Function at 0x10018047
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10081417
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e8
movdqa xmm0, xmmword [0x10007f80]
lea eax, [esp + 0x230]
push ebx
push esi
push edi
mov dword [esp + 0x6c], ecx
xor ebx, ebx
push dword [esp + 0x6c]
mov dword [esp + 0x14], 0xd59e57ad
lea ecx, [esp + 0x84]
push eax
lea eax, [esp + 0x234]
mov dword [esp + 0x1c], 0xffffffff
push eax
mov dword [esp + 0x28], 9
mov dword [esp + 0x2c], 0xfffffffb
push ebx
mov dword [esp + 0xd0], edx
movdqu xmmword [esp + 0x23c], xmm0
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
call fcn.10017753
mov dword [esp + 0x2fc], ebx
xor esi, esi
mov dword [esp + 0x1c], ebx
inc esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x14], ebx
jmp 0x1001810a
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1e0], 0xe2db
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100180f7
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jg 0x10018227
mov esi, dword [esp + 0x80]
xor edi, edi
inc edi
mov dword [esp + 0x2c], 0xffffffff
lea ecx, [esp + 0x1d4]
mov dword [esp + 0x24], 0x22e974a5
mov dword [esp + 0x34], ebx
mov dword [esp + 0x14], 0xfffffffe
mov dword [esp + 0x14], 0x1e01b17d
mov dword [esp + 0x1c], 0xfffffffb
push edi
call fcn.1001610f
mov dword [esp + 0x44], 0x36a5b5cf
mov dword [esp + 0x30], 0x83e7
mov dword [esp + 0x14], ebx
jmp 0x1001818d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1d4]
mov dword [eax + ecx*4], 0x42206dd2
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10018177
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100181af
push 0x1e54
push 0x1f8a
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
mov dword [esp + 0x14], ebx
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp eax, 4
mov dword [esi + 4], eax
mov eax, dword [esp + 0x34]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x30]
setg dl
imul eax, dword [esp + 0x28]
inc dword [esp + 0x28]
cmp eax, edx
jg 0x100181ee
mov eax, edi
cmp dword [esp + 0x24], ebx
jne 0x100181f0
mov eax, ebx
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jne 0x100181fe
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x1d4]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
call fcn.10016191
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10018128
xor esi, esi
inc esi
push 3
mov dword [esp + 0x14], ebx
pop edi
jmp 0x10018244
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x80]
cmp dword [eax + ecx*4], ebx
jne 0x1001824a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x10018230
or dword [esp + 0x2fc], 0xffffffff
lea ecx, [esp + 0x80]
call fcn.10016191
mov dword [esp + 0xa4], 8
lea ecx, [esp + 0x14c]
mov dword [esp + 0xc4], 0xffffffff
mov dword [esp + 0xb0], 0xda2ae7b7
push 2
call fcn.1001610f
mov dword [esp + 0x2fc], esi
lea ecx, [esp + 0x208]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x2c], 0xbf2d3f50
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], 0x4a6f4440
mov dword [esp + 0x44], 0x76eea530
push 2
call fcn.1001610f
push edi
lea ecx, [esp + 0xfc]
mov byte [esp + 0x300], 2
call fcn.1001610f
mov dword [esp + 0x24], 0x4262
push 2
mov dword [esp + 0x24], 0xa508
mov dword [esp + 0x14], ebx
pop edx
jmp 0x10018307
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100182f4
mov dword [esp + 0x10], ebx
jmp 0x10018329
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x208]
mov dword [eax + ecx*4], 0x3051ebf0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018313
mov dword [esp + 0x10], ebx
jmp 0x1001834b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf8]
mov dword [eax + ecx*4], 0xe61780ee
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10018335
mov dword [esp + 0x10], ebx
jmp 0x10018367
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x78], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018357
mov ecx, dword [esp + 0x14c]
mov eax, dword [ecx]
add eax, dword [ecx + 4]
mov dword [esp + 0x14], eax
mov eax, dword [ecx + 4]
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
jne 0x100183e2
inc dword [esp + 0x20]
jne 0x100183d9
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xf8]
mov dword [eax + 4], ecx
xor ecx, ecx
mov eax, dword [esp + 0x78]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x78]
cmp eax, 0xdd6b
setge cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x78]
imul eax, dword [esp + 0x28]
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x44]
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x2c], 0xffffffff
mov eax, ebx
jne 0x100183e4
mov eax, esi
sub eax, dword [esp + 0x14]
lea ecx, [esp + 0xf8]
mov dword [esp + 0x14], eax
call fcn.10016191
lea ecx, [esp + 0x208]
call fcn.10016191
or dword [esp + 0x2fc], 0xffffffff
lea ecx, [esp + 0x14c]
call fcn.10016191
push edi
lea ecx, [esp + 0x1e8]
call fcn.1001610f
push esi
lea ecx, [esp + 0x1a8]
mov dword [esp + 0x300], edi
call fcn.1001610f
mov byte [esp + 0x2fc], 4
mov dword [esp + 0x28], ebx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x1c], ebx
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10018464
push 0x1ebf
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10018476
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x10], ebx
jmp 0x10018492
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1e4]
mov dword [eax + ecx*4], 0x4a2a4f40
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001847c
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 0x9c3d069f
mov dword [esp + 0x50], 8
mov dword [esp + 0x48], esi
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x14], 9
mov dword [esp + 0x44], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0x2c], 5
mov dword [esp + 0x40], 0x435
mov dword [esp + 0x1c], 0x7348
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], ebx
jmp 0x100184fa
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x4c], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100184ea
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x30], ebx
jmp 0x100185b3
mov dword [esp + 0x20], 0x638ecf54
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10018531
push ebx
push 0xbc
call edi
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov dword [esp + 0x20], 0xd
jmp 0x100185a8
push 4
lea ecx, [esp + 0x120]
call fcn.1001610f
push 4
mov dword [esp + 0x28], 0x23b1a956
mov dword [esp + 0x18], ebx
pop edx
jmp 0x10018570
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0x7222
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001855a
mov dword [esp + 0x24], ebx
jmp 0x10018592
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x11c]
mov dword [eax + ecx*4], 0x8cc
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edx
jl 0x1001857c
lea ecx, [esp + 0x11c]
call fcn.10016191
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffffa
je 0x1001853b
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0x19
jne 0x1001850f
cmp dword [esp + 0x44], 0xae2718b9
jne 0x100185cc
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x50], ebx
jne 0x100185f2
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x2c]
inc dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x40], 0xe1dc630d
mov eax, dword [esp + 0x38]
mov dword [esp + 0x40], eax
mov dword [esp + 0x10], ebx
jmp 0x10018632
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 0x7c7be02
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001861c
mov dword [esp + 0x28], ebx
lea ecx, [esp + 0x1a4]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], eax
call fcn.10016191
or dword [esp + 0x2fc], 0xffffffff
lea ecx, [esp + 0x1e4]
call fcn.10016191
mov dword [esp + 0xbc], esi
lea ecx, [esp + 0x220]
mov dword [esp + 0x30], 0xfffffffd
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], 0xec2e0cf5
mov dword [esp + 0x1c], 0x2ae7b79f
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0x9ebf495e
mov dword [esp + 0x1c], 2
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0x526c7153
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0xfffffffa
mov dword [esp + 0x1c], 0xfffffff9
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0x6e523240
push 3
call fcn.1001610f
mov dword [esp + 0x2fc], 5
mov dword [esp + 0x14], ebx
jmp 0x10018708
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x220]
mov dword [eax + ecx*4], 0xd40a7fc
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x100186f2
mov dword [esp + 0x20], ebx
jmp 0x1001884b
mov dword [esp + 0x1c], 0x5af8b513
lea ecx, [esp + 0x17c]
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x1c], 4
mov dword [esp + 0x1c], 0xba29f583
mov dword [esp + 0x1c], esi
push 2
call fcn.1001610f
push 2
mov dword [esp + 0x14], ebx
pop edx
jmp 0x10018766
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2b4], 0xffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018753
mov dword [esp + 0x10], ebx
jmp 0x1001877e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x60], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018772
mov dword [esp + 0x10], ebx
jmp 0x1001879d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2d4], 0x5f8d9a2b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1001878a
mov dword [esp + 0x10], ebx
jmp 0x100187c0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x17c]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100187aa
mov dword [esp + 0x60], ebx
cmp dword [esp + 0x60], esi
jg 0x1001883b
mov esi, dword [esp + 0x17c]
mov dword [esp + 0x38], 3
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0x9af3
mov dword [esp + 0x40], ebx
mov dword [esp + 0x14], ebx
jmp 0x10018808
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2ac], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x100187f5
mov edx, dword [esi + 4]
mov ecx, dword [esp + 0x38]
lea eax, [edx - 1]
mov dword [esi + 4], eax
cmp ecx, edx
jge 0x10018824
xor eax, eax
inc eax
jmp 0x10018826
mov eax, ebx
mov dword [esp + 0x40], eax
inc dword [esp + 0x60]
cmp dword [esp + 0x60], 1
push 2
pop edx
jle 0x100187d7
xor esi, esi
inc esi
lea ecx, [esp + 0x17c]
call fcn.10016191
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 6
jl 0x10018718
or dword [esp + 0x2fc], 0xffffffff
lea ecx, [esp + 0x220]
call fcn.10016191
mov dword [esp + 0x34], 0x45f5b1b6
mov dword [esp + 0x38], 0xb7c7ce53
mov dword [esp + 0x24], 0xe97eede0
mov dword [esp + 0x1c], 0xfffffff6
mov eax, dword [esp + 0x38]
mov dword [esp + 0x24], eax
mov dword [esp + 0x24], ebx
jmp 0x100188b0
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100188ac
call edi
push eax
call dword [sym.imp.USER32.dll_IsIconic]
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 7
jge 0x10018898
push 2
lea ecx, [esp + 0x144]
call fcn.1001610f
mov dword [esp + 0x2fc], 6
lea eax, [esp + 0x29c]
push dword [esp + 0x4c]
movdqa xmm0, xmmword [0x10007f10]
lea ecx, [esp + 0x9c]
push eax
lea eax, [esp + 0x294]
mov dword [esp + 0xa0], ebx
push eax
push ebx
movdqu xmmword [esp + 0x29c], xmm0
mov dword [esp + 0xac], ebx
mov dword [esp + 0xb0], ebx
call fcn.10017753
mov byte [esp + 0x2fc], 7
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x14], 0x5bed8572
push 3
mov dword [esp + 0x2c], 0xfffffffe
pop esi
mov dword [esp + 0x2c], esi
cmp dword [esp + 0x2c], ebx
jl 0x10018c4d
mov dword [esp + 0x10], 0x2e31d832
lea ecx, [esp + 0x134]
mov dword [esp + 0x34], 0xfffffff9
push esi
call fcn.1001610f
mov byte [esp + 0x2fc], 8
mov dword [esp + 0x20], ebx
jmp 0x10018989
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0x401bc10b
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x10018973
mov dword [esp + 0x10], ebx
jmp 0x10018c1f
push dword [esp + 0x4c]
movdqa xmm0, xmmword [0x10007f30]
lea eax, [esp + 0x280]
push eax
lea eax, [esp + 0x274]
mov dword [esp + 0x94], ebx
push eax
push ebx
lea ecx, [esp + 0x9c]
mov dword [esp + 0xa0], ebx
movdqu xmmword [esp + 0x27c], xmm0
mov dword [esp + 0xa4], ebx
call fcn.10017753
mov byte [esp + 0x2fc], 9
mov esi, dword [esp + 0x8c]
mov ecx, dword [esp + 0x98]
mov dword [esp + 0x24], 0x98e64e6d
mov dword [esi + 8], ebx
mov eax, dword [esi + 8]
mov dword [ecx + eax*4], 0xedcc590f
inc dword [esi + 8]
cmp dword [esi + 8], 4
jl 0x10018a00
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], 3
jg 0x10018c04
mov edi, dword [esp + 0x134]
push dword [esp + 0x4c]
movdqa xmm0, xmmword [0x10007f40]
lea eax, [esp + 0x250]
push eax
lea eax, [esp + 0x244]
mov dword [esp + 0x28], 1
push eax
mov dword [esp + 0x44], 0x85b
lea ecx, [esp + 0xd4]
push ebx
movdqu xmmword [esp + 0x24c], xmm0
mov dword [esp + 0xd8], ebx
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
call fcn.10017753
mov dword [esp + 0x20], ebx
jmp 0x10018a96
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x70], 0xfffffffa
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x10018a86
mov dword [esp + 0x20], ebx
jmp 0x10018b20
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], ebx
jne 0x10018adc
cmp dword [esp + 0x10], ebx
je 0x10018ab7
mov eax, dword [esp + 0x20]
mov eax, dword [esi + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x70], eax
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp eax, dword [esp + 0x10]
jge 0x10018adc
mov ecx, ebx
jmp 0x10018adf
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x10]
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
imul edx, dword [esi + 8]
sub edx, eax
cmp edx, 0xfffffff9
sbb eax, eax
inc eax
dec eax
jne 0x10018b08
cmp dword [esp + 0x10], ebx
jne 0x10018b08
mov eax, ebx
jmp 0x10018b0b
xor eax, eax
inc eax
cmp eax, dword [esp + 0x10]
je 0x10018b15
mov eax, dword [esp + 0x38]
mov dword [esi + 8], 0x1cf6a124
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jle 0x10018aa3
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], ebx
je 0x10018b58
cmp dword [esp + 0x24], ebx
je 0x10018b58
xor edx, edx
inc edx
jmp 0x10018b5a
mov edx, ebx
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xc8]
sete cl
xor edx, edx
imul ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x14]
cmp ecx, 0x9c7d
setne dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x70]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor edx, edx
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x8c]
mov dword [eax], ecx
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x70]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
lea ecx, [esp + 0xc8]
setg dl
imul edx, dword [esp + 0x24]
sub edx, dword [esp + 0x2c]
neg edx
sbb edx, edx
inc edx
mov dword [edi + 8], edx
mov dword [esp + 0x70], edx
call fcn.10016191
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 3
jle 0x10018a29
lea ecx, [esp + 0x8c]
mov byte [esp + 0x2fc], 8
call fcn.10016191
inc dword [esp + 0x10]
push 3
pop esi
cmp dword [esp + 0x10], esi
jle 0x10018998
lea ecx, [esp + 0x134]
mov byte [esp + 0x2fc], 7
call fcn.10016191
dec dword [esp + 0x2c]
jns 0x10018948
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [esp + 0x98]
mov byte [esp + 0x2fc], 6
call fcn.10016191
push esi
lea ecx, [esp + 0x1f4]
call fcn.1001610f
mov byte [esp + 0x2fc], 0xa
lea ecx, [esp + 0xec]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x1c], ebx
push 4
call fcn.1001610f
mov byte [esp + 0x2fc], 0xb
xor edx, edx
inc edx
mov dword [esp + 0x24], edx
push 0xfffffffffffffff7
pop eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x34], edx
mov dword [esp + 0xa8], 0xaa50887c
mov dword [esp + 0x48], eax
mov dword [esp + 0x1c], 0xe2499e68
mov dword [esp + 0x44], edx
push 4
pop eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], 0x50b7f45b
mov dword [esp + 0x1c], 0x93cc9d6c
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 5
mov dword [esp + 0x1c], 0xc67a9553
mov dword [esp + 0x1c], 0x4f5fdfda
mov dword [esp + 0x1c], 0x726f2c0e
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x38], 0xfffffff6
mov dword [esp + 0x40], 0xffffffff
mov dword [esp + 0x1c], 0x41af53c8
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0x5ce76562
mov dword [esp + 0x1c], 0x1c721796
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], eax
jge 0x10018d63
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 0xd72276b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10018d46
mov dword [esp + 0x10], ebx
jmp 0x10018d79
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x68], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018d69
cmp dword [esp + 0x24], ebx
je 0x10018d98
mov eax, dword [esp + 0x24]
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, dword [esp + 0x24]
jge 0x10018d98
mov edx, ebx
mov eax, dword [esp + 0xec]
xor ecx, ecx
mov esi, 0x54165132
mov dword [eax + 0xc], esi
mov eax, dword [esp + 0x24]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, esi
setle al
inc eax
neg eax
sbb eax, eax
inc eax
cmp eax, 0xe61780ee
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0xab3c
setl al
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], 0xffffffed
cmp dword [esp + 0x14], 0xffffffe4
jle 0x1001902d
xor esi, esi
inc esi
mov dword [esp + 0x28], esi
lea ecx, [esp + 0x164]
mov dword [esp + 0x1c], 0xfafe44fa
push 2
call fcn.1001610f
mov byte [esp + 0x2fc], 0xc
lea ecx, [esp + 0x1fc]
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x50], 0xa8e8
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x38], esi
mov dword [esp + 0x24], 0xfffffffb
push esi
call fcn.1001610f
mov byte [esp + 0x2fc], 0xd
lea eax, [esp + 0x26c]
push dword [esp + 0x68]
movdqa xmm0, xmmword [0x10007f80]
lea ecx, [esp + 0xd8]
push eax
lea eax, [esp + 0x264]
mov dword [esp + 0x28], 0xfff7
push eax
push ebx
movdqu xmmword [esp + 0x26c], xmm0
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
mov dword [esp + 0xec], ebx
call fcn.10017753
mov dword [esp + 0xac], 0x18e49b9d
push 4
mov dword [esp + 0x20], 0x3b75a479
mov dword [esp + 0x14], ebx
pop edx
jmp 0x10018edd
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x27c], 0x6171
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018eca
mov dword [esp + 0x10], ebx
jmp 0x10018eff
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x164]
mov dword [eax + ecx*4], 0x7b187b35
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10018ee9
mov dword [esp + 0x10], ebx
jmp 0x10018f1b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x2bc], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10018f0c
mov dword [esp + 0x10], ebx
jmp 0x10018f3d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1fc]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10018f27
mov eax, dword [esp + 0x38]
add eax, dword [esp + 0x40]
jne 0x10018f8b
mov eax, dword [esp + 0x28]
xor edx, edx
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x50]
neg eax
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x280]
mov eax, dword [esp + 0x44]
cmp ecx, eax
mov eax, dword [esp + 0x164]
setl dl
xor ecx, ecx
cmp edx, 0xe6a4
mov eax, dword [eax]
setne cl
add eax, ecx
mov eax, ebx
je 0x10018f8d
mov eax, esi
mov dword [esp + 0x28], eax
xor edx, edx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xa8]
dec dword [esp + 0x20]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x2c4], ecx
mov eax, dword [esp + 0x280]
dec eax
cmp ecx, eax
mov eax, dword [esp + 0xac]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
sete cl
cmp ecx, 0xfff7
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
imul eax, ecx, 0x3af9
lea ecx, [esp + 0xd4]
mov dword [esp + 0x1c], eax
call fcn.10016191
lea ecx, [esp + 0x1fc]
call fcn.10016191
lea ecx, [esp + 0x164]
mov byte [esp + 0x2fc], 0xb
call fcn.10016191
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe4
jg 0x10018e04
lea ecx, [esp + 0xec]
mov byte [esp + 0x2fc], 0xa
call fcn.10016191
mov dword [esp + 0x14], 0x91a049fe
lea ecx, [esp + 0x128]
push 2
call fcn.1001610f
mov byte [esp + 0x2fc], 0xe
mov dword [esp + 0x14], ebx
jmp 0x1001907b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x128]
mov dword [eax + ecx*4], 0x2374
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019065
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0xffffffee
jl 0x100190fa
mov esi, dword [esp + 0x128]
push 1
lea ecx, [esp + 0x114]
call fcn.1001610f
xor edx, edx
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x20], ebx
inc edx
jmp 0x100190c9
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x110]
mov dword [eax + ecx*4], 0x70cd
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x100190b3
mov eax, dword [esp + 0x110]
lea ecx, [esp + 0x110]
mov eax, dword [eax]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], edx
call fcn.10016191
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffee
jge 0x10019094
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10019115
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
lea ecx, [esp + 0x128]
mov byte [esp + 0x2fc], 0xa
call fcn.10016191
push 2
xor esi, esi
mov dword [esp + 0x14], ebx
pop edx
inc esi
cmp dword [esp + 0x10], edx
jge 0x1001914d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x140]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x10]
jmp 0x10019133
mov dword [esp + 0x10], ebx
jmp 0x10019166
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x1f0]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019153
mov dword [esp + 0x14], 0x9000d4e7
mov dword [esp + 0x14], ebx
jmp 0x1001918e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2cc], 0xb9102071
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1001917b
mov dword [esp + 0x14], ebx
jmp 0x100191cf
mov dword [esp + 0x28], 5
mov dword [esp + 0x28], esi
cmp dword [esp + 0x28], ebx
jl 0x100191cb
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100191c5
push 0xda3
call edi
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
dec dword [esp + 0x28]
jns 0x100191ac
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1001919a
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x34], 0xffff
mov eax, dword [esp + 0x30]
cmp eax, 0xfffffffd
mov edx, dword [esp + 0x34]
setne cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
cmp edx, eax
mov eax, dword [esp + 0x30]
setle cl
xor edx, edx
cmp ecx, 0x6e9f0866
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
cmp ecx, 0xfffffffa
setge dl
sub edx, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setg cl
xor edx, edx
imul ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
neg eax
cmp eax, ecx
mov eax, dword [esp + 0x140]
setl dl
sub edx, 0x34e6
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [eax + 4], edx
mov eax, dword [esp + 0x30]
cmp edx, eax
setg cl
cmp ecx, 9
jbe 0x10019278
mov eax, dword [esp + 0x28]
push esi
lea ecx, [esp + 0x218]
call fcn.1001610f
mov dword [esp + 0x14], ebx
jmp 0x100192a1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x214]
mov dword [eax + ecx*4], 0x4e10
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001928b
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100192bf
push 0xe33
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
inc dword [esp + 0x2c]
lea ecx, [esp + 0x214]
call fcn.10016191
mov dword [esp + 0x34], 0xfb0b0297
mov ecx, 0xfffc
mov dword [esp + 0x1c], 2
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
cmp ecx, eax
mov eax, dword [esp + 0x1c]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
mov dword [esp + 0x14], ecx
mov dword [esp + 0x14], 0xfffffff6
jmp 0x10019363
mov dword [esp + 0x20], ebx
jmp 0x1001932c
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x29c], 0xb055cc25
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 4
jl 0x10019319
dec dword [esp + 0x29c]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001935f
push 0x20a3
push 0x870
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 5
je 0x10019313
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001937f
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EndPaint]
lea ecx, [esp + 0x1f0]
call fcn.10016191
or dword [esp + 0x2fc], 0xffffffff
lea ecx, [esp + 0x140]
call fcn.10016191
mov dword [esp + 0xb4], 0x8d9a2b82
lea ecx, [esp + 0x1bc]
mov dword [esp + 0x20], 0xb55bb2c2
mov dword [esp + 0x1c], 0xfffffffa
push 2
call fcn.1001610f
mov dword [esp + 0x1c], 0x8d96753f
mov dword [esp + 0x34], 0x4469
mov dword [esp + 0x14], ebx
jmp 0x100193f4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1bc]
mov dword [eax + ecx*4], 0x2a8358bd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100193de
mov dword [esp + 0x20], 0x11
cmp dword [esp + 0x20], 0xb
jg 0x1001947b
push 4
pop ecx
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0x21c3a23
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0xbdbdf7c
mov dword [esp + 0x1c], 0x282d564c
mov dword [esp + 0x1c], 0x9b2b534d
mov dword [esp + 0x14], ebx
jmp 0x10019466
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x2e0], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10019457
inc dword [esp + 0x34]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xb
jle 0x1001940d
lea ecx, [esp + 0x1bc]
call fcn.10016191
push 0x7f75
lea eax, [esp + 0xc0]
push eax
lea eax, [esp + 0xbc]
push eax
lea eax, [esp + 0xd0]
push eax
push ebx
lea eax, [esp + 0xb8]
push eax
lea eax, [esp + 0xc8]
push 0x5fec
push eax
call fcn.1001c13e
mov dword [esp + 0x4c], 0x4c90d297
lea ecx, [esp + 0x1e8]
add esp, 0x20
push 2
pop eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], 0xe043eef7
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x1c], 0xcc90c63b
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0x9d073d4
mov dword [esp + 0x1c], 0xc17a3f0a
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0xfe1f230
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0xde6b786a
mov dword [esp + 0x1c], 0x181f51b4
push eax
call fcn.1001610f
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x28], 0xb96bc97
mov dword [esp + 0x14], ebx
jmp 0x1001955e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c8]
mov dword [eax + ecx*4], 0x5e175309
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019548
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
cmp eax, 0x56e7
setne cl
mov dword [esp + 0x30], ecx
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x2c]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xa1cf
mov eax, dword [esp + 0x2c]
setge cl
xor edx, edx
cmp eax, ecx
mov ecx, dword [esp + 0x2c]
setge dl
sub ecx, dword [esp + 0x2c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setge al
add eax, dword [esp + 0x24]
jne 0x100195bf
mov ecx, ebx
cmp dword [esp + 0x30], ebx
je 0x100195c1
mov ecx, esi
xor eax, eax
cmp ecx, 0x1f0d
setl al
xor edx, edx
cmp eax, 0xcc9f
mov eax, dword [esp + 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, dword [esp + 0x24]
je 0x1001961a
cmp dword [esp + 0x24], ebx
je 0x1001961a
mov dword [esp + 0x34], 0x2d683a7e
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], eax
mov dword [esp + 0x30], 0xfffffff0
jmp 0x10019611
cmp dword [esp + 0x34], ebx
jne 0x1001965b
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0xfffffff6
jle 0x10019607
jmp 0x1001965b
mov eax, 0xfff7
mov dword [esp + 0x194], eax
mov dword [esp + 0x198], eax
mov dword [esp + 0x19c], eax
mov dword [esp + 0x1a0], eax
mov dword [esp + 0x24], ebx
jmp 0x10019654
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x194], 5
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 4
jl 0x10019641
inc dword [esp + 0x28]
lea ecx, [esp + 0x1c8]
call fcn.10016191
push esi
lea ecx, [esp + 0x15c]
call fcn.1001610f
mov dword [esp + 0x1c], 0xfffffff7
mov dword [esp + 0x14], ebx
jmp 0x1001969c
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x158]
mov dword [eax + ecx*4], 0x665683c8
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10019686
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100196b6
call edi
push eax
call dword [sym.imp.USER32.dll_IsIconic]
mov edx, dword [esp + 0x158]
xor ecx, ecx
cmp dword [edx], ecx
sete cl
sub ecx, dword [edx]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp dword [edx], ecx
setg al
xor ecx, ecx
cmp eax, dword [edx]
mov eax, 0x7cb3
setne cl
sub eax, ecx
lea ecx, [esp + 0x158]
mov dword [edx], eax
call fcn.10016191
mov byte [esp + 0x3f], bl
lea ecx, [esp + 0x3f]
xor dl, dl
call fcn.10019bc7
push 2
lea ecx, [esp + 0x174]
call fcn.1001610f
push 3
pop edi
mov dword [esp + 0x2fc], 0xf
lea ecx, [esp + 0xe0]
mov dword [esp + 0x34], 0xb3e7
push edi
call fcn.1001610f
mov dword [esp + 0x1c], esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10019756
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x170]
mov dword [eax + ecx*4], 0x2971c1ec
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019740
mov dword [esp + 0x10], ebx
jmp 0x10019776
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xb8], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10019763
mov dword [esp + 0x10], ebx
jmp 0x10019798
cmp dword [esp + 0x10], edi
jl 0x10019782