Function at 0x10019f1b
Capabilities:
Get geographical location
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100873e5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f8
push ebx
push esi
push edi
mov dword [esp + 0x80], ecx
lea ecx, [esp + 0x128]
push 2
mov dword [esp + 0x8c], edx
call fcn.100180d9
xor ebx, ebx
lea ecx, [esp + 0xf8]
push 3
mov dword [esp + 0x210], ebx
call fcn.100180d9
push 2
mov dword [esp + 0x18], ebx
pop edx
jmp 0x10019f91
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0xe60
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10019f7b
mov dword [esp + 0x14], ebx
jmp 0x10019fb3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x96bc97de
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019f9d
mov esi, dword [esp + 0x128]
xor eax, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov ecx, dword [esi + 4]
test ecx, ecx
setne al
imul ecx, eax
test ecx, ecx
je 0x1001a072
mov dword [esp + 0x28], 0xfffffff7
mov dword [esp + 0x18], 0x556123d4
mov dword [esp + 0x20], ebx
jmp 0x1001a005
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1d4], 0x9339b884
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x10019ff2
mov eax, dword [esp + 0x28]
xor edx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, 0x7c39c9d9
setne dl
xor ecx, ecx
imul edx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, 1
setge cl
add edx, ecx
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x2c], edx
xor edx, edx
cmp dword [esp + 0x2c], eax
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x1e0], ecx
jmp 0x1001a145
mov dword [esp + 0x14], 0x3c94681c
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0x20], ebx
jmp 0x1001a098
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x54], 0xc23782ec
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1001a088
xor ecx, ecx
mov dword [esp + 0x54], ebx
inc ecx
jmp 0x1001a13b
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], ebx
jl 0x1001a137
cmp dword [esp + 0x28], ebx
jne 0x1001a0da
mov eax, dword [esp + 0x28]
sub eax, 0xbde6
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x28]
jne 0x1001a0da
mov eax, ebx
cmp dword [esp + 0x14], ebx
je 0x1001a0dc
mov eax, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], ebx
jmp 0x1001a12b
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], ebx
jl 0x1001a127
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], ebx
jmp 0x1001a11b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001a117
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
xor ecx, ecx
inc ecx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jle 0x1001a0fa
dec dword [esp + 0x24]
jns 0x1001a0f0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jle 0x1001a0e6
dec dword [esp + 0x28]
jns 0x1001a0b8
inc dword [esp + 0x54]
cmp dword [esp + 0x54], ecx
jle 0x1001a0aa
mov eax, dword [esp + 0xf8]
mov ecx, dword [esi + 4]
mov dword [eax + 4], ecx
lea ecx, [esp + 0xf8]
call fcn.100188f6
or dword [esp + 0x20c], 0xffffffff
lea ecx, [esp + 0x128]
call fcn.100188f6
mov dword [esp + 0x14], 0x5baf43b7
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001a18a
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xffffffffffffffe4
pop esi
cmp dword [esp + 0x14], ebx
je 0x1001a1bb
mov dword [esp + 0x14], esi
jmp 0x1001a1b2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001a1ae
push 0x59f
call dword [sym.imp.USER32.dll_PostQuitMessage]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xa
jge 0x1001a199
jmp 0x1001a1e3
mov dword [esp + 0x14], ebx
jmp 0x1001a1dc
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001a1d8
push ebx
push 0xd03
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x1d
jl 0x1001a1c1
mov dword [esp + 0x24], 0xa624cdb
mov dword [esp + 0x14], 0xfffffff8
mov dword [esp + 0x28], 8
mov dword [esp + 0x1c], 1
push 9
mov dword [esp + 0x1c], 5
mov dword [esp + 0x2c], ebx
pop ecx
jmp 0x1001a22c
mov dword [esp + 0x38], 0x905d
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
inc dword [esp + 0x28]
cmp dword [esp + 0x28], ecx
jge 0x1001a214
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x1c], 0x19
jge 0x1001a3bd
push 9
pop edi
push 4
lea ecx, [esp + 0xa4]
call fcn.100180d9
push 4
mov dword [esp + 0x34], 0xe2138b36
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001a279
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xa0]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001a263
xor ecx, ecx
mov dword [esp + 0x14], ebx
inc ecx
jmp 0x1001a297
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x94], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001a288
mov esi, dword [esp + 0xa0]
cmp dword [esi + 0xc], ebx
jne 0x1001a356
mov eax, dword [esp + 0x28]
xor edx, edx
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
add ecx, edi
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setge cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x2c]
setge cl
xor eax, eax
cmp ecx, 0xd711
setg al
imul eax, dword [esp + 0x28]
cmp eax, dword [esi + 0xc]
jge 0x1001a302
cmp dword [esp + 0x28], ebx
je 0x1001a302
xor edx, edx
inc edx
jmp 0x1001a304
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, dword [esi + 0xc]
setl al
xor edx, edx
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x2c], eax
mov eax, dword [esp + 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0xffffffff
sbb edx, edx
xor ecx, ecx
neg edx
add edx, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setne cl
cmp dword [esi + 0xc], ecx
jg 0x1001a352
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
xor edx, edx
add ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0xa0]
setl dl
sub edx, 0x85e1
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x2c], edx
xor edx, edx
mov ecx, dword [esp + 0x2c]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x94], ecx
lea ecx, [esp + 0xa0]
call fcn.100188f6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x19
jl 0x1001a244
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0xfffffffffffffff6
mov dword [esp + 0x1c], 1
pop esi
mov dword [esp + 0x34], esi
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001a3e5
push 0x1bb0
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001a3fa
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x188]
push 1
call fcn.100180d9
xor edx, edx
mov dword [esp + 0x20], 0xf833fcb5
mov dword [esp + 0x20], ebx
inc edx
jmp 0x1001a42f
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x188]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1001a41d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001a445
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x1001a46a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001a464
push 0x80c
call dword [sym.imp.KERNEL32.dll_Sleep]
dec dword [esp + 0x20]
jns 0x1001a44f
lea ecx, [esp + 0x188]
call fcn.100188f6
push 1
lea ecx, [esp + 0x138]
call fcn.100180d9
mov dword [esp + 0x20c], 1
mov dword [esp + 0x20], 0xd5e48d32
mov dword [esp + 0x20], esi
jmp 0x1001a561
push 1
lea ecx, [esp + 0x114]
call fcn.100180d9
mov byte [esp + 0x20c], 2
lea ecx, [esp + 0x160]
mov dword [esp + 0x34], 0x551b32e2
push 3
call fcn.100180d9
xor edx, edx
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x1001a4eb
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0x665683c8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001a4d5
mov dword [esp + 0x1c], ebx
jmp 0x1001a50a
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x98], 0x7b8f5f49
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001a4f7
mov dword [esp + 0x1c], ebx
jmp 0x1001a529
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x160]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001a516
mov eax, dword [esp + 0x110]
lea ecx, [esp + 0x160]
mov dword [eax], 0xd
call fcn.100188f6
lea ecx, [esp + 0x110]
mov byte [esp + 0x20c], 1
call fcn.100188f6
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff1
jge 0x1001a4a0
push dword [esp + 0x98]
movdqa xmm0, xmmword [0x10007c50]
lea ecx, [esp + 0x60]
mov dword [esp + 0x2c], 0x9cfe0482
mov eax, 0x6f9b6917
mov dword [esp + 0x34], 0xdca8fecf
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0xd4], eax
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
lea eax, [esp + 0x1b8]
push eax
lea eax, [esp + 0x1ac]
mov dword [esp + 0x64], ebx
push eax
push ebx
movdqu xmmword [esp + 0x1b4], xmm0
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
call fcn.1001963b
mov eax, dword [esp + 0x5c]
mov dword [esp + 0x1c], 2
mov dword [esp + 0x14], 0x580
mov dword [esp + 0x34], 0xd1cc0c7f
mov esi, dword [eax]
mov dword [esp + 0x34], 6
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x5c]
lea ecx, [esi + 1]
mov dword [eax], ecx
cmp esi, edx
jle 0x1001a62b
xor edx, edx
inc edx
jmp 0x1001a62d
mov edx, ebx
mov eax, dword [esp + 0xd4]
xor ecx, ecx
mov eax, dword [esp + 0xd4]
inc ecx
sub ecx, eax
mov dword [esp + 0x38], ecx
xor ecx, ecx
mov eax, dword [esp + 0x38]
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x20]
jne 0x1001a65f
cmp dword [esp + 0x30], ebx
jne 0x1001a65f
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edx, dword [esp + 0x1c]
add edx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, edx
setl cl
xor edx, edx
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
cmp ecx, eax
setge dl
mov dword [esp + 0x38], edx
mov dword [esp + 0x28], 0xe
jmp 0x1001a6b5
mov dword [esp + 0x30], 1
inc dword [esp + 0x30]
cmp dword [esp + 0x34], ebx
jne 0x1001a6bc
dec dword [esp + 0x28]
cmp dword [esp + 0x28], 0xfffffffc
jl 0x1001a69f
lea ecx, [esp + 0x5c]
call fcn.100188f6
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
cmp dword [esp + 0x14], 2
jge 0x1001a6e4
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x8c], edx
inc dword [esp + 0x14]
jmp 0x1001a6cc
mov dword [esp + 0x14], ebx
jmp 0x1001a700
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001a6ea
mov dword [esp + 0x34], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], 0x13dce9d0
mov dword [esp + 0x34], 2
mov dword [esp + 0x34], 0x72759951
mov dword [esp + 0x34], edx
push 3
mov dword [esp + 0x34], 0x992f1e5c
mov dword [esp + 0x24], ebx
pop esi
jmp 0x1001a74e
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1e4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x1001a73b
inc dword [esp + 0x30]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a76d
push ebx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
xor edx, edx
inc edx
inc dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
neg eax
sbb eax, eax
add eax, 0xffffc643
neg eax
sbb eax, eax
inc eax
add eax, 6
je 0x1001b1f0
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0xe0]
mov dword [esp + 0x20], 0xb029
mov dword [esp + 0x30], 0xfffffffa
mov dword [esp + 0x30], 0xafa9b64f
mov dword [esp + 0x30], 0xffffffff
push esi
call fcn.100180d9
mov dword [esp + 0x24], ebx
jmp 0x1001a7e2
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0xec], 8
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x1001a7cf
mov dword [esp + 0x24], ebx
jmp 0x1001a804
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], 0xe34edf6b
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x1001a7ee
cmp dword [esp + 0x20], ebx
jne 0x1001a868
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
cmp eax, 1
setge cl
xor edx, edx
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xec]
imul eax, dword [esp + 0xf4]
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
cmp eax, ecx
setle dl
imul edx, dword [esp + 0x20]
test edx, edx
je 0x1001a864
cmp dword [esp + 0xec], ebx
jne 0x1001a868
mov ecx, ebx
jmp 0x1001a86b
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0xe0]
mov dword [eax + 4], ecx
lea ecx, [esp + 0xe0]
call fcn.100188f6
mov dword [esp + 0x20], ebx
jmp 0x1001a89a
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x158], 0xcd7820ea
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1001a887
mov dword [esp + 0x24], 0x15
jmp 0x1001b0cf
push 1
lea ecx, [esp + 0x170]
call fcn.100180d9
xor edx, edx
mov dword [esp + 0x18], 0x3c7730f9
mov dword [esp + 0x20], ebx
inc edx
jmp 0x1001a8e0
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x16c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x1001a8cd
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a8fa
call edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x1001a923
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a91d
push 0x71d
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
dec dword [esp + 0x18]
jns 0x1001a904
lea ecx, [esp + 0x16c]
call fcn.100188f6
mov dword [esp + 0x20], 0xe64f
mov dword [esp + 0x18], 0xa61928c1
mov dword [esp + 0x18], ebx
jmp 0x1001aa2f
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x1001a969
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1f0], 0xc70c3099
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001a956
mov dword [esp + 0x1c], ebx
jmp 0x1001aa21
push 1
lea ecx, [esp + 0xbc]
call fcn.100180d9
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x1001a9a2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001a990
mov eax, dword [esp + 0xb8]
mov dword [eax], ebx
mov dword [esp + 0x34], 0x310fecaf
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a9e0
push 0xd08
push ebx
push 0x1b8c
push ebx
push 0x790
push 0x1cf8
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x34], 0x938dd44a
inc dword [eax]
cmp dword [eax], esi
jle 0x1001a9b1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001aa11
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFocusRect]
lea ecx, [esp + 0xb8]
call fcn.100188f6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jle 0x1001a979
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x18
jle 0x1001a948
push 1
lea ecx, [esp + 0xb0]
call fcn.100180d9
mov byte [esp + 0x20c], 4
lea ecx, [esp + 0x74]
mov dword [esp + 0x14], 0xa48bbca6
push 1
call fcn.100180d9
mov dword [esp + 0x38], 0xb839bf5b
xor edx, edx
mov dword [esp + 0x18], 0xf51885a1
inc edx
mov dword [esp + 0x34], edx
mov dword [esp + 0x18], ebx
jmp 0x1001aa93
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], 0x3ed23c5a
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001aa80
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0xb
jne 0x1001abef
push 9
pop edi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x2c], 0x898cbdb6
mov dword [esp + 0x30], edx
mov dword [esp + 0x30], 0xde905f4d
mov dword [esp + 0x18], ebx
jmp 0x1001aae5
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x40], 0x706b3799
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001aad5
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x40], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
je 0x1001ab28
cmp dword [esp + 0x14], ebx
jne 0x1001ab2a
mov edx, ebx
cmp edi, edx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setle dl
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x74]
neg edx
sbb edx, edx
neg edx
mov dword [eax], edx
cmp edx, dword [esp + 0x1c]
jg 0x1001ab61
mov eax, dword [esp + 0x74]
cmp dword [eax], ebx
je 0x1001ab61
xor edx, edx
inc edx
jmp 0x1001ab63
mov edx, ebx
mov eax, dword [esp + 0x2c]
xor ecx, ecx
cmp edx, eax
mov eax, 0xfaa9634d
push 1
setg cl
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x34]
sub ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setl dl
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xffbe6269
setne al
xor edx, edx
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x30]
cmp ecx, eax
setne dl
xor ecx, ecx
cmp edx, 1
pop edx
setg cl
xor eax, eax
cmp ecx, 0x1f205951
setl al
mov dword [esp + 0x18], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xb
je 0x1001aaab
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [esp + 0x74]
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x14]
test eax, eax
setg cl
imul ecx, dword [esp + 0x34]
test ecx, ecx
jne 0x1001ac11
cmp dword [esp + 0x14], ebx
jne 0x1001ac11
mov edx, ebx
mov dword [esp + 0x18], edx
xor edx, edx
imul ecx, dword [esp + 0x18], 0x7a64
mov eax, dword [esp + 0x38]
cmp ecx, eax
mov eax, dword [esp + 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x74]
call fcn.100188f6
push 0x3372
push 0x6e14
push 0x250d
push 0xcca
push ebx
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0xb4]
push eax
push 0xc32
call fcn.1001d6d8
add esp, 0x20
mov dword [esp + 0x68], ebx
lea eax, [esp + 0x1a4]
mov dword [esp + 0x6c], ebx
xorps xmm0, xmm0
mov dword [esp + 0x70], ebx
lea ecx, [esp + 0x68]
push dword [esp + 0x9c]
movdqu xmmword [esp + 0x198], xmm0
push eax
lea eax, [esp + 0x19c]
push eax
push ebx
call fcn.1001963b
mov eax, dword [esp + 0x68]
push 9
pop ecx
mov dword [eax], 7
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001acce
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnregisterClassA]
push 9
pop ecx
mov eax, dword [esp + 0x68]
inc dword [eax]
cmp dword [eax], ecx
jle 0x1001acb8
lea ecx, [esp + 0x68]
call fcn.100188f6
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xac]
push esi
mov dword [eax], ecx
lea ecx, [esp + 0xc8]
mov dword [esp + 0x18], 6
call fcn.100180d9
mov dword [esp + 0x30], 0x3281
mov dword [esp + 0x18], ebx
jmp 0x1001ad30
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001ad1d
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0x15
jl 0x1001ad90
mov edx, dword [esp + 0xc4]
xor ecx, ecx
inc ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], 0x407858f9
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], ebx
jmp 0x1001ad74
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x184], 0x7d65121a
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001ad61
mov eax, dword [esp + 0x34]
mov dword [edx + 4], eax
inc dword [esp + 0x2c]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x15
jge 0x1001ad4b
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0xc4]
mov dword [eax + 4], ecx
lea ecx, [esp + 0xc4]
call fcn.100188f6
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jg 0x1001b0b7
push 4
lea ecx, [esp + 0x108]
call fcn.100180d9
push 4
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x20], ebx
pop edx
jmp 0x1001ade7
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x44], 0x540d
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001add7
mov dword [esp + 0x1c], ebx
jmp 0x1001ae05
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001adf3
mov dword [esp + 0x1c], ebx
jmp 0x1001ae20
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x140], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001ae11
mov esi, dword [esp + 0x104]
mov dword [esi + 8], 3
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x1001ae59
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1c0], 7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x1001ae46
mov eax, dword [esi + 8]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esi + 8]
test eax, eax
je 0x1001ae79
cmp dword [esp + eax*4 + 0x44], ebx
je 0x1001ae79
xor edx, edx
inc edx
jmp 0x1001ae7b
mov edx, ebx
mov eax, dword [esi + 8]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x44]
cmp eax, edx
mov eax, dword [esi + 8]
setg cl
xor edx, edx
mov eax, dword [esp + eax*4 + 0x44]
cmp eax, ecx
mov eax, dword [esi + 8]
sete dl
mov dword [esp + 0x34], edx
xor edx, edx
mov eax, dword [esp + eax*4 + 0x44]
cmp dword [esp + 0x34], eax
mov eax, dword [esp + 0x48]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x148]
setne cl
xor edx, edx
cmp ecx, dword [esi + 8]
setle dl
sub edx, eax
je 0x1001aed6
cmp dword [esp + 0x140], ebx
jne 0x1001aed6
mov ecx, ebx
jmp 0x1001aed9
xor ecx, ecx
inc ecx
mov eax, dword [esi + 8]
cmp ecx, dword [esp + eax*4 + 0x44]
jge 0x1001aeec
cmp dword [esi + 8], ebx
je 0x1001aeec
xor edx, edx
inc edx
jmp 0x1001aeee
mov edx, ebx
mov eax, dword [esi + 8]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x44]
cmp edx, eax
mov eax, dword [esi + 8]
setge cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x44]
mov edx, dword [esp + 0x2c]
sub edx, eax
mov eax, dword [esi + 8]
mov dword [esp + 0x1c4], edx
mov eax, dword [esp + eax*4 + 0x44]
cmp eax, edx
setne cl
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x48]
mov eax, dword [esi + 8]
mov eax, dword [esp + eax*4 + 0x44]
xor eax, eax
cmp dword [esi + 8], 0xcb44
sete al
mov dword [esp + 0x34], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001af5d
push 0x104b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec dword [esi + 8]
jns 0x1001ae34
lea ecx, [esp + 0x104]
call fcn.100188f6
xor edx, edx
mov dword [esp + 0x38], 0x58aa
inc edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], ebx
jmp 0x1001af99
mov dword [esp + 0x2c], 0xd95e17ca
cmp dword [esp + 0x2c], ebx
jne 0x1001afa0
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe2
jl 0x1001af87
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x1c], 0x41e55969
mov dword [esp + 0x34], 7
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], edx
jge 0x1001afe2
push 9
pop ecx
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x84], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001afcd
mov dword [esp + 0x1c], ebx
jmp 0x1001affb
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x84], 0xf57a7c20
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001afe8
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], 0x8cbdb62b
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
cmp edx, eax
mov eax, dword [esp + 0x20]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [esp + 0x90]
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x90], ebx
je 0x1001b098
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov eax, dword [esp + 0x28]
inc ecx
mov eax, dword [esp + 0x90]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
jmp 0x1001b09a
mov ecx, ebx
or eax, 0xffffffff
sub eax, ecx
mov dword [esp + 0x158], eax
inc dword [esp + 0x14]
push 3
pop esi
cmp dword [esp + 0x14], ebx
jle 0x1001adb8
lea ecx, [esp + 0xac]
mov byte [esp + 0x20c], 1
call fcn.100188f6
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x36
jl 0x1001a8ae
mov dword [esp + 0x18], ebx
mov dword [esp + 0x34], 0x4f84b811
mov dword [esp + 0x18], ebx
jmp 0x1001b0fb
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1cc], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001b0ec
mov dword [esp + 0x18], ebx
jmp 0x1001b1aa
mov dword [esp + 0x34], 0xfffffffb
lea ecx, [esp + 0x14c]
push 4
call fcn.100180d9
push 2
lea ecx, [esp + 0x120]
mov byte [esp + 0x210], 5
call fcn.100180d9
mov dword [esp + 0x24], ebx
jmp 0x1001b153
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14c]
mov dword [eax + ecx*4], 0x4eea2a3b
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 4
jl 0x1001b13d
mov dword [esp + 0x24], ebx
jmp 0x1001b176
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0x4b1b
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001b160
mov eax, dword [esp + 0x11c]
lea ecx, [esp + 0x11c]
dec dword [eax]
call fcn.100188f6
lea ecx, [esp + 0x14c]
mov byte [esp + 0x20c], 1
call fcn.100188f6
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffee
jne 0x1001b10b
mov dword [esp + 0x28], ebx
jmp 0x1001b1e7
mov dword [esp + 0x24], ebx
jmp 0x1001b1dc
lea eax, [esp + 0x3f]
mov byte [esp + 0x3f], bl
push eax
push 0x7430
push ebx
call fcn.1001baa5
add esp, 0xc
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 1
jle 0x1001b1c1
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x2d
jle 0x1001b1bb
jmp 0x1001b25d
mov dword [esp + 0x28], 0xfffffffe
xor ecx, ecx
mov dword [esp + 0x34], 0xef155d2
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
sub eax, 0x5c01cf56
cmp eax, 0xd6df
setne cl
add ecx, dword [esp + 0x28]
je 0x1001b225
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x134]
mov dword [eax], edx
mov eax, dword [esp + 0x2c]
cmp edx, eax
setg cl
mov dword [esp + 0x34], ecx
mov dword [esp + 0x24], 0xfffffffd
lea ecx, [esp + 0x178]
push 1
call fcn.100180d9
mov dword [esp + 0x18], ebx
jmp 0x1001b28f
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0x61ab6ec7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x1001b279
cmp dword [esp + 0x24], ebx
je 0x1001b2e4
mov dword [esp + 0x34], 2
mov dword [esp + 0x18], ebx
jmp 0x1001b2bd
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1b4], 8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001b2aa
mov dword [esp + 0x24], ebx
jmp 0x1001b2d8
mov eax, dword [esp + 0x1b4]
mov dword [esp + 0x34], eax
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x2a
jne 0x1001b2c9
jmp 0x1001b37a
mov dword [esp + 0x24], ebx
jmp 0x1001b309
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b305
push ebx
push ebx
push 0x15c8
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jle 0x1001b2ea
mov dword [esp + 0x24], 4
jmp 0x1001b373
mov dword [esp + 0x34], 0xc619a80b
cmp dword [esp + 0x34], 1
jge 0x1001b354
mov dword [esp + 0x2c], ebx
dec dword [esp + 0x2c]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b36f
push ebx
push 0x21b1
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
jmp 0x1001b36f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b36f
push 0x1311
push 0x2111
call dword [sym.imp.KERNEL32.dll_Beep]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x1a
jl 0x1001b319
lea ecx, [esp + 0x178]
call fcn.100188f6
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x134]
mov dword [esp + 0x18], eax
or dword [esp + 0x20c], 0xffffffff
call fcn.100188f6
mov eax, dword [esp + 0x88]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x80]
mov esi, edx
mov edi, eax
call fcn.10019ea9
mov ecx, dword [esp + 0x204]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret