Function at 0x10018868
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
push edi
mov dword [ebp - 0x58], edx
xor ebx, ebx
push 2
mov dword [ebp - 0x28], 0x2c70bb74
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 8], ebx
pop edi
jmp 0x1001889c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x14c], 0xc75286e8
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1001888b
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], bl
je 0x100188c0
push 0x8ec
push 0x16f1
push ebx
push 0x4e0
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov eax, dword [ebp - 0x28]
neg eax
push 3
sbb eax, eax
inc eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x30], 0x5b9b55bb
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 8], ebx
pop esi
jmp 0x100188f9
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x64], 0x13923cc
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x100188eb
mov byte [ebp - 0x12], bl
push 1
pop edx
cmp byte [ebp - 0x12], bl
je 0x1001891a
push ebx
push edx
push 0x1222
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x60]
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
cmp eax, edx
jge 0x10018941
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x5c]
xor ecx, ecx
mov eax, dword [ebp - 0x5c]
cmp eax, 0x1639956a
setle cl
xor eax, eax
mov dword [ebp - 0x5c], ecx
test ecx, ecx
setne al
mov dword [ebp - 0x28], eax
mov eax, 0xffff
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x10], 0xd313dd33
mov dword [ebp - 0xc8], eax
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 4], ebx
jmp 0x1001899f
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x144], 0xfffffffd
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x1001898e
mov dword [ebp - 4], ebx
jmp 0x100189ba
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xe4], 7
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x100189a9
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0xffffffe2
jge 0x10018afc
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x1c], 0x1fcc1031
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ebx
jl 0x10018ae4
mov dword [ebp - 0x28], 0xfffffffd
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
cmp eax, 8
mov dword [ebp - 0x140], eax
setl cl
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
imul edx, dword [ebp + eax*4 - 0xc8]
mov eax, dword [ebp - 0xbc]
cmp eax, edx
mov eax, dword [ebp - 0xc]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setne dl
add edx, 0x4433ac25
imul edx, dword [ebp + eax*4 - 0xc8]
test edx, edx
jne 0x10018a55
mov eax, dword [ebp - 0xc]
cmp dword [ebp + eax*4 - 0xc8], ebx
jne 0x10018a55
mov ecx, ebx
jmp 0x10018a58
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0xffffffff
push 0
setne al
xor edx, edx
cmp eax, 0x28f0
mov eax, dword [ebp - 0xc]
setge dl
sub edx, 0xc4e7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0xc]
setne cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xc8]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setle dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0xc8]
cmp edx, eax
mov eax, dword [ebp - 0xc]
setle bl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xc8]
cmp eax, ebx
mov eax, dword [ebp - 0xc]
sete cl
pop ebx
add ecx, dword [ebp + eax*4 - 0xc8]
mov dword [ebp - 0xe4], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xe4]
cmp eax, 0x185f
setg cl
mov dword [ebp - 0x13c], ecx
dec dword [ebp - 0xc]
jns 0x100189e2
cmp dword [ebp - 0xe4], ebx
jne 0x10018af9
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe2
jl 0x100189cc
xor edx, edx
inc edx
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_ModifyMenuW]
mov dword [ebp - 0x28], 0xc58d4ccf
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x30], ebx
jmp 0x1001936d
mov dword [ebp - 0x10], 0x3e13a6c9
mov dword [ebp - 0xc], 0x457a23a
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x10018b41
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x88], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 4
jl 0x10018b34
mov dword [ebp - 4], ebx
jmp 0x10018b5d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1c8], 0xfffffff8
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10018b4c
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], 0
je 0x10018b7a
push ebx
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
xor edx, edx
inc edx
mov dword [ebp - 0x80], ebx
jmp 0x10018d34
mov dword [ebp - 4], edx
mov dword [ebp - 0x1c], 0x7778e10a
mov dword [ebp - 8], ebx
jmp 0x10018b9b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x48], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10018b91
mov eax, dword [ebp - 4]
xor ecx, ecx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0xfffb
setne cl
sub ecx, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
cmp eax, 0xadf1adb2
mov eax, dword [ebp - 4]
sbb ecx, ecx
sub eax, 0x72ca3c0b
neg ecx
neg eax
sbb eax, eax
inc eax
imul eax, ecx
test eax, eax
jne 0x10018bea
mov ecx, ebx
cmp dword [ebp - 0x84], ebx
je 0x10018bec
mov ecx, edx
xor eax, eax
cmp ecx, edx
setle al
cmp eax, dword [ebp - 0x80]
jl 0x10018c0f
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], 0
je 0x10018c85
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x10018c82
mov dword [ebp - 0x1c], ebx
xor edx, edx
mov dword [ebp - 0x18], 0x41b87000
mov dword [ebp - 0x1c], 0xfffffffe
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
setl dl
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
sub eax, 0xdf78
cmp eax, dword [ebp - 0x80]
jg 0x10018c46
cmp dword [ebp - 0x18], ebx
jne 0x10018c46
mov eax, ebx
jmp 0x10018c49
xor eax, eax
inc eax
mov edx, dword [ebp - 0x80]
sub edx, eax
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor edx, edx
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setne dl
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x80]
imul eax, eax, 0x3b03
mov dword [ebp - 0x48], eax
xor edx, edx
inc edx
mov dword [ebp - 0xc], 8
jmp 0x10018d24
mov dword [ebp - 0x24], 0xb60f
mov dword [ebp - 8], ebx
jmp 0x10018cae
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xd0], 0x7da9fc5c
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10018c9d
mov eax, edx
cmp dword [ebp - 0x48], ebx
jne 0x10018cbd
mov eax, ebx
mov edx, dword [ebp - 0x48]
xor ecx, ecx
imul edx, eax
mov eax, dword [ebp - 0x10]
cmp eax, edx
setle cl
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd0]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
imul eax, ecx, 0x3c66
test eax, eax
jne 0x10018cf6
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x48]
neg eax
push 1
sbb eax, eax
neg eax
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x1c], 0xfffffff7
inc dword [ebp - 0xc]
pop edx
cmp dword [ebp - 0xc], 0x1a
jge 0x10018c91
dec dword [ebp - 0x80]
push 1
pop edx
cmp dword [ebp - 0x80], 0xffffffed
jg 0x10018b82
mov dword [ebp - 0x6c], 0xffffffff
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x97412df3
mov dword [ebp - 0xc], 7
push 0xfffffffffffffffb
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x18], 0x89fff12f
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0xe6a0122d
mov dword [ebp - 8], ebx
jmp 0x10018d82
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x174], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x10018d75
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
sub ecx, eax
imul ecx, dword [ebp - 0x10]
test ecx, ecx
je 0x10018dae
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, 0xe446
sub ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setge bl
xor ecx, ecx
cmp ebx, eax
setle cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
add ecx, 0x3ee91f8c
mov dword [ebp - 0x168], ecx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 4]
jne 0x10018e09
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0x168]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov ecx, 0x15771
setne dl
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x68], 0xfffffffa
mov dword [ebp - 0xc], 0xe17c
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x4fc37f20
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x34], 0x19b20e95
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub ecx, eax
je 0x10018e7a
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
cmp eax, 0xc3a0
setle cl
xor ebx, ebx
cmp ecx, 0xadfb1af9
jb 0x10018ea6
cmp dword [ebp - 0xc], ebx
jne 0x10018ea6
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x10018eab
xor edx, edx
inc edx
mov ecx, edx
xor eax, eax
cmp ecx, edx
sete al
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
je 0x10018ef1
mov dword [ebp - 0x1c], 0x6a5b5cf0
mov dword [ebp - 8], ebx
jmp 0x10018ed7
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x154], 0x2079
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10018ec6
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
jmp 0x10019056
mov eax, 0x6cdee94c
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x1c], 0xa9b924e1
mov dword [ebp - 8], ebx
jmp 0x10018f2b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x1b0], 0x5f053d0c
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10018f1a
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], 0
je 0x10018f4c
push ebx
push ebx
push 0x1d28
push 0x1095
push ebx
call esi
xor edx, edx
inc edx
mov dword [ebp - 4], 0xffffffec
cmp dword [ebp - 4], 0xfffffffa
jg 0x10019056
mov esi, 0xffff
mov dword [ebp - 0x1c], 0x4b6d700d
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edx
jge 0x10018f8d
push 0xfffffffffffffffb
pop ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xdc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10018f7b
mov dword [ebp - 0xc], 0xc
jmp 0x10019002
mov dword [ebp - 0x10], 0x6e3268dd
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 3
jg 0x10018fc5
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], 0
je 0x10018fb9
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_EndDialog]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10018fa6
xor edx, edx
inc edx
cmp dword [ebp - 0x10], ebx
jne 0x10018ff2
mov eax, dword [ebp - 4]
mov ecx, ebx
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
je 0x10018ff4
mov ecx, edx
xor eax, eax
cmp ecx, 0xfffffffb
sete al
mov dword [ebp - 0x2c], eax
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xfffffff2
jg 0x10018f96
cmp dword [ebp - 0x24], ebx
je 0x10019010
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x2c]
cmp esi, eax
push 1
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x108]
cmp ecx, eax
setg dl
mov dword [ebp - 0x1ac], edx
mov eax, dword [ebp - 0xc]
imul eax, edx
pop edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffffa
jle 0x10018f62
mov esi, dword [sym.imp.USER32.dll_ModifyMenuW]
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], 0
je 0x10019067
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [ebp - 0x4c], 0xfffffff6
xor ecx, ecx
mov dword [ebp - 8], 0xcb457102
inc ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x20], 0x42b48371
mov dword [ebp - 0x20], 0x9acf2579
mov dword [ebp - 0x20], 0xa40f2fda
push 3
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0xc], ebx
pop edx
jmp 0x100190ac
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x180], 0xb3c692be
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x1001909b
mov dword [ebp - 0xc], ebx
jmp 0x100190c7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x130], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x100190b6
mov dword [ebp - 0xc], ebx
jmp 0x100190e2
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x128], 9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x100190d1
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], 2
jge 0x10019108
mov ecx, 0xffff
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xf4], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x100190f5
mov dword [ebp - 8], ebx
jmp 0x1001919e
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x20], 0x2eaa29c1
mov dword [ebp - 0x20], 0xfffffffe
mov dword [ebp - 0x20], 0x585ed065
mov dword [ebp - 0x20], 0x81479b69
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], 0xa0c8d467
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], 0xc00eadd5
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 4], ebx
jmp 0x10019168
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x21c], 0xfffffff6
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x10019157
mov dword [ebp - 4], ebx
jmp 0x10019183
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x200], 0x8770ce40
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x10019172
inc dword [ebp - 0xf0]
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x180], ebx
jne 0x100191a8
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x10019110
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x68]
push eax
push ebx
lea eax, [ebp - 0x4c]
push eax
push 0x7427
call fcn.1001c6ca
mov dword [ebp - 8], 3
xor ecx, ecx
mov dword [ebp - 0x34], 0x105a
add esp, 0x18
mov dword [ebp - 0x24], 0xbda73a15
inc ecx
mov dword [ebp - 8], ebx
jmp 0x100191ed
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x54], ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x100191e3
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], 0
je 0x1001920a
push ebx
push 0xd5b
call edi
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], 0xfffffffd
jg 0x100192ea
xor esi, esi
inc esi
mov dword [ebp - 0x2c], 0xffffffff
push 4
mov dword [ebp - 0x1c], 0x4aee
mov dword [ebp - 4], ebx
pop ecx
jmp 0x1001923d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1e8], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019230
mov dword [ebp - 4], ebx
jmp 0x10019258
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x124], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10019247
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
test eax, eax
je 0x1001929d
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
neg ecx
cmp dword [ebp - 0x34], eax
jne 0x1001927e
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x54]
add ecx, eax
mov eax, dword [ebp - 0x124]
cmp eax, ecx
mov ecx, esi
setne dl
cmp edx, dword [ebp - 0x1dc]
jne 0x1001929f
mov ecx, ebx
xor eax, eax
cmp ecx, 0x1d77f172
setne al
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x124], ebx
je 0x100192d4
mov eax, dword [ebp - 0x118]
cmp esi, eax
mov eax, dword [ebp - 0x24]
sbb edx, edx
xor ecx, ecx
inc edx
test eax, eax
setns cl
xor eax, eax
cmp ecx, edx
setge al
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x24], ebx
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffd
jle 0x1001921a
mov esi, dword [sym.imp.USER32.dll_ModifyMenuW]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], ebx
jne 0x10019303
cmp dword [ebp - 0x30], ebx
jne 0x10019303
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x68]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x6c]
setge cl
xor edx, edx
cmp ecx, 0x833e
setle dl
dec eax
neg eax
sbb eax, eax
inc eax
imul eax, edx
cmp eax, dword [ebp - 0x28]
je 0x1001934e
cmp dword [ebp - 0x28], ebx
je 0x1001934e
xor edx, edx
mov eax, ebx
inc edx
jmp 0x10019353
xor edx, edx
inc edx
mov eax, edx
cmp eax, dword [ebp - 0x30]
jg 0x1001935f
mov eax, ebx
cmp dword [ebp - 0x30], ebx
je 0x10019361
mov eax, edx
imul eax, eax, 0x4e31
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 6
jg 0x10018b1a
mov dword [ebp - 4], ebx
jmp 0x1001938d
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xd4], 0x57fd
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jl 0x1001937c
mov dword [ebp - 4], ebx
jmp 0x100193a8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xb8], 0xf5c184c5
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x10019397
mov dword [ebp - 0xb8], ebx
jmp 0x100193c9
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0xd4], ebx
inc dword [ebp - 0xb8]
cmp dword [ebp - 0xb8], edx
jl 0x100193b6
mov eax, dword [ebp - 0xb0]
xor ecx, ecx
cmp eax, 3
mov eax, dword [ebp - 0x3c]
setl cl
dec ecx
mov dword [ebp - 0xb8], ecx
cmp dword [eax + 0x10], ebx
jne 0x100193f5
xor al, al
jmp 0x10019f92
mov dword [ebp - 0x10], 0x1f94964a
mov dword [ebp - 4], 0x7921
mov dword [ebp - 0x18], 0x509b955
mov dword [ebp - 0xc], 0x99e1f953
mov dword [ebp - 8], 0xa9d707d8
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 8], ebx
jmp 0x10019438
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x98], 0x54668dac
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x10019427
mov eax, dword [ebp - 4]
mov ecx, edx
sub ecx, eax
add ecx, dword [ebp - 0x10]
jne 0x10019451
cmp dword [ebp - 0x10], ebx
jne 0x10019451
mov edx, ebx
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 4]
setl cl
xor edx, edx
cmp ecx, 0x2522
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x10]
setle cl
xor edx, edx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
sub ecx, dword [ebp - 4]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x8c], ecx
xor ecx, ecx
mov eax, dword [ebp - 4]
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x8c]
cmp eax, 0x1caf
setne cl
xor edx, edx
mov dword [ebp - 0xc], ecx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
add edx, 2
cmp edx, dword [ebp - 0x10]
jne 0x100194e8
mov eax, dword [ebp - 0xc]
imul edx, dword [ebp - 0x10], 0x67d
xor ecx, ecx
add edx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
cmp eax, edx
setge cl
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], 0x18
jl 0x10019716
xor edi, edi
inc edi
mov dword [ebp - 0x2c], 0x880e
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x10], 0xca0f9639
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], 0
je 0x1001953c
push ebx
push ebx
push 0x1d28
push 0x1095
push ebx
call esi
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], 3
jg 0x10019703
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x20], 0xb88b
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x2c], ebx
jle 0x10019593
mov edx, ebx
cmp dword [ebp - 0x34], ebx
je 0x10019595
mov edx, edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xc]
setg cl
xor edx, edx
cmp ecx, 0x22c2
setl dl
cmp edx, dword [ebp + eax*4 - 0x98]
jl 0x10019633
mov dword [ebp - 0x28], 0xd870
mov eax, dword [ebp - 0x28]
dec eax
je 0x100195fb
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x98]
cmp dword [ebp - 8], eax
jl 0x100195e0
mov eax, dword [ebp - 0xc]
mov ecx, ebx
cmp dword [ebp + eax*4 - 0x98], ebx
je 0x100195e2
mov ecx, edi
mov eax, 0x6174ed7b
sub eax, ecx
mov ecx, 0xda298b23
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, 0xffffffff
mov eax, edi
jbe 0x100195fd
mov eax, ebx
xor edx, edx
cmp eax, 0xfbba
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
mov dword [ebp + eax*4 - 0x98], edx
mov eax, dword [ebp - 0x24]
cmp edx, eax
sete cl
cmp ecx, dword [ebp - 0x18]
je 0x10019627
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x10019629
mov eax, edi
add eax, 0x1179
mov dword [ebp - 0x28], eax
jmp 0x10019681
mov dword [ebp - 0x10], ebx
jmp 0x10019649
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1f8], 0x74211fa8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10019638
cmp dword [ebp - 0x2c], ebx
je 0x10019657
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
add eax, 3
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0x98f9
xor ecx, ecx
cmp eax, 3
setne cl
sub ecx, dword [ebp - 0x1ec]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
xor edx, edx
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
xor eax, eax
test edx, edx
setg al
xor edx, edx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x98]
cmp eax, edi
mov eax, dword [ebp - 0x34]
sete dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 4]
jl 0x100196c5
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x24], ebx
xor edx, edx
mov eax, dword [ebp - 0xc]
push 0
mov ecx, dword [ebp + eax*4 - 0x98]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setle cl
mov dword [ebp - 0x20], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jle 0x10019549
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x18
jge 0x1001950f
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor esi, esi
mov dword [ebp - 8], ebx
inc esi
jmp 0x1001972c
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x50], 7
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x1001971e
mov dword [ebp - 0x50], ebx
jmp 0x1001987c
mov dword [ebp - 0x20], 0xb58e
mov dword [ebp - 0x44], 0xa77b
mov dword [ebp - 0xc], ebx
jmp 0x1001975d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x18c], 0x59e57ad9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001974c
mov dword [ebp - 0xc], ebx
jmp 0x10019779
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x228], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10019768
mov dword [ebp - 0xc], ebx
jmp 0x10019795
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x238], 0xffffffff
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10019784
mov dword [ebp - 0xc], ebx
jmp 0x100197b1
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xec], 0xde360abe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x100197a0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x184], eax
inc dword [ebp - 0xec]
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x10], 0xf6af1124
mov dword [ebp - 0x10], ebx
jmp 0x10019862
mov dword [ebp - 0x24], 0xd3f46721
mov dword [ebp - 8], ebx
jmp 0x100197f5
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x198], 0xfa75c19c
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x100197e4
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], ebx
jl 0x10019836
mov dword [ebp - 8], 0xfffffffd
mov dword [ebp - 8], 2
cmp dword [ebp - 8], ebx
jl 0x10019831
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x198], ecx
cmp dword [ebp - 8], ebx
jne 0x10019831
dec dword [ebp - 8]
jns 0x1001981a
dec dword [ebp - 0x24]
jns 0x10019807
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], 0
je 0x1001985f
push 0x1cbd
push ebx
push 0x16f2
push 0x11a5
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffa
jne 0x100197d8
cmp byte [ebp - 0x11], 0
je 0x10019879
push ebx
call fcn.1001a021
pop ecx
dec dword [ebp - 0x50]
cmp dword [ebp - 0x50], 0xfffffff8
jge 0x10019739
lea eax, [ebp - 0x58]
push eax
push 0x3b22
push 0x2987
push ebx
call fcn.10019fd7
mov dword [ebp - 0x10], 0xdc4b4e12
add esp, 0x10
mov dword [ebp - 4], 0xae77ab39
mov dword [ebp - 0x20], 0xdae9
mov dword [ebp - 0x44], 0xff5452fa
mov dword [ebp - 8], ebx
jmp 0x100198cf
cmp dword [ebp - 8], 4
jl 0x100198be
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret