Function at 0x1002077e
Capabilities:
Check os version
Create process on windows
Get file system object information
Query service status
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10070056
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3d0
push ebx
push esi
mov dword [esp + 0x74], ecx
xor ebx, ebx
push edi
mov dword [esp + 0x18], 0x5d6c05ba
mov dword [esp + 0x24], 0xfffffff9
push 3
mov dword [esp + 0x30], 0x3b1d
pop edi
mov dword [esp + 0x1c], edi
mov byte [esp + 0x17], bl
mov dword [esp + 0xc4], edx
cmp byte [esp + 0x17], bl
je 0x100207f5
push 0xc53
push 0xd74
push 0x1bce
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
push 1
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x100208e0
mov dword [esp + 0x10], 0x66f5a9c4
mov dword [esp + 0x30], ebx
jmp 0x10020822
mov eax, dword [esp + 0x30]
mov dword [esp + eax*4 + 0x84], 0xde0b4074
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 2
jl 0x1002080f
mov dword [esp + 0x10], ebx
jmp 0x100208d2
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x84], ebx
je 0x1002086e
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x18]
sub eax, 0x3d7f1912
neg eax
sbb eax, eax
inc eax
cmp dword [esp + 0x24], eax
jl 0x1002085f
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x84]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x84]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x84]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0x84]
mov ecx, dword [esp + 0x84]
sub ecx, eax
neg ecx
sbb ecx, ecx
neg ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x84], edx
mov dword [esp + 0x1c], 0xb
jmp 0x100208c7
cmp dword [esp + 0x24], ebx
jne 0x100208ce
cmp dword [esp + 0x10], ebx
jne 0x100208ce
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xc
je 0x100208b7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jle 0x10020832
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x12
jge 0x10020801
mov eax, dword [0x12e4c538]
test al, 1
jne 0x10020990
or eax, edx
mov dword [0x12e4c538], eax
push ebx
mov dword [esp + 0x3e8], ebx
push ebx
mov dword [0x12e4c540], ebx
mov dword [0x12e4c544], ebx
call fcn.10013e8a
mov dword [0x12e4c540], eax
mov dword [0x12e4c548], ebx
mov dword [0x12e4c550], ebx
mov byte [esp + 0x3e4], 2
mov ecx, 0x12e4c548
mov dword [esp + 0x17c], eax
lea eax, [esp + 0x17c]
push eax
push 0x10
push ebx
lea eax, [esp + 0x128]
mov dword [0x12e4c55c], 0x3f800000
push eax
mov dword [0x12e4c54c], ebx
call fcn.10013c2e
push 0x10070ddf
mov dword [0x12e4c554], 7
mov dword [0x12e4c558], 8
call fcn.100558bc
or dword [esp + 0x3e8], 0xffffffff
xor edx, edx
pop ecx
inc edx
mov dword [esp + 0x18], 0x60657976
lea ecx, [esp + 0x24c]
mov dword [esp + 0x34], 0xdb88dcfd
push edx
call fcn.10011475
mov dword [esp + 0x3e4], edi
lea eax, [esp + 0x2fc]
push dword [esp + 0x11c]
movdqa xmm0, xmmword [0x1000a320]
lea ecx, [esp + 0x114]
push eax
lea eax, [esp + 0x2f4]
mov dword [esp + 0x118], ebx
push eax
push ebx
movdqu xmmword [esp + 0x2fc], xmm0
mov dword [esp + 0x124], ebx
mov dword [esp + 0x128], ebx
call fcn.10024879
mov byte [esp + 0x3e4], 4
xor esi, esi
mov dword [esp + 0x2c], ebx
inc esi
mov dword [esp + 0x30], ebx
jmp 0x10020a29
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24c]
mov dword [eax + ecx*4], 0x622b
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x10020a13
cmp dword [esp + 0x18], ebx
je 0x10020b25
mov dword [esp + 0x10], 0x1813
lea ecx, [esp + 0x1e0]
mov dword [esp + 0x24], 0x215a6091
push 2
call fcn.10011475
mov dword [esp + 0x30], ebx
jmp 0x10020a73
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1e0]
mov dword [eax + ecx*4], 0xe9e5a939
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 2
jl 0x10020a5d
cmp dword [esp + 0x18], ebx
jne 0x10020a9c
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x10]
cmp eax, ecx
setl dl
add edx, dword [esp + 0x10]
mov dword [esp + 0x34], edx
je 0x10020ac6
mov eax, dword [esp + 0x24c]
mov edx, esi
cmp dword [eax], ebx
jne 0x10020ac8
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1e0]
setl cl
mov dword [eax + 4], ecx
mov dword [esp + 0x18], ebx
jmp 0x10020b0e
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10020af5
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x1e0]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x10020ae3
lea ecx, [esp + 0x1e0]
call fcn.10011c4a
jmp 0x10020bdc
mov dword [esp + 0x30], 0xb891
mov dword [esp + 0x44], 0x5c6a8b5f
mov dword [esp + 0x18], 0xfffffffd
cmp dword [esp + 0x18], 0x2c
jl 0x10020bdc
mov edi, dword [esp + 0x110]
or ecx, 0xffffffff
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0x1f1c18a0
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
jne 0x10020b9a
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x30], ebx
jne 0x10020b9a
cmp dword [esp + 0x1c], ebx
jne 0x10020b9a
mov esi, ebx
mov edx, dword [esp + 0x34]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
cmp esi, eax
mov dword [edi + 0xc], edx
setg cl
sub edx, ecx
add edx, dword [esp + 0x34]
je 0x10020bc1
cmp dword [esp + 0x1c], ebx
je 0x10020bc1
xor esi, esi
inc esi
mov eax, esi
jmp 0x10020bc6
xor esi, esi
mov eax, ebx
inc esi
mov dword [esp + 0x44], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x2c
jge 0x10020b4f
push 3
pop edi
lea ecx, [esp + 0x110]
call fcn.10011c4a
or dword [esp + 0x3e4], 0xffffffff
lea ecx, [esp + 0x24c]
call fcn.10011c4a
imul eax, dword [esp + 0x78], 0x2710
lea ecx, [esp + 0x1bc]
push esi
add eax, dword [esp + 0xc8]
mov dword [esp + 0xcc], eax
mov dword [esp + 0x38], 7
mov dword [esp + 0x3c], 0xfffffffe
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x30], edi
mov dword [esp + 0x24], 0xb3a4df6f
mov dword [esp + 0x3c], 0xffffffff
mov dword [esp + 0x30], 0x1e1d82c3
mov dword [esp + 0x2c], 8
mov dword [esp + 0x28], 0xc2e9378f
mov dword [esp + 0x4c], 5
mov dword [esp + 0x28], 0x9737e0d1
mov dword [esp + 0x34], edi
mov dword [esp + 0x20], 0x48dc164f
mov dword [esp + 0x3c], 0x7806aa1c
call fcn.10011475
mov dword [esp + 0x44], esi
mov dword [esp + 0x10], ebx
jmp 0x10020ca3
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10020c91
mov dword [esp + 0x10], ebx
jmp 0x10020cc2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2a0], 2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10020caf
mov eax, dword [esp + 0x34]
xor edx, edx
mov eax, dword [esp + 0x2a0]
inc dword [esp + 0x2a0]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1bc]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x24]
setge dl
sub edx, eax
mov eax, dword [esp + 0x1bc]
sub edx, 0xe859
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp dword [eax], edx
setne cl
xor edx, edx
mov dword [eax], ecx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x24]
cmp eax, ecx
setle dl
sub edx, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x2c], edx
xor edx, edx
cmp eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [esp + 0x48]
je 0x10020d6e
mov edx, esi
cmp dword [esp + 0x2a0], ebx
jne 0x10020d70
mov edx, ebx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x1bc]
call fcn.10011c4a
lea eax, [esp + 0xc8]
push eax
call fcn.10023789
push 2
lea ecx, [esp + 0x22c]
mov eax, dword [eax]
mov dword [esp + 0x48], eax
call fcn.10011475
mov dword [esp + 0x3e4], 5
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x24], 0xfffffffa
mov dword [esp + 0x10], 0x906d8bc0
mov dword [esp + 0x20], 0xfffffff7
push 2
call fcn.10011475
push 2
mov byte [esp + 0x3e8], 6
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10020e04
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x228]
mov dword [eax + ecx*4], 0xca2c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10020dee
mov dword [esp + 0x18], ebx
jmp 0x10020e22
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x1d4]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10020e10
mov dword [esp + 0x18], ebx
jmp 0x10020e41
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x340], 0x7e906900
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10020e2e
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10020e64
push 0x22b0
push 0x1acc
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
mov edi, dword [esp + 0x228]
cmp dword [edi + 4], ebx
je 0x10020ebf
mov dword [esp + 0x24], ebx
xor ecx, ecx
mov eax, dword [esp + 0x24]
mov esi, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, esi
mov eax, dword [esp + 0x228]
setg cl
xor edx, edx
cmp ecx, dword [eax]
setl dl
xor eax, eax
cmp edx, esi
setl al
xor esi, esi
neg eax
inc esi
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
imul ecx, dword [edi + 4]
mov eax, dword [esp + 0x1d4]
mov dword [eax], ecx
test ecx, ecx
mov ecx, esi
jne 0x10020ec1
mov ecx, ebx
xor eax, eax
cmp ecx, dword [edi + 4]
setge al
cmp eax, 0x86095610
jae 0x10021025
push 4
lea ecx, [esp + 0x298]
call fcn.10011475
push 3
mov dword [esp + 0x28], 0x2c752785
mov dword [esp + 0x1c], ebx
pop edi
jmp 0x10020f06
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x21c], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10020ef3
mov dword [esp + 0x2c], 0x2656
cmp dword [esp + 0x2c], 0x1231
jge 0x10020f7d
lea eax, [esp + 0x7c]
push eax
push 0x10009dec
call fcn.10055d2e
pop ecx
pop ecx
jmp 0x10020f70
dec eax
mov dword [esp + 0x7c], eax
lea eax, [esp + 0x184]
push eax
lea eax, [esp + 0x140]
push eax
push 0x10009e80
call fcn.10055d2e
mov eax, dword [esp + 0x148]
add esp, 0xc
dec eax
push dword [esp + 0x184]
push eax
push 0x10009ebc
call fcn.100558e6
add esp, 0xc
mov eax, dword [esp + 0x7c]
test eax, eax
jne 0x10020f31
dec eax
mov dword [esp + 0x7c], eax
mov dword [esp + 0x18], ebx
jmp 0x10020f95
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x294]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10020f83
mov dword [esp + 0x18], ebx
jmp 0x10020fb5
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x324], 0xfffffff9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jl 0x10020fa2
cmp dword [esp + 0x220], ebx
jne 0x10020fd6
mov eax, dword [esp + 0x294]
or dword [eax + 0xc], 0xffffffff
mov dword [esp + 0x328], esi
mov dword [esp + 0x20], esi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x24], esi
mov edx, dword [esp + 0x340]
mov eax, dword [esp + 0x21c]
mov ecx, dword [esp + 0x24]
imul edx, eax
mov eax, dword [esp + 0x1d4]
imul ecx, edx
mov dword [eax + 4], ecx
lea ecx, [esp + 0x294]
mov eax, dword [esp + 0x21c]
mov eax, dword [esp + 0x21c]
inc eax
mov dword [esp + 0x10], eax
call fcn.10011c4a
jmp 0x10021052
mov dword [esp + 0x10], 0x1d
cmp dword [esp + 0x10], 0xd
jge 0x1002104f
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10021049
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
dec dword [esp + 0x10]
jmp 0x1002102d
push 3
pop edi
lea ecx, [esp + 0x1d4]
call fcn.10011c4a
or dword [esp + 0x3e4], 0xffffffff
lea ecx, [esp + 0x228]
call fcn.10011c4a
mov eax, dword [esp + 0x44]
test eax, eax
je 0x10021086
mov dword [esp + 0x170], eax
jmp 0x10022f0a
mov dword [esp + 0x20], 0xa43d
lea ecx, [esp + 0x240]
push esi
call fcn.10011475
mov dword [esp + 0x24], 0xa92bd42c
mov dword [esp + 0x2c], 0xc9ebf495
mov dword [esp + 0x30], ebx
jmp 0x100210c7
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x240]
mov dword [eax + ecx*4], 7
inc dword [esp + 0x30]
cmp dword [esp + 0x30], esi
jl 0x100210b1
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100210e3
push 0xd94
call dword [sym.imp.USER32.dll_GetSysColor]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x240]
sub ecx, eax
jne 0x10021100
mov ecx, ebx
cmp dword [edx], ebx
je 0x10021102
mov ecx, esi
xor eax, eax
cmp dword [edx], ecx
setg al
neg eax
sub eax, dword [edx]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x240]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x24]
setle dl
mov dword [esp + 0x2c], edx
xor edx, edx
cmp dword [esp + 0x2c], eax
mov eax, dword [esp + 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x240]
call fcn.10011c4a
mov eax, dword [0x12e4c538]
test al, 2
jne 0x100211f6
or eax, 2
mov dword [0x12e4c538], eax
push 7
pop esi
push ebx
mov dword [esp + 0x3e8], esi
push ebx
mov dword [0x12e4c560], ebx
mov dword [0x12e4c564], ebx
call fcn.10013e8a
mov dword [0x12e4c560], eax
mov dword [0x12e4c568], ebx
mov dword [0x12e4c570], ebx
mov byte [esp + 0x3e4], 9
mov ecx, 0x12e4c568
mov dword [esp + 0x180], eax
lea eax, [esp + 0x180]
push eax
push 0x10
push ebx
lea eax, [esp + 0x198]
mov dword [0x12e4c57c], 0x3f800000
push eax
mov dword [0x12e4c56c], ebx
call fcn.10013c2e
push 0x10070dda
mov dword [0x12e4c574], esi
mov dword [0x12e4c578], 8
call fcn.100558bc
or dword [esp + 0x3e8], 0xffffffff
pop ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0x198], xmm0
mov dword [esp + 0x18], 0xe0648261
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10021222
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esp + 0x18], ebx
jmp 0x1002132a
mov dword [esp + 0x10], 0x5f5b
lea ecx, [esp + 0x204]
mov dword [esp + 0x1c], 0xafb5
push edi
call fcn.10011475
mov dword [esp + 0x30], ebx
jmp 0x10021264
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x204]
mov dword [eax + ecx*4], 0xf903
inc dword [esp + 0x30]
cmp dword [esp + 0x30], edi
jl 0x1002124e
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x18], ebx
je 0x10021301
mov dword [esp + 0x28], 0x9da9
cmp dword [esp + 0x28], ebx
jne 0x10021337
push 2
mov dword [esp + 0x2c], ebx
pop edx
jmp 0x100212f9
mov dword [esp + 0x1c], ebx
jmp 0x100212ef
mov dword [esp + 0x10], ebx
jmp 0x100212e5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x204]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100212d3
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x100212cd
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edx
jle 0x100212c7
jmp 0x1002131a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1002131a
push ebx
push 0x17f7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea ecx, [esp + 0x204]
call fcn.10011c4a
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xffffffff
jl 0x1002122b
jmp 0x10021343
lea ecx, [esp + 0x204]
call fcn.10011c4a
lea eax, [esp + 0x78]
push eax
call fcn.100237eb
push edi
lea ecx, [esp + 0x1f0]
mov esi, dword [eax]
mov dword [esp + 0x34], esi
call fcn.10011475
mov dword [esp + 0x3e4], 0xa
mov dword [esp + 0x18], 0xfffffffe
mov dword [esp + 0x2c], 0x1422
cmp dword [esp + 0x2c], 0xdf7
jge 0x100214a3
lea eax, [esp + 0x194]
push eax
push ecx
lea eax, [esp + 0x134]
push eax
push ecx
lea eax, [esp + 0x198]
mov ecx, 0x10660718
push eax
call fcn.10010f2e
pop ecx
mov ecx, eax
call fcn.10010f2e
pop ecx
mov ecx, eax
call fcn.10010f2e
lea eax, [esp + 0x1a8]
push eax
push ecx
lea eax, [esp + 0x10c]
push eax
push ecx
lea eax, [esp + 0x15c]
mov ecx, 0x10660718
push eax
call fcn.10010f2e
pop ecx
mov ecx, eax
call fcn.10010f2e
pop ecx
mov ecx, eax
call fcn.10010f2e
lea eax, [esp + 0x15c]
mov ecx, 0x10660718
push eax
call fcn.10010f2e
mov ecx, dword [esp + 0x104]
mov eax, dword [esp + 0x1a8]
add eax, ecx
add eax, dword [esp + 0x14c]
push ecx
push ecx
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x1000a298]
movsd qword [esp], xmm0
call fcn.10057610
mov eax, dword [esp + 0x19c]
add eax, dword [esp + 0x134]
add eax, dword [esp + 0x190]
fstp qword [esp + 0x40]
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm0, qword [0x1000a290]
movsd qword [esp], xmm0
call fcn.10057610
movd xmm0, dword [esp + 0x164]
mov edx, 0x10009ed8
fadd qword [esp + 0x40]
pop ecx
pop ecx
mov ecx, 0x106605f8
cvtdq2pd xmm0, xmm0
fstp qword [esp + 0x38]
comisd xmm0, xmmword [esp + 0x38]
jae 0x10021497
mov edx, 0x10009edc
call fcn.1000d867
push eax
call fcn.10013ebe
pop ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x1c], ebx
jmp 0x100214c7
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1ec]
mov dword [eax + ecx*4], 0x9841b3c6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x100214b1
mov dword [esp + 0x18], ebx
jmp 0x10021624
mov dword [esp + 0x10], 0xb6748f69
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100214f0
push ebx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x10021620
mov dword [esp + 0x1c], ebx
jmp 0x1002151b
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x80], 0x5206
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10021508
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x80], ebx
je 0x1002153a
cmp dword [esp + 0x10], ebx
je 0x1002153a
xor ecx, ecx
inc ecx
jmp 0x1002153c
mov ecx, ebx
mov eax, dword [esp + 0x1ec]
cmp ecx, dword [eax]
jl 0x1002154e
mov eax, dword [esp + 0x80]
mov eax, dword [esp + 0x80]
cmp dword [esp + 0x10], 0x34c2
jl 0x1002156f
mov eax, dword [esp + 0x1ec]
cmp dword [eax + 8], ebx
jne 0x1002156f
mov edx, ebx
jmp 0x10021572
xor edx, edx
inc edx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setge al
imul eax, dword [esp + 0x80]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], ebx
jmp 0x10021601
push 2
lea ecx, [esp + 0x238]
call fcn.10011475
mov dword [esp + 0x28], ebx
jmp 0x100215bd
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x234]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jl 0x100215ab
mov eax, dword [esp + 0x234]
cmp dword [eax], ebx
jne 0x1002160a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100215f1
push 0x687
push 0xcb
push ebx
push 0x22e
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [esp + 0x234]
call fcn.10011c4a
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jle 0x10021597
jmp 0x10021616
lea ecx, [esp + 0x234]
call fcn.10011c4a
dec dword [esp + 0x10]
jns 0x10021502
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x100214d6
or dword [esp + 0x3e4], 0xffffffff
lea ecx, [esp + 0x1ec]
call fcn.10011c4a
cmp byte [ebp + 0xc], 0
jne 0x10021651
test esi, esi
jne 0x100220d2
mov dword [esp + 0x10], 0xaeb9ae77
mov dword [esp + 0x10], ebx
jmp 0x10021672
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xb4], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1002165f
mov dword [esp + 0x10], ebx
jmp 0x1002168e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x90], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1002167f
mov eax, dword [esp + 0xb4]
mov dword [esp + 0xc0], eax
test eax, eax
jne 0x100216b3
cmp dword [esp + 0xb4], ebx
jne 0x100216b3
mov eax, ebx
jmp 0x100216b6
xor eax, eax
inc eax
xor ecx, ecx
mov dword [esp + 0x90], eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x90]
cmp ecx, eax
mov eax, dword [esp + 0x90]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov ecx, dword [esp + 0xb4]
mov eax, dword [esp + 0xb4]
setle dl
mov dword [esp + 0x2c], edx
xor edx, edx
cmp ecx, eax
setge dl
add edx, 0x10dd013d
cmp edx, dword [esp + 0x2c]
jl 0x1002170a
mov eax, dword [esp + 0xb4]
mov eax, dword [esp + 0xb8]
xor ecx, ecx
mov eax, dword [esp + 0xb4]
mov eax, dword [esp + 0x90]
mov eax, dword [esp + 0x90]
mov eax, dword [esp + 0x90]
cmp eax, 0xffffffff
setge cl
mov dword [esp + 0x90], ecx
mov eax, dword [esp + 0xb4]
cmp dword [esp + 0x90], ebx
je 0x100218e7
mov dword [esp + 0x18], ebx
lea ecx, [esp + 0x288]
push 2
call fcn.10011475
mov dword [esp + 0x1c], ebx
jmp 0x1002177e
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x288]
mov dword [eax + ecx*4], 0x20eaadaf
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10021768
cmp dword [esp + 0xb4], ebx
je 0x1002183e
mov eax, 0xe80a7c6d
mov dword [esp + 0xf4], eax
mov dword [esp + 0xf8], eax
mov dword [esp + 0xfc], eax
mov dword [esp + 0x100], eax
mov dword [esp + 0x24], 1
mov eax, dword [esp + 0x24]
inc dword [esp + 0x24]
test eax, eax
je 0x100217d5
cmp dword [esp + 0xfc], ebx
je 0x100217d5
xor edx, edx
inc edx
jmp 0x100217d7
mov edx, ebx
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
neg ecx
sbb ecx, ecx
neg ecx
imul eax, ecx
xor ecx, ecx
cmp eax, 6
mov eax, dword [esp + 0xfc]
setne cl
imul eax, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0xf8]
setge dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x18]
cmp edx, eax
setle cl
cmp ecx, dword [esp + 0x18]
jne 0x1002182a
cmp dword [esp + 0x18], ebx
je 0x1002182a
xor ecx, ecx
inc ecx
jmp 0x1002182c
mov ecx, ebx
mov eax, dword [esp + 0xf8]
add eax, ecx
mov dword [esp + 0x100], eax
jmp 0x10021891
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1002185f
push 0x856
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [esp + 0x10], 0xfffffff9
jmp 0x1002188a
mov dword [esp + 0x18], ebx
jmp 0x10021880
mov eax, dword [esp + 0x18]
cmp dword [esp + eax*4 + 0xb4], ebx
jne 0x10021886
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x1002186f
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe3
jl 0x10021869
mov eax, dword [esp + 0xb4]
xor ecx, ecx
cmp eax, 0x5dd215cd
mov eax, dword [esp + 0x288]
setle cl
xor edx, edx
cmp ecx, 0x762c
setl dl
mov dword [eax], edx
mov eax, dword [esp + 0x18]
sub edx, eax
mov eax, 0xcfb11589
cmp eax, edx
sbb ecx, ecx
inc ecx
neg ecx
mov dword [esp + 0x90], ecx
mov eax, dword [esp + 0x18]
xor eax, eax
test ecx, ecx
lea ecx, [esp + 0x288]
setle al
mov dword [esp + 0x10], eax
jmp 0x10021932
push edi
lea ecx, [esp + 0x274]
call fcn.10011475
mov dword [esp + 0x1c], ebx
jmp 0x10021910
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x270]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x100218fa
mov eax, dword [esp + 0x270]
lea ecx, [esp + 0x270]
imul eax, dword [eax + 4], 0x38e5
mov dword [esp + 0x90], eax
call fcn.10011c4a
mov dl, byte [ebp + 0xc]
lea eax, [esp + 0x360]
mov ecx, dword [esp + 0x78]
push eax
call fcn.10014fd7
mov esi, eax
lea edi, [esp + 0x19c]
mov eax, 0x8436
pop ecx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [esp + 0x18], 0x4b25b3b
xor edi, edi
mov dword [esp + 0x28], 4
inc edi
mov dword [esp + 0x1c], 0x568be135
mov dword [esp + 0x20], 0xfffffffa
mov dword [esp + 0x1ac], eax
mov dword [esp + 0x1b0], eax
mov dword [esp + 0x1b4], eax
mov dword [esp + 0x1b8], eax
mov dword [esp + 0x10], ebx
jmp 0x100219b3
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x74], 0x1ea66e58
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100219a3
push 3
mov dword [esp + 0x14], ebx
pop esi
jmp 0x100219d5
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x30c], 0x9a4d91f0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x100219c2
mov eax, dword [esp + 0x18]
dec dword [esp + 0x1c]
mov eax, dword [esp + 0x74]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
je 0x10021a30
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
sub ecx, eax
cmp ecx, 0x9d20578c
sbb eax, eax
neg eax
sub eax, dword [esp + 0x28]
neg eax
sbb eax, eax
inc eax
cmp eax, 0x79dc
jl 0x10021a24
mov eax, dword [esp + 0x314]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x74]
mov eax, dword [esp + 0x1ac]
mov eax, dword [esp + 0x1b0]
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x1ac], ebx
jne 0x10021a57
mov eax, ebx
cmp dword [esp + 0x74], ebx
je 0x10021a59
mov eax, edi
mov dword [esp + 0x18], eax
xor edx, edx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
add ecx, 0x83de
cmp ecx, eax
setne dl
cmp byte [ebp + 0xc], 0
mov dword [esp + 0x74], edx
mov dword [esp + 0x18], edx
je 0x100220cc
cmp dword [esp + 0x1a0], 0
je 0x100220cc
push 2
lea ecx, [esp + 0x124]
call fcn.10011475
mov dword [esp + 0x18], 0xfffffffd
mov dword [esp + 0x2c], 0x83de37d6
mov dword [esp + 0x10], ebx
jmp 0x10021ac9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x9c], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10021ab6
mov dword [esp + 0x10], ebx
jmp 0x10021aeb
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0x976f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10021ad5
mov dword [esp + 0x9c], ebx
cmp dword [esp + 0x9c], 0xe
jg 0x10021d5a
mov dword [esp + 0x1c], 0xca2961c0
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], ebx
jl 0x10021d42
mov dword [esp + 0x2c], 0x1935
cmp dword [esp + 0x2c], 0x12e4
jge 0x10021ced
push 0x11acbb98
push 0x10009d04
call fcn.10055d2e
cmp dword [0x11acbb98], 0
pop ecx
pop ecx
mov dword [esp + 0x20], ebx
jle 0x10021ced
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0xdc]
push eax
push 0x10009f40
call fcn.10055d2e
add esp, 0xc
push ebx
push 2
push dword [esp + 0xb4]
push dword [esp + 0xb4]
call fcn.1006f2a0
mov edi, eax
mov eax, edx
mov esi, edi
mov dword [esp + 0x2c], edi
push eax
add esi, 1
mov dword [esp + 0x48], eax
mov ecx, eax
push edi
adc ecx, ebx
push ecx
push esi
call fcn.1005b740
mov ecx, dword [esp + 0xd8]
mov edi, edx
sub ecx, 1
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0xdc]
push ebx
sbb eax, ebx
mov dword [esp + 0x38], ecx
push 2
push eax
push ecx
mov dword [esp + 0x20], eax
call fcn.1006f2a0
mov esi, eax
mov ecx, edx
push edx
add esi, 1
push eax
adc ecx, ebx
push ecx
push esi
call fcn.1005b740
sub dword [esp + 0x28], eax
push dword [esp + 0xac]
mov ecx, dword [esp + 0xac]
sbb edi, edx
push dword [esp + 0xac]
mov eax, dword [esp + 0xb4]
add ecx, 1
mov dword [esp + 0x2c], edi
adc eax, ebx
push eax
push ecx
call fcn.1005b740
push ebx
push 2
push edx
push eax
call fcn.1006f2a0
mov dword [esp + 0x48], edx
mov edi, eax
mov edx, dword [esp + 0x2c]
mov esi, edx
mov eax, dword [esp + 0x44]
add esi, 1
push eax
mov ecx, eax
push edx
adc ecx, ebx
push ecx
push esi
call fcn.1005b740
sub eax, edi
sbb edx, dword [esp + 0x48]
add dword [esp + 0x28], eax
adc dword [esp + 0x24], edx
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x34]
push ebx
push 2
push edi
push esi
mov dword [esp + 0xe8], esi
mov dword [esp + 0xec], edi
call fcn.1006f2a0
push edi
push dword [esp + 0x38]
add esi, 1
mov dword [esp + 0x34], eax
mov ecx, edi
mov dword [esp + 0x4c], edx
adc ecx, ebx
push ecx
push esi
call fcn.1005b740
push ebx
push 2
push edx
push eax
call fcn.1006f2a0
mov dword [esp + 0x48], edx
mov edi, eax
mov edx, dword [esp + 0x2c]
mov esi, edx
mov eax, dword [esp + 0x44]
add esi, 1
push eax
mov ecx, eax
push edx
adc ecx, ebx
push ecx
push esi
call fcn.1005b740
mov ecx, dword [esp + 0x24]
sub edi, eax
mov eax, dword [esp + 0x48]
sbb eax, edx
mov edx, dword [esp + 0x28]
add edx, edi
adc ecx, eax
push ecx
push edx
push 0x10009eac
call fcn.100558e6
mov eax, dword [esp + 0x2c]
add esp, 0xc
inc eax
mov dword [esp + 0x20], eax
cmp eax, dword [0x11acbb98]
jl 0x10021b55
xor edi, edi
inc edi
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x120]
cmp dword [eax + ecx*4], ebx
jne 0x10021d26
mov eax, dword [esp + 0xa4]
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x9c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x120]
imul ecx, dword [eax]
mov eax, ebx
test ecx, ecx
je 0x10021d28
mov eax, edi
add eax, 0xffb3215f
neg eax
sbb eax, eax
inc eax
neg eax
mov dword [esp + 0x18], eax
dec dword [esp + 0x1c]
jns 0x10021b1d
inc dword [esp + 0x9c]
cmp dword [esp + 0x9c], 0xe
jle 0x10021b07
push 3
pop esi
mov eax, dword [esp + 0x120]
cmp dword [eax], ebx
jne 0x10021d95
mov eax, dword [esp + 0x18]
mov dword [esp + 0xa4], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], 0xb49d
cmp dword [esp + 0x18], ebx
jne 0x10021d8a
mov eax, dword [esp + 0x18]
mov eax, edi
cmp dword [esp + 0x9c], ebx
je 0x10021d97
mov eax, ebx
mov dword [esp + 0x2c], eax
lea ecx, [esp + 0x120]
call fcn.10011c4a
push dword [esp + 0x18c]
mov eax, dword [esp + 0x1a8]
lea ecx, [esp + 0xec]
movdqa xmm0, xmmword [0x1000a2d0]
mov dword [esp + 0x178], eax
lea eax, [esp + 0x310]
push eax
lea eax, [esp + 0x304]
mov dword [esp + 0xf0], ebx
push eax
push ebx
movdqu xmmword [esp + 0x30c], xmm0
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
call fcn.10024879
mov dword [esp + 0x3e4], 0xb
lea ecx, [esp + 0x258]
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], 0xfffffffe
push esi
call fcn.10011475
mov byte [esp + 0x3e4], 0xc
lea ecx, [esp + 0x2e0]
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x44], 0x5d9c727
mov dword [esp + 0x38], 0x9cd17cd9
push 2
call fcn.10011475
mov byte [esp + 0x3e4], 0xd
mov dword [esp + 0x20], 0x774d
mov dword [esp + 0x18], ebx
jmp 0x10021e7d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x258]
mov dword [eax + ecx*4], 0xa5e0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10021e67
mov dword [esp + 0x18], ebx
jmp 0x10021e9c
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x318], 0x7684abf0
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10021e89
mov dword [esp + 0x18], ebx
jmp 0x10021ebe
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x2e0]
mov dword [eax + ecx*4], 0x6de1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10021ea8
xor ecx, ecx
mov dword [esp + 0x48], 0xfffffff7
mov dword [esp + 0x24], 0x2c512dc6
lea ecx, [esp + 0x130]
push esi
call fcn.10011475
mov dword [esp + 0x18], 0x4628aea3
xor edx, edx
mov dword [esp + 0x1c], 9
inc edx
mov dword [esp + 0x10], 0xffbb8911
mov dword [esp + 0x38], edx
mov dword [esp + 0x2c], edx
mov dword [esp + 0x2c], 0xa6afe108
mov dword [esp + 0x10], ebx
jmp 0x10021f2b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0xf1bb1300
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10021f15
mov dword [esp + 0x10], ebx
jmp 0x10021f4a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2b0], 0x4198
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10021f37
mov eax, dword [esp + 0x130]
xor ecx, ecx
cmp ecx, dword [eax]
mov eax, dword [esp + 0x18]
sbb ecx, ecx
inc ecx
imul eax, ecx
test eax, eax
je 0x10021f6d
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x130]
mov ecx, edx
mov dword [eax], edx
mov eax, dword [esp + 0x18]
sub ecx, eax
jne 0x10021f88
cmp dword [esp + 0x1c], ebx
jne 0x10021f88
mov edx, ebx
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x1f9d99d
mov ecx, dword [esp + 0x258]
setl al
xor edx, edx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, dword [ecx + 4]
mov ecx, dword [esp + 0x2b0]
mov eax, dword [esp + 0x34]
setle dl
imul ecx, edx
xor edx, edx
sub ecx, eax
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
imul ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x44]
cmp ecx, eax
mov eax, dword [esp + 0x2b4]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setg cl
xor edi, edi
imul eax, ecx
inc edi
xor ecx, ecx
mov dword [esp + 0x31c], eax
inc dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp eax, edi
mov eax, dword [esp + 0x48]
setle cl
sub eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
imul eax, dword [esp + 0x10]
test eax, eax
jne 0x10022034
mov eax, dword [esp + 0x130]
cmp dword [eax + 4], ebx
jne 0x10022034
mov ecx, ebx
cmp dword [eax], ebx
je 0x10022036
mov ecx, edi
mov eax, dword [esp + 0x48]
add eax, ecx
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xe8]
imul ecx, dword [eax]
mov dword [esp + 0x44], ecx
lea ecx, [esp + 0x130]
dec dword [esp + 0x2c]
call fcn.10011c4a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10022092
push 0x2268
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
lea ecx, [esp + 0x2e0]
call fcn.10011c4a
lea ecx, [esp + 0x258]
call fcn.10011c4a
or dword [esp + 0x3e4], 0xffffffff
lea ecx, [esp + 0xe8]
call fcn.10011c4a
mov eax, dword [esp + 0x1a0]
mov dword [esp + 0x178], eax
mov esi, dword [esp + 0x30]
jmp 0x100220d5
xor edi, edi
inc edi
mov dword [esp + 0x10], 0xfffffffa
mov dword [esp + 0x10], ebx
jmp 0x1002214f
push 2
lea ecx, [esp + 0x2c0]
call fcn.10011475
mov dword [esp + 0x1c], edi
mov dword [esp + 0x1c], ebx
jmp 0x10022111
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2bc]
mov dword [eax + ecx*4], 0xad95
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x100220fb
mov dword [esp + 0x1c], ebx
jmp 0x10022135
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10022131
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x1002211e
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x2bc]
call fcn.10011c4a
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffe
je 0x100220e3
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xffffffea
jl 0x100221ad
push 0xfffffffffffffff7
pop edx
mov dword [esp + 0x38], 0x98f01ba0
mov dword [esp + 0x1c], ebx
jmp 0x10022185
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2d4], 0x3617
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10022172
mov dword [esp + 0x2d8], edx
xor ecx, ecx
mov eax, dword [esp + 0x10]
cmp eax, edx
setle cl
mov dword [esp + 0x38], ecx
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffea
jge 0x10022164
test esi, esi
jne 0x100228aa
cmp dword [esp + 0x198], esi
jle 0x100228aa
mov dword [esp + 0x38], edi
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100221df
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10022209
push ebx
push 0x174a
push 0x1847
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
mov dword [esp + 0x20], 0x29a3df60
mov dword [esp + 0x1c], ebx
jmp 0x1002222a
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2c8], 0xf1124f01
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jl 0x10022217
mov dword [esp + 0x38], 0x2588
cmp dword [esp + 0x38], 0xbe5
jge 0x1002239d
lea eax, [esp + 0x190]
push eax
lea eax, [esp + 0x50]
push eax
push 0x10009e80
call fcn.10055d2e
add esp, 0xc
lea ecx, [esp + 0x210]
push dword [esp + 0x4c]
call fcn.10011475
mov dword [esp + 0x3e4], 0xe
mov edi, ebx
mov eax, dword [esp + 0x4c]
test eax, eax
jle 0x100222a5
mov esi, dword [esp + 0x210]
push esi
push 0x10009dec
call fcn.10055d2e
mov eax, dword [esp + 0x54]
inc edi
pop ecx
add esi, 4
pop ecx
cmp edi, eax
jl 0x1002228c
push eax
lea ecx, [esp + 0x1fc]
call fcn.10011475
mov byte [esp + 0x3e4], 0xf
cmp dword [esp + 0x4c], 0
mov esi, dword [esp + 0x1f8]
mov dword [esp + 0x38], ebx
jle 0x100222e7
mov edi, esi
push edi
push 0x10009dec
call fcn.10055d2e
inc ebx
add edi, 4
pop ecx
pop ecx
cmp ebx, dword [esp + 0x4c]
jl 0x100222ce
xor ebx, ebx
mov ecx, dword [esp + 0x1fc]
mov byte [esp + 0x108], bl
sub ecx, esi
push dword [esp + 0x108]
sar ecx, 2
push esi
push dword [esp + 0x204]
call fcn.10024de3
mov edi, dword [esp + 0x19c]
add esp, 0xc
mov eax, dword [esp + 0x210]
mov ecx, ebx
lea edx, [edi - 2]
mov eax, dword [eax + edi*4 - 4]
add eax, dword [esi]
mov dword [esp + 0x2c], eax
test edx, edx
js 0x1002236d
mov ebx, dword [esp + 0x210]
inc ecx
cmp ecx, dword [esp + 0x4c]
jge 0x1002236b
mov eax, dword [esi + ecx*4]
add eax, dword [ebx + edx*4]
cmp eax, dword [esp + 0x2c]
jle 0x10022353
inc ecx
cmp ecx, dword [esp + 0x4c]
jl 0x10022340
cmp ecx, dword [esp + 0x4c]
jge 0x1002236b
mov eax, dword [esi + ecx*4]
add eax, dword [ebx + edx*4]
cmp eax, dword [esp + 0x2c]
jg 0x1002236b
lea edi, [edx + 1]
dec edx
jns 0x10022339
xor ebx, ebx
push edi
push 0x10009e78
call fcn.100558e6
pop ecx
pop ecx
lea ecx, [esp + 0x1f8]
call fcn.10011c4a
or dword [esp + 0x3e4], 0xffffffff
lea ecx, [esp + 0x210]
call fcn.10011c4a
xor edi, edi
inc edi
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jl 0x100223c1
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100223bb
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
dec dword [esp + 0x20]
jns 0x100223a7
mov dword [esp + 0x38], 0x1743
cmp dword [esp + 0x38], 0x124f
jge 0x100225ae
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
mov dword [esp + 0xd4], ebx
push 0x61
pop esi
push esi
lea eax, [esp + 0x374]
mov dword [esp + 0x3e8], 0x10
push edi
push eax
call fcn.100559a0
add esp, 0xc
mov word [esp + 0x370], 0
push 2
pop eax
mov dword [esp + 0x8c], eax
cmp byte [esp + eax + 0x370], 0
je 0x1002245e
lea eax, [esp + 0x8c]
push eax
lea ecx, [esp + 0xd0]
call fcn.10023406
mov eax, dword [esp + 0x8c]
push 2
pop edx
lea ecx, [eax + eax]
jmp 0x1002245a
inc edx
mov byte [esp + ecx + 0x370], bl
mov ecx, edx
imul ecx, eax
cmp ecx, esi
jl 0x1002244d
inc eax
mov dword [esp + 0x8c], eax
cmp eax, esi
jl 0x10022420
mov eax, dword [esp + 0xd0]
sub eax, dword [esp + 0xcc]
sar eax, 2
mov dword [esp + 0x38], eax
jmp 0x10022579
mov eax, dword [esp + 0x38]
or esi, 0xffffffff
mov dword [esp + 0x24], esi
test eax, eax
jle 0x10022544
mov edx, dword [esp + 0xcc]
mov dword [esp + 0x34], edx
mov dword [esp + 0x48], eax
mov eax, dword [edx]
cdq
push edx
push eax
push edi
push ecx
mov dword [esp + 0x3c], eax
mov dword [esp + 0x54], edx
call fcn.1006f350
or eax, edx
jne 0x10022526
mov esi, dword [esp + 0x34]
mov dword [esp + 0x20], ebx
mov ebx, dword [esp + 0x68]
push dword [esp + 0x44]
push dword [esp + 0x30]
push edi
push ebx
call fcn.1006f2a0
inc dword [esp + 0x20]
mov ebx, eax
mov edi, edx
mov dword [esp + 0x68], ebx
mov dword [esp + 0x6c], edi
mov eax, dword [esi]
cdq
mov ecx, edx
mov dword [esp + 0x2c], eax
push ecx
push eax
push edi
push ebx
mov dword [esp + 0x54], ecx
call fcn.1006f350
or eax, edx
je 0x100224ca
mov esi, dword [esp + 0x24]
push 0
pop ebx
cmp esi, 0xffffffff
jne 0x10022515
mov esi, dword [esp + 0x20]
jmp 0x10022522
mov edx, dword [esp + 0x20]
mov ecx, esi
call fcn.1002076a
mov esi, eax
mov dword [esp + 0x24], esi
mov edx, dword [esp + 0x34]
mov ecx, dword [esp + 0x68]
add edx, 4
dec dword [esp + 0x48]
mov dword [esp + 0x34], edx
jne 0x100224a6
cmp esi, 0xffffffff
jne 0x10022547
xor esi, esi
inc esi
cmp edi, ebx
jg 0x10022567
jl 0x10022557
cmp dword [esp + 0x68], ebx
jae 0x10022567
jmp 0x10022557
sar esi, 1
mov eax, esi
and eax, 0x80000001
jns 0x10022565
dec eax
or eax, 0xfffffffe
inc eax
je 0x10022555
push esi
mov ecx, 0x106605f8
call fcn.10011129
push eax
call fcn.10013ebe
pop ecx
lea eax, [esp + 0x68]
mov ecx, 0x10660718
push eax
call fcn.10023043
mov ecx, dword [esp + 0x68]
mov eax, ecx
mov edi, dword [esp + 0x6c]
or eax, edi
jne 0x10022484
or dword [esp + 0x3e4], 0xffffffff
lea ecx, [esp + 0xcc]
call fcn.10011c4a
mov dword [esp + 0x28], 0xc6e5
mov dword [esp + 0x38], 0x5047c4d1
mov dword [esp + 0x38], 0xfadacd7d
mov dword [esp + 0x38], 0x193d
cmp dword [esp + 0x38], 0x5fa
jge 0x10022809
mov dword [esp + 0x64], 0xf
mov dword [esp + 0x60], ebx
mov byte [esp + 0x50], bl
lea eax, [esp + 0x10c]
mov dword [esp + 0x3e4], 0x11
push eax
mov ecx, 0x10660718
call fcn.10010f2e
lea edx, [esp + 0x50]
mov ecx, eax
call fcn.100246f7
mov esi, dword [esp + 0x10c]
cmp esi, 1
jne 0x1002266e
mov edi, 0x10009f4c
push edi
call fcn.100556e0
pop ecx
push eax
push edi
push dword [esp + 0x68]
push ecx
lea ecx, [esp + 0x60]
call fcn.1002384d
mov ecx, 0x106605f8
test eax, eax
jne 0x1002265d
mov edx, 0x10009edc
call fcn.1000d867
push eax
call fcn.10013ebe
pop ecx
mov edi, ebx
jmp 0x1002272e
mov edx, 0x10009ed8
call fcn.1000d867
push eax
call fcn.10013ebe
pop ecx
cmp esi, 2
jne 0x100226ce
mov edi, 0x10009e04
push edi
call fcn.100556e0
pop ecx
push eax
push edi
push dword [esp + 0x68]
push ecx
lea ecx, [esp + 0x60]
call fcn.1002384d
test eax, eax
je 0x100226b8
mov edi, 0x10009e10
push edi
call fcn.100556e0
pop ecx
push eax
push edi
push dword [esp + 0x68]
push ecx
lea ecx, [esp + 0x60]
call fcn.1002384d
mov edx, 0x10009ed8
test eax, eax
jne 0x100226bd
mov edx, 0x10009edc
mov ecx, 0x106605f8
call fcn.1000d867
push eax
call fcn.10013ebe
pop ecx
xor edi, edi
inc edi
cmp esi, edi
jle 0x10022724
mov edx, dword [esp + 0x64]
lea eax, [esp + 0x50]
cmp edx, 0x10
lea ecx, [esp + 0x50]
cmovae eax, dword [esp + 0x50]
cmovae ecx, dword [esp + 0x50]
mov al, byte [edi + eax]
cmp al, byte [edi + ecx - 1]
jne 0x1002271f
cmp edx, 0x10
lea eax, [esp + 0x50]
cmovae eax, dword [esp + 0x50]
cmp byte [edi + eax], 0x31
jne 0x1002271f
mov edx, 0x10009f50
mov ecx, 0x106605f8
call fcn.1000d867
push eax
call fcn.10013ebe
pop ecx
inc edi
cmp edi, esi
jl 0x100226d5
mov edi, ebx
test esi, esi
jle 0x100227db
mov edx, dword [esp + 0x64]
lea eax, [esp + 0x50]
mov ecx, dword [esp + 0x50]
cmp edx, 0x10
cmovae eax, ecx
cmp byte [edi + eax], 0x30
jne 0x100227d2
cmp edx, 0x10
mov byte [esp + 0x17], 1
lea eax, [esp + 0x50]
cmovae eax, ecx
xor edx, edx
inc edx
mov byte [edi + eax], 0x31
cmp esi, edx
jle 0x100227a3
cmp dword [esp + 0x64], 0x10
lea eax, [esp + 0x50]
lea ecx, [esp + 0x50]
cmovae eax, dword [esp + 0x50]
cmovae ecx, dword [esp + 0x50]
mov al, byte [eax + edx]
cmp al, byte [ecx + edx - 1]
jne 0x10022798
cmp dword [esp + 0x64], 0x10
lea eax, [esp + 0x50]
cmovae eax, dword [esp + 0x50]
cmp byte [eax + edx], 0x31
je 0x1002279f
inc edx
cmp edx, esi
jl 0x10022764
jmp 0x100227a3
mov byte [esp + 0x17], bl
cmp dword [esp + 0x64], 0x10
lea eax, [esp + 0x50]
cmovae eax, dword [esp + 0x50]
cmp byte [esp + 0x17], 0
mov byte [eax + edi], 0x30
je 0x100227d2
mov edx, 0x10009f50
mov ecx, 0x106605f8
call fcn.1000d867
push eax
call fcn.10013ebe
pop ecx
inc edi
cmp edi, esi
jl 0x1002272e
mov edx, 0x10009f54
mov ecx, 0x106605f8
call fcn.1000d867
push eax
call fcn.10013ebe
or dword [esp + 0x3e8], 0xffffffff
xor edi, edi
pop ecx
push ebx
inc edi
lea ecx, [esp + 0x54]
push edi
call fcn.1000c279
jmp 0x1002280c
xor edi, edi
inc edi
mov dword [esp + 0x1c], ebx
jmp 0x10022825
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x330], 0xfffffff7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x10022812
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x28]
cmp eax, edi
setg cl
mov dword [esp + 0x338], ecx
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
add edx, ecx
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x28]
setne cl
xor edx, edx
imul ecx, ecx, 0xe305
cmp ecx, eax
setne dl
mov dword [esp + 0x38], edx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10022888
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov ecx, dword [esp + 0x19c]
test ecx, ecx
je 0x100228aa
call fcn.1002070a
mov esi, eax
lea eax, [esp + 0x78]
push eax
mov dword [esp + 0x34], esi
call fcn.100237eb
mov dword [eax], esi
mov dword [esp + 0x10], 0xfffffffc
mov dword [esp + 0x2c], 0x9a924c00
push 2
mov dword [esp + 0x3c], edi
mov dword [esp + 0x20], ebx
pop ecx
jmp 0x100228da
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x2cc], 0x95a9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x100228c7
mov eax, dword [esp + 0x10]
imul eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x10]
jg 0x100228ff
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
mov eax, ebx
cmp dword [esp + 0x2c], ebx
je 0x10022901
mov eax, edi
mov dword [esp + 0x38], eax
mov dword [esp + 0x10], ebx
jmp 0x1002291e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2cc], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1002290b
lea ecx, [esp + 0x198]
call fcn.1001cc32
push 3
pop esi
push esi
lea ecx, [esp + 0x154]
call fcn.10011475
mov dword [esp + 0x3e4], 0x12
lea ecx, [esp + 0x140]
mov dword [esp + 0x24], edi
push esi
call fcn.10011475
mov byte [esp + 0x3e4], 0x13
mov dword [esp + 0x10], ebx
jmp 0x10022980
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0x33a4a9bd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1002296a
mov dword [esp + 0x10], ebx
jmp 0x1002299f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x140]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1002298c
push 2
pop eax
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], ebx
jl 0x10022bf5
mov dword [esp + 0x18], edi
mov dword [esp + 0x38], 0x1871d0c0
mov dword [esp + 0x18], ebx
jmp 0x10022bde
mov dword [esp + 0x10], 0xfffffff9
mov dword [esp + 0x34], 0xfffffffc
mov dword [esp + 0x2c], 0x8ba54f90
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], ebx
jl 0x10022bda
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 0x433ac254
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
jl 0x10022bd0
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x264]
push eax
call fcn.10011475
mov dword [esp + 0x48], 0xe5a1ae28
mov dword [esp + 0x28], ebx
jmp 0x10022a3c
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x264]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jl 0x10022a2a
mov dword [esp + 0x28], ebx
jmp 0x10022bac
mov dword [esp + 0x20], ebx
jmp 0x10022a65
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xe0], 0x2f1fcc10
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x10022a52
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x34], edi
mov ecx, dword [esp + 0xe0]
mov eax, dword [esp + 0x34]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
mov edx, 0xffff
sete cl
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x140]
mov dword [eax], ecx
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x150]
cmp edx, dword [eax + ecx*4]
mov eax, dword [esp + 0x18]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
imul ecx, dword [esp + 0x38]
test ecx, ecx
jne 0x10022b99
mov eax, dword [esp + 0x140]
xor edx, edx
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x264]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
mov eax, dword [esp + 0x150]
cmp dword [eax + ecx*4], ebx
mov eax, dword [esp + 0xe0]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x150]
setle cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
setge dl
xor ecx, ecx
cmp edx, dword [eax + edi*4]
mov eax, dword [esp + 0x2c]
setle cl
mov dword [esp + 0x44], ecx
xor ecx, ecx
cmp dword [esp + 0x44], eax
setne cl
xor eax, eax
cmp ecx, 4
setge al
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0xe0]
cmp dword [esp + 0x20], eax
je 0x10022b62
mov ecx, edi
mov eax, dword [esp + 0x28]
add eax, 0xfffffffb
add eax, ecx
mov dword [esp + 0x34], eax
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 2
jle 0x10022a4c
lea ecx, [esp + 0x264]
call fcn.10011c4a
dec dword [esp + 0x1c]
push 2
pop eax
jns 0x10022a0b
dec dword [esp + 0x10]
jns 0x100229f1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], eax
jle 0x100229cb
dec dword [esp + 0x24]
jns 0x100229b6
push 3
pop esi
lea ecx, [esp + 0x140]
call fcn.10011c4a
or dword [esp + 0x3e4], 0xffffffff
lea ecx, [esp + 0x150]
call fcn.10011c4a
cmp dword [esp + 0x30], 0
je 0x10022f0a
push esi
lea ecx, [esp + 0x280]
call fcn.10011475
mov dword [esp + 0x3e4], 0x14
mov dword [esp + 0x34], edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x20], ebx
jmp 0x10022c5c
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x27c]
mov dword [eax + ecx*4], 0x9841b3c6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x10022c46
mov dword [esp + 0x34], 2
cmp dword [esp + 0x34], ebx
jl 0x10022ece
mov dword [esp + 0x1c], 0x48f69f7f
mov dword [esp + 0x38], 0xd585ed06
mov dword [esp + 0x38], 0xfffffffb
mov dword [esp + 0x20], ebx
jmp 0x10022ca5
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x350], 0x4145c174
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x10022c92
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10022cbf
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov dword [esp + 0x1c], ebx
jmp 0x10022eb9
mov dword [esp + 0x38], 0x1b43
cmp dword [esp + 0x38], 0x120e
jge 0x10022dcc
lea eax, [esp + 0x16c]
mov ecx, 0x10660718
push eax
call fcn.10010f2e
mov esi, dword [esp + 0x16c]
lea ecx, [esp + 0x160]
push esi
call fcn.10011475
mov byte [esp + 0x3e4], 0x15
test esi, esi
jle 0x10022d2a
mov edi, dword [esp + 0x160]
mov ebx, esi
push edi
mov ecx, 0x10660718
call fcn.10010f2e
add edi, 4
dec ebx
jne 0x10022d19
mov eax, esi
mov edi, ebx
cdq
sub eax, edx
mov edx, dword [esp + 0x160]
sar eax, 1
test eax, eax
jle 0x10022d7c
mov dword [esp + 0x38], 0x5a40f2fd
mov dword [esp + 0x38], ebx
mov dword [esp + 0x38], edi
mov dword [esp + 0x20], ebx
mov dword [esp + 0x38], 0xec0021fb
mov dword [esp + 0x20], ebx
jmp 0x10022e01
cmp dword [esp + 0x20], esi
jl 0x10022dee
cmp dword [esp + 0x1c], 2
jle 0x10022cc8
dec dword [esp + 0x34]
jns 0x10022c74
or dword [esp + 0x3e4], 0xffffffff
lea ecx, [esp + 0x27c]
call fcn.10011c4a
mov edx, dword [esp + 0xc4]
mov ecx, dword [esp + 0x30]
call fcn.10020760
mov esi, eax
lea eax, [esp + 0xc8]
push eax
mov dword [esp + 0x174], esi
call fcn.10023789
mov dword [eax], esi
mov eax, dword [ebp + 8]
lea esi, [esp + 0x170]
mov ecx, dword [esp + 0x3dc]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret