Function at 0x10016a30
Capabilities:
Access peb ldr_data
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10086b03
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f8
push ebx
push esi
push edi
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0xd8]
push 3
mov dword [esp + 0xa4], edx
call fcn.10014bbc
xor ebx, ebx
mov dword [esp + 0x20c], ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0xb90f9986
mov dword [esp + 0x20], 0xdc10
mov dword [esp + 0x18], ebx
jmp 0x10016aa6
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10016a90
mov edi, dword [esp + 0xd8]
xor eax, eax
xor ecx, ecx
inc ecx
push 0xffffffffffffffff
cmp dword [edi + 4], ecx
setg al
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0xdc]
add eax, dword [esi]
pop eax
je 0x10016b49
push dword [esp + 0x30]
movdqa xmm0, xmmword [0x10008c30]
lea eax, [esp + 0x1c8]
push eax
lea eax, [esp + 0x1bc]
mov dword [esp + 0x24], 0xbafc
push eax
push ebx
lea ecx, [esp + 0xa4]
mov dword [esp + 0xa4], ebx
movdqu xmmword [esp + 0x1c4], xmm0
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
call fcn.1001610b
mov eax, dword [edi + 4]
mov ecx, dword [esi + 8]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x94]
mov dword [eax + 0xc], ecx
lea ecx, [esp + 0x94]
call fcn.100153ad
jmp 0x10016c21
mov dword [esp + 0x1c], 0x7263b0a6
mov dword [esp + 0x28], 0x6a6c65b0
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 0xd
jne 0x10016b89
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10016b7b
push 0xb84
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xd
je 0x10016b64
or eax, 0xffffffff
mov dword [esp + 0xc], 0x15
jmp 0x10016c16
mov dword [esp + 0x14], eax
xor edx, edx
mov dword [esp + 0x18], 0x653e3f36
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setg dl
imul edx, dword [esp + 0x1c]
test edx, edx
je 0x10016bc7
cmp dword [esp + 0x1c], ebx
je 0x10016bc7
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x10016bcc
xor ecx, ecx
mov eax, ebx
inc ecx
cmp dword [esp + 0xc], eax
je 0x10016bd8
cmp dword [esp + 0x28], ebx
jne 0x10016bda
mov ecx, ebx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
add ecx, dword [edi + 4]
mov dword [esp + 0x18], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10016c0f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
dec dword [esp + 0xc]
push 0xffffffffffffffff
pop eax
cmp dword [esp + 0xc], 0xffffffe2
jg 0x10016b96
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10016c3d
push ebx
push 0x19e6
push 0x1e23
push ebx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
or esi, 0xffffffff
lea ecx, [esp + 0xd8]
mov dword [esp + 0x20c], esi
call fcn.100153ad
mov dword [esp + 0xc], esi
push 3
mov dword [esp + 0x18], 0xda0e60f9
mov dword [esp + 0x1c], ebx
pop esi
jmp 0x10016c78
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x64], 0xdd688769
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10016c68
xor edx, edx
inc edx
mov dword [esp + 0xc], edx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], 2
push 0xfffffffffffffff6
pop edi
cmp dword [esp + 0xc], ebx
jl 0x10016d39
mov dword [esp + 0x1c], 6
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x64]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x64]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x64]
mov eax, dword [esp + 0xc]
cmp ecx, dword [esp + eax*4 + 0x64]
jle 0x10016cd2
cmp dword [esp + 0x14], ebx
jne 0x10016cd4
mov edx, ebx
mov eax, dword [esp + 0xc]
xor ecx, ecx
push 1
mov eax, dword [esp + eax*4 + 0x68]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
cmp eax, edx
mov eax, 0xffff
setne cl
xor edx, edx
sub eax, ecx
imul eax, eax, 6
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + eax*4 + 0x68]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x18]
sete dl
xor ecx, ecx
cmp edx, eax
pop edx
setg cl
xor eax, eax
cmp ecx, 0x57736d0c
setge al
cmp edi, eax
sbb eax, eax
neg eax
mov dword [esp + 0x6c], eax
dec dword [esp + 0xc]
jns 0x10016ca2
mov dword [esp + 0xc], edx
mov dword [esp + 0xc], ebx
jmp 0x10016dbc
mov dword [esp + 0x18], 0x6748f69f
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0xb457102d
mov dword [esp + 0x18], 0xfffffff3
cmp dword [esp + 0x18], 0x16
jne 0x10016db8
push esi
lea ecx, [esp + 0x148]
call fcn.10014bbc
mov dword [esp + 0x24], ebx
jmp 0x10016d8b
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x10016d79
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x144]
mov dword [eax], ecx
lea ecx, [esp + 0x144]
call fcn.100153ad
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x16
je 0x10016d66
xor edx, edx
inc edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x19
jne 0x10016d43
push 2
lea ecx, [esp + 0x100]
call fcn.10014bbc
xor ecx, ecx
mov eax, 0xf05f4326
inc ecx
mov dword [esp + 0x20c], ecx
mov dword [esp + 0xc], 0xb26bdde0
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 2
jle 0x10016e79
xor esi, esi
inc esi
mov dword [esp + 0x20], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10016e28
push ebx
call dword [sym.imp.USER32.dll_DestroyCursor]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10016e4e
push 0x1f58
push 0x16ea
push 0xd76
push 0x2539
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esp + 0x20], 0xb6fd
lea ecx, [esp + 0x114]
push esi
call fcn.10014bbc
or esi, 0xffffffff
xor edx, edx
mov dword [esp + 0xc], esi
inc edx
mov dword [esp + 0x18], ebx
jmp 0x10016f57
xor ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x14], 0x88cd
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10016eae
push ebx
push ebx
push 0x174f
push ebx
push 0x19f1
push ebx
push 0x1246
push 0x142f
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0xc]
cmp eax, 0x7a329ef
mov eax, dword [esp + 0xc]
setge cl
xor edx, edx
cmp ecx, 0xfffffffd
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0xc]
je 0x10016ee6
cmp dword [esp + 0xc], ebx
je 0x10016ee6
xor esi, esi
inc esi
mov ecx, esi
jmp 0x10016eeb
xor esi, esi
mov ecx, ebx
inc esi
mov eax, dword [esp + 0xc]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x164], ecx
xor ecx, ecx
mov eax, dword [esp + 0xc]
cmp eax, esi
mov eax, dword [esp + 0x1c]
setg cl
xor edx, edx
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp edx, eax
setne cl
mov dword [esp + 0x14], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x10016e76
jmp 0x10016e12
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10016f45
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0xc], ebx
jmp 0x10016fe8
mov dword [esp + 0x24], 7
mov dword [esp + 0x24], ebx
jmp 0x10016fde
mov dword [esp + 0x20], esi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10016f8f
call edi
push eax
call dword [sym.imp.USER32.dll_IsZoomed]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x114]
cmp dword [ecx + eax*4], ebx
je 0x10016fa5
cmp dword [ecx], ebx
jne 0x10016fe4
jmp 0x10016fda
mov dword [esp + 0x18], ebx
jmp 0x10016fb7
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x3c], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10016fab
mov dword [esp + 0x40], ebx
jmp 0x10016fd4
mov dword [esp + 0x1c], 0xb9dbea52
inc dword [esp + 0x1c]
inc dword [esp + 0x40]
cmp dword [esp + 0x40], ebx
jle 0x10016fc4
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jle 0x10016f77
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x10016f69
mov dword [esp + 0xc], ebx
jmp 0x1001700c
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x114]
mov eax, dword [ecx + eax*4]
mov dword [ecx], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x10016ff8
lea ecx, [esp + 0x114]
call fcn.100153ad
mov dword [esp + 0xa8], 0xfffc
lea ecx, [esp + 0x120]
mov dword [esp + 0x20], 0xc5530c4e
mov dword [esp + 0x14], 6
mov dword [esp + 0x1c], 8
mov dword [esp + 0x28], 0x534d
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], ebx
push 2
call fcn.10014bbc
push 2
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1001707b
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x18c], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10017068
xor esi, esi
mov dword [esp + 0xc], ebx
inc esi
cmp dword [esp + 0xc], edx
jge 0x100170a2
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], esi
inc dword [esp + 0xc]
jmp 0x10017088
cmp dword [esp + 0x14], ebx
jne 0x100170bc
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18c]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], ebx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x120]
mov dword [eax], ecx
lea ecx, [esp + 0x120]
call fcn.100153ad
mov dword [esp + 0x20], 7
mov dword [esp + 0x14], 0xfff8
mov dword [esp + 0x18], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], 0xfffffffd
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub edx, 0xd8cb
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, 0x5425
setl cl
sub edx, ecx
mov dword [esp + 0x18], edx
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
imul ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x28]
je 0x100171da
mov dword [esp + 0x1c], 9
xor edx, edx
mov dword [esp + 0x14], 0x34859bb
mov dword [esp + 0x24], esi
mov dword [esp + 0xc], 0xc0e07525
mov eax, dword [esp + 0x28]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setle dl
xor ecx, ecx
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
cmp eax, 0x223b
setl cl
xor eax, eax
cmp ecx, 0x9b3a
setl al
sub eax, dword [esp + 0x28]
cmp esi, eax
mov eax, dword [esp + 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x24], ecx
jmp 0x100171ff
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100171ff
push 0x13d4
push 0x6b9
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push dword [esp + 0x30]
movdqa xmm0, xmmword [0x10008b60]
lea ecx, [esp + 0x74]
mov eax, 0x9f4f9a02
mov dword [esp + 0x1c], 0x21b07fb0
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
lea eax, [esp + 0x1a8]
push eax
lea eax, [esp + 0x19c]
mov dword [esp + 0x14], 0xffff
push eax
push ebx
movdqu xmmword [esp + 0x1a4], xmm0
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
call fcn.1001610b
mov byte [esp + 0x20c], 2
dec dword [esp + 0xc]
mov eax, dword [esp + 0xc]
neg eax
cmp dword [esp + 0xc], eax
je 0x1001735a
push 3
pop esi
mov dword [esp + 0x1c], 0x2d2c87a7
lea ecx, [esp + 0x138]
mov dword [esp + 0x20], 0x90ae73
push esi
call fcn.10014bbc
mov dword [esp + 0x18], ebx
jmp 0x100172c0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x100172aa
mov dword [esp + 0xc], ebx
jmp 0x100172ea
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x70]
cmp dword [eax + ecx*4], ebx
jne 0x100172f0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x70]
cmp dword [eax + ecx*4], ebx
jne 0x100172f0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x100172cc
mov dword [esp + 0xc], 0x17
jmp 0x10017345
mov dword [esp + 0x18], 0x3c0bf90a
mov dword [esp + 0x18], ebx
jmp 0x1001733b
mov dword [esp + 0x14], 0xec134886
mov edx, dword [esp + 0x14]
dec edx
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [esp + 0x138]
setle cl
mov dword [eax], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x10017308
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x1e
jl 0x100172fa
lea ecx, [esp + 0x138]
call fcn.100153ad
jmp 0x10017378
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017378
push 0x1862
push 0x22c6
call edi
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
xor eax, eax
lea ecx, [esp + 0x70]
inc eax
mov byte [esp + 0x20c], al
call fcn.100153ad
mov dword [esp + 0xa4], ebx
xor edx, edx
inc edx
or esi, 0xffffffff
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], 0x6e3245f1
mov dword [esp + 0x24], 0x1e2c0d37
push 4
mov dword [esp + 0x2c], esi
pop ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], ebx
jmp 0x100173cc
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xb8], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x100173bd
push 3
pop ecx
mov dword [esp + 0x14], ecx
jmp 0x100174b3
mov dword [esp + 0xc], 0xfbc781ce
inc dword [esp + 0xc]
mov dword [esp + 0xc], ebx
jmp 0x100174a5
mov dword [esp + 0x2c], 0x35b68906
mov dword [esp + 0x24], ebx
jmp 0x10017497
mov dword [esp + 0x28], ebx
jmp 0x10017489
mov dword [esp + 0x18], ebx
jmp 0x10017420
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x54], 0x388a0193
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10017410
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
jl 0x10017485
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0xb8]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + eax*4 + 0xb8]
cmp eax, dword [esp + 0x54]
jl 0x10017453
mov eax, dword [esp + 0xb8]
mov eax, dword [esp + 0x54]
imul eax, dword [esp + 0x2c]
cmp esi, eax
mov eax, dword [esp + 0x24]
sbb ecx, ecx
neg ecx
mov dword [esp + eax*4 + 0xb8], ecx
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xb8], 0xfffffff6
dec dword [esp + 0x18]
jns 0x10017430
push 3
pop ecx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ecx
jle 0x1001740a
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jle 0x10017404
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jle 0x100173f3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1d
jge 0x100173de
mov eax, dword [esp + 0xb8]
mov ecx, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x24], ecx
dec dword [esp + 0x1c]
mov dword [esp + 0xc], ebx
jmp 0x100174ef
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x100174d9
mov dword [esp + 0xc], 0xfffffffe
lea ecx, [esp + 0xac]
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 8
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0xba5b0420
mov dword [esp + 0x20], esi
push edx
call fcn.10014bbc
mov eax, 0x4a04
xor edx, edx
mov dword [esp + 0xc8], eax
inc edx
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0x2c], 0xe948eca1
mov dword [esp + 0x1c], 0x13644cad
mov dword [esp + 0x1c], 0xffff
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], 0x97e54b53
mov dword [esp + 0x14], ebx
jmp 0x10017587
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10017575
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0xc]
je 0x1001759f
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
xor edx, edx
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp dword [esp + 0xc], ecx
jl 0x10017655
cmp dword [esp + 0xc], ebx
je 0x10017655
mov dword [esp + 0x14], 0xade0
mov eax, 0x2e3ca369
mov dword [esp + 0x14], 0x5f7919ad
mov dword [esp + 0x14], 0x2f3d4794
mov dword [esp + 0x14], esi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x14], 0x19c2
mov dword [esp + 0x14], 0xc14c38d6
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 4
jle 0x100176a9
xor eax, eax
inc eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 0xd3380ee9
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], eax
dec dword [esp + 0x14]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jg 0x10017620
jmp 0x100176a9
mov dword [esp + 0x14], 0xe07df7dc
mov dword [esp + 0x14], 0xb011
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov dword [esp + 0xc], ebx
jmp 0x100176a3
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001768d
push ebx
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], 0xec53312a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x1001767b
inc dword [esp + 0x1c]
mov esi, dword [esp + 0xd4]
mov eax, dword [esp + 0x2c]
neg esi
sbb esi, esi
neg esi
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x680eded6
mov eax, dword [esp + 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp dword [esp + 0xcc], ecx
jne 0x100176f3
mov eax, dword [esp + 0xac]
cmp dword [eax], ebx
je 0x100176f3
xor ecx, ecx
inc ecx
mov eax, ecx
jmp 0x100176f8
xor ecx, ecx
mov eax, ebx
inc ecx
mov dword [esp + 0x2c], eax
mov eax, esi
shl eax, 2
test eax, eax
jne 0x1001770d
mov edx, ebx
cmp dword [esp + 0x1c], ebx
je 0x1001770f
mov edx, ecx
mov eax, dword [esp + 0xcc]
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0xc]
imul eax, eax, 0x2184bcfa
sub eax, dword [esp + 0x18]
cmp eax, 0xfffffffd
setle cl
add ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xac]
mov dword [eax], ecx
lea ecx, [esp + 0xac]
call fcn.100153ad
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 2
jge 0x10017780
xor esi, esi
inc esi
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1d0], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001776a
push 3
pop esi
push esi
lea ecx, [esp + 0x80]
call fcn.10014bbc
mov dword [esp + 0xc], ebx
jmp 0x100177a5
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1c4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10017796
mov dword [esp + 0xc], ebx
jmp 0x100177c0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x100177b1
mov eax, dword [esp + 0x7c]
mov dword [eax], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100177e8
push 0x506
push 0x2530
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
mov eax, dword [esp + 0x7c]
mov eax, dword [eax]
mov eax, dword [esp + eax*4 + 0x1c4]
mov eax, dword [esp + 0x7c]
inc dword [eax]
cmp dword [eax], 2
jle 0x100177cc
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017815
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
lea ecx, [esp + 0x7c]
call fcn.100153ad
mov dword [esp + 0xc], ebx
jmp 0x10017837
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1f0], 0xfffffffe
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10017824
mov dword [esp + 0x20], 0xdde0bcd8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017867
push 0x1c81
push 0x15
push 0xc34
call edi
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001787c
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov eax, dword [esp + 0xfc]
cmp dword [eax], ebx
je 0x10017a70
push esi
lea ecx, [esp + 0x130]
call fcn.10014bbc
push 0xfffffffffffffffa
mov dword [esp + 0x1c], 4
mov dword [esp + 0x18], ebx
pop edi
jmp 0x100178bb
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100178a9
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100178d6
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x10017921
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x1001791b
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x12c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x14]
jns 0x100178f9
xor eax, eax
inc eax
dec dword [esp + 0x18]
jns 0x100178e7
lea ecx, [esp + 0x12c]
call fcn.100153ad
push dword [esp + 0x30]
movdqa xmm0, xmmword [0x10008bf0]
lea eax, [esp + 0x1b8]
push eax
lea eax, [esp + 0x1ac]
mov dword [esp + 0x28], ebx
push eax
push ebx
lea ecx, [esp + 0x100]
mov dword [esp + 0x100], ebx
movdqu xmmword [esp + 0x1b4], xmm0
mov dword [esp + 0x104], ebx
mov dword [esp + 0x108], ebx
call fcn.1001610b
push 3
mov dword [esp + 0x2c], edi
or esi, 0xffffffff
mov dword [esp + 0x2c], ebx
pop ecx
cmp dword [esp + 0x28], ecx
jg 0x10017a4d
mov dword [esp + 0x14], 0x532bb11a
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0x131d8b9d
mov dword [esp + 0x20], 0x2c9ebf49
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ecx
jge 0x100179d9
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1e4], 0xee4c20f7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x100179bd
xor eax, eax
inc eax
mov dword [esp + 0x14], ebx
jmp 0x10017a3e
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x20], 0xda2ae7b7
mov dword [esp + 0x20], 0xfffffffe
mov dword [esp + 0x20], 0x58382bdb
mov dword [esp + 0x20], 0x6718e503
mov dword [esp + 0x20], 0x2487223b
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 9
inc dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x14]
push 1
pop eax
cmp dword [esp + 0x14], ecx
jle 0x100179df
inc dword [esp + 0x28]
jmp 0x10017986
lea ecx, [esp + 0xf0]
call fcn.100153ad
mov eax, dword [esp + 0xfc]
xor ecx, ecx
cmp dword [eax], ebx
setne cl
mov dword [esp + 0x20], ecx
jmp 0x10017e8f
push 4
lea ecx, [esp + 0x10c]
call fcn.10014bbc
mov dword [esp + 0x20], 0xc99cdf9c
xor edx, edx
mov dword [esp + 0x20], 0xdf11bbb4
inc edx
mov dword [esp + 0x20], 0xc75d
mov dword [esp + 0x20], 0xff74
mov dword [esp + 0x1c], 0x4ddb
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], 4
jge 0x10017ac8
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], edx
inc dword [esp + 0xc]
jmp 0x10017aad
mov dword [esp + 0xc], ebx
jmp 0x10017add
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1d8], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10017ace
mov eax, dword [esp + 0x108]
mov dword [eax + 8], 0xfffffffd
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x1c]
test eax, eax
jne 0x10017b01
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x108]
lea ecx, [esp + 0x108]
mov dword [eax + 4], ebx
call fcn.100153ad
mov dword [esp + 0x20], 0xa07e4fc2
lea ecx, [esp + 0x178]
mov dword [esp + 0x20], 0xe30f5872
mov dword [esp + 0x24], 0xe2db
push 2
call fcn.10014bbc
mov dword [esp + 0x14], ebx
jmp 0x10017b59
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0xe57a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10017b43
inc dword [esp + 0x24]
xor eax, eax
mov dword [esp + 0x24], ebx
inc eax
jmp 0x10017b8a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017b86
push 0xc11
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
inc eax
inc dword [esp + 0x24]
cmp dword [esp + 0x24], eax
jle 0x10017b6d
lea ecx, [esp + 0x178]
call fcn.100153ad
mov dword [esp + 0x20], 9
mov dword [esp + 0x20], 0x5fe46c2e
mov dword [esp + 0x20], 0x10c13fe6
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], 0xdac842f8
mov dword [esp + 0x18], 0x3f3ac9d7
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0xc]
je 0x10017be7
cmp dword [esp + 0xc], ebx
jne 0x10017be7
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x10017bec
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
je 0x10017c0e
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
add eax, dword [esp + 0xc]
js 0x10017c2e
mov eax, ebx
cmp dword [esp + 0x18], ebx
je 0x10017c30
mov eax, edx
imul eax, eax, 0x9744
xor ecx, ecx
cmp eax, 0xb94be3d0
setne cl
cmp ecx, 8
sbb eax, eax
neg eax
sub eax, 6
je 0x10017d13
mov dword [esp + 0x24], 0xf4c6f444
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017c7e
push ebx
push 0x1434
push 0x126d
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov esi, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
neg esi
sbb esi, esi
xor ecx, ecx
sub eax, 8
neg esi
cmp ecx, eax
mov eax, dword [esp + 0x24]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
setg cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
cmp dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
setg cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
cmp esi, ecx
jne 0x10017cdc
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
xor esi, esi
xor edx, edx
inc esi
cmp eax, esi
mov eax, dword [esp + 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x24]
setle cl
sub eax, ecx
je 0x10017d08
cmp dword [esp + 0x24], ebx
je 0x10017d08
xor eax, eax
inc eax
jmp 0x10017d0a
mov eax, ebx
push 3
mov dword [esp + 0x18], eax
pop esi
jmp 0x10017d4e
mov dword [esp + 0x20], 0x2ea9177c
mov dword [esp + 0x14], ebx
jmp 0x10017d34
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x184], 0xf0d22965
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10017d21
mov dword [esp + 0x20], 0x5f9ba4ae
mov eax, dword [esp + 0xc]
mov dword [esp + 0x184], eax
push esi
lea ecx, [esp + 0x170]
call fcn.10014bbc
push 3
pop edx
mov byte [esp + 0x20c], dl
mov dword [esp + 0x14], ebx
jmp 0x10017d7d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10017d6b
or esi, 0xffffffff
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0xda0e60f9
mov dword [esp + 0x14], ebx
jmp 0x10017da8
cmp dword [esp + 0x14], edx
jl 0x10017d98
lea eax, [esp + 0xa4]
push eax
push ebx
call fcn.1001acce
pop ecx
pop ecx
push 2
lea ecx, [esp + 0x154]
call fcn.10014bbc
xor edx, edx
mov byte [esp + 0x20c], 4
mov dword [esp + 0xc], ebx
inc edx
cmp dword [esp + 0xc], 3
jge 0x10017ed4
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x88], edx
inc dword [esp + 0xc]
jmp 0x10017ebc
mov dword [esp + 0xc], ebx
jmp 0x10017ef0
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0xa86ba47c
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10017eda
mov dword [esp + 0x8c], 0x1c
jmp 0x10018014
push edx
lea ecx, [esp + 0xe8]
call fcn.10014bbc
xor edx, edx
mov dword [esp + 0xc], ebx
inc edx
jmp 0x10017f33
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0x683c8fc5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10017f1d
mov dword [esp + 0xc], ebx
jmp 0x10017f4f
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x34], 8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x10017f3f
mov dword [esp + 0x34], ebx
cmp dword [esp + 0x34], ebx
jl 0x10017ffe
mov dword [esp + 0x14], 8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10017f94
push ebx
push 0x23c0
push 0xe01
push ebx
push 0x5fb
push 0x268d
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esp + 0x14], ebx
jmp 0x10017fee
mov eax, dword [esp + 0x34]
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0xe4]
mov eax, dword [ecx + eax*4]
cmp eax, dword [ecx + edx*4]
jle 0x10017fbc
cmp dword [esp + 0x14], ebx
jle 0x10017f9a
dec dword [esp + 0x34]
jns 0x10017f64
lea ecx, [esp + 0xe4]
call fcn.100153ad
dec dword [esp + 0x8c]
xor edx, edx
inc edx
cmp dword [esp + 0x8c], edx
je 0x10017f07
lea ecx, [esp + 0x150]
call fcn.100153ad
lea ecx, [esp + 0xfc]
mov dword [esp + 0x20c], esi
call fcn.100153ad
mov eax, dword [esp + 0xa0]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x30]
mov esi, edx
mov edi, eax
call fcn.100169be
mov ecx, dword [esp + 0x204]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret