Function at 0x10019339
Capabilities:
Access peb ldr_data
Create process on windows
Get disk information
Get disk size
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007954d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
push ebx
push esi
push edi
push 3
pop esi
mov dword [esp + 0xc], 0xffffffff
mov edi, edx
push 0
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x3c], edi
mov dword [esp + 0x84], ecx
mov dword [esp + 0x10], 0x15
pop ebx
jmp 0x100194d4
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x118]
push esi
call fcn.100173a1
mov dword [esp + 0x1c], ebx
jmp 0x100193be
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 2
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x100193a8
xor ecx, ecx
mov dword [esp + 0x1c], ebx
inc ecx
jmp 0x100193d9
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x64], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x100193cd
mov dword [esp + 0x1c], ebx
jmp 0x100193f8
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x84], 0xfa66fa4b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x100193e5
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x118]
mov dword [eax], ecx
mov dword [esp + 0x64], ebx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
inc ecx
add eax, ecx
mov dword [esp + 0x84], eax
lea ecx, [eax + 4]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x14]
setne dl
sub edx, 0x3053
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, 0x844ba928
jae 0x1001946b
cmp dword [esp + 0x64], ebx
je 0x1001946b
xor eax, eax
inc eax
jmp 0x1001946d
mov eax, ebx
imul eax, eax, 0xe1cc
test eax, eax
je 0x1001948f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100194b2
push 0x211c
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x100194b2
mov dword [esp + 0x14], ebx
jmp 0x100194ab
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100194a7
push ebx
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff5
jle 0x10019495
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100194c4
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x118]
call fcn.10017423
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe7
jle 0x1001938d
push 2
lea ecx, [esp + 0xc8]
call fcn.100173a1
mov dword [esp + 0x1bc], ebx
mov dword [esp + 0x1c], 4
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], 0xe9d60a22
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 9
je 0x100195b3
xor edx, edx
inc edx
mov dword [esp + 0xc], edx
mov dword [esp + 0x14], 0xd8c6
mov dword [esp + 0x20], 0xae86
mov dword [esp + 0x30], 6
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x1c]
je 0x10019548
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0xc], ebx
jne 0x1001956a
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
cmp eax, 0x606e
setne cl
cmp dword [esp + 0x18], ecx
jg 0x1001959e
mov eax, edx
cmp dword [esp + 0x1c], ebx
jne 0x100195a0
mov eax, ebx
mov dword [esp + 0x30], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 9
jne 0x1001951a
lea eax, [esp + 0x90]
mov dword [esp + 0x28], 0xffffffff
push eax
push 0x1f0e
push ebx
lea eax, [esp + 0xd0]
mov dword [esp + 0x30], ebx
push eax
mov dword [esp + 0x34], 0xffffffff
push 0x7268
call fcn.1001c816
mov dword [esp + 0x28], 0xffffffff
add esp, 0x14
mov dword [esp + 0xc], 0x82b
mov dword [esp + 0x2c], 1
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], ebx
jmp 0x1001961c
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x44], 5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001960c
mov dword [esp + 0x14], 0xb
jmp 0x1001991e
mov dword [esp + 0x28], 0xfffffffd
mov dword [esp + 0x28], ebx
jmp 0x100198fa
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], ebx
mov dword [esp + 0x2c], 0xc9109b52
mov dword [esp + 0x2c], 0xc0f44dc8
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x10019709
mov eax, dword [esp + 0x28]
cmp dword [esp + eax*4 + 0x44], ebx
je 0x100196ca
mov eax, dword [esp + 0x28]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setge dl
imul eax, edx, 0x66b
cmp dword [esp + 0x1c], eax
jge 0x1001969f
mov eax, dword [esp + 0x28]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov eax, dword [esp + 0x28]
setl dl
mov dword [esp + eax*4 + 0x44], edx
test edx, edx
jne 0x100196ca
mov eax, ebx
jmp 0x100196cd
xor eax, eax
inc eax
mov edx, dword [esp + 0x1c]
xor ecx, ecx
imul edx, eax
sub edx, dword [esp + 0x28]
imul edx, dword [esp + 0x14]
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
cmp edx, eax
setl cl
xor eax, eax
add ecx, dword [esp + 0xc]
cmp ecx, 0xd8f6
setne al
mov dword [esp + 0x18], eax
dec dword [esp + 0x1c]
jns 0x1001966e
mov eax, dword [esp + 0x28]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + eax*4 + 0x44], ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add eax, 0x3a0aeb04
je 0x100197db
mov dword [esp + 0x2c], 0x40f4eb95
mov dword [esp + 0x1c], 0xe572dbe4
cmp dword [esp + 0x1c], ebx
jne 0x1001977e
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0xc], eax
jge 0x1001977e
mov edx, ebx
jmp 0x10019781
xor edx, edx
inc edx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
push 3
setg cl
xor edx, edx
mov eax, dword [esp + eax*4 + 0x48]
cmp edx, eax
sbb esi, esi
neg esi
sub esi, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
sub esi, ecx
neg esi
sbb esi, esi
inc esi
sub esi, dword [esp + eax*4 + 0x48]
mov eax, dword [esp + 0x30]
neg esi
sbb esi, esi
inc esi
cmp esi, eax
mov eax, dword [esp + 0x18]
pop esi
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 1
sbb eax, eax
neg eax
mov dword [esp + 0x18], eax
jmp 0x100198f6
mov dword [esp + 0x20], 0x1e51
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x100198f6
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x100198e1
push 4
lea ecx, [esp + 0xd4]
call fcn.100173a1
mov dword [esp + 0x18], ebx
jmp 0x10019830
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 0xe0e7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001981a
mov dword [esp + 0x18], ebx
jmp 0x100198c6
mov eax, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setg dl
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x24], ebx
jne 0x1001989e
mov ecx, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x44]
cmp edx, eax
setl cl
sub ecx, 0x1902de64
je 0x1001989e
mov eax, dword [esp + 0xd0]
cmp dword [eax], ebx
je 0x1001989e
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x44]
mov dword [esp + 0x2c], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10019840
lea ecx, [esp + 0xd0]
call fcn.10017423
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x10019806
dec dword [esp + 0x1c]
jns 0x100197f5
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jle 0x10019640
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001991a
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xd
jge 0x1001962f
mov dword [esp + 0x28], 1
cmp dword [esp + 0x28], ebx
jl 0x1001a8e4
mov edi, dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10019946
push 3
pop esi
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x150]
push 2
call fcn.100173a1
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], 0x66febfb2
mov dword [esp + 0x14], ebx
jmp 0x10019981
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x18c], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001996e
mov dword [esp + 0x14], ebx
jmp 0x100199a3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0xfa5c62e0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001998d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100199c0
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [esp + 0x18], ebx
jmp 0x100199f2
mov dword [esp + 0x20], 0x78f4
mov dword [esp + 0xc], ebx
jmp 0x100199e3
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x184], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x100199d4
dec dword [esp + 0x20]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x100199c6
lea ecx, [esp + 0x150]
call fcn.10017423
push esi
lea ecx, [esp + 0x104]
call fcn.100173a1
push 1
lea ecx, [esp + 0x98]
mov byte [esp + 0x1c0], 1
call fcn.100173a1
push 4
pop eax
mov byte [esp + 0x1bc], 2
lea ecx, [esp + 0xb8]
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], 0xfffffff7
push eax
call fcn.100173a1
mov dword [esp + 0x1c], 0x72be76dc
mov dword [esp + 0x2c], 0x9b2b
mov dword [esp + 0x24], 5
mov dword [esp + 0x14], ebx
jmp 0x10019a7c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x94]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10019a6a
mov dword [esp + 0x14], ebx
jmp 0x10019a9f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], 0x707d8eb7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10019a89
mov eax, dword [esp + 0x94]
xor ecx, ecx
mov edx, dword [eax]
mov eax, edx
imul eax, edx
cmp eax, edx
setl cl
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
je 0x10019bda
mov dword [esp + 0xc], 0xfffffff6
push 0xfffffffffffffff9
pop eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], 0xfffffffa
mov dword [esp + 0x30], 0x31defcec
mov dword [esp + 0x20], 0xdcc3592e
mov eax, dword [esp + 0xc]
sub eax, 0x262f770
jne 0x10019b50
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0x94]
sub ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x94]
cmp edx, dword [eax]
mov eax, dword [esp + 0xc]
setle cl
sub ecx, eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], ecx
mov ecx, 0x917a
sub ecx, eax
cmp ecx, dword [esp + 0x24]
jle 0x10019b50
mov eax, ebx
jmp 0x10019b53
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x30], 0xec6f
jne 0x10019bb6
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
inc dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
cmp eax, 0x8a24
setge dl
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp edx, eax
mov eax, dword [esp + 0xb8]
setle cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [esp + 0x1c]
setge dl
sub eax, edx
mov dword [esp + 0x24], eax
jne 0x10019bb6
mov ecx, ebx
jmp 0x10019bb9
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0xb8]
mov dword [eax + 0xc], ecx
mov eax, 0xc010
sub eax, ecx
imul eax, eax, 0x544a
sub eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
jmp 0x10019bf2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019bf2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
lea ecx, [esp + 0xb8]
call fcn.10017423
lea ecx, [esp + 0x94]
mov byte [esp + 0x1bc], 1
call fcn.10017423
mov dword [esp + 0x20], ebx
lea ecx, [esp + 0xf4]
push esi
call fcn.100173a1
mov dword [esp + 0xc], ebx
jmp 0x10019c3f
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 0xea5d6c05
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10019c29
mov eax, dword [esp + 0xf4]
lea ecx, [esp + 0xf4]
mov byte [esp + 0x1bc], 1
mov dword [eax + 4], ebx
call fcn.10017423
xor edx, edx
mov dword [esp + 0x24], 0x564c7b7f
mov dword [esp + 0xc], ebx
inc edx
jmp 0x10019c84
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x34], 0x5b9b55bb
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10019c74
mov dword [esp + 0x34], ebx
cmp dword [esp + 0x34], 0xf
je 0x10019cfd
mov dword [esp + 0xc], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0x98d20b50
mov dword [esp + 0x24], 4
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x34]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x20]
jg 0x10019cdb
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
add eax, dword [esp + 0x34]
mov dword [esp + 0x24], eax
inc dword [esp + 0x34]
cmp dword [esp + 0x34], 0xf
push 1
pop edx
jne 0x10019c95
mov dword [esp + 0xc], ebx
jmp 0x10019d19
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10019d03
mov eax, dword [esp + 0x100]
cmp dword [eax + 4], ebx
je 0x1001a7f8
push dword [esp + 0x90]
movdqa xmm0, xmmword [0x10007a20]
lea eax, [esp + 0x188]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0xa8], ebx
push eax
push ebx
lea ecx, [esp + 0xb0]
mov dword [esp + 0xb4], ebx
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0xb8], ebx
call fcn.10018875
mov dword [esp + 0xc], 0xfffffffb
mov dword [esp + 0xc], ebx
jmp 0x10019da2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019d9e
push 0xac5
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x10019d87
lea ecx, [esp + 0xa0]
call fcn.10017423
mov dword [esp + 0x30], 0x1b3c
lea ecx, [esp + 0xdc]
mov dword [esp + 0x18], 0xc865b49d
xor eax, eax
mov dword [esp + 0x24], 0xad5a519d
inc eax
mov dword [esp + 0x24], 8
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0xffffffff
push 4
call fcn.100173a1
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 4
jge 0x10019e1c
push 0xfffffffffffffff9
pop edx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10019e03
cmp dword [esp + 0x30], ebx
je 0x10019f51
mov dword [esp + 0x2c], 0x837182ab
xor edx, edx
mov dword [esp + 0x20], 0x657689a
inc edx
mov dword [esp + 0x20], 0x8807383c
mov dword [esp + 0xc], 0xe96f8f9e
mov dword [esp + 0x14], ebx
jmp 0x10019e5f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x40], 0x61a65206
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10019e4f
mov dword [esp + 0x14], ebx
jmp 0x10019e7e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x88], 2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10019e6b
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x20], eax
je 0x10019e9f
mov ecx, edx
cmp dword [esp + 0x40], ebx
jne 0x10019ea1
mov ecx, ebx
mov eax, dword [esp + 0x40]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
add eax, ecx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], 0xffff
jne 0x10019ec6
cmp dword [esp + 0x88], ebx
jne 0x10019ec8
mov edx, ebx
dec dword [esp + 0xc]
xor ecx, ecx
mov eax, dword [esp + 0x18]
cmp edx, eax
mov esi, dword [esp + 0xdc]
setge cl
xor eax, eax
cmp ecx, dword [esi + 0xc]
setge al
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
add ecx, dword [esp + 0x40]
je 0x10019f13
cmp dword [esp + 0x40], ebx
je 0x10019f13
xor eax, eax
inc eax
jmp 0x10019f15
mov eax, ebx
add eax, 0xfffffffd
cmp eax, 0xcd538770
push 3
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
cmp ecx, eax
mov eax, dword [esp + 0x44]
setne dl
cmp edx, 0xfffffff8
mov dword [esi + 0xc], edx
pop esi
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [esp + 0x40], ecx
jmp 0x10019f5f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019f5f
push ebx
call edi
lea ecx, [esp + 0xdc]
call fcn.10017423
mov dword [esp + 0x24], 0x3869393d
mov eax, 0x3132d683
mov dword [esp + 0xc], 0xe60f951
mov dword [esp + 0x14], 5
mov dword [esp + 0x20], 0xfffffff6
mov dword [esp + 0x1c], 0x8ecb302a
mov dword [esp + 0x18], 0x451f1e28
mov dword [esp + 0x20], 0x5878ed7c
mov dword [esp + 0x130], eax
mov dword [esp + 0x134], eax
mov dword [esp + 0x138], eax
mov dword [esp + 0x13c], eax
cmp dword [esp + 0xc], ebx
je 0x10019fcf
xor ecx, ecx
inc ecx
jmp 0x10019fd1
mov ecx, ebx
mov eax, dword [esp + 0xc]
neg eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0xc]
test eax, eax
mov eax, dword [esp + 0x18]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [esp + 0x14], ecx
jle 0x1001a01c
cmp dword [esp + 0x14], ebx
jne 0x1001a01c
mov ecx, ebx
jmp 0x1001a01f
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0xc]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setne dl
xor ecx, ecx
add edx, 0x1e13ca4d
cmp eax, edx
mov eax, dword [esp + 0xc]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
jne 0x1001a065
cmp dword [esp + 0x1c], ebx
jne 0x1001a065
mov eax, ebx
jmp 0x1001a068
xor eax, eax
inc eax
push 2
mov dword [esp + 0x134], eax
mov dword [esp + 0x1c], ebx
pop ecx
jmp 0x1001a088
mov dword [esp + 0x20], 0xdd79339b
inc dword [esp + 0x20]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001a078
mov dword [esp + 0xc], ebx
jmp 0x1001a0a4
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x5c], 5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001a094
mov dword [esp + 0x20], 6
mov dword [esp + 0xc], 0x4822b165
mov dword [esp + 0x24], 0x3e0566a9
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001a0df
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x140], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x1001a0d0
inc dword [esp + 0x20]
mov dword [esp + 0xc], 1
cmp dword [esp + 0xc], ebx
je 0x1001a11d
mov dword [esp + 0xc], 0xffffffe6
jmp 0x1001a114
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a110
push ebx
call edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffee
jge 0x1001a102
jmp 0x1001a14c
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a13a
push 0xb57
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a14c
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
dec dword [esp + 0x30]
mov dword [esp + 0x5c], ebx
cmp dword [esp + 0x5c], 1
jg 0x1001a8c3
jmp 0x1001a164
push 2
mov dword [esp + 0x20], ebx
pop edx
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], ebx
jmp 0x1001a185
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x50], 0xe3245f1d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001a175
cmp dword [esp + 0x58], ebx
je 0x1001a195
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x54]
mov ecx, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x9695
setne al
xor ecx, ecx
cmp eax, 0x4ba3
setl cl
add ecx, 0x68a0
cmp dword [esp + 0x54], ecx
je 0x1001a21e
cmp dword [esp + 0x54], ebx
je 0x1001a21e
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0xfffffff3
jle 0x1001a307
mov dword [esp + 0x24], 1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a1ff
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov eax, dword [esp + 0x54]
mov dword [esp + 0x24], 1
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff3
jg 0x1001a1e5
push 2
pop edx
jmp 0x1001a307
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], ebx
jl 0x1001a307
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
jl 0x1001a2b5
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x1001a29f
push edx
lea ecx, [esp + 0xec]
call fcn.100173a1
mov dword [esp + 0x18], ebx
jmp 0x1001a275
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0xd21b1857
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001a25f
mov eax, dword [esp + 0xe8]
lea ecx, [esp + 0xe8]
mov dword [eax + 4], 0x877e0698
call fcn.10017423
dec dword [esp + 0x14]
push 2
pop edx
jns 0x1001a24c
mov dword [esp + 0x54], 0x4f1d4b08
mov dword [esp + 0x18], 0x4f1d4b08
dec dword [esp + 0xc]
jns 0x1001a23a
mov dword [esp + 0xc], edx
cmp dword [esp + 0xc], ebx
jl 0x1001a2fd
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], ebx
jl 0x1001a2f7
mov dword [esp + 0x14], 0xfffffff6
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x1001a2f1
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + eax*4 + 0x50]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x50], ecx
dec dword [esp + 0x14]
jns 0x1001a2db
dec dword [esp + 0x18]
jns 0x1001a2c9
dec dword [esp + 0xc]
jns 0x1001a2bf
dec dword [esp + 0x1c]
jns 0x1001a22c
mov dword [esp + 0x7c], 0x607a9881
lea ecx, [esp + 0x10c]
mov dword [esp + 0x24], 0xed45b0e8
mov dword [esp + 0x24], 0x622b
push edx
call fcn.100173a1
mov dword [esp + 0xc], ebx
jmp 0x1001a348
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001a332
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10c]
mov dword [eax], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a36e
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
lea ecx, [esp + 0x10c]
call fcn.10017423
push 1
lea ecx, [esp + 0x148]
call fcn.100173a1
mov byte [esp + 0x1bc], 4
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0xc], 0x15
jmp 0x1001a4ee
mov dword [esp + 0x18], 1
lea ecx, [esp + 0x124]
push esi
call fcn.100173a1
mov dword [esp + 0x1c], ebx
jmp 0x1001a3de
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], 2
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001a3c8
xor ecx, ecx
mov dword [esp + 0x1c], ebx
inc ecx
jmp 0x1001a3f9
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x68], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1001a3ed
mov dword [esp + 0x1c], ebx
jmp 0x1001a415
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x78], 0xfa66fa4b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x1001a405
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x124]
mov dword [eax], ecx
mov dword [esp + 0x68], ebx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
inc ecx
add eax, ecx
mov dword [esp + 0x78], eax
lea ecx, [eax + 4]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
sub edx, 0x3053
neg edx
sbb edx, edx
inc edx
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp eax, 0x844ba928
jae 0x1001a485
cmp dword [esp + 0x68], ebx
je 0x1001a485
xor eax, eax
inc eax
jmp 0x1001a487
mov eax, ebx
imul eax, eax, 0xe1cc
test eax, eax
je 0x1001a4a9
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a4cc
push 0x211c
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x1001a4cc
mov dword [esp + 0x18], ebx
jmp 0x1001a4c5
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a4c1
push ebx
call dword [sym.imp.KERNEL32.dll_RtlCaptureContext]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff5
jle 0x1001a4af
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a4de
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x124]
call fcn.10017423
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe7
jle 0x1001a3ad
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x168]
mov dword [esp + 0x18], 0x2da8afc1
mov dword [esp + 0xc], 0x110e6b6c
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x826
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], 0x3818264d
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x24], 0xb323fa9d
mov dword [esp + 0x24], ebx
push 4
call fcn.100173a1
mov byte [esp + 0x1bc], 5
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
jmp 0x1001a570
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x168]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001a55d
cmp dword [esp + 0x14], ebx
jne 0x1001a581
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], 0x5732
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg eax
push 0
sbb eax, eax
inc eax
add eax, dword [esp + 0x18]
neg eax
mov eax, dword [esp + 0x18]
pop ecx
sets cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0xc], ecx
mov dword [esp + 0xc], 0xfffffff1
jmp 0x1001a70a
mov dword [esp + 0x30], 0x23ce
lea ecx, [esp + 0xac]
push 2
call fcn.100173a1
mov byte [esp + 0x1bc], 6
lea ecx, [esp + 0x6c]
mov dword [esp + 0x20], 0xffffffff
push esi
call fcn.100173a1
mov dword [esp + 0x20], 0x55a5
mov dword [esp + 0x14], ebx
jmp 0x1001a63d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], 0x6f37d437
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001a627
mov dword [esp + 0x14], ebx
jmp 0x1001a65d
cmp dword [esp + 0xc], 4
jne 0x1001a5e9
jmp 0x1001a728
lea ecx, [esp + 0x168]
mov byte [esp + 0x1bc], 4
call fcn.10017423
mov dword [esp + 0xc], ebx
jmp 0x1001a755
cmp dword [esp + 0xc], 1
jl 0x1001a742
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0xe997
mov dword [esp + 0xc], ebx
jmp 0x1001a821
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x8c], 0xb0121307
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001a80e
mov dword [esp + 0x18], ebx
jmp 0x1001a8a0
mov dword [esp + 0xc], 0xfffffffd
mov dword [esp + 0xc], 0xffffffe5
jmp 0x1001a892
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x30], 6
mov dword [esp + 0x2c], 0x79ae4f78
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x18], ebx
je 0x1001a87d
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x8c], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jg 0x1001a83f
mov eax, dword [esp + 0x14]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1d
jle 0x1001a82d
push ebx
push 0x6c17
lea eax, [esp + 0x47]
mov byte [esp + 0x47], bl
push eax
push 0x6007
call fcn.1001da93
add esp, 0x10
lea ecx, [esp + 0x100]
mov byte [esp + 0x1bc], bl
call fcn.10017423
dec dword [esp + 0x28]
jns 0x10019943
mov edi, dword [esp + 0x38]
or dword [esp + 0x1bc], 0xffffffff
lea ecx, [esp + 0xc4]
call fcn.10017423
push 2
lea ecx, [esp + 0x160]
call fcn.100173a1
mov dword [esp + 0x14], 0x4cd4536
mov dword [esp + 0x20], 0xcbae8b01
mov dword [esp + 0x38], 0xd5c0aeca
mov dword [esp + 0x38], 0x2f9e
mov dword [esp + 0xc], ebx
jmp 0x1001a93e
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001a92c
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], ebx
jl 0x1001aa0b
push 3
pop ecx
mov dword [esp + 0x38], 0xfffffff6
mov dword [esp + 0x18], 0x526d2e85
mov dword [esp + 0x38], 0x443eb606
mov dword [esp + 0x38], 0x44d513c6
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x30], 0x333db962
mov dword [esp + 0xc], ebx
jmp 0x1001a9a3
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1a4], 6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001a990
dec dword [esp + 0x20]
mov dword [esp + 0x18], 0xfffffff4
jmp 0x1001a9fa
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001a9d8
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x198], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001a9c5
inc dword [esp + 0x30]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a9f6
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
push 3
pop ecx
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffea
jl 0x1001a9b7
dec dword [esp + 0x14]
jns 0x1001a95a
lea ecx, [esp + 0x15c]
call fcn.10017423
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x80]
mov esi, edx
mov edi, eax
call fcn.100192c7
mov ecx, dword [esp + 0x1b4]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret