Function at 0x100196c4
Capabilities:
Access peb ldr_data
Check os version
Get file attributes
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10083764
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3a8
push ebx
push esi
xor esi, esi
mov dword [esp + 0x30], ecx
push edi
inc esi
mov dword [esp + 0xc], 0xfffffffb
push esi
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x104], edx
call fcn.1001770e
xor ebx, ebx
lea ecx, [esp + 0x1a4]
push esi
mov dword [esp + 0x3c0], ebx
call fcn.1001770e
mov dword [esp + 0x1c], ebx
jmp 0x1001973a
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2d0], 0xf088
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x10019727
mov dword [esp + 0x1c], ebx
jmp 0x1001975d
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1b0]
mov dword [eax + ecx*4], 0x34f1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10019747
mov dword [esp + 0x1c], ebx
jmp 0x1001977f
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 0x4b664fb7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10019769
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0xc], 0x17
jmp 0x100198b8
mov dword [esp + 0x18], 0x9b389519
mov dword [esp + 0x14], 0x6d4c01e0
mov dword [esp + 0x20], ebx
jmp 0x100197be
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x68], 0x23e64f14
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x100197ae
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x100197d8
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [esp + 0xc], ebx
jne 0x1001987a
mov ecx, dword [esp + 0x6c]
xor edx, edx
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0x68]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setle cl
mov dword [esp + 0x18], ecx
xor ecx, ecx
cmp dword [esp + 0x18], eax
mov eax, dword [esp + 0x6c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x68]
setne dl
add eax, edx
mov dword [esp + 0x2d8], eax
jne 0x10019830
cmp dword [esp + 0x2d8], ebx
je 0x1001983d
mov eax, dword [esp + 0x1b0]
mov ecx, esi
cmp dword [eax], ebx
jne 0x1001983f
mov ecx, ebx
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
lea eax, [ecx - 6]
xor ecx, ecx
cmp eax, 0xfffffffc
setle cl
cmp ecx, 0xb7e59501
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
sbb esi, esi
xor edx, edx
inc esi
cmp eax, ecx
setl dl
add esi, edx
add esi, dword [esp + 0x6c]
jne 0x10019877
mov ecx, ebx
inc esi
jmp 0x1001987c
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
cmp ecx, 0xbb9a
setg al
cmp dword [esp + 0x6c], eax
jge 0x10019891
mov eax, dword [esp + 0x6c]
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x1a4]
test ecx, ecx
setne dl
mov dword [eax], ecx
xor eax, eax
cmp edx, 0xe9843c6b
setne al
mov dword [esp + 0x14], eax
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffffd
jle 0x10019798
lea ecx, [esp + 0x1a4]
call fcn.10017fa2
or dword [esp + 0x3bc], 0xffffffff
lea ecx, [esp + 0x1b0]
call fcn.10017fa2
mov dword [esp + 0x28], 0x69fdf99f
lea ecx, [esp + 0x11c]
push 4
call fcn.1001770e
mov dword [esp + 0x3bc], esi
mov dword [esp + 0xc], 0xdb88dcfd
mov dword [esp + 0x20], 0xff68e10d
mov dword [esp + 0x20], 7
mov dword [esp + 0x20], ebx
jmp 0x10019930
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x1001991e
mov dword [esp + 0x28], ebx
jmp 0x10019b18
mov dword [esp + 0x24], esi
mov dword [esp + 0x24], 0xfffffff0
jmp 0x10019aba
push esi
lea ecx, [esp + 0xa4]
call fcn.1001770e
mov dword [esp + 0x14], 0x2a3c
mov dword [esp + 0x20], 0xfffffffb
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], ebx
jmp 0x1001998e
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xa0]
mov dword [eax + ecx*4], 0xf25cbd94
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10019978
mov dword [esp + 0xc], ebx
jmp 0x100199a9
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x360], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001999a
mov eax, dword [esp + 0xa0]
mov dword [eax], ebx
mov dword [esp + 0x18], 8
mov dword [esp + 0x20], ebx
jmp 0x100199da
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x388], 0x2891ba80
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x100199c7
mov eax, dword [esp + 0x11c]
cmp dword [eax], ebx
je 0x100199f2
cmp dword [esp + 0x14], ebx
jne 0x100199f4
mov esi, ebx
mov ecx, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0xa0]
setg dl
xor ecx, ecx
cmp dword [eax], edx
sete cl
xor edx, edx
mov dword [esp + 0x390], ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], 0xbd3e
mov eax, dword [esp + 0xc]
mov dword [esp + 0x364], eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
cmp eax, ecx
setge dl
sub edx, dword [esp + 0x24]
mov dword [esp + 0x20], edx
xor edx, edx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x11c]
imul ecx, esi
imul ecx, dword [eax]
test ecx, ecx
mov dword [eax], ecx
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xa0]
cmp dword [ecx], eax
je 0x10019a96
cmp dword [esp + 0xc], ebx
mov ecx, dword [esp + 0xa0]
jne 0x10019a96
xor esi, esi
mov eax, ebx
inc esi
jmp 0x10019a9b
xor esi, esi
inc esi
mov eax, esi
inc dword [ecx]
cmp dword [ecx], 0x11
mov dword [esp + 0x18], eax
jne 0x100199b9
lea ecx, [esp + 0xa0]
call fcn.10017fa2
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff6
jle 0x10019951
mov dword [esp + 0xc], 7
jmp 0x10019b0d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019af5
push 0x2100
push 0x16e4
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019b09
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xa
jge 0x10019acf
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0xc
jl 0x10019940
or dword [esp + 0x3bc], 0xffffffff
lea ecx, [esp + 0x11c]
call fcn.10017fa2
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x1f8]
push 2
call fcn.1001770e
mov dword [esp + 0x14], 0xffff
mov dword [esp + 0x20], ebx
jmp 0x10019b6d
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1f8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x10019b5b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019b89
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0x18]
mov ecx, esi
mov eax, dword [esp + 0x1f8]
sub ecx, dword [eax]
je 0x10019b9e
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x1f8]
imul eax, dword [esp + 0x18]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x14], eax
call fcn.10017fa2
push dword [esp + 0x34]
movdqa xmm0, xmmword [0x10007e90]
lea eax, [esp + 0x334]
push eax
lea eax, [esp + 0x328]
mov dword [esp + 0x2c], 0xfffffffb
push eax
push ebx
lea ecx, [esp + 0x138]
mov dword [esp + 0x138], ebx
movdqu xmmword [esp + 0x330], xmm0
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebx
call fcn.10018ddb
push 2
mov dword [esp + 0x2c], 0xfffffff7
mov dword [esp + 0x2c], ebx
pop edi
cmp dword [esp + 0x28], 3
jg 0x10019c4e
mov dword [esp + 0x20], ebx
jmp 0x10019c37
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x26c], esi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10019c28
mov dword [esp + 0x26c], 0x462751c7
inc dword [esp + 0x28]
jmp 0x10019c1b
lea ecx, [esp + 0x128]
call fcn.10017fa2
push esi
lea ecx, [esp + 0x190]
call fcn.1001770e
mov dword [esp + 0x3bc], edi
mov eax, 0x967c74e2
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0x9e885dc1
mov dword [esp + 0x14], 0xc5c6a81d
mov dword [esp + 0x24], 0xd4f509e1
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x28], esi
mov dword [esp + 0x250], eax
mov dword [esp + 0x254], eax
mov dword [esp + 0x258], eax
mov dword [esp + 0x25c], eax
mov dword [esp + 0x18], 0xfffffffd
mov dword [esp + 0x20], ebx
jmp 0x10019cd8
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x8c], 0xfff6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10019cc5
mov ecx, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x1c]
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x1c]
mov dword [esp + 0x18], ebx
mov eax, dword [esp + 0x1c]
setg cl
dec edx
add edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x1c]
setl cl
mov dword [esp + 0x14], ecx
xor ecx, ecx
cmp dword [esp + 0x14], eax
setge cl
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov eax, dword [esp + 0x14]
cmp eax, 0xe249
setne cl
cmp dword [esp + 0x1c], ecx
jge 0x10019d58
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov edi, 0x54bc
neg ecx
mov eax, edi
sbb ecx, ecx
inc ecx
imul ecx, dword [esp + 0x1c]
sub eax, ecx
mov dword [esp + 0x1c], eax
je 0x10019d80
mov eax, esi
cmp dword [esp + 0x90], ebx
jne 0x10019d82
mov eax, ebx
mov dword [esp + 0x24], eax
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x8c]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x8c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x90]
cmp eax, 0xfffffffb
setge cl
mov dword [esp + 0x258], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], ebx
jmp 0x10019df6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019df2
push ebx
push 0x103c
push 0xc96
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0x2d
je 0x10019dc8
push esi
lea ecx, [esp + 0x19c]
call fcn.1001770e
mov byte [esp + 0x3bc], 3
mov dword [esp + 0x20], 0xa8eac8b
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019e2d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [esp + 0x20], 0xfffffff1
jmp 0x10019e4f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019e4b
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
je 0x10019e37
mov dword [esp + 0x1c], ebx
jmp 0x10019e6f
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2e0], 0xf088
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x10019e5c
push 3
lea ecx, [esp + 0x284]
call fcn.1001770e
mov byte [esp + 0x3bc], 4
lea ecx, [esp + 0x2b0]
mov dword [esp + 0x30], 0x64dc9ed9
push 3
call fcn.1001770e
mov byte [esp + 0x3bc], 5
mov dword [esp + 0x30], 0x52bf
mov dword [esp + 0x30], ebx
mov dword [esp + 0x18], 0xfffd
push 3
mov dword [esp + 0x34], 0x3164c116
mov dword [esp + 0x10], ebx
pop edx
jmp 0x10019ee5
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x280]
mov dword [eax + ecx*4], 0x9d29
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10019ecf
mov dword [esp + 0xc], ebx
jmp 0x10019f03
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x2b0]
mov dword [eax + ecx*4], esi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10019ef1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019f1b
push ebx
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x274]
mov dword [esp + 0x30], esi
push 4
call fcn.1001770e
mov dword [esp + 0x30], ebx
mov dword [esp + 0x20], ebx
jmp 0x10019f55
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x274]
mov dword [eax + ecx*4], 0x85faafe3
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x10019f3f
inc dword [esp + 0x18]
lea ecx, [esp + 0x274]
call fcn.10017fa2
lea ecx, [esp + 0x2b0]
call fcn.10017fa2
lea ecx, [esp + 0x280]
mov byte [esp + 0x3bc], 3
call fcn.10017fa2
mov dword [esp + 0x1c], ebx
jmp 0x10019fa8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18c]
mov dword [eax + ecx*4], 0x34f1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10019f92
push 3
lea ecx, [esp + 0xec]
call fcn.1001770e
mov dword [esp + 0xc], 0xef7d2668
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], 0x4e58
mov dword [esp + 0x14], 0x2d683a7e
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], ebx
jmp 0x10019ff8
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0x79753589
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10019fe2
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, esi
setge cl
sub ecx, dword [esp + 0x1c]
je 0x1001a020
mov eax, dword [esp + 0xe8]
cmp dword [eax + 8], ebx
je 0x1001a020
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], ebx
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x1c]
jne 0x1001a040
cmp dword [esp + 0x1c], ebx
jne 0x1001a040
mov eax, ebx
cmp dword [esp + 0xc], ebx
je 0x1001a042
mov eax, esi
mov esi, dword [esp + 0xe8]
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 4]
cmp eax, edx
setl cl
xor eax, eax
cmp ecx, edx
mov ecx, 0xffff
setge al
neg eax
cmp eax, ecx
jb 0x1001a077
cmp dword [esp + 0x1c], ebx
jne 0x1001a077
mov eax, ebx
jmp 0x1001a07a
xor eax, eax
inc eax
cmp eax, dword [esp + 0x1c]
jl 0x1001a099
mov dword [esp + 0x18], ecx
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
jmp 0x1001a17f
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebx
jmp 0x1001a15d
mov dword [esp + 0x2c], 0xae2ad21d
mov eax, dword [esp + 0x24]
cmp eax, dword [esi + 4]
je 0x1001a10a
mov dword [esp + 0x28], 0x57a8360e
mov dword [esp + 0x20], 0x401cea02
cmp dword [esp + 0x2c], ebx
jne 0x1001a0f6
mov eax, dword [esp + 0xc]
xor edx, edx
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
cmp eax, ecx
setg dl
add edx, dword [esp + 0x18]
jne 0x1001a0f6
mov edx, ebx
jmp 0x1001a0f9
xor edx, edx
inc edx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x2c], ecx
jmp 0x1001a11f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a11f
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov dword [esp + 0xc], 2
cmp dword [esp + 0xc], ebx
jl 0x1001a159
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a153
push 0x11ba
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
dec dword [esp + 0xc]
jns 0x1001a12d
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe3
je 0x1001a0ae
mov dword [esp + 0x1c], ebx
jmp 0x1001a178
cmp dword [esp + 0x14], ebx
jne 0x1001a17f
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffff
je 0x1001a16e
mov dword [esp + 0xc], ebx
jmp 0x1001a19b
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0x8d3b3e24
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001a185
lea ecx, [esp + 0xe8]
call fcn.10017fa2
xor esi, esi
mov dword [esp + 0x1c], ebx
inc esi
jmp 0x1001a1cd
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 0x4b664fb7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001a1b7
mov dword [esp + 0x24], ebx
mov dword [esp + 0xc], 0xf2bac411
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x1001a1fd
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x48], 0x69fdf99f
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1001a1ed
mov dword [esp + 0x48], 0x1b
cmp dword [esp + 0x48], 0xfffffff1
jne 0x1001a50f
push dword [esp + 0x34]
movdqa xmm0, xmmword [0x10007e10]
lea eax, [esp + 0x314]
push eax
lea eax, [esp + 0x308]
mov dword [esp + 0x78], ebx
push eax
push ebx
lea ecx, [esp + 0x80]
mov dword [esp + 0x84], ebx
movdqu xmmword [esp + 0x310], xmm0
mov dword [esp + 0x88], ebx
call fcn.10018ddb
mov dword [esp + 0x20], 0x18ebdb8
cmp dword [esp + 0x48], ebx
jne 0x1001a2a9
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x70]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov esi, dword [eax]
mov eax, dword [esp + 0x50]
cmp edx, eax
mov edx, dword [esp + 0x70]
setne cl
xor eax, eax
cmp ecx, dword [edx + 0xc]
setge al
sub eax, 0xfffd
neg eax
sbb eax, eax
inc eax
cmp eax, esi
jne 0x1001a2a2
test esi, esi
jne 0x1001a2af
xor esi, esi
mov ecx, ebx
inc esi
jmp 0x1001a2b4
mov edx, dword [esp + 0x70]
jmp 0x1001a2b2
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
cmp ecx, 0x507e
push 0xfffffffffffffff8
setg al
xor ecx, ecx
cmp eax, dword [edx]
pop eax
setl cl
sub eax, ecx
jne 0x1001a2d3
cmp dword [edx], eax
mov eax, ebx
je 0x1001a2d5
mov eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x48]
je 0x1001a3ba
mov dword [esp + 0x18], 0xce5aba8d
mov dword [esp + 0x20], ebx
jmp 0x1001a308
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x160], 5
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1001a2f5
cmp dword [esp + 0x18], ebx
je 0x1001a34b
mov eax, dword [esp + 0x18]
sub eax, 2
cmp eax, 0xa82b5dfe
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
cmp ecx, eax
mov eax, ebx
setl dl
cmp edx, 0x380d
jge 0x1001a343
mov eax, esi
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], 0x2308dcf7
mov ecx, dword [esp + 0xc]
sub ecx, 0xfff7
mov edx, dword [esp + 0x70]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffff7
mov ecx, 0x8ca0e2c2
setne al
neg eax
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x164]
cmp dword [edx + 8], eax
setle cl
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
neg ecx
sbb ecx, ecx
neg ecx
add eax, ecx
mov ecx, dword [esp + 0x4c]
imul ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x160], ecx
jmp 0x1001a4f2
mov dword [esp + 0x1c], 0xa536ca9a
mov dword [esp + 0xc], ebx
jmp 0x1001a447
mov dword [esp + 0x2c], 3
xor edx, edx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x70]
cmp dword [eax + ecx*4], 2
sete dl
neg edx
mov dword [esp + 0x1c], edx
je 0x1001a43a
mov eax, dword [esp + 0xc]
xor edx, edx
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0xc]
mov ecx, dword [esp + 0x70]
mov eax, dword [esp + 0x14]
cmp eax, dword [ecx + esi*4]
mov eax, dword [esp + 0x70]
setle dl
xor ecx, ecx
cmp edx, dword [eax + edi*4]
mov edx, dword [esp + 0x50]
setne cl
imul edx, ecx
neg edx
sbb edx, edx
xor eax, eax
neg edx
cmp edx, 0x416a781b
sete al
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
je 0x1001a43a
xor esi, esi
inc esi
mov eax, esi
jmp 0x1001a43f
xor esi, esi
mov eax, ebx
inc esi
mov dword [esp + 0x2c], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jle 0x1001a3c8
push 9
pop edx
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], 0xffffffe9
jge 0x1001a4f2
push 0x16
pop ecx
mov dword [esp + 0xc], 0x6ab0c02e
cmp dword [esp + 0xc], ebx
jne 0x1001a4f2
mov dword [esp + 0xc], ecx
jmp 0x1001a4dd
mov dword [esp + 0x28], 0xfffa
mov dword [esp + 0x2c], 0xfffffff7
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], edx
jmp 0x1001a4d2
mov dword [esp + 0x2c], 0x2395
mov dword [esp + 0x24], 0xffffffee
jmp 0x1001a4c7
mov dword [esp + 0x2c], 0xedc16971
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffffb
jle 0x1001a4bb
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0x34
jg 0x1001a4a9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jle 0x1001a47b
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe9
jl 0x1001a467
lea ecx, [esp + 0x70]
call fcn.10017fa2
dec dword [esp + 0x48]
cmp dword [esp + 0x48], 0xfffffff1
je 0x1001a217
mov edi, 0x54bc
mov dword [esp + 0x24], 0x17
jmp 0x1001a999
mov dword [esp + 0x2c], 0xfffffff8
lea ecx, [esp + 0x1c8]
push esi
call fcn.1001770e
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001a54e
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xd0], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001a53f
mov dword [esp + 0xc], ebx
jmp 0x1001a56e
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001a55b
mov dword [esp + 0xd8], ebx
jmp 0x1001a5a2
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c8]
neg ecx
mov dword [eax], ecx
xor eax, eax
cmp ecx, 0xfe1
setl al
mov dword [esp + 0x18], eax
inc dword [esp + 0xd8]
cmp dword [esp + 0xd8], 0xd
jl 0x1001a57d
lea ecx, [esp + 0x1c8]
call fcn.10017fa2
mov dword [esp + 0x28], 0x3fbb
lea ecx, [esp + 0x228]
mov dword [esp + 0x14], 0xcb8ce3e6
mov dword [esp + 0x18], 0x5d2d9150
push esi
call fcn.1001770e
mov dword [esp + 0x2c], 0x44cf5927
mov dword [esp + 0x30], 0x40a16501
mov dword [esp + 0x14], ebx
jmp 0x1001a609
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x228]
mov dword [eax + ecx*4], 0xa6c9cd49
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001a5f3
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], esi
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x14]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x228]
setge dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x28]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x3622ba39
lea ecx, [esp + 0x228]
setge al
mov dword [esp + 0x2c], eax
call fcn.10017fa2
mov dword [esp + 0x20], 0x9b389519
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x2c], 0x6d4c01e0
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], 0xa1a8f1ed
push esi
call fcn.1001770e
mov dword [esp + 0x2c], esi
mov dword [esp + 0x14], ebx
jmp 0x1001a6c2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], 0x3d478254
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001a6ac
mov dword [esp + 0x1c], ebx
jmp 0x1001a762
mov dword [esp + 0x18], 0x8939f5fa
mov dword [esp + 0x14], 0x6cd33356
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
sub edx, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp edx, eax
mov eax, dword [esp + 0x18]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, 5
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
cmp eax, 0xedb6
mov eax, dword [esp + 0x1e0]
setle cl
mov dword [eax], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
add eax, 2
mov dword [esp + 0x2c], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1001a6d1
mov dword [esp + 0x1c], ebx
jmp 0x1001a77f
mov dword [esp + 0x18], 0x323fa9df
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff9
je 0x1001a773
lea ecx, [esp + 0x1e0]
call fcn.10017fa2
mov dword [esp + 0x14], ebx
jmp 0x1001a7a8
cmp dword [esp + 0x24], 0xfffffffd
jle 0x1001a51c
lea ecx, [esp + 0x198]
call fcn.10017fa2
or dword [esp + 0x3bc], 0xffffffff
lea ecx, [esp + 0x18c]
call fcn.10017fa2
mov dword [esp + 0x2c], 0xfffffff8
lea ecx, [esp + 0x1bc]
push esi
call fcn.1001770e
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x1001a9f6
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xac], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001a9e7
mov dword [esp + 0xc], ebx
jmp 0x1001aa16
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1bc]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001aa03
mov dword [esp + 0xb4], ebx
jmp 0x1001aa4a
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1bc]
neg ecx
mov dword [eax], ecx
xor eax, eax
cmp ecx, 0xfe1
setl al
mov dword [esp + 0x18], eax
inc dword [esp + 0xb4]
cmp dword [esp + 0xb4], 0xd
jl 0x1001aa25
lea ecx, [esp + 0x1bc]
call fcn.10017fa2
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x14], ebx
jmp 0x1001aa81
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x168], 0x26bdde0b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001aa6e
mov dword [esp + 0xc], esi
cmp dword [esp + 0xc], ebx
jl 0x1001ab21
push dword [esp + 0x34]
movdqa xmm0, xmmword [0x10007e00]
lea eax, [esp + 0x304]
push eax
lea eax, [esp + 0x2f8]
mov dword [esp + 0xc0], ebx
push eax
push ebx
lea ecx, [esp + 0xc8]
mov dword [esp + 0xcc], ebx
movdqu xmmword [esp + 0x300], xmm0
mov dword [esp + 0xd0], ebx
call fcn.10018ddb
mov ecx, dword [esp + 0xb8]
mov dword [ecx + 4], esi
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x168], ebx
jne 0x1001aaf9
dec dword [ecx + 4]
jns 0x1001aae7
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ab0b
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [esp + 0xb8]
call fcn.10017fa2
dec dword [esp + 0xc]
jns 0x1001aa96
mov dword [esp + 0xc], ebx
jmp 0x1001ab92
mov dword [esp + 0x14], 7
mov dword [esp + 0x14], ebx
jmp 0x1001ab87
mov dword [esp + 0x24], 0x28fdeb77
mov dword [esp + 0x24], ebx
jmp 0x1001ab5f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ab5b
push ebx
push 0x536
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jle 0x1001ab43
mov dword [esp + 0x24], 0xd
jmp 0x1001ab7c
cmp dword [esp + 0x24], 2
jle 0x1001ab6f
cmp dword [esp + 0x14], 0x19
jl 0x1001ab35
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xfffffff9
jne 0x1001ab27
mov dword [esp + 0x18], 0xffffffff
lea ecx, [esp + 0x260]
push esi
call fcn.1001770e
mov dword [esp + 0x2c], 0x76ab2aee
mov dword [esp + 0x14], ebx
jmp 0x1001abd2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x260]
mov dword [eax + ecx*4], 0x9f30cc2f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001abbc
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001abf0