Function at 0x100198fb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100881b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push esi
push edi
mov dword [esp + 0x28], 0x52061f6
push 2
pop esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0xe48d327c
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
push 0
mov dword [esp + 0x14], 0x7571177e
mov dword [esp + 0x34], 0xffffffff
pop ebx
mov dword [esp + 0x30], 0xbf079684
push 1
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x98], edx
mov dword [esp + 0x70], ecx
mov dword [esp + 0x14], 4
pop edi
jmp 0x10019a8b
push edi
lea ecx, [esp + 0x19c]
call fcn.10017a59
mov dword [esp + 0x22c], ebx
mov dword [esp + 0x30], 0x6ee4e912
mov dword [esp + 0x30], 0xfbf68593
mov dword [esp + 0x30], 0x7fc0549e
mov dword [esp + 0x30], 0x7f08e229
mov dword [esp + 0x14], ebx
jmp 0x100199cc
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 0x351c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x100199b6
mov dword [esp + 0x28], ebx
jmp 0x10019a68
mov dword [esp + 0x18], 0x923e64f1
mov dword [esp + 0x30], 0x9989d221
mov dword [esp + 0x14], ebx
jmp 0x10019a04
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x204], 0x950a4ba3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x100199f1
mov dword [esp + 0x18], ebx
jmp 0x10019a5e
mov dword [esp + 0x30], 0xd63a88e0
lea ecx, [esp + 0x18c]
push 3
call fcn.10017a59
mov dword [esp + 0x14], ebx
jmp 0x10019a43
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18c]
mov dword [eax + ecx*4], 0x57e71f09
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019a2d
inc dword [esp + 0x1c]
lea ecx, [esp + 0x18c]
call fcn.10017adb
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x10019a11
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x13
jle 0x100199db
or dword [esp + 0x22c], 0xffffffff
lea ecx, [esp + 0x198]
call fcn.10017adb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x17
mov dword [esp + 0x28], ebx
jne 0x1001997c
jmp 0x10019ded
push dword [esp + 0x6c]
movdqa xmm0, xmmword [0x100081f0]
lea eax, [esp + 0x1f8]
push eax
lea eax, [esp + 0x1ec]
mov dword [esp + 0x18], ebx
push eax
mov dword [esp + 0x24], 8
lea ecx, [esp + 0xa4]
push ebx
movdqu xmmword [esp + 0x1f4], xmm0
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
call fcn.10018f62
mov dword [esp + 0x14], 0xfffffffe
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xffffffe2
jne 0x10019ba3
mov esi, dword [esp + 0x98]
mov dword [esp + 0x1c], 0x56370016
mov dword [esp + 0x14], ebx
jmp 0x10019b2d
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xf0], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019b1e
mov eax, dword [esp + 0x10]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0xf8]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xf0]
cmp dword [esi + 0xc], edi
jne 0x10019b62
mov ecx, edi
cmp dword [esp + 0xf8], ebx
jne 0x10019b64
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffff8
setne al
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0xf8]
mov edx, dword [esp + 0x10]
sub edx, eax
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [esp + 0x14], ecx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe2
je 0x10019b10
push 2
pop esi
mov dword [esp + 0x14], 0xfffffffa
jmp 0x10019bde
mov dword [esp + 0x2c], 0x715ee56e
mov dword [esp + 0x18], ebx
jmp 0x10019bd4
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x1c]
dec eax
mov dword [esp + 0x10], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x10019bbb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1c
jle 0x10019bad
lea ecx, [esp + 0x98]
call fcn.10017adb
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 0xe2632c5b
mov dword [esp + 0x1c], 0xfffffffb
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], 0
je 0x10019c19
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xa
jg 0x10019cf3
mov dword [esp + 0x14], 0x50b5f0b1
mov dword [esp + 0x1c], edi
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
neg esi
mov eax, dword [esp + 0x10]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
mov eax, dword [esp + 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x10]
setne cl
mov dword [esp + 0x1c], ecx
xor ecx, ecx
cmp esi, eax
setge cl
xor eax, eax
cmp ecx, dword [esp + 0x1c]
setl al
sub eax, dword [esp + 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
sub eax, dword [esp + 0x10]
imul ecx, eax, 0x3ecf
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov ecx, 0xadca1a1f
setle dl
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x10]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], 0x11
jmp 0x10019cda
mov byte [esp + 0x23], bl
cmp byte [esp + 0x23], 0
je 0x10019cd6
call dword [sym.imp.KERNEL32.dll_GetACP]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10019cc5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xa
jle 0x10019c28
push 2
pop esi
mov dword [esp + 0x30], 0x56915a13
lea ecx, [esp + 0x168]
mov dword [esp + 0x30], 0xfffffffe
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0xe5c7a00f
mov dword [esp + 0x30], 0xc5416513
mov dword [esp + 0x30], ebx
mov dword [esp + 0x30], 0x76b87d0f
mov dword [esp + 0x30], 0x1fc9a57b
mov dword [esp + 0x30], 0x5047c4d1
mov dword [esp + 0x30], 0xce4a6f44
push esi
call fcn.10017a59
push esi
lea ecx, [esp + 0x138]
mov dword [esp + 0x230], edi
call fcn.10017a59
mov dword [esp + 0x10], ebx
jmp 0x10019d78
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019d66
mov dword [esp + 0x10], ebx
jmp 0x10019d9a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0x2f7c629c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019d84
mov eax, dword [esp + 0x134]
lea ecx, [esp + 0x134]
dec dword [eax]
call fcn.10017adb
or dword [esp + 0x22c], 0xffffffff
lea ecx, [esp + 0x168]
call fcn.10017adb
mov dword [esp + 0x14], ebx
jmp 0x10019ddf
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x68], 0xc370
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10019dcf
dec dword [esp + 0x68]
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x22
jl 0x10019a9f
push 3
lea ecx, [esp + 0xe8]
call fcn.10017a59
mov dword [esp + 0x22c], esi
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x2c], 6
mov dword [esp + 0x30], 8
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x30], 0xfffffff9
push esi
call fcn.10017a59
mov dword [esp + 0x1c], 0x96e6
mov dword [esp + 0x10], ebx
jmp 0x10019e66
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019e50
mov dword [esp + 0x10], ebx
jmp 0x10019e86
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x114], 0xfffffff8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019e73
mov dword [esp + 0x10], ebx
jmp 0x10019ea4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019e92
mov ecx, dword [esp + 0xe4]
xor edx, edx
mov eax, dword [ecx + 4]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x114]
mov eax, dword [esp + 0x114]
mov esi, dword [ecx + 4]
mov eax, dword [esp + 0xe4]
lea ecx, [esi + esi]
cmp ecx, dword [eax]
setle dl
xor ecx, ecx
cmp edx, 0x2af
setne cl
xor eax, eax
cmp ecx, esi
lea ecx, [esp + 0x1a4]
setl al
mov dword [esp + 0x2c], eax
inc dword [esp + 0x1c]
call fcn.10017adb
or dword [esp + 0x22c], 0xffffffff
lea ecx, [esp + 0xe4]
call fcn.10017adb
mov dword [esp + 0x10], 0xffffffff
lea ecx, [esp + 0x108]
mov dword [esp + 0x18], 0xfffd
push edi
call fcn.10017a59
mov dword [esp + 0x14], ebx
jmp 0x10019f4d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10019f37
mov dword [esp + 0x10], ebx
jmp 0x10019f65
mov dword [esp + 0x18], 0x29be1d92
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffea
je 0x10019f59
push 2
mov dword [esp + 0x1c], 0xffffffeb
pop esi
jmp 0x10019fc6
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x10019fc2
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x108]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [esp + 0x14], ebx
jmp 0x10019fb6
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x108]
cmp dword [eax + ecx*4], ebx
jne 0x10019fbc
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x10019fa2
dec dword [esp + 0x10]
jns 0x10019f83
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jge 0x10019f79
lea ecx, [esp + 0x108]
call fcn.10017adb
mov dword [esp + 0x18], 0xc45cdbe8
mov dword [esp + 0x38], edi
mov dword [esp + 0x24], 0x48f4
mov dword [esp + 0x34], esi
mov dword [esp + 0x1c], 0x389a9b8f
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x34], edi
mov dword [esp + 0x14], ebx
jmp 0x1001a016
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x44], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001a00a
mov dword [esp + 0x18], ebx
jmp 0x1001a2b9
mov dword [esp + 0x28], 0x210b999f
mov dword [esp + 0x30], 0xa2215256
mov dword [esp + 0x2c], 0xe10e5e53
mov dword [esp + 0x10], 0xf126c7f0
mov dword [esp + 0x28], ebx
jmp 0x1001a1cc
mov dword [esp + 0x30], 0xad9bacc5
lea ecx, [esp + 0x1b8]
push edi
call fcn.10017a59
mov dword [esp + 0x10], ebx
jmp 0x1001a075
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x5c], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a069
mov dword [esp + 0x10], ebx
jmp 0x1001a098
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1b8]
mov dword [eax + ecx*4], 0xeb77278f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001a082
mov dword [esp + 0x5c], ebx
jmp 0x1001a1b2
mov dword [esp + 0x30], 0xf934f545
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x14], 0x93d0b548
mov dword [esp + 0x30], 0x426a7609
inc dword [esp + 0x1c]
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], ebx
jl 0x1001a1ae
mov dword [esp + 0x34], 0xffffffff
mov eax, dword [esp + 0x28]
cmp dword [esp + eax*4 + 0x44], ebx
jne 0x1001a156
cmp dword [esp + 0x5c], ebx
jne 0x1001a139
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x44], ecx
test ecx, ecx
jne 0x1001a129
cmp dword [esp + 0x18], ebx
jne 0x1001a11b
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x5c], 0x7da1
mov eax, ebx
jge 0x1001a11d
mov eax, edi
mov dword [esp + 0x10], eax
mov ecx, ebx
cmp dword [esp + 0x10], ebx
je 0x1001a12b
mov ecx, edi
mov eax, dword [esp + 0x2c]
mov edx, ebx
sub ecx, eax
cmp ecx, dword [esp + 0x60]
je 0x1001a13b
mov edx, edi
mov eax, dword [esp + 0x34]
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xfffffff9
setg al
cmp eax, dword [esp + 0x34]
mov eax, ebx
jne 0x1001a158
mov eax, edi
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + eax*4 + 0x44]
mov dword [esp + 0x34], eax
cmp dword [esp + 0x18], edi
mov eax, dword [esp + 0x5c]
sbb ecx, ecx
xor edx, edx
neg ecx
dec ecx
cmp ecx, eax
mov eax, dword [esp + 0x34]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x48]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x48]
setg dl
sub edx, eax
mov dword [esp + 0x34], edx
dec dword [esp + 0x14]
jns 0x1001a0d9
inc dword [esp + 0x5c]
cmp dword [esp + 0x5c], edi
jle 0x1001a0a7
lea ecx, [esp + 0x1b8]
call fcn.10017adb
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jle 0x1001a04e
mov dword [esp + 0x10], ebx
jmp 0x1001a2ab
mov dword [esp + 0x14], ebx
jmp 0x1001a1f4
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1f4], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001a1e5
mov eax, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [esp + 0x48]
mov eax, dword [esp + 0x38]
cmp edx, 0xf1d
setne cl
imul eax, ecx
test eax, eax
jne 0x1001a234
mov eax, dword [esp + 0x10]
mov ecx, ebx
cmp dword [esp + eax*4 + 0x44], ebx
je 0x1001a236
mov ecx, edi
mov eax, 0x576
sub eax, ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 0x38], eax
cmp dword [esp + 0x38], ebx
je 0x1001a253
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], ecx
xor ecx, ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1f4]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
cmp eax, 0x5bd2
setge cl
xor eax, eax
cmp ecx, edi
setle al
mov dword [esp + 0x34], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x1001a1df
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x1001a025
mov dword [esp + 0x30], 0xd6b6
mov dword [esp + 0x1c], 0x1a3622ba
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], 0x3a6c
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], ebx
jmp 0x1001a363
mov dword [esp + 0x28], 0xbb0cb8ce
lea ecx, [esp + 0x12c]
call fcn.10017a59
mov dword [esp + 0x14], ebx
jmp 0x1001a31d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0xfcfbce00
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001a307
inc dword [esp + 0x24]
xor edx, edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov ecx, edi
setl dl
sub edx, dword [esp + 0x2c]
imul edx, dword [esp + 0x24]
imul edx, dword [esp + 0x18]
mov eax, dword [esp + 0x128]
sub ecx, edx
mov dword [eax + 0xc], ecx
lea ecx, [esp + 0x128]
call fcn.10017adb
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe2
push 4
jg 0x1001a2ed
mov dword [esp + 0x20], 0xffffffff
lea ecx, [esp + 0x178]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], 0x940c9ba5
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0xfffffffb
mov dword [esp + 0x20], 0xa82bc906
call fcn.10017a59
mov dword [esp + 0x24], 0x4d25
mov dword [esp + 0x10], ebx
jmp 0x1001a3be
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x3c], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001a3b2
push 4
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001a3e0
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x210], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a3cd
mov dword [esp + 0x10], ebx
jmp 0x1001a3fe
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001a3ec
mov dword [esp + 0x3c], 0x14
jmp 0x1001a51a
mov dword [esp + 0x1c], 0xb821342f
mov dword [esp + 0x18], 0x3ca3691f
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x2c], 0xe7a32987
mov dword [esp + 0x14], ebx
jmp 0x1001a44a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xc8], 0xfffffff9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001a437
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
sub ecx, 0xfff9
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0xffff1c36
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x18]
jge 0x1001a494
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x3c]
cmp eax, edi
mov eax, dword [esp + 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
inc eax
cmp eax, 0x2496
jne 0x1001a4da
cmp dword [esp + 0x1c], ebx
jne 0x1001a525
jmp 0x1001a516
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x1c], 0x8d679bdd
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0xc83b9135
mov dword [esp + 0x1c], 0xf18b0119
dec dword [esp + 0x2c]
dec dword [esp + 0x3c]
cmp dword [esp + 0x3c], 0xfffffff9
je 0x1001a411
dec dword [esp + 0x24]
lea ecx, [esp + 0x174]
call fcn.10017adb
mov dword [esp + 0x24], 0x75c9
lea ecx, [esp + 0x180]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x38], 0xc407858f
push esi
call fcn.10017a59
mov dword [esp + 0x1c], 0x8963
mov dword [esp + 0x14], ebx
jmp 0x1001a57a
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001a564
mov eax, dword [esp + 0x24]
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], 4
jmp 0x1001a5dc
mov dword [esp + 0x1c], 0xc17e5c28
mov dword [esp + 0x2c], 0x5440874b
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x38], eax
jle 0x1001a5cc
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x2c
jg 0x1001a592
lea ecx, [esp + 0x180]
call fcn.10017adb
push 3
lea ecx, [esp + 0x120]
call fcn.10017a59
push 3
pop ecx
mov dword [esp + 0x22c], ecx
mov dword [esp + 0x18], 0x37831e42
mov dword [esp + 0x2c], 0xbd42ca8c
mov dword [esp + 0x38], 0x59bb7a14
mov dword [esp + 0x14], ebx
jmp 0x1001a638
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xfc], 4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001a625
mov eax, dword [esp + 0xfc]
xor edx, edx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
je 0x1001a66a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x100]
cmp eax, ecx
setl dl
mov dword [esp + 0x18], edx
jmp 0x1001a6f2
mov dword [esp + 0x1c], 0xf6a715cc
mov dword [esp + 0x10], 0xd0e75d5
mov dword [esp + 0x24], 0x475e
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
cmp ecx, eax
setl dl
add edx, dword [esp + 0x10]
cmp dword [esp + 0xfc], edx
jne 0x1001a6c0
mov eax, ebx
cmp dword [esp + 0x2c], ebx
je 0x1001a6c2
mov eax, edi
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], ebx
jmp 0x1001a6ec
mov dword [esp + 0x10], ebx
jmp 0x1001a6e1
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xfc], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a6d2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1001a6cc
push 0xfffffffffffffffe
pop eax
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0xa4]
mov dword [esp + 0x38], edi
mov esi, 0xffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], esi
push 3
call fcn.10017a59
mov byte [esp + 0x22c], 4
lea ecx, [esp + 0x14c]
mov dword [esp + 0x2c], 0xee4cff15
mov dword [esp + 0x34], 0x627e80a
push edi
call fcn.10017a59
mov dword [esp + 0x10], ebx
jmp 0x1001a759
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa4]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a743
mov dword [esp + 0x10], ebx
jmp 0x1001a778