Function at 0x10017817
Capabilities:
Check os version
Create thread
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], 0xe90a624c
xor edx, edx
mov dword [ebp - 0xc], 0xfffffffe
push 4
mov dword [ebp - 0x88], ecx
mov dword [ebp - 4], edx
pop edi
jmp 0x10017850
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xbc], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10017843
push 1
mov dword [ebp - 4], edx
pop esi
jmp 0x1001786a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x1001785d
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xb0]
mov eax, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xbc]
sub eax, dword [ebp - 0xbc]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp - 4]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], edx
jmp 0x100178e6
mov dword [ebp - 0x18], 0xfffffff7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffffb
jne 0x100178d6
mov dword [ebp - 0x80], 0xffffffff
mov eax, 0x6bbb3073
mov dword [ebp - 0x7c], 0xffffffff
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], 0xce01153a
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x1c], edx
jmp 0x10017945
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcc], 0x1f94964a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10017934
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xc8], edx
jmp 0x10017999
mov dword [ebp - 0x1c], edx
jmp 0x1001796b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x34], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001795d
mov dword [ebp - 0x34], edx
jmp 0x1001798d
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1001798a
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
xor edx, edx
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 3
jle 0x10017975
inc dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], 3
jle 0x10017958
mov dword [ebp - 4], 3
mov dword [ebp - 0x28], 5
cmp dword [ebp - 4], edx
jl 0x10017ac7
push 5
pop edi
mov dword [ebp - 8], 0xcafe8b0d
mov dword [ebp - 0xc], 4
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x18], 0x57a772be
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 3
jg 0x10017a9e
mov dword [ebp - 0xc], 0xfffffffc
cmp dword [ebp - 8], edx
jne 0x10017a48
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 8]
cmp eax, 0x509b9552
mov eax, dword [ebp - 4]
setne cl
mov dword [ebp + eax*4 - 0xcc], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, 0xc010
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0xc], ecx
mov eax, edx
cmp dword [ebp - 0xc], edx
je 0x10017a4a
mov eax, esi
imul eax, eax, 0xfff9
sub eax, dword [ebp - 8]
je 0x10017a5c
mov eax, esi
cmp dword [ebp - 8], edx
jne 0x10017a5e
mov eax, edx
mov dword [ebp - 0xc], eax
xor edx, edx
mov eax, dword [ebp - 8]
push 0
mov ecx, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setne dl
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
pop edx
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x100179e4
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
dec eax
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x148]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
dec dword [ebp - 4]
jns 0x100179bc
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 8], 0xed9ba07e
mov dword [ebp - 0x24], 0xd9ee1c97
mov dword [ebp - 4], 0xfd77ccca
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], 0xfffffffe
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10017b03
push edx
push 0x9c
push edx
push edx
push 0x474
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x24], 0x85faafe3
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 8]
jl 0x10017b28
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 4]
sub eax, 0x1af6658d
neg eax
sbb eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 0x22e9
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], 0xfffe
mov dword [ebp - 4], ecx
jmp 0x10017b95
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x30], 0xfffffff7
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10017b87
mov dword [ebp - 4], ecx
jmp 0x10017bb0
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1a8], 0xfffffff6
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10017b9f
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1a0], eax
mov ecx, dword [ebp - 0x30]
imul ecx, eax
mov eax, dword [ebp - 0x30]
push 3
sub ecx, 0x36efa05e
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0xc576
sete dl
xor ecx, ecx
sub edx, 0x61a6b719
imul edx, eax
mov eax, dword [ebp - 0x24]
sub edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setne cl
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0xc]
xor edx, edx
mov dword [ebp - 4], 0xfffffff7
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0x70c3099c
mov dword [ebp - 0x18], 0xfd9d0890
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 0x9b69
mov dword [ebp - 0xc], 0xdad816f9
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], edx
pop ecx
jmp 0x10017c75
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x118], 0x3718bd85
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10017c64
mov dword [ebp - 4], edx
jmp 0x10017c8c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf8], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10017c7f
mov dword [ebp - 0xc], 0xfffffff9
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x118], eax
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xf8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
dec dword [ebp - 0xe4]
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xf0]
mov eax, dword [ebp - 0xf0]
cmp dword [ebp - 0x14], eax
jne 0x10017d08
mov eax, esi
cmp dword [ebp - 0x114], edx
jne 0x10017d0a
mov eax, edx
imul eax, eax, 0xf455
push 4
pop ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 0xfffffff7
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], edx
jmp 0x10017d36
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1d0], 0xe48d327c
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10017d25
mov dword [ebp - 4], edx
jmp 0x10017d51
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xdc], 0xdb505206
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10017d40
mov dword [ebp - 0xd8], edx
jmp 0x10017d71
mov eax, dword [ebp - 0xd8]
mov dword [ebp + eax*4 - 0x1d0], edx
inc dword [ebp - 0xd8]
cmp dword [ebp - 0xd8], ecx
jl 0x10017d5e
mov dword [ebp - 0x1c], 0xfffffff8
cmp dword [ebp - 0x1c], 0xfffffffa
jne 0x10017db2
mov dword [ebp - 0x18], 0x3707
cmp dword [ebp - 0x18], edx
jne 0x10017daf
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10017da6
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
xor edx, edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffa
je 0x10017d86
push 4
pop ecx
mov dword [ebp - 0xc], 0x1b76e1ee
mov dword [ebp - 8], 0x32b1cecb
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 4], edx
jmp 0x10017dd6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x38], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10017dcc
mov dword [ebp - 4], edx
jmp 0x10017df1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c0], 0x8d239be9
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10017de0
mov dword [ebp - 8], edx
cmp dword [ebp - 8], edx
jl 0x10017f36
mov dword [ebp - 0x1c], 0x9f7fd1e8
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x18], 0x145c
mov dword [ebp - 0x18], 0xa4087b33
mov dword [ebp - 0x1c], edx
jmp 0x10017e2c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x19c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10017e1f
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], edx
jl 0x10017eb1
mov dword [ebp - 4], 0xb9dd952e
mov dword [ebp - 0x14], 0xfffffffd
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xc], 0x253a34c8
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edx
jl 0x10017e6d
mov dword [ebp - 0xc], 0xffffffff
inc dword [ebp - 0xc]
dec dword [ebp - 4]
jns 0x10017e5e
mov dword [ebp - 0x14], edx
jmp 0x10017ea7
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edx
jl 0x10017ea4
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], edx
jl 0x10017e9f
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10017e9a
push edx
push 0x1981
push edx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
xor edx, edx
dec dword [ebp - 0x24]
jns 0x10017e82
dec dword [ebp - 4]
jns 0x10017e7a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x10017e72
dec dword [ebp - 0x1c]
jns 0x10017e3a
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x19c], eax
test eax, eax
je 0x10017ecf
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x20], eax
jl 0x10017ecf
mov edx, esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, 0xb2bc
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 7
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x38]
imul eax, dword [ebp - 0x38], 0xc28c
test eax, eax
jne 0x10017f16
mov eax, edx
cmp dword [ebp - 0x1c], edx
je 0x10017f18
mov eax, esi
mov dword [ebp - 0x1b4], eax
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov eax, dword [ebp - 8]
push 4
mov dword [ebp + eax*4 - 0x38], ecx
dec dword [ebp - 8]
pop ecx
jns 0x10017e02
mov dword [ebp - 0xc], 0xc9bf5e4d
push 3
mov dword [ebp - 0x18], 0x8acc4b7c
mov dword [ebp - 0x14], edx
pop ecx
jmp 0x10017f5a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x50], 0x7ddc85f7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10017f4c
mov dword [ebp - 0x48], edx
cmp dword [ebp - 0x48], 0xfffffff4
jge 0x10017fb7
mov dword [ebp - 0xc], esi
xor ecx, ecx
mov dword [ebp - 0x18], 0xc58bdfad
mov eax, dword [ebp - 0x48]
cmp eax, 0xfffffffd
setge cl
cmp dword [ebp - 0x48], ecx
jne 0x10017f8f
mov eax, dword [ebp - 0x48]
mov ecx, edx
sub eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
je 0x10017f91
mov ecx, esi
mov eax, dword [ebp - 0x48]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
push 0
setge dl
xor ecx, ecx
cmp eax, edx
pop edx
setg cl
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xfffffff4
jl 0x10017f68
push 3
pop ecx
mov dword [ebp - 0x18], 0x2542
mov dword [ebp - 0xc], esi
mov dword [ebp - 0xc], 0x4aca62e2
mov dword [ebp - 0xc], 0x18e8dce9
mov dword [ebp - 0xc], 0xfffffffb
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0xc], 5
mov dword [ebp - 0xc], 0xe7924a04
mov dword [ebp - 0xc], 0xe0ad50a0
mov dword [ebp - 0xc], 0xfffffff7
mov dword [ebp - 0xc], 0x48eca1ae
mov dword [ebp - 0xc], 0xd2d97b6e
mov dword [ebp - 0xc], 0xc31937da
mov dword [ebp - 0xc], 0x43232af7
mov dword [ebp - 0xc], edx
mov dword [ebp - 0xc], 0xad706983
mov dword [ebp - 0xc], 0xff0f9ab1
mov dword [ebp - 0xc], 0xc7d87010
mov dword [ebp - 0xc], 0x61f0846d
mov dword [ebp - 8], edx
cmp dword [ebp - 8], eax
jge 0x10018055
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x160], 0x327c
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1001803e
mov dword [ebp - 8], edx
jmp 0x1001806b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x16c], 0x44d9913d
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x1001805a
mov dword [ebp - 8], edx
jmp 0x10018086
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1b0], 0xaa3630dd
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10018075
mov dword [ebp - 8], edx
jmp 0x1001809b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x60], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10018091
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], edx
jl 0x100181d2
mov dword [ebp - 0x1c], 0x3edb3952
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], edx
jmp 0x100180d7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x184], 0xc40a98ce
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100180c6
mov eax, dword [ebp - 4]
push 0xfffffffffffffff7
pop ecx
mov eax, dword [ebp + eax*4 - 0x160]
mov dword [ebp - 0x24], 0x74d
mov eax, dword [ebp - 0x184]
sub ecx, eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
add edx, ecx
dec dword [ebp - 0xc]
cmp eax, edx
jge 0x1001810e
mov ecx, esi
xor edx, edx
jmp 0x10018112
xor edx, edx
mov ecx, edx
mov eax, 0xc193
sub eax, ecx
xor ecx, ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x160]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x160]
cmp eax, esi
sete cl
cmp ecx, 0x66593c39
jg 0x10018155
mov eax, esi
cmp dword [ebp - 0x20], edx
jne 0x10018157
mov eax, edx
cmp eax, dword [ebp - 0x1c]
jne 0x1001816b
cmp dword [ebp - 0x178], edx
je 0x1001816b
mov ecx, esi
cmp dword [ebp - 0x20], edx
jne 0x1001816d
mov ecx, edx
mov eax, dword [ebp - 4]
push 3
mov eax, dword [ebp + eax*4 - 0x160]
add eax, ecx
neg eax
pop ecx
sbb eax, eax
neg eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], edx
jl 0x100181c9
mov dword [ebp - 0xc], 0xfffffffd
mov dword [ebp - 0x14], edx
jmp 0x100181b6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100181a5
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
jns 0x10018199
dec dword [ebp - 4]
jns 0x100180ac
dec dword [ebp - 0x60]
mov dword [ebp - 8], 0xcb363f9e
mov dword [ebp - 0xc], 0x7909
mov dword [ebp - 0x1c], 0x27f08e22
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0xb6890635
mov dword [ebp - 4], edx
jmp 0x10018207
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x70], 0x9d221e9c
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100181f9
mov dword [ebp - 4], edx
jmp 0x10018222
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x9c], 8
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10018211
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
inc dword [ebp - 0x70]
mov esi, dword [ebp - 0x70]
cmp dword [ebp - 8], 0x9beab1d6
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
setl cl
xor edx, edx
cmp esi, ecx
setle dl
xor esi, esi
mov dword [ebp - 0x1c], edx
inc esi
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 8]
add eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jg 0x1001831b
mov dword [ebp - 0xc], 0xfffffffe
push 3
pop ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0x7ad46d2
mov dword [ebp - 0x14], 0x2129e5e2
mov dword [ebp - 4], 0xd96456cf
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], ecx
jge 0x100182ba
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1dc], esi
inc dword [ebp - 0x14]
jmp 0x100182a6
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
add edx, 0xbc66c7
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
neg edx
sub edx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edx
inc dword [ebp - 4]
jmp 0x10018383
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x70]
jg 0x1001833a
cmp dword [ebp - 0x1c], ecx
je 0x1001833a
mov edx, esi
cmp dword [ebp - 0xc], ecx
jne 0x1001833c
mov edx, ecx
mov eax, dword [ebp - 0x70]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x9c]
setne cl
xor edx, edx
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
imul ecx, dword [ebp - 0x20], 0xffa2
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x20], edx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x10018385
push ecx
push 0x1b1
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
xor ecx, ecx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 0x76270e7a
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0x13
jg 0x1001843d
mov dword [ebp - 4], 0xa8fecf79
mov dword [ebp - 0xc], 0x84edc022
mov dword [ebp - 0x14], ecx
jmp 0x100183cb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0x41fd9d08
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100183bd
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x5c], eax
imul eax, dword [ebp - 0x5c], 0x3b6f
mov edx, dword [ebp - 4]
push 0
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 4], ecx
xor ecx, ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0xc]
cmp edx, eax
setl cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x13
pop ecx
jle 0x100183aa
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x10018454
push 0x162b
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor ecx, ecx
mov dword [ebp - 8], 8
mov dword [ebp - 4], 0x4cd
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 4], ecx
jmp 0x1001847b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x98], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001846e
push 3
mov dword [ebp - 4], ecx
pop edx
jmp 0x1001849a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x104], 6
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x10018489
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], esi
jg 0x100185d6
mov dword [ebp - 0xc], 0x4d513c61
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], 0xaf072071
mov dword [ebp - 0x18], 0x46a1c17c
mov dword [ebp - 8], ecx
jmp 0x100184e0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x10c], 0x7ab61b58
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x100184cf
mov dword [ebp - 8], ecx
jmp 0x100184f8
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1e8], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x100184eb
mov dword [ebp - 8], ecx
jmp 0x10018513
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x90], 0xcdd7
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10018502
cmp dword [ebp - 0x94], ecx
je 0x10018557
mov ecx, dword [ebp - 0xfc]
neg ecx
sbb ecx, ecx
xor eax, eax
add ecx, 0xac0be208
cmp ecx, 4
setle al
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x104]
cmp eax, ecx
setne dl
cmp edx, dword [ebp - 0x20]
jge 0x10018555
mov edx, esi
jmp 0x10018559
xor ecx, ecx
mov edx, ecx
mov eax, dword [ebp - 0x104]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10c]
setg cl
sub ecx, eax
xor eax, eax
cmp ecx, 0xfffffff6
setne al
add eax, eax
cmp eax, dword [ebp - 0x94]
jne 0x10018583
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x8c]
dec dword [ebp - 0x8c]
cmp eax, esi
je 0x10018597
mov eax, esi
jmp 0x10018599
xor eax, eax
mov dword [ebp - 0x108], eax
xor ecx, ecx
add eax, 0xfffffffc
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x104], edx
mov eax, dword [ebp - 4]
push 3
mov eax, dword [ebp + eax*4 - 0x98]
cmp eax, edx
pop edx
sete cl
sub ecx, edx
mov dword [ebp - 0x20], ecx
inc dword [ebp - 4]
push 0
pop ecx
cmp dword [ebp - 4], esi
jle 0x100184b2
mov dword [ebp - 0xc], ecx
mov edx, ecx
mov dword [ebp - 0x18], 0x76270e7a
push 5
mov dword [ebp - 0x18], 0xffffffff
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x20], ecx
je 0x100185f9
mov edx, esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x20]
mov byte [ebp - 0xd], cl
je 0x10018627
cmp byte [ebp - 0xd], cl
je 0x10018636
push ecx
push 0x2654
push ecx
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
jmp 0x10018634
cmp byte [ebp - 0xd], cl
je 0x10018636
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
xor ecx, ecx
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x20], 0x4d0289a6
mov dword [ebp - 0x24], 0xa75a
push 3
mov dword [ebp - 0x18], 0x89b4
mov dword [ebp - 8], ecx
pop edx
jmp 0x1001866b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x130], 0x9d19ac19
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1001865a
mov dword [ebp - 8], ecx
jmp 0x10018682
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x174], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10018675
mov dword [ebp - 8], ecx
jmp 0x1001869e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x124], 0xd3ecf04b
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x1001868d
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], eax
sbb eax, eax
neg eax
mov dword [ebp - 0x170], eax
jne 0x100186b8
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x12c]
dec dword [ebp - 0x124]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x20], 0xb733c633
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x1c], 0x9d70cadd
mov dword [ebp - 0x18], 0xbc00eadd
mov dword [ebp - 4], 0x901516ea
mov dword [ebp - 0x14], ecx
jmp 0x1001872c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x168], 0xb6eb6b9d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001871b
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x24]
cmp eax, edx
cmovae esi, ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setge dl
add edx, dword [ebp - 0x20]
je 0x10018773
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
inc dword [ebp - 0x1c]
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
cmp eax, 0xe889
setl cl
cmp ecx, dword [ebp - 0x18]
jl 0x10018773
xor edx, edx
inc edx
jmp 0x10018775
xor edx, edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
imul ecx, esi
sub ecx, dword [ebp - 4]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0x13
jg 0x10018949
xor esi, esi
push 5
inc esi
pop edi
mov dword [ebp - 0x24], 0xa8fecf79
mov dword [ebp - 0x28], 0x8acc4b7c
mov dword [ebp - 0x14], edx
jmp 0x100187c6
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x44], 0x7ddc85f7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100187b8
mov dword [ebp - 0x3c], edx
cmp dword [ebp - 0x3c], 0xfffffff4
jge 0x10018821
mov dword [ebp - 0x18], esi
xor ecx, ecx
mov dword [ebp - 0x28], 0xc58bdfad
mov eax, dword [ebp - 0x3c]
cmp eax, 0xfffffffd
setge cl
cmp dword [ebp - 0x3c], ecx
jne 0x100187fc
mov eax, dword [ebp - 0x3c]
mov ecx, edx
sub eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
je 0x100187fe
mov ecx, esi
mov eax, dword [ebp - 0x3c]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
push 0
setge dl
xor ecx, ecx
cmp eax, edx
pop edx
setg cl
mov dword [ebp - 0x28], ecx
dec dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff4
jl 0x100187d5
mov dword [ebp - 0x20], 0x84edc022
mov dword [ebp - 0x14], edx
jmp 0x1001883b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64], 0x41fd9d08
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001882d
mov dword [ebp - 4], 0x1928c176
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], 0xbc657e3b
mov dword [ebp - 0x14], edx
jmp 0x1001886b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x190], 0x3bd5de1f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001885a
mov dword [ebp - 4], edx
jmp 0x100188d0
mov dword [ebp - 0x1c], edi
mov ecx, dword [ebp - 4]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffffd
setle al
xor edx, edx
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x16580849
setg cl
xor eax, eax
cmp ecx, edx
setl al
mov dword [ebp - 0x18c], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x16
jle 0x10018876
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x64], eax
imul eax, dword [ebp - 0x64], 0x3b6f
mov edx, dword [ebp - 0x24]
push 0
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul edx, eax
mov eax, dword [ebp - 0xc]
cmp edx, eax
setge cl
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
pop edx
setl cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x13
jle 0x100187a5
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x18], 0x16f93bd5
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x28], 0x9f486485
mov dword [ebp - 4], edx
jmp 0x10018970
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x140], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x1001895f
mov dword [ebp - 4], edx
jmp 0x10018985
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x58], edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001897b
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x1001899b
push edx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
mov eax, dword [ebp - 0x140]
xor edx, edx
mov eax, dword [ebp - 0x134]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x13c]
cmp ecx, eax
setge dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x58]
setl cl
xor edx, edx
add ecx, 0xffff0a5e
cmp ecx, eax
mov eax, dword [ebp - 0x140]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0xc]
setl cl
add eax, ecx
xor ecx, ecx
cmp eax, 6
setne cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov byte [ebp - 0x29], 0
mov dword [ebp - 0xc], 0xcd795364
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x28], 0xfffffff7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
cmp eax, 0xaa96141e
setne cl
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, 0x91e6
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, 0x4c5b20a
cmp ecx, dword [ebp - 0x20]
mov byte [ebp - 0xd], 0
jl 0x10018a80
cmp byte [ebp - 0xd], 0
je 0x10018a94
push 0xa85
push 0xbc2
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
jmp 0x10018a94
cmp byte [ebp - 0xd], 0
je 0x10018a94
push 0x258f
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
lea eax, [ebp - 0x29]
push 0
push eax
call fcn.1001abc3
pop ecx
pop ecx
mov eax, ebx
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0x88]
mov esi, edx
mov edi, eax
call fcn.100177a5
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret