Function at 0x10018cf8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0
mov dword [ebp - 0x9c], edx
xor edx, edx
mov dword [ebp - 0x24], 0xc2e0cf57
mov byte [ebp - 5], dl
mov dword [ebp - 0xa4], ecx
cmp byte [ebp - 5], dl
je 0x10018d31
push 0x1caf
push 0x1af
push edx
call dword [sym.imp.USER32.dll_InflateRect]
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018d47
push 0x11cb
call dword [sym.imp.USER32.dll_MessageBeep]
xor edx, edx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x24], 0xa049fe38
push esi
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
push edi
je 0x10018d7a
push 0xd8
push edx
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_Polyline]
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018d98
push edx
push edx
push 0x6bc
push 0x1cc0
push edx
call dword [sym.imp.USER32.dll_InsertMenuA]
xor edx, edx
mov dword [ebp - 0x10], 4
xor edi, edi
mov dword [ebp - 4], 0x357257ea
inc edi
mov dword [ebp - 0x18], 0x6903
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], edx
jmp 0x10018dca
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 0x40d7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x10018dbc
mov dword [ebp - 0x10], edx
jmp 0x10018eda
mov dword [ebp - 0x20], 0x919c
mov dword [ebp - 0x14], edx
jmp 0x10018df0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1a4], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10018de3
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x30]
test eax, eax
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x30]
cmp edx, eax
setg cl
cmp ecx, 0xfffffffc
mov dword [ebp - 0x1a0], ecx
mov eax, dword [ebp - 0x10]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 4], ecx
mov dword [ebp - 4], edx
jmp 0x10018ece
mov dword [ebp - 0xc], edx
push 3
mov dword [ebp - 0x1c], 0xfcb44481
pop ecx
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], edx
jl 0x10018ebd
mov dword [ebp - 0x14], edx
jmp 0x10018e75
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x104], 0x84902314
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x10018e64
mov dword [ebp - 0xfc], edx
jmp 0x10018eb0
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x19c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xfc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], 0x6f9a4d91
inc dword [ebp - 0xfc]
cmp dword [ebp - 0xfc], ecx
jle 0x10018e83
dec dword [ebp - 0xc]
jns 0x10018e5f
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x30], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x10018e4a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x10018dd7
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edx
jl 0x10018f0e
mov dword [ebp - 0x10], edi
mov eax, dword [ebp - 0x10]
neg eax
je 0x10018ef8
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], 0xfeac8e4c
dec dword [ebp - 4]
jns 0x10018eeb
mov dword [ebp - 0x10], 0xfffffff9
mov dword [ebp - 4], 0xe0648261
mov dword [ebp - 0xc], edx
jmp 0x10018f32
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x184], 0xfffffff6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x10018f21
mov dword [ebp - 4], edx
jmp 0x10018f52
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018f4f
push edx
push edx
call dword [sym.imp.USER32.dll_CopyRect]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x17
jl 0x10018f3c
mov dword [ebp - 4], edx
jmp 0x1001903e
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], edx
jl 0x1001903b
mov dword [ebp - 0x18], 0x5f5b1b6f
mov dword [ebp - 0xc], edx
jmp 0x10018f90
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc0], 0xfffffff7
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10018f7f
mov dword [ebp - 0xbc], edx
jmp 0x10018ffd
mov dword [ebp - 0x14], 0xdf3d37a5
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], edx
jl 0x10018ff7
mov dword [ebp - 0xc], 0xc2e7ccc8
mov dword [ebp - 0xc], edx
jmp 0x10018fed
mov dword [ebp - 0x18], 0x8e9646b8
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], edx
jl 0x10018fea
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10018fe5
push edx
push 0x2166
push 0xb04
push edx
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
xor edx, edx
dec dword [ebp - 0x18]
jns 0x10018fc8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jle 0x10018fb9
dec dword [ebp - 0x14]
jns 0x10018fad
inc dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], edx
jle 0x10018f9e
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], edx
jl 0x10019032
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x1001902d
push edx
push edx
push 0x1371
push 0x513
call ebx
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
xor edx, edx
dec dword [ebp - 0x18]
jns 0x1001900d
dec dword [ebp - 0x10]
jns 0x10018f73
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x10018f60
mov dword [ebp - 0xc], 6
mov dword [ebp - 4], edi
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], edx
jmp 0x1001906a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x98], 0xfff8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10019059
mov dword [ebp - 4], edx
jmp 0x10019120
mov dword [ebp - 0x10], 0x6df37d45
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x10], edx
jmp 0x10019114
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x18], 0xeafb5d1c
mov dword [ebp - 0xc], edx
jmp 0x100190ae
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xd4], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x100190a1
mov dword [ebp - 0x14], 0x2524
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], edx
jne 0x100190c8
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x10], edx
jne 0x100190d0
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, edx
cmp dword [ebp - 0x18], edx
je 0x100190e5
mov eax, edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x98], ecx
lea eax, [ecx + 0xaa12]
mov dword [ebp - 0xd4], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x1001908e
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jle 0x10019078
mov dword [ebp - 0x14], edx
jmp 0x10019162
mov dword [ebp - 4], edx
jmp 0x10019159
mov dword [ebp - 0x10], 0x4e1054d8
mov dword [ebp - 0x10], edx
jmp 0x10019150
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x98], 0x2c78
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001913f
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xffffffe8
jle 0x10019133
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe2
je 0x1001912e
mov dword [ebp - 0x20], 0x664087a9
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x20], 0xfffffff8
push 9
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 4], edx
pop ecx
jmp 0x10019196
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x50], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001918c
mov dword [ebp - 4], edx
jmp 0x100191af
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x38], 0xc45cdbe8
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x100191a1
mov dword [ebp - 0x34], edx
cmp dword [ebp - 0x34], edi
jg 0x100193af
mov eax, 0x949f4ffc
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 4], 0xfaa0
mov dword [ebp - 0xc], edx
jmp 0x100191f8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x60], 0x10b999fb
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x100191ea
mov dword [ebp - 0x5c], edx
jmp 0x10019302
mov dword [ebp - 0x20], 0x23f1
mov dword [ebp - 0x18], 3
mov dword [ebp - 0xc], edx
jmp 0x1001922a
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x160], 5
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10019219
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019240
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov eax, dword [ebp - 0x160]
xor ecx, ecx
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x158]
test eax, eax
mov eax, dword [ebp - 0x38]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x5c]
setl dl
imul eax, edx
cmp dword [ebp - 0x20], eax
jl 0x10019278
cmp dword [ebp - 0x160], 0
jne 0x10019278
xor edx, edx
jmp 0x1001927a
mov edx, edi
mov eax, dword [ebp - 0x160]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x50]
setne cl
xor edx, edx
cmp ecx, 8
setne dl
imul eax, edx
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x100192a8
cmp dword [ebp - 0x5c], 0
je 0x100192a8
mov edx, edi
jmp 0x100192aa
xor edx, edx
mov esi, dword [ebp - 0x5c]
xor ecx, ecx
mov dword [ebp - 0xb4], esi
mov eax, dword [ebp - 0x34]
cmp edx, eax
mov eax, dword [ebp - 0x34]
setle cl
xor edx, edx
add ecx, 0x74db503b
cmp ecx, eax
setl dl
cmp esi, edx
jl 0x100192dc
xor edx, edx
cmp dword [ebp - 0x38], edx
je 0x100192de
mov eax, edi
jmp 0x100192e0
xor edx, edx
mov eax, edx
imul eax, eax, 0xd482
cmp eax, dword [ebp - 0x50]
jl 0x100192f2
mov ecx, edi
cmp dword [ebp - 0x50], edx
jne 0x100192f4
mov ecx, edx
xor eax, eax
cmp ecx, 0xffffffff
sete al
mov dword [ebp - 4], eax
inc dword [ebp - 0x5c]
cmp dword [ebp - 0x5c], edi
jle 0x10019206
mov dword [ebp - 4], edx
cmp dword [ebp - 4], edi
jg 0x10019398
mov dword [ebp - 0x18], 0xb3176a17
xor edx, edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setg dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x18]
inc eax
cmp eax, ecx
setle dl
xor ecx, ecx
cmp edx, 0x8509
setle cl
xor edx, edx
sub ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x38]
add ecx, 0xfffffffd
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setle dl
sub edx, eax
mov eax, dword [ebp - 0xb4]
dec eax
add eax, edx
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jle 0x10019317
xor edx, edx
inc dword [ebp - 0x34]
mov eax, 0x949f4ffc
cmp dword [ebp - 0x34], edi
jle 0x100191c6
mov esi, dword [sym.imp.USER32.dll_GetDC]
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
push 0
pop eax
sete al
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], edx
jmp 0x100195d3
mov dword [ebp - 0xc], 0x8d4081c2
mov dword [ebp - 0x20], 0x5e1abe8f
mov dword [ebp - 0xc], edx
jmp 0x100193e6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x78], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x100193dc
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], edx
jl 0x10019423
mov dword [ebp - 4], edx
mov dword [ebp - 4], edx
jmp 0x10019419
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + eax*4 - 0x78]
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x78], ecx
mov eax, dword [ebp - 0xc]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 4], edx
jne 0x1001941e
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x100193fb
dec dword [ebp - 0xc]
jns 0x100193f3
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], edx
jne 0x1001947b
mov dword [ebp - 4], edx
jmp 0x10019454
cmp byte [ebp - 5], 0
je 0x10019451
push edx
push 0x23f1
push edx
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x13
mov byte [ebp - 5], dl
jl 0x10019436
cmp byte [ebp - 5], 0
je 0x100194b3
push edx
call ebx
push eax
call esi
push eax
push 0
push 0x15bc
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
xor edx, edx
jmp 0x100194b3
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0xc], edx
jmp 0x10019498
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x180], 9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10019487
mov eax, dword [ebp - 0x180]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], edx
jmp 0x100194c9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x150], 0xffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x100194b8
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xc], 2
cmp dword [ebp - 0xc], edx
jl 0x100195d0
mov dword [ebp - 4], edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019532
push 0x905
push 0x1d7c
push 0x1e18
push 0x25a1
push 0x3b4
call ebx
push eax
call esi
push eax
push 0x1eed
push 0x1549
push 0xb46
push 0x1e1d
call ebx
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
xor edx, edx
mov dword [ebp - 4], edx
jmp 0x100195bd
mov dword [ebp - 0x20], 0xad7d
mov dword [ebp - 0x1c], 5
mov eax, dword [ebp - 0x10]
sub eax, 0xc131
jne 0x10019558
mov eax, dword [ebp - 0x150]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
inc ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x150]
cmp edx, eax
setne cl
cmp dword [ebp - 0x20], ecx
jge 0x1001958b
cmp dword [ebp - 4], 0
je 0x1001958b
mov edx, edi
jmp 0x1001958d
xor edx, edx
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x150]
cmp eax, edx
setne cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x100195ba
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor edx, edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jle 0x1001953a
dec dword [ebp - 0xc]
jns 0x100194e5
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jne 0x100193c9
or eax, 0xffffffff
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x20], 0xa9bca7b5
mov dword [ebp - 0x10], 0x639e
mov dword [ebp - 0x14], edx
mov dword [ebp - 0xc], edx
jmp 0x10019626
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x134], 0xc8d3c891
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10019615
inc dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x134]
mov ecx, edi
sub ecx, eax
mov eax, dword [ebp - 0x20]
cmp eax, ecx
push 0xfffffffffffffffd
setl dl
xor ecx, ecx
cmp edx, 5
pop esi
setg cl
xor edx, edx
imul ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp dword [ebp - 0x14], ecx
jle 0x10019676
mov dword [ebp - 0x1c], esi
dec dword [ebp - 0x1c]
jmp 0x10019739
mov dword [ebp - 0x1c], 0xfffffffb
xor ecx, ecx
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 4], ecx
jmp 0x1001969c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x144], 0xb9cc5119
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1001968b
mov dword [ebp - 4], ecx
jmp 0x100196b8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1d4], 9
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x100196a7
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ecx
jne 0x10019706
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0xc8]
cmp eax, ecx
setg dl
xor ecx, ecx
imul eax, edx, 0xea6c
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x130], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setne cl
mov dword [ebp - 0x140], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x10], ecx
jne 0x1001971e
mov edx, ecx
cmp dword [ebp - 0x20], ecx
je 0x10019720
mov edx, edi
mov dword [ebp - 0xc4], edx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x1cc], ecx
mov dword [ebp - 0x20], 0x15aa961
xor edx, edx
push 9
pop eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 3
mov dword [ebp - 0x14], 0xffff
mov dword [ebp - 4], edx
jmp 0x1001976c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x11c], 0xff606579
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1001975b
mov dword [ebp - 4], edx
jmp 0x10019788
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x124], 0xb8914be
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10019777
cmp dword [ebp - 0x11c], edx
je 0x100197ec
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], 0xdf6f9781
mov dword [ebp - 0xc], edx
jmp 0x100197af
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x48], esi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x100197a5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x114]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x11c]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
jmp 0x100198f7
mov dword [ebp - 4], 0xfffb
mov dword [ebp - 0x28], 0x5e148cb4
mov dword [ebp - 0xc], edx
jmp 0x1001980d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x74], 0xe474c77a
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x100197ff
cmp dword [ebp - 4], edx
je 0x1001982f
mov eax, dword [ebp - 0x124]
mov ecx, 0xd5d909cc
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 4]
mov eax, edi
jg 0x10019831
mov eax, edx
imul eax, eax, 0xfffffffa
push 9
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp dword [ebp - 4], 0xfcd4d338
sbb eax, eax
neg eax
sub dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 4]
je 0x100198ad
mov dword [ebp - 0x14], 0xfffffff1
jmp 0x100198a6
mov dword [ebp - 0x28], 0x95c3c62e
mov dword [ebp - 0xc], edx
jmp 0x10019894
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1c4], 0xfffffff9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10019883
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jg 0x10019877
jmp 0x100198dc
mov dword [ebp - 0x28], 0xdeab2dd2
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x100198c2
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, dword [ebp - 0x74]
xor edx, edx
mov dword [ebp - 0x74], esi
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
cmp eax, ecx
setl dl
add edx, esi
mov dword [ebp - 0x28], edx
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x100198f7
push 0x518
push 0x185a
call dword [sym.imp.KERNEL32.dll_Beep]
xor edx, edx
mov dword [ebp - 0x14], 0x638ecf54
mov dword [ebp - 0xc], edi
mov dword [ebp - 0xc], edx
jmp 0x10019914
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x68], 3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10019906
mov edi, dword [sym.imp.GDI32.dll_IntersectClipRect]
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x1001994b
push 0x68c
push 0xdd5
push 0xc81
push 0x48d
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
xor edx, edx
mov esi, dword [sym.imp.USER32.dll_SetScrollPos]
xor ecx, ecx
mov dword [ebp - 0x14], edx
inc ecx
jmp 0x10019a4f
mov dword [ebp - 0x10], 0x30722263
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x68], edx
jne 0x10019a58
mov dword [ebp - 0x10], edx
jmp 0x10019a43
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], edx
jl 0x10019a40
mov dword [ebp - 4], 0xfffffff8
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], edx
jmp 0x10019a07
cmp dword [ebp - 4], edx
jne 0x100199f4
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
neg edx
sbb edx, edx
neg edx
mov eax, dword [ebp + eax*4 - 0x68]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x68]
sub ecx, eax
add ecx, dword [ebp - 4]
mov eax, dword [ebp - 4]
sub ecx, dword [ebp + eax*4 - 0x68]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setge cl
cmp ecx, 2
sbb eax, eax
xor ecx, ecx
neg eax
inc ecx
cmp eax, ecx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x68]
jl 0x100199eb
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp dword [ebp - 0x1c], edx
jne 0x100199f4
mov ecx, edx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x68]
imul eax, ecx
xor ecx, ecx
mov dword [ebp - 0xc], eax
inc dword [ebp - 4]
inc ecx
cmp dword [ebp - 4], ecx
jle 0x1001999a
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], edx
jl 0x10019a37
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10019a2f
push edx
push 0x61e
push 0x13b3
call ebx
push eax
call esi
xor edx, edx
dec dword [ebp - 0xc]
jns 0x10019a14
xor ecx, ecx
inc ecx
dec dword [ebp - 0x18]
jns 0x1001998b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10019978
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x1001995c
mov dword [ebp - 0x14], 0xda439beb
mov dword [ebp - 0x24], 0xe2a8d3a1
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0xfffffff9
mov dword [ebp - 0x54], 0xfffffffc
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0x6954eb85
mov dword [ebp - 0x1c], 0xfe98d7e9
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x10], edx
jmp 0x10019aa8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x12c], 0xbca6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10019a97
mov dword [ebp - 0x10], edx
jmp 0x10019ac4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x16c], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10019ab3
mov dword [ebp - 0x10], edx
jmp 0x10019ae0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1b4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10019acf
mov dword [ebp - 0x14], edx
jmp 0x10019bd7
mov dword [ebp - 0x18], 0x1bc383c6
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x18], 0xf4f23013
mov dword [ebp - 0x18], 0xd7af2c9a
mov dword [ebp - 4], edx
jmp 0x10019b27
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x90], 0xdb8faaae
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10019b16
mov dword [ebp - 4], edx
jmp 0x10019b43
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x164], 0x4ff5452f
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019b32
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x12c]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x12c], ecx
xor ecx, ecx
inc ecx
mov dword [ebp - 0x8c], ecx
cmp dword [ebp - 0x8c], edx
jl 0x10019bd4
mov dword [ebp - 0x18], 0x55950707
mov dword [ebp - 0x18], 0xa4c5706b
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], edx
jmp 0x10019b94
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1e0], 0xf3b8cff2
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10019b83
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], edx
jl 0x10019bcc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x10019aee
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1c], 5
mov dword [ebp - 0xc], 0xfffffffc
mov dword [ebp - 4], edx
jmp 0x10019c1c
cmp dword [ebp - 4], 4
jl 0x10019c0b