Function at 0x10018901
Capabilities:
Check os version
Create process on windows
Get common file path
Get memory capacity

Disassembly:
mov eax, 0x1007b47d
call fcn.1007ac40
sub esp, 0x1ac
push ebx
push esi
mov dword [ebp - 0x14], 0xfffffffb
xor ebx, ebx
push edi
mov dword [ebp - 0x4c], ecx
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], 5
push 4
mov dword [ebp - 0xa4], edx
call fcn.10016a6e
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x20], 0x83ad
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], ebx
jmp 0x10018971
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0xdb6b7be2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1001895e
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x24], 0x9995
je 0x10018999
mov ecx, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setg dl
cmp edx, 9
jg 0x10018999
mov ecx, ebx
jmp 0x1001899c
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x63700168
setne al
cmp dword [ebp - 0x14], eax
jne 0x100189af
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x2c]
jge 0x100189c9
cmp dword [ebp - 0x2c], ebx
jne 0x100189c9
mov edx, ebx
jmp 0x100189cc
xor edx, edx
inc edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x160]
dec dword [ebp - 0x18]
call fcn.1001732e
push dword [ebp - 0x4c]
movdqa xmm0, xmmword [0x10007a40]
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x188]
mov dword [ebp - 0x78], ebx
push eax
push ebx
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x74], ebx
movdqu xmmword [ebp - 0x188], xmm0
mov dword [ebp - 0x70], ebx
call fcn.100180c2
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x28], 0xfcf09cc2
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x2c], 0x219a
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xffffffe9
je 0x10018beb
mov edi, 0xf7a2d47e
mov dword [ebp - 0x18], 0xfffffff8
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x1c], 0xfffffff8
push 1
call fcn.10016a6e
mov dword [ebp - 0x24], 0xbe6
mov dword [ebp - 0x1c], ebx
jmp 0x10018a89
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10018a7d
mov dword [ebp - 0x1c], ebx
jmp 0x10018aa5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1a0], 0xf45a3231
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10018a94
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
inc dword [ebp - 0x2c]
cmp ecx, eax
jge 0x10018abf
xor eax, eax
inc eax
jmp 0x10018ac1
mov eax, ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
je 0x10018acc
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x64]
mov edx, dword [eax]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
cmp eax, edx
setle cl
sub ecx, edx
xor edx, edx
mov dword [ebp - 0x28], ecx
mov ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x64]
setge dl
mov dword [eax], edx
test edx, edx
je 0x10018b15
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x64]
add dword [eax], ecx
jmp 0x10018b69
mov dword [ebp - 0x18], 0xfffffff7
jmp 0x10018b63
mov dword [ebp - 0x24], ebx
jmp 0x10018b4a
cmp byte [ebp - 0xd], 0
je 0x10018b30
push ebx
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018b47
push ebx
push 0xca8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1c
mov byte [ebp - 0xd], bl
jne 0x10018b23
cmp byte [ebp - 0xd], 0
je 0x10018b60
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x36
jge 0x10018b1e
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0x20
jl 0x10018bd6
xor esi, esi
inc esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x13c], edi
mov dword [ebp - 0x138], edi
mov dword [ebp - 0x134], edi
mov dword [ebp - 0x130], edi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018ba1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x28d8805e
setle cl
xor eax, eax
cmp ecx, 0xffffffff
setge al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1a0]
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x64]
mov dword [eax], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x20
jge 0x10018b75
lea ecx, [ebp - 0x64]
call fcn.1001732e
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe9
jne 0x10018a59
push 1
lea ecx, [ebp - 0xb0]
call fcn.10016a6e
xor eax, eax
lea ecx, [ebp - 0xf8]
inc eax
mov byte [ebp - 4], al
mov dword [ebp - 0x1c], 0x76b0f738
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
push 4
call fcn.10016a6e
xor ecx, ecx
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], ebx
inc ecx
jmp 0x10018c4b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x34], 0x70f9e3d3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10018c3d
mov dword [ebp - 0x18], ebx
jmp 0x10018c62
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd4], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10018c55
mov dword [ebp - 0x18], ebx
jmp 0x10018c80
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10018c6d
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
cmp dword [ebp - 0x1c], 0xffffffff
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setg cl
xor edx, edx
cmp ecx, 0x213e
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0x7ad53a38
jl 0x10018cd7
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x24], ebx
je 0x10018d7f
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0x36
jg 0x10018e4b
mov esi, dword [sym.imp.ADVAPI32.dll_ControlService]
mov edi, 0xcb6
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x24], 0xfffffff7
jmp 0x10018d42
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x18], ebx
jmp 0x10018d39
mov dword [ebp - 0x20], 1
cmp dword [ebp - 0x14], ebx
jne 0x10018d3f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 8
jl 0x10018d2a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
je 0x10018d17
mov dword [ebp - 0x14], ebx
jmp 0x10018d6c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018d5b
push ebx
push edi
push ebx
call esi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018d69
push ebx
push edi
push ebx
call esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10018d4d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x36
jle 0x10018d07
jmp 0x10018e4b
mov dword [ebp - 0x18], 0x523e
lea ecx, [ebp - 0x104]
push 3
call fcn.10016a6e
mov dword [ebp - 0x14], ebx
jmp 0x10018da7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10018d98
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 1
setle cl
xor eax, eax
cmp ecx, 0x76dcb0c7
setge al
cmp eax, dword [ebp - 0x18]
jle 0x10018dd4
cmp dword [ebp - 0x18], ebx
jne 0x10018dd4
mov eax, ebx
jmp 0x10018dd7
xor eax, eax
inc eax
xor edx, edx
cmp eax, 0x56eb3e19
mov eax, dword [ebp - 0x104]
setg dl
xor ecx, ecx
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp eax, ecx
setge dl
xor ecx, ecx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0xd4]
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0xd4]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setne dl
cmp edx, dword [ebp - 0x1c]
jg 0x10018e32
cmp dword [ebp - 0x12c], ebx
jne 0x10018e32
mov ecx, ebx
jmp 0x10018e37
xor esi, esi
lea ecx, [esi + 1]
mov eax, dword [ebp - 0xf8]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x104]
call fcn.1001732e
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 1
call fcn.1001732e
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x14], 0xc8d3c891
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x10018f02
mov dword [ebp - 0x20], 4
dec dword [ebp - 0x20]
mov dword [ebp - 0x14], ebx
jmp 0x10018ef4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0xcc]
mov eax, dword [ebp - 0x1c]
sub ecx, dword [ebp + eax*4 - 0xcc]
je 0x10018ee2
mov dword [ebp - 0x20], 0x15d7249a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018ef1
push ebx
push ebx
push 0x1155
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x10018ef1
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018ef1
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x10018ea4
dec dword [ebp - 0x1c]
jns 0x10018e95
xor ecx, ecx
inc ecx
mov eax, 0xdd1e1e87
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x14], ebx
jmp 0x10018f2b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1ac], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10018f1e
push 2
mov dword [ebp - 0x80], ebx
pop esi
jmp 0x10018f80
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
jg 0x10018f7d
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018f5e
push ebx
push ecx
push 0x17bd
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
push 1
mov eax, dword [ebp + eax*4 - 0x1ac]
cmp eax, esi
setle cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x14]
pop ecx
cmp dword [ebp - 0x14], esi
jle 0x10018f44
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], esi
jle 0x10018f39
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018faa
push 0x973
push 0xebe
push ebx
push ebx
push 0xb27
push 0x2267
call dword [sym.imp.USER32.dll_ToUnicode]
mov dword [ebp - 0x1c], ebx
jmp 0x10018fc2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], 0x99333c7d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10018faf
mov dword [ebp - 0x20], 9
lea ecx, [ebp - 0x154]
mov dword [ebp - 0x28], 0x5dae5a60
push 4
call fcn.10016a6e
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x28], 0x7278fa8f
push 1
call fcn.10016a6e
mov dword [ebp - 0x14], 0xe291920b
mov dword [ebp - 0x1c], 0x6fd8
mov dword [ebp - 0x1c], ebx
jmp 0x10019024
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x154]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10019015
mov dword [ebp - 0x1c], ebx
jmp 0x10019042
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0x720348f4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x1001902f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xec]
dec dword [eax]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001907b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea ecx, [ebp - 0xec]
call fcn.1001732e
lea ecx, [ebp - 0x154]
mov byte [ebp - 4], 1
call fcn.1001732e
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], esi
jge 0x100190b6
xor esi, esi
inc esi
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x174], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100190a0
push 2
pop esi
mov dword [ebp - 0x24], 0x971c
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x20], 0x4768c0aa
mov dword [ebp - 0x20], 3
push 4
call fcn.10016a6e
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x14], 0x3859
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x28], 0xa97f51ef
mov dword [ebp - 0x28], ebx
push 1
call fcn.10016a6e
mov dword [ebp - 0x1c], 0x8f49235
push 3
mov dword [ebp - 0x28], 0x4643a64e
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10019128
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1b8], 0x978f3c34
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10019117
mov dword [ebp - 0x18], ebx
jmp 0x10019145
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0x5cc2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10019132
mov dword [ebp - 0x18], ebx
jmp 0x10019163
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x94]
mov dword [eax + ecx*4], 0x3eb61943
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10019150
mov dword [ebp - 0x18], ebx
jmp 0x1001917f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x194], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001916e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
inc dword [ebp - 0x1c]
test ecx, ecx
jne 0x100191d7
mov eax, dword [ebp - 0x14]
neg eax
cmp eax, dword [ebp - 0x20]
jle 0x100191be
mov eax, dword [ebp - 0x194]
sub eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
cmp eax, 0x5438
mov eax, dword [ebp - 0x94]
setg cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
add edx, 4
cmp dword [ebp - 0x28], edx
jle 0x100191d7
mov eax, ebx
jmp 0x100191da
xor eax, eax
inc eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x24], eax
jl 0x10019211
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ebx
jl 0x10019292
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe0]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x14]
jns 0x100191f5
jmp 0x10019292
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019228
push ebx
push 0xca8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov dword [ebp - 0x1c], ebx
jmp 0x1001928d
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001923d
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001928a
push 0x1a95
push 0xbb4
push ebx
push ebx
push 0x26d0
push 0x208f
push 0x22ac
push 0x119b
push 0x144b
push 0x1abe
push 0x1933
push 0x17d
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_StretchDIBits]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1001922d
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x94]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x94]
call fcn.1001732e
lea ecx, [ebp - 0xe0]
call fcn.1001732e
mov esi, dword [ebp - 0x78]
xor eax, eax
cmp dword [esi], eax
setg al
xor ecx, ecx
cmp dword [esi], eax
mov eax, dword [esi + 0xc]
setl cl
dec eax
add eax, ecx
xor ecx, ecx
cmp dword [esi], eax
mov eax, dword [ebp - 0xb0]
setne cl
mov dword [eax], ecx
xor eax, eax
cmp ecx, dword [esi]
setg al
cmp eax, dword [esi]
jne 0x100192f3
test ecx, ecx
je 0x100192f3
xor eax, eax
inc eax
jmp 0x100192f5
mov eax, ebx
imul eax, dword [esi]
xor edx, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb0]
cmp dword [eax], ebx
mov eax, dword [ebp - 0x78]
setne dl
xor ecx, ecx
cmp edx, dword [eax]
setg cl
imul ecx, dword [esi + 0xc]
mov dword [ebp - 0x170], ecx
lea ecx, [ebp - 0xb0]
call fcn.1001732e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.1001732e
mov dword [ebp - 0x1c], 0xf3d4e677
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x20], 0x945cb81e
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x14], ebx
jmp 0x1001936f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x148], 0xfffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001935e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001938b
push ebx
push 0x24df
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov dword [ebp - 0x24], 0xfffffffe
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
je 0x100193ad
cmp dword [ebp - 0x24], ebx
jne 0x100193b0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x144]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x148]
setge dl
xor ecx, ecx
add edx, 0x758b39d2
cmp edx, 0x78cc
push 2
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
pop esi
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0x6f9a4d91
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x18], 0xfffffff0
cmp dword [ebp - 0x18], 0x11
je 0x1001953c
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xf6a1c3d0
mov dword [ebp - 0x14], ebx
jmp 0x10019440
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6c], 0xa473eb90
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10019432
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
jmp 0x1001951b
mov dword [ebp - 0x28], 0xfffffffb
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001946a
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x6c]
sub eax, 0x2f2c0841
je 0x1001949b
mov dword [ebp - 0x14], 0xb6069300
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jl 0x10019518
cmp dword [ebp - 0x1c], ebx
jne 0x10019518
dec dword [ebp - 0x14]
jns 0x1001948b
jmp 0x10019518
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x2c], 0x6a1c
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jl 0x100194c9
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x14]
jns 0x100194b1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 0x191a83ac
jne 0x100194dc
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x24], ebx
jne 0x100194f4
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x24], edx
inc ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jle 0x10019450
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019534
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
inc dword [ebp - 0x18]
jmp 0x1001940e
mov dword [ebp - 0x18], 0xffffffe6
jmp 0x1001954d
cmp dword [ebp - 0x18], ebx
jne 0x10019553
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1c
jne 0x10019545
mov dword [ebp - 0x20], 0xb0b0
mov dword [ebp - 0x20], 0xffffffff
cmp dword [ebp - 0x20], ebx
mov byte [ebp - 0xd], bl
je 0x1001957e
cmp byte [ebp - 0xd], 0
je 0x1001958b
push ebx
push 0x8d9
push ebx
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1001958b
cmp byte [ebp - 0xd], 0
je 0x1001958b
push ebx
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x20], 0xfa147b80
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x14], ebx
jmp 0x100195bd
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x164], 0x624039b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100195ac
mov dword [ebp - 0x24], ebx
jmp 0x10019644
mov dword [ebp - 0x1c], 0x976ff55e
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x20], 0xd1f2e966
mov dword [ebp - 0x1c], ebx
jmp 0x1001963c
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x14], ebx
jmp 0x100195ff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x178], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100195ee
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019622
push 0x2432
push ebx
push ebx
push ebx
push 0x213
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov dword [ebp - 0x14], ebx
jmp 0x10019634
mov dword [ebp - 0x20], 0x27f7b6fe
dec dword [ebp - 0x20]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10019627
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x100195e2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x100195c8
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001966a
push ebx
push ebx
push ebx
push ebx
push 0x1e5f
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 1
lea ecx, [ebp - 0x40]
call fcn.10016a6e
push 1
lea ecx, [ebp - 0x110]
mov dword [ebp - 4], 5
call fcn.10016a6e
mov byte [ebp - 4], 6
mov dword [ebp - 0x14], 0xdb3ae355
mov dword [ebp - 0x14], ebx
jmp 0x100196a9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], 0x38ab659d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10019698
mov dword [ebp - 0x14], ebx
jmp 0x1001984c
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x10019839
mov dword [ebp - 0x24], 0x2e8588d0
mov dword [ebp - 0x18], 0x1fbc9fa8
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
jl 0x1001981c
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfaf07207
mov ecx, dword [ebp - 0x1c]
sbb edx, edx
inc edx
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp edx, ecx
setle al
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0xa0]
imul eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x24]
je 0x10019784
mov dword [ebp - 0x28], 0x77d6446b
mov dword [ebp - 0x18], 0x18
jmp 0x1001977c
mov dword [ebp - 0x20], 0xe7504ed0
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0xa0], ebx
je 0x10019756
cmp dword [ebp - 0x20], ebx
je 0x10019756
xor edx, edx
inc edx
jmp 0x10019758
mov edx, ebx
mov eax, dword [ebp - 0x9c]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
test ecx, ecx
setle dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x20], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff2
jle 0x1001972d
jmp 0x100197a2
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x100197a2
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001979d
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
dec dword [ebp - 0x18]
jns 0x1001978c
mov dword [ebp - 0x18], 0xfffffff5
jmp 0x1001980d
mov dword [ebp - 0x28], 0xffff
mov dword [ebp - 0x20], 0xaecaa70
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
sub ecx, 0xfff9
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
mov ecx, 0x461d0ee3
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul eax, eax, 0xfffb
sub ecx, eax
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setl dl
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
add edx, 0xffffb8d1
neg edx
sbb edx, edx
inc edx
add edx, dword [ebp + eax*4 - 0xa0]
mov dword [ebp - 0x2c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa
jl 0x100197ab
dec dword [ebp - 0x24]
jns 0x100196ea
mov dword [ebp - 0x24], 0x10
jmp 0x10019830
cmp dword [ebp - 0x2c], ebx
jne 0x10019836
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe7
jle 0x10019825
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe5
jl 0x100196cd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x16
jne 0x100196b7
mov dword [ebp - 0x20], 0x635290ce
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x20], 0xffffffff
xor eax, eax
mov dword [ebp - 0x20], 0xfffffffb
inc eax
mov dword [ebp - 0x28], 0xcd3624b6
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], 0xcb13638e
mov dword [ebp - 0x20], 0x3423637b
push eax
call fcn.10016a6e
mov dword [ebp - 0x20], 0x137d3709
mov dword [ebp - 0x18], ebx
jmp 0x100198af
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x16c], 6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001989e
mov dword [ebp - 0x18], ebx
jmp 0x100198c3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100198b9
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x100198df
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100198d0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x10019944
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
jne 0x10019910
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
neg eax
sub eax, ecx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x11c]
setne dl
mov dword [eax], edx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], 0xe41b0ce7
lea ecx, [ebp - 0x11c]
call fcn.1001732e
mov dword [ebp - 0x18], ebx
jmp 0x10019969
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x58], 0x1b3c692b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001995b
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x10019987
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x40]
mov dword [eax + ecx*4], 0xb457102d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10019977
mov dword [ebp - 0x18], ebx
jmp 0x100199a1
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x110]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10019991
mov edx, dword [ebp - 0x40]
mov dword [edx], ebx
mov eax, dword [edx]
cmp dword [ebp + eax*4 - 0x58], ebx
jne 0x10019a61
mov eax, dword [ebp - 0x40]
xor edx, edx
push 0
mov eax, dword [eax]
mov ecx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x58]
cmp ecx, eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x110]
setg dl
cmp edx, dword [ecx]
pop edx
setge dl
mov dword [eax], edx
neg edx
mov eax, dword [ecx]
mov eax, dword [ebp + eax*4 - 0x58]
cmp edx, eax
jg 0x100199fe
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x58], ebx
jne 0x100199fe
mov eax, ebx
jmp 0x10019a01
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x58]
mov ecx, dword [ebp - 0x40]
cmp dword [ecx], eax
mov eax, dword [ebp - 0x20]
setg dl
mov dword [ebp - 0x2c], edx
mov edx, dword [ecx]
xor ecx, ecx
imul eax, edx
add eax, dword [ebp - 0x2c]
cmp eax, 0x89ec
mov eax, dword [ebp + edx*4 - 0x58]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setle dl
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x58]
cmp edx, eax
mov edx, dword [ebp - 0x40]
setl cl
xor eax, eax
cmp ecx, dword [edx]
setg al
inc dword [edx]
mov dword [ebp - 0x20], eax
cmp dword [edx], esi
jle 0x100199ab
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x110]
call fcn.1001732e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.1001732e
mov dword [ebp - 0x24], 0x8bbca631
mov dword [ebp - 0x24], 3
jmp 0x10019b80
mov dword [ebp - 0x14], 4
mov dword [ebp - 0x14], 0xd
jmp 0x10019ac7
cmp dword [ebp - 0x14], 0xffffffff
jle 0x10019a9e
cmp dword [ebp - 0x24], 0x14
jge 0x10019a8e
push esi
lea ecx, [ebp - 0xbc]
call fcn.10016a6e
mov dword [ebp - 0x1c], 0x13638ecf
mov dword [ebp - 0x14], ebx
jmp 0x10019bb5
cmp dword [ebp - 0x14], esi
jl 0x10019ba2