Function at 0x10018e35
Capabilities:
Check os version
Get keyboard layout
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008a391
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
push ebx
push esi
mov dword [esp + 0x14], 0xdb22124f
xor ebx, ebx
push edi
mov dword [esp + 0x34], 0xf86f25db
mov dword [esp + 0x38], ebx
push 3
mov dword [esp + 0x34], 0x7cdd5376
mov dword [esp + 0x104], edx
mov dword [esp + 0x94], ecx
mov dword [esp + 0x24], ebx
pop edi
jmp 0x10018e9e
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x50], 0xb56411d7
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10018e8e
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
sub ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov dword [esp + 0x30], ecx
xor ecx, ecx
cmp dword [esp + 0x30], eax
mov eax, dword [esp + 0x18]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x50], ecx
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x54], ebx
jne 0x10018f1b
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x50]
dec ecx
neg ecx
push edi
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [esp + 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x54]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x3c]
setl cl
mov dword [esp + 0x34], ecx
xor ecx, ecx
cmp dword [esp + 0x34], eax
sete cl
xor esi, esi
mov dword [esp + 0x54], ecx
inc esi
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x1ac]
mov dword [esp + 0x2c], 0x8a1f9496
mov dword [esp + 0x30], esi
mov dword [esp + 0x20], 0xa05d
mov dword [esp + 0x30], 8
mov dword [esp + 0x3c], 0x6084edc0
mov dword [esp + 0x3c], 0xf7c2f5a2
call fcn.10016d5e
mov dword [esp + 0x20], ebx
jmp 0x10018fd4
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1a8]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10018fc1
mov eax, dword [esp + 0x28]
xor edx, edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setne dl
cmp edx, dword [esp + 0x28]
jge 0x10018ffb
mov eax, esi
cmp dword [esp + 0x28], ebx
jne 0x10018ffd
mov eax, ebx
mov dword [esp + 0x2c], eax
xor edx, edx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setne dl
sub edx, dword [esp + 0x1c]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x2c], edx
xor edx, edx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], esi
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x1a8]
lea ecx, [esp + 0x1a8]
setge dl
mov dword [esp + 0x38], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x38], eax
call fcn.10016de0
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
jmp 0x10019093
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x224], 2
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edi
jl 0x10019080
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x100190ae
push ebx
push ebx
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x1c], 2
cmp dword [esp + 0x1c], ebx
jl 0x1001911e
mov dword [esp + 0x2c], 0x86cce57b
mov dword [esp + 0x2c], 2
cmp dword [esp + 0x2c], ebx
jl 0x100190f3
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x100190ed
push 1
call esi
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
dec dword [esp + 0x2c]
jns 0x100190d8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10019118
push ebx
push 0x1f36
push 0x1f78
push 0xc74
push 0x1e27
call dword [sym.imp.GDI32.dll_CreateBitmap]
dec dword [esp + 0x1c]
jns 0x100190c2
mov dword [esp + 0x28], 0xdb22124f
mov dword [esp + 0x18], 0xac64a684
mov dword [esp + 0x2c], 5
mov dword [esp + 0x18], 0x1b
cmp dword [esp + 0x18], 0xfffffff5
jge 0x10019291
push 7
pop edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0xf0], edi
mov dword [esp + 0xf4], edi
mov dword [esp + 0xf8], edi
mov dword [esp + 0xfc], edi
mov dword [esp + 0x1c], 0x4ed25e42
mov dword [esp + 0x30], 0xd31fc531
mov dword [esp + 0x20], ebx
jmp 0x10019192
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x3c], 0x4f9dbc9b
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x10019182
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x3c], ebx
je 0x100191a8
xor ecx, ecx
inc ecx
jmp 0x100191aa
mov ecx, ebx
mov eax, dword [esp + 0x3c]
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x3c]
cmp ecx, eax
sete dl
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x2c], ebx
je 0x100191c9
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0xfc]
mov eax, dword [esp + 0xfc]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
add eax, 0x9080
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x3c]
cmp dword [esp + 0x2c], eax
je 0x1001921e
cmp dword [esp + 0x2c], ebx
jne 0x1001921e
mov ecx, ebx
jmp 0x10019221
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0xfc]
add eax, ecx
cmp eax, dword [esp + 0x18]
jge 0x1001923a
cmp dword [esp + 0x1c], ebx
jne 0x1001923a
mov edx, ebx
jmp 0x1001923d
xor edx, edx
inc edx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, dword [esp + 0x18]
jge 0x1001925c
cmp dword [esp + 0xf8], ebx
je 0x1001925c
xor edx, edx
inc edx
jmp 0x1001925e
mov edx, ebx
mov eax, dword [esp + 0x3c]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x3c]
jge 0x10019273
mov eax, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x30], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff5
jl 0x1001914c
mov edi, dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [esp + 0x18], 0xd
jmp 0x100192bf
mov dword [esp + 0x30], 0x9d693ce8
mov dword [esp + 0x24], 0x278539ae
mov dword [esp + 0x2c], 1
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x14
jl 0x1001929b
mov dword [esp + 0x1c], 0xf86f25db
lea ecx, [esp + 0x1b4]
mov dword [esp + 0x30], 0x85299dad
push 1
call fcn.10016d5e
mov dword [esp + 0x20], ebx
jmp 0x10019300
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1b4]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jl 0x100192ea
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x1b4]
mov dword [eax], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10019325
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x1b4]
call fcn.10016de0
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], ebx
jmp 0x1001937a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10019372
push 0x2636
push 0x1dc3
push 0x230f
push 0x2599
push 0x68f
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [esp + 0x20]
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xfffffff1
jle 0x1001933f
mov dword [esp + 0x30], 0x7cdd5376
lea ecx, [esp + 0x5c]
push 2
call fcn.10016d5e
push 2
lea ecx, [esp + 0x14c]
mov dword [esp + 0x240], ebx
call fcn.10016d5e
push 2
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x100193c5
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100193b2
xor esi, esi
mov dword [esp + 0x18], ebx
inc esi
jmp 0x100193e7
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xe0], 0xbd90
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x100193d4
mov dword [esp + 0x18], ebx
jmp 0x10019409
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0x56237581
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100193f3
mov eax, dword [esp + 0x5c]
mov dword [eax], 0xffffffec
mov dword [esp + 0x20], esi
mov dword [esp + 0x34], ebx
jmp 0x10019436
mov eax, dword [esp + 0x34]
mov dword [esp + eax*4 + 0x208], 0x8451d77f
inc dword [esp + 0x34]
cmp dword [esp + 0x34], 4
jl 0x10019423
mov ecx, dword [esp + 0x5c]
cmp dword [ecx], ebx
je 0x100194d1
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x5c]
mov edx, esi
push 0
cmp dword [eax], ebx
mov eax, dword [eax + 4]
setne cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x65251c60
setge cl
xor eax, eax
test ecx, ecx
mov dword [esp + 0x210], ecx
sete al
xor ecx, ecx
imul eax, dword [esp + 0x24]
cmp eax, 0x1c36
mov eax, dword [esp + 0x60]
setg cl
sub ecx, dword [eax]
mov eax, dword [esp + 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
mov ecx, dword [esp + 0x24]
pop eax
sets al
sub ecx, eax
mov eax, dword [esp + 0x5c]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0xe0], ecx
lea eax, [ecx - 1]
xor ecx, ecx
cmp eax, 0x5bb5
setge cl
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x5c]
jne 0x100194d3
mov edx, ebx
mov eax, dword [esp + 0x148]
mov dword [eax], edx
inc dword [ecx]
cmp dword [ecx], 0xffffffef
jne 0x10019419
lea ecx, [esp + 0x148]
call fcn.10016de0
or dword [esp + 0x23c], 0xffffffff
lea ecx, [esp + 0x5c]
call fcn.10016de0
mov dword [esp + 0x20], ebx
jmp 0x1001951a
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x68], 0xb56411d7
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x1001950a
push 2
lea ecx, [esp + 0x98]
call fcn.10016d5e
push 7
mov dword [esp + 0x240], esi
pop eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x20], ebx
jmp 0x10019561
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x94]
mov dword [eax + ecx*4], 0x90ac204e
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x1001954b
mov eax, dword [esp + 0x94]
mov dword [eax], 0xfffffff2
jmp 0x1001957a
xor esi, esi
inc esi
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x1c0]
push esi
call fcn.10016d5e
mov dword [esp + 0x20], ebx
jmp 0x100195a4
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c0]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jl 0x10019591
mov eax, dword [esp + 0x94]
mov eax, dword [eax]
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], ebx
jmp 0x100195f5
mov dword [esp + 0x30], esi
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x94]
cmp dword [eax], ebx
je 0x100195d4
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x30], ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100195f1
call dword [sym.imp.USER32.dll_GetCapture]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
jle 0x100195bd
lea ecx, [esp + 0x1c0]
call fcn.10016de0
mov esi, dword [esp + 0x94]
inc dword [esi]
cmp dword [esi], 0x14
jne 0x10019577
xor eax, eax
cmp dword [esi], eax
setne al
xor ecx, ecx
cmp eax, dword [esi]
setg cl
xor eax, eax
cmp ecx, dword [esi]
mov esi, dword [esi]
setne al
xor ecx, ecx
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
sub eax, esi
cmp eax, esi
setge cl
xor eax, eax
cmp ecx, esi
setg al
xor edx, edx
cmp esi, eax
mov eax, dword [esp + 0x94]
setne dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [esp + 0x2c]
cmp edx, eax
setne cl
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0x94]
or dword [esp + 0x23c], eax
call fcn.10016de0
mov eax, dword [esp + 0x28]
xor edx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x28]
setg dl
xor ecx, ecx
cmp eax, edx
push 2
setl cl
sub ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x34], ecx
xor ecx, ecx
cmp dword [esp + 0x34], eax
mov eax, dword [esp + 0x2c]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x2c]
pop esi
setge dl
xor ecx, ecx
cmp edx, eax
push esi
setne cl
mov dword [esp + 0x6c], ecx
lea ecx, [esp + 0x1a0]
mov dword [esp + 0x1c], 0xfc07e17f
mov dword [esp + 0x3c], 0xffffffff
call fcn.10016d5e
mov dword [esp + 0x30], ebx
mov dword [esp + 0x38], 0x34071e99
mov dword [esp + 0x30], 0xcf162c80
mov dword [esp + 0x14], ebx
jmp 0x1001972c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x128], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1001971d
mov dword [esp + 0x14], ebx
jmp 0x1001974e
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x19c]
mov dword [eax + ecx*4], 4
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10019738
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov dword [esp + 0x12c], 0x16
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x19c]
push 6
pop edx
cmp eax, edx
mov eax, dword [esp + 0x18]
push 6
setne cl
xor edx, edx
cmp ecx, 0x90a
setge dl
xor ecx, ecx
cmp edx, eax
mov dword [esi + 4], edx
setle cl
cmp ecx, 0xfffffff7
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x3c], eax
mov ecx, dword [esp + 0x130]
mov eax, dword [esp + 0x1c]
add ecx, eax
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setl dl
xor ecx, ecx
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp edx, eax
mov eax, dword [esp + 0x3c]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
cmp eax, ecx
sbb eax, eax
inc eax
add eax, dword [esp + 0x18]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x38]
xor eax, eax
cmp dword [esi + 4], 2
setg al
cmp eax, dword [esp + 0x18]
jne 0x10019815
cmp dword [esp + 0x18], ebx
jne 0x10019815
xor esi, esi
mov ecx, ebx
inc esi
jmp 0x1001981a
xor esi, esi
inc esi
mov ecx, esi
xor eax, eax
cmp ecx, 0x1361131e
lea ecx, [esp + 0x19c]
setl al
mov dword [esp + 0x30], eax
call fcn.10016de0
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x6c], ebx
jne 0x10019843
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x68]
mov eax, dword [esp + 0x68]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x68]
dec ecx
neg ecx
push 3
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x6c]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
setl cl
mov dword [esp + 0x34], ecx
xor ecx, ecx
cmp dword [esp + 0x34], eax
sete cl
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x134]
mov dword [esp + 0x2c], 0x8a1f9496
mov dword [esp + 0x30], esi
mov dword [esp + 0x24], 0xa05d
mov dword [esp + 0x30], 8
mov dword [esp + 0x28], 0x6084edc0
mov dword [esp + 0x28], 0xf7c2f5a2
call fcn.10016d5e
mov dword [esp + 0x1c], ebx
jmp 0x100198fa
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x130]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x100198e7
mov eax, dword [esp + 0x28]
xor edx, edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setne dl
cmp edx, dword [esp + 0x28]
jge 0x10019922
mov eax, esi
cmp dword [esp + 0x28], ebx
jne 0x10019924
mov eax, ebx
mov dword [esp + 0x2c], eax
xor edx, edx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setne dl
sub edx, dword [esp + 0x20]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x2c], edx
xor edx, edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov dword [esp + 0x24], esi
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
cmp eax, ecx
mov eax, dword [esp + 0x130]
lea ecx, [esp + 0x130]
setge dl
mov dword [esp + 0x24], edx
mov eax, dword [eax + 8]
mov dword [esp + 0x24], eax
call fcn.10016de0
mov dword [esp + 0x18], 0xf825
lea ecx, [esp + 0x114]
push 2
call fcn.10016d5e
push 2
pop edx
mov dword [esp + 0x23c], edx
push 6
mov dword [esp + 0x28], 0x61e33ecd
pop eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], ebx
jmp 0x100199e4
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x100199d2
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
inc eax
je 0x10019a92
mov dword [esp + 0x30], esi
lea ecx, [esp + 0x160]
push edx
call fcn.10016d5e
mov dword [esp + 0x14], ebx
jmp 0x10019a2f
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x8c], 0xffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10019a1c
mov dword [esp + 0x14], ebx
jmp 0x10019a4d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x10019a3b
cmp dword [esp + 0x8c], ebx
je 0x10019a68
mov eax, dword [esp + 0x8c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov ecx, 0xa8eb0028
sub ecx, eax
add ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x160]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x160]
call fcn.10016de0
jmp 0x10019b24
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x18], ebx
jmp 0x10019b08
mov dword [esp + 0x30], 0xfffffffe
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x114]
cmp dword [eax + ecx*4], ebx
jne 0x10019b0e
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 0x114]
neg eax
cmp eax, dword [edx + esi*4]
setg cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
inc edx
cmp edx, eax
setne cl
xor esi, esi
mov dword [esp + 0x30], ecx
inc dword [esp + 0x18]
inc esi
cmp dword [esp + 0x18], esi
jle 0x10019aa0
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019b24
push 0x2508
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
or dword [esp + 0x23c], 0xffffffff
lea ecx, [esp + 0x114]
call fcn.10016de0
mov dword [esp + 0x28], 0xdb22124f
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], ebx
jmp 0x10019b5d
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x218], 2
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x10019b4a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019b74
push ebx
push ebx
push ebx
call edi
push 2
pop edi
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], ebx
jl 0x10019bde
mov dword [esp + 0x2c], 0x86cce57b
mov dword [esp + 0x2c], edi
cmp dword [esp + 0x2c], ebx
jl 0x10019bb2
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019bac
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
dec dword [esp + 0x2c]
jns 0x10019b93
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019bd8
push ebx
push 0x1f36
push 0x1f78
push 0xc74
push 0x1e27
call dword [sym.imp.GDI32.dll_CreateBitmap]
dec dword [esp + 0x1c]
jns 0x10019b81
mov dword [esp + 0x30], 0x9d05
mov dword [esp + 0x24], 9
mov dword [esp + 0x1c], ebx
jmp 0x10019c04
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x48], 0xfffffffb
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10019bf4
mov dword [esp + 0x48], ebx
jmp 0x10019c24
mov dword [esp + 0x24], ebx
inc dword [esp + 0x24]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], eax
dec dword [esp + 0x48]
cmp dword [esp + 0x48], 0xfffffff9
jg 0x10019c10
mov dword [esp + 0x2c], 0xf86f25db
lea ecx, [esp + 0xc4]
push 4
call fcn.10016d5e
push 3
pop edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x30], 0x213ec752
mov dword [esp + 0x1c], ebx
jmp 0x10019c6c
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc4]
mov dword [eax + ecx*4], 0x28c176b0
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x10019c56
mov dword [esp + 0x14], ebx
jmp 0x10019c8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc4]
cmp dword [eax + ecx*4], ebx
jne 0x10019c93
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jle 0x10019c79
mov eax, dword [esp + 0xc4]
cmp dword [eax + 8], ebx
je 0x10019ca7
mov ecx, esi
cmp dword [esp + 0x14], ebx
jne 0x10019ca9
mov ecx, ebx
mov eax, dword [esp + 0xc4]
mov edx, 0xdb5cabfc
cmp edx, dword [eax + 4]
sbb eax, eax
xor edx, edx
inc eax
cmp eax, ecx
mov eax, dword [esp + 0x14]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
xor eax, eax
cmp ecx, 0xfffffffb
lea ecx, [esp + 0xc4]
setge al
mov dword [esp + 0x14], eax
call fcn.10016de0
mov dword [esp + 0x18], 0xac64a684
mov dword [esp + 0x1c], 5
mov dword [esp + 0x18], 0x1b
jmp 0x10019e2c
mov dword [esp + 0x1c], ebx
push 7
pop eax
mov dword [esp + 0x104], eax
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x20], 0x4ed25e42
mov dword [esp + 0x30], 0xd31fc531
mov dword [esp + 0x1c], ebx
jmp 0x10019d4b
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x40], 0x4f9dbc9b
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10019d3b
mov eax, dword [esp + 0x18]
mov ecx, esi
cmp dword [esp + 0x40], ebx
jne 0x10019d5f
mov ecx, ebx
mov eax, dword [esp + 0x40]
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x40]
cmp ecx, eax
sete dl
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], ebx
je 0x10019d7e
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x110]
mov eax, dword [esp + 0x110]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
add eax, 0x9080
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x40]
cmp dword [esp + 0x1c], eax
je 0x10019dd1
mov ecx, ebx
cmp dword [esp + 0x1c], ebx
je 0x10019dd3
mov ecx, esi
mov eax, dword [esp + 0x110]
add eax, ecx
cmp eax, dword [esp + 0x18]
jge 0x10019dea
mov edx, ebx
cmp dword [esp + 0x20], ebx
je 0x10019dec
mov edx, esi
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, dword [esp + 0x18]
jge 0x10019e08
mov edx, esi
cmp dword [esp + 0x10c], ebx
jne 0x10019e0a
mov edx, ebx
mov eax, dword [esp + 0x40]
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [esp + 0x40]
jge 0x10019e1f
mov eax, dword [esp + 0x40]
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x30], eax
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff5
jl 0x10019d02
mov dword [esp + 0x18], 0xd
jmp 0x10019e61
mov dword [esp + 0x30], 0x9d693ce8
mov dword [esp + 0x24], 0x278539ae
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x14
jl 0x10019e41
push 4
pop eax
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x190]
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], 8
mov dword [esp + 0x1c], 0xf4e79753
push eax
call fcn.10016d5e
mov dword [esp + 0x24], 0x88c55612
mov dword [esp + 0x14], ebx
jmp 0x10019eb1
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xac], 0xfffe
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10019e9e
mov dword [esp + 0x14], ebx
jmp 0x10019ed4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x190]
mov dword [eax + ecx*4], 0x31aa08e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10019ebe
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10019f18
push 0x1792
push 0xe36
push 0x1d55
push 0x1b67
push 0x4ea
push 0xd57
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], edi
jg 0x10019fa8
mov esi, dword [esp + 0x190]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0xac]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0xac]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0xac]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0xac]
mov eax, dword [esp + 0x30]
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x14]
mov edx, dword [esp + eax*4 + 0xac]
xor eax, eax
mov ecx, dword [esp + 0x1c]
add ecx, 0x7b051af7
imul ecx, dword [esp + 0x24]
cmp ecx, edx
setl al
xor edx, edx
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xac]
cmp ecx, eax
setge dl
mov dword [esi + 8], edx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x10019f2d
xor esi, esi
inc esi
lea ecx, [esp + 0x190]
call fcn.10016de0
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0xd4]
mov dword [esp + 0x14], esi
push 4
call fcn.10016d5e
mov dword [esp + 0x14], ebx
jmp 0x10019fe2
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10019fd0
mov dword [esp + 0x14], ebx
jmp 0x10019ffe
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x120], esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10019fef
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], 0x12
jge 0x1001a176
mov edi, dword [esp + 0xd4]
mov dword [esp + 0x18], 0x5ba77230
mov dword [esp + 0x24], 0x37ff
mov dword [esp + 0x38], esi
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 3
jg 0x1001a136
mov dword [esp + 0x20], ebx
mov dword [esp + 0x38], 2
mov dword [esp + 0x20], 3
cmp dword [esp + 0x20], ebx
jl 0x1001a124
mov dword [esp + 0x34], 0x66e58d02
mov dword [esp + 0x34], ebx
jmp 0x1001a0a1
mov dword [esp + 0x1c], 0xe135e1f6
mov dword [esp + 0x1c], 3
cmp dword [esp + 0x1c], ebx
jl 0x1001a09d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a097
inc dword [esp + 0x34]
cmp dword [esp + 0x34], 3
jle 0x1001a069
cmp dword [esp + 0x14], ebx
je 0x1001a0d7
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
add eax, 5
je 0x1001a0bf
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp ecx, eax
setge dl
cmp edx, dword [esp + 0x20]
je 0x1001a0f8
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x1001a03d
xor esi, esi
inc esi
mov eax, dword [esp + 0x24]
cmp dword [edi + 8], ebx
je 0x1001a150
mov eax, dword [esp + 0xd4]
mov eax, dword [eax + 4]
mov dword [esp + 0x120], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x124]
mov dword [esp + 0x38], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x12
jl 0x1001a01a
lea ecx, [esp + 0xd4]
call fcn.10016de0
mov dword [esp + 0x24], 0x85299dad
lea ecx, [esp + 0x178]
push esi
call fcn.10016d5e
mov dword [esp + 0x1c], ebx
jmp 0x1001a1b3
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x178]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001a19d
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x178]
mov dword [eax], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a1d8
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea ecx, [esp + 0x178]
call fcn.10016de0
mov dword [esp + 0x14], ebx
mov dword [esp + 0x34], 0x61fbc9fa
mov dword [esp + 0x1c], 0xfffffffa
mov dword [esp + 0x14], 0xfffffff9
cmp dword [esp + 0x14], 0xffffffef
jl 0x1001a39a
push 7
pop edi
push dword [esp + 0x90]
movdqa xmm0, xmmword [0x10008550]
lea eax, [esp + 0x1fc]
push eax
lea eax, [esp + 0x1f0]
mov dword [esp + 0x28], esi
push eax
mov dword [esp + 0x30], esi
lea ecx, [esp + 0xc4]
push ebx
movdqu xmmword [esp + 0x1f8], xmm0
mov dword [esp + 0xc8], ebx
mov dword [esp + 0xcc], ebx
mov dword [esp + 0xd0], ebx
call fcn.10018468
mov dword [esp + 0x1c], ebx
jmp 0x1001a279
mov dword [esp + 0x24], 0x7cdd5376
mov dword [esp + 0x24], 0x6482
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1001a3bc