Function at 0x1001dcb6
Capabilities:
Accept command line arguments
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10056265
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
push ebx
xor ebx, ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], 0x862f
mov byte [esp + 7], bl
push esi
push edi
mov dword [esp + 0x34], ecx
cmp byte [esp + 0xf], bl
je 0x1001dd02
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1001dd12
call dword [sym.imp.USER32.dll_ReleaseCapture]
call fcn.1001a61d
push ecx
push eax
lea ecx, [esp + 0x34]
call fcn.1001e534
mov dword [esp + 0xac], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x20], 0xa2c
cmp dword [esp + 0x20], 0xc2e
push 1
pop edi
jle 0x1001ddb4
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0x79a7
mov eax, esi
lea ecx, [esp + 0x40]
or eax, ebx
cdq
push edx
push eax
call fcn.100042e3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001dd70
mov eax, dword [eax]
push eax
call fcn.10039f30
pop ecx
push 0
push 1
lea ecx, [esp + 0x48]
call fcn.10002764
add esi, edi
dec dword [esp + 0x14]
jne 0x1001dd56
mov esi, dword [esp + 0x10]
inc edi
cmp edi, 0x736
jl 0x1001dd4a
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x2a2c
jl 0x1001dd48
inc ebx
cmp ebx, 0x243a
jl 0x1001dd42
xor edi, edi
xor ebx, ebx
inc edi
mov dword [esp + 0x18], edi
cmp dword [esp + 0x20], 0x899
jge 0x1001ddcd
push str.fxzqp_efx_wfvv_zinizbyey_obgy
call fcn.10039f30
pop ecx
mov dword [esp + 0xac], ebx
mov dword [esp + 0x14], ebx
jmp 0x1001ddea
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1c], 7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001ddda
mov dword [esp + 0x10], ebx
jmp 0x1001df96
mov dword [esp + 0x20], 0xf7d96711
mov dword [esp + 0x14], 0xacb3
mov dword [esp + 0x18], 0x230b63e9
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x1c], ebx
je 0x1001dea3
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x20], ebx
je 0x1001de49
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xffff
test eax, eax
je 0x1001de79
mov edx, edi
cmp dword [esp + 0x20], ebx
jne 0x1001de7b
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
mov edx, edi
setg cl
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
sub eax, 0xfffffff8
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x10]
cmp eax, 0x5520f303
jg 0x1001dea5
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0x6293
mov ecx, 0xfffc
setne al
imul eax, eax, 0x7c1
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jg 0x1001df92
mov dword [esp + 0x18], 0x77b9
cmp dword [esp + 0x18], 0x7a80
jle 0x1001df4b
mov edi, ebx
mov esi, ebx
mov ecx, ebx
lea eax, [esi + edi]
sar eax, cl
lea ecx, [esp + 0x70]
cdq
push edx
push eax
call fcn.100042e3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001df10
mov eax, dword [eax]
push eax
call fcn.10039f30
pop ecx
push 0
push 1
lea ecx, [esp + 0x78]
call fcn.10002764
inc ebx
cmp ebx, 0x7cf4
jl 0x1001def3
inc esi
push 0
pop ebx
cmp esi, 0x2aac
jl 0x1001def3
inc edi
cmp edi, 0x5393
jl 0x1001def1
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov byte [esp + 0xf], bl
cmp dword [esp + 0x18], 0x7733
jge 0x1001df64
push str.letu_zcxnu_qnecu_qfpa
call fcn.10039f30
pop ecx
mov dword [esp + 0xac], ebx
cmp byte [esp + 0xf], 0
je 0x1001df7d
push 0x1668
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x1001dedd
xor edi, edi
inc edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001ddf9
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001dfd3
push 0xc04
push 0x30d
push 0x2453
push 0xe45
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
mov ecx, dword [esp + 0x2c]
mov edx, ecx
mov esi, dword [esp + 0x28]
add esi, 0xffffc3c6
mov eax, dword [ecx + 4]
cmp byte [eax + 0xd], 0
jne 0x1001e013
cmp dword [eax + 0x10], esi
jge 0x1001dff6
mov eax, dword [eax + 8]
jmp 0x1001dffa
mov edx, eax
mov eax, dword [eax]
cmp byte [eax + 0xd], 0
je 0x1001dfec
cmp edx, ecx
je 0x1001e013
cmp esi, dword [edx + 0x10]
jl 0x1001e013
mov dword [esp + 0x3c], edx
lea esi, [esp + 0x3c]
jmp 0x1001e01b
mov dword [esp + 0x38], ecx
lea esi, [esp + 0x38]
mov eax, dword [0x1017ea5c]
mov esi, dword [esi]
test al, 1
jne 0x1001e054
or eax, edi
mov dword [0x1017ea58], 7
mov dword [0x1017ea5c], eax
xor eax, eax
push 0x10056b26
mov dword [0x1017ea54], ebx
mov word [0x1017ea44], ax
call fcn.100384ac
pop ecx
mov ecx, dword [esp + 0x2c]
cmp esi, ecx
je 0x1001e077
push dword [esi + 0x18]
mov edx, dword [esi + 0x14]
lea ecx, [esp + 0x8c]
call fcn.10016b5f
pop ecx
mov byte [esp + 0xac], 5
mov ebx, edi
jmp 0x1001e093
push 0x1017ea44
lea ecx, [esp + 0x5c]
call fcn.10007cbb
push 2
mov dword [esp + 0xb0], 6
pop ebx
mov esi, dword [esp + 0x34]
mov ecx, esi
push eax
mov dword [esp + 0x28], ebx
call fcn.10007cbb
or ebx, 4
test bl, 2
je 0x1001e0ba
push 0
push edi
lea ecx, [esp + 0x60]
and ebx, 0xfffffffd
call fcn.10006c15
test bl, 1
je 0x1001e0ce
push 0
push edi
lea ecx, [esp + 0x90]
call fcn.10006c15
lea ecx, [esp + 0x2c]
call fcn.1001e491
mov ecx, dword [esp + 0xa4]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret