Function at 0x10018b71
Capabilities:
Extract resource via kernel32 functions
Modify service

Disassembly:
mov eax, 0x1007e24e
call fcn.1007dae0
sub esp, 0x1f8
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0x7bf48c44
push 3
mov dword [ebp - 0x1c], 0xd7cbae8b
pop esi
mov dword [ebp - 0xc8], ecx
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x1c], 0x2c02a306
mov dword [ebp - 0x28], 0x3063
mov dword [ebp - 0x14], 0xfffffff8
push esi
mov dword [ebp - 0xcc], edx
call fcn.10016cb0
mov dword [ebp - 0x24], 0xeb81
xor ebx, ebx
push 1
mov dword [ebp - 0x1c], 0xd786ff52
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x10018be9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10018bda
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10], 0x1c23
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x10018c15
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
or ecx, 0xffffffff
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x104]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x24]
add eax, ecx
jne 0x10018c3c
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x104]
mov eax, dword [ebp - 0x104]
mov eax, dword [eax + 8]
dec eax
mov dword [ebp - 0x1c], eax
call fcn.10017570
mov dword [ebp - 0x28], 0xfb0b0297
mov dword [ebp - 0x1c], 0xf4caa5d7
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x14], ebx
jmp 0x10018c89
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d4], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10018c78
push 2
pop esi
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], ebx
jl 0x10018d56
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x24], 0x8f492357
mov dword [ebp - 0x10], esi
cmp dword [ebp - 0x10], ebx
jl 0x10018d4d
xor ecx, ecx
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
setge dl
mov dword [ebp - 0x24], edx
xor edx, edx
cmp ecx, eax
setl dl
xor eax, eax
cmp edx, dword [ebp - 0x24]
setge al
cmp eax, dword [ebp - 0x10]
je 0x10018cfd
mov edx, edi
cmp dword [ebp - 0x20], ebx
jne 0x10018cff
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1d0]
mov edx, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x10]
jns 0x10018cb3
dec dword [ebp - 0x28]
jns 0x10018c9d
dec dword [ebp - 0x2c]
lea ecx, [ebp - 0x184]
mov dword [ebp - 0x1c], 0xb7c7ce53
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x28], 0xc5534bf8
push esi
call fcn.10016cb0
mov dword [ebp - 0x14], ebx
jmp 0x10018d92
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x184]
mov dword [eax + ecx*4], 0x6f7fbf21
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10018d7f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp esi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], edi
cmp dword [ebp - 0x20], ebx
jl 0x10018de9
mov dword [ebp - 0x24], 0x32cf415d
mov dword [ebp - 0x1c], 0xed6b6572
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x10018de4
mov dword [ebp - 0x24], 0x3bd
cmp dword [ebp - 0x28], ebx
jne 0x10018de4
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x28]
jns 0x10018dd0
dec dword [ebp - 0x20]
jns 0x10018db4
lea ecx, [ebp - 0x184]
call fcn.10017570
mov dword [ebp - 0x30], 0x53606de7
mov dword [ebp - 0x10], ebx
jmp 0x10018e11
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc4], 0x55bb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018e00
mov dword [ebp - 0x10], ebx
jmp 0x10018e2c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc], 0xfe223643
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10018e1b
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0xdc], ebx
jmp 0x10018e6e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 0xd672a835
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], al
je 0x10018e68
push ebx
push ebx
push 0x1dd1
call esi
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
inc dword [ebp - 0xdc]
cmp dword [ebp - 0xdc], ebx
jle 0x10018e40
push edi
lea ecx, [ebp - 0x150]
call fcn.10016cb0
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xa4]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1c], 0xfffffffd
push 2
call fcn.10016cb0
push 0xfffffffffffffffd
pop edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x10], ebx
jmp 0x10018eb5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10018eab
mov dword [ebp - 0x10], ebx
jmp 0x10018ecf
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10018ec0
mov dword [ebp - 0x10], ebx
jmp 0x10018eeb
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc0], 0xba16
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10018eda
mov dword [ebp - 0x10], ebx
jmp 0x10018f06
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x178], 0x461d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10018ef5
mov dword [ebp - 0x10], edi
mov edi, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
cmp dword [ebp - 0x10], ebx
jl 0x10018fa4
mov dword [ebp - 0x24], 8
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10018f31
push ebx
call edi
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0xa4]
setle dl
xor ecx, ecx
cmp edx, 0x7563ffaf
setge cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0xc0]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setl cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x48]
neg eax
cmp eax, 0x693009c
mov eax, dword [ebp - 0x10]
setg cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp + eax*4 - 0x48]
imul eax, ecx, 0x38ab
inc eax
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x10]
jns 0x10018f1e
mov dword [ebp - 0x10], ebx
jmp 0x1001909a
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x14], ebx
jmp 0x10018fc9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x118], 0x5659
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10018fb8
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0xa4]
setle dl
imul ecx, edx, 0xe71c
xor edx, edx
add ecx, dword [eax]
mov eax, dword [ebp - 0x118]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x48]
test eax, eax
sete cl
add ecx, edx
imul eax, ecx, 0xa6d7
xor ecx, ecx
cmp eax, 2
setg cl
imul eax, ecx, 0x3e99
xor ecx, ecx
cmp eax, 0x5291260e
setl cl
imul ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x118]
je 0x1001905a
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
jmp 0x10019091
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10019087
push 0xaad
push 0x1662
push 0xd8d
push 0x89c
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov eax, dword [ebp - 0xa4]
cmp dword [eax], ebx
jne 0x100190a6
dec dword [ebp - 0x174]
inc dword [ebp - 0x10]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jle 0x10018fac
lea ecx, [ebp - 0xa4]
call fcn.10017570
mov dword [ebp - 0x24], 0x6fc33146
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1c], 0xfffffffd
push 2
call fcn.10016cb0
xor edx, edx
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x10], ebx
inc edx
cmp dword [ebp - 0x10], 2
jge 0x100190f2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], edx
inc dword [ebp - 0x10]
jmp 0x100190e0
mov dword [ebp - 0x10], ebx
jmp 0x1001910a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x100190f7
mov dword [ebp - 0x10], ebx
jmp 0x10019126
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xe0], 0xba16
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10019115
mov dword [ebp - 0x10], ebx
jmp 0x10019141
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1a0], 0x461d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10019130
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x100191dc
mov dword [ebp - 0x24], 8
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10019166
push ebx
call edi
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x98]
setle dl
xor ecx, ecx
cmp edx, 0x7563ffaf
setge cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0xe0]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setl cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x50]
neg eax
cmp eax, 0x693009c
mov eax, dword [ebp - 0x10]
setg cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp + eax*4 - 0x50]
imul eax, ecx, 0x38ab
inc eax
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x10]
jns 0x10019153
xor edx, edx
inc edx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edx
jg 0x100192e2
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x14], ebx
jmp 0x10019205
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x138], 0x5659
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100191f4
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x50]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x98]
setle dl
imul ecx, edx, 0xe71c
xor edx, edx
add ecx, dword [eax]
mov eax, dword [ebp - 0x138]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x50]
test eax, eax
sete cl
add ecx, edx
imul eax, ecx, 0xa6d7
xor ecx, ecx
cmp eax, 2
setg cl
imul eax, ecx, 0x3e99
xor ecx, ecx
cmp eax, 0x5291260e
setl cl
imul ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x138]
je 0x10019296
mov eax, dword [ebp - 0x98]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
jmp 0x100192cd
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100192c3
push 0xaad
push 0x1662
push 0xd8d
push 0x89c
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov eax, dword [ebp - 0x98]
cmp dword [eax], ebx
jne 0x100192e2
dec dword [ebp - 0x19c]
xor eax, eax
inc dword [ebp - 0x10]
inc eax
cmp dword [ebp - 0x10], eax
jle 0x100191e8
lea ecx, [ebp - 0x98]
call fcn.10017570
push 3
pop ecx
mov dword [ebp - 0x20], ecx
mov eax, 0xeea2a3b3
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
push ecx
mov dword [ebp - 0x11c], eax
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x1c], 0xa7ef5d87
call fcn.10016cb0
mov dword [ebp - 0x24], ebx
xor edx, edx
mov dword [ebp - 0x14], 0xfeae
inc edx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 4
jge 0x10019348
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1e4], edx
inc dword [ebp - 0x10]
jmp 0x10019333
mov dword [ebp - 0x10], ebx
jmp 0x1001935c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001934d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x11c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1d8]
mov eax, dword [ebp - 0x144]
cmp dword [eax + 4], ebx
je 0x1001939d
cmp dword [eax], ebx
mov eax, edx
jne 0x1001939f
mov eax, ebx
mov dword [ebp - 0x24], eax
lea ecx, [ebp - 0x144]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x11c], eax
call fcn.10017570
push 3
lea ecx, [ebp - 0xec]
call fcn.10016cb0
mov dword [ebp - 0x14], 0xf251d69f
mov dword [ebp - 0x14], ebx
jmp 0x100193e2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xc6a53d06
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100193cf
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 2
jg 0x1001949e
xor edi, edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x10019485
mov dword [ebp - 0x1c], 0x644bb323
mov dword [ebp - 0x1c], 0x5477a75e
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xec]
cmp dword [eax + ecx*4], ebx
je 0x1001946e
mov ecx, dword [ebp - 0x20]
or edx, 0xffffffff
mov eax, dword [ebp - 0xec]
sub edx, dword [eax + ecx*4]
mov eax, 0xe055a24b
cmp eax, edx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, 0xdfee
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xec]
setg cl
cmp ecx, dword [eax + esi*4]
lea eax, [edi + 1]
je 0x10019470
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x20]
jns 0x1001940d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x100193f7
mov edi, dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0xec]
call fcn.10017570
push 3
lea ecx, [ebp - 0x110]
call fcn.10016cb0
mov dword [ebp - 0x10], 0x39beb064
mov dword [ebp - 0x14], ebx
jmp 0x100194d5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0xbbca6318
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100194c2
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x10019536
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x1001952b
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x110]
cmp dword [eax + ecx*4], ebx
jne 0x1001950a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x110]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x100194f3
dec dword [ebp - 0x10]
jns 0x100194e7
lea ecx, [ebp - 0x110]
call fcn.10017570
xor ecx, ecx
mov dword [ebp - 0x24], 0xaa4807c1
mov dword [ebp - 0x38], ebx
inc ecx
jmp 0x1001955e
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x34], 0xe3556834
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x10019550
push dword [ebp - 0xc4]
movdqa xmm0, xmmword [0x10007b10]
lea eax, [ebp - 0x1a0]
push eax
lea eax, [ebp - 0x1b0]
mov dword [ebp - 0x14], ebx
push eax
mov dword [ebp - 0x28], 0xb1891f78
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x14], 0x98d72a67
push ebx
movdqu xmmword [ebp - 0x1b0], xmm0
mov dword [ebp - 0xbc], ebx
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xb4], ebx
call fcn.1001832b
xor ecx, ecx
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x100195cc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100195be
mov dword [ebp - 0x14], 0xfffffff2
jmp 0x10019701
mov dword [ebp - 0x1c], 0x5739
mov dword [ebp - 0x20], 0x24b83428
mov dword [ebp - 0x28], 0x51d69f42
mov dword [ebp - 0x28], 0xffffffe7
jmp 0x100196f4
mov dword [ebp - 0x24], 0x34caa8e5
mov dword [ebp - 0x10], ebx
jmp 0x1001961b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb0], 0xfe4b2830
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001960a
mov dword [ebp - 0x10], ebx
jmp 0x10019637
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f4], 0xf9150fae
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10019626
mov dword [ebp - 0xb0], ebx
cmp dword [ebp - 0xb0], 0x1c
je 0x100196f1
xor ebx, ebx
inc ebx
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x24], 0x5e3aa9c1
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
cmp eax, 0xe56e
je 0x10019671
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x40]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb0]
add ecx, eax
mov eax, dword [ebp - 0x40]
cmp ecx, eax
setl dl
xor eax, eax
test edx, edx
setle al
cmp ebx, eax
mov eax, dword [ebp - 0x40]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, 0x323fa9df
setge cl
xor eax, eax
cmp ecx, 0xcd9d7
setge al
xor ecx, ecx
cmp eax, 9
setne cl
xor edx, edx
cmp ecx, 7
setge dl
xor eax, eax
cmp edx, 0x404e
setle al
mov dword [ebp - 0x24], eax
inc dword [ebp - 0xb0]
cmp dword [ebp - 0xb0], 0x1c
jne 0x10019653
xor ebx, ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffa
jne 0x100195fe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1a
je 0x100195dd
mov dword [ebp - 0x14], 0xd
cmp dword [ebp - 0x14], 0xa
jl 0x10019737
mov ecx, dword [ebp - 0xbc]
mov dword [ebp - 0x24], 0x3e5f8859
mov eax, dword [ebp - 0x24]
mov dword [ecx + 4], eax
mov dword [ebp - 0x40], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xa
jge 0x1001971e
lea ecx, [ebp - 0xbc]
call fcn.10017570
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x150]
push eax
push ebx
call fcn.1001cf5b
add esp, 0xc
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1c], 0xfffffffd
lea ecx, [ebp - 0x8c]
push 2
call fcn.10016cb0
xor edx, edx
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x10], ebx
inc edx
cmp dword [ebp - 0x10], 2
jge 0x10019790
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x58], edx
inc dword [ebp - 0x10]
jmp 0x1001977e
mov dword [ebp - 0x10], ebx
jmp 0x100197a8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10019795
mov dword [ebp - 0x10], ebx
jmp 0x100197c4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd0], 0xba16
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100197b3
mov dword [ebp - 0x10], ebx
jmp 0x100197df
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16c], 0x461d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100197ce
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x10019877
mov dword [ebp - 0x24], 8
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10019804
push ebx
call edi
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x8c]
setle dl
xor ecx, ecx
cmp edx, 0x7563ffaf
setge cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0xd0]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setl cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x58]
neg eax
cmp eax, 0x693009c
mov eax, dword [ebp - 0x10]
setg cl
sub ecx, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [ebp + eax*4 - 0x58]
imul eax, ecx, 0x38ab
inc eax
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x10]
jns 0x100197f1
xor edi, edi
mov dword [ebp - 0x10], ebx
inc edi
jmp 0x10019970
mov dword [ebp - 0x24], 0xfffffffa
mov dword [ebp - 0x14], ebx
jmp 0x1001989f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x130], 0x5659
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001988e
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x58]
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x58]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov eax, dword [ebp - 0x8c]
setle dl
imul ecx, edx, 0xe71c
xor edx, edx
add ecx, dword [eax]
mov eax, dword [ebp - 0x130]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x58]
test eax, eax
sete cl
add ecx, edx
imul eax, ecx, 0xa6d7
xor ecx, ecx
cmp eax, 2
setg cl
imul eax, ecx, 0x3e99
xor ecx, ecx
cmp eax, 0x5291260e
setl cl
imul ecx, dword [ebp - 0x28]
add ecx, dword [ebp - 0x130]
je 0x10019930
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
jmp 0x10019967
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001995d
push 0xaad
push 0x1662
push 0xd8d
push 0x89c
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov eax, dword [ebp - 0x8c]
cmp dword [eax], ebx
jne 0x10019979
dec dword [ebp - 0x168]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10019882
lea ecx, [ebp - 0x8c]
call fcn.10017570
push 3
mov dword [ebp - 0x38], ebx
pop ecx
jmp 0x1001999d
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x1bc], 0x2c3978d1
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], ecx
jl 0x1001998c
mov dword [ebp - 0x14], 0x68ec0ae9
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], ecx
jmp 0x100199d1
mov dword [ebp - 0x1c], 6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 0xf47a6de
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffee
je 0x100199b4
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100199ec
call esi
push eax
call dword [sym.imp.USER32.dll_GetMenu]
push 3
pop ecx
mov dword [ebp - 0x30], ebx
jmp 0x100199fb
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x34], edi
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jl 0x100199f1
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x1c], 0xf8ee
mov dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x14], ebx
jmp 0x10019a28
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x64], 7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10019a1a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10019a3c
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x10019afc
mov dword [ebp - 0x28], 0x86ff18ee
mov ecx, edi
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x5c]
sub ecx, eax
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0xa10dd664
jbe 0x10019a77
mov eax, dword [ebp - 0x10]
mov edx, ebx
cmp dword [ebp + eax*4 - 0x64], ebx
je 0x10019a79
mov edx, edi
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x64]
add eax, edx
add ecx, eax
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0xffff
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ecx, ecx
cmp edx, 0x7bf19931
mov eax, dword [ebp + eax*4 - 0x64]
setge cl
xor edx, edx
cmp ecx, eax
setle dl
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
imul edx, dword [ebp + eax*4 - 0x64]
sub edx, 0x63f76313
je 0x10019aca
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x64]
mov eax, dword [ebp - 0x10]
cmp ecx, dword [ebp + eax*4 - 0x64]
jge 0x10019ae1
mov edx, ebx
cmp dword [ebp - 0x14], ebx
je 0x10019ae3
mov edx, edi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x10]
jns 0x10019a4c
mov dword [ebp - 0x30], ebx
jmp 0x1001a21d
mov dword [ebp - 0x24], 0xdd711a53
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], 0xfffffffa
push edi
call fcn.10016cb0
mov dword [ebp - 0x14], ebx
jmp 0x10019b40
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0x67f8b4df
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10019b2d
cmp dword [ebp - 0x10], ebx
jne 0x10019b59
cmp dword [ebp - 0x30], ebx
jle 0x10019b04
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x150]
call fcn.10017570
push 3
pop esi
mov dword [ebp - 0x24], esi
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a24b
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001a25a
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
push edi
lea ecx, [ebp - 0x70]
call fcn.10016cb0
mov dword [ebp - 0x1c], 0x1fbb9cf7
mov dword [ebp - 0x10], ebx
jmp 0x1001a27c
cmp dword [ebp - 0x10], 4
jl 0x1001a26f