Function at 0x1001a519
Capabilities:
Get common file path
Get file system object information
Get session user name
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008d176
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x270
push ebx
push esi
push edi
mov dword [esp + 0x1c], 0xffffffff
mov edi, 0xbf0ddd9c
xor ebx, ebx
mov dword [esp + 0x18], edi
mov dword [esp + 0xd8], edx
mov dword [esp + 0x54], ecx
cmp dword [esp + 0x1c], ebx
jne 0x1001a565
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp eax, 0x1b9849b7
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x1c]
push 1
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
pop esi
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x1c]
setle cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
cmp dword [esp + 0x20], eax
setl cl
mov dword [esp + 0x18], ecx
mov dword [esp + 0x18], 0x19
jmp 0x1001a85f
push esi
lea ecx, [esp + 0xac]
call fcn.10018732
mov dword [esp + 0xc], ebx
jmp 0x1001a5e6
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001a5d4
cmp dword [esp + 0x1c], ebx
je 0x1001a834
mov eax, dword [esp + 0xa8]
cmp dword [eax], ebx
je 0x1001a848
lea ecx, [esp + 0xa8]
call fcn.10018f31
push 0xfffffffffffffffc
pop eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 0x3809d01
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x20], eax
mov eax, 0xffff
mov dword [esp + 0x100], eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x18], 4
cmp dword [esp + 0x24], ebx
jne 0x1001a67e
mov ecx, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov ecx, ebx
setg dl
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x2c], ebx
je 0x1001a680
mov ecx, esi
mov eax, dword [esp + 0x10c]
mov edx, esi
inc dword [esp + 0x10c]
cmp ecx, eax
mov eax, dword [esp + 0xc]
cmovge edx, ebx
sub eax, dword [esp + 0xc]
cmp eax, dword [esp + 0xc]
je 0x1001a6a7
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [esp + 0x20]
test ecx, ecx
je 0x1001a6c2
mov eax, dword [esp + 0x10c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
sub ecx, eax
neg ecx
push 0xfffffffffffffff9
sbb ecx, ecx
inc ecx
pop eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x18], eax
mov byte [esp + 0x3b], bl
cmp byte [esp + 0x3b], bl
je 0x1001a6fd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x30], edi
mov dword [esp + 0x3c], 0x8c6a53d0
mov dword [esp + 0x28], 3
push 0xfffffffffffffff8
pop eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x1c], 9
mov dword [esp + 0xc], eax
mov dword [esp + 0x2c], 0x29aa810d
mov dword [esp + 0x20], 0x283066c9
mov dword [esp + 0x120], esi
mov dword [esp + 0x124], esi
mov dword [esp + 0x128], esi
mov dword [esp + 0x12c], esi
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], 0xe3f9150f
inc dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x128]
neg eax
jne 0x1001a79a
mov eax, dword [esp + 0x124]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x120]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x24], ebx
je 0x1001a7b7
mov ecx, esi
cmp dword [esp + 0x28], ebx
jne 0x1001a7b9
mov ecx, ebx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
sub ecx, eax
add ecx, dword [esp + 0x20]
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x34], ebx
jne 0x1001a7e1
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
xor ecx, ecx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
cmp eax, 0x1b9849b7
mov eax, dword [esp + 0x34]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x34]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x34]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x30], ecx
mov dword [esp + 0x30], 0x19
jmp 0x1001ade9
mov byte [esp + 0x3b], bl
cmp byte [esp + 0x3b], bl
je 0x1001a848
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov eax, dword [esp + 0xa8]
lea ecx, [esp + 0xa8]
call fcn.10018f31
dec dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
jle 0x1001a5c1
jmp 0x1001a611
push esi
lea ecx, [esp + 0x68]
call fcn.10018732
mov dword [esp + 0x20], 0x28d5feaf
mov dword [esp + 0x14], ebx
jmp 0x1001a899
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], 0x297
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001a886
mov dword [esp + 0x14], ebx
jmp 0x1001a8b8
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1cc], 0xef5d870a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001a8a5
mov dword [esp + 0x14], ebx
jmp 0x1001a8d8
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x168], 0x5158018d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001a8c5
mov byte [esp + 0x3b], bl
cmp byte [esp + 0x3b], 0
je 0x1001a8f1
push ebx
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov edx, dword [esp + 0x64]
xor eax, eax
cmp dword [edx], ebx
setne al
xor ecx, ecx
mov dword [esp + 0x1d4], eax
sub eax, dword [edx]
add eax, 0xfffffff9
cmp eax, 0x13e1
mov dword [esp + 0x168], eax
setge cl
cmp dword [edx], ecx
jne 0x1001a92c
cmp dword [esp + 0x16c], ebx
mov ecx, esi
mov edx, dword [esp + 0x64]
jne 0x1001a92e
mov ecx, ebx
xor eax, eax
cmp ecx, dword [edx]
sete al
cmp eax, dword [edx]
je 0x1001a948
cmp dword [esp + 0x1d0], ebx
mov eax, ebx
mov edx, dword [esp + 0x64]
je 0x1001a94a
mov eax, esi
mov ecx, dword [edx]
add eax, 0x8716b5b3
add eax, ecx
xor edx, edx
cmp ecx, eax
lea ecx, [esp + 0x64]
sete dl
mov dword [esp + 0x20], edx
call fcn.10018f31
push esi
lea ecx, [esp + 0x7c]
call fcn.10018732
push 3
lea ecx, [esp + 0x17c]
mov dword [esp + 0x288], ebx
call fcn.10018732
mov dword [esp + 0x3c], 0xcadfb1af
mov dword [esp + 0x3c], 0xf6872920
mov dword [esp + 0xc], ebx
jmp 0x1001a9af
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x178]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001a99c
mov eax, dword [esp + 0x178]
lea ecx, [esp + 0x178]
mov byte [esp + 0x284], bl
mov dword [eax + 8], 0x18
call fcn.10018f31
mov dword [esp + 0xc], ebx
jmp 0x1001a9ec
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x78]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001a9dd
cmp dword [esp + 0x34], ebx
je 0x1001aa30
mov eax, dword [esp + 0x78]
cmp dword [eax], ebx
je 0x1001add0
or dword [esp + 0x284], 0xffffffff
lea ecx, [esp + 0x78]
call fcn.10018f31
push 3
lea ecx, [esp + 0x228]
call fcn.10018732
mov dword [esp + 0xc], esi
mov dword [esp + 0xc], ebx
jmp 0x1001ae0b
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0xc0]
mov dword [esp + 0x18], 0x32ffab8c
push 2
call fcn.10018732
mov byte [esp + 0x284], 2
lea ecx, [esp + 0x20c]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x3c], 8
push esi
call fcn.10018732
mov dword [esp + 0x3c], 0x2ad14ca7
push 2
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001aa96
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001aa80
mov dword [esp + 0x14], ebx
jmp 0x1001aab1
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x25c], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001aaa2
mov dword [esp + 0x14], ebx
jmp 0x1001aad3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20c]
mov dword [eax + ecx*4], 0x6c49a7e1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001aabd
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
jne 0x1001ab48
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp eax, esi
setge cl
add ecx, dword [esp + 0x28]
imul ecx, dword [esp + 0x28]
test ecx, ecx
jne 0x1001ab0b
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc0]
mov eax, dword [eax]
add eax, eax
jne 0x1001ab2c
mov eax, ebx
cmp dword [esp + 0x18], ebx
je 0x1001ab2e
mov eax, esi
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
mov ecx, dword [esp + 0xc0]
je 0x1001ab44
cmp dword [ecx + 4], ebx
jne 0x1001ab4f
mov edx, ebx
jmp 0x1001ab51
mov ecx, dword [esp + 0xc0]
mov edx, esi
xor eax, eax
cmp edx, dword [ecx]
lea ecx, [esp + 0x20c]
setge al
mov dword [esp + 0x24], eax
dec dword [esp + 0x20]
call fcn.10018f31
lea ecx, [esp + 0xc0]
mov byte [esp + 0x284], bl
call fcn.10018f31
push 3
lea ecx, [esp + 0x1a0]
call fcn.10018732
mov dword [esp + 0x20], 5
push 2
mov dword [esp + 0x28], 0x4951162d
pop edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ebx
jmp 0x1001abc0
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], 0x2e91a049
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001abaa
mov dword [esp + 0x1c], ebx
jmp 0x1001abe0
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x160], 0x1489
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001abcd
mov byte [esp + 0x3b], bl
cmp byte [esp + 0x3b], 0
je 0x1001abfd
push ebx
push 0x2618
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [esp + 0x19c]
mov dword [esi + 4], 0x19
mov dword [esp + 0x28], 0xf995
xor edx, edx
mov dword [esp + 0xc], 0xa5d732ad
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esi + 8]
cmp eax, dword [esi + 4]
mov eax, dword [esp + 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, dword [esp + 0x28]
test ecx, ecx
je 0x1001ac5d
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x164]
xor edx, edx
mov eax, dword [esp + 0x160]
cmp eax, 1
mov eax, dword [esp + 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, dword [esi + 4]
setge al
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], ebx
jmp 0x1001ac9a
cmp dword [esp + 0xc], ebx
jne 0x1001aca1
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0xd
jg 0x1001ac90
dec dword [esi + 4]
cmp dword [esi + 4], 0xe
jge 0x1001ac0b
lea ecx, [esp + 0x19c]
call fcn.10018f31
mov byte [esp + 0x13], bl
lea ecx, [esp + 0xf4]
push 4
call fcn.10018732
mov dword [esp + 0x18], 0x1fc3eee2
mov dword [esp + 0x24], 0x7d65121a
mov dword [esp + 0xc], ebx
jmp 0x1001acf4
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001ace2
mov byte [esp + 0x3b], bl
cmp byte [esp + 0x3b], 0
je 0x1001ad1d
push 0x1d87
push 0x2013
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
je 0x1001ad37
mov eax, dword [esp + 0xf4]
cmp dword [eax + 4], ebx
jne 0x1001ad37
mov eax, ebx
jmp 0x1001ad3a
xor eax, eax
inc eax
mov dword [esp + 0x18], eax
xor edx, edx
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0xf4]
mov esi, dword [edi + 4]
cmp dword [edi + 0xc], esi
sete dl
xor eax, eax
cmp esi, 0x7c70ab2
setl al
xor ecx, ecx
cmp eax, edx
setg cl
xor edx, edx
cmp ecx, esi
setge dl
xor eax, eax
cmp edx, esi
setl al
cmp eax, dword [edi + 8]
jl 0x1001ad7d
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, 0xffff
sub ecx, eax
mov eax, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
xor esi, esi
inc ecx
inc esi
inc dword [esp + 0x24]
cmp eax, ecx
mov eax, esi
jge 0x1001ada0
mov eax, ebx
xor ecx, ecx
cmp eax, esi
mov eax, dword [esp + 0xf4]
sete cl
add ecx, dword [eax]
mov dword [edi + 4], ecx
lea ecx, [esp + 0xf4]
call fcn.10018f31
cmp byte [esp + 0x13], 0
je 0x1001add0
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
mov eax, dword [esp + 0x78]
lea ecx, [esp + 0x78]
or dword [esp + 0x284], 0xffffffff
call fcn.10018f31
dec dword [esp + 0x30]
cmp dword [esp + 0x30], ebx
jle 0x1001a86e
jmp 0x1001aa15
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x224]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001adf8
mov dword [esp + 0xc], 2
cmp dword [esp + 0xc], ebx
jl 0x1001ae37
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ae31
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
dec dword [esp + 0xc]
jns 0x1001ae20
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ae62
push 0x1f03
push 0x1c4a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_LineTo]
lea ecx, [esp + 0x224]
call fcn.10018f31
mov dword [esp + 0x30], 0x638ecf54
mov dword [esp + 0x28], 0xd8f8f576
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x2c], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001aea0
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x50], 0x61fc42ff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001ae90
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001aebe
push 0x2401
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x28], 0x565e08cc
cmp dword [esp + 0x28], ebx
je 0x1001aed8
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x30], eax
je 0x1001af8d
mov dword [esp + 0x18], 4
mov dword [esp + 0x20], 0xce7aebb
mov dword [esp + 0x20], 0xffffffff
cmp dword [esp + 0x18], ebx
je 0x1001af18
mov ecx, esi
cmp dword [esp + 0x50], ebx
jne 0x1001af1a
mov ecx, ebx
mov eax, dword [esp + 0x18]
add eax, ecx
jne 0x1001af2a
mov edx, ebx
cmp dword [esp + 0x18], ebx
je 0x1001af2c
mov edx, esi
mov eax, dword [esp + 0x30]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setge cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp edx, eax
setg cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x50]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [esp + 0x20]
setge al
cmp eax, 0xab4d
jg 0x1001af7f
cmp dword [esp + 0x24], ebx
jne 0x1001af7f
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], esi
jmp 0x1001afc8
mov dword [esp + 0x28], 0xffffffe2
jmp 0x1001afc1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001afbd
push ebx
push 0x1dd0
push 0x1dd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0xfffffff4
jl 0x1001af97
mov dword [esp + 0x2c], 0x7ddc85f7
lea ecx, [esp + 0x1d8]
push 3
call fcn.10018732
mov dword [esp + 0xc], ebx
jmp 0x1001aff6
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1d8]
mov dword [eax + ecx*4], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001afe4
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b019
push 0xaea
push 0xa64
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b03b
push 0x316
push 0x2681
push ebx
push 0x5f2
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [esp + 0x1d8]
call fcn.10018f31
push 2
lea ecx, [esp + 0x144]
call fcn.10018732
mov dword [esp + 0x284], 3
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x34], 0xe0f7
mov dword [esp + 0x20], 0xb0badcab
mov dword [esp + 0xc], ebx
jmp 0x1001b08e
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x40], 0xb194
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001b07e
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b0ac
push ebx
push ebx
push 0x1cea
call dword [sym.imp.ADVAPI32.dll_CopySid]
push 2
mov dword [esp + 0x2c], ebx
pop edx
jmp 0x1001b208
mov dword [esp + 0x14], 0x8531d14
xor ecx, ecx
mov eax, dword [esp + 0x40]
cmp eax, esi
setge cl
cmp ecx, dword [esp + 0x28]
jge 0x1001b0d5
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebx
je 0x1001b0e7
mov ecx, esi
cmp dword [esp + 0x14], ebx
jne 0x1001b0e9
mov ecx, ebx
mov eax, dword [esp + 0x28]
sub eax, ecx
je 0x1001b163
mov dword [esp + 0x24], 0x39e6a413
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x34], ebx
je 0x1001b10b
mov edx, esi
cmp dword [esp + 0x28], ebx
jne 0x1001b10d
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [esp + 0x34]
test ecx, ecx
je 0x1001b125
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x14]
setg cl
add eax, 0xaedcd7f0
add eax, ecx
xor ecx, ecx
cmp eax, 0x1912
setle cl
add ecx, dword [esp + 0x24]
mov dword [esp + 0x20], ecx
jmp 0x1001b201
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x1fa46b4c
mov dword [esp + 0x34], ebx
cmp dword [esp + 0x34], ebx
jg 0x1001b1ee
mov eax, dword [esp + 0x34]
mov eax, dword [esp + eax*4 + 0x40]
cmp eax, dword [esp + 0x20]
jl 0x1001b1c1
mov eax, dword [esp + 0x40]
xor edx, edx
test eax, eax
mov eax, dword [esp + 0x34]
setns dl
xor ecx, ecx
mov esi, dword [esp + eax*4 + 0x40]
mov eax, dword [esp + 0x14]
cmp edx, eax
mov eax, dword [esp + 0x40]
setge cl
add esi, ecx
xor ecx, ecx
cmp esi, eax
mov eax, dword [esp + 0x34]
setge cl
xor esi, esi
inc esi
cmp ecx, dword [esp + eax*4 + 0x40]
mov eax, esi
jg 0x1001b1c3
mov eax, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ebx
jmp 0x1001b1db
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x40], ebx
jne 0x1001b1e1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1001b1cd
inc dword [esp + 0x34]
cmp dword [esp + 0x34], ebx
jle 0x1001b179
push 2
pop edx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b204
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 2
pop edx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edx
je 0x1001b0b8
mov dword [esp + 0xc], ebx
jmp 0x1001b22a
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001b218
mov dword [esp + 0x2c], 0xffffffe8
jmp 0x1001b4c0
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0xe8]
mov dword [esp + 0x18], 0x32ffab8c
push edx
call fcn.10018732
mov byte [esp + 0x284], 4
lea ecx, [esp + 0x218]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x3c], 8
push esi
call fcn.10018732
mov dword [esp + 0x3c], 0x2ad14ca7
push 2
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001b2a2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001b28c
mov dword [esp + 0x14], ebx
jmp 0x1001b2bd
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x254], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001b2ae
mov dword [esp + 0x14], ebx
jmp 0x1001b2df
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x218]
mov dword [eax + ecx*4], 0x6c49a7e1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001b2c9
mov eax, dword [esp + 0x28]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
jne 0x1001b354
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp eax, esi
setge cl
add ecx, dword [esp + 0x28]
imul ecx, dword [esp + 0x28]
test ecx, ecx
jne 0x1001b317
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xe8]
mov eax, dword [eax]
add eax, eax
jne 0x1001b338
mov eax, ebx
cmp dword [esp + 0x18], ebx
je 0x1001b33a
mov eax, esi
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
mov ecx, dword [esp + 0xe8]
je 0x1001b350
cmp dword [ecx + 4], ebx
jne 0x1001b35b
mov edx, ebx
jmp 0x1001b35d
mov ecx, dword [esp + 0xe8]
mov edx, esi
xor eax, eax
cmp edx, dword [ecx]
lea ecx, [esp + 0x218]
setge al
mov dword [esp + 0x24], eax
dec dword [esp + 0x20]
call fcn.10018f31
lea ecx, [esp + 0xe8]
mov byte [esp + 0x284], 3
call fcn.10018f31
mov dword [esp + 0x18], ebx
push 2
mov dword [esp + 0x10], 0xd3df75dc
pop edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x30], edx
mov dword [esp + 0xc], ebx
jmp 0x1001b3bc
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x240], 0x2189f42
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001b3a9
mov dword [esp + 0xc], ebx
jmp 0x1001b43d
mov dword [esp + 0x24], ebx
mov dword [esp + 0x18], 0x590f0234
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x24]
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], edx
cmp dword [esp + 0x30], ebx
jl 0x1001b439
mov dword [esp + 0x18], ebx
jmp 0x1001b42d
mov eax, dword [esp + 0x30]
cmp dword [esp + eax*4 + 0x240], ebx
jne 0x1001b433
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b429
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 2
pop edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jle 0x1001b401
dec dword [esp + 0x30]
jns 0x1001b3fb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xa
jle 0x1001b3c9
mov dword [esp + 0x18], ebx
jmp 0x1001b4b6
mov dword [esp + 0x30], 0xa77c874
mov dword [esp + 0x30], ebx
jmp 0x1001b4ac
mov dword [esp + 0xc], 0xee6d058a
mov dword [esp + 0xc], ebx
jmp 0x1001b492
cmp dword [esp + 0x30], esi
jle 0x1001b458
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1001b44a
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 0xffffffef
jl 0x1001b23d
or dword [esp + 0x284], 0xffffffff
lea ecx, [esp + 0x140]
call fcn.10018f31
mov dword [esp + 0x18], 0x960f57a7
mov dword [esp + 0xc], ebx
jmp 0x1001b500
cmp dword [esp + 0xc], 2
jl 0x1001b4ed