Function at 0x10018c51
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov eax, 0x1007f9ee
call fcn.1007f148
sub esp, 0x1b8
mov dword [ebp - 0x14], 0xfffffffd
mov eax, 0xc8748afa
mov dword [ebp - 0x18], 0xb8c3ad3b
mov dword [ebp - 0xa0], eax
push ebx
mov dword [ebp - 0x9c], eax
xor ebx, ebx
mov dword [ebp - 0x98], eax
push esi
mov dword [ebp - 0x94], eax
push edi
mov dword [ebp - 0x90], edx
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10018cb0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c4], 0xdc85
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10018c9f
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x14], ebx
jmp 0x10018d79
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x180]
mov dword [ebp - 0x18], 0xb5c6eff3
mov dword [ebp - 0x18], 0xe780ca9f
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xde9e8436
mov dword [ebp - 0x18], 3
mov dword [ebp - 0x18], 0xf6285890
call fcn.10016c36
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x18], 0x9c279a20
push 2
mov dword [ebp - 0x18], 0x1d45
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x10018d2a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x180]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10018d1b
xor ecx, ecx
mov dword [ebp - 0x20], ebx
inc ecx
jmp 0x10018d44
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10018d37
inc dword [ebp - 0x18]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018d6b
push ebx
push 0x2016
push 0xad7
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
lea ecx, [ebp - 0x180]
call fcn.10017508
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
push 0xffffffffffffffff
pop eax
push 2
jle 0x10018cca
lea ecx, [ebp - 0x110]
call fcn.10016c36
mov dword [ebp - 0x2c], 0x7730f94f
mov dword [ebp - 0x14], ebx
jmp 0x10018daf
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x110]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10018d9f
mov dword [ebp - 0x2c], ebx
jmp 0x10018dd3
mov dword [ebp - 0x18], 0xfffffff9
mov edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x110]
mov dword [eax + edx*4], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 1
jle 0x10018dba
lea ecx, [ebp - 0x110]
call fcn.10017508
xor ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x20], 0xe60f951
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], 0x43cc9f19
mov dword [ebp - 0x38], 2
mov dword [ebp - 0x30], 0xb7c39c9d
mov dword [ebp - 0x1c], 0x6920
mov dword [ebp - 0x24], ebx
jmp 0x10018e31
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x44], 0x302aff63
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10018e23
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xe80031aa
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x44], eax
mov edx, dword [ebp - 0x20]
imul edx, eax
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
xor edx, edx
imul ecx, ecx, 0x7d26
cmp ecx, eax
setle dl
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x38]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x30]
jg 0x10018e82
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1c], 0xfffd
cmp dword [ebp - 0x1c], ebx
je 0x10018e98
cmp dword [ebp - 0x38], ebx
je 0x10018e98
xor edx, edx
inc edx
jmp 0x10018e9a
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
imul ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
setg cl
add ecx, dword [ebp - 0x20]
je 0x10018ec4
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], 3
xor ecx, ecx
mov dword [ebp - 0x34], 0x97151158
inc ecx
mov dword [ebp - 0x18], 0x94784533
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x18], 0x4a48c552
mov dword [ebp - 0x30], 0xf
cmp dword [ebp - 0x30], ebx
je 0x10018f32
mov dword [ebp - 0x1c], ebx
jmp 0x10018f24
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018f12
push 0x130d
push 0xdde
call esi
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10018f21
push ebx
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 9
je 0x10018ef7
dec dword [ebp - 0x30]
jne 0x10018ef2
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x28], ebx
je 0x10018f92
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x34], 0xf3aa798d
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], 0xa5dbdfdd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], eax
jmp 0x10018fee
mov dword [ebp - 0x30], 0xfffffffd
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x34], ebx
je 0x10018fab
mov esi, ecx
cmp dword [ebp - 0x18], ebx
jne 0x10018fad
mov esi, ebx
mov ecx, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp eax, ecx
setle dl
cmp edx, 0xc99cc0f7
ja 0x10018fc5
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp - 0x20]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
neg ecx
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x24], eax
push 4
call fcn.10016c36
push 2
lea ecx, [ebp - 0xb4]
mov dword [ebp - 4], ebx
call fcn.10016c36
or eax, 0xffffffff
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], ebx
jmp 0x1001902f
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x1001901c
mov dword [ebp - 0x30], ebx
jmp 0x1001908d
mov dword [ebp - 0x28], 0xa4d073ff
xor edx, edx
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xb4]
cmp dword [eax + ecx*4], 0xffffffff
setge dl
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x28], ebx
jmp 0x10019084
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x18], 0x704f3d4e
mov edx, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], edx
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jle 0x1001905b
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 1
jle 0x1001903a
lea ecx, [ebp - 0xb4]
call fcn.10017508
mov dword [ebp - 0x28], 0x5b9b55bb
mov dword [ebp - 0x24], ebx
jmp 0x100190b8
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x40], 0x689351f2
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jl 0x100190aa
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 0xa
jne 0x100192e7
or edi, 0xffffffff
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x18], 0xfffffffa
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x100190f4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x100192d4
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x24], ebx
jmp 0x10019116
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x58], edi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x1001910c
mov dword [ebp - 0x58], ebx
jmp 0x100192c2
push 1
lea ecx, [ebp - 0x7c]
call fcn.10016c36
xor edx, edx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x24], ebx
inc edx
jmp 0x10019149
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0x492a4153
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10019139
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x40], ebx
jne 0x100191b6
mov eax, dword [ebp - 0x58]
mov ecx, edx
mov dword [ebp - 0x1c], eax
xor edx, edx
mov eax, dword [ebp - 0x40]
sub ecx, eax
mov eax, dword [ebp - 0x50]
cmp ecx, eax
setl dl
cmp edx, dword [ebp - 0x20]
jle 0x1001917c
cmp dword [ebp - 0x20], ebx
jne 0x1001917c
mov edx, ebx
jmp 0x1001917f
xor edx, edx
inc edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x40]
lea eax, [edx - 0x26b17019]
xor edx, edx
cmp ecx, eax
setge dl
imul eax, edx, 0x5d17
test eax, eax
jne 0x100191a0
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x40]
cmp dword [ebp - 0x28], ebx
je 0x1001924d
xor edx, edx
inc edx
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x40], ebx
je 0x1001924d
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x38], ebx
cmp dword [eax], ebx
jne 0x100191e8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x7c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov ecx, ebx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xc588
jne 0x100191ea
mov ecx, edx
inc dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor eax, eax
cmp ecx, 9
setge al
xor edx, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setle dl
cmp edx, dword [ebp - 0x38]
je 0x1001922c
cmp dword [ebp - 0x38], ebx
je 0x1001922c
xor eax, eax
inc eax
jmp 0x1001922e
mov eax, ebx
xor ecx, ecx
test eax, eax
setg cl
xor eax, eax
cmp ecx, 0x94be
setne al
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
jmp 0x100192b7
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jg 0x10019281
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], ebx
jmp 0x10019271
mov dword [ebp - 0x38], 0xc9e433c5
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x10019267
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1001925f
or edi, 0xffffffff
mov eax, dword [ebp - 0x54]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp eax, 0x62a08d8d
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
imul ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x40], ecx
lea ecx, [ebp - 0x7c]
call fcn.10017508
inc dword [ebp - 0x58]
cmp dword [ebp - 0x58], ebx
jle 0x10019124
dec dword [ebp - 0x20]
jns 0x10019100
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xa
je 0x100190ce
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x24], ebx
jmp 0x10019304
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x198], 0x5464b5f5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100192f3
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001931e
push ebx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x24], ebx
jmp 0x1001933c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019339
push 0x2345
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jle 0x10019323
mov dword [ebp - 0x1c], ebx
jmp 0x1001935a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x10019347
mov dword [ebp - 0x1c], ebx
jmp 0x10019376
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1b4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10019365
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019399
push 0x2415
push 0x11e9
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov eax, dword [ebp - 0x14]
mov ecx, 0xa0d018d3
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
sub eax, 0x3572
cmp ecx, eax
mov eax, dword [ebp - 0x14]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x84e5
setne al
lea ecx, [eax + 0xb81e]
mov eax, dword [ebp - 0x128]
mov dword [eax + 8], ecx
test ecx, ecx
jne 0x100194c8
cmp dword [ebp - 0x2c], ebx
jne 0x100194c8
push dword [ebp - 0xa4]
movdqa xmm0, xmmword [0x10007e40]
lea eax, [ebp - 0x180]
push eax
lea eax, [ebp - 0x190]
mov dword [ebp - 0xc0], ebx
push eax
push ebx
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xbc], ebx
movdqu xmmword [ebp - 0x190], xmm0
mov dword [ebp - 0xb8], ebx
call fcn.1001838b
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], 0x73e70d28
mov dword [ebp - 0x2c], ebx
jmp 0x100194b5
push 3
lea ecx, [ebp - 0x174]
call fcn.10016c36
mov dword [ebp - 0x34], 0xe072305a
mov eax, 0x43657218
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x14], ebx
jmp 0x1001949e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x174]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001948b
dec dword [ebp - 0x18]
lea ecx, [ebp - 0x174]
call fcn.10017508
dec dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xfffffffc
jl 0x10019455
lea ecx, [ebp - 0xc0]
call fcn.10017508
jmp 0x100194e4
mov dword [ebp - 0x14], ebx
jmp 0x100194db
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0x6992f1e5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100194cd
inc dword [ebp - 0x5c]
or eax, 0xffffffff
lea ecx, [ebp - 0x128]
mov dword [ebp - 4], eax
call fcn.10017508
mov dword [ebp - 0x20], 0x60477862
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x14], 0xfbfc75da
push 1
call fcn.10016c36
mov dword [ebp - 4], 2
mov dword [ebp - 0x24], ebx
jmp 0x1001952c
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x140]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 1
jl 0x1001951c
mov dword [ebp - 0x20], ebx
jmp 0x100195fd
push 1
lea ecx, [ebp - 0x8c]
call fcn.10016c36
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x34], 0xdbf4df7b
mov dword [ebp - 0x14], ebx
jmp 0x1001956d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001955a
mov eax, dword [ebp - 0x8c]
cmp dword [eax], ebx
jne 0x1001958c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
jne 0x1001958c
mov ecx, ebx
jmp 0x1001958f
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x8c]
mov edx, dword [eax]
lea eax, [ecx + 0x410320ef]
xor ecx, ecx
cmp eax, 0xc1df
setle cl
xor eax, eax
imul ecx, edx
imul ecx, edx
cmp ecx, edx
setne al
sub eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
neg eax
jne 0x100195c9
cmp dword [ebp - 0x34], ebx
jne 0x100195c9
mov edx, ebx
jmp 0x100195cc
xor edx, edx
inc edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [ebp - 0x20], ecx
je 0x100195ea
mov eax, dword [ebp - 0x8c]
cmp dword [eax], ebx
je 0x100195ea
xor eax, eax
inc eax
jmp 0x100195ec
mov eax, ebx
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x8c]
call fcn.10017508
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe3
jl 0x1001953a
cmp dword [ebp - 0x14], ebx
jne 0x1001962b
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setle dl
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jg 0x1001962b
mov edx, ebx
jmp 0x1001962e
xor edx, edx
inc edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x140]
setle cl
mov dword [eax], ecx
or eax, 0xffffffff
lea ecx, [ebp - 0x140]
mov dword [ebp - 4], eax
call fcn.10017508
push 5
pop eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x18], 0x9ff60657
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001967b
push ebx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001969f
push ebx
push 0x2200
push 0xca4
push 0x1643
push 0x1372
call dword [sym.imp.GDI32.dll_CreateBitmap]
mov dword [ebp - 0x38], 0x495e3b37
lea ecx, [ebp - 0x104]
push 1
call fcn.10016c36
xor edx, edx
mov dword [ebp - 0x18], 0xf5ac3d6c
inc edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ebx
jmp 0x100196d3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4c], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100196c5
mov dword [ebp - 0x1c], ebx
jmp 0x100196ed
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100196de
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x104]
mov dword [eax], ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], edx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001972b
push ebx
push 0x470
push ebx
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
lea ecx, [ebp - 0x104]
call fcn.10017508
push 1
lea ecx, [ebp - 0x14c]
call fcn.10016c36
mov dword [ebp - 4], 3
or eax, 0xffffffff
mov dword [ebp - 0x2c], 0x24ec2e0c
mov dword [ebp - 0x2c], eax
jmp 0x10019772
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001976f
push ebx
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xd
je 0x10019759
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x168]
mov dword [ebp - 0x2c], eax
xor eax, eax
inc eax
mov dword [ebp - 0x18], 0x8cc19583
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], eax
push 3
call fcn.10016c36
mov byte [ebp - 4], 4
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], 0xa6ca0cec
mov dword [ebp - 0x14], ebx
jmp 0x100197be
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x168]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100197ae
mov esi, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 2
mov dword [ebp - 0x24], ebx
pop edi
cmp dword [ebp - 0x24], 0x19
jg 0x10019874
mov dword [ebp - 0x18], 0x1510afbd
lea ecx, [ebp - 0xf8]
push edi
call fcn.10016c36
mov dword [ebp - 0x3c], 0x58c458a9
mov dword [ebp - 0x14], ebx
jmp 0x1001980c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0xeb8e136d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100197f9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019820
push ebx
push ebx
push ebx
push ebx
call esi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 1
mov eax, dword [ebp - 0x34]
setle cl
add ecx, eax
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
xor eax, eax
cmp ecx, 0xa907
sete al
xor ecx, ecx
cmp eax, 3
setle cl
xor edx, edx
cmp ecx, 0xfffffffb
lea ecx, [ebp - 0xf8]
setle dl
xor eax, eax
cmp edx, 0xf1bf
setne al
mov dword [ebp - 0x18], eax
call fcn.10017508
inc dword [ebp - 0x24]
jmp 0x100197d0
lea ecx, [ebp - 0x168]
mov byte [ebp - 4], 3
call fcn.10017508
mov dword [ebp - 0x14], ebx
jmp 0x1001989b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0x3413f087
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10019888
mov dword [ebp - 0x64], 0x4ec2e0cf
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x28], 0x2c7c8a6b
mov dword [ebp - 0x18], 0x457d6700
push edi
call fcn.10016c36
mov dword [ebp - 0x1c], ebx
jmp 0x100198d5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x60], 0x17c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x100198c7
mov dword [ebp - 0x1c], ebx
jmp 0x100198f3
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 0x6b79df94
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x100198e0
cmp dword [ebp - 0x28], ebx
je 0x1001991f
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setge dl
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x807cfaf4
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x28]
je 0x1001991f
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x60], ebx
je 0x10019927
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x134]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x134]
mov dword [eax], 0xfffffffe
call fcn.10017508
cmp dword [ebp - 0x68], ebx
je 0x10019b84
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xfffffffb
jmp 0x10019a10
mov dword [ebp - 0x2c], 4
lea ecx, [ebp - 0xec]
push edi
call fcn.10016c36
mov dword [ebp - 0x18], 0xdf0ebf90
mov dword [ebp - 0x14], ebx
jmp 0x10019991
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001997e
mov dword [ebp - 0x2c], 4
cmp dword [ebp - 0x2c], 0xa
jl 0x10019a02
mov esi, dword [ebp - 0xec]
mov dword [ebp - 0x18], 6
mov ecx, 0xcee34edf
mov eax, dword [ebp - 0x18]
add eax, 0x5158018d
mov dword [esi + 4], 0xb3f36565
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x2c]
sub edx, 0xb68d
neg edx
sbb edx, edx
inc edx
cmp edx, 0xfffffff9
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xb3f36565
setl cl
imul ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0xa
jge 0x100199a9
lea ecx, [ebp - 0xec]
call fcn.10017508
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xfffffff0
jl 0x1001995f
mov dword [ebp - 0x24], 0xc099
or eax, 0xffffffff
mov dword [ebp - 0x3c], 0x4872
mov dword [ebp - 0x1c], 0x90ac204e
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x14], 0x719d8726
mov dword [ebp - 0x14], 0xae7b1b0c
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], ebx
jmp 0x10019a58
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a8], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10019a4b
mov dword [ebp - 0x1c], 0xffffffe3
jmp 0x10019a7a
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019a77
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
jne 0x10019a67
mov dword [ebp - 0x1c], 0xfffffff3
jmp 0x10019ae3
mov dword [ebp - 0x18], 0xfff7
cmp dword [ebp - 0x18], ebx
jne 0x10019acd
mov eax, dword [ebp - 0x34]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub ecx, 0x77baea03
cmp ecx, eax
setle dl
sub edx, 0x6b93
mov dword [ebp - 0x18], edx
jne 0x10019acd
mov ecx, ebx
jmp 0x10019ad0
xor ecx, ecx
inc ecx
mov eax, 0x9aa69ac2
sub eax, ecx
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x1a4], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jge 0x10019a89
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x64], ebx
jne 0x10019b59
mov eax, dword [ebp - 0x38]
sub eax, 0x2b82
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
je 0x10019b11
cmp dword [ebp - 0x64], ebx
je 0x10019b11
xor edx, edx
inc edx
jmp 0x10019b13
mov edx, ebx
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
sub ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x14c]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x3c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x38]
je 0x10019b49
cmp dword [ebp - 0x3c], ebx
je 0x10019b49
xor ecx, ecx
inc ecx
jmp 0x10019b4b
mov ecx, ebx
mov eax, dword [ebp - 0x64]
imul eax, ecx
test eax, eax
jne 0x10019b59
mov edx, ebx
jmp 0x10019b5c
xor edx, edx
inc edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x64]
setne cl
imul ecx, eax
mov eax, dword [ebp - 0x24]
imul eax, ecx
sub eax, 0x7eb23672
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
jmp 0x10019c3f
mov dword [ebp - 0x20], 0xc5534bf8
lea ecx, [ebp - 0x11c]
mov dword [ebp - 0x18], 0x7e7c14ab
push 4
call fcn.10016c36
mov dword [ebp - 0x14], ebx
jmp 0x10019bb7
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 0x4c821046
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10019ba4
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019bcc
push ebx
push ebx
push ebx
push ebx
call esi
mov eax, dword [ebp - 0x20]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x11c]
setge cl
mov dword [eax], ecx
lea ecx, [ebp - 0x11c]
call fcn.10017508
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], 0x1bd77dfc
push eax
push ebx
push 0x3f68
call fcn.1001caee
add esp, 0xc
or eax, 0xffffffff
lea ecx, [ebp - 0x14c]
mov dword [ebp - 4], eax
call fcn.10017508
mov edi, dword [sym.imp.USER32.dll_ValidateRect]
mov dword [ebp - 0x18], 1
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019c70
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_InsertMenuA]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019c8e
push ebx
push ebx
push 0x151b
push 0xeed
push ebx
call esi
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x20], 0x17473468
mov dword [ebp - 0x14], ebx
jmp 0x10019cb2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd0], 0xffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10019ca1
cmp dword [ebp - 0x1c], ebx
jne 0x10019cc3
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0xc4]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
or eax, 0xffffffff
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
je 0x10019cfd
mov dword [ebp - 0x18], 0x1a652065
mov dword [ebp - 0x18], eax
jmp 0x10019deb
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
push 6
pop eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x20], ebx
jne 0x10019d80
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0x20], 0xfffffffa
mov eax, dword [ebp - 0xc4]
add eax, dword [ebp - 0x20]
jne 0x10019d62
cmp dword [ebp - 0x20], ebx
jne 0x10019d62
mov eax, ebx
jmp 0x10019d65
xor eax, eax
inc eax
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0xc4]
imul eax, dword [ebp - 0x18], 0x688d
test eax, eax
jne 0x10019d80
mov ecx, ebx
jmp 0x10019d83
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
imul eax, ecx
cmp eax, 0xad47
jne 0x10019de2
mov dword [ebp - 0x20], 0x15
jmp 0x10019dc6
mov dword [ebp - 0x1c], ebx
jmp 0x10019dbd
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019dba
push ebx
push 0x2299
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10019d9e
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 9
jge 0x10019d99
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019deb
push 0xfa4
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x10019deb
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 1
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019e05
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10019e1d
push ebx
push ebx
push 0x151b
push 0xeed
push ebx
call esi
mov eax, dword [ebp - 0x90]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0x80]
mov edi, edx
mov esi, eax
call fcn.10018bdf
mov ecx, dword [ebp - 0xc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret