Function at 0x10017947
Capabilities:
Access peb ldr_data
Extract resource via kernel32 functions
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10073be5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1d8
push ebx
push esi
push edi
mov dword [esp + 0x30], ecx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x38], edx
mov dword [esp + 0x10], 1
push 4
call fcn.100154f1
xor ebx, ebx
mov dword [esp + 0xc], ebx
jmp 0x100179a3
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10017991
xor edi, edi
mov dword [esp + 0x10], 0xfffffff1
inc edi
cmp dword [esp + 0x10], 0x1b
je 0x10017a0d
mov esi, dword [esp + 0xfc]
mov dword [esp + 0x18], edi
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
add ecx, dword [esp + 0x18]
cmp ecx, dword [esp + 0x10]
jle 0x100179f6
mov ecx, ebx
cmp dword [esp + 0x10], ebx
je 0x100179f8
mov ecx, edi
mov eax, 0xfffb
sub eax, ecx
mov dword [esi + 0xc], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1b
jne 0x100179c3
lea ecx, [esp + 0xfc]
call fcn.10015dc5
push 3
mov dword [esp + 0x14], 0x5c68ec0a
lea ecx, [esp + 0x154]
pop esi
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x10], 0xbf5cd53b
mov dword [esp + 0x1c], edi
push esi
call fcn.100154f1
push 4
mov dword [esp + 0x14], ebx
pop edi
jmp 0x10017a61
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1d0], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10017a4e
mov dword [esp + 0x10], ebx
jmp 0x10017a83
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0x943e2f7c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10017a6d
mov dword [esp + 0x10], ebx
jmp 0x10017ace
mov dword [esp + 0x1c], 0x6941fc9a
mov dword [esp + 0x1c], 0xfffffff9
mov dword [esp + 0xc], ebx
mov dword [esp + 0x18], 0xc299e885
inc dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1d4], 0x44426282
mov dword [esp + 0xc], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xf
jne 0x10017a8f
mov dword [esp + 0xc], 0xffffffe7
jmp 0x10017b29
mov dword [esp + 0x10], ebx
jmp 0x10017af8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1a0], 0x6e28
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10017ae5
mov dword [esp + 0x10], ebx
jmp 0x10017b18
mov dword [esp + 0x18], 9
mov dword [esp + 0x18], 0x85fafe44
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x10017b04
mov eax, dword [esp + 0x1a8]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff7
jge 0x10017adf
lea ecx, [esp + 0x150]
call fcn.10015dc5
push edi
lea ecx, [esp + 0xc4]
call fcn.100154f1
mov dword [esp + 0x1ec], ebx
mov dword [esp + 0xc], 0xe1e87df2
mov dword [esp + 0x20], 9
mov dword [esp + 0xc], ebx
jmp 0x10017b78
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10017b66
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0xc], ebx
jmp 0x10017d76
push 2
lea ecx, [esp + 0xf4]
call fcn.100154f1
push 2
lea ecx, [esp + 0xe8]
mov byte [esp + 0x1f0], 1
call fcn.100154f1
push 2
pop edx
mov byte [esp + 0x1ec], dl
mov dword [esp + 0x24], 0x29c214f1
mov dword [esp + 0x10], ebx
jmp 0x10017bdf
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf0]
mov dword [eax + ecx*4], 0x72d4ea68
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10017bc9
mov dword [esp + 0x10], ebx
jmp 0x10017c01
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10017beb
mov esi, dword [esp + 0xf0]
mov dword [esi + 4], 3
push 3
lea ecx, [esp + 0x94]
call fcn.100154f1
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10017c47
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x90]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10017c31
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0xc0]
cmp dword [eax + ecx*4], ebx
jne 0x10017cfb
mov eax, dword [esp + 0x90]
mov dword [eax + 8], 0x6b779c63
cmp dword [esp + 0x18], ebx
je 0x10017cc9
mov eax, dword [esp + 0xc]
inc eax
cmp eax, 0xffff
mov eax, dword [esp + 0xc0]
sbb ecx, ecx
inc ecx
cmp ecx, dword [eax]
jge 0x10017c96
cmp dword [esi + 4], ebx
jne 0x10017c96
mov eax, ebx
jmp 0x10017c99
xor eax, eax
inc eax
add eax, 0xffff0004
neg eax
sbb eax, eax
neg eax
sub eax, dword [esp + 0xc]
neg eax
sbb eax, eax
inc eax
cmp eax, 0xf7bdd484
mov eax, dword [esp + 0xc]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0xe4]
setge dl
mov dword [eax], edx
imul eax, dword [esp + 0xc], 0x6ec1
xor ecx, ecx
test eax, eax
setle cl
xor eax, eax
cmp dword [esi + 4], ecx
lea ecx, [esp + 0x90]
setl al
mov dword [esp + 0x20], eax
call fcn.10015dc5
dec dword [esi + 4]
jns 0x10017c15
jmp 0x10017d07
lea ecx, [esp + 0x90]
call fcn.10015dc5
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x17], bl
sub ecx, eax
je 0x10017d31
cmp byte [esp + 0x17], 0
je 0x10017d50
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
jmp 0x10017d50
cmp byte [esp + 0x17], 0
je 0x10017d49
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 0x24]
mov dword [esi + 4], eax
lea ecx, [esp + 0xe4]
call fcn.10015dc5
lea ecx, [esp + 0xf0]
mov byte [esp + 0x1ec], bl
call fcn.10015dc5
inc dword [esp + 0xc]
push 3
pop esi
cmp dword [esp + 0xc], esi
jle 0x10017b8d
or dword [esp + 0x1ec], 0xffffffff
lea ecx, [esp + 0xc0]
call fcn.10015dc5
mov dword [esp + 0xc], ebx
jmp 0x10017daa
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x28], 0xfffffff9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x10017d9a
push 4
lea ecx, [esp + 0x10c]
call fcn.100154f1
push esi
lea ecx, [esp + 0x16c]
mov dword [esp + 0x1f0], esi
call fcn.100154f1
mov dword [esp + 0x10], ebx
jmp 0x10017def
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0xac204e2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10017dd9
mov dword [esp + 0x10], ebx
jmp 0x10017e12
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], 0x390197f0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10017dfc
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10017e36
push ebx
push ebx
push 0x25d0
push 0x2f6
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov eax, dword [esp + 0x108]
lea ecx, [esp + 0x168]
mov dword [eax + 8], 0xfffffffc
call fcn.10015dc5
or dword [esp + 0x1ec], 0xffffffff
lea ecx, [esp + 0x108]
call fcn.10015dc5
mov dword [esp + 0x28], ebx
jmp 0x10018067
mov dword [esp + 0xc], 0xfffffff6
xor ecx, ecx
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x1c], 0x1c946b43
mov dword [esp + 0x20], 0x1d25bb08
push 0xfffffffffffffff9
pop edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], 0xfff6
mov eax, dword [esp + 0x20]
cmp eax, edx
setne cl
mov dword [esp + 0x18], ecx
mov dword [esp + 0xc], 0xffffffeb
jmp 0x10017ecb
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10017ec7
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x1c
jl 0x10017eb5
mov dword [esp + 0x10], 0x7c203980
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x24], 0x9d73ae4c
mov dword [esp + 0x10], ebx
jmp 0x10017fd4
mov dword [esp + 0xc], 0x6de713a4
mov dword [esp + 0x24], 0xfffffffb
mov dword [esp + 0x18], 0x6dbc1c23
mov dword [esp + 0x1c], 0xfffd
mov dword [esp + 0xc], 1
jmp 0x10017fc5
mov dword [esp + 0x20], 0xffaf0720
mov dword [esp + 0x24], 0x1c3d076c
cmp dword [esp + 0x10], ebx
jne 0x10017fa8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ebx
jne 0x10017f4c
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp eax, 1
setl dl
sub edx, 4
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp edx, eax
setg cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
add ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [esp + 0xc]
jg 0x10017fa8
mov eax, ebx
jmp 0x10017fab
xor eax, eax
inc eax
mov dword [esp + 0x24], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10017fc1
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x18
jge 0x10017f24
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1c
jl 0x10017ef7
mov dword [esp + 0x10], ebx
jmp 0x1001805c
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001800a
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x12c], 5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10017ff7
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018029
push 0x7e3
call edi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [esp + 0xc], ebx
jmp 0x10018049
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x12c]
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x12c], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x1001802f
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x16
jl 0x10017fe5
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0xf
je 0x10017e6d
mov eax, dword [esp + 0x30]
cmp dword [eax + 0x10], ebx
jne 0x10018082
xor al, al
jmp 0x10018a45
mov dword [esp + 0xc], 0xfffffffb
mov dword [esp + 0x18], 0x13d0bb9
mov dword [esp + 0x1c], 0x7ea4c57
mov dword [esp + 0xc], ebx
jmp 0x100180b3
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x9c], 5
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x100180a0
mov dword [esp + 0xc], ebx
jmp 0x10018157
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], 0xfffffffd
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x9c], ebx
jne 0x100180e3
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], 0xfff9
xor edx, edx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], 0xffffffff
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x9c]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov eax, dword [esp + 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, 0x130dfdda
setge dl
sub edx, dword [esp + 0xa4]
mov eax, dword [esp + 0xc]
sub edx, 0xa814b11f
neg edx
sbb edx, edx
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x9c]
inc edx
cmp edx, eax
setl cl
mov dword [esp + 0x1c], ecx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x100180c2
mov dword [esp + 0x18], 0xd4e7937
lea ecx, [esp + 0x5c]
mov dword [esp + 0xc], 0xa93826a0
push 1
call fcn.100154f1
mov dword [esp + 0x1ec], 4
lea ecx, [esp + 0x120]
mov dword [esp + 0x24], 0xffffffff
push esi
call fcn.100154f1
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x100181bb
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x74], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100181ab
mov dword [esp + 0x10], ebx
jmp 0x100181db
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 0xf63069be
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100181c8
mov dword [esp + 0x10], ebx
jmp 0x100181f8
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x58], 0x60fc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100181e8
mov dword [esp + 0x10], ebx
jmp 0x1001821b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10018205
cmp dword [esp + 0x18], ebx
je 0x10018264
mov eax, dword [esp + 0x18]
mov ecx, 0x7d8ca64f
mov eax, dword [esp + 0x78]
xor edx, edx
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
sub ecx, eax
mov esi, dword [esp + 0x5c]
cmp ecx, dword [esi]
setge dl
xor eax, eax
cmp edx, 0x84cbed56
setne al
cmp eax, 0x994b748a
je 0x10018268
xor eax, eax
inc eax
jmp 0x1001826a
mov esi, dword [esp + 0x5c]
mov eax, ebx
sub eax, dword [esi]
je 0x10018329
or eax, 0xffffffff
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], eax
mov dword [esp + 0x54], eax
mov dword [esp + 0x1c], 4
imul eax, dword [esp + 0x24], 5
mov ecx, dword [esp + 0x48]
sub ecx, eax
mov dword [esp + 0xc], ecx
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x74]
jle 0x100182b1
cmp dword [esp + 0x58], ebx
je 0x100182b1
xor ecx, ecx
inc ecx
jmp 0x100182b3
mov ecx, ebx
mov eax, dword [esp + 0x48]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x24]
setne dl
sub ecx, eax
mov eax, dword [esp + 0x120]
imul ecx, edx
mov dword [eax + 4], ecx
test ecx, ecx
jne 0x100182e3
cmp dword [esp + 0x48], ebx
jne 0x100182e3
mov edx, ebx
jmp 0x100182e6
xor edx, edx
inc edx
mov eax, dword [esp + 0x5c]
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [esp + 0x74]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x4c]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x48]
setle cl
cmp ecx, 0xffff
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
xor eax, eax
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [esp + 0x1c], eax
jmp 0x1001834f
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001834f
push ebx
push 0x22da
push 0x4ac
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
lea ecx, [esp + 0x120]
call fcn.10015dc5
or dword [esp + 0x1ec], 0xffffffff
lea ecx, [esp + 0x5c]
call fcn.10015dc5
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x10007ad0]
lea eax, [esp + 0x1a4]
push eax
lea eax, [esp + 0x198]
mov dword [esp + 0xd4], ebx
push eax
push ebx
lea ecx, [esp + 0xdc]
mov dword [esp + 0xe0], ebx
movdqu xmmword [esp + 0x1a0], xmm0
mov dword [esp + 0xe4], ebx
call fcn.10016c1d
mov dword [esp + 0x1ec], 5
mov dword [esp + 0xc], ebx
jmp 0x100183d7
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x8c], 0xfc558bac
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x100183c4
mov dword [esp + 0xc], 0xb4e94f93
lea ecx, [esp + 0xb4]
push 1
call fcn.100154f1
push 2
pop esi
mov byte [esp + 0x1ec], 6
lea ecx, [esp + 0x114]
mov dword [esp + 0x20], 0x5f432603
push esi
call fcn.100154f1
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001842d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x34], 0xa8f90a3c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001841d
mov dword [esp + 0x10], ebx
jmp 0x1001844f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018439
mov dword [esp + 0x10], ebx
jmp 0x10018471
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 0x920b2455
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001845b
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x34], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0xb4]
mov dword [esp + 0x34], ecx
mov dword [eax], ecx
imul eax, dword [esp + 0xc], 0xa760
sub eax, dword [esp + 0xc]
cmp eax, dword [esp + 0xc]
jne 0x100184ae
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xb4]
mov eax, dword [eax]
cmp eax, dword [esp + 0xc]
je 0x100184cf
mov ecx, ebx
test eax, eax
je 0x100184d1
mov ecx, edx
xor eax, eax
cmp ecx, 0xfffd
sete al
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x114]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax + 4], ecx
lea ecx, [esp + 0x114]
call fcn.10015dc5
lea ecx, [esp + 0xb4]
mov byte [esp + 0x1ec], 5
call fcn.10015dc5
push ebx
call fcn.1001a195
or dword [esp + 0x1f0], 0xffffffff
pop ecx
lea ecx, [esp + 0xcc]
call fcn.10015dc5
push 3
mov dword [esp + 0x14], ebx
pop edi
jmp 0x10018548
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x68], 0xad313dd3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10018538
mov dword [esp + 0x10], ebx
jmp 0x10018567
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1ac], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10018554
mov dword [esp + 0x70], ebx
jmp 0x1001859c
mov dword [esp + 0xc], 0x8c9f3690
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], ebx
jl 0x10018598
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x1ac], ebx
jne 0x10018598
dec dword [esp + 0xc]
jns 0x10018585
dec dword [esp + 0x70]
cmp dword [esp + 0x70], 0xffffffeb
jge 0x10018573
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0xd8]
push edi
mov dword [eax], ebx
call fcn.100154f1
mov dword [esp + 0xc], ebx
jmp 0x100185d2
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], 0x399841b3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x100185bc
mov esi, dword [esp + 0xd8]
mov dword [esi + 8], 4
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100185f7
call dword [sym.imp.KERNEL32.dll_GetVersion]
dec dword [esi + 8]
cmp dword [esi + 8], 0xffffffe8
jge 0x100185e6
lea ecx, [esp + 0xd8]
call fcn.10015dc5
mov dword [esp + 0xc], ebx
mov dword [esp + 0xc], ebx
jmp 0x10018629
cmp dword [esp + 0xc], edi
jl 0x10018616
mov ecx, dword [esp + 0x1e4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret