Function at 0x10018ec0
Capabilities:
Create directory
Create process on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10088de4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x260
push ebx
push esi
push edi
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x1bc]
push 2
mov dword [esp + 0xa8], edx
call fcn.10017107
xor ebx, ebx
lea ecx, [esp + 0xe0]
push 1
mov dword [esp + 0x278], ebx
call fcn.10017107
push 2
xor edx, edx
mov dword [esp + 0x1c], ebx
pop esi
inc edx
cmp dword [esp + 0x18], esi
jge 0x10018f38
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x18]
jmp 0x10018f1e
mov dword [esp + 0x18], ebx
mov edi, 0xfb871c7b
jmp 0x10018f55
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10018f43
mov dword [esp + 0x18], ebx
jmp 0x10018f74
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x22c], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10018f61
mov eax, dword [esp + 0xe0]
push 0xfffffffffffffffb
pop ecx
mov dword [eax], edx
mov dword [esp + 0x20], 0x2086bd08
mov dword [esp + 0x10], ebx
jmp 0x10018fa4
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x8c], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10018f95
mov dword [esp + 0x94], ebx
jmp 0x10018fdc
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x10018fd5
push ebx
push ebx
push ebx
push ebx
push 0x1c0c
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor edx, edx
inc edx
inc dword [esp + 0x94]
cmp dword [esp + 0x94], edx
jle 0x10018fb4
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], ebx
jl 0x10019016
mov dword [esp + 0x94], 0xfffffff9
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1001900d
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
dec dword [esp + 0x20]
jns 0x10018fef
xor edx, edx
inc edx
mov eax, dword [esp + 0xe0]
push 0xfffffffffffffffb
pop ecx
dec dword [eax]
jns 0x10018f87
mov dword [esp + 0x230], ebx
lea ecx, [esp + 0xe0]
call fcn.10017189
or dword [esp + 0x274], 0xffffffff
lea ecx, [esp + 0x1bc]
call fcn.10017189
mov dword [esp + 0x18], edi
or edi, 0xffffffff
push 0xfffffffffffffff8
pop eax
mov dword [esp + 0x10], 0x5c82f744
mov dword [esp + 0x30], eax
push 0xfffffffffffffffb
pop ecx
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x28], edi
mov dword [esp + 0x28], 5
mov dword [esp + 0x28], 0x364f2ca1
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 0xe85dc32c
mov dword [esp + 0x28], edi
push esi
call fcn.10017107
mov dword [esp + 0x274], 1
mov dword [esp + 0x18], ebx
jmp 0x100190c1
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x18c], 0x64a6847d
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x100190ae
mov dword [esp + 0x18], ebx
jmp 0x100190e4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1b0]
mov dword [eax + ecx*4], 0x49f7fae0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x100190ce
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019108
push ebx
push ebx
push 0x1c44
push 0x7b9
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], ebx
jl 0x100192b7
mov esi, 0x924f
mov dword [esp + 0x14], 0x443250e6
lea ecx, [esp + 0x1a4]
mov dword [esp + 0x110], esi
mov dword [esp + 0x114], esi
mov dword [esp + 0x118], esi
mov dword [esp + 0x11c], esi
push 4
call fcn.10017107
mov byte [esp + 0x274], 2
mov dword [esp + 0x28], 9
mov dword [esp + 0x1c], ebx
jmp 0x10019179
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x10019163
mov dword [esp + 0x14], ebx
jmp 0x1001921d
mov dword [esp + 0x1c], 0x39ecf4a
mov dword [esp + 0x30], 0xed55c59c
cmp dword [esp + 0x1c], ebx
jne 0x100191de
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
add eax, dword [esp + 0x1c]
cmp eax, 0xf8609561
jb 0x100191c8
cmp dword [esp + 0x1c], ebx
jne 0x100191c8
mov eax, ebx
jmp 0x100191cb
xor eax, eax
inc eax
cmp eax, dword [esp + 0x114]
jl 0x100191de
cmp dword [esp + 0x14], ebx
jne 0x100191de
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x110]
xor edx, edx
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x18c]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x18c], ecx
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
cmp edx, eax
setl cl
mov dword [esp + 0x30], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x10019189
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x10019299
push 1
lea ecx, [esp + 0x148]
call fcn.10017107
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
jmp 0x10019268
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0xb9cbadbe
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10019252
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x144]
cmp dword [esp + eax*4 + 0x18c], ebx
jne 0x10019294
inc dword [esp + 0x24]
call fcn.10017189
dec dword [esp + 0x10]
jns 0x10019236
jmp 0x10019299
call fcn.10017189
lea ecx, [esp + 0x1a4]
mov byte [esp + 0x274], 1
call fcn.10017189
dec dword [esp + 0x18]
jns 0x1001911b
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x274], edi
call fcn.10017189
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x15c]
mov dword [esp + 0x30], ebx
push 3
call fcn.10017107
push 3
pop edx
mov dword [esp + 0x274], edx
mov dword [esp + 0x2c], 0xffff
mov dword [esp + 0x10], ebx
jmp 0x1001930a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100192f8
mov dword [esp + 0x18], 0x18
cmp dword [esp + 0x18], 0x15
jl 0x100194f5
mov esi, dword [esp + 0x15c]
mov dword [esp + 0x20], esi
push 1
lea ecx, [esp + 0x84]
call fcn.10017107
push 3
lea ecx, [esp + 0x178]
mov byte [esp + 0x278], 4
call fcn.10017107
push 3
pop edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], ebx
jmp 0x10019375
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x80]
mov dword [eax + ecx*4], 0x57e8b72f
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x1001935f
mov dword [esp + 0x14], ebx
jmp 0x10019398
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], 0xdc7555b7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x10019382
mov edi, dword [esp + 0x174]
mov dword [edi + 8], ebx
mov dword [esp + 0x24], 0x1b55e973
cmp dword [esp + 0x18], ebx
jne 0x100193ba
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov ecx, dword [edi + 8]
mov eax, dword [esp + 0x80]
setg dl
mov dword [esp + 0x24], edx
mov edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [esp + 0x24]
cmp eax, edx
setne cl
xor eax, eax
cmp edx, ecx
setle al
xor ecx, ecx
imul eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x2c], eax
setl cl
xor eax, eax
cmp eax, ecx
mov ecx, dword [edi + 8]
mov eax, dword [esp + 0x80]
sbb edx, edx
inc edx
imul edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [esp + 0x18]
cmp edx, eax
setne cl
cmp ecx, dword [esp + 0x18]
jg 0x1001943d
cmp dword [esi + 8], ebx
je 0x10019450
mov ecx, dword [edi + 8]
mov eax, dword [esp + 0x80]
cmp dword [eax + ecx*4], ebx
je 0x10019450
mov ecx, ebx
jmp 0x10019453
xor ecx, ecx
inc ecx
neg ecx
sub ecx, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x6c14
setne al
sub eax, dword [esp + 0x18]
mov ecx, dword [edi + 8]
neg eax
sbb eax, eax
xor edx, edx
add eax, 0xffff0002
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x80]
mov esi, dword [esp + 0x2c]
cmp esi, dword [eax + ecx*4]
setge dl
mov dword [esp + 0x2c], edx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100194a6
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
inc dword [edi + 8]
cmp dword [edi + 8], 0
mov esi, dword [esp + 0x20]
jle 0x100193a8
mov eax, dword [esp + 0x80]
mov ecx, dword [esi + 8]
mov dword [eax], ecx
lea ecx, [esp + 0x174]
call fcn.10017189
lea ecx, [esp + 0x80]
mov byte [esp + 0x274], 3
call fcn.10017189
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0x15
jge 0x1001932e
or edi, 0xffffffff
lea ecx, [esp + 0x15c]
mov dword [esp + 0x274], edi
call fcn.10017189
mov dword [esp + 0x28], ebx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019524
push ebx
push 0x2e3
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001953a
push 0x16fc
call dword [sym.imp.USER32.dll_BeginDeferWindowPos]
mov dword [esp + 0x28], 0xfffffff9
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019555
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019567
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [esp + 0x20], 0x477862fd
lea ecx, [esp + 0x4c]
mov dword [esp + 0x18], 0xfffffffe
push 2
call fcn.10017107
mov dword [esp + 0x274], 5
mov dword [esp + 0x10], ebx
jmp 0x100195a6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x4c]
mov dword [eax + ecx*4], 0x89b54615
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019593
mov dword [esp + 0x18], 0xfffffff7
cmp dword [esp + 0x18], 0xd
je 0x10019752
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x30], eax
push 3
lea ecx, [esp + 0xac]
call fcn.10017107
mov byte [esp + 0x274], 6
lea ecx, [esp + 0x12c]
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], 0x64ea33a4
push 2
call fcn.10017107
mov dword [esp + 0x14], ebx
jmp 0x10019618
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019602
mov dword [esp + 0x14], ebx
jmp 0x1001963b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019625
mov ecx, dword [esp + 0xa8]
mov dword [ecx], ebx
lea edi, [ecx + 8]
mov esi, dword [ecx]
xor ecx, ecx
mov edx, dword [esp + 0x4c]
mov dword [esp + 0x24], 0xe11a796d
mov dword [esp + 0x2c], 1
mov eax, dword [esp + 0x20]
cmp dword [edx + esi*4], eax
setg cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
add eax, dword [edi]
mov edx, dword [esp + 0x20]
add edx, eax
mov eax, dword [esp + 0xa8]
mov ecx, dword [eax]
mov eax, dword [esp + 0x4c]
sub edx, dword [eax + ecx*4]
mov eax, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [edi]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x4c]
sub ecx, dword [eax]
mov eax, dword [esp + 0x18]
cmp ecx, 0xb5c6eff3
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x30]
setl cl
xor edx, edx
cmp ecx, dword [eax + 4]
mov eax, dword [esp + 0x12c]
mov ecx, dword [esp + 0xa8]
setg dl
mov dword [eax], edx
xor eax, eax
cmp dword [ecx], ebx
sete al
inc dword [ecx]
cmp dword [ecx], 1
mov dword [esp + 0x2c], eax
jle 0x1001964e
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019720
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
lea ecx, [esp + 0x12c]
call fcn.10017189
lea ecx, [esp + 0xa8]
mov byte [esp + 0x274], 5
call fcn.10017189
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xd
jne 0x100195c8
or edi, 0xffffffff
mov dword [esp + 0x18], 1
push 0xfffffffffffffff6
pop esi
cmp dword [esp + 0x18], ebx
jl 0x10019849
mov dword [esp + 0x24], 0x93dcedb1
mov dword [esp + 0x24], esi
mov dword [esp + 0x10], ebx
jmp 0x10019789
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x58], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10019779
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100197a3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [esp + 0x64], ebx
jmp 0x10019834
mov dword [esp + 0x30], 0x512e
mov dword [esp + 0x2c], ebx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100197d2
push ebx
push ebx
push 0x1b4c
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov eax, dword [esp + 0x64]
xor edx, edx
mov eax, dword [esp + 0x64]
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x4c]
mov ecx, dword [eax + ecx*4]
mov eax, dword [esp + 0x60]
add ecx, eax
mov eax, dword [esp + 0x30]
cmp ecx, eax
setne dl
add edx, 0x270bb1dc
mov dword [esp + 0x24], edx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x64]
mov eax, dword [esp + 0x4c]
cmp dword [eax], ebx
je 0x1001982a
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0x4c]
cmp dword [eax + ecx*4], ebx
je 0x1001982a
xor eax, eax
inc eax
jmp 0x1001982c
mov eax, ebx
mov dword [esp + 0x2c], eax
inc dword [esp + 0x64]
cmp dword [esp + 0x64], 1
jle 0x100197ac
dec dword [esp + 0x18]
jns 0x10019767
lea ecx, [esp + 0x4c]
mov dword [esp + 0x274], edi
call fcn.10017189
mov dword [esp + 0x1c], 0xd149febb
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x24], 0x30f888c5
mov dword [esp + 0x10], ebx
jmp 0x10019887
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x3c], 0x2beaa32b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10019877
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], 0x12
cmp dword [esp + 0x1c], 0xa
jl 0x100199c1
push 0xfffffffffffffffb
pop esi
push 2
lea ecx, [esp + 0x13c]
call fcn.10017107
mov dword [esp + 0x274], 7
lea eax, [esp + 0x1f4]
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x10008260]
lea ecx, [esp + 0xd8]
push eax
lea eax, [esp + 0x1ec]
mov dword [esp + 0xdc], ebx
push eax
push ebx
movdqu xmmword [esp + 0x1f4], xmm0
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
call fcn.100185df
mov dword [esp + 0x10], ebx
jmp 0x10019928
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019912
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x3c]
sub ecx, dword [esp + 0x3c]
mov eax, dword [esp + 0xd4]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax + 8], ecx
cmp esi, ecx
sbb eax, eax
xor edx, edx
neg eax
sub eax, 0xffff
imul eax, dword [esp + 0x24]
imul ecx, eax, 7
mov eax, dword [esp + 0x138]
cmp dword [eax + 4], ecx
lea ecx, [esp + 0xd4]
mov eax, dword [esp + 0x3c]
setl dl
sub eax, 0x105bd4b8
imul eax, edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], ebx
call fcn.10017189
lea ecx, [esp + 0x138]
mov dword [esp + 0x274], edi
call fcn.10017189
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xa
jge 0x100198ac
push 0xfffffffffffffff6
pop esi
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x100082d0]
lea eax, [esp + 0x218]
push eax
lea eax, [esp + 0x20c]
mov dword [esp + 0x20], 0xa4f833fc
push eax
mov dword [esp + 0x30], 0xa1efe0c2
lea ecx, [esp + 0xd4]
push ebx
movdqu xmmword [esp + 0x214], xmm0
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
call fcn.100185df
mov dword [esp + 0x10], ebx
jmp 0x10019a2e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x34], 4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10019a1e
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x10019a59
mov dword [esp + 0x30], 0x68876942
mov eax, dword [esp + 0x18]
mov eax, dword [esp + eax*4 + 0x34]
mov dword [esp + 0x30], eax
dec dword [esp + 0x18]
jns 0x10019a3f
cmp dword [esp + 0x34], ebx
je 0x10019a6a
cmp dword [esp + 0x18], ebx
je 0x10019a6a
xor edx, edx
inc edx
jmp 0x10019a6c
mov edx, ebx
mov eax, dword [esp + 0x34]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x34]
setg cl
xor edx, edx
cmp ecx, 0x13ca
setl dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x34]
imul eax, edx
cmp eax, 0x8ec
mov eax, dword [esp + 0x18]
setne cl
xor edx, edx
sub ecx, eax
mov eax, dword [esp + 0x34]
add ecx, eax
mov eax, dword [esp + 0x34]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, esi
setl cl
add eax, ecx
xor ecx, ecx
cmp eax, 0x1418
setg cl
xor eax, eax
imul ecx, dword [esp + 0x18]
cmp ecx, 9
setg al
xor ecx, ecx
cmp eax, 1
setge cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x18]
sub edx, eax
mov eax, dword [esp + 0x18]
cmp eax, edx
setle cl
xor edx, edx
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x34]
cmp eax, 5
mov eax, dword [esp + 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc8]
setl cl
mov dword [eax + 0xc], ecx
lea ecx, [esp + 0xc8]
call fcn.10017189
mov dword [esp + 0x10], 0x25b9b55b
lea ecx, [esp + 0x120]
push 2
call fcn.10017107
mov dword [esp + 0x10], ebx
jmp 0x10019b54
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019b42
mov dword [esp + 0x10], 0x10
jmp 0x10019bff
mov dword [esp + 0x14], 0xfffffff7
mov dword [esp + 0x14], ebx
jmp 0x10019bd1
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], 1
cmp dword [esp + 0x20], ebx
jl 0x10019ba1
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019b9b
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
dec dword [esp + 0x20]
jns 0x10019b88
mov eax, dword [esp + 0x14]
mov ecx, 0x1a17e59
mov edx, dword [esp + 0x120]
sub ecx, dword [edx + eax*4]
je 0x10019bbc
cmp dword [edx], ebx
jne 0x10019bd8
jmp 0x10019bcd
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019bcd
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jle 0x10019b76
mov dword [esp + 0x14], ebx
jmp 0x10019bf4
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019bf0
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jle 0x10019bde
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff2
jg 0x10019b68
lea ecx, [esp + 0x120]
call fcn.10017189
push 1
lea ecx, [esp + 0x1cc]
call fcn.10017107
mov dword [esp + 0x274], 8
xor ecx, ecx
inc ecx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], 0xfffffffc
mov dword [esp + 0x30], 0x4498b94b
mov dword [esp + 0x20], 0x783518f
mov eax, dword [esp + 0x10]
neg eax
mov dword [esp + 0x14], eax
je 0x10019ccc
mov dword [esp + 0x20], 0x6eda
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], 0x1c3a
jle 0x10019c9e
cmp dword [esp + 0x10], 0x7b30
jne 0x10019c86
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x14], ebx
je 0x10019cac
mov eax, ecx
cmp dword [esp + 0x20], ebx
jne 0x10019cae
mov eax, ebx
xor edx, edx
cmp eax, 0x65f5
mov eax, dword [esp + 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x20], ecx
jmp 0x10019d4d
push 2
lea ecx, [esp + 0x154]
call fcn.10017107
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], ebx
jmp 0x10019cf6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019ce4
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x1c], ebx
jne 0x10019d1d
cmp dword [esp + 0x20], ebx
jne 0x10019d1d
mov edx, ebx
jmp 0x10019d20
xor edx, edx
inc edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x150]
mov dword [eax + 4], ecx
xor eax, eax
cmp ecx, edx
lea ecx, [esp + 0x150]
setne al
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
call fcn.10017189
mov dword [esp + 0x28], 0x4dcc80fc
mov dword [esp + 0x40], ebx
jmp 0x10019d6e
mov eax, dword [esp + 0x40]
mov dword [esp + eax*4 + 0x240], 0xade2167f
inc dword [esp + 0x40]
cmp dword [esp + 0x40], 2
jl 0x10019d5b
push 2
lea ecx, [esp + 0x16c]
call fcn.10017107
push 0xfffffffffffffffb
pop eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], ebx
jmp 0x10019da6
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], 0x5b57
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019d90
mov dword [esp + 0x10], ebx
jmp 0x10019e0e
mov dword [esp + 0x20], ebx
mov dword [esp + 0x30], 0xef9d7865
mov dword [esp + 0x20], 1
cmp dword [esp + 0x20], ebx
jl 0x10019e0a
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x168]
cmp dword [eax + ecx*4], 0xcf09
setne dl
mov dword [esp + 0x30], edx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10019e04
push 0x7b8
push ebx
push 0x238e
call dword [sym.imp.KERNEL32.dll_OpenProcess]
dec dword [esp + 0x20]
jns 0x10019dcd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jle 0x10019db3
lea ecx, [esp + 0x168]
call fcn.10017189
push 0xfb1
lea eax, [esp + 0x1cc]
xor dl, dl
push 0x3224
push eax
lea ecx, [esp + 0x4c]
call fcn.1001a9b8
add esp, 0xc
lea ecx, [esp + 0xf8]
push 1
call fcn.10017107
mov byte [esp + 0x274], 9
lea ecx, [esp + 0xbc]
mov dword [esp + 0x20], edi
push 4
call fcn.10017107
mov dword [esp + 0x24], 0xc4ce10b4
mov dword [esp + 0x30], 0x5d8d3410
mov dword [esp + 0x14], ebx
jmp 0x10019e95
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10019e7f
mov dword [esp + 0x14], ebx
jmp 0x10019eb8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xbc]
mov dword [eax + ecx*4], 0xffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10019ea2
mov eax, dword [esp + 0xf8]
mov edi, dword [eax]
test edi, edi
jne 0x10019f19
mov ecx, dword [esp + 0x20]
mov esi, dword [esp + 0xbc]
neg ecx
mov eax, dword [esp + 0xf8]
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [esi + 4]
mov edi, dword [eax]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setg dl
sub edx, dword [esi + 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, edi
mov edx, dword [esp + 0xbc]
setne cl
xor eax, eax
cmp ecx, dword [edx + 0xc]
setle al
cmp eax, dword [edx]
jne 0x10019f20
mov eax, ebx
jmp 0x10019f23
mov edx, dword [esp + 0xbc]
xor eax, eax
inc eax
cmp eax, 0xc4185a1f
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xa296
setl cl
xor eax, eax
cmp ecx, 1
setge al
xor ecx, ecx
cmp eax, edi
mov eax, dword [esp + 0x20]
setne cl
add ecx, 0xa9
imul ecx, dword [edx + 4]
sub ecx, eax
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xbc]
mov eax, dword [esp + 0x24]
sub eax, dword [edx + 4]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x30], eax
call fcn.10017189
lea ecx, [esp + 0xf8]
mov byte [esp + 0x274], 8
call fcn.10017189
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x100081f0]
lea eax, [esp + 0x208]
push eax
lea eax, [esp + 0x1fc]
mov dword [esp + 0xf4], ebx
push eax
push ebx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x100], ebx
movdqu xmmword [esp + 0x204], xmm0
mov dword [esp + 0x104], ebx
call fcn.100185df
mov dword [esp + 0x20], 0x9000d4e7
mov dword [esp + 0x20], 3
cmp dword [esp + 0x20], ebx
jl 0x1001a00a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a004
push ebx
push ebx
push 0x436
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
dec dword [esp + 0x20]
jns 0x10019fe5
lea ecx, [esp + 0xec]
call fcn.10017189
mov dword [esp + 0x20], ebx
jmp 0x1001a864
mov dword [esp + 0x28], 1
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a046
push 0x22b3
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a058
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov dword [esp + 0x28], 0xa756
mov dword [esp + 0x28], 1
push 2
pop ecx
mov dword [esp + 0x28], ecx
push 9
pop eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x28], 7
mov dword [esp + 0x28], 4
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0xc660f7e7
push 0xfffffffffffffffb
mov dword [esp + 0x2c], 0x711e7bff
pop eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 0x9a278c00
mov dword [esp + 0x14], ebx
jmp 0x1001a0ce
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x248], 0x89f42c60
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001a0bb
mov dword [esp + 0x14], ebx
jmp 0x1001a0ed
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x250], 0x5f4e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001a0da
mov dword [esp + 0x1c], ebx
jmp 0x1001a185
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x10008240]
lea eax, [esp + 0x1e8]
push eax
lea eax, [esp + 0x1dc]
mov dword [esp + 0x30], 0x7a3a
push eax
push ebx
lea ecx, [esp + 0xa8]
mov dword [esp + 0xa8], ebx
movdqu xmmword [esp + 0x1e4], xmm0
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
call fcn.100185df
mov dword [esp + 0x10], ebx
jmp 0x1001a165
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x238], 0x1ad67a4b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001a152
mov eax, dword [esp + 0x98]
lea ecx, [esp + 0x98]
inc dword [eax]
call fcn.10017189
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xf
jle 0x1001a0fd
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0x74]
push 3
call fcn.10017107
mov dword [esp + 0x14], 1
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x10], ebx
jmp 0x1001a1c4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], 0x2fd41e55
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a1b1
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 2
jg 0x1001a29e
mov edi, dword [esp + 0x74]
mov dword [esp + 0x1c], 0x5c62e089
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x1001a220
mov dword [esp + 0x10], 0x5ed9a924
mov dword [esp + 0x10], ebx
jmp 0x1001a215
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], 0x11151c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a202
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x1001a1f4
mov dword [esp + 0x24], 1
xor edx, edx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x74]
cmp dword [ecx + eax*4], ebx
sete dl
xor eax, eax
cmp dword [ecx + esi*4], edx
setne al
xor ecx, ecx
cmp eax, 1
setg cl
cmp dword [esp + 0x1c], ecx
jle 0x1001a270
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x74]
mov eax, dword [edx + eax*4]
imul eax, dword [edi + 8]
cmp dword [edx + esi*4], eax
setge cl
mov dword [esp + 0x2c], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x1001a1de
lea ecx, [esp + 0x74]
call fcn.10017189
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x180]
mov dword [esp + 0x14], 0xfcf33f23
mov dword [esp + 0x10], 0xb9e9d60a
mov dword [esp + 0x2c], 0xffffffff
push 1
call fcn.10017107
mov dword [esp + 0x10], ebx
jmp 0x1001a2ed
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1001a2d7
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
neg ecx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
sbb ecx, ecx
mov eax, dword [esp + 0x18]
neg ecx
mov dword [esp + 0x10], eax
xor edx, edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
setge dl
xor ecx, ecx
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp edx, eax
mov eax, dword [esp + 0x18]
setg cl
xor edx, edx
cmp ecx, 0x5f88
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp dword [esp + 0x18], ecx
jne 0x1001a354
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
xor edx, edx
inc edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x14], ebx
jmp 0x1001a37b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x180]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001a365
lea ecx, [esp + 0x180]
call fcn.10017189
mov dword [esp + 0x10], ebx
jmp 0x1001a3a6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x25c], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001a393
mov dword [esp + 0x10], 0xc74a
lea ecx, [esp + 0x68]
mov dword [esp + 0x1c], 0xffffffff
push 2
call fcn.10017107
mov byte [esp + 0x274], 0xa
mov dword [esp + 0x18], 0xd9cd4431
mov dword [esp + 0x2c], 0x762969fb
mov dword [esp + 0x24], 0x8a1b
mov dword [esp + 0x48], 0xfffffffa
mov dword [esp + 0x28], 1
mov dword [esp + 0x1c], ebx
jmp 0x1001a411
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x68]
mov dword [eax + ecx*4], 0xfa51669
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001a3fe
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1001a432
push ebx
push ebx
push 0x1b4c
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
add edx, 3
cmp edx, eax
setl cl
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
sub ecx, eax
imul ecx, dword [esp + 0x10]
test ecx, ecx
jne 0x1001a45f
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0xf47a6dee
mov edi, dword [esp + 0x68]
mov eax, dword [esp + 0x10]
sbb ecx, ecx
neg ecx
mov dword [edi + 4], ecx
sub ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
lea eax, [ecx + 0x5fe8887]
test eax, eax
jne 0x1001a607
cmp dword [edi + 4], ebx
jne 0x1001a607
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 0x1b5b3a04
push 3
mov dword [esp + 0x18], 0x25a44896
mov dword [esp + 0x18], ebx
pop ecx
jmp 0x1001a4d1
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x220], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001a4be
mov dword [esp + 0x14], ebx
jmp 0x1001a4f0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x214], 0xec372b4d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001a4dd
mov dword [esp + 0x18], ebx
jmp 0x1001a5f7
mov dword [esp + 0x18], 5
lea ecx, [esp + 0x198]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x2c], ebx
push 2
call fcn.10017107
mov dword [esp + 0x14], ebx
jmp 0x1001a645
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 0x767dbf12
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001a62f
mov eax, dword [esp + 0x18]
neg eax
jne 0x1001a69e
cmp dword [esp + 0x18], ebx
je 0x1001a66a
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x1c], 0xffff
sbb eax, eax
inc eax
cmp eax, 0x89d68482
mov eax, dword [esp + 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
sub edx, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x198]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x198]
call fcn.10017189
lea ecx, [esp + 0x68]
mov byte [esp + 0x274], 8
call fcn.10017189
lea eax, [esp + 0x3b]
mov byte [esp + 0x3b], bl
push eax
push ebx
push 0x4030
push 0x1cd1
call fcn.1001ce3e
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x114]
mov dword [esp + 0x38], 0xa927213e
xor eax, eax
mov dword [esp + 0x38], 0x7d50f82b
inc eax
mov dword [esp + 0x38], 0x9edca8fe
add esp, 0x10
mov dword [esp + 0x28], eax
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], 0x515466bc
mov dword [esp + 0x2c], 0xb6f9b691
mov dword [esp + 0x24], 8
push eax
call fcn.10017107
mov dword [esp + 0x10], 0x4668
mov dword [esp + 0x48], 0x67d
mov dword [esp + 0x14], ebx
jmp 0x1001a762
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xb4], 3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001a74f
mov dword [esp + 0x14], ebx
jmp 0x1001a785
cmp dword [esp + 0x20], 0xffffffff
jg 0x1001a01f
or dword [esp + 0x274], 0xffffffff
lea ecx, [esp + 0x1c8]
call fcn.10017189
mov eax, dword [esp + 0xa4]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x44]
mov esi, edx
mov edi, eax
call fcn.10018e4e
mov ecx, dword [esp + 0x26c]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret