Function at 0x10001b5d
Capabilities:
Resolve function by parsing pe exports
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004b31e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xf0
mov dword [esp + 0x3c], edx
mov byte [esp + 0x2c], cl
push ebx
push esi
push edi
test cl, cl
je 0x10002434
mov dword [esp + 0x10], 0xffffffff
xor ebx, ebx
mov dword [esp + 0x14], 0xbd13d8c5
mov dword [esp + 0x14], 0xed99ea7
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x1c], ebx
jmp 0x10001bc9
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x30], 0xf9b3
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10001bb9
mov dword [esp + 0x10], 1
cmp dword [esp + 0x10], ebx
jl 0x10001c83
mov dword [esp + 0x1c], 0xfffffff9
cmp dword [esp + 0x30], ebx
je 0x10001bff
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x30], ebx
je 0x10001bff
xor ecx, ecx
inc ecx
jmp 0x10001c01
mov ecx, ebx
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x30]
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x30]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x30]
sete dl
imul ecx, edx, 0xdcef
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x69393dda
setle al
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
jne 0x10001c56
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x30]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + eax*4 + 0x30]
add edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
dec dword [esp + 0x10]
jns 0x10001be2
xor eax, eax
mov dword [esp + 0x80], 7
mov dword [esp + 0x7c], ebx
mov word [esp + 0x6c], ax
mov dword [esp + 0x104], ebx
mov dword [esp + 0x24], 0xf606
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 0xbacd7953
mov dword [esp + 0x24], 8
mov dword [esp + 0x24], 0x5cbd9454
mov dword [esp + 0x40], 0x6887e08a
mov dword [esp + 0x1c], ebx
jmp 0x10001ce5
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x88], 0x61ab6ec7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10001cd2
sub esp, 0x10
lea ecx, [esp + 0x50]
mov dl, 1
push 0x2050
call fcn.10002669
add esp, 0x14
lea eax, [ebp + 0xc]
lea edx, [esp + 0x6c]
push 0x75cf
push ecx
push eax
push 1
call fcn.10002550
add esp, 0x10
mov dword [esp + 0x50], 0xe1757117
lea edx, [esp + 0x50]
xor cl, cl
call fcn.10002451
mov eax, dword [0x10063bb0]
test al, 1
jne 0x10001d63
or eax, 1
mov dword [0x10063bb0], eax
push 0x10c9
mov byte [esp + 0x108], 1
call fcn.10018b3c
mov word [0x10064f4c], ax
mov byte [esp + 0x108], bl
mov eax, dword [0x10063bb0]
pop ecx
test al, 2
jne 0x10001d8f
or eax, 2
mov dword [0x10063bb0], eax
push 0xc30
mov byte [esp + 0x108], 2
call fcn.10018b3c
pop ecx
mov word [0x10064f60], ax
mov byte [esp + 0x104], bl
mov dword [esp + 0x14], 5
mov dword [esp + 0x1c], 0x867b8f5f
mov dword [esp + 0x14], 0x3edfa831
mov dword [esp + 0x24], 0x5edade09
mov dword [esp + 0x20], ebx
jmp 0x10001dc5
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x2c], 0xc04ee7d2
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x10001db5
mov dword [esp + 0x10], 0x74aa
cmp dword [esp + 0x10], 0x77a0
jle 0x10001e65
mov esi, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], 0x21e9
mov edi, ebx
mov dword [esp + 0x24], esi
and esi, edi
mov eax, esi
lea ecx, [esp + 0xc8]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001e19
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push 0
push 1
lea ecx, [esp + 0xd0]
call fcn.100040fa
inc ebx
cmp ebx, 0xf11
jl 0x10001dfc
mov esi, dword [esp + 0x14]
inc edi
push 0
pop ebx
cmp edi, 0x4f46
jl 0x10001df6
dec esi
dec dword [esp + 0x1c]
mov dword [esp + 0x14], esi
jne 0x10001df4
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x2dbf
jl 0x10001de8
mov dword [esp + 0x20], ebx
jmp 0x10001e7b
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x44], 0xfffffffe
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x10001e6b
cmp dword [esp + 0x10], 0x71f9
jge 0x10001e97
push str.moajdr_awbpfryp_brp_xadof
call fcn.10036008
pop ecx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x18], 0x180b
cmp dword [esp + 0x18], 0x18c6
jle 0x10001f24
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
mov edi, ebx
mov dword [esp + 0x14], ebx
mov esi, ebx
mov ecx, esi
mov dword [esp + 0x24], edi
shl edi, cl
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [esp + 0x98]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001ee7
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push 0
push 1
lea ecx, [esp + 0xa0]
call fcn.100040fa
inc ebx
cmp ebx, 0x4479
jl 0x10001ec8
mov edi, dword [esp + 0x14]
inc esi
push 0
pop ebx
cmp esi, 0x53b3
jl 0x10001ec0
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0x777f
jl 0x10001ebe
mov eax, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
setl dl
xor ecx, ecx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
cmp eax, 1
setg cl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x44], ecx
mov eax, dword [esp + 0x1c]
sub eax, ecx
mov dword [esp + 0x24], eax
cmp dword [esp + 0x18], 0x151a
jge 0x10001f7e
push str.uyboxhk_hhy_agah_azohgzii_tsfoyjch_fceysdyr_axqytuebf_iea_dkffrdqv
call fcn.10036008
pop ecx
mov dword [esp + 0x104], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x24], eax
test eax, eax
je 0x10002353
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x2285faaf
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x10], 0x7952
cmp dword [esp + 0x10], 0x79dc
jle 0x10002052
mov edi, ebx
mov dword [esp + 0x20], ebx
mov esi, ebx
mov dword [esp + 0x18], ebx
mov ecx, esi
mov dword [esp + 0x14], edi
mov esi, edi
sar esi, cl
xor edi, edi
mov dword [esp + 0x14], 0x1c11
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [esp + 0xb0]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002001
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push 0
push 1
lea ecx, [esp + 0xb8]
call fcn.100040fa
add edi, ebx
dec dword [esp + 0x14]
jne 0x10001fe2
inc ebx
cmp ebx, 0x2b44
jl 0x10001fd8
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x20]
inc esi
mov dword [esp + 0x18], esi
push 0
pop ebx
cmp esi, 0x1c49
jl 0x10001fce
inc edi
mov dword [esp + 0x20], edi
cmp edi, 0x37c9
jl 0x10001fc8
mov dword [esp + 0x18], ebx
jmp 0x10002068
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x54], 0x31a2955e
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10002058
cmp dword [esp + 0x10], 0x7815
jge 0x10002084
push str.hmrqwp_nkaslu_flqi_yoedfqx_pdjdfi_cjmkmh_hvvneygp_asin_guuemxfn_ahhhmr_egue_jlfo_chfswqy
call fcn.10036008
pop ecx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x20], ebx
jmp 0x100022dd
mov dword [esp + 0x18], 0x2bf5f40e
mov dword [esp + 0x10], 0x4ff0
cmp dword [esp + 0x10], 0x51cf
jle 0x100020f9
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [esp + 0xe0]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100020d1
mov eax, dword [eax]
push eax
call fcn.10036008
pop ecx
push ebx
push 1
lea ecx, [esp + 0xe8]
call fcn.100040fa
inc edi
cmp edi, 0x7751
jl 0x100020b2
inc esi
cmp esi, 0x1643
jl 0x100020b0
mov dword [esp + 0x14], 0x800f4d4e
cmp dword [esp + 0x10], 0x4c6f
jge 0x10002116
push str.bnwusc_wnco_vvlxejuto_dyyco_wqbxk_ywfbesvi_vsboh
call fcn.10036008
pop ecx
mov dword [esp + 0x104], ebx
mov dword [esp + 0x10], 0x523668f7
mov dword [esp + 0x10], 4
mov dword [esp + 0x10], 0x88afc007
mov dword [esp + 0x10], ebx
jmp 0x1000214a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x8c], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1000213b
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
add ecx, eax
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
sub ecx, eax
mov eax, dword [esp + 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
imul ecx, ecx, 0xf3b
cmp ecx, eax
mov eax, dword [esp + 0x18]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [esp + 0x20]
setge bl
xor ecx, ecx
cmp ebx, eax
setl cl
xor ebx, ebx
add ecx, dword [esp + 0x1c]
jne 0x100021af
cmp dword [esp + 0x14], ebx
jne 0x100021af
mov eax, ebx
jmp 0x100021b2
xor eax, eax
inc eax
xor ecx, ecx
cmp eax, 0xaa4f
setg cl
xor eax, eax
cmp ecx, 0xe0c0
setge al
cmp eax, 0xffffffff
mov eax, dword [esp + 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
test ecx, ecx
js 0x100021f4
cmp dword [esp + 0x14], ebx
jne 0x100021f4
cmp dword [esp + 0x10], ebx
je 0x100021f8
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x90]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0x20]
jle 0x10002275
mov dword [esp + 0x18], 0xfea1
xor edx, edx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setge dl
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x54], eax
cmp dword [esp + 0x20], ebx
jge 0x10002256
cmp dword [esp + 0x18], ebx
jne 0x100022e8
jmp 0x100022d9
mov dword [esp + 0x18], ebx
jmp 0x1000226c
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x54], 0x67326dc7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1000225c
jmp 0x100022d9
mov dword [esp + 0x4c], 0xfffffffe
mov dword [esp + 0x14], 0xf0102089
mov dword [esp + 0x10], ebx
jmp 0x1000229e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x84], 0x37ece519
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1000228b
mov dword [esp + 0x10], ebx
jmp 0x100022bb
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x5c], 0x3ecb6aef
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100022ab
lea eax, [esp + 0x4c]
mov ecx, 0x4b15
push eax
push 1
call fcn.10001abb
dec dword [esp + 0x68]
pop ecx
pop ecx
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffea
jl 0x10002094
mov dword [esp + 0x20], 1
cmp dword [esp + 0x20], ebx
jl 0x10002312
mov dword [esp + 0x10], ebx
jmp 0x10002305
call fcn.10002f7d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jle 0x100022fc
dec dword [esp + 0x20]
jns 0x100022f6
call fcn.10001aa2
push 0x34
pop ecx
xor edx, edx
div ecx
lea eax, [esp + 0x3c]
mov ecx, 0x10064f4c
push eax
push 0xbd6
push 0x6a60
lea eax, [esp + 0x78]
mov dword [esp + 0x48], edx
push eax
push ebx
mov edx, 0x10064f60
call fcn.1000336e
add esp, 0x14
dec dword [esp + 0x24]
jne 0x10001f94
mov dword [esp + 0x10], 0x5a136951
mov dword [esp + 0x14], ebx
jmp 0x10002371
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x28], 0x8ec0ae97
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10002361
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x100023ee
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x28], ebx
je 0x100023e3
mov dword [esp + 0x14], ebx
jmp 0x100023aa
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x64], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1000239a
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x64]
mov dword [esp + 0x24], eax
jmp 0x100023e8
call fcn.10002654
dec dword [esp + 0x10]
jns 0x10002382
mov dword [esp + 0x10], ebx
jmp 0x10002408
mov dword [esp + 0x24], 4
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], eax
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffa
jl 0x100023f4
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x6c]
cmp eax, ecx
je 0x10002426
push 0xffffffffffffffff
push ebx
push ecx
mov ecx, eax
call fcn.100041cd
push ebx
push 1
lea ecx, [esp + 0x74]
call fcn.100042fb
jmp 0x1000243c
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0xfc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret