Function at 0x10017d95
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c0
push ebx
push esi
push edi
push 0
mov dword [ebp - 0x14], 0x7e2799ac
mov dword [ebp - 0x94], edx
mov dword [ebp - 0x20], 0x53f0d3ec
pop edx
mov dword [ebp - 0x14], 0xffffffe6
cmp dword [ebp - 0x14], 0x17
push 1
mov dword [ebp - 0x98], ecx
pop esi
jne 0x10017e34
mov dword [ebp - 4], 0xc7555b7c
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 4], edx
jmp 0x10017df2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x178], 4
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10017de1
mov dword [ebp - 4], esi
cmp dword [ebp - 4], 0x8819
jle 0x10017e11
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
je 0x10017e11
mov edx, esi
mov dword [ebp - 0x16c], 0xffff
xor ecx, ecx
mov eax, dword [ebp - 4]
cmp edx, eax
push 0
setl cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x17
pop edx
je 0x10017dce
mov dword [ebp - 0x18], edx
mov dword [ebp - 0xc], edx
jmp 0x10017e49
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xac], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10017e3c
mov dword [ebp - 0xc], edx
jmp 0x10017e65
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x198], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10017e54
mov dword [ebp - 0xa4], 0xffffffe2
jmp 0x10017ea2
mov dword [ebp - 4], 0xa2961c0f
mov dword [ebp - 4], esi
cmp dword [ebp - 4], edx
jl 0x10017e9c
mov byte [ebp - 0x21], dl
cmp byte [ebp - 0x21], 0
je 0x10017e97
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor edx, edx
dec dword [ebp - 4]
jns 0x10017e86
inc dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], 0xfffffff5
jne 0x10017e77
inc dword [ebp - 0x18]
mov eax, 0x44b1310f
mov dword [ebp - 0x1c], edx
mov byte [ebp - 5], dl
mov dword [ebp - 0xc], 0x789328a
mov dword [ebp - 0x10], 0xc1da7bc9
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0x10], edx
jmp 0x10017ef2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x28], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017ee4
mov dword [ebp - 0x10], edx
jmp 0x10017f0d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x108], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10017efc
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x28], edx
jmp 0x1001806c
mov dword [ebp - 4], 7
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x1c], 8
cmp dword [ebp - 0xc], 0xffff
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x2b00
mov eax, dword [ebp - 4]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x28]
mov dword [ebp - 0x10], ecx
jne 0x10017f74
cmp dword [ebp - 0x28], 0
jne 0x10017f74
xor edx, edx
jmp 0x10017f76
mov edx, esi
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
setne cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
cmp ecx, dword [ebp - 4]
jl 0x10017fcc
mov byte [ebp - 0x21], dl
cmp byte [ebp - 0x21], dl
je 0x10017fb1
push 0x196e
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
xor edx, edx
mov byte [ebp - 0x21], dl
cmp byte [ebp - 0x21], 0
je 0x10018069
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor edx, edx
jmp 0x10018069
mov dword [ebp - 0x1c], 0x1c250287
mov dword [ebp - 0x1c], 0xe2be8ca4
push 4
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], edx
pop ecx
jmp 0x10017ff6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1a8], 0xf8b4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10017fe5
mov dword [ebp - 0x10], edx
jmp 0x10018011
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x190], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10018000
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18c]
mov eax, dword [ebp - 0x19c]
sub eax, dword [ebp - 0x14]
jne 0x10018046
mov ecx, edx
cmp dword [ebp - 0x18], edx
je 0x10018048
mov ecx, esi
mov eax, dword [ebp - 0x28]
imul eax, ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
jmp 0x10018063
mov dword [ebp - 0x18], 9
dec dword [ebp - 0x18]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x10018056
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xfffffffd
jne 0x10017f27
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], edx
jl 0x10018107
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp + eax*4 - 0x28], 0x654
sub eax, 0x1ac6
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
add eax, 0x1800d466
mov dword [ebp - 0xc8], eax
jne 0x100180af
cmp dword [ebp - 0xc], edx
je 0x100180b1
mov edx, esi
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp eax, edx
push 0
setl cl
xor eax, eax
cmp ecx, 0x5126
pop edx
setl al
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x28]
mov ecx, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x28], ecx
dec dword [ebp - 0xc]
jns 0x10018082
cmp byte [ebp - 5], 0
mov esi, dword [sym.imp.USER32.dll_UnregisterClassA]
je 0x10018230
mov dword [ebp - 0x10], 8
or eax, 0xffffffff
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], edx
jmp 0x1001813d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x138], 0xe91b76e1
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001812c
mov dword [ebp - 0x10], 0xffffffef
cmp dword [ebp - 0x10], 0xfffffffc
jne 0x1001822c
xor eax, eax
inc eax
or edi, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x2c], 0x941c
mov dword [ebp - 0x48], 5
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 0x18
je 0x10018219
mov dword [ebp - 0x18], 0x6c19
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 0xb5af
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
sub eax, edx
xor edx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setg dl
mov dword [ebp - 0x130], edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
add ecx, 0x4fbdfbf1
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x18
jne 0x1001817e
xor eax, eax
xor edx, edx
inc eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffc
je 0x1001815a
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push edx
push edx
call esi
xor ecx, ecx
mov byte [ebp - 5], cl
push 3
pop eax
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 4], ecx
jmp 0x10018266
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x168], 9
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10018255
mov dword [ebp - 0x90], 0xfffffff2
cmp dword [ebp - 0x90], 0xfffffff7
jle 0x10018365
xor edx, edx
inc edx
or ebx, 0xffffffff
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xab593421
mov dword [ebp - 0x1c], 0x8f21009d
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0x552bf338
mov dword [ebp - 0x1c], 0x71013923
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 4
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0x4dbf0cf8
mov dword [ebp - 0x1c], 0x63069be5
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], 0x5e0e2bf3
mov dword [ebp - 0x1c], 0xba8d7d2a
mov dword [ebp - 0x1c], 0xc9b6cd04
mov dword [ebp - 0x1c], 0x83afd470
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x1c], 0x69376522
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ecx
jmp 0x10018329
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001831c
mov dword [ebp - 0x10], ecx
jmp 0x10018344
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x100], 3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10018333
inc dword [ebp - 0x18]
inc dword [ebp - 0x90]
cmp dword [ebp - 0x90], 0xfffffff7
jg 0x10018289
mov ebx, dword [sym.imp.USER32.dll_GetDC]
cmp byte [ebp - 5], cl
je 0x1001837e
push 0x1078
push ecx
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], 0xfffffffb
mov dword [ebp - 0x10], 0x18d
mov dword [ebp - 0x1c], ecx
push 4
mov dword [ebp - 0x1c], 0xdfac86e8
mov dword [ebp - 0xc], ecx
pop edx
jmp 0x100183b2
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x12c], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x100183a1
mov dword [ebp - 0xc], ecx
jmp 0x100183cd
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1c0], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x100183bc
mov dword [ebp - 0xc], ecx
jmp 0x100183e9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x11c], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x100183d8
cmp dword [ebp - 0x14], ecx
je 0x100183f6
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x10]
jge 0x100184aa
or eax, 0xffffffff
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
jmp 0x10018439
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x6c], 0xa8ccedb7
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001842b
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
neg ecx
push 0xfffffffffffffffc
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xfffffff8
setg al
cmp eax, 0x9a984365
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x12c]
mov eax, dword [ebp - 0x68]
cmp ecx, eax
pop eax
setg dl
xor ecx, ecx
cmp edx, 0xfff7
setne cl
sub eax, ecx
xor ecx, ecx
cmp eax, 1
setle cl
mov dword [ebp - 0x18], ecx
inc dword [ebp - 0x11c]
jmp 0x100184bc
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x100184be
push edx
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
xor edx, edx
mov dword [ebp - 0x14], 0xf36f6dd8
xor ecx, ecx
mov dword [ebp - 0xc], 0xffff
inc ecx
mov dword [ebp - 0x10], edx
jmp 0x100184e5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10c], 0x198a8f93
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100184d4
mov dword [ebp - 0x10], edx
jmp 0x100184fd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x30], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x100184ef
mov dword [ebp - 0x30], edx
jmp 0x10018519
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018516
push edx
push edx
call esi
xor edx, edx
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edx
jle 0x10018507
xor esi, esi
mov dword [ebp - 0x14], edx
inc esi
cmp dword [ebp - 0x14], edx
jl 0x100185e3
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], edx
jmp 0x1001854a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x40], 0xbca9d692
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001853c
mov dword [ebp - 0x38], edx
cmp dword [ebp - 0x38], edx
jg 0x100185bd
or ecx, 0xffffffff
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x30], edx
je 0x10018567
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp + eax*4 - 0x30]
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xc], eax
jne 0x100185a6
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edx
jle 0x1001855b
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x100185da
push 0xe4
push edx
push edx
push edx
push edx
call edi
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edx, edx
dec dword [ebp - 0x14]
jns 0x1001852d
mov dword [ebp - 0x10], 0xc93b4e1
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 0xe61175c8
mov dword [ebp - 0x2c], 0xce65
mov dword [ebp - 4], edx
jmp 0x10018614
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x160], 0x49562184
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10018603
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x11
jle 0x1001876a
mov eax, 0x33efc07e
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0xc], 0xcb8ce3e
mov dword [ebp - 0x20], 0x543b
mov dword [ebp - 0xc], edx
jmp 0x100186af
mov dword [ebp - 4], edx
jmp 0x10018661
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe0], 0x16501874
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10018650
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xe0]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x80], ecx
xor ecx, ecx
mov dword [ebp - 0xe0], esi
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
cmp eax, esi
mov eax, dword [ebp - 0x10]
setl cl
sub eax, ecx
imul eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x1001864b
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 3
jg 0x10018758
mov dword [ebp - 0x18], 0xb7f464f6
mov ecx, 0xd633
mov eax, dword [ebp - 0x74]
sub ecx, eax
jne 0x100186da
cmp dword [ebp - 0xc], edx
je 0x100186e1
cmp dword [ebp - 0x10], edx
je 0x100186e1
mov edx, esi
mov eax, dword [ebp - 0xc]
push 0
mov ecx, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp - 0x10]
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, esi
setne dl
xor eax, eax
add edx, dword [ebp - 0x154]
cmp edx, esi
setle al
xor edx, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sub ecx, eax
add ecx, dword [ebp - 0x78]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x80]
cmp eax, ecx
setg dl
sub edx, dword [ebp - 0x74]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
pop edx
jle 0x100186c2
inc dword [ebp - 0x10]
mov eax, 0x33efc07e
cmp dword [ebp - 0x10], 0x11
jg 0x1001862c
or eax, 0xffffffff
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 4], 0xe5ccc90a
mov dword [ebp - 4], edx
jmp 0x1001879e
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x1001879b
push esi
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x10018785
mov dword [ebp - 0x10], 0xee76f502
mov dword [ebp - 4], edx
jmp 0x100187c1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf0], 2
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x100187b0
mov dword [ebp - 0x10], edx
jmp 0x1001883f
mov dword [ebp - 4], 0xfffffffd
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0xdf0442e1
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x100187fb
push edx
push 0xe73
push edx
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x10018836
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xf0]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xf0], edx
je 0x10018824
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0xf0], edx
mov eax, esi
jne 0x10018826
mov eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0xf0]
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jle 0x10018800
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x100187cc
mov dword [ebp - 0xc], 0xea75c96
or ecx, 0xffffffff
mov dword [ebp - 0x18], 0x7bf0
mov dword [ebp - 4], 0x9b95
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], edx
jmp 0x10018876
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x150], 0xfffffff9
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10018865
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x14], 0xffffffe3
cmp dword [ebp - 0x14], 0x1b
jle 0x10018900
mov dword [ebp - 0x18], 0xcfd6
mov dword [ebp - 0x20], 0x5950cfdf
mov eax, dword [ebp - 0x18]
neg eax
jne 0x100188c6
mov ecx, edx
cmp dword [ebp - 0x18], edx
je 0x100188c8
mov ecx, esi
mov eax, 0x42ad5d7c
sub eax, ecx
xor ecx, ecx
add eax, dword [ebp - 0x18]
cmp eax, 0xef90
mov eax, 0xdf860956
push 0
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
setge dl
mov dword [ebp - 0x20], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x1b
pop edx
jg 0x100188aa
push 8
pop ecx
mov dword [ebp - 0xbc], ecx
mov eax, 0xfff7
mov dword [ebp - 0xb8], ecx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 4], edx
jmp 0x1001893f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x44], 0xfffffff6
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10018931
mov dword [ebp - 0x44], 3
cmp dword [ebp - 0x44], edx
jl 0x100189a3
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x1001899b
push 0x1e4b
push 0x608
push 0x11b
push edx
push 0x2c0
push 0x1583
call edi
push eax
call ebx
push eax
push 0x233d
push 0xced
push 0x1c6e
push 0x1e3
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor edx, edx
dec dword [ebp - 0x44]
jns 0x10018950
push 8
pop ecx
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x20], edx
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x18], 0xfffffffa
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x10], edx
jmp 0x10018aeb
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], 2
mov dword [ebp - 4], edx
jmp 0x100189e2
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xc4], 0x405732aa
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x100189d1
mov dword [ebp - 4], 0xffffffe5
jmp 0x10018adf
mov dword [ebp - 0xc], edx
or ecx, 0xffffffff
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 4], esi
je 0x10018aa1
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x1c], 0x6f37
mov dword [ebp - 0x14], edx
jmp 0x10018a9a
mov dword [ebp - 0x18], 0x9150faeb
mov dword [ebp - 0xc], edx
jmp 0x10018a58
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018a55
push edx
push 0x16a3
push 0x5b2
call edi
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
xor edx, edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jle 0x10018a33
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xc4], edx
jne 0x10018a70
mov eax, edx
cmp dword [ebp - 0x18], edx
je 0x10018a72
mov eax, esi
neg eax
jne 0x10018a79
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10018a27
jmp 0x10018ac7
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018ab2
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018ac7
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018ad9
push edx
call dword [sym.imp.USER32.dll_RegisterClassW]
xor edx, edx
inc dword [ebp - 4]
push 8
pop ecx
cmp dword [ebp - 4], ecx
jne 0x100189f4
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffa
jg 0x100189c2
mov dword [ebp - 0xc], 0xb8342836
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], edx
jne 0x10018b3e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xf851
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
cmp ecx, dword [ebp - 0x20]
jl 0x10018b3e
mov eax, edx
cmp dword [ebp - 0xc], edx
je 0x10018b40
mov eax, esi
imul eax, eax, 0xa404
push 8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], 0x53072226
pop eax
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
or eax, 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 2
jge 0x10018b8b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x180], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10018b71
or eax, 0xffffffff
inc dword [ebp - 4]
mov dword [ebp - 4], 0xffffffe4
jmp 0x10018bba
mov dword [ebp - 0x1c], 0x69aed23b
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x2c], 0x76ec
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x1c], edx
jne 0x10018bc0
dec dword [ebp - 0x20]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xa
jle 0x10018b97
mov dword [ebp - 0xc], 9
mov dword [ebp - 4], 0xfffffff9
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], edx
jmp 0x10018be4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x70], 0x9a56718e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018bd6
mov dword [ebp - 0x10], edx
jmp 0x10018bff
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x144], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10018bee
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, esi
push 0
setle cl
sub ecx, dword [ebp - 0xc]
neg ecx
pop eax
sbb ecx, ecx
inc ecx
sets al
add eax, dword [ebp - 0xc]
jne 0x10018c4a
mov eax, edx
cmp dword [ebp - 0x70], edx
je 0x10018c4c
mov eax, esi
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
dec eax
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edx
jmp 0x10018cd1
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], edx
jmp 0x10018c8e
cmp dword [ebp - 0x1c], edx
jne 0x10018c94
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018c8b
push 0x1d0e
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1d
jne 0x10018c6f
mov dword [ebp - 4], edx
jmp 0x10018cc8
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018caa
call dword [sym.imp.USER32.dll_WaitMessage]
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018cc5
push edx
push 0x1ffe
push edx
call edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xb
jle 0x10018c99
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jg 0x10018c67
mov dword [ebp - 4], edx
jmp 0x10018ced
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xfc], 0x7c70ab22
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10018cdc
mov dword [ebp - 0x1c], 0xac78
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018d0e