Function at 0x1001f56a
Capabilities:
Access peb ldr_data
Check os version
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10070057
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x434c
call fcn.1006b160
push ebx
push esi
mov dword [esp + 0x44], ecx
mov esi, edx
push edi
mov dword [esp + 0xc], 0xc204e2db
lea ecx, [esp + 0xd8]
mov dword [esp + 0x10], 0x74952f34
mov dword [esp + 0x20], 0xe45bbbde
push 3
mov dword [esp + 0x40], esi
call fcn.1000f401
xor eax, eax
lea ecx, [esp + 0xcc]
xor ebx, ebx
inc eax
mov dword [esp + 0x4364], ebx
mov dword [esp + 0x24], 0xaeb8efb6
mov dword [esp + 0x38], ebx
push eax
call fcn.1000f401
xor edx, edx
inc edx
mov byte [esp + 0x4364], dl
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], 0x74354af3
mov dword [esp + 0xc], ebx
jmp 0x1001f616
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001f604
mov dword [esp + 0xc], ebx
jmp 0x1001f639
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 0xda73
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001f623
push 0xa
pop eax
mov dword [esp + 0x34], eax
mov dword [esp + 0xc], eax
jmp 0x1001f892
mov dword [esp + 0x18], 0xb143e95a
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x1c], ebx
jmp 0x1001f67c
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x188], 0x389f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1001f669
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001f69f
push ebx
push ebx
push 0x412
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
xor edx, edx
inc edx
cmp dword [esp + 0x18], ebx
jne 0x1001f6bf
mov dword [esp + 0x10], 0xffff
cmp dword [esp + 0x10], ebx
je 0x1001f6b7
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x18], 0x29bf3901
jge 0x1001f7d1
mov dword [esp + 0x20], edx
mov dword [esp + 0x44], 0x8317d239
mov dword [esp + 0x18], 0xffffffea
cmp dword [esp + 0x18], 0xd
jne 0x1001f88e
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x144]
push edx
call fcn.1000f401
xor edx, edx
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x1001f730
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001f71a
mov dword [esp + 0x20], 0xfffffff6
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp eax, edx
mov eax, dword [esp + 0x18c]
setl cl
imul ecx, eax
mov eax, dword [esp + 0x28]
imul eax, ecx
xor ecx, ecx
cmp eax, 0x2570d978
setle cl
xor eax, eax
cmp ecx, 9
setge al
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x144]
mov dword [eax], ecx
mov eax, dword [esp + 0x44]
push dword [esp + 0x144]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x14], eax
call fcn.10055e77
pop ecx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xd
push 1
pop edx
je 0x1001f700
jmp 0x1001f88b
mov dword [esp + 0x44], 0x8a1d
xor ecx, ecx
mov dword [esp + 0x20], 0x5f6f594a
xor edi, edi
mov edx, dword [esp + 0xd8]
inc edi
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x20], 0xfffffffb
mov eax, dword [esp + 0x24]
cmp eax, edi
mov dword [edx + 4], edi
setle cl
sub ecx, dword [esp + 0xc]
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [esp + 0x18c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x24]
sub eax, 0x99d6db78
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x18c]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x28], ebx
je 0x1001f886
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xcc]
cmp edi, dword [eax]
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffff6
setne cl
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x30]
mov eax, edi
jg 0x1001f888
mov eax, ebx
mov dword [edx + 4], eax
xor edx, edx
inc edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x1c
push 2
pop ecx
je 0x1001f64f
cmp dword [esp + 0xcc], 0
je 0x1001f8cc
push dword [esp + 0xcc]
call fcn.10055e77
pop ecx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
or eax, 0xffffffff
mov dword [esp + 0x4364], eax
cmp dword [esp + 0xd8], 0
je 0x1001f902
push dword [esp + 0xd8]
call fcn.10055e77
pop ecx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov eax, dword [0x11d42670]
xor edi, edi
inc edi
test al, 1
jne 0x1001f9a9
or eax, edi
mov dword [0x11d42670], eax
push 2
pop eax
push ebx
mov dword [esp + 0x4368], eax
push ebx
mov dword [0x11d42650], ebx
mov dword [0x11d42654], ebx
call fcn.10011e7b
mov dword [0x11d42650], eax
mov dword [0x11d42658], ebx
mov dword [0x11d42660], ebx
mov byte [esp + 0x4364], 4
mov ecx, 0x11d42658
mov dword [esp + 0x178], eax
lea eax, [esp + 0x178]
push eax
push 0x10
push ebx
lea eax, [esp + 0x58]
mov dword [0x11d4266c], 0x3f800000
push eax
mov dword [0x11d4265c], ebx
call fcn.10011c53
push 0x10070f27
mov dword [0x11d42664], 7
mov dword [0x11d42668], 8
call fcn.10055ce5
or eax, 0xffffffff
pop ecx
mov dword [esp + 0x4364], eax
mov dword [esp + 0x1c], 0x62d5e48d
mov dword [esp + 0x1c], 0xfffffff8
jmp 0x1001f9e2
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001f9d7
mov dword [esp + 0x30], 0xddbc3707
cmp dword [esp + 0x30], ebx
jne 0x1001f9de
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c
jl 0x1001f9c5
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff1
je 0x1001f9bb
imul eax, dword [esp + 0x48], 0x2710
lea ecx, [esp + 0x50]
push dword [esp + 0x4c]
movdqa xmm0, xmmword [0x10008a60]
movdqu xmmword [esp + 0x2a4], xmm0
mov dword [esp + 0x54], ebx
add eax, esi
mov dword [esp + 0x58], ebx
mov dword [esp + 0x80], eax
lea eax, [esp + 0x2b4]
mov dword [esp + 0x1c], edi
push eax
mov dword [esp + 0x2c], 0xefa1e1c5
lea eax, [esp + 0x2a8]
mov dword [esp + 0x24], 0x21046671
push eax
mov dword [esp + 0x1c], 0xa8c98aac
mov dword [esp + 0x38], 0x674fa72d
mov dword [esp + 0x18], 0xfffffffd
push ebx
mov dword [esp + 0x68], ebx
call fcn.10012921
mov dword [esp + 0x4364], 5
lea eax, [esp + 0x2e0]
push dword [esp + 0x4c]
movdqa xmm0, xmmword [0x10008a50]
lea ecx, [esp + 0x68]
push eax
lea eax, [esp + 0x2d8]
mov dword [esp + 0x6c], ebx
push eax
push ebx
movdqu xmmword [esp + 0x2e0], xmm0
mov dword [esp + 0x78], ebx
mov dword [esp + 0x7c], ebx
call fcn.10012921
mov byte [esp + 0x4364], 6
cmp dword [esp + 0x18], ebx
je 0x1001fb0f
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
cmp ecx, eax
setne dl
mov dword [esp + 0x24], edx
cmp dword [esp + 0x24], ebx
je 0x1001fad2
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov edx, edi
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x18]
sub eax, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
cmp dword [esp + 0x18], eax
jl 0x1001fb11
mov edx, ebx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setge dl
imul ecx, edx, 0xfa8f
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0xc], ecx
mov dword [esp + 0xc], 3
cmp dword [esp + 0xc], ebx
jl 0x1001fd67
mov esi, dword [esp + 0x64]
mov dword [esp + 0x44], esi
mov dword [esp + 0x18], 5
mov dword [esp + 0x28], 0xfffffffa
mov dword [esp + 0x20], 0xfffa
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 3
jg 0x1001fd05
mov dword [esp + 0x28], 0x6ae20245
xor edx, edx
mov dword [esp + 0x30], 0xfc5a51f
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x50]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x10], eax
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
sub ecx, 0x7903
mov esi, dword [esp + 0x50]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp dword [esi + edi*4], eax
mov eax, dword [esp + 0x24]
setl cl
sub ecx, edx
add eax, ecx
je 0x1001fc19
mov dword [esp + 0x30], 0x235a
mov eax, dword [esp + 0x30]
or eax, 0xffffffff
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
jne 0x1001fc05
cmp dword [esp + 0x18], ebx
jne 0x1001fc05
mov ecx, ebx
jmp 0x1001fc0a
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [esp + 0x28]
sub eax, ecx
mov dword [esp + 0x28], eax
jmp 0x1001fcf2
push dword [esp + 0x4c]
movdqa xmm0, xmmword [0x10008a20]
lea ecx, [esp + 0x74]
xor eax, eax
mov dword [esp + 0x74], ebx
inc eax
mov dword [esp + 0x78], ebx
mov dword [esp + 0x34], eax
lea eax, [esp + 0x2d4]
push eax
lea eax, [esp + 0x2c8]
mov dword [esp + 0x80], ebx
push eax
push ebx
movdqu xmmword [esp + 0x2d0], xmm0
call fcn.10012921
mov dword [esp + 0x38], 0x6fef6f1a
cmp dword [esp + 0x30], ebx
jne 0x1001fcbe
mov edi, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x70]
mov ecx, dword [esi + 8]
sub ecx, dword [eax + 8]
xor eax, eax
cmp ecx, 0x266c0953
setl al
xor edx, edx
cmp eax, dword [esi + edi*4]
mov eax, dword [esp + 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x30]
setg cl
xor eax, eax
inc eax
cmp ecx, eax
mov eax, dword [esp + 0x50]
sbb ecx, ecx
neg ecx
cmp ecx, dword [eax + edx*4]
jne 0x1001fcbe
mov eax, ebx
jmp 0x1001fcc1
xor eax, eax
inc eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 0xe8bd61c0
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x70], 0
mov dword [esp + 0x30], eax
je 0x1001fcf2
push dword [esp + 0x70]
call fcn.10055e77
pop ecx
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x78], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x1001fb90
mov esi, dword [esp + 0x44]
xor edx, edx
inc edx
mov eax, edx
cmp dword [esp + 0x18], ebx
jne 0x1001fd12
mov eax, ebx
neg eax
jne 0x1001fd28
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x10], eax
jl 0x1001fd28
mov ecx, ebx
cmp dword [esp + 0x20], ebx
je 0x1001fd2a
mov ecx, edx
mov eax, dword [esp + 0x50]
cmp dword [eax], ecx
jg 0x1001fd3a
mov eax, ebx
cmp dword [esp + 0x20], ebx
je 0x1001fd3c
mov eax, edx
push 2
pop ecx
cmp ecx, eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
cmp eax, ecx
setle dl
mov dword [esi + 8], edx
dec dword [esp + 0xc]
jns 0x1001fb69
xor edi, edi
inc edi
cmp dword [esp + 0x64], 0
je 0x1001fd84
push dword [esp + 0x64]
call fcn.10055e77
pop ecx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], ebx
or eax, 0xffffffff
mov dword [esp + 0x4364], eax
cmp dword [esp + 0x50], 0
je 0x1001fdab
push dword [esp + 0x50]
call fcn.10055e77
pop ecx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
lea eax, [esp + 0x7c]
push eax
call fcn.100222d6
mov eax, dword [eax]
test eax, eax
je 0x1001fe25
push 0xfffffffffffffff9
mov dword [esp + 0x14], 0xea5d6c05
mov dword [esp + 0x170], eax
mov dword [esp + 0x14], 0x1c
pop edi
jmp 0x1001fdea
cmp byte [esp + 0x17], 0
je 0x1001fde6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommState]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], edi
mov byte [esp + 0x17], bl
je 0x1001fdd7
cmp byte [esp + 0x17], 0
je 0x10021a31
push 0xb5d
push 0x7c
push 0x25be
push 0x192d
push 0x152e
push 0x417
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x10021a31
mov dword [esp + 0xc], 0x162c9cc1
lea ecx, [esp + 0xfc]
mov dword [esp + 0x2c], 0xa733e34b
mov dword [esp + 0x20], 0x45d
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0x56a4
push 3
call fcn.1000f401
mov dword [esp + 0x4364], 7
lea eax, [esp + 0x280]
push dword [esp + 0x4c]
movdqa xmm0, xmmword [0x10008a10]
lea ecx, [esp + 0x90]
push eax
lea eax, [esp + 0x278]
mov dword [esp + 0x38], 0x32d45ab6
push eax
push ebx
movdqu xmmword [esp + 0x280], xmm0
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
call fcn.10012921
or edx, 0xffffffff
mov dword [esp + 0x38], edx
mov dword [esp + 0x18], ebx
jmp 0x1001fed1
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1f8], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001fec2
push 2
pop ecx
push 0xfffffffffffffffe
mov dword [esp + 0x1c], ebx
pop esi
jmp 0x1001fef3
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x84], esi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001fee4
mov dword [esp + 0x18], ebx
jmp 0x1001ff11
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001feff
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [esp + 0x2c], eax
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
sub edx, 0x92c6
neg edx
sbb edx, edx
inc edx
cmp edx, eax
mov edx, dword [esp + 0xc]
setl cl
add edx, ecx
xor ecx, ecx
mov dword [esp + 0x204], edx
mov eax, dword [esp + 0x2c]
cmp eax, 0xfffffff7
setg cl
xor eax, eax
cmp ecx, edx
mov ecx, 0xbae0fc36
setne al
cmp ecx, eax
sbb eax, eax
neg eax
imul eax, dword [esp + 0xc]
sub eax, dword [esp + 0xc]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0xc]
jge 0x1001ff86
mov ecx, ebx
cmp dword [esp + 0xc], ebx
je 0x1001ff88
mov ecx, edi
mov eax, dword [esp + 0xc]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x204]
cmp ecx, eax
mov eax, dword [esp + 0x1fc]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setg cl
xor edx, edx
cmp ecx, 5
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x1f8]
cmp edx, eax
setle cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
add eax, dword [esp + 0x204]
je 0x1001fffe
mov ecx, edi
cmp dword [esp + 0x88], ebx
jne 0x10020000
mov ecx, ebx
mov eax, dword [esp + 0x1c]
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
mov dword [esp + 0x204], edx
mov eax, dword [esp + 0xc]
cmp edx, eax
mov eax, dword [esp + 0xfc]
setg cl
xor edx, edx
cmp ecx, 7
setg dl
mov dword [eax + 8], edx
xor edx, edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp eax, 0x7f79
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x88]
cmp eax, dword [esp + 0x88]
jge 0x10020084
mov eax, ebx
cmp dword [esp + 0x1c], ebx
je 0x10020086
mov eax, edi
mov ecx, dword [esp + 0x28]
sub ecx, eax
mov eax, dword [esp + 0x8c]
mov dword [eax + 4], ecx
dec dword [esp + 0x28]
mov eax, dword [esp + 0x88]
mov eax, dword [esp + 0x88]
push dword [esp + 0x8c]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x3c], eax
call fcn.10055e77
or eax, 0xffffffff
mov dword [esp + 0x90], ebx
pop ecx
mov dword [esp + 0x4364], eax
push dword [esp + 0xfc]
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
call fcn.10055e77
mov eax, dword [0x11d42670]
mov dword [esp + 0x100], ebx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
pop ecx
test al, 2
jne 0x100201af
push 2
pop ecx
or eax, ecx
mov dword [0x11d42670], eax
push ebx
mov dword [esp + 0x4368], 8
push ebx
mov dword [0x11d42630], ebx
mov dword [0x11d42634], ebx
call fcn.10011e7b
mov dword [0x11d42630], eax
mov dword [0x11d42638], ebx
mov dword [0x11d42640], ebx
push 0xa
pop ecx
mov byte [esp + 0x4364], cl
mov ecx, 0x11d42638
mov dword [esp + 0x1bc], eax
lea eax, [esp + 0x1bc]
push eax
push 0x10
push ebx
lea eax, [esp + 0x278]
mov dword [0x11d4264c], 0x3f800000
push eax
mov dword [0x11d4263c], ebx
call fcn.10011c53
push 0x10070f22
mov dword [0x11d42644], 7
mov dword [0x11d42648], 8
call fcn.10055ce5
pop ecx
or ecx, 0xffffffff
mov dword [esp + 0x4364], ecx
jmp 0x100201b2
or ecx, 0xffffffff
mov dword [esp + 0xc], 0x49fe387
mov dword [esp + 0x30], ecx
cmp dword [esp + 0xc], ebx
je 0x100201fc
mov dword [esp + 0x20], 7
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10020327
push 0x141a
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
jmp 0x10020327
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], 0xd8af8716
mov dword [esp + 0x2c], 0x949
mov dword [esp + 0x24], 0xd58e7ea
mov dword [esp + 0x24], 3
mov dword [esp + 0x28], ecx
push 2
pop eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], ebx
jne 0x10020253
cmp dword [esp + 0xc], ebx
je 0x1002025b
mov edx, edi
cmp dword [esp + 0x1c], ebx
jne 0x1002025d
mov edx, ebx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
add eax, edx
add ecx, eax
mov dword [esp + 0x30], ecx
je 0x10020277
mov eax, edi
cmp dword [esp + 0x1c], ebx
jne 0x10020279
mov eax, ebx
mov dword [esp + 0x24], eax
or ecx, 0xffffffff
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0xc]
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x28]
jl 0x100202ac
mov eax, dword [esp + 0x2c]
dec dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 4
setne al
xor edx, edx
add eax, 0xfff9
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
cmp ecx, eax
setge dl
mov dword [esp + 0x2c], edx
xor edx, edx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
setne dl
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], 0xf4aedf2f
xor ecx, ecx
xorps xmm0, xmm0
inc ecx
movdqu xmmword [esp + 0x15c], xmm0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], 0xacc4b7c7
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], 0xfa08
mov dword [esp + 0x38], 0x617092ff
mov dword [esp + 0x30], 0xde87
mov dword [esp + 0x10], ebx
jmp 0x1002037b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x21c], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1002036c
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 3
jg 0x1002041a
xor ebx, ebx
inc ebx
or esi, 0xffffffff
mov dword [esp + 0x20], 0x9bacde9e
xor ecx, ecx
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x21c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x21c]
cmp eax, ebx
mov eax, dword [esp + 0x18]
setl cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [esp + 0x224]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
add eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
mov edx, dword [esp + 0x24]
add edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
cmp edx, eax
setne cl
mov dword [esp + 0x1c], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x10020397
xor ecx, ecx
xor ebx, ebx
push 0xfffffffffffffffe
inc ecx
pop esi
cmp dword [esp + 0x220], ebx
je 0x10020450
mov dword [esp + 0x30], 0x8d23
mov dword [esp + 0x30], esi
mov dword [esp + 0x30], 0xe66b6c7e
mov dword [esp + 0x30], ecx
mov dword [esp + 0x30], 0xa6b9
mov dword [esp + 0x1c], 9
jmp 0x10020611
mov dword [esp + 0x10], ecx
mov ecx, 0x2da0
mov dword [esp + 0x20], 0xedcddcde
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x10], 0xffff
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setge dl
mov dword [esp + 0x30], edx
mov dword [esp + 0x24], 0xffffffe7
jmp 0x10020606
mov dword [esp + 0x28], 0xb03c7580
lea ecx, [esp + 0xf0]
push 3
call fcn.1000f401
mov dword [esp + 0xc], ebx
jmp 0x100204d8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xf0]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x100204c6
mov dword [esp + 0xc], ebx
jmp 0x100204f8
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x2f8], 0x413ed762
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x100204e5
mov dword [esp + 0x18], ebx
jmp 0x100205cb
mov dword [esp + 0xc], 0xfffd
cmp dword [esp + 0x28], ebx
jne 0x100205ae
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0x28]
cmp ecx, eax
setl dl
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x220]
mov eax, dword [esp + 0xc]
neg ecx
sbb ecx, ecx
neg ecx
sub eax, ecx
xor ecx, ecx
imul eax, eax, 0x8e6a
inc ecx
cmp ecx, eax
sbb eax, eax
inc eax
imul eax, dword [esp + 0x38]
test eax, eax
je 0x10020567
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xf0]
imul eax, dword [eax], 0x3c28
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x5c2
mov eax, dword [esp + 0x28]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp ecx, 0x9ac8
setg al
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
cmp eax, 0xf159e9dc
setg cl
mov dword [esp + 0x2f8], ecx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff1
jne 0x10020508
cmp dword [esp + 0xf0], 0
je 0x10020602
push dword [esp + 0xf0]
call fcn.10055e77
pop ecx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov dword [esp + 0xf8], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x20
jle 0x100204aa
lea eax, [esp + 0x48]
push eax
call fcn.10022338
cmp byte [ebp + 0xc], 0
mov esi, dword [eax]
mov dword [esp + 0x2c], esi
jne 0x1002062f
test esi, esi
jne 0x10020a23
mov dword [esp + 0xc], 0x1824a8c6
mov dword [esp + 0xc], 0x13
cmp dword [esp + 0xc], 0xfffffff1
jg 0x100206a0
push 2
pop ecx
mov dword [esp + 0x10], 0x1891f782
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 3
jge 0x10020678
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2ec], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1002065f
push 2
pop ecx
mov dword [esp + 0x10], ebx
jmp 0x1002068f
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x2ec], ebx
jne 0x10020695
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jle 0x1002067e
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff1
jle 0x10020649
mov dword [esp + 0xc], ebx
jmp 0x100206c5
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100206c1
push 0x1ff6
push 0x1f61
call dword [sym.imp.USER32.dll_GetDlgItem]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x14
jne 0x100206a6
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x308]
mov ecx, dword [esp + 0x48]
push eax
call fcn.100136af
mov esi, eax
lea edi, [esp + 0x160]
xor eax, eax
pop ecx
inc eax
lea ecx, [esp + 0x120]
movsd dword es:[edi], dword [esi]
push eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.1000f401
xor edx, edx
mov dword [esp + 0x10], 0xc4d8e5cc
mov dword [esp + 0x10], ebx
inc edx
jmp 0x10020725
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0xd3df75dc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1002070f
mov dword [esp + 0x10], ebx
jmp 0x1002074b
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10020747
push 0x15a
call dword [sym.imp.USER32.dll_IsWindow]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10020731
cmp dword [esp + 0x120], 0
je 0x1002077d
push dword [esp + 0x120]
call fcn.10055e77
pop ecx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
cmp byte [ebp + 0xc], 0
je 0x10020a1f
cmp dword [esp + 0x164], 0
je 0x10020a1f
mov eax, dword [esp + 0x168]
mov dword [esp + 0x30], 0x20a3
cmp dword [esp + 0x30], 0xa9f
mov dword [esp + 0x170], eax
jge 0x10020830
call fcn.10057b78
add eax, 0x20
push eax
push 0x100082d4
push 0x100082d8
call fcn.100584b3
add esp, 0xc
lea eax, [esp + 0x318]
xor edi, edi
inc edi
push 0x3e
push edi
push eax
call fcn.1000ef8d
add esp, 0xc
mov esi, edi
cmp byte [esp + esi + 0x318], 0
je 0x10020828
push esi
mov ecx, 0x10661e78
call fcn.1000f0f4
push eax
call fcn.10011f68
mov eax, esi
pop ecx
cmp esi, 0x3e
jge 0x10020828
mov byte [esp + eax + 0x318], bl
mov ecx, eax
jmp 0x1002081d
cdq
idiv dword [esp + 0x34]
add ecx, edx
test eax, eax
jne 0x10020816
mov eax, ecx
cmp ecx, 0x3e
jl 0x1002080b
inc esi
cmp esi, 0x3e
jl 0x100207e8
jmp 0x10020833
xor edi, edi
inc edi
mov dword [esp + 0xc], 0x1824a8c6
mov dword [esp + 0xc], 0x13
jmp 0x100209da
mov dword [esp + 0x10], 0x1891f782
mov dword [esp + 0x10], ebx
jmp 0x10020865
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2e0], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10020856
push 2
mov dword [esp + 0x14], ebx
pop edi
jmp 0x100209c9
mov dword [esp + 0x34], 0x2684
cmp dword [esp + 0x34], 0x44c
jge 0x100209b8
lea eax, [esp + 0x5c]
push eax
lea eax, [esp + 0x64]
push eax
push 0x100081cc
call fcn.10055adb
add esp, 0xc
jmp 0x100209b0
push 0x4000
lea eax, [esp + 0x35c]
push ebx
push eax
call fcn.1000ef8d
xor eax, eax
mov dword [esp + 0x2c], ebx
inc eax
add esp, 0xc
cmp dword [esp + 0x60], 0
mov byte [esp + 0x358], al
jle 0x10020972
lea eax, [esp + 0x98]
mov edi, ebx
push eax
push 0x10008178
call fcn.10055adb
cmp dword [esp + 0xa0], 0
mov esi, ebx
pop ecx
pop ecx
jle 0x10020933
xor ebx, ebx
lea eax, [esp + 0xbc]
push eax
push 0x10008178
call fcn.10055adb
pop ecx
pop ecx
mov ecx, dword [esp + 0xbc]
lea eax, [ebx + 1]
dec ecx
shl eax, cl
or edi, eax
mov dword [esp + 0xbc], ecx
inc esi
cmp esi, dword [esp + 0x98]
jl 0x100208fd
xor ebx, ebx
mov esi, dword [esp + 0x5c]
xor eax, eax
mov ecx, esi
lea edx, [eax + 1]
shl edx, cl
jmp 0x10020954
mov al, byte [esp + edx + 0x358]
mov ecx, edx
or ecx, edi
or byte [esp + ecx + 0x358], al
dec edx
jns 0x10020942
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [esp + 0x60]
jl 0x100208d9
xor eax, eax
push 2
inc eax
pop edi
jmp 0x10020976
mov esi, dword [esp + 0x5c]
mov ecx, esi
mov edx, ebx
shl eax, cl
jmp 0x10020989
cmp byte [esp + eax + 0x358], 0
je 0x10020989
inc edx
dec eax
test eax, eax
jg 0x1002097e
push edx
push 0x10008198
call fcn.10055d0f
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x6c]
push eax
push 0x100081cc
call fcn.10055adb
add esp, 0x14
cmp eax, edi
je 0x100208aa
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x2e0], ebx
jne 0x100209d3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x10020878
dec dword [esp + 0xc]
push 1
pop edi
cmp dword [esp + 0xc], 0xfffffff1
jle 0x10020848
mov dword [esp + 0xc], ebx
jmp 0x10020a0a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10020a06
push 0x1ff6
push 0x1f61
call dword [sym.imp.USER32.dll_GetDlgItem]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x14
jne 0x100209eb
mov eax, dword [esp + 0x164]
mov dword [esp + 0x174], eax
mov esi, dword [esp + 0x2c]
xor ecx, ecx
mov dword [esp + 0xc], ebx
inc ecx
jmp 0x10020a38
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x40], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x10020a2c
push 2
mov dword [esp + 0x10], ebx
pop edi
jmp 0x10020a5a
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xa8], 0xfffffff7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10020a47
mov dword [esp + 0x40], 0xfffffff3
cmp dword [esp + 0x40], 0x1d
jl 0x10020b16
or edi, 0xffffffff
push ecx
mov dword [esp + 0x38], edi
lea ecx, [esp + 0x180]
call fcn.1000f401
xor edx, edx
mov dword [esp + 0xc], ebx
inc edx
jmp 0x10020aa3
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x80], 0xf889
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10020a90
mov dword [esp + 0xc], ebx
jmp 0x10020ac5
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x17c]
mov dword [eax + ecx*4], 0x6cef
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10020aaf
mov eax, dword [esp + 0x34]
dec eax
je 0x10020ada
mov ecx, edx
cmp dword [esp + 0x40], ebx
jne 0x10020adc
mov ecx, ebx
mov eax, dword [esp + 0x17c]
push eax
mov dword [eax], ecx
call fcn.10055e77
pop ecx
mov dword [esp + 0x17c], ebx
mov dword [esp + 0x180], ebx
mov dword [esp + 0x184], ebx
inc dword [esp + 0x40]
cmp dword [esp + 0x40], 0x1d
push 1
pop ecx
jge 0x10020a76
push 2
pop edi
mov dword [esp + 0xac], ebx
jmp 0x10020b66
mov dword [esp + 0x10], 0xc1094d0e
mov dword [esp + 0x10], ebx
jmp 0x10020b59
mov dword [esp + 0x34], 0xfffffffc
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10020b4d
push ebx
push 0xbf3
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [esp + 0x34], 0x1e7bf5cb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10020b2d
inc dword [esp + 0xac]
cmp dword [esp + 0xac], ebx
jle 0x10020b1f
test esi, esi
jne 0x10021564
cmp dword [esp + 0x15c], esi
jle 0x10021564
push 4
lea ecx, [esp + 0x118]
call fcn.1000f401
mov dword [esp + 0x4364], 0xb
lea ecx, [esp + 0x108]
mov dword [esp + 0x10], 0x100c4307
push edi
call fcn.1000f401
mov dword [esp + 0xc], ebx
or esi, 0xffffffff
cmp dword [esp + 0xc], 4
jge 0x10020bd4
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], esi
inc dword [esp + 0xc]
jmp 0x10020bb9
mov dword [esp + 0xc], ebx
jmp 0x10020bf0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0x39
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10020bda
mov ecx, dword [esp + 0x114]
cmp dword [ecx + 4], 0xffff
je 0x10020c2a
xor eax, eax
cmp dword [ecx], ebx
sete al
imul eax, dword [ecx + 4]
test eax, eax
je 0x10020c20
cmp dword [esp + 0x10], ebx
je 0x10020c20
xor eax, eax
inc eax
jmp 0x10020c22
mov eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
push 0xfffffffffffffff7
pop eax
mov dword [esp + 0x244], eax
mov dword [esp + 0x248], eax
mov dword [esp + 0x24c], eax
mov dword [esp + 0x250], eax
mov dword [esp + 0x34], 0x97e65fb
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
add eax, dword [esp + 0x250]
cmp dword [esp + 0x108], 0
mov dword [esp + 0x10], eax
je 0x10020c95
push dword [esp + 0x108]
call fcn.10055e77
pop ecx
mov dword [esp + 0x108], ebx
mov dword [esp + 0x10c], ebx
mov dword [esp + 0x110], ebx
mov dword [esp + 0x4364], esi
push dword [esp + 0x114]
call fcn.10055e77
xor eax, eax
mov dword [esp + 0x118], ebx
pop ecx
inc eax
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
lea ecx, [esp + 0x9c]
mov dword [esp + 0xc], eax
push eax
call fcn.1000f401
xor edx, edx
mov dword [esp + 0x34], 0xd7d393e7
mov dword [esp + 0x18], ebx
inc edx
jmp 0x10020cf9
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], 0xce4a6f44
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10020ce3
mov dword [esp + 0x18], ebx
jmp 0x10020d18
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x214], 7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10020d05
mov eax, dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
add edx, 0x1328
cmp edx, eax
setle cl
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x9c]
add dword [eax], ecx
mov ecx, dword [esp + 0x218]
mov eax, dword [esp + 0x9c]
imul ecx, dword [eax]
xor eax, eax
inc eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], ebx
jl 0x10020d90
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x214]
mov eax, dword [esp + 0x9c]
mov dword [eax], ecx
dec dword [esp + 0xc]
jns 0x10020d76
push dword [esp + 0x9c]
call fcn.10055e77
pop ecx
push 3
lea ecx, [esp + 0xe8]
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
mov dword [esp + 0xa8], ebx
call fcn.1000f401
mov dword [esp + 0x4364], 0xd
lea eax, [esp + 0x290]
push dword [esp + 0x80]
movdqa xmm0, xmmword [0x10008ab0]
lea ecx, [esp + 0xb4]
push eax
lea eax, [esp + 0x288]
mov dword [esp + 0x28], 0xfffffff7
push eax
mov dword [esp + 0x2c], 0x1230b63e
push ebx
movdqu xmmword [esp + 0x290], xmm0
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
mov dword [esp + 0xc8], ebx
call fcn.10012921
mov byte [esp + 0x4364], 0xe
mov dword [esp + 0x10], ebx
jmp 0x10020e49
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0xa61928c1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10020e33
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10020e67
push ebx
push 0x1b12
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov esi, dword [esp + 0xe4]
push 0xfffffffffffffff9
pop edi
mov dword [esi + 4], edi
mov edi, dword [esp + 0xb0]
xor eax, eax
mov dword [esp + 0xc], 0xac70c309
inc eax
mov dword [esp + 0x10], 0x854668da
push eax
lea ecx, [esp + 0x154]
call fcn.1000f401
xor edx, edx
mov byte [esp + 0x4364], 0xf
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x10020ec2
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0xcecb2ec6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x10020eac
mov dword [esp + 0xc], 0x1a
cmp dword [esp + 0xc], 0xfffffffd
jle 0x10020f78
jmp 0x10020ee0
xor edx, edx
inc edx
push edx
lea ecx, [esp + 0x13c]
call fcn.1000f401
xor edx, edx
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x10020f09
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x138]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x10020ef6
mov eax, dword [esp + 0x138]
mov dword [eax], ebx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10020f39
push ebx
push 0x1c2e
push 0x37a
push 0x1ae4
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
cmp dword [esp + 0xc], ebx
mov eax, dword [esp + 0x138]
jne 0x10020f4d
inc dword [eax]
cmp dword [eax], 0x1a
jle 0x10020f18
push eax
call fcn.10055e77
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ebx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffd
pop ecx
jg 0x10020edd
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 4]
sub ecx, eax
xor eax, eax
cmp ecx, dword [esi + 4]
setle al
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xe4]
mov edx, dword [eax]
mov eax, dword [esp + 0x10]
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 0x349b496e
cmp ecx, 0x1546
setl al
cmp eax, 0x9552
jg 0x10020fe7
cmp dword [esp + 0xc], ebx
je 0x10020fe7
xor eax, eax
lea edx, [eax + 1]
jmp 0x10020fe9
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
sub ecx, dword [esp + 0x10]
dec ecx
cmp eax, ecx
sbb eax, eax
neg eax
imul eax, dword [esp + 0x10]
cmp eax, 0xd8491f19
mov eax, dword [esp + 0x150]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax]
setge dl
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov byte [esp + 0x4364], 0xe
push dword [esp + 0x150]
mov dword [edi + 4], eax
call fcn.10055e77
inc dword [esi + 4]
cmp dword [esi + 4], 0xe
pop ecx
mov dword [esp + 0x150], ebx
mov dword [esp + 0x154], ebx
mov dword [esp + 0x158], ebx
jne 0x10020e7b
push dword [esp + 0xb0]
call fcn.10055e77
pop ecx
or esi, 0xffffffff
mov dword [esp + 0xb0], ebx
mov dword [esp + 0x4364], esi
push dword [esp + 0xe4]
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
call fcn.10055e77
xor eax, eax
mov dword [esp + 0xe8], ebx
pop ecx
inc eax
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
lea ecx, [esp + 0xc0]
mov dword [esp + 0xc], 0xecba
mov dword [esp + 0x10], ebx
push eax
call fcn.1000f401
xor edx, edx
mov dword [esp + 0x10], ebx
push 0xfffffffffffffff9
inc edx
pop edi
jmp 0x100210eb
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 0x27363782
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100210d5
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp dword [esp + 0xc], 0x57a67d93
jl 0x1002110b
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, esi
mov edx, dword [esp + 0xc0]
sub ecx, eax
je 0x10021127
cmp dword [edx], ebx
je 0x10021127
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10021129
mov ecx, ebx
xor eax, eax
cmp ecx, dword [edx]
setl al
add eax, dword [edx]
jne 0x10021138
cmp dword [edx], eax
jne 0x10021141
cmp dword [edx], 0
jne 0x10021141
mov ecx, ebx
jmp 0x10021146
xor eax, eax
lea ecx, [eax + 1]
mov eax, dword [esp + 0xc]
xor edx, edx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0xc0]
sete dl
xor ecx, ecx
sub edx, dword [eax]
mov eax, dword [esp + 0x10]
cmp eax, edx
mov eax, dword [esp + 0xc0]
setge cl
add ecx, dword [eax]
mov byte [esp + 0x17], bl
je 0x100211ce
push 3
pop edi
push edi
lea ecx, [esp + 0x230]
call fcn.1000f401
mov dword [esp + 0x34], 9
mov dword [esp + 0xc], ebx
jmp 0x10021595
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x12c], 0xad313dd3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10021582
mov dword [esp + 0xc], ebx
jmp 0x100215b7
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x22c]
mov dword [eax + ecx*4], 0x8987f2fb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x100215a1
mov dword [esp + 0x130], ebx
cmp dword [esp + 0x130], 0x1b
je 0x100215f4
mov ecx, dword [esp + 0x22c]
mov eax, dword [esp + 0x12c]
sub eax, dword [ecx + 4]
mov dword [esp + 0x34], eax
inc dword [esp + 0x130]
cmp dword [esp + 0x130], 0x1b
jne 0x100215d5
lea ecx, [esp + 0x22c]
call fcn.1000fd61
lea ecx, [esp + 0x15c]
call fcn.1001b35a
xor eax, eax
lea ecx, [esp + 0x238]
inc eax
push eax
call fcn.1000f401
or eax, 0xffffffff
xor edx, edx
mov dword [esp + 0x2c], eax
inc edx
mov dword [esp + 0x1c], 0x466
mov dword [esp + 0x24], 0x639e6a41
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 8
mov dword [esp + 0x10], ebx
jmp 0x1002165e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x238]
mov dword [eax + ecx*4], 0xb963ab1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10021648
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
cmp eax, edx
mov eax, dword [esp + 0x238]
setl cl
sub ecx, dword [eax]
jne 0x1002168e
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
test eax, eax
setle cl
add ecx, dword [esp + 0x1c]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100216d5
push 0x2691
push 0x1957
push 0x21e3
call dword [sym.imp.KERNEL32.dll_HeapCreate]
lea ecx, [esp + 0x238]
call fcn.1000fd61
test esi, esi
je 0x1002189b
mov dword [esp + 0x10], 0x9fdf99ff
or eax, 0xffffffff
mov dword [esp + 0x28], 0xcd795364
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ebx
jmp 0x1002176f
mov dword [esp + 0x34], 0x6c619a80
xor ecx, ecx
mov dword [esp + 0x30], 0x9737e0d1
inc ecx
mov dword [esp + 0x1c], ebx
jmp 0x10021732
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x19c], 0x92ea21e1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1002171f
inc dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x19c], 0x4df6f978
mov eax, dword [esp + 0x34]
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x28]
cmp eax, 0x863c
setg cl
add ecx, dword [esp + 0x10]
neg ecx
mov dword [esp + 0x30], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1a
jg 0x10021706
mov edx, dword [esp + 0x3c]
mov ecx, esi
call fcn.1001f560
mov edi, eax
mov dword [esp + 0x10], 0x91a049fe
xor eax, eax
mov dword [esp + 0x20], 0x11d7feae
mov dword [esp + 0x16c], edi
inc eax
mov dword [esp + 0x10], 0xfffffff2
jmp 0x10021882
mov dword [esp + 0x24], 0x22124f84
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 0xffffffea
jl 0x1002187e
push 2
pop esi
push esi
lea ecx, [esp + 0x20c]
call fcn.1000f401
mov dword [esp + 0x3c], 0x1db95674
mov dword [esp + 0x1c], ebx
jmp 0x100217f9
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x208]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x100217e3
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x208]
mov eax, dword [esp + 0x24]
cmp dword [esi + 4], ebx
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, dword [esi + 4]
mov eax, dword [esp + 0x208]
setle cl
cmp ecx, dword [eax]
jg 0x10021840
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, 1
setg cl
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x208]
call fcn.1000fd61
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xffffffea
jge 0x100217c5
xor eax, eax
inc eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jle 0x100217aa
lea eax, [esp + 0x7c]
push eax
call fcn.100222d6
push 3
mov dword [eax], edi
pop edi
mov dword [esp + 0x24], 0x15252cb1
mov dword [esp + 0x10], ebx
jmp 0x100218b8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1b0], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100218a9
push 2
pop eax
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ebx
jl 0x10021a31
mov dword [esp + 0xc], 0xc4530722
mov dword [esp + 0x20], 0xfec1e183
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], ebx
jl 0x10021a19
or eax, 0xffffffff
xor edx, edx
mov dword [esp + 0x28], eax
inc edx
mov eax, dword [esp + 0x24]
cmp dword [esp + eax*4 + 0x1b0], ebx
jne 0x10021923
mov eax, dword [esp + 0xc]
mov ecx, edx
mov eax, dword [esp + 0x1b8]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
sub ecx, eax
mov ecx, ebx
je 0x10021925
mov ecx, edx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + eax*4 + 0x1b0]
sub eax, ecx
add eax, dword [esp + 0xc]
cmp eax, dword [esp + 0xc]
jg 0x100219d3
push edx
lea ecx, [esp + 0x264]
call fcn.1000f401
mov dword [esp + 0x3c], 0x1b0ce7ae
xor edx, edx
mov dword [esp + 0x3c], 0x19cd890f
inc edx
mov dword [esp + 0x10], ebx
jmp 0x1002197c
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x260]
mov dword [eax + ecx*4], 0xa3a7221e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10021966
imul ecx, dword [esp + 0x20], 0xfffe
xor edx, edx
add ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + eax*4 + 0x1b0]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
setg cl
xor edx, edx
cmp ecx, 0xf77d
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x3c], ecx
lea ecx, [esp + 0x260]
call fcn.1000fd61
jmp 0x10021a0f
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10021a0f
push ebx
push 0x1b47
push 0x1bf0
push 0xe5e
push 0x360
push 0xa14
push 0x224f
push 0x22e3
push 0xda2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
dec dword [esp + 0xc]
jns 0x100218ed
mov eax, dword [esp + 0x24]
push 2
mov eax, dword [esp + eax*4 + 0x1b4]
dec dword [esp + 0x28]
pop eax
jns 0x100218cf
mov eax, dword [ebp + 8]
lea esi, [esp + 0x16c]
mov ecx, dword [esp + 0x435c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret