Function at 0x10017b69
Capabilities:
Get common file path
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x184
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0x76820624
push 0
mov dword [ebp - 0x30], 0x2280
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x18], 0x1d
pop ebx
jmp 0x10017bc1
mov dword [ebp - 8], 7
mov dword [ebp - 0x24], 0x9ec4279c
mov dword [ebp - 8], ebx
jmp 0x10017bb8
mov dword [ebp - 0x24], 7
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], 0xf
jge 0x10017ba8
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffff
jne 0x10017b95
mov dword [ebp - 0x18], 0xa
jmp 0x10017c27
mov dword [ebp - 0x10], 0x1e6e2bfb
mov dword [ebp - 8], ebx
jmp 0x10017bed
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xb8], 0xf7e4
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10017bdc
cmp dword [ebp - 0x18], ebx
jne 0x10017bfc
mov edx, ebx
jmp 0x10017bff
xor edx, edx
inc edx
mov eax, dword [ebp - 0xb4]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x10]
setle cl
sub eax, 4
add edx, ecx
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x10], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xb
jg 0x10017bd0
mov dword [ebp - 8], ebx
jmp 0x10017c3f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe0], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x10017c32
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
mov ebx, dword [sym.imp.USER32.dll_GetDC]
je 0x10017c8f
push 0x253
push 0x660
push 0x2260
call edi
push eax
call ebx
push eax
push 0x1f6e
push 0x25d7
push 0x7ca
push 0x1f26
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
xor ebx, ebx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10017ca8
push 0x976
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 8], ebx
jmp 0x10017cc5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x174], 0xfffffff6
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10017cb4
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10017ce3
push 0x12ac
call edi
push eax
call esi
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x10017d06
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10017d01
push 0x12ac
call edi
push eax
call esi
dec dword [ebp - 0x10]
jns 0x10017cef
mov dword [ebp - 0xc], ebx
jmp 0x10017d19
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x48], 0x24ec2e0c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10017d0b
xor esi, esi
mov dword [ebp - 0xc], ebx
inc esi
cmp dword [ebp - 0xc], 3
jge 0x10017d37
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x5c], esi
inc dword [ebp - 0xc]
jmp 0x10017d25
mov dword [ebp - 0xc], ebx
jmp 0x10017d49
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x12c], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10017d3c
mov dword [ebp - 0x48], ebx
jmp 0x10017dad
mov dword [ebp - 8], 0xd8cb4c23
mov dword [ebp - 8], ebx
jmp 0x10017d71
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x168], 0x2bb11acc
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10017d60
mov dword [ebp - 8], ebx
jmp 0x10017da4
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10017d8d
call edi
push eax
call dword [sym.imp.USER32.dll_GetMenu]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10017da1
push 0x25b0
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x10017d7c
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 0xe
jle 0x10017d54
mov dword [ebp - 0x5c], esi
cmp dword [ebp - 0x5c], ebx
jl 0x10017e52
mov dword [ebp - 0x10], 0x2bd42ca8
mov dword [ebp - 0x24], 0xfffffffb
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x48], 0xdbea5223
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], ebx
jl 0x10017e49
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 8], ebx
jmp 0x10017dfa
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x50], 6
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10017dec
mov dword [ebp - 0x4c], esi
cmp dword [ebp - 0x4c], ebx
jl 0x10017e1e
mov eax, dword [ebp - 0x5c]
cmp dword [ebp + eax*4 - 0x48], ebx
jne 0x10017e1e
cmp dword [ebp - 0x12c], ebx
jne 0x10017e1e
dec dword [ebp - 0x4c]
jns 0x10017e08
mov dword [ebp - 8], ebx
jmp 0x10017e3f
mov dword [ebp - 0x30], 7
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x4c]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
mov dword [ebp - 0x24], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jle 0x10017e23
dec dword [ebp - 0x10]
jns 0x10017de0
dec dword [ebp - 0x5c]
jns 0x10017dbf
mov dword [ebp - 0x10], 0x3f6a0837
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], 8
mov dword [ebp - 8], ebx
jmp 0x10017e76
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x2c], 0x97f6af11
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10017e68
mov dword [ebp - 0x2c], 0x12
jmp 0x10017f15
mov dword [ebp - 8], 0x3773672d
mov dword [ebp - 0x14], 0xd61fb9a3
mov dword [ebp - 8], ebx
jmp 0x10017ea8
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x70], 0x12e1dfe0
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10017e9a
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], 0x703026d8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x2c]
jge 0x10017ef4
mov eax, ebx
cmp dword [ebp - 0x2c], ebx
je 0x10017ef6
mov eax, esi
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10017f12
push 0x213d
call dword [sym.imp.USER32.dll_GetKeyboardType]
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffff6
jg 0x10017e87
mov dword [ebp - 0x18], 0x9ad59e57
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x20], 0xbeb0647d
mov dword [ebp - 8], ebx
jmp 0x10017f4a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x104], 0xca631852
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10017f39
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jg 0x10017faa
mov ecx, 0x44455595
mov dword [ebp - 0x30], 0xeb9ae77a
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xec], ecx
mov dword [ebp - 0xe8], ecx
mov dword [ebp - 0xe4], ecx
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 8], ebx
jmp 0x10017f99
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x184], 0xf3f6085e
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x10017f88
dec dword [ebp - 0x10]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10017f5d
mov dword [ebp - 0x30], 0xfffffffa
xor edx, edx
mov dword [ebp - 0x10], 7
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 0xadd63529
mov dword [ebp - 0x24], 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
or eax, 0xffffffff
sub eax, ecx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
jne 0x10018039
mov edx, ebx
cmp dword [ebp - 0x14], ebx
je 0x1001803b
mov edx, esi
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
sub ecx, 0x8e35
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x24], ecx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10018073
call edi
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov dword [ebp - 0x18], 5
cmp dword [ebp - 0x18], 8
jle 0x100180b8
mov dword [ebp - 0x18], ebx
jmp 0x100180b0
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001809b
push ebx
push esi
push 0x4fe
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x100180ad
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x27
je 0x10018085
jmp 0x100180ed
mov dword [ebp - 0x10], 0x81ced8f6
xor ecx, ecx
mov dword [ebp - 0x24], 0x50a4ba31
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, esi
setge cl
sub ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x10]
sub ecx, 0xfffffffc
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 8], ebx
jmp 0x10018100
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x40], 0xfffffffe
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x100180f2
mov dword [ebp - 0x1c], 0xfffffff7
mov dword [ebp - 0x10], 0x9cdc345f
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 8], ebx
jmp 0x1001812a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x60], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10018120
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10018168
push ebx
push 0x268d
push 0x514
push 0x1c9e
push 0x2090
push 0x1882
push 0x2081
push 0x15fe
push 0x2563
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
cmp dword [ebp - 0x1c], ebx
jne 0x10018178
mov eax, ebx
add eax, 0x5b7d
mov eax, ebx
je 0x1001817a
mov eax, esi
mov dword [ebp - 0x10], eax
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setg bl
xor edx, edx
mov dword [ebp - 0x60], ebx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setl dl
add edx, ebx
xor ebx, ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], 0x13b91020
mov dword [ebp - 0x20], 0xffffffe7
cmp dword [ebp - 0x20], 0xffffffe5
jl 0x10018233
mov dword [ebp - 8], 0x751c76d7
mov dword [ebp - 8], ebx
jmp 0x100181d2
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x138], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x100181c1
mov dword [ebp - 8], ebx
jmp 0x10018225
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10018200
push ebx
push 0x155f
push 0x597
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10018222
push 0x2256
push 0x1d6
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x100181dd
dec dword [ebp - 0x20]
jmp 0x100181af
push ebx
push 0x674b
lea eax, [ebp - 0x31]
mov byte [ebp - 0x31], bl
push eax
push 0xcf5
push 0x7920
push 0x76e5
call fcn.10021403
mov dword [ebp - 0x30], 0xa2a3
add esp, 0x18
mov dword [ebp - 8], ebx
jmp 0x10018274
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x10c], 7
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10018263
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001828e
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x100189d2
mov dword [ebp - 0x20], 0x13b91020
mov dword [ebp - 0x20], 0xffffffe7
jmp 0x10018329
mov dword [ebp - 8], 0x751c76d7
mov dword [ebp - 8], ebx
jmp 0x100182cb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x15c], 4
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x100182ba
mov dword [ebp - 8], ebx
jmp 0x10018320
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x100182fa
push ebx
push 0x155f
push 0x597
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001831d
push 0x2256
push 0x1d6
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x100182d6
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe5
jge 0x100182ae
mov dword [ebp - 0x20], 0xbe4438b
mov dword [ebp - 0x28], 0xe7bf5cbf
mov dword [ebp - 0x30], 0xd6887694
mov dword [ebp - 0xc], ebx
jmp 0x1001835e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x144], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001834d
mov dword [ebp - 0xc], ebx
jmp 0x1001837a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb0], 0xca4f833f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10018369
mov dword [ebp - 0xa4], ebx
jmp 0x100183a6
cmp byte [ebp - 1], 0
je 0x100183a0
push 0xbf7
push ebx
push 0x582
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
inc dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], 2
mov byte [ebp - 1], bl
jle 0x10018388
cmp byte [ebp - 1], 0
je 0x100183cc
push 0x20f0
push ebx
push 0x15af
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov dword [ebp - 0x24], 0xed997831
mov dword [ebp - 0x30], 0xfffd
mov dword [ebp - 0x28], 0x8195
mov dword [ebp - 0x28], 0x5f0b101a
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x28], 0xf8b8ae50
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x28], 0x9c710427
mov dword [ebp - 0x28], 0x592c6eed
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0xe0fc36fe
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], 0x45dcefb
mov dword [ebp - 8], ebx
jmp 0x10018454
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x150], 0x8af16de6
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10018443
mov dword [ebp - 0x10], ebx
xor edx, edx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x40], 0xffffffff
mov dword [ebp - 0x28], 0xfff9
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x100184a3
push esi
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x100184bd
push esi
push 0x1df2
push 0x98e
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov dword [ebp - 0x20], ebx
jmp 0x100189bf
mov dword [ebp - 0xc], 0x68ec0ae9
mov eax, 0xddd9cd4
mov dword [ebp - 0x10], 0xfffffffc
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
jmp 0x10018507
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018504
push ebx
push 0xab1
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xb
jg 0x100184ef
mov eax, dword [ebp - 0xc]
xor edx, edx
test eax, eax
setns dl
xor ecx, ecx
mov dword [ebp - 0x78], edx
mov eax, dword [ebp - 0xc]
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0xfffffff8
setne al
cmp eax, 7
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0xc]
jge 0x10018548
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, esi
setg cl
cmp dword [ebp - 0xc], ecx
jle 0x1001856c
mov dword [ebp - 0x10], 0xc4dd
dec dword [ebp - 0x10]
jmp 0x1001861f
mov dword [ebp - 0x14], 0x86c7a88f
mov dword [ebp - 0xc], ebx
jmp 0x10018615
mov dword [ebp - 0x10], 0x72585faf
mov dword [ebp - 8], 0xfffffff8
mov dword [ebp - 8], ebx
jmp 0x1001859b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x98], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x1001858e
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x98]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
sub edx, eax
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, edx
setne cl
sub ecx, dword [ebp - 0x14]
je 0x100185e1
mov edx, esi
cmp dword [ebp - 0x94], ebx
jne 0x100185e3
mov edx, ebx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x84], ecx
xor eax, eax
test edx, edx
setle al
mov dword [ebp - 0x10], eax
cmp ecx, dword [ebp - 0x10]
je 0x1001860d
mov eax, ebx
cmp dword [ebp - 0x14], ebx
je 0x1001860f
mov eax, esi
mov dword [ebp - 0x14], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x1001857b
mov dword [ebp - 8], 0xe0648261
mov dword [ebp - 0x10], 0x8e9646b8
mov dword [ebp - 0x14], 0x8ef8a6eb
mov dword [ebp - 0x28], 0x7b3
mov dword [ebp - 8], ebx
jmp 0x100187a9
mov dword [ebp - 0xc], 0xfffffff9
mov dword [ebp - 0x14], 0x5ce17c92
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x10], eax
jl 0x1001870b
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001867d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdc], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001866c
mov eax, dword [ebp - 0xd0]
xor ecx, ecx
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
imul edx, eax
mov dword [ebp - 0xd0], edx
mov eax, dword [ebp - 0xc]
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setg dl
xor ebx, ebx
cmp edx, 0xe13
setge bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x100187a6
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10018701
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
dec dword [ebp - 0x1c]
jns 0x100186e8
jmp 0x100187a6
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x14], ebx
jmp 0x1001872f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xa0], 3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001871e
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0xfef5379a
mov eax, dword [ebp - 0x9c]
setne cl
xor edx, edx
cmp ecx, 0xa4ef
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xc]
setg cl
cmp ecx, esi
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 8]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
add ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setne dl
mov dword [ebp - 0x14], edx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffb
je 0x10018643
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x100187c6
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 3
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x100187df
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xfc], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x100187ce
mov dword [ebp - 0xc], ebx
jmp 0x100187fa
cmp dword [ebp - 0x20], 2
jle 0x100184c5
dec dword [ebp - 0x18]
jns 0x1001829e
mov eax, dword [ebp - 0x64]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0x68]
mov edi, edx
mov esi, eax
call fcn.10017af7
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret