Function at 0x1001a42f
Capabilities:
Check os version
Compare security identifiers
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008a99e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x268
push ebx
push esi
mov dword [esp + 0x58], edx
push edi
mov dword [esp + 0x1c], 9
mov dword [esp + 0x1c], 0xffffffe5
cmp dword [esp + 0x1c], 0x13
push 0
mov dword [esp + 0x50], ecx
pop ebx
jg 0x1001a4c8
mov ecx, 0x9949
mov dword [esp + 0x20], 0x506d4441
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], ebx
jmp 0x1001a4b7
mov dword [esp + 0x1b0], ecx
mov dword [esp + 0x1b4], ecx
mov dword [esp + 0x1b8], ecx
mov dword [esp + 0x1bc], ecx
mov eax, dword [esp + 0x1b0]
mov dword [esp + 0x28], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1001a48c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x13
jle 0x1001a47a
mov dword [esp + 0x28], 0xffffffff
lea ecx, [esp + 0x15c]
push 3
call fcn.10018477
mov dword [esp + 0x28], 7
xor edx, edx
mov dword [esp + 0x2c], 0x5e49
inc edx
push 0xfffffffffffffff9
mov dword [esp + 0x2c], ebx
pop eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], ebx
jmp 0x1001a512
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x50], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001a502
mov dword [esp + 0x14], ebx
jmp 0x1001a530
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x15c]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001a51e
mov eax, dword [esp + 0x50]
mov ecx, 0x83674579
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x15c]
mov eax, dword [eax + 8]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x50]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x50]
setle cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp dword [esp + 0x28], eax
setg cl
mov dword [esp + 0x28], ecx
lea ecx, [esp + 0x15c]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
call fcn.100184f9
mov dword [esp + 0x3c], 0xfb871c7b
mov dword [esp + 0x30], 0x97f6af11
push 4
mov dword [esp + 0x2c], 0xc38ec326
mov dword [esp + 0x24], ebx
pop ecx
jmp 0x1001a5de
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x248], 0xdfc3e8ce
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x1001a5cb
mov dword [esp + 0x30], ebx
jmp 0x1001a63d
mov dword [esp + 0x18], 0xf4672159
mov dword [esp + 0x2c], 0xfff9
mov dword [esp + 0x18], ebx
mov dword [esp + 0x28], 0xdb78
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x30], ebx
je 0x1001a618
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x250], eax
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xffffffea
jle 0x1001a5ea
mov dword [esp + 0x34], ecx
xor esi, esi
inc esi
mov dword [esp + 0x30], 0xfffffffe
mov dword [esp + 0x18], esi
lea ecx, [esp + 0x13c]
push 2
call fcn.10018477
mov dword [esp + 0x27c], ebx
lea eax, [esp + 0x208]
push dword [esp + 0x7c]
movdqa xmm0, xmmword [0x10007e80]
lea ecx, [esp + 0x90]
push eax
lea eax, [esp + 0x200]
mov dword [esp + 0x30], 0x13236c21
push eax
push ebx
movdqu xmmword [esp + 0x208], xmm0
mov dword [esp + 0x9c], ebx
mov dword [esp + 0xa0], ebx
mov dword [esp + 0xa4], ebx
call fcn.10019a06
mov dword [esp + 0x20], ebx
jmp 0x1001a6d3
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1001a6c1
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x30], 5
jmp 0x1001aa75
mov dword [esp + 0x38], 0x39beb064
xor edx, edx
inc edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x40], edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x20], ebx
jmp 0x1001a725
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x1cc], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1001a712
mov dword [esp + 0x38], 0xb
cmp dword [esp + 0x38], 0x1a
jle 0x1001aa55
jmp 0x1001a744
xor edx, edx
inc edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x14], 0x6b13122e
mov dword [esp + 0x3c], ebx
jmp 0x1001a914
mov dword [esp + 0x24], 0xb3921ded
mov dword [esp + 0x14], 0x71dbcabe
mov dword [esp + 0x2c], 0x9031ea06
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 0xfffffff2
jne 0x1001a910
mov edi, dword [esp + 0x13c]
mov dword [esp + 0x20], 0xf5452fa8
mov dword [esp + 0x40], 0x653ddb20
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], ebx
je 0x1001a7d1
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x1c], edx
jle 0x1001a7bb
mov ecx, edx
cmp dword [esp + 0x20], ebx
jne 0x1001a7bd
mov ecx, ebx
mov eax, dword [esp + 0x3c]
sub ecx, eax
mov eax, dword [esp + 0x38]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
jne 0x1001a7d3
mov edx, ebx
xor eax, eax
test edx, edx
sets al
xor edx, edx
sub eax, dword [esp + 0x18]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x2c], ebx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
cmp ecx, eax
mov eax, 0x3a52fa75
setge dl
sub eax, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
sub edx, eax
mov eax, dword [esp + 0x38]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
xor edx, edx
add ecx, dword [esp + 0x18]
inc edx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov dword [edi + 4], ecx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x40]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x1c]
sub ecx, eax
mov dword [esp + 0x14], ecx
jne 0x1001a874
mov esi, ebx
cmp dword [esp + 0x14], ebx
je 0x1001a876
mov esi, edx
mov eax, dword [esp + 0x38]
xor ecx, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x40]
cmp eax, esi
setne cl
imul ecx, dword [esp + 0x20]
test ecx, ecx
jne 0x1001a89a
cmp dword [esp + 0x3c], ebx
jne 0x1001a89a
mov edx, ebx
mov dword [esp + 0x28], edx
mov eax, dword [esp + 0x28]
push 0xfffffffffffffff8
pop ecx
cmp ecx, eax
mov eax, dword [esp + 0x40]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
xor ecx, ecx
sub edx, 0xa37e
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
setge cl
add ecx, 0x5444fe37
jne 0x1001a8e1
cmp dword [esp + 0x2c], ebx
jne 0x1001a8e1
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x1001a8e6
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [esp + 0x8c]
mov dword [eax], ecx
test ecx, ecx
je 0x1001a8fb
mov eax, edx
cmp dword [esp + 0x14], ebx
jne 0x1001a8fd
mov eax, ebx
mov dword [esp + 0x40], eax
dec dword [esp + 0x24]
cmp dword [esp + 0x24], 0xfffffff2
je 0x1001a787
dec dword [esp + 0x3c]
cmp dword [esp + 0x3c], 0xffffffe6
jl 0x1001a759
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], ebx
jl 0x1001aa40
mov edi, dword [esp + 0x13c]
jmp 0x1001a93d
xor edx, edx
inc edx
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x14]
cmp eax, edx
mov eax, dword [esp + 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x14]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
add ecx, 2
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp dword [esp + 0x2c], eax
setle cl
xor eax, eax
cmp ecx, dword [edi + 4]
mov ecx, dword [esp + 0x38]
setg al
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
add ecx, dword [esp + 0x1c]
imul ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x1001a9b7
cmp dword [esp + 0x1d0], ebx
jne 0x1001a9b7
mov esi, ebx
jmp 0x1001a9ba
xor esi, esi
inc esi
mov ecx, dword [esp + 0x14]
xor edx, edx
sub esi, dword [edi + 4]
mov eax, dword [esp + 0x8c]
cmp dword [eax + ecx*4], esi
mov eax, dword [esp + 0x40]
setne dl
xor ecx, ecx
inc edx
cmp edx, dword [edi + 4]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xf76caf44
setl cl
cmp eax, ecx
sbb eax, eax
add eax, 0x63a2f86f
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xdee2
mov eax, dword [esp + 0x8c]
setge cl
mov dword [eax], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001aa36
push 0xcc7
push 0x49f
push 0x2282
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
dec dword [esp + 0x14]
jns 0x1001a93a
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 0x1a
jg 0x1001a741
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001aa71
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0x1d
jg 0x1001a6ed
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001aa93
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
lea ecx, [esp + 0x8c]
call fcn.100184f9
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x13c]
call fcn.100184f9
xor ecx, ecx
mov dword [esp + 0x40], 0xd66c4a87
mov dword [esp + 0x24], ebx
inc ecx
jmp 0x1001aad4
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x58], 0x4a6847df
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jl 0x1001aac4
mov dword [esp + 0x2c], 0xfffffffa
mov dword [esp + 0x24], ebx
jmp 0x1001aafb
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x1d4], 0xffffffff
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jl 0x1001aae8
mov dword [esp + 0x2c], ebx
cmp dword [esp + 0x2c], ebx
jl 0x1001ab27
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ab1e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
dec dword [esp + 0x2c]
jns 0x1001ab0b
xor ecx, ecx
inc ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0xe8]
mov dword [esp + 0x14], 0x12d2c87a
mov dword [esp + 0x30], 0xda8ed40a
mov dword [esp + 0x38], 0xde64f6cb
push 2
call fcn.10018477
mov dword [esp + 0x24], ebx
jmp 0x1001ab6d
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0x1a82e77e
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001ab57
mov eax, dword [esp + 0x14]
xor esi, esi
mov eax, dword [esp + 0x14]
inc esi
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], esi
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xffffffff
setge al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x14], eax
je 0x1001abc3
cmp dword [esp + 0x14], ebx
je 0x1001abc3
xor eax, eax
inc eax
mov ecx, eax
jmp 0x1001abc8
xor eax, eax
mov ecx, ebx
inc eax
mov esi, dword [sym.imp.USER32.dll_GetDoubleClickTime]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x1c], ebx
jmp 0x1001ac66
mov dword [esp + 0x28], 0x4ddc87
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
jl 0x1001ac3e
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jl 0x1001ac38
mov dword [esp + 0x38], ebx
jmp 0x1001ac13
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0x255d5800
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 2
jl 0x1001abfd
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xe8]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x14]
jns 0x1001abf7
xor eax, eax
inc eax
dec dword [esp + 0x30]
jns 0x1001abed
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
jl 0x1001ac62
dec dword [esp + 0x28]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ac59
call esi
dec dword [esp + 0x30]
jns 0x1001ac48
xor eax, eax
inc eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], eax
jle 0x1001abdb
lea ecx, [esp + 0xe8]
call fcn.100184f9
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001ac91
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
mov dword [esp + 0x34], 0xe559
mov dword [esp + 0x34], 0x7a7c2039
mov dword [esp + 0x34], 0x167fa5c6
mov dword [esp + 0x34], 0x4b666a75
mov dword [esp + 0x34], 0xf5ed9a92
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x34], 7
mov dword [esp + 0x28], 0xb95ae649
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001acde
call esi
dec dword [esp + 0x28]
mov dword [esp + 0x3c], ebx
jmp 0x1001b5fc
mov dword [esp + 0x34], 0xef20fe6e
xor ecx, ecx
mov dword [esp + 0x34], 0xbeccce1e
inc ecx
mov dword [esp + 0x34], 2
mov dword [esp + 0x34], 0xe923e64f
mov dword [esp + 0x34], 0xfffffff9
mov dword [esp + 0x34], 0x68029989
mov dword [esp + 0x34], ecx
mov dword [esp + 0x34], 0x6985
mov dword [esp + 0x28], 0xe6b99bf0
mov dword [esp + 0x14], ebx
jmp 0x1001ad47
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x258], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001ad38
mov dword [esp + 0x14], ebx
jmp 0x1001ad67
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1e4], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001ad54
mov dword [esp + 0x14], ebx
jmp 0x1001ad7f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x70], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x1001ad73
inc dword [esp + 0x28]
lea eax, [esp + 0x218]
push dword [esp + 0x70]
xorps xmm0, xmm0
mov dword [esp + 0x24], 0x99244325
push eax
lea eax, [esp + 0x210]
mov dword [esp + 0xd4], ebx
push eax
push ebx
lea ecx, [esp + 0xdc]
mov dword [esp + 0xe0], ebx
movdqu xmmword [esp + 0x218], xmm0
mov dword [esp + 0xe4], ebx
call fcn.10019a06
xor ecx, ecx
inc ecx
mov dword [esp + 0x27c], ecx
mov eax, dword [esp + 0xcc]
mov dword [esp + 0x14], 0xecb302af
mov dword [esp + 0x1c], 6
mov dword [esp + 0x28], 0xffffffff
mov edx, dword [eax + 0xc]
xor eax, eax
cmp edx, ecx
mov dword [esp + 0x30], 0x625c2a3d
mov dword [esp + 0x18], 0xec3a435f
setne al
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
cmp ecx, 4
setne dl
xor eax, eax
xor esi, esi
inc esi
cmp edx, esi
setne al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], 0xf
jmp 0x1001b016
mov dword [esp + 0x2c], 0x459f451d
lea ecx, [esp + 0x100]
push 4
call fcn.10018477
mov byte [esp + 0x27c], 2
mov dword [esp + 0x24], ebx
jmp 0x1001ae86
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0xe87bb6ab
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 4
jl 0x1001ae70
mov dword [esp + 0x14], ebx
jmp 0x1001af86
xor eax, eax
lea ecx, [esp + 0x174]
inc eax
mov dword [esp + 0x20], eax
push eax
call fcn.10018477
xor esi, esi
mov dword [esp + 0x24], ebx
inc esi
jmp 0x1001aec9
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x174]
mov dword [eax + ecx*4], 0x87e17710
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x1001aeb3
cmp dword [esp + 0x2c], ebx
jne 0x1001af65
mov eax, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
setge dl
imul edx, dword [esp + 0x14]
mov dword [esp + 0x28], edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
add eax, 0xffff9437
add eax, ecx
xor ecx, ecx
test eax, eax
mov eax, dword [esp + 0x20]
setg cl
cmp ecx, 0xad446302
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x58d3b3e2
setl al
xor edx, edx
cmp eax, 0xfffffffb
setne dl
sub edx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor eax, eax
add ecx, dword [esp + 0x2c]
cmp ecx, 0x63b8
setne al
cmp eax, 0xf2b6367a
ja 0x1001af65
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], esi
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x174]
mov dword [eax], ecx
lea ecx, [esp + 0x174]
call fcn.100184f9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 7
jl 0x1001ae96
mov dword [esp + 0x30], ebx
jmp 0x1001aff7
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x14], 0xfffffff1
cmp dword [esp + 0x14], 0xfffffffb
jne 0x1001afcb
mov eax, dword [esp + 0x100]
mov dword [eax + 0xc], 0x2350c165
dec dword [esp + 0x18]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xfffffffb
je 0x1001afb5
cmp dword [esp + 0x34], ebx
je 0x1001afe1
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x100]
mov dword [eax + 0xc], ecx
jmp 0x1001aff3
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001aff3
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0xc
je 0x1001af97
lea ecx, [esp + 0x100]
mov byte [esp + 0x27c], 1
call fcn.100184f9
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe8
jg 0x1001ae4c
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0xcc]
call fcn.100184f9
xor eax, eax
inc eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], 0xfffffff6
mov dword [esp + 0x24], ebx
jmp 0x1001b061
cmp byte [esp + 0x13], 0
je 0x1001b05d
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 6
mov byte [esp + 0x13], bl
je 0x1001b04e
cmp byte [esp + 0x13], 0
je 0x1001b0b8
push 0x9d0
push 0x48b
push 0x26b9
push ebx
push 0xa88
push 0xf77
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push 0x6dd
push 0x21a9
push 0xb2c
push 0x2f
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov dword [esp + 0x20], ebx
jmp 0x1001b3dd
mov dword [esp + 0x2c], 5
lea ecx, [esp + 0x1d8]
mov dword [esp + 0x18], ebx
push 1
call fcn.10018477
mov dword [esp + 0x27c], 3
mov dword [esp + 0x38], ebx
jmp 0x1001b0ff
mov eax, dword [esp + 0x38]
mov dword [esp + eax*4 + 0xd8], 0xffff
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 4
jl 0x1001b0ec
mov dword [esp + 0x38], ebx
jmp 0x1001b122
mov ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x1d8]
mov dword [eax + ecx*4], 0x46552ded
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 1
jl 0x1001b10c
mov dword [esp + 0x18], 0xffffffec
jmp 0x1001b341
mov dword [esp + 0x38], 0x8d581621
mov dword [esp + 0x38], ebx
jmp 0x1001b332
mov dword [esp + 0x14], ebx
lea ecx, [esp + 0x130]
push 1
call fcn.10018477
xor edx, edx
mov byte [esp + 0x27c], 4
inc edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], ebx
jmp 0x1001b184
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0x8fa8f90a
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jl 0x1001b16e
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 3
jg 0x1001b2c9
push 0xfffffffffffffffc
pop eax
mov dword [esp + 0x30], eax
push 0xfffffffffffffff8
pop ecx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x34], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], 3
cmp dword [esp + 0x30], ebx
jl 0x1001b1ef
mov eax, dword [esp + 0x130]
mov dword [eax], 0x545ee28f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b1e9
push 0x10e7
push 0x1e67
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
dec dword [esp + 0x30]
jns 0x1001b1bd
mov dword [esp + 0x30], ebx
jmp 0x1001b2ac
push 2
lea ecx, [esp + 0x19c]
call fcn.10018477
mov dword [esp + 0x24], ebx
jmp 0x1001b222
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x198]
mov dword [eax + ecx*4], 0x9e9d60a2
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 2
jl 0x1001b20c
mov esi, dword [esp + 0x198]
mov dword [esi + 4], ebx
mov eax, dword [esi + 4]
cmp dword [esp + eax*4 + 0xd8], ebx
je 0x1001b27a
mov eax, dword [esp + 0x14]
xor edx, edx
cmp eax, 0x26c4
mov eax, dword [esp + 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x130]
setle cl
mov dword [eax], ecx
mov eax, dword [esp + 0x38]
mov eax, dword [esi + 4]
mov eax, dword [esp + eax*4 + 0xd8]
mov eax, dword [esp + 0xd8]
mov eax, dword [esp + 0x38]
mov eax, dword [esi + 4]
mov ecx, dword [esp + eax*4 + 0xd8]
mov eax, dword [esp + 0x38]
inc dword [esi + 4]
cmp dword [esi + 4], 3
mov dword [esp + eax*4 + 0xd8], ecx
jle 0x1001b233
inc dword [esp + 0x1c]
lea ecx, [esp + 0x198]
call fcn.100184f9
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 3
jle 0x1001b1f8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
push 1
pop edx
jle 0x1001b199
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 3
jg 0x1001b31a
jmp 0x1001b2d9
xor edx, edx
inc edx
mov dword [esp + 0x34], 0xa2c0
mov eax, dword [esp + 0x38]
cmp dword [esp + eax*4 + 0xd8], ebx
jne 0x1001b2f6
mov eax, edx
cmp dword [esp + 0x38], edx
jle 0x1001b2f8
mov eax, ebx
xor edx, edx
cmp eax, 1
mov eax, dword [esp + 0x38]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x34], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jle 0x1001b2d6
lea ecx, [esp + 0x130]
mov byte [esp + 0x27c], 3
call fcn.100184f9
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 3
jle 0x1001b147
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1c
jge 0x1001b136
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x1d8]
call fcn.100184f9
mov dword [esp + 0x34], 0xfffffff6
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + eax*4 + 0x58]
mov dword [esp + 0x40], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b38a
push ebx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
cmp dword [esp + 0x3c], ebx
jne 0x1001b394
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + eax*4 + 0x58]
cmp dword [esp + 0x3c], 0xce2e7c52
jne 0x1001b3b8
mov eax, dword [esp + 0x3c]
cmp dword [esp + eax*4 + 0x58], ebx
jne 0x1001b3b8
mov ecx, ebx
jmp 0x1001b3bb
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x28]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x20]
setg cl
mov dword [esp + eax*4 + 0x58], ecx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1001b0c1
push 2
lea ecx, [esp + 0x190]
call fcn.10018477
push 5
pop esi
push 4
lea ecx, [esp + 0x16c]
mov dword [esp + 0x280], esi
call fcn.10018477
mov dword [esp + 0x1c], 0xffffffff
xor edx, edx
mov dword [esp + 0x20], esi
inc edx
push 8
pop esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x34], 0x1b78
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], ebx
jmp 0x1001b453
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18c]
mov dword [eax + ecx*4], 0xfa5c62e0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1001b43d
mov dword [esp + 0x14], ebx
jmp 0x1001b472
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001b460
mov dword [esp + 0x14], ebx
jmp 0x1001b492
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x238], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001b47f
mov ecx, dword [esp + 0x18c]
mov eax, dword [esp + 0x28]
add eax, dword [ecx + 4]
dec dword [esp + 0x28]
test eax, eax
je 0x1001b4ef
mov esi, dword [esp + 0x168]
mov eax, dword [esi + 4]
add eax, 0xffff
jne 0x1001b4c7
mov eax, ebx
cmp dword [ecx + 4], ebx
je 0x1001b4c9
mov eax, edx
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x20]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp dword [esi + 4], eax
mov eax, edx
je 0x1001b4f1
mov eax, ebx
cmp eax, dword [esp + 0x2c]
jge 0x1001b4fd
cmp dword [esp + 0x34], ebx
jne 0x1001b4ff
mov edx, ebx
mov dword [esp + 0x23c], edx
mov dword [esp + 0x20], ebx
jmp 0x1001b5c9
mov dword [esp + 0x18], ebx
jmp 0x1001b525
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x74], 4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x1001b515
mov dword [esp + 0x1c], ebx
jmp 0x1001b5ba
mov dword [esp + 0x28], 0xffff
mov dword [esp + 0x34], 7
mov eax, dword [esp + 0x74]
cmp dword [esp + 0x74], ebx
jne 0x1001b59d
cmp dword [esp + 0x28], ebx
jne 0x1001b59d
mov dword [esp + 0x18], ebx
jmp 0x1001b56e
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x228], 0x1939efd9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001b55b
cmp dword [esp + 0x28], ebx
je 0x1001b590
cmp dword [esp + 0x74], ebx
jne 0x1001b58c
mov eax, dword [esp + 0x228]
mov eax, dword [esp + 0x74]
mov eax, dword [esp + 0x74]
mov eax, dword [esp + 0x230]
mov dword [esp + 0x34], eax
jmp 0x1001b5b6
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001b5b6
push ebx
push ebx
push 0x1d53
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xf
jl 0x1001b535
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffeb
jg 0x1001b50f
lea ecx, [esp + 0x168]
call fcn.100184f9
or dword [esp + 0x27c], 0xffffffff
lea ecx, [esp + 0x18c]
call fcn.100184f9
mov eax, dword [esp + 0x40]
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], ebx
jle 0x1001aceb
mov dword [esp + 0x2c], 0xfffffffa
lea ecx, [esp + 0x148]
mov dword [esp + 0x18], 0xffff
mov dword [esp + 0x28], 0xfffffff6
push 3
call fcn.10018477
push 2
lea ecx, [esp + 0x11c]
mov dword [esp + 0x280], 6
call fcn.10018477
mov dword [esp + 0x34], 0xc6daafd5
push 2
mov dword [esp + 0x38], 0xfffffff6
mov dword [esp + 0x18], ebx
pop edx
jmp 0x1001b671
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1e8], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001b65e
mov dword [esp + 0x14], ebx
jmp 0x1001b693