Function at 0x1001af53
Capabilities:
Check os version
Create pipe
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008ec5d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x268
movdqa xmm0, xmmword [0x10007b90]
lea eax, [esp + 0x25c]
push ebx
push esi
push edi
push dword [esp + 0x88]
xor ebx, ebx
mov dword [esp + 0x5c], ecx
or edi, 0xffffffff
mov dword [esp + 0x40], edx
mov dword [esp + 0x20], edi
lea ecx, [esp + 0x124]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x3c], 0xbf2465cd
mov dword [esp + 0x38], 0xbec0351
push eax
mov dword [esp + 0x1c], edi
lea eax, [esp + 0x260]
mov dword [esp + 0x40], 0x9d982735
push eax
mov dword [esp + 0x44], 0xdbf0cf86
mov dword [esp + 0x30], 0x2ca335c2
mov dword [esp + 0x34], 0xd91b0598
push ebx
movdqu xmmword [esp + 0x268], xmm0
mov dword [esp + 0x130], ebx
mov dword [esp + 0x134], ebx
mov dword [esp + 0x138], ebx
call fcn.1001a48b
xor ecx, ecx
mov dword [esp + 0x30], 0x1db4dbdf
mov dword [esp + 0x10], ebx
inc ecx
jmp 0x1001b02b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x6c], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001b01f
push 2
mov dword [esp + 0x14], ebx
pop esi
jmp 0x1001b049
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xb8], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001b03a
mov eax, dword [esp + 0x2c]
neg eax
je 0x1001b062
mov edx, ecx
cmp dword [esp + 0xb8], ebx
jne 0x1001b064
mov edx, ebx
dec dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x14]
cmp edx, eax
mov eax, 0xffff
setle cl
cmp eax, ecx
mov eax, dword [esp + 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [esp + 0x6c]
mov ecx, 0xe1b1b552
setl dl
sub ecx, edx
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x1c]
cmp eax, ecx
mov eax, dword [esp + 0xbc]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x6c]
setne cl
xor edx, edx
cmp ecx, 0x27163995
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setle cl
imul eax, ecx
test eax, eax
je 0x1001b0e0
cmp dword [esp + 0x1c], ebx
je 0x1001b0e0
xor edi, edi
lea edx, [edi + 1]
or edi, 0xffffffff
jmp 0x1001b0e2
mov edx, ebx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x6c]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
je 0x1001b11b
cmp dword [esp + 0xb8], ebx
je 0x1001b11b
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x1001b120
xor ecx, ecx
mov eax, ebx
inc ecx
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
je 0x1001b1fd
mov dword [esp + 0x38], ecx
mov dword [esp + 0x38], 0x6e4944c1
mov dword [esp + 0x28], 0xfffffff6
mov dword [esp + 0x24], 0x96db3533
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0xe2d0b182
mov dword [esp + 0x14], ebx
jmp 0x1001b16f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x150], 0x39425a33
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001b15c
mov eax, dword [esp + 0x154]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xc668
jne 0x1001b193
mov eax, ebx
cmp dword [esp + 0xbc], ebx
je 0x1001b195
mov eax, ecx
cmp eax, dword [esp + 0x24]
jne 0x1001b19f
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xfc9d
sete al
xor edx, edx
imul ecx, eax, 0xf491
mov eax, dword [esp + 0x154]
cmp ecx, eax
mov eax, dword [esp + 0x30]
setle dl
dec dword [esp + 0x30]
xor edi, edi
inc edi
cmp eax, edx
mov eax, edi
jl 0x1001b1df
mov eax, ebx
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], 0xa776a221
jmp 0x1001b232
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001b218
push ebx
push 0x143
push 0x1f67
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001b22f
push ebx
push 0x1f7e
push ebx
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
xor edi, edi
inc edi
lea ecx, [esp + 0x120]
call fcn.100196eb
mov dword [esp + 0x2c], 0x8ef6
lea ecx, [esp + 0x1fc]
mov dword [esp + 0x24], 0x210e164c
mov dword [esp + 0x10], esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x1c], 0xd0176df7
push 3
call fcn.10018ece
xor edx, edx
mov dword [esp + 0x27c], ebx
mov dword [esp + 0x14], ebx
inc edx
cmp dword [esp + 0x14], 3
jge 0x1001b295
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1fc]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
jmp 0x1001b27a
cmp dword [esp + 0x10], ebx
jne 0x1001b2b5
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x10]
je 0x1001b2a9
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], ebx
je 0x1001b361
mov eax, 0x6673
lea ecx, [esp + 0x1f0]
mov dword [esp + 0x238], eax
mov dword [esp + 0x23c], eax
mov dword [esp + 0x240], eax
mov dword [esp + 0x244], eax
mov dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x38], 0xcf5a8b06
push 3
call fcn.10018ece
mov dword [esp + 0x14], ebx
jmp 0x1001b31e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1f0]
mov dword [eax + ecx*4], 0x927f7b6f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001b308
dec dword [esp + 0x1c]
mov dword [esp + 0x10], 0xfffffff3
jmp 0x1001b34a
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b346
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x1001b333
lea ecx, [esp + 0x1f0]
call fcn.100196eb
jmp 0x1001b3e6
mov dword [esp + 0x20], ebx
jmp 0x1001b3df
mov dword [esp + 0x10], ebx
jmp 0x1001b3d5
mov dword [esp + 0x1c], ebx
jmp 0x1001b3b9
mov dword [esp + 0x14], 0xfffffff8
mov dword [esp + 0x14], ebx
jmp 0x1001b3af
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b3a7
push 0x219f
push 0x144c
push 0x19cf
push 0x9ae
push ebx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov eax, dword [esp + 0x10]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1001b381
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x1001b373
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b3d1
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x1001b36d
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x18
je 0x1001b367
mov dword [esp + 0x20], 4
lea ecx, [esp + 0x1fc]
or dword [esp + 0x27c], 0xffffffff
call fcn.100196eb
mov dword [esp + 0x28], 0x90d29729
lea ecx, [esp + 0xd8]
xor edi, edi
mov dword [esp + 0x10], 0xffffffff
inc edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x1c], 0xb667f5ae
push edi
call fcn.10018ece
xor edx, edx
inc edx
mov dword [esp + 0x27c], edx
mov dword [esp + 0x14], ebx
jmp 0x1001b454
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], 0x24b969b4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001b43e
mov dword [esp + 0x10], 0x18
cmp dword [esp + 0x10], 0xa
jne 0x1001b547
xor edi, edi
inc edi
push 3
lea ecx, [esp + 0xc4]
call fcn.10018ece
mov dword [esp + 0x14], 8
mov dword [esp + 0x14], ebx
jmp 0x1001b4a2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001b48c
mov eax, dword [esp + 0xc0]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jne 0x1001b4f9
cmp dword [esp + 0x10], ebx
je 0x1001b4e0
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
xor edi, edi
mov eax, dword [esp + 0x24]
inc ecx
mov eax, dword [esp + 0xc0]
inc edi
cmp dword [eax + 8], ecx
jne 0x1001b4e2
mov ecx, ebx
xor eax, eax
test ecx, ecx
mov ecx, ebx
setle al
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x1c]
jge 0x1001b4fb
mov ecx, edi
mov eax, dword [esp + 0xc0]
xor edx, edx
cmp ecx, dword [eax + 4]
mov eax, dword [esp + 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc0]
setge cl
xor edx, edx
cmp ecx, dword [eax]
lea ecx, [esp + 0xc0]
mov eax, dword [esp + 0xd8]
setl dl
mov dword [eax], edx
call fcn.100196eb
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xa
je 0x1001b470
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0xd8]
add edx, 0x108fa7ad
cmp dword [eax], 0xfffffffd
setg cl
cmp edx, ecx
je 0x1001b568
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
cmp eax, esi
setg cl
xor eax, eax
cmp ecx, 5
mov ecx, dword [esp + 0x10]
setle al
sub ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xd8]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x24]
setl dl
xor esi, esi
inc esi
cmp esi, edx
sbb ecx, ecx
neg ecx
add eax, ecx
je 0x1001b5ba
mov edx, esi
cmp dword [esp + 0x24], ebx
jne 0x1001b5bc
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0xd8]
or dword [esp + 0x27c], 0xffffffff
call fcn.100196eb
mov dword [esp + 0x30], 0xffff
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x1c], 0xf9c2
push 3
call fcn.10018ece
mov dword [esp + 0x14], ebx
jmp 0x1001b615
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001b603
dec dword [esp + 0x1c]
push 2
mov dword [esp + 0x20], ebx
pop edi
jmp 0x1001b646
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b642
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x1001b629
lea ecx, [esp + 0x1e0]
call fcn.100196eb
mov dword [esp + 0x34], esi
lea ecx, [esp + 0x180]
mov dword [esp + 0x14], 0x48bbca63
push 3
call fcn.10018ece
mov dword [esp + 0x14], ebx
jmp 0x1001b68e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001b678
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b6a8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [esp + 0x14], 0xfffffff6
cmp dword [esp + 0x14], 0xffffffef
jne 0x1001b6d8
mov ecx, dword [esp + 0x180]
mov dword [esp + 0x24], esi
dec dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [ecx + 4], eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffef
je 0x1001b6be
lea ecx, [esp + 0x180]
call fcn.100196eb
push esi
lea ecx, [esp + 0x74]
call fcn.10018ece
push 3
lea ecx, [esp + 0x130]
mov dword [esp + 0x280], edi
call fcn.10018ece
mov byte [esp + 0x27c], 3
xor edx, edx
mov dword [esp + 0x34], ebx
inc edx
mov dword [esp + 0x10], ebx
jmp 0x1001b728
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x40], 0x624039b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001b718
mov dword [esp + 0x10], ebx
jmp 0x1001b747
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
mov dword [eax + ecx*4], 0xb743d837
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001b734
push 3
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1001b768
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001b756
mov eax, dword [esp + 0x70]
xor edi, edi
inc edi
mov dword [eax], ebx
mov eax, dword [eax]
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], 0x967684ab
mov eax, dword [esp + eax*4 + 0x40]
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 0xfffffffe
jle 0x1001b8fe
mov esi, dword [esp + 0x12c]
push 2
lea ecx, [esp + 0x16c]
call fcn.10018ece
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], edi
mov dword [esp + 0x10], ebx
jmp 0x1001b7d6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x22c], 0xec01
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001b7c3
mov dword [esp + 0x10], ebx
jmp 0x1001b7f9
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], 0xb14151c8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001b7e3
mov eax, dword [esp + 0x40]
xor edx, edx
mov dword [esi + 8], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x234]
mov eax, dword [esp + 0x70]
cmp ecx, dword [eax]
setne dl
cmp dword [esp + 0x20], edx
jle 0x1001b830
cmp dword [esp + 0x40], ebx
jne 0x1001b830
xor edx, edx
mov eax, ebx
inc edx
jmp 0x1001b835
xor edx, edx
inc edx
mov eax, edx
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x168]
setne cl
mov dword [eax + 4], ecx
test ecx, ecx
je 0x1001b858
mov eax, dword [esp + 0x70]
mov ecx, edx
mov eax, dword [eax]
cmp dword [esp + eax*4 + 0x40], ebx
jne 0x1001b85a
mov ecx, ebx
mov eax, dword [esp + 0x20]
imul eax, ecx
mov dword [esp + 0x28], eax
cmp dword [esp + 0x28], ebx
je 0x1001b873
mov ecx, edx
cmp dword [esp + 0x20], ebx
jne 0x1001b875
mov ecx, ebx
xor eax, eax
cmp ecx, 0x7cd95329
setne al
xor edx, edx
cmp eax, 0xffff
mov eax, dword [esp + 0x70]
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setge cl
xor edx, edx
mov dword [esp + 0x28], ecx
xor edi, edi
mov eax, dword [esp + 0x28]
inc edi
mov eax, dword [esp + 0x70]
cmp dword [eax], edi
mov eax, dword [esp + 0x234]
sete dl
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x40]
cmp ecx, eax
mov eax, dword [esp + 0x70]
setge dl
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x40]
cmp edx, eax
setne cl
mov dword [esi + 8], ecx
lea ecx, [esp + 0x168]
call fcn.100196eb
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffffe
jg 0x1001b7a3
push 3
pop edx
mov eax, dword [esp + 0x70]
dec dword [eax]
jns 0x1001b777
mov eax, dword [esp + 0x40]
xor edx, edx
mov eax, dword [esp + 0x40]
xor ecx, ecx
mov eax, dword [esp + 0x40]
inc edx
mov eax, dword [esp + 0x40]
cmp eax, edx
mov edi, dword [esp + 0x12c]
setge cl
sub ecx, dword [edi + 8]
je 0x1001b938
mov esi, edx
cmp dword [esp + 0x40], ebx
jne 0x1001b93a
mov esi, ebx
mov eax, dword [esp + 0x70]
xor ecx, ecx
mov edx, dword [eax]
mov eax, dword [esp + 0x34]
cmp esi, eax
setle cl
xor eax, eax
cmp ecx, edx
lea ecx, [esp + 0x12c]
setge al
add eax, edx
sub eax, dword [edi + 8]
neg eax
sbb eax, eax
add eax, 0xfffffffb
mov dword [edi + 8], eax
call fcn.100196eb
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x70]
call fcn.100196eb
xor edi, edi
lea ecx, [esp + 0x1d4]
inc edi
push edi
call fcn.10018ece
xor edx, edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x1001b9b1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1d4]
mov dword [eax + ecx*4], 0x1713b910
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001b99b
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x1001ba0d
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001b9f2
push ebx
push 0x25a3
push 0x503
push 0x5b2
push 0x229a
push 0x2138
push 0x258e
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1d4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x1c]
jns 0x1001b9c1
lea ecx, [esp + 0x1d4]
call fcn.100196eb
push 2
mov dword [esp + 0x18], ebx
pop esi
jmp 0x1001ba35
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x268], 0x209a488d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001ba22
mov dword [esp + 0x14], 0xd8cb
lea ecx, [esp + 0x208]
mov dword [esp + 0x24], 0xfffa
or edi, 0xffffffff
mov dword [esp + 0x20], edi
mov dword [esp + 0x28], 0x6a71
push esi
call fcn.10018ece
push 4
pop eax
push eax
lea ecx, [esp + 0x148]
mov dword [esp + 0x280], eax
call fcn.10018ece
push 0xfffffffffffffff8
mov dword [esp + 0x38], 4
pop edx
mov dword [esp + 0x38], edx
mov dword [esp + 0x10], ebx
jmp 0x1001baa5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x208]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001ba93
mov dword [esp + 0x10], ebx
jmp 0x1001bac7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0xb16aac89
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001bab1
mov dword [esp + 0x10], ebx
jmp 0x1001bae3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xb0], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001bad4
cmp dword [esp + 0x14], ebx
je 0x1001bb04
mov dword [esp + 0x24], 6
cmp dword [esp + 0x24], ebx
je 0x1001bb04
xor edx, edx
inc edx
mov eax, edx
jmp 0x1001bb09
xor edx, edx
mov eax, ebx
inc edx
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jne 0x1001bb65
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, 0x4c20
setg cl
xor eax, eax
cmp ecx, 0x718e
setge al
sub eax, 0xa140
je 0x1001bb41
mov eax, dword [esp + 0x144]
mov ecx, edx
cmp dword [eax + 8], ebx
jne 0x1001bb43
mov ecx, ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x144]
cmp dword [eax + 8], ebx
mov eax, ebx
je 0x1001bb67
mov eax, edx
imul eax, eax, 0x79a982ff
mov dword [esp + 0xb0], eax
mov dword [esp + 0x20], 0xfff9
mov eax, dword [esp + 0xb0]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xb0]
mov eax, dword [esp + 0xb0]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001bbbf
push ebx
call dword [sym.imp.COMDLG32.dll_FindTextW]
lea ecx, [esp + 0x144]
call fcn.100196eb
lea ecx, [esp + 0x208]
mov dword [esp + 0x27c], edi
call fcn.100196eb
lea eax, [esp + 0x53]
mov byte [esp + 0x53], bl
push ebx
push eax
call fcn.10025d4d
pop ecx
pop ecx
cmp dword [esp + 0x2c], ebx
je 0x1001bc21
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
sub eax, 0xd4a1
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x30]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x30]
jg 0x1001bc21
xor esi, esi
inc esi
mov edx, esi
jmp 0x1001bc26
xor esi, esi
mov edx, ebx
inc esi
mov eax, dword [esp + 0x2c]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [esp + 0x30]
jle 0x1001bc3b
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x2c]
mov edi, dword [esp + 0x58]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
cmp eax, ecx
setl dl
mov dword [esp + 0x34], edx
cmp dword [edi + 0x10], ebx
jne 0x1001bc7e
xor al, al
jmp 0x1001ce40
mov dword [esp + 0x1c], 0xe8cff0ea
mov dword [esp + 0x28], 0x3a4c924b
mov dword [esp + 0x1c], 0xf
jmp 0x1001bd0e
push 2
lea ecx, [esp + 0x13c]
call fcn.10018ece
mov dword [esp + 0x34], 0x24b2
mov dword [esp + 0x14], ebx
jmp 0x1001bcca
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001bcb4
mov ecx, dword [esp + 0x138]
mov eax, dword [esp + 0x1c]
mov dword [ecx + 4], ebx
mov eax, dword [ecx + 4]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x138]
mov eax, dword [eax]
mov dword [ecx + 4], eax
lea ecx, [esp + 0x138]
call fcn.100196eb
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff2
jge 0x1001bc98
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001bd2b
push 0x2668
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [esp + 0x2c], 0x48bbca63
lea ecx, [esp + 0x18c]
push 3
call fcn.10018ece
mov dword [esp + 0x27c], 5
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], 0xfffffff8
mov dword [esp + 0x10], 0xc902dafb
mov dword [esp + 0x28], 0x53423637
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
je 0x1001bd7e
mov eax, dword [esp + 0x1c]
mov edx, esi
cmp eax, dword [esp + 0x1c]
je 0x1001bd80
mov edx, ebx
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
cmp edx, eax
setle cl
xor edx, edx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
cmp eax, 0xffffffff
mov eax, dword [esp + 0x2c]
setle dl
xor ecx, ecx
cmp eax, edx
setne cl
dec ecx
je 0x1001bdfa
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001bdcc
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001bf78
push 0xe88
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x1001bf78
xor ecx, ecx
mov dword [esp + 0x20], 0x7c7a
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x20]
cmp eax, 0xa720
setg cl
add ecx, 5
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0xfffffff9
cmp edx, eax
mov eax, dword [esp + 0x20]
setge cl
xor edx, edx
cmp ecx, 3
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, dword [esp + 0x10]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x20]
jne 0x1001bef7
or eax, 0xffffffff
mov dword [esp + 0x24], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], ebx
jmp 0x1001be88
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1b0], 6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001be75
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x1b8]
jle 0x1001bebd
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp eax, 0xa81f
setg cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov eax, esi
cmp dword [esp + 0x1b8], ebx
jne 0x1001bebf
mov eax, ebx
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], 3
sbb ecx, ecx
neg ecx
sub ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1b8]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x34], ecx
jmp 0x1001bf78
mov dword [esp + 0x20], ebx
jmp 0x1001bf71
mov dword [esp + 0x10], ebx
jmp 0x1001bf66
push 2
lea ecx, [esp + 0x218]
call fcn.10018ece
mov dword [esp + 0x14], ebx
jmp 0x1001bf2d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x214]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001bf17
mov dword [esp + 0x1c], ebx
jmp 0x1001bf50
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001bf4c
push ebx
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x1001bf3a
lea ecx, [esp + 0x214]
call fcn.100196eb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xe
jl 0x1001bf03
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffec
jg 0x1001befd
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x2c], 0x42bb
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x34], 6
mov dword [esp + 0x14], ebx
jmp 0x1001bfb9
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x100], 0x1f2c29a3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001bfa6
cmp dword [esp + 0x10c], ebx
je 0x1001c102
mov dword [esp + 0x1c], 0x91df82
lea ecx, [esp + 0x198]
mov dword [esp + 0x28], 3
push esi
call fcn.10018ece
xor edx, edx
mov dword [esp + 0x34], 0xaedf47f2
mov dword [esp + 0x14], ebx
inc edx
jmp 0x1001c011
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001bffb
imul eax, dword [esp + 0x1c], 0xfa55
cmp eax, dword [esp + 0x1c]
jle 0x1001c030
mov eax, edx
cmp dword [esp + 0x100], ebx
jne 0x1001c032
mov eax, ebx
imul ecx, eax, 0xf6a0
xor edx, edx
sub ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
cmp ecx, eax
mov ecx, dword [esp + 0x10c]
mov eax, dword [esp + 0x198]
setl dl
add ecx, edx
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
add eax, ecx
je 0x1001c071
cmp dword [esp + 0x10c], ebx
je 0x1001c071
xor esi, esi
inc esi
mov edx, esi
jmp 0x1001c076
xor esi, esi
mov edx, ebx
inc esi
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, edx
setne cl
imul ecx, dword [esp + 0x108]
dec ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xc5a74d4b
setne al
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x24], eax
jl 0x1001c0ae
cmp dword [esp + 0x34], ebx
je 0x1001c0b6
mov eax, esi
cmp dword [esp + 0x2c], ebx
jne 0x1001c0b8
mov eax, ebx
mov edx, dword [esp + 0x1c]
xor ecx, ecx
imul edx, eax
mov eax, dword [esp + 0x10c]
cmp edx, eax
setl cl
cmp ecx, 0xffffffff
jle 0x1001c0da
mov ecx, esi
cmp dword [esp + 0x28], ebx
jne 0x1001c0dc
mov ecx, ebx
mov eax, dword [esp + 0x2c]
add eax, ecx
lea ecx, [esp + 0x198]
imul eax, eax, 0x90ba
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
call fcn.100196eb
jmp 0x1001c16d
mov dword [esp + 0x14], ebx
xor ecx, ecx
mov dword [esp + 0x1c], 0xda4adcf8
mov eax, dword [esp + 0x104]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
inc edx
cmp edx, eax
setg cl
cmp dword [esp + 0x34], ecx
jle 0x1001c13d
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
jmp 0x1001c15b
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001c15b
push ebx
push 0x1bca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001c16d
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
lea eax, [esp + 0x18c]
push eax
push ebx
push 0xfae
lea eax, [esp + 0xf0]
push 0x7afc
push eax
call fcn.1001d02d
or eax, 0xffffffff
add esp, 0x14
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0x16580849
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], ebx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001c1be
push 0x1464
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x24]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x24]
cmp eax, 0x3ffe0
mov eax, dword [esp + 0x24]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
sub edx, eax
mov eax, dword [esp + 0x14]
cmp eax, edx
setge cl
mov dword [esp + 0x34], ecx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001c214
push ebx
call fcn.1001ced5
pop ecx
xor eax, eax
mov dword [esp + 0x20], 7
inc eax
lea ecx, [esp + 0x7c]
push eax
call fcn.10018ece
mov dword [esp + 0x14], ebx
xor edx, edx
mov dword [esp + 0x24], 0x360abed9
inc edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001c255
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], 0x34111d01
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001c242
mov dword [esp + 0x10], ebx
jmp 0x1001c271
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x5c], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001c261
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x7c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov esi, dword [eax]
imul edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
neg eax
cmp eax, esi
setle cl
cmp edx, ecx
jl 0x1001c2a8
test esi, esi
jne 0x1001c2a8
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x7c]
xor esi, esi
inc esi
mov ecx, esi
mov edx, dword [eax]
mov eax, dword [esp + 0x20]
sub ecx, eax
xor eax, eax
cmp ecx, edx
setg al
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x5c]
setg cl
sub ecx, edx
neg ecx
sbb ecx, ecx
add ecx, 0xfffffffa
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x34], ecx
xor ecx, ecx
cmp dword [esp + 0x34], eax
setne cl
xor eax, eax
cmp ecx, 0x11fc
setle al
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
je 0x1001c34f
mov eax, dword [esp + 0x5c]
xor edx, edx
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x7c]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xfffffff9
setne al
xor ecx, ecx
cmp eax, 0x94ad
mov eax, dword [esp + 0x7c]
setg cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [esp + 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x7c]
mov edx, esi
sete cl
cmp ecx, dword [eax]
jle 0x1001c351
mov edx, ebx
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, 0x6fbc
jge 0x1001c36e
mov eax, dword [esp + 0x7c]
cmp dword [eax], ebx
mov eax, ebx
je 0x1001c370
mov eax, esi
mov dword [esp + 0x14], eax
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov edx, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x7c]
sub edx, dword [eax]
mov eax, dword [esp + 0x20]
cmp edx, eax
setg cl
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x7c]
call fcn.100196eb
mov dword [esp + 0x2c], 0xfffffff6
cmp dword [esp + 0x2c], 0xffffffef
jne 0x1001c779
mov dword [esp + 0x90], esi
lea ecx, [esp + 0xa4]
push 2
call fcn.10018ece
mov byte [esp + 0x27c], 6
lea eax, [esp + 0x258]
push dword [esp + 0xe4]
movdqa xmm0, xmmword [0x10007b50]
lea ecx, [esp + 0xd0]
push eax
lea eax, [esp + 0x250]
mov dword [esp + 0x18], 0xeaa32b1c
push eax
mov dword [esp + 0x40], 6
push ebx
movdqu xmmword [esp + 0x258], xmm0
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
call fcn.1001a48b
mov byte [esp + 0x27c], 7
lea ecx, [esp + 0x174]
mov dword [esp + 0x24], 0x8770ce40
push esi
call fcn.10018ece
mov byte [esp + 0x27c], 8
mov dword [esp + 0x11c], 0x1265a1b
mov dword [esp + 0x10], ebx
jmp 0x1001c476
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa4]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001c460
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001c499
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x174]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001c486
mov dword [esp + 0x10], ebx
jmp 0x1001c4b8
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x18c]
call fcn.100196eb
mov edx, dword [esp + 0x3c]
mov dword [edx], ebx
cmp dword [edi + 0x14], 0x10
jb 0x1001c79d
mov esi, dword [edi]
jmp 0x1001c79f
mov esi, edi
cmp dword [edi + 0x14], 0x10
jb 0x1001c7a9
mov ecx, dword [edi]
jmp 0x1001c7ab
mov ecx, edi
mov eax, dword [edi + 0x10]
add eax, ecx
cmp esi, eax
je 0x1001caf2
mov al, byte [esi]
cmp al, 0x30
jl 0x1001c919
cmp al, 0x39
jg 0x1001c919
xor eax, eax
inc eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x4c], 0xa810d21d
mov dword [esp + 0x118], ebx
mov dword [esp + 0x114], 0xfffffff9
mov dword [esp + 0xf8], 0xfa1
mov dword [esp + 0x44], 0x16
cmp dword [esp + 0x44], 0xfffffffc
jle 0x1001c851
push 4
lea ecx, [esp + 0x224]
mov dword [edx], ebx
call fcn.10018ece
mov dword [esp + 0x27c], 0xa
mov dword [esp + 0x1c], 0x8e5ccc90
mov dword [esp + 0x54], 0xff8ee1d1
mov dword [esp + 0x14], ebx
jmp 0x1001c960
cmp dword [esp + 0x14], 4
jl 0x1001c94a
mov dword [esp + 0x1c], 0x5d16df25
mov dword [esp + 0x14], 0x42573927
push 2
mov dword [esp + 0x34], 0xb6b7be2d
mov dword [esp + 0x20], ebx
pop edi
jmp 0x1001cb23
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x64], 0x36ccb036
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x1001cb13
mov dword [esp + 0x1c], 0x24a8c6a5
mov dword [esp + 0x1c], 0x13
cmp dword [esp + 0x1c], 9
jle 0x1001ce3d
mov ecx, dword [esp + 0x274]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret