Function at 0x10017a40
Capabilities:
Accept command line arguments
Check os version
Enumerate gui resources
Get graphical window text
Identify system language via api
Log keystrokes via polling
Query environment variable
Query service status

Disassembly:
mov eax, 0x10069d6b
call fcn.100691c8
sub esp, 0xbfc
movdqa xmm0, xmmword [0x1000b7c0]
lea eax, [ebp - 0x5cc]
push ebx
push esi
push edi
mov dword [ebp - 0xcc], ecx
lea ecx, [ebp - 0x5dc]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x3cc]
mov byte [ebp - 0x51], dl
movdqu xmmword [ebp - 0x5dc], xmm0
call fcn.10011c9b
mov edi, 0x5ccc90a3
xor ebx, ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], 0x50730467
mov dword [ebp - 0x3c], 0xfffffffa
push 3
mov dword [ebp - 0x28], 0x9e63a5be
pop esi
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x18], esi
push 0xfffffffffffffff8
pop ecx
cmp dword [ebp - 0x18], ebx
jl 0x10017b20
mov esi, dword [ebp - 0x3cc]
mov edi, 0xf199314e
mov dword [ebp - 0x30], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x3cc]
mov eax, dword [esi + 4]
push 0xfffffffffffffff8
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ecx + edx*4]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x18]
add edx, 0x2fc257a1
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x3c]
cmp edi, eax
pop ecx
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x18]
jns 0x10017ac5
push 3
mov edi, 0x5ccc90a3
pop esi
lea ecx, [ebp - 0x3cc]
call fcn.1001268d
push 4
pop eax
push eax
lea ecx, [ebp - 0x1a8]
call fcn.10011c5f
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x409884cb
mov dword [ebp - 0x28], 0x85755261
mov dword [ebp - 0x18], 0x7b831966
push 4
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x24], ebx
pop edx
jmp 0x10017b74
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1a8]
mov dword [eax + ecx*4], 0x3342
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10017b61
push 8
mov dword [ebp - 0x24], ebx
pop ecx
jmp 0x10017b8e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0xa4], ecx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10017b81
mov dword [ebp - 0xa0], esi
push 1
pop eax
cmp dword [ebp - 0xa0], ebx
jl 0x10017cfe
mov edi, 0x89bdd777
jmp 0x10017bb2
xor eax, eax
inc eax
push eax
lea ecx, [ebp - 0x518]
call fcn.10011c5f
xor edx, edx
mov dword [ebp - 0x44], 0x76105f61
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x10017bdc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x518]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10017bcd
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x1a8]
cmp edi, dword [eax + ecx*4]
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
neg ecx
imul eax, ecx
xor ecx, ecx
cmp eax, 0xffffffff
setge cl
sub ecx, 0x516a205b
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x1a8]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x14], eax
jne 0x10017cbb
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x1a8]
cmp dword [eax + ecx*4], 0xffffffff
mov eax, dword [ebp - 0x9c]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x18], 0x18
jmp 0x10017cb3
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff5
jl 0x10017ca3
jmp 0x10017ce2
mov dword [ebp - 0x28], 0x6f85
mov dword [ebp - 0x44], 0xfffffffa
mov dword [ebp - 0x44], 0xa862252
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x518]
call fcn.1001268d
dec dword [ebp - 0xa0]
jns 0x10017baf
mov edi, 0x5ccc90a3
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10017d18
push 0xc3b
push 0x767
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a8]
call fcn.1001268d
xor ecx, ecx
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x10017d40
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x98], 0x48261f9c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10017d2f
mov dword [ebp - 0x98], ebx
cmp dword [ebp - 0x98], 0xb
jg 0x10017f0d
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10017ef5
mov dword [ebp - 0x28], 0x141a
cmp dword [ebp - 0x28], 0xe20
jge 0x10017ee9
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x140]
push eax
push 0x1000b218
call fcn.10050d0b
add esp, 0xc
lea ecx, [ebp - 0x178]
call fcn.10022886
lea ecx, [ebp - 0x170]
mov dword [ebp - 4], 1
call fcn.10022886
mov edi, ebx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x140], edi
jle 0x10017ec1
lea eax, [ebp - 0x64]
push eax
push 0x1000b1cc
call fcn.10050d0b
pop ecx
pop ecx
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x178]
call fcn.100228b9
test eax, eax
jne 0x10017eac
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x170]
call fcn.100228b9
test eax, eax
jne 0x10017e22
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x178]
and eax, dword [ebp - 0x100]
mov dword [ebp - 0x1cc], eax
lea eax, [ebp - 0x1cc]
push eax
call fcn.100228b9
test eax, eax
je 0x10017e27
xor esi, esi
inc esi
jmp 0x10017e56
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0x170]
and eax, dword [ebp - 0x100]
mov dword [ebp - 0x1d0], eax
lea eax, [ebp - 0x1d0]
push eax
call fcn.100228b9
test eax, eax
je 0x10017e56
push 2
pop eax
cmp esi, eax
cmovl eax, esi
mov esi, eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x708]
push eax
lea ecx, [ebp - 0x178]
call fcn.1002289b
mov eax, dword [ebp - 0x64]
and eax, dword [ebp - 0x100]
mov dword [ebp - 0x208], eax
movzx eax, byte [0x11e51e88]
push eax
lea eax, [ebp - 0x208]
push eax
push ecx
lea eax, [ebp - 0x710]
push eax
lea ecx, [ebp - 0x170]
call fcn.1002395e
inc edi
cmp edi, dword [ebp - 0x140]
jl 0x10017dc3
jmp 0x10017eae
mov esi, ebx
cmp esi, 2
jg 0x10017ec1
push esi
push 0x1000b324
call fcn.10050f3f
pop ecx
jmp 0x10017ecb
push 0x1000b320
call fcn.100510f6
pop ecx
lea ecx, [ebp - 0x170]
call fcn.1001ddd9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
call fcn.1001ddd9
push 3
pop esi
push ebx
push 0x1a41
call dword [sym.imp.GDI32.dll_SetBkColor]
inc dword [ebp - 0x98]
cmp dword [ebp - 0x98], 0xb
jle 0x10017d58
mov edi, 0x5ccc90a3
movdqa xmm0, xmmword [0x1000b7c0]
lea ecx, [ebp - 0x67c]
push ecx
lea eax, [ebp - 0x66c]
push eax
push ecx
lea ecx, [ebp - 0x438]
movdqu xmmword [ebp - 0x67c], xmm0
call fcn.10011c9b
xor eax, eax
mov dword [ebp - 4], esi
inc eax
lea ecx, [ebp - 0x1f4]
mov dword [ebp - 0x40], eax
push eax
call fcn.10011c5f
push 0xfffffffffffffff8
pop eax
push 2
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x10017f67
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb0], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10017f5a
mov dword [ebp - 0x1c], ebx
jmp 0x10017f82
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x390], 0xbb6bc3ec
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10017f71
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x10017fa2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1f4]
mov dword [eax + ecx*4], 0xc2542929
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10017f8f
mov dword [ebp - 0x1c], ebx
jmp 0x10017fbd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6e0], 0x279e56
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10017fac
mov eax, dword [ebp - 0xb0]
cmp eax, dword [ebp - 0xb0]
jg 0x10017fda
mov ecx, ebx
cmp dword [ebp - 0xb0], ebx
je 0x10017fdc
mov ecx, edx
mov eax, dword [ebp - 0xb0]
mov dword [ebp - 0x38c], eax
sub eax, ecx
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
jne 0x10018004
cmp dword [ebp - 0xb0], ebx
jne 0x10018004
mov edx, ebx
mov ecx, dword [ebp - 0xb0]
xor eax, eax
add ecx, dword [ebp - 0xb0]
cmp edx, 0x76d238e4
setle al
cmp ecx, eax
jle 0x1001802b
cmp dword [ebp - 0xb0], ebx
jne 0x1001802b
mov ecx, ebx
jmp 0x1001802e
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x1f4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x6dc]
imul eax, dword [ebp - 0xac]
test eax, eax
jne 0x1001804a
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1f4]
xor edx, edx
push 0xfffffffffffffff8
cmp dword [eax], ebx
mov eax, dword [ebp - 0x38c]
sete dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, 1
pop ecx
setle al
cmp eax, ecx
mov eax, dword [ebp - 0x1f4]
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x1f4]
call fcn.1001268d
mov dword [ebp - 0x18], edi
lea ecx, [ebp - 0x26c]
push 2
call fcn.10011c5f
mov dword [ebp - 0x14], ebx
jmp 0x100180b2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x26c]
mov dword [eax + ecx*4], 0x68206240
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001809f
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100180c7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [ebp - 0x26c]
mov dword [eax], ebx
mov dword [ebp - 0x2c], 0x55e00fe1
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x26c]
dec dword [eax]
cmp dword [eax], 0xffffffe2
jge 0x100180cf
lea ecx, [ebp - 0x26c]
call fcn.1001268d
mov dword [ebp - 0x28], 0x50730467
lea ecx, [ebp - 0x61c]
xor eax, eax
mov dword [ebp - 0x14], 0xffffffff
inc eax
xorps xmm0, xmm0
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x90197f0a
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x60c]
push ecx
push eax
push ecx
mov dword [ebp - 0x34], ebx
lea ecx, [ebp - 0x6d4]
movdqu xmmword [ebp - 0x61c], xmm0
call fcn.10011c9b
mov dword [ebp - 0x34], 0x1ac8
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10018162
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6e8], 1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10018151
mov dword [ebp - 0x14], ebx
jmp 0x1001818a
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018187
push ebx
push 0x1635
push 0x2623
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe8
jl 0x1001816d
dec dword [ebp - 0x2c]
lea ecx, [ebp - 0x6d4]
call fcn.1001268d
mov dword [ebp - 0x48], 0xfffffffa
mov dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100181bd
push ebx
push ebx
call dword [sym.imp.USER32.dll_EnumWindows]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100181d0
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 0x28], 0x9e63a5be
xor edx, edx
mov dword [ebp - 0x34], 0xf75d
inc edx
mov dword [ebp - 0x34], 0xedcc
mov dword [ebp - 0x34], 0x27cad7d7
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10018207
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x53c], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100181fa
inc dword [ebp - 0x2c]
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0x2e4ed383
mov dword [ebp - 0x44], 2
mov dword [ebp - 0x28], 0x77d7e7d1
mov dword [ebp - 0x24], 0xffffffec
jmp 0x10018292
mov dword [ebp - 0x18], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x2c], 0xe6b6cd33
mov dword [ebp - 0x28], 0xbe92e3f9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
cmp eax, 0x72a67f8b
setge cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x24], ebx
jne 0x10018298
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffffa
je 0x1001823e
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x24], 0xff3e
neg ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
sbb ecx, ecx
mov eax, dword [ebp - 0x1c]
neg ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
lea eax, [ecx - 0x1117c522]
test eax, eax
jne 0x100183ec
cmp dword [ebp - 0x20], ebx
jne 0x100183ec
mov dword [ebp - 0x28], 0xa5481f04
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
jge 0x100182f8
push 8
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x150], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100182e6
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], ebx
jl 0x100183fd
push 0xfffffffffffffff7
pop edi
mov dword [ebp - 0x2c], 0xfffffffa
xor edx, edx
mov dword [ebp - 0x3c], 0xfffffff6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x150]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x150]
mov ecx, dword [ebp - 0x150]
mov eax, dword [ebp - 0x14c]
cmp eax, ecx
setge dl
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x20]
test eax, eax
setns cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14c]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf8487b25
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
mov eax, dword [ebp + eax*4 - 0x150]
add eax, edx
cmp edi, eax
mov eax, dword [ebp - 0x14c]
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x3c]
je 0x100183b1
cmp dword [ebp - 0x20], ebx
jne 0x100183b1
mov eax, ebx
jmp 0x100183b4
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100183dc
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
dec dword [ebp - 0x1c]
jns 0x1001830b
mov edi, 0x5ccc90a3
jmp 0x100183fd
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100183fd
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x20], 0x8a06
mov dword [ebp - 0x44], 0xa7bc9995
mov dword [ebp - 0x2c], 0x8aa2d34c
push 8
pop eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], 0x82e58099
mov dword [ebp - 0x40], 0x15ee56e3
mov dword [ebp - 0x2c], 0xbc23cea2
mov dword [ebp - 0x28], 0x7f1bd53d
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001844b
push ebx
push ebx
push 0x1f4b
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
cmp dword [ebp - 0x20], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x44], eax
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setge dl
sub edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x40], edx
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x20]
je 0x10018495
cmp dword [ebp - 0x40], ebx
jne 0x10018495
mov ecx, ebx
jmp 0x10018498
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x20]
inc ecx
xor edx, edx
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x5498
setge al
xor edx, edx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, 0x6ce
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x10018699
mov esi, dword [ebp - 0x438]
push 0xfffffffffffffff8
pop edi
mov dword [ebp - 0x1c], 0xd7b1c2a2
mov dword [ebp - 0x34], 0x76b5a7dd
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x1c]
jge 0x10018505
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setle dl
xor ebx, ebx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne bl
xor ecx, ecx
imul ebx, dword [ebp - 0x1c]
imul ebx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub ebx, 0x795ed7c6
cmp eax, ebx
setl cl
cmp ecx, 0xffffffff
jg 0x10018543
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], 0x1c18
cmp dword [ebp - 0x28], 0x46a
jge 0x10018595
mov ebx, 0x1065b310
jmp 0x1001857b
mov ecx, dword [ebp - 0x128]
test ecx, ecx
je 0x10018595
call fcn.10017888
push eax
mov ecx, 0x1065b258
call fcn.10011a2c
push eax
call fcn.10016103
pop ecx
lea eax, [ebp - 0x128]
mov ecx, ebx
push eax
call fcn.10011831
mov ecx, dword [eax]
mov ecx, dword [ecx + 4]
test byte [ecx + eax + 0xc], 6
je 0x1001855a
mov dword [ebp - 0x28], 0x9c6fec1b
xor ebx, ebx
mov dword [ebp - 0x1c], 0xffffffe6
cmp dword [ebp - 0x1c], 0xe
jl 0x10018631
push 3
lea ecx, [ebp - 0x570]
call fcn.10011c5f
mov dword [ebp - 0x30], 0xd8fb8cef
mov dword [ebp - 0x14], ebx
jmp 0x100185db
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x570]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100185c8
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], ebx
jl 0x10018606
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018601
push ebx
push 0x1339
call dword [sym.imp.USER32.dll_SetWindowTextA]
dec dword [ebp - 0x30]
jns 0x100185ed
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001861e
push 0x10f2
push 0xc03
call dword [sym.imp.GDI32.dll_RestoreDC]
lea ecx, [ebp - 0x570]
call fcn.1001268d
inc dword [ebp - 0x1c]
jmp 0x100185a5
mov dword [ebp - 0x28], 0xd8d92426
mov dword [ebp - 0x30], edi
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x438]
mov eax, dword [esi + 4]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ecx + edx*4]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x18]
add edx, 0x2fc257a1
cmp edx, eax
setl cl
mov dword [ebp - 0x28], ecx
mov ecx, 0xf199314e
mov eax, dword [ebp - 0x48]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x18]
jns 0x100184e6
push 3
mov edi, 0x5ccc90a3
pop esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x438]
call fcn.1001268d
movdqa xmm0, xmmword [0x1000b7c0]
lea ecx, [ebp - 0x65c]
push ecx
lea eax, [ebp - 0x64c]
push eax
push ecx
lea ecx, [ebp - 0x3d8]
movdqu xmmword [ebp - 0x65c], xmm0
call fcn.10011c9b
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x48], 0x50730467
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x48], 0x9e63a5be
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x1001875f
mov esi, dword [ebp - 0x3d8]
mov edi, 0xf199314e
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x3d8]
mov eax, dword [esi + 4]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ecx + edx*4]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x18]
add edx, 0x2fc257a1
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x28]
cmp edi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x18]
jns 0x10018704
push 3
mov edi, 0x5ccc90a3
pop esi
lea ecx, [ebp - 0x3d8]
call fcn.1001268d
movdqa xmm0, xmmword [0x1000b7c0]
lea ecx, [ebp - 0x63c]
push ecx
lea eax, [ebp - 0x62c]
push eax
push ecx
lea ecx, [ebp - 0x498]
movdqu xmmword [ebp - 0x63c], xmm0
call fcn.10011c9b
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x48], 0x50730467
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x48], 0x9e63a5be
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x10018821
mov esi, dword [ebp - 0x498]
mov edi, 0xf199314e
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x498]
mov eax, dword [esi + 4]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ecx + edx*4]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x18]
add edx, 0x2fc257a1
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x28]
cmp edi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x18]
jns 0x100187c6
push 3
mov edi, 0x5ccc90a3
pop esi
lea ecx, [ebp - 0x498]
call fcn.1001268d
movdqa xmm0, xmmword [0x1000b7c0]
lea ecx, [ebp - 0x5ec]
push ecx
lea eax, [ebp - 0x5dc]
push eax
push ecx
lea ecx, [ebp - 0x39c]
movdqu xmmword [ebp - 0x5ec], xmm0
call fcn.10011c9b
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x48], 0x50730467
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x48], 0x9e63a5be
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x100188e0
mov esi, dword [ebp - 0x39c]
mov edi, 0xf199314e
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x39c]
mov eax, dword [esi + 4]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ecx + edx*4]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x18]
add edx, 0x2fc257a1
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
mov eax, dword [ebp - 0x28]
cmp edi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x18]
jns 0x10018888
mov edi, 0x5ccc90a3
lea ecx, [ebp - 0x39c]
call fcn.1001268d
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jne 0x100189eb
push 0xfffffffffffffff9
pop edi
push 2
lea ecx, [ebp - 0x374]
call fcn.10011c5f
mov dword [ebp - 0x48], 0xf2e96673
mov dword [ebp - 0x24], ebx
jmp 0x10018937
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x374]
mov dword [eax + ecx*4], 0x75286e87
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10018924
xor ecx, ecx
mov dword [ebp - 0x24], ebx
inc ecx
jmp 0x10018956
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1c0], 0x9785734c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10018945
mov esi, dword [ebp - 0x374]
mov dword [esi], edi
mov dword [ebp - 0x2c], 0xb919
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x1001898b
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x78c9dffb
setl cl
xor eax, eax
cmp ecx, dword [esi + 4]
setne al
xor edx, edx
cmp eax, 0xe0cd
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x374]
sete cl
mov dword [ebp - 0x1c0], ecx
dec dword [eax]
cmp dword [eax], 0xfffffff3
jne 0x10018963
lea ecx, [ebp - 0x374]
call fcn.1001268d
inc dword [ebp - 0x1c]
je 0x1001890b
mov edi, 0x5ccc90a3
cmp dword [ebp - 0x1c], ebx
je 0x100189f7
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], ebx
je 0x10018a09
cmp dword [ebp - 0x1c], ebx
je 0x10018a09
xor edx, edx
inc edx
jmp 0x10018a0b
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
push 8
sete cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x284]
pop eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x18], ebx
push 1
call fcn.10011c5f
xor edx, edx
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x10018a53
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x284]
mov dword [eax + ecx*4], 0x196e6c8c
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10018a40
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
je 0x10018a96
mov eax, dword [ebp - 0x284]
cmp dword [eax], edx
jle 0x10018a74
cmp dword [eax], 0
mov ecx, edx
jne 0x10018a76
mov ecx, ebx
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x40]
jge 0x10018a96
cmp dword [ebp - 0x30], ebx
je 0x10018a96
xor edx, edx
inc edx
jmp 0x10018a98
mov edx, ebx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x20]
jne 0x10018abd
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x284]
sub ecx, 0xc63
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10018b1d
push 0x2184
push 0xc3
push 0x8ad
push 0x309
push 0x4de
push 0x155f
push 0x285
push 0x12b9
push 0x26f7
push 0x160f
push 0xa33
call dword [sym.imp.GDI32.dll_StretchBlt]
lea ecx, [ebp - 0x284]
call fcn.1001268d
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jne 0x10018c28
push 0xfffffffffffffff9
pop edi
push 2
lea ecx, [ebp - 0x314]
call fcn.10011c5f
mov dword [ebp - 0x48], 0xf2e96673
mov dword [ebp - 0x24], ebx
jmp 0x10018b74
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x314]
mov dword [eax + ecx*4], 0x75286e87
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10018b61
xor ecx, ecx
mov dword [ebp - 0x24], ebx
inc ecx
jmp 0x10018b93
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1f8], 0x9785734c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10018b82
mov esi, dword [ebp - 0x314]
mov dword [esi], edi
mov dword [ebp - 0x2c], 0xb919
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
je 0x10018bc8
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setg dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x78c9dffb
setl cl
xor eax, eax
cmp ecx, dword [esi + 4]
setne al
xor edx, edx
cmp eax, 0xe0cd
mov eax, dword [ebp - 0x2c]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x314]
sete cl
mov dword [ebp - 0x1f8], ecx
dec dword [eax]
cmp dword [eax], 0xfffffff3
jne 0x10018ba0
lea ecx, [ebp - 0x314]
call fcn.1001268d
inc dword [ebp - 0x1c]
je 0x10018b48
mov edi, 0x5ccc90a3
cmp dword [ebp - 0x1c], ebx
je 0x10018c34
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x28], ebx
je 0x10018c46
cmp dword [ebp - 0x1c], ebx
je 0x10018c46
xor edx, edx
inc edx
jmp 0x10018c48
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x18], 0x5610a143
mov dword [ebp - 0x48], 0x2246
cmp dword [ebp - 0x48], 0x734
jge 0x10018d6b
lea eax, [ebp - 0xdc]
push eax
push 0x1000b1cc
call fcn.10050d0b
mov eax, dword [ebp - 0xdc]
pop ecx
pop ecx
test eax, eax
je 0x10018d64
dec eax
mov dword [ebp - 0xdc], eax
lea eax, [ebp - 0x70]
push eax
push 0x1000b1cc
call fcn.10050d0b
pop ecx
pop ecx
push dword [ebp - 0x70]
lea ecx, [ebp - 0x3f0]
call fcn.10011c5f
mov eax, dword [ebp - 0x70]
mov edi, ebx
mov ebx, dword [ebp - 0x3f0]
test eax, eax
jle 0x10018cfc
push 4
mov esi, ebx
pop ebx
push esi
push 0x1000b1cc
call fcn.10050d0b
mov eax, dword [ebp - 0x70]
inc edi
pop ecx
add esi, ebx
pop ecx
cmp edi, eax
jl 0x10018cdf
mov ebx, dword [ebp - 0x3f0]
lea edx, [eax - 1]
xor ecx, ecx
test edx, edx
js 0x10018d1d
cmp ecx, dword [ebx + edx*4]
cmovle ecx, dword [ebx + edx*4]
xor eax, eax
test ecx, ecx
setg al
dec ecx
mov dword [ebx + edx*4], eax
dec edx
jns 0x10018d05
mov eax, dword [ebp - 0x70]
xor esi, esi
test eax, eax
jle 0x10018d38
push dword [ebx + esi*4]
push 0x1000b334
call fcn.10050f3f
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x70]
jl 0x10018d23
push 0x1000b135
call fcn.100510f6
pop ecx
lea ecx, [ebp - 0x3f0]
call fcn.1001268d
mov eax, dword [ebp - 0xdc]
push 0
pop ebx
test eax, eax
jne 0x10018ca6
mov edi, 0x5ccc90a3
dec eax
mov dword [ebp - 0xdc], eax
push 3
pop esi
push esi
lea ecx, [ebp - 0x29c]
call fcn.10011c5f
mov dword [ebp - 0x14], ebx
jmp 0x10018d92
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x29c]
mov dword [eax + ecx*4], 0xe708bee6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10018d7f
mov dword [ebp - 0x24], 0xc1d6
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], eax
jge 0x10018dd6
mov ecx, dword [ebp - 0x24]
xor edx, edx
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, 0xbc0d133f
setl dl
cmp eax, edx
sbb eax, eax
inc eax
cmp eax, 0xb288586f
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
jne 0x10018dd6
cmp dword [ebp - 0x24], ebx
jne 0x10018dd6
mov eax, ebx
jmp 0x10018dd9
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x1c]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x1c]
mov ebx, dword [sym.imp.USER32.dll_EndMenu]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 9
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffd
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xbefa
setl al
xor ecx, ecx
cmp eax, 0xec56
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, 0xffff
setl dl
sub edx, eax
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
cmp dword [ebp - 0x1c], edx
je 0x10018ea2
xor edx, edx
mov dword [ebp - 0x2c], 0x9080254f
mov dword [ebp - 0x18], edx
jmp 0x10018e90
mov dword [ebp - 0x1c], edx
jmp 0x10018e79
inc dword [ebp - 0x2c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x10018e73
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x29c]
cmp dword [eax + ecx*4], edx
jne 0x10018e96
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10018e6e
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x10018eb5
call ebx
jmp 0x10018eb3
xor edx, edx
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x10018eb5
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x10018eeb
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jl 0x10018eda
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], edx
jmp 0x10018ed0
dec dword [ebp - 0x2c]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x10018eca
dec dword [ebp - 0x14]
jns 0x10018ec2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x29c]
cmp dword [eax + ecx*4], edx
jne 0x10018ef3
inc dword [ebp - 0x1c]
push 2
pop eax
cmp dword [ebp - 0x1c], eax
jle 0x10018eba
lea ecx, [ebp - 0x29c]
call fcn.1001268d
push 8
pop eax
xor ecx, ecx
mov dword [ebp - 0x14], eax
push 4
mov dword [ebp - 0x14], ecx
pop edx
jmp 0x10018f1f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60c], 0x5711
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10018f0e
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], esi
jg 0x10018f96
jmp 0x10018f31
push 4
pop edx
push edx
lea ecx, [ebp - 0x450]
call fcn.10011c5f
push 4
mov dword [ebp - 0x18], 0
pop edx
jmp 0x10018f5c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x450]
mov dword [eax + ecx*4], 0xcce1e2c0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10018f49
mov edx, dword [ebp - 0x450]
mov dword [edx + 4], esi
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x60c]
mov eax, dword [edx + 4]
dec dword [edx + 4]
mov dword [ebp + eax*4 - 0x60c], ecx
jns 0x10018f6a
lea ecx, [ebp - 0x450]
call fcn.1001268d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10018f2e
movdqa xmm0, xmmword [0x1000b7c0]
lea ecx, [ebp - 0x62c]
push ecx
lea eax, [ebp - 0x61c]
push eax
push ecx
lea ecx, [ebp - 0x480]
movdqu xmmword [ebp - 0x62c], xmm0
call fcn.10011c9b
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x35c]
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x48], 0x50730467
push 1
call fcn.10011c5f
xor edx, edx
mov dword [ebp - 0x24], edx
jmp 0x10018ff6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6f0], 0xcff0ea75
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10018fe5
mov dword [ebp - 0x24], edx
jmp 0x10019014
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x35c]
mov dword [eax + ecx*4], 0xe87df2f4
inc dword [ebp - 0x24]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x24], ecx
jl 0x10019001
mov eax, dword [ebp - 0x35c]
mov dword [eax], edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], edx
jl 0x1001903a
mov dword [ebp - 0x2c], edx
dec dword [ebp - 0x2c]
dec dword [ebp - 0x30]
jns 0x1001902f
mov eax, dword [ebp - 0x35c]
inc dword [eax]
cmp dword [eax], ecx
jle 0x10019024
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x10019055
push edx
call dword [sym.imp.USER32.dll_GetKeyboardState]
lea ecx, [ebp - 0x35c]
call fcn.1001268d
push 4
pop edi
mov dword [ebp - 0x28], 0xfffffffa
lea ecx, [ebp - 0x528]
push edi
call fcn.10011c5f
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x18], eax
xor edx, edx
push 8
pop eax
mov dword [ebp - 0x44], eax
mov eax, 0x4a90611b
push 0xfffffffffffffffd
pop esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x4c4], eax
mov dword [ebp - 0x4c0], eax
mov dword [ebp - 0x4bc], eax
mov dword [ebp - 0x4b8], eax
mov dword [ebp - 0x14], edx
jmp 0x100190bf
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x528]
mov dword [eax + ecx*4], 0xbbca
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100190ac
push 3
pop edi
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], edx
jl 0x100190e6
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x100190e1
push edx
call dword [sym.imp.USER32.dll_SetCursor]
xor edx, edx
dec dword [ebp - 0x18]
jns 0x100190cf
mov dword [ebp - 0x2c], 0x2f80c341
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
cmp eax, esi
setne cl
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x44]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 0x44]
cmp eax, 0xfffc
setge cl
imul edx, ecx
lea ecx, [ebp - 0x528]
mov dword [ebp - 0x4b8], edx
call fcn.1001268d
push 4
pop esi
mov dword [ebp - 0x48], 0x9e63a5be
lea ecx, [ebp - 0x408]
mov dword [ebp - 0x34], 0xfffffffe
push esi
call fcn.10011c5f
xor edx, edx
mov dword [ebp - 0x24], edx
jmp 0x10019158
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x6b0], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x1001914b
mov dword [ebp - 0x24], edx
jmp 0x10019172
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x408]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10019162
mov ecx, dword [ebp - 0x408]
mov dword [ecx + 0xc], edx
mov eax, dword [ecx + 0xc]
inc dword [ecx + 0xc]
mov dword [ebp + eax*4 - 0x6b0], 1
cmp dword [ecx + 0xc], edi
jl 0x10019180
lea ecx, [ebp - 0x408]
call fcn.1001268d
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], 0
jl 0x10019208
mov esi, dword [ebp - 0x480]
push 0xfffffffffffffff8
pop eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x480]
mov eax, dword [esi + 4]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x30]
mov edx, dword [ecx + edx*4]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x18]
add edx, 0x2fc257a1
cmp edx, eax
setl cl
mov dword [ebp - 0x48], ecx
mov ecx, 0xf199314e
mov eax, dword [ebp - 0x28]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x48], eax
dec dword [ebp - 0x18]
jns 0x100191b0
or esi, 0xffffffff
lea ecx, [ebp - 0x480]
mov dword [ebp - 4], esi
call fcn.1001268d
movdqa xmm0, xmmword [0x1000b7b0]
lea ecx, [ebp - 0x64c]
push ecx
lea eax, [ebp - 0x63c]
push eax
push ecx
lea ecx, [ebp - 0x538]
movdqu xmmword [ebp - 0x64c], xmm0
call fcn.10011c9b
push 1
lea ecx, [ebp - 0x588]
mov dword [ebp - 4], 6
call fcn.10011c5f
push 4
pop eax
mov dword [ebp - 0x34], eax
xor edx, edx
mov dword [ebp - 0x34], 0x3072c02a
inc edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0xa191a83a
mov dword [ebp - 0x34], 0xc545e213
mov dword [ebp - 0x34], 0x6d786ff5
mov dword [ebp - 0x34], 0x2efe8e60
mov dword [ebp - 0x34], 0xfe93
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x7054f86f
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x14], 0
jmp 0x100192bf
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x588]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100192ac
mov eax, dword [ebp - 0x538]
lea ecx, [ebp - 0x588]
mov dword [eax], 0xfffffff2
call fcn.1001268d
lea ecx, [ebp - 0x538]
mov dword [ebp - 4], esi
call fcn.1001268d
push 8
pop eax
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x2b4]
xor eax, eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], eax
push 1
call fcn.10011c5f
xor edx, edx
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x14], edx
jmp 0x10019325
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2b4]
mov dword [eax + ecx*4], 0x196e6c8c
inc dword [ebp - 0x14]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x14], ecx
jl 0x10019312
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], edx
je 0x10019366
mov eax, dword [ebp - 0x2b4]
cmp dword [eax], ecx
jle 0x10019346
cmp dword [eax], edx
jne 0x10019348
mov ecx, edx
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, dword [ebp - 0x40]
jge 0x10019366
cmp dword [ebp - 0x30], edx
je 0x10019366
inc edx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x20]
jne 0x1001938b
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2b4]
sub ecx, 0xc63
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x100193ec
push 0x2184
push 0xc3
push 0x8ad
push 0x309
push 0x4de
push 0x155f
push 0x285
push 0x12b9
push 0x26f7
push 0x160f
push 0xa33
call dword [sym.imp.GDI32.dll_StretchBlt]
lea ecx, [ebp - 0x2b4]
call fcn.1001268d
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x34], edx
inc ecx
mov dword [ebp - 0x34], 0x9aed23b6
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x48], 0xfffffffc
mov dword [ebp - 0x34], 0xff23b1a9
mov dword [ebp - 0x34], 0x8cccddd1
mov dword [ebp - 0x34], 0x576c5165
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x9acd
mov dword [ebp - 0x40], 0x1c58
mov dword [ebp - 0x14], edx
jmp 0x1001944f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c8], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001943e
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x48]
dec dword [ebp - 0x40]
cmp ecx, eax
jge 0x1001946d
cmp dword [ebp - 0x1c8], edx
jne 0x1001946d
mov eax, edx
jmp 0x10019470
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 0x32c]
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x18], 0x5610a143
push edi
call fcn.10011c5f
mov dword [ebp - 0x14], 0
jmp 0x100194b7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x32c]
mov dword [eax + ecx*4], 0xe708bee6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100194a4
mov dword [ebp - 0x24], 0xc1d6
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], eax
jge 0x100194f9
mov ecx, dword [ebp - 0x24]
xor edx, edx
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, 0xbc0d133f
setl dl
cmp eax, edx
sbb eax, eax
inc eax
cmp eax, 0xb288586f
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
jne 0x100194f9
xor eax, eax
cmp dword [ebp - 0x24], eax
je 0x100194fc
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x1c]
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 9
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffd
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 0xbefa
setl al
xor ecx, ecx
cmp eax, 0xec56
mov eax, dword [ebp - 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, 0xffff
setl dl
sub edx, eax
sub edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
inc edx
cmp dword [ebp - 0x1c], edx
je 0x100195bf
xor edx, edx
mov dword [ebp - 0x2c], 0x9080254f
mov dword [ebp - 0x18], edx
jmp 0x100195ad
mov dword [ebp - 0x1c], edx
jmp 0x10019596
inc dword [ebp - 0x2c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x10019590
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x32c]
cmp dword [eax + ecx*4], edx
jne 0x100195b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1001958b
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x100195d2
call ebx
jmp 0x100195d0
xor edx, edx
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x100195d2
push edx
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x10019608
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jl 0x100195f7
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x24], edx
jmp 0x100195ed
dec dword [ebp - 0x2c]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], eax
jle 0x100195e7
dec dword [ebp - 0x14]
jns 0x100195df
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x32c]
cmp dword [eax + ecx*4], edx
jne 0x10019610
inc dword [ebp - 0x1c]
push 2
pop eax
cmp dword [ebp - 0x1c], eax
jle 0x100195d7
lea ecx, [ebp - 0x32c]
call fcn.1001268d
mov dword [ebp - 0x1c], 0xfffffffa
lea ecx, [ebp - 0x2cc]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x18], 0x5610a143
push edi
call fcn.10011c5f
mov dword [ebp - 4], 7
mov dword [ebp - 0x14], 0
jmp 0x10019666
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2cc]
mov dword [eax + ecx*4], 0xe708bee6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10019653
mov dword [ebp - 0x24], 0xc1d6
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], eax
jge 0x100196a8