Function at 0x1001cf51
Capabilities:
Get disk information
Resolve function by parsing pe exports
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10090150
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x280
push ebx
push esi
push edi
mov dword [esp + 0x54], ecx
lea ecx, [esp + 0x184]
mov dword [esp + 0xc], 0xc755
mov dword [esp + 0x14], 0x173bf38c
push 3
mov dword [esp + 0xac], edx
call fcn.1001b24b
xor ebx, ebx
lea ecx, [esp + 0x124]
mov dword [esp + 0x294], ebx
or edi, 0xffffffff
mov dword [esp + 0x1c], edi
mov dword [esp + 0x38], 0x1832d748
push 1
call fcn.1001b24b
mov dword [esp + 0x14], ebx
jmp 0x1001cfdc
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x184]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001cfca
mov dword [esp + 0x14], ebx
jmp 0x1001cffb
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001cfe9
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, 0x9ac1
mov eax, dword [esp + 0xc]
setg cl
sub eax, ecx
mov dword [esp + 0x14], eax
jne 0x1001d048
cmp dword [esp + 0x14], ebx
jne 0x1001d048
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0xc]
sub eax, dword [esp + 0xc]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov dword [esp + 0xc], ebx
jmp 0x1001d064
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001d060
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x1001d04e
mov eax, dword [esp + 0xc]
mov ecx, 0x99b5f277
cmp ecx, eax
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x184]
cmp dword [eax + 8], edx
setle cl
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x38]
neg ecx
sbb ecx, ecx
sub eax, 0x70e9879a
inc ecx
neg eax
sbb eax, eax
inc eax
add ecx, eax
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x124]
mov dword [eax], ecx
lea ecx, [esp + 0x124]
call fcn.1001b2cd
lea ecx, [esp + 0x184]
mov dword [esp + 0x294], edi
call fcn.1001b2cd
xor eax, eax
mov dword [esp + 0x30], 0x15256ee9
inc eax
lea ecx, [esp + 0x98]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x24], eax
push 2
call fcn.1001b24b
mov dword [esp + 0x294], 1
mov dword [esp + 0x14], 0xd7f825e7
mov dword [esp + 0x20], 0x5b3b9da4
mov dword [esp + 0x10], 0xa4d91f06
mov dword [esp + 0x14], ebx
jmp 0x1001d13b
mov dword [esp + 0x20], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x10
jle 0x1001d12f
mov dword [esp + 0x14], 0x11
cmp dword [esp + 0x14], 5
je 0x1001d342
push 4
lea ecx, [esp + 0xd8]
call fcn.1001b24b
mov byte [esp + 0x294], 2
lea ecx, [esp + 0x160]
mov dword [esp + 0xc], 0xcb81eca6
push 2
call fcn.1001b24b
mov dword [esp + 0x28], 0x20578cca
mov dword [esp + 0x38], 0xfffffffd
mov dword [esp + 0xc], ebx
jmp 0x1001d1ad
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], 0xfffa
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001d197
push 2
mov dword [esp + 0x10], ebx
pop edx
jmp 0x1001d1d3
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 1
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001d1bd
mov dword [esp + 0xc], ebx
jmp 0x1001d1f2
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x84], 0x44d4e2b7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001d1df
mov edi, dword [esp + 0xd4]
mov dword [esp + 0x20], ebx
mov dword [esp + 0xc], 0xc218
mov eax, dword [edi + 0xc]
add eax, 0xb9c2
cmp eax, dword [esp + 0xc]
jl 0x1001d21d
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x160]
sub ecx, 0x2f1e
neg ecx
sbb ecx, ecx
add ecx, 0xd4b4a565
mov dword [eax + 4], ecx
mov dword [esp + 0x28], ecx
xor ecx, ecx
mov eax, dword [esp + 0x28]
cmp eax, dword [edi + 0xc]
mov dword [esp + 0x84], eax
setne cl
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 0xfffffff1
jmp 0x1001d305
mov dword [esp + 0x20], 0x65721867
mov dword [esp + 0x24], 0x8bc13026
cmp dword [esp + 0x20], ebx
jne 0x1001d27d
mov esi, ebx
jmp 0x1001d280
xor esi, esi
inc esi
cmp dword [esp + 0x20], ebx
je 0x1001d2e0
mov eax, dword [esp + 0x88]
xor edx, edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x84]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x84]
imul ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xd4]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x20]
setl dl
sub edx, eax
add edx, dword [esp + 0x10]
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x28]
add eax, 0x5c8b
je 0x1001d2e0
xor eax, eax
inc eax
jmp 0x1001d2e2
mov eax, ebx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
xor eax, eax
cmp dword [edi + 0xc], 7
setg al
sub esi, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], 0x1eb1ed30
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xe
jne 0x1001d263
lea ecx, [esp + 0x160]
call fcn.1001b2cd
lea ecx, [esp + 0xd4]
mov byte [esp + 0x294], 1
call fcn.1001b2cd
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 5
jne 0x1001d155
or edi, 0xffffffff
mov dword [esp + 0x10], 0xc7fffaa2
lea ecx, [esp + 0xec]
mov dword [esp + 0x44], 0xf0e77da1
push 4
call fcn.1001b24b
mov dword [esp + 0x10], 0x65ab3e90
mov dword [esp + 0x38], 0xc3f30b91
mov dword [esp + 0x10], ebx
jmp 0x1001d388
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001d376
mov edx, dword [esp + 0xec]
mov dword [edx + 8], ebx
mov dword [esp + 0x10], 0xffffffe8
cmp dword [esp + 0x10], 4
jle 0x1001d419
mov ecx, dword [esp + 0xec]
mov dword [esp + 0x14], 0x2a8d3a18
mov dword [esp + 0x38], 0x271dbca
cmp dword [ecx + 0xc], ebx
je 0x1001d3fe
mov dword [esp + 0x20], 0x7dfe4d9e
mov eax, dword [esp + 0x20]
mov dword [ecx + 0xc], eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x20], ebx
jne 0x1001d3f8
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x38], ebx
jmp 0x1001d40e
mov dword [esp + 0x38], 0xd996
mov eax, dword [esp + 0x38]
mov dword [esp + 0x38], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jg 0x1001d3af
lea ecx, [esp + 0xec]
call fcn.1001b2cd
push dword [esp + 0x54]
movdqa xmm0, xmmword [0x10009260]
lea eax, [esp + 0x240]
push eax
lea eax, [esp + 0x234]
mov dword [esp + 0x60], 0x67606e82
push eax
push ebx
lea ecx, [esp + 0x114]
mov dword [esp + 0x114], ebx
movdqu xmmword [esp + 0x23c], xmm0
mov dword [esp + 0x118], ebx
mov dword [esp + 0x11c], ebx
call fcn.1001c750
mov dword [esp + 0x14], 7
push 3
mov dword [esp + 0x48], 2
pop eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x14], eax
push 8
pop esi
cmp dword [esp + 0x14], ebx
jl 0x1001d4f1
mov dword [esp + 0x20], 0x2e31d832
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jl 0x1001d4eb
mov dword [esp + 0x10], 0x6715f0ed
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
jl 0x1001d4e5
mov dword [esp + 0x28], esi
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001d4d8
push 0x2fa
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
inc dword [esp + 0x28]
dec dword [esp + 0x10]
jns 0x1001d4bc
push 3
pop eax
dec dword [esp + 0x20]
jns 0x1001d4aa
dec dword [esp + 0x14]
jns 0x1001d498
lea ecx, [esp + 0x104]
call fcn.1001b2cd
mov dword [esp + 0x38], 0x503b5b0d
lea ecx, [esp + 0x1c0]
mov dword [esp + 0x44], 0xfffffffd
mov dword [esp + 0x34], 7
mov dword [esp + 0xc], 0x7eede0b4
mov dword [esp + 0x20], 0xe7c1
mov dword [esp + 0x10], 0x2104
push 4
call fcn.1001b24b
push 4
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001d553
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x190], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001d544
mov dword [esp + 0x14], ebx
jmp 0x1001d575
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c0]
mov dword [eax + ecx*4], 0x94dfd996
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001d55f
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0xc]
jle 0x1001d589
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, 0x1d25
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
sub ecx, eax
add ecx, dword [esp + 0xc]
add ecx, dword [esp + 0xc]
mov dword [esp + 0x194], ecx
mov dword [esp + 0xc], ebx
jmp 0x1001d64e
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x190], ebx
je 0x1001d5ea
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001d5f9
push 0x39e
push ebx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
jmp 0x1001d5f9
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x190], 0xfffffff7
mov dword [esp + 0x20], ebx
jmp 0x1001d643
mov dword [esp + 0x10], 3
cmp dword [esp + 0x10], ebx
jl 0x1001d63f
mov eax, dword [esp + 0xc]
cmp dword [esp + eax*4 + 0x190], ebx
jne 0x1001d63f
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001d639
push 0xc4c
push ebx
push ebx
push ebx
push 0x10b1
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
dec dword [esp + 0x10]
jns 0x1001d60d
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffffd
je 0x1001d5ff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jle 0x1001d5c4
lea ecx, [esp + 0x1c0]
call fcn.1001b2cd
push 3
lea ecx, [esp + 0x170]
call fcn.1001b24b
mov byte [esp + 0x294], 3
mov dword [esp + 0xc], 0xfffffffe
mov dword [esp + 0x10], 0x2978
mov dword [esp + 0x24], 0x33920027
mov dword [esp + 0x28], 0x9c5a
mov dword [esp + 0x10], ebx
jmp 0x1001d6b0
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1dc], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001d6a1
cmp dword [esp + 0xc], ebx
jne 0x1001d6d1
mov eax, dword [esp + 0xc]
mov edx, ebx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
jmp 0x1001d6d4
xor edx, edx
inc edx
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc]
setne cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp eax, edx
setg cl
add ecx, 0x3ec9
mov dword [esp + 0x10], ecx
cmp dword [esp + 0xc], ebx
jne 0x1001d74b
cmp dword [esp + 0x10], ebx
jne 0x1001d74b
mov eax, dword [esp + 0x28]
inc dword [esp + 0x28]
cmp eax, 0x8f9c3281
je 0x1001d723
xor ecx, ecx
inc ecx
jmp 0x1001d725
mov ecx, ebx
mov eax, dword [esp + 0x1e4]
xor edx, edx
add eax, 2
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp dword [esp + 0xc], ecx
je 0x1001d74b
mov ecx, ebx
jmp 0x1001d74e
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x1e0]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
mov dword [esp + 0xc], 0xd7f7ffff
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], 0x8f6f7e70
mov dword [esp + 0x14], ebx
jmp 0x1001d795
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3c], 0xaf1124f0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001d785
mov dword [esp + 0x14], ebx
jmp 0x1001d7b2
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x48], 0xf2c29a3d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001d7a2
mov dword [esp + 0x50], ebx
jmp 0x1001d910
mov dword [esp + 0x20], 0x67215912
mov dword [esp + 0x10], 0xa553fc2f
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x1001d90c
mov dword [esp + 0x14], 0xcc254292
mov ecx, 0xc25fcc58
mov eax, dword [esp + 0x50]
mov eax, dword [esp + eax*4 + 0x3c]
sub ecx, eax
je 0x1001d864
mov dword [esp + 0x10], 0x89226c31
xor edx, edx
mov eax, dword [esp + 0x50]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + eax*4 + 0x3c]
test eax, eax
mov eax, dword [esp + 0x50]
setg dl
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x3c]
cmp eax, edx
mov eax, dword [esp + 0x14]
setne cl
add eax, ecx
cmp dword [esp + 0x10], eax
jge 0x1001d83d
cmp dword [esp + 0x20], ebx
jne 0x1001d83d
mov eax, ebx
jmp 0x1001d840
xor eax, eax
inc eax
mov ecx, dword [esp + 0x10]
cmp eax, 0x8d383303
sbb eax, eax
add eax, 0x98ca95f6
neg eax
sbb eax, eax
inc eax
sub ecx, eax
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x3c], ecx
jmp 0x1001d902
mov dword [esp + 0x10], 0x8fe2d584
mov dword [esp + 0x10], ebx
jmp 0x1001d885
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x148], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001d872
mov eax, dword [esp + 0x150]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x14c]
cmp dword [esp + 0x50], 1
jl 0x1001d8b5
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x20]
sub edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x50]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov eax, dword [esp + eax*4 + 0x3c]
cmp eax, edx
setg cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x14c]
mov eax, dword [esp + 0x3c]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
dec dword [esp + 0x20]
jns 0x1001d7e0
inc dword [esp + 0x50]
cmp dword [esp + 0x50], ebx
jle 0x1001d7c2
cmp dword [esp + 0x4c], ebx
jne 0x1001d92c
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x48]
cmp dword [esp + 0x28], ebx
je 0x1001d93e
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x48]
sub ecx, eax
mov eax, 0xe4a47bfe
cmp eax, ecx
sbb eax, eax
inc eax
sub edx, eax
neg edx
sbb edx, edx
add edx, 0xffffc22b
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [esp + 0x50], edx
mov eax, dword [esp + 0x3c]
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, edi
setg al
cmp eax, 2
jae 0x1001d98c
cmp dword [esp + 0x24], ebx
jne 0x1001d98c
mov ecx, ebx
jmp 0x1001d98f
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x24]
push dword [esp + 0x54]
movdqa xmm0, xmmword [0x100091c0]
imul eax, ecx
lea ecx, [esp + 0x60]
movdqu xmmword [esp + 0x210], xmm0
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x10], eax
lea eax, [esp + 0x220]
push eax
lea eax, [esp + 0x214]
mov dword [esp + 0x4c], 1
push eax
push ebx
call fcn.1001c750
mov dword [esp + 0xc], edi
mov dword [esp + 0x20], 0x4cbed562
mov dword [esp + 0x24], 0xf0ed6937
mov dword [esp + 0x24], 0x5c2f0027
mov dword [esp + 0x24], ebx
mov dword [esp + 0xc], ebx
jmp 0x1001dba9
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], ebx
mov dword [esp + 0x28], 0xfffffff9
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
cmp dword [eax + ecx*4], ebx
je 0x1001da8c
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
push 0xfffffffffffffff6
mov eax, dword [eax + ecx*4]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x60]
mov eax, dword [esi + eax*4]
cmp eax, dword [esi + edx*4]
pop eax
setge cl
sub ecx, 0x4cd021a
cmp eax, ecx
mov eax, dword [esp + 0xc]
sbb ecx, ecx
inc ecx
imul ecx, dword [esi + edi*4]
imul eax, ecx
add eax, 7
or edi, 0xffffffff
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], 0x39663a4
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
mov edx, dword [esp + 0x24]
sub edx, dword [eax + ecx*4]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, edi
setg al
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ebx
je 0x1001db7d
mov dword [esp + 0x34], 0xffff
mov dword [esp + 0x24], 0xe16851cc
mov dword [esp + 0x10], ebx
jmp 0x1001dafe
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x25c], 0x691445a1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001daeb
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001db23
push ebx
push ebx
push 0x21bc
push 0x8ba
push ebx
call dword [sym.imp.USER32.dll_ModifyMenuW]
cmp dword [esp + 0x14], ebx
jne 0x1001db69
mov dword [esp + 0x10], 0xbc92cebb
cmp dword [esp + 0x10], 0x6c1f5e2d
jg 0x1001db65
mov esi, dword [esp + 0xc]
xor ecx, ecx
mov edx, dword [esp + 0x5c]
mov eax, dword [esp + 0x34]
cmp eax, dword [edx + esi*4]
setl cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
neg eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x5c]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x268], eax
jmp 0x1001dba5
mov dword [esp + 0x24], 0xc334
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jle 0x1001da06
lea ecx, [esp + 0x5c]
call fcn.1001b2cd
mov dword [esp + 0x14], 0xf951fe7
mov dword [esp + 0x10], ebx
jmp 0x1001dbd7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x7c], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001dbcb
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, dword [esp + 0x14]
jl 0x1001dbff
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
xor edx, edx
mov dword [esp + 0x7c], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], 0x8ed7c3b7
mov dword [esp + 0x34], edi
mov eax, dword [esp + 0x7c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x7c]
mov eax, dword [esp + 0x10]
add eax, 0xbc3360e7
add ecx, eax
mov dword [esp + 0x7c], ecx
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
xor edx, edx
imul ecx, dword [esp + 0x14]
neg ecx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setg dl
mov dword [esp + 0x34], edx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001dc89
push ebx
push ebx
push 0x1294
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001dca2
push 0x5ac
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov dword [esp + 0x2c], ebx
jmp 0x1001dcb8
mov eax, dword [esp + 0x2c]
mov dword [esp + eax*4 + 0x40], 0x37c0
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 1
jl 0x1001dca8
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x30]
push eax
push ebx
push 0x15e9
push 0x7218
call fcn.10022435
movdqa xmm0, xmmword [0x100091b0]
lea eax, [esp + 0x240]
add esp, 0x14
mov dword [esp + 0xc], 6
lea ecx, [esp + 0x8c]
mov dword [esp + 0x8c], ebx
movdqu xmmword [esp + 0x21c], xmm0
mov dword [esp + 0x90], ebx
push dword [esp + 0x54]
mov dword [esp + 0x98], ebx
push eax
lea eax, [esp + 0x224]
push eax
push ebx
call fcn.1001c750
mov byte [esp + 0x294], 4
xor ecx, ecx
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
test eax, eax
push 0xfffffffffffffffa
setg cl
xor eax, eax
cmp ecx, 0x22a149ce
pop esi
setl al
cmp eax, 0xc0bf
jle 0x1001df6b
push 4
lea ecx, [esp + 0xe4]
call fcn.1001b24b
mov dword [esp + 0x20], 1
push 4
mov dword [esp + 0x2c], 0xfffffffd
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001dd97
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001dd85
mov dword [esp + 0x14], ebx
jmp 0x1001ddb6
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xd0], 0xe735
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001dda3
mov dword [esp + 0xc], 3
cmp dword [esp + 0xc], ebx
jl 0x1001de9c
mov dword [esp + 0x10], edx
mov dword [esp + 0x10], ebx
jmp 0x1001dde9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x68], 0xe815
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001ddd9
mov dword [esp + 0x10], 3
cmp dword [esp + 0x10], ebx
jl 0x1001de92
mov dword [esp + 0x24], 0x59ec1348
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001de1b
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x68]
cmp esi, eax
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe0]
sbb esi, esi
inc esi
xor edx, edx
mov dword [eax + ecx*4], esi
mov eax, dword [esp + 0x68]
cmp eax, esi
mov eax, dword [esp + 0xc]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xd0]
cmp ecx, eax
setne dl
sub edx, 6
jne 0x1001de75
cmp dword [esp + 0x10], ebx
jne 0x1001de75
mov ecx, ebx
jmp 0x1001de78
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0xc]
add eax, ecx
mov dword [esp + 0x20], eax
dec dword [esp + 0x10]
push 0xfffffffffffffffa
pop esi
jns 0x1001de02
push 4
pop edx
dec dword [esp + 0xc]
jns 0x1001ddcf
mov dword [esp + 0x20], 0xffffffea
cmp dword [esp + 0x20], 0xfffffff0
jg 0x1001df5d
jmp 0x1001deb4
push 4
pop edx
mov dword [esp + 0x34], 0x9919139f
mov dword [esp + 0x10], ebx
jmp 0x1001ded5
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1b0], 0x35e45db0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001dec2
cmp dword [esp + 0x1b8], ebx
je 0x1001df2a
mov eax, dword [esp + 0xe0]
xor edx, edx
mov ecx, dword [esp + 0x1b8]
push 0
mov dword [eax + 0xc], ebx
mov eax, dword [esp + 0x1bc]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setle dl
sub edx, eax
xor eax, eax
cmp edx, 1
setge al
sub eax, dword [esp + 0x24]
add eax, 0xd
neg eax
sbb eax, eax
inc eax
pop eax
setns al
mov dword [esp + 0x1b8], eax
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x2495
setl al
mov dword [esp + 0x28], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff0
jle 0x1001deb1
lea ecx, [esp + 0xe0]
call fcn.1001b2cd
jmp 0x1001df7c
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001df7c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [esp + 0xc], ebx
jmp 0x1001dfb0
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x8c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x8c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jle 0x1001df82
lea ecx, [esp + 0x8c]
mov byte [esp + 0x294], 3
call fcn.1001b2cd
mov dword [esp + 0x2c], ebx
jmp 0x1001dfe7
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x16c]
mov dword [eax + ecx*4], 0x422f8dc7
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 3
jl 0x1001dfd1
mov dword [esp + 0x2c], ebx
jmp 0x1001e003
mov eax, dword [esp + 0x2c]
mov dword [esp + eax*4 + 0xb8], edi
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 2
jl 0x1001dff4
mov dword [esp + 0x2c], ebx
jmp 0x1001e023
mov eax, dword [esp + 0x2c]
mov dword [esp + eax*4 + 0x23c], 0xffff
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 4
jl 0x1001e010
mov dword [esp + 0xc], 9
lea ecx, [esp + 0xf8]
mov dword [esp + 0x10], 1
push 3
call fcn.1001b24b
mov byte [esp + 0x294], 5
mov dword [esp + 0x34], 0xe338ae63
mov dword [esp + 0x14], ebx
jmp 0x1001e074
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0xc46bc227
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001e05e
mov dword [esp + 0x14], ebx
jmp 0x1001e090
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x110], edi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001e081
push 0x19
pop edi
cmp dword [esp + 0xc], ebx
je 0x1001e16f
xor ecx, ecx
mov dword [esp + 0x20], 0x87f2
mov dword [esp + 0x34], 0xd926128f
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0x1031
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0x20]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0xc]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setle cl
sub ecx, 2
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
xor ecx, ecx
imul edx, dword [esp + 0xc]
mov eax, dword [esp + 0x34]
cmp edx, eax
mov eax, dword [esp + 0x10]
setne cl
xor edx, edx
cmp eax, ecx
setne dl
sub edx, 0x3d87e3bc
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0x59ea
setle al
xor ecx, ecx
cmp eax, 0x735e
mov eax, dword [esp + 0xf8]
setle cl
xor edx, edx
cmp ecx, dword [eax + 8]
setg dl
mov dword [esp + 0x34], edx
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [esp + 0x34]
cmp edx, eax
setle cl
mov dword [esp + 0x28], ecx
jmp 0x1001e2e1
mov dword [esp + 0x14], 0xfffffffd
mov dword [esp + 0xc], 0xb
cmp dword [esp + 0xc], edi
jle 0x1001e2e1
mov esi, dword [esp + 0xf8]
push 2
lea ecx, [esp + 0x17c]
call fcn.1001b24b
mov dword [esp + 0x20], 5
mov dword [esp + 0x24], 0x3fee22e7
mov dword [esp + 0x24], 4
mov dword [esp + 0x24], 0xcae1
mov dword [esp + 0x10], ebx
jmp 0x1001e1d6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001e1c4
mov dword [esp + 0x10], 0xfffffffa
cmp dword [esp + 0x10], ebx
je 0x1001e220
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp dword [esi + 8], 0x23d12ef6
setne cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x5201
setl cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
imul eax, dword [esp + 0x14]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x114]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x178]
mov eax, dword [esp + 0x14]
cmp eax, dword [ecx + 4]
mov eax, dword [esp + 0x20]
setl dl
xor ecx, ecx
cmp edx, dword [esi + 8]
setne cl
xor edx, edx
add eax, ecx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setl dl
cmp edx, dword [esi + 8]
jl 0x1001e29a
mov dword [esp + 0x24], 0x7f9cd946
mov dword [esp + 0x24], 0xa5bdb26f
jmp 0x1001e2c7
mov dword [esp + 0x24], 0x294ba750
mov dword [esp + 0x20], ebx
jmp 0x1001e2c0
mov dword [esp + 0x28], 0x3c4fb361
mov dword [esp + 0x28], 0x4d67785d
inc dword [esp + 0x24]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0xc
je 0x1001e2a8
lea ecx, [esp + 0x178]
call fcn.1001b2cd
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jg 0x1001e190
lea ecx, [esp + 0xf8]
mov byte [esp + 0x294], 3
call fcn.1001b2cd
mov ecx, dword [esp + 0x40]
xor edx, edx
mov eax, dword [esp + 0x40]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x934f
setl al
cmp dword [esp + 0x40], eax
jl 0x1001e329
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x40]
xor ecx, ecx
add eax, 0x9102
mov dword [esp + 0x30], eax
mov edx, dword [esp + 0x40]
mov eax, dword [esp + 0x30]
imul edx, eax
mov eax, dword [esp + 0x40]
cmp edx, eax
setl cl
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x98]
mov dword [eax + 4], ecx
xor eax, eax
test ecx, ecx
sete al
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
je 0x1001e5ae
mov dword [esp + 0x34], 1
mov dword [esp + 0x1c], 7
mov dword [esp + 0x1c], ebx
jmp 0x1001e39c
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x24c], 0x2afe01bd
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1001e389
mov dword [esp + 0x1c], ebx
jmp 0x1001e45a
push dword [esp + 0x54]
movdqa xmm0, xmmword [0x10009230]
lea eax, [esp + 0x200]
push eax
lea eax, [esp + 0x1f4]
mov dword [esp + 0xb4], ebx
push eax
push ebx
lea ecx, [esp + 0xbc]
mov dword [esp + 0xc0], ebx
movdqu xmmword [esp + 0x1fc], xmm0
mov dword [esp + 0xc4], ebx
call fcn.1001c750
mov ecx, dword [esp + 0xac]
mov dword [ecx + 0xc], 3
mov dword [esp + 0x30], 0xfffffffd
mov dword [esp + 0x30], 3
cmp dword [esp + 0x30], ebx
jl 0x1001e445
mov dword [esp + 0x10], 0x6d6092f6
mov dword [esp + 0x10], ebx
jmp 0x1001e438
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x24c], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001e425
dec dword [esp + 0x30]
jns 0x1001e417
dec dword [ecx + 0xc]
jns 0x1001e401
lea ecx, [esp + 0xac]
call fcn.1001b2cd
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 5
je 0x1001e3ac
push ebx
call fcn.10021a82
mov dword [esp + 0x34], 0x2ba39464
pop ecx
mov dword [esp + 0x24], 0xfffffff9
xor ecx, ecx
mov dword [esp + 0x1c], 0x3fbb4ebb
inc ecx
mov dword [esp + 0xc], ebx
jmp 0x1001e4a0
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1cc], 0xc93
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001e48d
mov dword [esp + 0xc], ebx
jmp 0x1001e4bf
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x27c], 0xa149cec7
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001e4ac
mov dword [esp + 0xc], ebx
jmp 0x1001e4df
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xcc], 0x2e77e815
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x1001e4cc
mov dword [esp + 0x30], ebx
jmp 0x1001e584
mov dword [esp + 0x24], 0xe63e3155
mov dword [esp + 0x24], 0xf90a2337
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0x1d0]
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x24], 0xfe012d2c
push 2
call fcn.1001b24b
push 2
pop edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x1c], ebx
jmp 0x1001e543
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1d0]
mov dword [eax + ecx*4], 0x2d91509c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001e52d
dec dword [esp + 0x24]
mov dword [esp + 0x1c], ebx
jmp 0x1001e56b
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e567
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ebx
jle 0x1001e553
lea ecx, [esp + 0x1d0]
call fcn.1001b2cd
inc dword [esp + 0x30]
push 1
pop ecx
cmp dword [esp + 0x30], ebx
jle 0x1001e4ee
mov eax, dword [esp + 0x34]
xor ecx, ecx
mov edx, dword [esp + 0x98]
mov eax, dword [esp + 0x40]
cmp dword [edx + 4], eax
setle cl
mov dword [esp + 0x10], ecx
jmp 0x1001ea58
push 4
lea ecx, [esp + 0x134]
call fcn.1001b24b
mov dword [esp + 0x1c], ebx
jmp 0x1001e5d8
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1001e5c2
mov eax, dword [esp + 0x130]
mov dword [eax + 8], ebx
mov dword [esp + 0x34], ebx
cmp dword [esp + 0x34], ebx
jne 0x1001e5fc
dec dword [eax + 8]
cmp dword [eax + 8], 0xffffffe9
jne 0x1001e5e9
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e612
push 0x1e1e
call dword [sym.imp.KERNEL32.dll_TlsFree]
lea ecx, [esp + 0x130]
call fcn.1001b2cd
mov dword [esp + 0x1c], 0xdb756fd8
push 0xfffffffffffffff8
mov dword [esp + 0x14], 0x8e41
pop esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], ebx
jmp 0x1001e652
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x26c], 0x30dfddae
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1001e63f
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e66c
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
mov eax, dword [esp + 0x10]
xor edx, edx
cmp eax, 1
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x24]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x28], ecx
mov ecx, 0xfecaa001
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
sub ecx, eax
jne 0x1001e6c0
cmp dword [esp + 0x10], ebx
jne 0x1001e6c0
mov eax, ebx
jmp 0x1001e6c3
xor eax, eax
inc eax
mov dword [esp + 0x274], eax
lea ecx, [esp + 0x13c]
mov dword [esp + 0x28], 0xac155ea0
mov eax, 0x7f6af112
mov dword [esp + 0x20], 0x92ce4ca0
mov dword [esp + 0x28], 0x4e821fd1
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], eax
mov dword [esp + 0x74], eax
mov dword [esp + 0x78], eax
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x10], esi
mov dword [esp + 0x28], 0xd8ef068c
push 3
call fcn.1001b24b
mov byte [esp + 0x294], 6
mov dword [esp + 0x1c], ebx
jmp 0x1001e742
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x13c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1001e72f
mov dword [esp + 0x74], ebx
jmp 0x1001e81d
push 1
lea ecx, [esp + 0x11c]
call fcn.1001b24b
xor edx, edx
mov dword [esp + 0x14], ebx
inc edx
jmp 0x1001e77f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], 0xd83d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001e769
mov dword [esp + 0x14], ebx
jmp 0x1001e79a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xa4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001e78b
cmp dword [esp + 0xc], ebx
je 0x1001e802
mov dword [esp + 0xc], edi
cmp dword [esp + 0xc], 0x2b
je 0x1001e7e2
push 0xfffffffffffffff6
pop eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], ebx
jmp 0x1001e7d0
mov dword [esp + 0x34], 0xffffffff
cmp dword [esp + 0x34], ebx
jne 0x1001e7d7
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff7
je 0x1001e7be
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0x2b
jne 0x1001e7b4
mov dword [esp + 0xc], ebx
jmp 0x1001e7fa
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001e7e8
jmp 0x1001e80d
mov dword [esp + 0xa4], 0xffffffff
lea ecx, [esp + 0x118]
call fcn.1001b2cd
inc dword [esp + 0x74]
cmp dword [esp + 0x74], 0x1c
jne 0x1001e752
mov eax, dword [esp + 0x28]
dec dword [esp + 0x28]
cmp eax, esi
je 0x1001e839
xor esi, esi
inc esi
jmp 0x1001e83b
mov esi, ebx
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0xc]
cmp eax, ecx
setne dl
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x78]
mov dword [esp + 0x78], eax
mov edx, dword [esp + 0xc]
add edx, esi
add edx, eax
sub edx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x13c]
mov byte [esp + 0x294], 3
setl cl
mov dword [eax], ecx
lea ecx, [esp + 0x13c]
call fcn.1001b2cd
mov dword [esp + 0x1c], ebx
jmp 0x1001e8ac
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1a0], 0xdcd6a9b0
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1001e899
mov dword [esp + 0x10], 0x75c9
lea ecx, [esp + 0x154]
push 1
call fcn.1001b24b
mov dword [esp + 0x1c], ebx
jmp 0x1001e8e5
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 0xe87df2f4
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x1001e8cf
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x154]
mov dword [eax], ecx
mov dword [esp + 0x10], 0xfffffffd
jmp 0x1001e91f
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001e91b
push 0xf7e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe6
jl 0x1001e903
lea ecx, [esp + 0x154]
call fcn.1001b2cd
mov eax, dword [esp + 0x40]
lea ecx, [esp + 0xc0]
push dword [esp + 0xcc]
movdqa xmm0, xmmword [0x10009220]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x210]
push eax
lea eax, [esp + 0x204]
mov dword [esp + 0xc8], ebx
push eax
push ebx
movdqu xmmword [esp + 0x20c], xmm0
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xd8], ebx
call fcn.1001c750
mov eax, dword [esp + 0xc0]
lea ecx, [esp + 0xc0]
mov dword [esp + 0x34], 0xfffffff9
mov dword [eax + 8], ebx
call fcn.1001b2cd
cmp dword [esp + 0x38], ebx
je 0x1001e9b3
cmp dword [esp + 0x40], ebx
je 0x1001e9b3
xor eax, eax
inc eax
jmp 0x1001e9b5
mov eax, ebx
mov dword [esp + 0x28], eax
xor edx, edx
imul ecx, dword [esp + 0x28], 6
add ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x98]
cmp ecx, dword [eax + 4]
setne dl
cmp edx, 0xffffffff
ja 0x1001e9da
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], 0xba24
mov eax, dword [esp + 0x20]
add eax, 6
cmp eax, dword [esp + 0x1a8]
jne 0x1001e9fd
cmp dword [esp + 0x28], ebx
je 0x1001e9fd
mov edx, ebx
mov eax, dword [esp + 0x1c]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1a8]
mov eax, dword [esp + 0x1a4]
mov eax, dword [esp + 0x16c]
cmp dword [eax], ebx
je 0x1001ea2f
mov dword [esp + 0x1c], ebx
jmp 0x1001eab6
mov dword [esp + 0x30], 0x5445d8d6
mov eax, dword [esp + 0x240]
cmp eax, dword [esp + 0x58]
jne 0x1001ea7b
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x38]
cmp dword [esp + 0x30], ebx
jne 0x1001ea93
cmp dword [esp + 0x44], ebx
jne 0x1001ea93
mov eax, ebx
jmp 0x1001ea96
xor eax, eax
inc eax
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 5
jge 0x1001eaab
cmp dword [esp + 0x30], ebx
jne 0x1001eaab
mov eax, ebx
jmp 0x1001eaae
xor eax, eax
inc eax
mov dword [esp + 0x34], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xa
je 0x1001ea5e
lea ecx, [esp + 0x16c]
call fcn.1001b2cd
or dword [esp + 0x294], 0xffffffff
lea ecx, [esp + 0x98]
call fcn.1001b2cd
mov dword [esp + 0xc], 0x24a8c6a5
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], 0xfffffffd
mov dword [esp + 0x38], 0xbb000e2e
mov dword [esp + 0x58], ebx
mov dword [esp + 0xc], 0x13
jmp 0x1001eb3b
mov dword [esp + 0x44], 0x836c
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001eb2b
push ebx
push 0x2d8
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov eax, dword [esp + 0xc]
add eax, dword [esp + 0x44]
mov dword [esp + 0x28], eax
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffea
jl 0x1001eb0b
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0xc]
je 0x1001eb54
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov dword [esp + 0x28], 0xfffffffb
mov eax, dword [esp + 0xc]
cmp eax, 0x61fc2da8
setne cl
xor edx, edx
add ecx, dword [esp + 0xc]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
cmp eax, ecx
setge dl
mov dword [esp + 0x1c], edx
xor edx, edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0xa8]
mov ecx, 0x3e8
setg dl
imul edx, dword [esp + 0x38]
sub edx, dword [esp + 0x58]
mov dword [esp + 0x38], edx
cdq
idiv ecx
mov ecx, dword [esp + 0x54]
mov edi, edx
mov esi, eax
call fcn.1001cedf
mov ecx, dword [esp + 0x28c]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret