Function at 0x1001810b
Capabilities:
Accept command line arguments
Get graphical window text
Get session user name
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007bc76
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
push esi
push edi
mov dword [esp + 0x60], edx
xor ebx, ebx
push 8
mov dword [esp + 0x68], ecx
xor ecx, ecx
mov dword [esp + 0x14], 0x5c96dd1e
inc ecx
pop edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], ebx
jmp 0x10018161
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x78], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x10018151
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0xfffffff6
jmp 0x1001818d
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jge 0x10018179
push 2
lea ecx, [esp + 0x130]
call fcn.10016394
mov dword [esp + 0x234], ebx
mov dword [esp + 0x24], 0x2603
mov dword [esp + 0x20], 0x1c9eeb3b
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x100181da
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x48], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100181ca
mov eax, dword [esp + 0x48]
xor ecx, ecx
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
cmp eax, 0x739c25fe
setl cl
cmp ecx, dword [esp + 0x48]
jg 0x1001820e
cmp dword [esp + 0x48], ebx
je 0x1001820e
xor edi, edi
lea ecx, [edi + 1]
jmp 0x10018210
mov ecx, ebx
mov eax, dword [esp + 0x4c]
imul eax, dword [esp + 0x4c]
imul eax, ecx
test eax, eax
jne 0x10018224
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x24], ebx
jne 0x10018232
mov eax, dword [esp + 0x24]
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018267
push 0x1e5c
push 0x1643
push 0xb86
push 0x139
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
push 2
lea ecx, [esp + 0x148]
call fcn.10016394
xor eax, eax
lea ecx, [esp + 0x120]
inc eax
mov byte [esp + 0x234], al
mov dword [esp + 0x10], 0x7ce53d8d
mov dword [esp + 0x20], eax
mov dword [esp + 0x38], 0x415d7249
push eax
call fcn.10016394
mov byte [esp + 0x234], 2
mov dword [esp + 0x20], 7
mov dword [esp + 0x18], ebx
jmp 0x100182cc
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0x5d6c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x100182b6
xor edx, edx
mov dword [esp + 0x18], ebx
inc edx
jmp 0x100182ee
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100182dc
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], edx
jg 0x1001844e
xor edi, edi
inc edi
push dword [esp + 0x78]
movdqa xmm0, xmmword [0x10007eb0]
lea eax, [esp + 0x1ec]
push eax
lea eax, [esp + 0x1e0]
mov dword [esp + 0x38], 0xd7c1188e
push eax
mov dword [esp + 0x28], 0x4a754320
lea ecx, [esp + 0xf4]
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x34], 0xffff
push ebx
movdqu xmmword [esp + 0x1e8], xmm0
mov dword [esp + 0xf8], ebx
mov dword [esp + 0xfc], ebx
mov dword [esp + 0x100], ebx
call fcn.10017868
mov dword [esp + 0x18], ebx
jmp 0x10018385
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x15c], 0x3a266d21
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10018372
mov edx, dword [esp + 0x10]
mov esi, edi
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x144]
mov eax, dword [eax + edx*4]
dec dword [esp + 0x24]
cmp eax, ecx
cmovl esi, ebx
dec dword [esp + 0x28]
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x15c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x160]
mov eax, dword [esp + 0x164]
cmp ecx, eax
mov ecx, dword [esp + 0x30]
mov eax, 0x8991f32a
setle dl
cmp eax, edx
sbb eax, eax
neg eax
imul eax, eax, 0xb6f2
add eax, 0xb6f1490e
add ecx, eax
xor eax, eax
cmp ecx, 0x7f191253
setl al
xor ecx, ecx
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x38]
cmp esi, eax
mov eax, dword [esp + 0x120]
setg cl
xor edx, edx
cmp ecx, dword [esp + 0x28]
setg dl
xor ecx, ecx
cmp edx, dword [eax]
setne cl
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0xe8]
call fcn.10016416
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jle 0x10018305
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018477
push ebx
push ebx
push ebx
push 0x95b
push 0x1386
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
lea ecx, [esp + 0x120]
call fcn.10016416
lea ecx, [esp + 0x144]
mov byte [esp + 0x234], bl
call fcn.10016416
xor edi, edi
lea ecx, [esp + 0xf4]
inc edi
push edi
call fcn.10016394
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x100184c5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 0x5d6c05ba
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100184af
mov eax, dword [esp + 0xf4]
mov dword [eax], ebx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100184e5
call dword [sym.imp.USER32.dll_DestroyCaret]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100184f8
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [esp + 0xf4]
dec dword [eax]
cmp dword [eax], 0xffffffe2
jne 0x100184d4
lea ecx, [esp + 0xf4]
call fcn.10016416
push 2
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10018531
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], 5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x1001851b
push 4
mov dword [esp + 0x1c], ebx
pop esi
jmp 0x10018553
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xd8], 0xdf1febae
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10018540
mov dword [esp + 0xe4], ebx
jmp 0x1001857e
mov ecx, dword [esp + 0xe4]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], 0xe3245f1d
inc dword [esp + 0xe4]
cmp dword [esp + 0xe4], edx
jl 0x10018562
or dword [esp + 0x234], 0xffffffff
lea ecx, [esp + 0x12c]
call fcn.10016416
xor edi, edi
lea ecx, [esp + 0x6c]
inc edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], 0xfffffffa
push esi
call fcn.10016394
mov dword [esp + 0x234], 3
mov dword [esp + 0x28], 0x44653ffd
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0x89ed5b60
mov dword [esp + 0x5c], 0xdf1d9793
mov dword [esp + 0x10], ebx
jmp 0x100185f0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x6c]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x100185e1
mov dword [esp + 0x10], 0x1a
cmp dword [esp + 0x10], 0x16
jg 0x10018874
push 2
lea ecx, [esp + 0x13c]
call fcn.10016394
mov dword [esp + 0x38], 0xfffffff6
mov dword [esp + 0x18], ebx
jmp 0x1001863b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10018625
mov esi, dword [esp + 0x138]
mov dword [esp + 0x20], esi
mov eax, dword [esi + 4]
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
jne 0x100186d0
cmp dword [esp + 0x18], edi
sbb eax, eax
xor ecx, ecx
inc eax
add eax, dword [esp + 0x18]
cmp eax, 0x9a20
mov eax, dword [esp + 0x6c]
setle cl
xor edx, edx
cmp ecx, 0x58905b8b
mov ecx, 0xe11a796d
setle dl
sub edx, 0xfffffff9
neg edx
sbb edx, edx
inc edx
mov dword [eax], edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x28]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, dword [esi + 4]
setne al
cmp edi, eax
mov eax, dword [esp + 0x10]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x28]
setle cl
sub edx, ecx
sub edx, eax
jne 0x100186d0
mov eax, ebx
inc edx
jmp 0x100186d5
xor edx, edx
inc edx
mov eax, edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x18], 3
cmp dword [esp + 0x18], ebx
jl 0x10018856
jmp 0x100186f0
xor edx, edx
inc edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x30], 0xb56fe18
mov dword [esp + 0x34], 0x8859b346
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x6c]
mov dword [eax], ecx
mov eax, dword [esp + 0x30]
neg eax
dec dword [esp + 0x30]
cmp eax, ecx
mov eax, edx
cmove eax, ebx
cmp dword [esp + 0x18], ebx
je 0x10018735
mov ecx, edx
cmp dword [esp + 0x1c], ebx
jne 0x10018737
mov ecx, ebx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 4], eax
add eax, ecx
jne 0x100187b4
mov eax, dword [esp + 0x10]
xor edx, edx
cmp dword [esi + 4], eax
mov eax, dword [esp + 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x6c]
setg cl
sub ecx, dword [esi + 4]
imul ecx, ecx, 0xe5f8
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, dword [eax + 0xc]
mov eax, dword [esp + 0x38]
setl dl
xor ecx, ecx
cmp edx, eax
mov dword [esi + 4], edx
setg cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
add ecx, dword [esp + 0x38]
mov eax, dword [esp + 0x28]
cmp ecx, eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x6c]
setle dl
mov dword [eax + ecx*4], edx
mov eax, dword [esp + 0x38]
sub edx, eax
cmp edx, dword [esp + 0x24]
jl 0x100187c1
cmp dword [esp + 0x38], ebx
je 0x100187c1
xor edi, edi
lea ecx, [edi + 1]
jmp 0x100187c3
mov ecx, ebx
xor eax, eax
cmp ecx, 0xda0d
setl al
xor edx, edx
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x5c]
cmp eax, ecx
mov eax, dword [esp + 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
test eax, eax
mov eax, dword [esp + 0x34]
setle cl
xor edx, edx
add ecx, 0xf903
cmp ecx, eax
setne dl
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x6c]
imul edx, dword [eax + esi*4]
mov esi, dword [esp + 0x20]
add edx, dword [eax + edi*4]
mov ecx, dword [esi + 4]
neg edx
sbb edx, edx
neg edx
lea eax, [ecx + edx]
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x6c]
setg dl
mov dword [eax], edx
mov dword [esp + 0x1c], edx
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
dec dword [esp + 0x18]
jns 0x100186ed
lea ecx, [esp + 0x138]
call fcn.10016416
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0x16
push 1
pop edi
jle 0x10018609
or dword [esp + 0x234], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.10016416
mov esi, dword [esp + 0x64]
cmp dword [esi + 0x10], ebx
jne 0x10018895
xor al, al
jmp 0x10019875
mov eax, dword [esp + 0x60]
mov dword [eax], ebx
mov dword [esp + 0x24], 0x14c90d29
mov dword [esp + 0x28], 0x65e790e8
mov dword [esp + 0x20], 0x47d2038
mov dword [esp + 0x2c], 0x76e5
mov dword [esp + 0x1c], ebx
jmp 0x100188d4
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x118], 0xf951fe77
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x100188c1
mov eax, dword [esp + 0x118]
xor ecx, ecx
mov dword [esp + 0x118], eax
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
sub edx, 0x896e
cmp eax, edx
setl cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x2c]
add eax, dword [esp + 0x20]
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], edi
cmp dword [esp + 0x2c], ebx
jl 0x1001893d
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018937
push 0x905
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
dec dword [esp + 0x2c]
jns 0x10018920
push dword [esp + 0x78]
movdqa xmm0, xmmword [0x10007e30]
lea eax, [esp + 0x20c]
push eax
lea eax, [esp + 0x200]
mov dword [esp + 0x18], ebx
push eax
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0xb0]
push ebx
movdqu xmmword [esp + 0x208], xmm0
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
mov dword [esp + 0xbc], ebx
call fcn.10017868
mov dword [esp + 0x28], 0xfffffffa
cmp dword [esp + 0x10], ebx
je 0x10018aff
xor ecx, ecx
mov dword [esp + 0x24], 0x2d7bc352
inc ecx
mov dword [esp + 0x30], ecx
mov dword [esp + 0x28], 0x46cd5fec
mov dword [esp + 0x18], ebx
jmp 0x100189cb
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x50], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x100189bf
mov dword [esp + 0x18], ebx
jmp 0x100189e7
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xd0], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x100189d8
mov eax, dword [esp + 0x50]
xor edx, edx
mov eax, dword [esp + 0x10]
test eax, eax
mov eax, dword [esp + 0x10]
sets dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x54]
sub edx, eax
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x50]
setne cl
imul ecx, eax
mov eax, dword [esp + 0x50]
add eax, ecx
jne 0x10018a3e
cmp dword [esp + 0x50], ebx
jne 0x10018a3e
mov edx, ebx
jmp 0x10018a43
xor edi, edi
lea edx, [edi + 1]
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, edx
mov eax, dword [esp + 0x10]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x54]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x50]
setge cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x20]
setne cl
cmp ecx, 0xfffffff8
sbb eax, eax
neg eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x30]
add eax, 4
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x758185f1
mov eax, dword [esp + 0xa4]
setg cl
xor edx, edx
cmp ecx, dword [eax + 4]
mov eax, dword [esp + 0x50]
mov ecx, dword [esp + 0xd0]
setle dl
add eax, 0xf844
imul ecx, eax
xor eax, eax
cmp ecx, edx
setle al
xor edx, edx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov eax, dword [esp + 0x30]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0x29efec1
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x24], ecx
jmp 0x10018b1f
mov dword [esp + 0x20], 4
mov dword [esp + 0x20], 0x9191d4d0
mov dword [esp + 0x20], ebx
dec dword [esp + 0x28]
mov dword [esp + 0x24], 0xc90acefc
lea ecx, [esp + 0xa4]
call fcn.10016416
mov dword [esp + 0x2c], 0xb13638ec
xor ecx, ecx
mov dword [esp + 0x10], 0x23b6182e
inc ecx
mov dword [esp + 0x28], 0x985589b5
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x34], 0xf18c9a01
mov dword [esp + 0x1c], ebx
jmp 0x10018b6f
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xbc], 0x68f62c4d
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x10018b5c
mov ecx, dword [esp + 0x2c]
xor edx, edx
mov eax, dword [esp + 0x2c]
cmp ecx, eax
setne dl
mov dword [esp + 0x10], edx
mov dword [esp + 0x10], 0xfffffffa
jmp 0x10018c53
mov dword [esp + 0x24], 0x9c3997b
mov dword [esp + 0x28], 0xfffffffe
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x10018bc6
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0xcc], 6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x10018bb3
mov dword [esp + 0x28], 8
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
neg eax
sbb eax, eax
xor edx, edx
neg eax
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x24]
cmp eax, 9
setle dl
mov dword [esp + 0xbc], edx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x24]
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0xcc], eax
mov dword [esp + 0x34], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018c4f
push 0x74a
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
dec dword [esp + 0x10]
xor ecx, ecx
inc ecx
cmp dword [esp + 0x10], 0xffffffed
jg 0x10018b95
mov dword [esp + 0x1c], ebx
jmp 0x10018c77
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x3c], 0xfffffffe
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x10018c67
push 2
pop edi
mov dword [esp + 0x3c], ebx
cmp dword [esp + 0x3c], edi
je 0x10018f69
jmp 0x10018c93
xor ecx, ecx
inc ecx
mov dword [esp + 0x20], 0xa754320e
mov dword [esp + 0x34], 9
mov dword [esp + 0x34], 0x946b43d2
mov dword [esp + 0x34], 6
mov dword [esp + 0x5c], ebx
mov eax, dword [esp + 0x20]
inc eax
cmp eax, 0xab653b1d
sbb eax, eax
neg eax
sub eax, dword [esp + 0x34]
mov dword [esp + 0x5c], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018cee
push ebx
push ebx
push 0x908
push 0x20f0
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
xor ecx, ecx
inc ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10018f5b
mov dword [esp + 0x18], 4
mov dword [esp + 0x20], 0xab653b1d
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], ebx
jmp 0x10018d27
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x68], 7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x10018d17
mov dword [esp + 0x18], ebx
jmp 0x10018d5a
mov dword [esp + 0x1c], 4
mov dword [esp + 0x1c], 0xffffffec
jmp 0x10018d4f
cmp dword [esp + 0x18], ebx
jne 0x10018d56
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffe
jge 0x10018d45
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1b
jne 0x10018d33
push 0xfffffffffffffff6
pop eax
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], eax
jge 0x10018f4e
push 4
lea ecx, [esp + 0x154]
call fcn.10016394
mov dword [esp + 0x234], 4
mov dword [esp + 0x10], 0x188e17b8
mov dword [esp + 0x10], ebx
jmp 0x10018daf
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0xf2121f90
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10018d99
mov dword [esp + 0x10], ebx
jmp 0x10018dcf
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x220], 0x68108531
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10018dbc
mov dword [esp + 0x10], ebx
jmp 0x10018f20
push 3
lea ecx, [esp + 0x9c]
call fcn.10016394
mov dword [esp + 0x20], 0xfffffffd
xor edx, edx
mov dword [esp + 0x20], ebx
inc edx
mov dword [esp + 0x24], 0xed1d25bb
mov eax, 0x758fc567
mov dword [esp + 0x20], edx
mov dword [esp + 0x20], 0x3b0639e6
mov dword [esp + 0x20], edx
mov dword [esp + 0x184], eax
mov dword [esp + 0x188], eax
mov dword [esp + 0x18c], eax
mov dword [esp + 0x190], eax
mov dword [esp + 0x1c], ebx
jmp 0x10018e50
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0xd7249aae
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x10018e3a
mov eax, dword [esp + 0x98]
mov dword [eax], ebx
mov dword [esp + 0x20], edx
mov dword [esp + 0x20], 0xfffffffb
mov dword [esp + 0x20], 0x9bca7b5c
mov dword [esp + 0x20], 0x717f4039
mov dword [esp + 0x20], 0xb42be197
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
jmp 0x10018ea1
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x214], 0x7494dfd9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x10018e8e
dec dword [esp + 0x28]
jne 0x10018eda
mov eax, dword [esp + 0x98]
mov ecx, dword [eax]
mov eax, dword [esp + 0x150]
cmp dword [eax + ecx*4], ebx
je 0x10018ed6
cmp dword [esp + 0x18], ebx
je 0x10018ed0
mov eax, dword [esp + 0x214]
cmp dword [esp + 0x10], ebx
jne 0x10018eda
mov ecx, ebx
jmp 0x10018edc
mov ecx, edx
xor eax, eax
cmp ecx, 0x2f8ba796
setl al
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], 0xfffffffe
mov eax, dword [esp + 0x24]
mov dword [esp + 0x184], eax
mov eax, dword [esp + 0x98]
inc dword [eax]
cmp dword [eax], 3
jle 0x10018e60
lea ecx, [esp + 0x98]
call fcn.10016416
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x10018dde
or dword [esp + 0x234], 0xffffffff
lea ecx, [esp + 0x150]
call fcn.10016416
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffff6
jl 0x10018d72
push ebx
push 0x4d97
call fcn.10019993
pop ecx
pop ecx
inc dword [esp + 0x3c]
cmp dword [esp + 0x3c], edi
jne 0x10018c90
mov eax, dword [esp + 0x3c]
lea ecx, [esp + 0x1a0]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x24], 0x25062d7b
mov dword [esp + 0x28], 0xfffffffe
push 3
call fcn.10016394
mov dword [esp + 0x1c], ebx
jmp 0x10018fb3
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1a0]
mov dword [eax + ecx*4], 0x4176
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x10018f9d
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, 0x240c
mov eax, dword [esp + 0x10]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0xd926
sub eax, dword [esp + 0x10]
sub eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
je 0x1001900b
cmp dword [esp + 0x10], ebx
je 0x1001900b
xor edx, edx
inc edx
mov ecx, edx
jmp 0x10019010
xor edx, edx
mov ecx, ebx
inc edx
mov eax, 0x1d89
sub eax, ecx
imul eax, dword [esp + 0x10]
sub eax, dword [esp + 0x10]
jne 0x1001902a
mov eax, ebx
cmp dword [esp + 0x28], ebx
je 0x1001902c
mov eax, edx
cmp eax, dword [esp + 0x10]
jne 0x1001903c
mov dword [esp + 0x24], 0xf446cd5f
jmp 0x1001907e
mov dword [esp + 0x20], 0xfffffffe
mov dword [esp + 0x28], edx
mov dword [esp + 0x34], 0x6fa4bc44
cmp dword [esp + 0x20], ebx
jne 0x10019066
mov eax, dword [esp + 0x24]
mov dword [esp + 0x28], eax
mov eax, ebx
cmp dword [esp + 0x28], ebx
je 0x10019068
mov eax, edx
mov dword [esp + 0x34], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001907e
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 0x1a0]
call fcn.10016416
cmp dword [esi + 0x14], 0x10
jb 0x10019094
mov ecx, dword [esi]
jmp 0x10019096
mov ecx, esi
cmp dword [esi + 0x14], 0x10
mov dword [esp + 0x44], ecx
jb 0x100190a4
mov edx, dword [esi]
jmp 0x100190a6
mov edx, esi
mov eax, dword [esi + 0x10]
add eax, edx
cmp ecx, eax
je 0x10019702
push dword [esp + 0x68]
movdqa xmm0, xmmword [0x10007e80]
lea eax, [esp + 0x1fc]
push eax
lea eax, [esp + 0x1f0]
mov dword [esp + 0x90], ebx
push eax
push ebx
lea ecx, [esp + 0x98]
mov dword [esp + 0x9c], ebx
movdqu xmmword [esp + 0x1f8], xmm0
mov dword [esp + 0xa0], ebx
call fcn.10017868
mov dword [esp + 0x234], 5
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 3
jg 0x1001922f
mov esi, dword [esp + 0x88]
xor edi, edi
lea ecx, [esp + 0x168]
inc edi
push edi
call fcn.10016394
xor edx, edx
mov dword [esp + 0x10], ebx
inc edx
jmp 0x1001915a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x168]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10019148
mov dword [esp + 0x10], ebx
jmp 0x10019179
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x208], 0xbb7a1405
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019166
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019195
push ebx
call dword [sym.imp.USER32.dll_CharUpperW]
xor edx, edx
inc edx
mov eax, dword [esp + 0x24]
dec dword [esp + 0x24]
cmp eax, edx
jne 0x10019201
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x18], ebx
je 0x100191bd
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x88]
cmp dword [eax + ecx*4], ebx
mov ecx, edx
jne 0x100191bf
mov ecx, ebx
mov eax, dword [esp + 0x168]
mov dword [eax], ecx
test ecx, ecx
jne 0x100191d0
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x208]
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x88]
cmp dword [edx + 4], 0xffffffff
setge cl
xor eax, eax
cmp ecx, 0x6cad8e65
setl al
cmp eax, dword [edx]
jle 0x100191fe
mov ecx, ebx
jmp 0x10019203
xor edx, edx
inc edx
mov ecx, edx
xor eax, eax
cmp ecx, 0xc705be73
lea ecx, [esp + 0x168]
setne al
mov dword [esi + 0xc], eax
call fcn.10016416
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x1001912f
push 2
pop edi
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001924e
push ebx
push ebx
push 0x2bd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
or dword [esp + 0x234], 0xffffffff
lea ecx, [esp + 0x88]
call fcn.10016416
push dword [esp + 0x68]
movdqa xmm0, xmmword [0x10007ec0]
lea eax, [esp + 0x1dc]
push eax
lea eax, [esp + 0x1d0]
mov dword [esp + 0x84], ebx
push eax
push ebx
lea ecx, [esp + 0x8c]
mov dword [esp + 0x90], ebx
movdqu xmmword [esp + 0x1d8], xmm0
mov dword [esp + 0x94], ebx
call fcn.10017868
mov dword [esp + 0x234], 6
xor ecx, ecx
mov dword [esp + 0x28], 0x22a149ce
inc ecx
mov dword [esp + 0x24], 0xe012d2c8
mov dword [esp + 0x10], ebx
jmp 0x100192dd
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x58], 0xbb4ebb0c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x100192cd
mov dword [esp + 0x10], ebx
jmp 0x100192fc
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xc4], 5
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x100192e9
mov eax, dword [esp + 0x58]
xor edx, edx
mov dword [esp + 0x24], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
cmp ecx, eax
mov ecx, dword [esp + 0x58]
mov eax, dword [esp + 0x28]
setge dl
dec ecx
mov dword [esp + 0x20], edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x28]
setl dl
imul eax, dword [esp + 0x20]
mov dword [esp + 0x34], edx
xor edx, edx
cmp dword [esp + 0x34], eax
mov eax, dword [esp + 0x58]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0xc4], ecx
lea ecx, [esp + 0x100]
mov dword [esp + 0x18], 0xa18885c6
mov dword [esp + 0x18], edi
xor edi, edi
inc edi
push edi
call fcn.10016394
xor edx, edx
mov dword [esp + 0x20], 0xfffa
mov dword [esp + 0x1c], ebx
inc edx
jmp 0x10019398
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0x13e13a6c
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x10019382
cmp dword [esp + 0x18], ebx
je 0x100193b4
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x100]
mov dword [eax], ecx
mov dword [esp + 0x18], ebx
jmp 0x100193de
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x100]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x100193cb
lea ecx, [esp + 0x100]
call fcn.10016416
mov dword [esp + 0x20], 0x4f01c089
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001940c
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10019425
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
mov dword [esp + 0x28], 0xfffffffc
mov dword [esp + 0x24], 0xa1448afe
mov dword [esp + 0x30], 0xc2df100
mov dword [esp + 0x10], ebx
jmp 0x10019456
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x198], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10019443
mov dword [esp + 0x10], ebx
jmp 0x10019476
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1ac], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10019463
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], 3
jg 0x1001958a
mov esi, dword [esp + 0x7c]
xor edi, edi
push 2
lea ecx, [esp + 0x110]
call fcn.10016394
mov dword [esp + 0x1c], ebx
jmp 0x100194bc
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10c]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x100194a6
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x7c]
mov eax, dword [ecx + eax*4]
add eax, dword [ecx]
cmp eax, dword [ecx + edx*4]
jge 0x100194e1
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x19c], ebx
mov eax, dword [esp + 0x28]
test eax, eax
setns cl
xor edx, edx
mov dword [esp + 0x1b4], ecx
mov eax, dword [esp + 0x24]
add eax, ecx
mov ecx, dword [esp + 0x18]
cmp eax, dword [esi + 0xc]
mov eax, dword [esp + 0x7c]
setl dl
imul edx, dword [esi + 8]
mov dword [eax + ecx*4], edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
inc eax
je 0x10019542
lea edx, [edi + 1]
cmp dword [esp + 0x1b4], ebx
jne 0x10019544
mov edx, ebx
mov eax, dword [esp + 0x10c]
xor ecx, ecx
cmp edx, dword [eax]
sete cl
xor eax, eax
cmp ecx, 0x34d
setge al
mov dword [esp + 0x30], eax
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x10c]
mov dword [eax + 4], ecx
lea ecx, [esp + 0x10c]
call fcn.10016416
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x10019492
or dword [esp + 0x234], 0xffffffff
lea ecx, [esp + 0x7c]
call fcn.10016416
mov eax, dword [esp + 0x44]
mov al, byte [eax]
cmp al, 0x30
jl 0x100196e0
cmp al, 0x39
jg 0x100196e0
mov dword [esp + 0x18], 0xffffffff
xor ecx, ecx
mov dword [esp + 0x20], 0x3df603fa
inc ecx
mov dword [esp + 0x20], 7
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x100195ed
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1c4], 0x654fddd3
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jl 0x100195da
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x10]
sbb ecx, ecx
inc ecx
dec dword [esp + 0x10]
cmp eax, ecx
jl 0x10019621
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001969a
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1001969a
mov eax, 0x876a
mov dword [esp + 0x174], eax
mov dword [esp + 0x178], eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x180], eax
mov dword [esp + 0x10], 0x12
jmp 0x10019693
mov dword [esp + 0x18], ebx
jmp 0x10019681
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001966a
push 0x6550
push ebx
call fcn.1001995f
pop ecx
pop ecx
push 0x4128
push ebx
push 0xab5
call fcn.1001c44c
add esp, 0xc
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1a
jne 0x10019652
mov eax, dword [esp + 0x174]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x16
jge 0x1001964c
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100196b2
push ebx
push 0x7a42
call fcn.1001bdae
pop ecx
pop ecx
push 0x756a
lea eax, [esp + 0x48]
push eax
push 0x2964
lea eax, [esp + 0x6c]
push ebx
push eax
call fcn.100198c8
mov ecx, dword [esp + 0x58]
add esp, 0x14
mov esi, dword [esp + 0x64]
inc ecx
push 2
pop edi
jmp 0x10019096
push ebx
lea eax, [esp + 0x64]
push eax
push 0x3bf2
push 0x2f04
push 0x36be
call fcn.10021f1d
add esp, 0x14
jmp 0x1001888e
mov dword [esp + 0xc8], 0xffff
lea ecx, [esp + 0x1b8]
mov dword [esp + 0xb8], edi
xor eax, eax
mov dword [esp + 0x94], 0x884cb8f6
inc eax
mov dword [esp + 0xd4], ebx
mov dword [esp + 0xc0], ebx
mov dword [esp + 0xb0], 0x5a7ab5bf
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0xfffffff9
mov dword [esp + 0x20], 0x709e8e54
mov dword [esp + 0x20], 0xec1e183a
mov dword [esp + 0x20], 0x6eae1177
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0x1d9d65fe
mov dword [esp + 0x20], 0x900d2964
push 3
mov dword [esp + 0x24], 0xffffffff
pop eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 6
mov dword [esp + 0x20], 0x82b3f54c
mov dword [esp + 0x20], 0xfffffffc
push eax
call fcn.10016394
lea eax, [esp + 0x40]
mov dword [esp + 0x234], 7
push eax
lea eax, [esp + 0x1bc]
mov dword [esp + 0xb8], 0x23ff4914
push eax
push ebx
call fcn.100199dd
xor ecx, ecx
mov dword [esp + 0x4c], ebx
add esp, 0xc
inc ecx
jmp 0x1001980f
mov eax, dword [esp + 0x40]
mov dword [esp + eax*4 + 0x194], 0xf2ec2878
inc dword [esp + 0x40]
cmp dword [esp + 0x40], ecx
jl 0x100197fc
lea eax, [esp + 0xd4]
push eax
lea eax, [esp + 0xbc]
push eax
lea eax, [esp + 0xc8]
push eax
push ebx
lea eax, [esp + 0xd8]
push eax
lea eax, [esp + 0xa8]
push eax
lea eax, [esp + 0xc8]
push eax
push 0x6639
call fcn.1001b4ba
push 0x65b3
lea ecx, [esp + 0xd8]
push ecx
push ebx
call fcn.100220c5
add esp, 0x2c
lea ecx, [esp + 0x1b8]
call fcn.10016416
xor eax, eax
inc eax
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret