Function at 0x10018d8f
Capabilities:
Check os version
Get graphical window text

Disassembly:
mov eax, 0x10072ebf
call fcn.10072640
sub esp, 0x19c
push ebx
push esi
push edi
push 0
pop ebx
xor esi, esi
mov dword [ebp - 0x20], 0x5e48d327
inc esi
mov dword [ebp - 0x8c], edx
push 2
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x20], esi
pop edi
jmp 0x10018e39
mov dword [ebp - 0x18], 0xd214c405
lea ecx, [ebp - 0x120]
push 3
call fcn.10016dd3
push 3
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x10018df0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x18c], 0x3c8fc558
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10018ddf
mov dword [ebp - 0x10], ebx
jmp 0x10018e0d
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10018dfa
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], edi
jg 0x10018e2b
mov eax, dword [ebp - 0x120]
mov dword [eax + 8], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10018e20
lea ecx, [ebp - 0x120]
call fcn.10017696
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff9
jle 0x10018dc3
mov dword [ebp - 0x30], 0xa1f94964
mov dword [ebp - 0x20], 0xb4ff
mov dword [ebp - 0x38], 0x9e53e58b
mov dword [ebp - 0x18], 0x7d2703d9
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], 0xe2f9
mov dword [ebp - 0x2c], 0xf906d8bc
mov dword [ebp - 0x34], 0xddac0faa
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x3c], 0xadfd6f60
mov dword [ebp - 0x10], ebx
jmp 0x10018e97
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x144], 0x72b21a35
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10018e86
mov dword [ebp - 0x10], ebx
jmp 0x10018eb3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x170], 0x2a30a4cc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018ea2
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10018ece
push ebx
push 0x1fc3
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayDestroy]
cmp dword [ebp - 0x28], ebx
je 0x10018edd
mov eax, dword [ebp - 0x1c]
mov edx, esi
cmp eax, dword [ebp - 0x20]
jne 0x10018edf
mov edx, ebx
mov eax, dword [ebp - 0x140]
xor ecx, ecx
cmp edx, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x140]
setle dl
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x24]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setne cl
dec dword [ebp - 0x34]
cmp eax, ecx
mov ecx, dword [ebp - 0x140]
mov eax, esi
cmovge eax, ebx
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x254f
setl al
cmp dword [ebp - 0x20], eax
je 0x1001908a
mov dword [ebp - 0x38], 0x1dc7e906
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x10018f93
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe4], 0xb5b06a83
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10018f82
mov dword [ebp - 0x10], ebx
jmp 0x10018faf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1a8], 0x17887b34
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10018f9e
mov dword [ebp - 0x1c], ebx
jmp 0x1001907e
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x138]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x28], 0xfd1a6840
push esi
call fcn.10016dd3
mov dword [ebp - 0xa4], 0xb5901663
mov dword [ebp - 0x18], ebx
jmp 0x10018ffc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 0xf96354d1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10018fe9
cmp dword [ebp - 0xe0], ebx
je 0x10019050
imul eax, dword [ebp - 0x24], 0x3c9e
xor ecx, ecx
cmp eax, 0x6edb5b29
mov eax, dword [ebp - 0x138]
setl cl
add ecx, dword [eax]
xor eax, eax
cmp ecx, 5
setne al
xor edx, edx
cmp eax, 0x3645
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x3c]
inc dword [ebp - 0x3c]
test ecx, ecx
je 0x10019050
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x28], ebx
je 0x10019058
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xa4]
lea ecx, [ebp - 0x138]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
call fcn.10017696
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffed
jne 0x10018fbd
jmp 0x100190a4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100190a4
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
mov dword [ebp - 0x28], 4
lea ecx, [ebp - 0x88]
push 3
call fcn.10016dd3
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x3c], 0x865e1bfe
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0x905687c4
mov dword [ebp - 0x10], 0xd6b8
mov dword [ebp - 0x1c], ebx
jmp 0x100190f5
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100190e6
mov dword [ebp - 0x1c], ebx
jmp 0x1001910d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xb4], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10019100
mov dword [ebp - 0x2c], 0x4aa41a80
cmp dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x88]
jle 0x1001912b
mov ecx, esi
cmp dword [eax], ebx
jne 0x1001912d
mov ecx, ebx
mov eax, dword [eax]
xor edx, edx
mov dword [ebp - 0xa8], eax
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x88]
setl dl
xor ecx, ecx
imul edx, dword [eax]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
sub eax, 5
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 8]
mov edx, dword [eax]
mov eax, dword [ebp - 0x3c]
add eax, edx
cmp eax, 0x4f2a6ca0
mov eax, 0xfff9
setg cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
imul eax, dword [ebp - 0xa8]
add eax, edx
cmp edx, eax
setle cl
sub ecx, esi
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, esi
setle al
cmp eax, 3
jg 0x100191b6
mov eax, dword [ebp - 0x2c]
xor esi, esi
xor ecx, ecx
inc esi
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 2
setg cl
neg ecx
je 0x10019214
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x18], ebx
jmp 0x100191eb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x54], 0xf87662b0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100191dd
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x20], ebx
jmp 0x10019349
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x38], 0xb74473ca
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x10], ebx
jmp 0x1001933f
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x34], 0xffffffff
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001925b
push ebx
push ebx
push 0x394
push 0xb25
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb4], ecx
cmp dword [ebp - 0x2c], 0xffffffff
jge 0x100192f6
push esi
lea ecx, [ebp - 0x150]
call fcn.10016dd3
mov dword [ebp - 0x1c], ebx
jmp 0x10019291
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4c], 0xbe3e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10019283
mov dword [ebp - 0x1c], ebx
jmp 0x100192ae
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0xee1efb40
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001929b
cmp dword [ebp - 0x10], ebx
jne 0x100192ca
mov eax, dword [ebp - 0x4c]
cmp eax, dword [ebp - 0x4c]
jne 0x100192c3
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov ecx, ebx
jmp 0x100192cc
mov ecx, esi
xor eax, eax
cmp ecx, esi
lea ecx, [ebp - 0x150]
sete al
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x38], 0xdf555a6f
inc dword [ebp - 0x34]
call fcn.10017696
jmp 0x1001933c
mov dword [ebp - 0x2c], 6
mov ecx, 0x234d
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xb4]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0xb4]
mov eax, dword [ebp - 0x2c]
sub ecx, eax
add edx, ecx
je 0x10019337
cmp dword [ebp - 0x3c], ebx
je 0x10019337
mov eax, esi
cmp dword [ebp - 0x10], ebx
jne 0x10019339
mov eax, ebx
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10019231
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x88]
call fcn.10017696
push 3
pop eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0xcc]
push eax
call fcn.10016dd3
push 3
pop edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x1c], ebx
jmp 0x1001938f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0xa049
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1001937c
mov dword [ebp - 0x1c], ebx
jmp 0x100193a7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x44], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10019399
mov dword [ebp - 0x44], ebx
jmp 0x100194c0
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], ebx
jl 0x10019421
mov dword [ebp - 0x34], 0x34eea2a3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100193f4
push 0x1792
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov dword [ebp - 0x34], 2
cmp dword [ebp - 0x34], ebx
jl 0x1001941c
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019414
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [ebp - 0x18], esi
dec dword [ebp - 0x34]
jns 0x10019400
dec dword [ebp - 0x1c]
jns 0x100193cf
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001944c
push 0x20af
push ebx
push ebx
push 0x26a3
push 0xa2b
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x100194bd
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0xcc]
cmp dword [eax + ecx*4], ebx
je 0x10019495
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
neg ecx
sbb ecx, ecx
neg ecx
cmp ecx, dword [eax]
jge 0x1001948c
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], 0xc65
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
add edx, 0x32adaa23
mov dword [ebp - 0x38], edx
dec dword [ebp - 0x18]
jns 0x10019458
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 2
jle 0x100193b5
mov dword [ebp - 0x44], esi
lea ecx, [ebp - 0xcc]
call fcn.10017696
mov dword [ebp - 0x38], 0x3b6f9b69
cmp dword [ebp - 0x30], ebx
je 0x10019504
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, 0xfffffffa
setle cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x28]
jne 0x100194fd
mov eax, dword [ebp - 0x2c]
mov eax, esi
cmp dword [ebp - 0x28], ebx
je 0x10019506
mov eax, ebx
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100195b4
mov dword [ebp - 0x20], 0xfdf99ff6
mov dword [ebp - 0x30], 0x5bf25cbd
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x30], 0xe673292c
mov dword [ebp - 0x18], ebx
jmp 0x10019548
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x198], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10019537
mov dword [ebp - 0x20], ebx
jmp 0x1001959f
mov dword [ebp - 0x30], 0x6444
lea ecx, [ebp - 0x15c]
mov dword [ebp - 0x30], 0xeb7161ab
push esi
call fcn.10016dd3
mov dword [ebp - 0x24], 0xd91e66c6
mov dword [ebp - 0x18], ebx
jmp 0x10019589
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x15c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10019579
inc dword [ebp - 0x24]
lea ecx, [ebp - 0x15c]
call fcn.10017696
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffc
jne 0x10019553
push 0x12e6
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 3
lea ecx, [ebp - 0x114]
call fcn.10016dd3
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], 0x22e974a5
mov dword [ebp - 0x30], 0xfffffffb
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x28], 0xab46
mov dword [ebp - 0x38], 0xfc37f20b
mov dword [ebp - 0x1c], ebx
jmp 0x1001960d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0xc204
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100195fa
mov dword [ebp - 0x1c], ebx
jmp 0x10019626
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10019618
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x1001967a
mov dword [ebp - 0x18], 0xfffffffb
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019657
push 0x1455
push 0x18d2
call dword [sym.imp.USER32.dll_SetCaretPos]
mov dword [ebp - 0x18], ebx
jmp 0x1001966f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001966c
push ebx
call dword [sym.imp.USER32.dll_SetKeyboardState]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1001965c
dec dword [ebp - 0x20]
jns 0x10019637
cmp dword [ebp - 0x20], 0xdb5a
jne 0x10019699
cmp dword [ebp - 0x7c], 0xffffffff
mov ecx, esi
sbb eax, eax
inc eax
cmp eax, 0xcc33bab7
sbb eax, eax
neg eax
cmp eax, esi
jbe 0x1001969b
mov ecx, ebx
inc dword [ebp - 0x28]
xor eax, eax
cmp ecx, 0xfffffffa
sete al
xor ecx, ecx
imul eax, dword [ebp - 0x28]
sub eax, 0xb221
imul eax, eax, 0x9f36
cmp eax, 0xfb38
setge cl
cmp ecx, dword [ebp - 0x30]
jge 0x100196cb
mov edx, ebx
cmp dword [ebp - 0x28], ebx
je 0x100196cd
mov edx, esi
mov eax, dword [ebp - 0x114]
xor ecx, ecx
cmp edx, dword [eax]
setge cl
imul eax, ecx, 0x700d
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x38], eax
call fcn.10017696
mov dword [ebp - 0x18], ebx
jmp 0x10019701
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], 0xfc558bac
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100196f3
mov edx, esi
cmp dword [ebp - 0x48], ebx
jne 0x1001970f
mov edx, ebx
mov eax, dword [ebp - 0x48]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
setg cl
xor eax, eax
cmp edx, ecx
setge al
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001973f
push ebx
push 0x185c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov dword [ebp - 0x30], 0xbeaa
lea ecx, [ebp - 0x12c]
push esi
call fcn.10016dd3
mov dword [ebp - 0x38], 0xf69f
mov dword [ebp - 0x18], ebx
jmp 0x10019771
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], 0xb457102d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001975e
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x12c]
mov dword [eax], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019790
call dword [sym.imp.KERNEL32.dll_GetVersion]
lea ecx, [ebp - 0x12c]
call fcn.10017696
mov dword [ebp - 0x10], 5
mov eax, 0x822c
push 0xfffffffffffffffa
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
pop edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0x20], 0xb
jmp 0x10019805
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x30], 0x693e932
mov dword [ebp - 0x30], 0xfffffff8
mov dword [ebp - 0x30], 0xa98815cb
mov dword [ebp - 0x18], ebx
jmp 0x100197fc
inc dword [ebp - 0xd0]
jne 0x10019802
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jge 0x100197f1
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100197d4
mov dword [ebp - 0x34], edx
lea ecx, [ebp - 0xfc]
push 2
call fcn.10016dd3
push 2
lea ecx, [ebp - 0x168]
mov dword [ebp - 4], esi
call fcn.10016dd3
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10019845
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x168]
mov dword [eax + ecx*4], 0x55bb2c21
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10019832
mov dword [ebp - 0x20], ebx
jmp 0x100198ba
mov dword [ebp - 0x18], 0x5260417b
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x100198b4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], ebx
jmp 0x1001987d
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001987a
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10019867
mov dword [ebp - 0x1c], ebx
jmp 0x100198aa
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100198a7
push ebx
push 0x2606
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10019887
dec dword [ebp - 0x18]
jns 0x1001985f
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x10019850
lea ecx, [ebp - 0x168]
call fcn.10017696
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x30], 0xfffffffc
mov dword [ebp - 0x18], ebx
jmp 0x100198ee
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x98], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100198dd
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019910
push ebx
push ebx
push 0x1404
push 0xf59
push ebx
call dword [sym.imp.USER32.dll_InsertMenuW]
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10019a50
mov dword [ebp - 0x20], 7
lea ecx, [ebp - 0xf0]
push 2
call fcn.10016dd3
push 2
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x1001994f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x1001993c
mov dword [ebp - 0x20], ebx
jmp 0x10019a33
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x1c], 0x34cb4417
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x100199ff
mov esi, dword [ebp - 0xf0]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x98]
dec dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x18]
imul ecx, eax, 0x38d9
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov dword [esi + 4], ecx
mov eax, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x20]
setl bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor eax, eax
cmp ecx, 0x2c512dc6
setle al
xor ebx, ebx
add eax, dword [ebp - 0x18]
je 0x100199e6
cmp dword [ebp - 0x20], ebx
je 0x100199e6
xor ecx, ecx
inc ecx
jmp 0x100199e8
mov ecx, ebx
mov eax, dword [ebp - 0x10]
neg ecx
mov dword [ebp + eax*4 - 0x98], ecx
dec dword [ebp - 0x10]
jns 0x10019983
xor esi, esi
push 2
inc esi
pop edx
mov dword [ebp - 0x1c], ebx
jmp 0x10019a2b
cmp dword [ebp - 0x18], esi
je 0x10019a0c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x90], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x10019a04
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x1001995c
lea ecx, [ebp - 0xf0]
call fcn.10017696
dec dword [ebp - 0x18]
jns 0x10019920
mov dword [ebp - 0x10], ebx
jmp 0x10019a5f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x64], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10019a55
mov dword [ebp - 0x10], ebx
jmp 0x10019a79
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10019a6a
mov dword [ebp - 0x18], 0x4ec2e0cf
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019ab0
push 0x23d0
push ebx
push 0x21f8
push 0x6ae
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov dword [ebp - 0x18], ebx
jmp 0x10019ac7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019ac4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x19
jg 0x10019ab5
mov dword [ebp - 0x10], ebx
jmp 0x10019ae3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xa0], 0x9f4aec70
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10019ad2
push 2
pop edi
push edi
lea ecx, [ebp - 0x78]
call fcn.10016dd3
mov dword [ebp - 0x10], ebx
jmp 0x10019b06
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc0], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10019af9
mov dword [ebp - 0x10], ebx
jmp 0x10019b21
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], 0xde19d29b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10019b11
mov dword [ebp - 0x10], ebx
jmp 0x10019b3c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x180], 0xb5d1cb6a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10019b2b
mov eax, dword [ebp - 0x78]
mov dword [eax], ebx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x10019b78
mov dword [ebp - 0x18], 0xa07e4fc2
mov dword [ebp - 0x18], ebx
jmp 0x10019b70
mov eax, dword [ebp - 0x78]
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0xc0], ebx
jne 0x10019b75
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10019b5f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x10019b53
mov eax, dword [ebp - 0x78]
inc dword [eax]
cmp dword [eax], edi
jle 0x10019b47
mov eax, dword [ebp - 0xc0]
xor ecx, ecx
mov eax, dword [ebp - 0xc0]
mov edx, dword [ebp - 0x78]
mov eax, dword [ebp - 0xbc]
cmp dword [edx + 4], ebx
setl cl
sub ecx, eax
mov dword [edx + 4], ecx
mov dword [ebp - 0x178], ecx
lea ecx, [ebp - 0x78]
call fcn.10017696
mov dword [ebp - 0x10], ebx
jmp 0x10019bd6
push ebx
push 0x46d3
push 0x6158
push 0x75c0
call fcn.1001cf42
add esp, 0x10
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10019bbb
mov dword [ebp - 0x18], 0xffffffff
lea ecx, [ebp - 0x108]
push edi
call fcn.10016dd3
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x28], 0xbbd4856c
mov dword [ebp - 0x30], 0xb51f0ef2
mov dword [ebp - 0x1c], ebx
jmp 0x10019c1c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0x43836745
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10019c09
mov dword [ebp - 0x1c], ebx
jmp 0x10019c34
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6c], 0xaf7b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10019c26
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0xb5411457
mov edx, dword [ebp - 0x108]
setne cl
mov dword [edx + 4], ecx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], esi
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, esi
setl cl
cmp ecx, dword [ebp - 0x18]
je 0x10019c6e
cmp dword [edx + 4], ebx
mov edx, esi
jne 0x10019c70
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x108]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
add eax, dword [ebp - 0x6c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
call fcn.10017696
cmp dword [ebp - 0x10], ebx
je 0x10019cd7
mov dword [ebp - 0x10], 0xd0c1
cmp dword [ebp - 0x10], ebx
jne 0x10019cd1
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jne 0x10019cc8
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x58]
mov ecx, 0x2afa4368
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
sub ecx, eax
sub ecx, dword [ebp - 0x60]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xffffffff
setne al
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
test ecx, ecx
jne 0x10019d1b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x64]
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0xa0], ebx
or dword [ebp - 4], 0xffffffff
call fcn.10017696
mov dword [ebp - 0x10], esi
xor edx, edx
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov ecx, dword [ebp - 0x18]
setl dl
xor eax, eax
cmp edx, 0x8029
setg al
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
sub ecx, 0xe4e91208
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0xf09a2b44
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x10]
jl 0x10019da4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10019dd6
mov dword [ebp - 0x18], ebx
jmp 0x10019dd0