Function at 0x1001755d
Capabilities:
Get common file path
Get geographical location
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x17c
push ebx
push esi
push edi
push 0xfffffffffffffffb
mov dword [ebp - 0x80], ecx
xor ebx, ebx
pop ecx
mov dword [ebp - 0x1c], ecx
xor esi, esi
mov dword [ebp - 0x1c], 2
inc esi
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0x55b7cefa
mov dword [ebp - 0x1c], 0xb5f0b101
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x68], edx
mov dword [ebp - 4], ebx
jmp 0x100175b5
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x13c], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x100175a8
inc dword [ebp - 0x18]
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 8], 0xb445acee
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x1c], 0xef407293
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x100175fe
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
cmp dword [ebp - 8], ebx
jne 0x1001760a
mov eax, dword [ebp - 8]
mov eax, ebx
jmp 0x1001760c
mov eax, esi
mov dword [ebp - 0x24], eax
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
cmp eax, ecx
setg dl
xor ecx, ecx
cmp edx, 0x28ab
setge cl
xor eax, eax
cmp ecx, 0xe5ec
setle al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
test eax, eax
mov eax, dword [ebp - 8]
sets cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 4]
setl bl
xor ecx, ecx
cmp ebx, eax
setne cl
cmp ecx, dword [ebp - 0x14]
je 0x10017668
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
xor edx, edx
imul ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp ecx, eax
setl dl
sub edx, 0xbc6e
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 4], edx
jne 0x10017695
xor ebx, ebx
cmp dword [ebp - 8], ebx
jne 0x10017697
mov eax, dword [ebp - 8]
jmp 0x10017697
xor ebx, ebx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x1c], 0xfffffff8
mov byte [ebp - 9], bl
cmp byte [ebp - 9], 0
je 0x100176c5
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov byte [ebp - 9], bl
cmp byte [ebp - 9], 0
je 0x100176db
push ebx
push ebx
push 0x1a4a
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x1c], 0x55b7cefa
mov dword [ebp - 4], 0x69fdf99f
mov dword [ebp - 4], 8
jmp 0x1001774d
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x1c], 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, 0xa073
mov eax, dword [ebp - 4]
setle bl
xor edx, edx
cmp ecx, eax
setle dl
add ebx, edx
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x1001774a
push ebx
push 0x1f9c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
je 0x100176ff
mov dword [ebp - 0x10], 0x63384304
mov dword [ebp - 4], 0xfffffff8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0xeded
mov dword [ebp - 8], ebx
jmp 0x1001777e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4c], 0x579253a3
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10017770
mov dword [ebp - 8], ebx
jmp 0x10017792
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x60], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10017788
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x60], eax
mov eax, 0x9035a60c
mov dword [ebp - 0x1c], 0xb5f0b101
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 4], 6
mov dword [ebp - 0x1c], 0xea0d018d
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0x8bc13026
mov dword [ebp - 4], ebx
jmp 0x10017837
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe4], 0xcca69919
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10017826
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setge dl
mov dword [ebp - 0x18], edx
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, esi
setle al
xor edx, edx
imul ecx, eax, 0x945c
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
mov dword [ebp - 0x18], edx
dec dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x20]
sub ecx, 0x6af8
neg ecx
sbb ecx, ecx
imul eax, dword [ebp - 4], 0xc869
inc ecx
sub eax, ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x1c], 0xd2038e85
mov dword [ebp - 4], ebx
jmp 0x100178cc
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x17c], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x100178bf
dec dword [ebp - 0x14]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x35
jl 0x100179cc
mov esi, dword [sym.imp.USER32.dll_GetDC]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], 9
mov dword [ebp - 4], ebx
jmp 0x1001790b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x124], 0xfffffffd
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x100178fa
mov dword [ebp - 0x10], ebx
jmp 0x100179b3
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
jl 0x100179b0
mov dword [ebp - 4], 0x6b471dfd
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], ebx
jl 0x1001799b
mov dword [ebp - 8], 2
mov dword [ebp - 8], ebx
jmp 0x10017991
mov byte [ebp - 9], bl
cmp byte [ebp - 9], 0
je 0x1001798e
push 0x1c02
push 0x1bcd
push 0x2176
push 0x176d
push 0x4e9
call edi
push eax
call esi
push eax
push 0x204a
push 0x24e3
push 0x1544
push 0xa8f
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_StretchBlt]
xor ecx, ecx
inc ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jle 0x10017943
dec dword [ebp - 4]
jns 0x10017937
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x24]
jns 0x10017928
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10017919
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x35
jge 0x100178eb
xor esi, esi
inc esi
push 3
mov dword [ebp - 4], ebx
pop ecx
jmp 0x100179e5
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x160], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100179d4
inc dword [ebp - 0x18]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0xc77dcda7
mov dword [ebp - 0x24], 0x3ea3
mov dword [ebp - 4], ebx
jmp 0x10017a21
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x16c], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10017a10
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 8]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], esi
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 8]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 8]
setne bl
xor ecx, ecx
cmp ebx, eax
setge cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x24]
xor ebx, ebx
mov dword [ebp - 0x10], 0x252cb136
mov dword [ebp - 4], ebx
jmp 0x10017aac
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x54], 0x342e
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10017a9e
mov dword [ebp - 0x10], ebx
jmp 0x10017c34
mov dword [ebp - 8], esi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x10017ada
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10017ad0
cmp dword [ebp - 0x34], ebx
jne 0x10017c3d
mov dword [ebp - 8], ebx
jmp 0x10017c28
mov dword [ebp - 4], ebx
jmp 0x10017b06
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x114], 0xf77d900d
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10017af5
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x34], ebx
je 0x10017b4b
cmp dword [ebp - 0x34], ebx
je 0x10017b4b
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
jmp 0x10017b41
mov dword [ebp - 4], 0x6c902daf
mov dword [ebp - 4], ebx
jmp 0x10017b38
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x54], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10017b2e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10017b22
jmp 0x10017c25
mov dword [ebp - 0x1c], 0x2718b962
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 4], ebx
jmp 0x10017b6f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xac], 0x8e548e01
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10017b5e
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
mov edx, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 8]
cmp eax, esi
setle cl
xor eax, eax
cmp ecx, edx
mov ecx, 0x7d02
setle al
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x54]
add ecx, eax
mov eax, dword [ebp - 0x34]
cmp eax, ecx
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x34]
cmp edx, eax
setge cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0xa8]
cmp dword [ebp - 0x18], eax
jle 0x10017bd5
mov ecx, esi
cmp dword [ebp - 0xac], ebx
jne 0x10017bd7
mov ecx, ebx
mov eax, dword [ebp - 0xa8]
xor edx, edx
cmp ecx, eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
setg dl
imul ecx, edx
xor edx, edx
mov dword [ebp + eax*4 - 0x34], ecx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
add ecx, 2
cmp ecx, 0xd9d6
setle al
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x1c], eax
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x10017af0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x10017aba
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x10017c4c
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 0x14], 0xa48bbca6
mov dword [ebp - 0x14], 0xfffffffb
jmp 0x10017c97
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 4], ebx
jmp 0x10017c79
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x90], 4
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10017c68
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffea
jle 0x10017c5c
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x10017cb5
push 0x411
push ebx
push ebx
push ebx
call esi
mov dword [ebp - 0x10], 0xffffffff
push 3
mov dword [ebp - 8], 0x9cc25fa
pop ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ebx
jmp 0x10017cdf
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x9c], 0x106ec6e5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10017cce
mov dword [ebp - 0x10], ebx
jmp 0x10017cfa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x104], 0xe9bd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x10017ce9
mov dword [ebp - 0x10], ebx
jmp 0x10017d16
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf4], 0xd5889e59
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10017d05
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
inc dword [ebp - 0x14]
cmp eax, ecx
je 0x10017d2d
xor eax, eax
inc eax
jmp 0x10017d2f
mov eax, ebx
mov dword [ebp - 0x10], 8
mov ecx, dword [ebp - 8]
sub ecx, eax
mov eax, dword [ebp - 8]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 8]
setle dl
sub eax, 0x49a2f381
neg eax
sbb eax, eax
inc eax
sub edx, eax
xor eax, eax
add edx, dword [ebp - 0x10]
cmp edx, 0xfffffffc
setl al
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], ebx
je 0x10017d7c
cmp dword [ebp - 0x10], ebx
je 0x10017d7c
xor ecx, ecx
inc ecx
jmp 0x10017d7e
mov ecx, ebx
mov eax, dword [ebp - 8]
sub ecx, eax
je 0x10017d88
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, dword [ebp - 0x10]
cmp eax, 0x947e29ac
mov eax, dword [ebp - 0x14]
setne cl
sub edx, ecx
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x9c]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
imul eax, ecx, 0x634
mov dword [ebp - 0x9c], ecx
test eax, eax
je 0x10017dd5
cmp dword [ebp - 0x10], ebx
je 0x10017dd5
xor edx, edx
inc edx
jmp 0x10017dd7
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 8]
jl 0x10017de9
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
neg eax
cmp eax, dword [ebp - 0x14]
je 0x10017e07
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x10017e37
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x10017e37
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x10017e2b
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x11c], 1
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10017e1a
inc dword [ebp - 0xf0]
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xbc795c38
mov dword [ebp - 0x1c], 0x8968f25c
mov dword [ebp - 8], 0x17
jmp 0x10017f02
mov dword [ebp - 0x24], ebx
xor edx, edx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 0xfffffffb
mov dword [ebp - 0x18], 1
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
mov dword [ebp - 4], edx
mov dword [ebp - 4], ebx
jmp 0x10017ef9
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x1c], 0x42b6
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jne 0x10017e9a
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
je 0x10017eba
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
je 0x10017ecc
cmp dword [ebp - 0x18], ebx
je 0x10017ecc
xor eax, eax
inc eax
jmp 0x10017ece
mov eax, ebx
cmp eax, dword [ebp - 0x14]
jle 0x10017edc
cmp dword [ebp - 8], ebx
jne 0x10017edc
mov ecx, ebx
jmp 0x10017edf
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x14]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff0
jge 0x10017e81
dec dword [ebp - 8]
cmp dword [ebp - 8], 9
jge 0x10017e58
push 0xfffffffffffffffb
mov eax, 0x3c692bea
pop ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], 0xc930f888
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], ebx
jmp 0x10018118
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 8], 7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sete dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x44]
cmp eax, edx
setg cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x44], ebx
je 0x10017fa8
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x44], ebx
je 0x10017fa8
xor edx, edx
inc edx
jmp 0x10017faa
mov edx, ebx
mov dword [ebp - 0x14], 0xfffffff6
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x10]
setne cl
xor edx, edx
test ecx, ecx
setg dl
add edx, dword [ebp + eax*4 - 0x44]
mov dword [ebp - 0x24], edx
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
imul eax, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 8]
sub eax, 0xfffffffc
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
mov eax, dword [ebp - 0x10]
setne cl
cmp ecx, dword [ebp + eax*4 - 0x44]
jne 0x1001800e
cmp dword [ebp - 0x44], ebx
je 0x1001800e
xor eax, eax
inc eax
jmp 0x10018010
mov eax, ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ebx
jl 0x10018115
or eax, 0xffffffff
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0x20], 0xfd77138
mov dword [ebp - 0x1c], 0x5ea98998
mov dword [ebp - 0x20], 0x535f447f
mov dword [ebp - 4], ebx
jmp 0x10018069
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x100], 0x3df1c911
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10018058
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0xd4a52d86
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf8]
neg eax
sbb eax, eax
neg eax
add eax, 0xa
imul eax, dword [ebp - 0x18]
test eax, eax
jne 0x100180ca
cmp dword [ebp - 0x3c], ebx
jne 0x100180ca
cmp dword [ebp - 0x1c], ebx
jne 0x100180ca
mov eax, ebx
jmp 0x100180cd
xor eax, eax
inc eax
mov edx, dword [ebp - 0x44]
add edx, eax
mov eax, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x44]
neg edx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0xf8], ecx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 8]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0x89a43d54
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
dec dword [ebp - 0x14]
jns 0x10018023
inc dword [ebp - 0x10]
xor edx, edx
cmp dword [ebp - 0x10], 3
jle 0x10017f38
mov dword [ebp - 0x1c], 2
inc edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0xd0374c7a
mov dword [ebp - 8], 0xcc099a56
mov dword [ebp - 0x14], 0xe3580d4
mov eax, dword [ebp - 0x14]
sub eax, 0x3c8e79b
jne 0x1001815d
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
add eax, 0x4c20f746
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0x15
jg 0x100182a6
mov dword [ebp - 0x20], 0x81de9829
mov ecx, 0xf2bf5804
mov dword [ebp - 0x18], 0x51fe511b
xor edx, edx
mov dword [ebp - 0x24], 0xf80366e5
mov dword [ebp - 0x1c], 0xc705
mov eax, dword [ebp - 0x14]
sub ecx, eax
add ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setl bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor ebx, ebx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], 0xffffffea
jl 0x10018296
mov dword [ebp - 4], ebx
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setne dl
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x1a69
jle 0x100181f7
cmp dword [ebp - 4], ebx
je 0x100181f7
xor ecx, ecx
inc ecx
jmp 0x100181f9
mov ecx, ebx
mov eax, dword [ebp - 4]
sub ecx, eax
mov eax, dword [ebp - 8]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
xor ecx, ecx
add edx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setl cl
cmp ecx, 1
ja 0x1001822a
cmp dword [ebp - 4], ebx
je 0x1001822a
xor eax, eax
inc eax
jmp 0x1001822c
mov eax, ebx
mov ecx, 0xbffaef17
cmp ecx, eax
mov eax, dword [ebp - 4]
push 0
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 4]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 4]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setle cl
cmp ecx, 0x833e1abb
sbb eax, eax
neg eax
sub eax, 0x3922
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffea
jge 0x100181d1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
jle 0x10018178
xor edx, edx
inc edx
mov dword [ebp - 0x1c], 7
mov dword [ebp - 8], edx
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x20], ebx
mov dword [ebp - 8], 0xfffffffb
cmp dword [ebp - 8], 0x11
je 0x100183e7
mov dword [ebp - 4], 0xdfbd6c3f
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x14], ebx
jmp 0x100182e8
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100182de
mov eax, dword [ebp - 4]
cmp dword [ebp - 8], 0xc502
jle 0x10018335
mov eax, dword [ebp - 8]
imul eax, dword [ebp - 8]
cmp eax, 0x94e8fe75
je 0x1001830e
mov eax, ebx
cmp dword [ebp - 4], ebx
je 0x10018310
mov eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
inc eax
neg eax
sbb eax, eax
inc eax
neg eax
jne 0x10018327
mov ecx, ebx
cmp dword [ebp - 8], ebx
je 0x10018329
mov ecx, edx
mov eax, dword [ebp - 4]
imul eax, ecx
mov ecx, edx
test eax, eax
jne 0x10018337
mov ecx, ebx
mov eax, dword [ebp - 4]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 4]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x10], ebx
jmp 0x100183d2
mov dword [ebp - 0x1c], 0x8cb5c746
cmp dword [ebp - 0x10], ebx
je 0x10018371
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
jne 0x10018391
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x2c], ebx
je 0x10018398
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x2c]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
sub edx, dword [ebp + eax*4 - 0x2c]
je 0x100183b4
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x2c], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001835e
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x11
push 1
pop edx
jne 0x100182cb
mov dword [ebp - 8], 0xb445acee
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], 0xfffffffd
mov dword [ebp - 0x1c], 0xef407293
mov byte [ebp - 9], bl
cmp byte [ebp - 9], 0
je 0x1001841f
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
xor edi, edi
inc edi
cmp dword [ebp - 8], ebx
jne 0x1001842e
mov eax, dword [ebp - 8]
mov eax, ebx
jmp 0x10018430
mov eax, edi
mov dword [ebp - 0x18], eax
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
cmp eax, ecx
setg dl
xor ecx, ecx
cmp edx, 0x28ab
setge cl
xor eax, eax
cmp ecx, 0xe5ec
setle al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 8]
test eax, eax
mov eax, dword [ebp - 8]
sets cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 4]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl bl
xor ecx, ecx
cmp ebx, eax
setne cl
cmp ecx, dword [ebp - 4]
je 0x1001848c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 4]
xor edx, edx
imul ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
setl dl
sub edx, 0xbc6e
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
jne 0x100184b9
xor ebx, ebx
cmp dword [ebp - 8], ebx
jne 0x100184bb
mov eax, dword [ebp - 8]
jmp 0x100184bb
xor ebx, ebx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 8], ebx
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0xc77dcda7
mov dword [ebp - 0x24], 0x3ea3
mov dword [ebp - 4], ebx
jmp 0x100184ff
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x154], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x100184ee
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 8]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], edi
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
cmp ecx, eax
mov eax, dword [ebp - 8]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 8]
setne bl
xor ecx, ecx
cmp ebx, eax
setge cl
xor ebx, ebx
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 0xfffffff8
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x1001858a
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x1001859f
push ebx
push ebx
push 0x1a4a
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov dword [ebp - 0x1c], edi
mov eax, 0x70004ddc
mov dword [ebp - 0x1c], 0x55b7cefa
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 0xe62b5609
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], eax
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x4071e994
mov dword [ebp - 0x1c], 0xa0b2b040
mov dword [ebp - 4], ebx
jmp 0x100185f4
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x28], 0xadf1adb2
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x100185e6
mov eax, ebx
cmp dword [ebp - 0x28], ebx
je 0x10018602
mov eax, edi
mov dword [ebp - 0x18], eax
xor edx, edx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xfffe
setg cl
cmp eax, ecx
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle bl
xor ecx, ecx
cmp ebx, eax
setne cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
cmp edi, eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov ecx, edi
setge dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, edi
sete al
cmp eax, dword [ebp - 0x28]
jl 0x10018699
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
add eax, 0xfa4a
add eax, ecx
neg eax
sbb eax, eax
neg eax
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
jmp 0x100186c7
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x64], 0x94801897
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x100186b9
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x100186e6
push 0x23e1
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 0x1c], 0xb5f0b101
mov dword [ebp - 4], 0x69fdf99f
mov dword [ebp - 4], 8
jmp 0x1001874b
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x1c], 4
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, 0xa073
mov eax, dword [ebp - 4]
setle bl
xor edx, edx
cmp ecx, eax
setle dl
add ebx, edx
mov dword [ebp - 0x1c], ebx
xor ebx, ebx
mov byte [ebp - 9], bl
cmp byte [ebp - 9], bl
je 0x10018748
push ebx
push 0x1f9c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
je 0x100186fd
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x10], 0x63384304
mov dword [ebp - 4], 0xfffffff8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], 0xeded
mov dword [ebp - 8], ebx
jmp 0x10018783
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x48], 0x579253a3
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x10018775
mov dword [ebp - 8], ebx
jmp 0x10018797
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x6c], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1001878d
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x10], 0x252cb136
mov dword [ebp - 4], ebx
jmp 0x100187f8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x5c], 0x342e
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x100187ea
mov dword [ebp - 0x10], ebx
jmp 0x10018980
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x10018826
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x30], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x1001881c
cmp dword [ebp - 0x30], ebx
jne 0x10018989
mov dword [ebp - 8], ebx
jmp 0x10018974
mov dword [ebp - 4], ebx
jmp 0x10018852
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x10c], 0xf77d900d
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10018841
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x30], ebx
je 0x10018897
cmp dword [ebp - 8], ebx
jle 0x1001883c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10018806
mov byte [ebp - 9], bl
cmp byte [ebp - 9], 0
je 0x10018999
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov dword [ebp - 4], edi
mov eax, 0x9035a60c
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x20], 0xea0d018d
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], 0x8bc13026
mov dword [ebp - 0x14], ebx
jmp 0x100189f0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xe8], 0xcca69919
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100189df
mov ecx, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 4]
cmp ecx, eax
setge dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
cmp eax, ecx
setg dl
xor eax, eax
cmp edx, edi
setle al
xor edx, edx
imul ecx, eax, 0x945c
mov eax, dword [ebp - 4]
cmp ecx, eax
setg dl
mov dword [ebp - 0x20], edx
dec dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
imul ecx, dword [ebp - 8]
sub ecx, 0x6af8
neg ecx
sbb ecx, ecx
imul eax, dword [ebp - 0x24], 0xc869
inc ecx
sub eax, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0x860b
mov dword [ebp - 0x20], 5
mov dword [ebp - 4], ebx
jmp 0x10018a82
cmp dword [ebp - 4], edi
jl 0x10018a75