop eax
mov dword [esp + 0x1ec], edi
mov dword [esp + 0x1f0], edi
mov dword [esp + 0x1f4], edi
push eax
call fcn.1001a4ba
push 9
pop eax
mov dword [esp + 0x2d4], 0xd
mov dword [esp + 0x21c], eax
mov dword [esp + 0x220], eax
mov dword [esp + 0x224], eax
push 2
mov dword [esp + 0x22c], eax
mov dword [esp + 0x14], ebx
pop edx
jmp 0x100199e2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x80]
mov dword [eax + ecx*4], 0xe7f737a9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100199cc
mov esi, dword [esp + 0x80]
mov edi, 0xffff
mov dword [esi], ebx
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x1a8]
push 3
call fcn.1001a4ba
mov dword [esp + 0x10], ebx
jmp 0x10019a24
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], 0x91359a70
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019a0e
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019a47
push 0x122e
push ebx
push 0x478
call dword [sym.imp.GDI32.dll_Polygon]
mov eax, dword [esp + 0x1c]
cmp dword [esi + 4], ebx
jl 0x10019a5a
cmp dword [esp + 0x1c], ebx
je 0x10019a5a
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x80]
xor edx, edx
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x1e8]
mov eax, dword [esp + 0x80]
mov eax, dword [eax]
mov ecx, dword [esp + eax*4 + 0x1e8]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setg dl
mov dword [esp + 0x224], edx
test edx, edx
je 0x10019a97
mov eax, dword [esp + 0x220]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x80]
cmp dword [eax], 1
mov eax, dword [esp + 0x1c]
setle cl
xor edx, edx
cmp eax, ecx
setg dl
sub edx, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x80]
mov eax, dword [eax]
mov dword [esp + 0x54], edx
mov eax, dword [esp + eax*4 + 0x1e8]
cmp eax, 0x91cb
mov eax, dword [esp + 0x20]
setle cl
xor edx, edx
cmp ecx, dword [esp + 0x54]
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x2c]
cmp edx, eax
mov eax, dword [esp + 0x1a8]
push eax
setne cl
mov dword [eax + 8], ecx
call fcn.10052bc8
mov eax, dword [esp + 0x84]
pop ecx
mov dword [esp + 0x1a8], ebx
mov dword [esp + 0x1ac], ebx
inc dword [eax]
cmp dword [eax], 3
mov dword [esp + 0x1b0], ebx
jle 0x100199f6
or dword [esp + 0x2d4], 0xffffffff
push eax
call fcn.10052bc8
mov dword [esp + 0x84], ebx
mov edi, 0x5b40194d
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffffc
pop ecx
jg 0x1001996d
mov eax, dword [ebp + 8]
lea esi, [esp + 0x1b4]
mov ecx, dword [esp + 0x2cc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret