Function at 0x10018a99
Capabilities:
Create thread

Disassembly:
mov eax, 0x10085692
call fcn.10084c94
sub esp, 0x190
mov dword [ebp - 0x9c], edx
xor edx, edx
mov dword [ebp - 0x8c], ecx
mov dword [ebp - 0x14], edx
jmp 0x10018aca
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40], 3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10018abc
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push esi
push edi
push 0xfffffffffffffffd
pop edi
push 2
mov dword [ebp - 0x40], 5
pop esi
jmp 0x10018b94
mov dword [ebp - 0x14], 0xfffffffe
xor ecx, ecx
mov dword [ebp - 0x38], 0xfffffff7
mov dword [ebp - 0x2c], edi
mov eax, dword [ebp - 0x14]
cmp eax, 1
mov eax, dword [ebp - 0x40]
setg cl
sub ecx, eax
mov eax, dword [ebp - 0x14]
imul eax, ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, ecx
mov ecx, 0xc4b7c700
cmp ecx, eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x40], eax
jne 0x10018b7b
mov dword [ebp - 0x14], edx
jmp 0x10018b4e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x19c], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10018b3d
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x2c], edx
jl 0x10018b8e
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10018b74
push 0x1e25
push edx
push edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
xor edx, edx
dec dword [ebp - 0x2c]
jns 0x10018b5c
jmp 0x10018b8e
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10018b8e
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_EndPaint]
inc dword [ebp - 0x40]
push 0
pop edx
cmp dword [ebp - 0x40], 0x1a
jg 0x10018aeb
push 1
lea ecx, [ebp - 0x64]
call fcn.10016d92
and dword [ebp - 4], 0
lea ecx, [ebp - 0x98]
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x24], 0x563ffaf0
push esi
call fcn.10016d92
mov dword [ebp - 0x38], 0xc019
xor edx, edx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], 0xa83acdd7
mov dword [ebp - 0x20], edx
jmp 0x10018bf5
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], 0x59d5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x10018be5
mov dword [ebp - 0x20], edx
jmp 0x10018c13
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], 0x2b4746a1
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10018c00
mov eax, dword [ebp - 0x64]
cmp dword [eax], edx
jne 0x10018cb6
dec dword [ebp - 0x24]
cmp dword [ebp - 0x30], edx
jne 0x10018c3f
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x98]
mov dword [eax + 4], ecx
test ecx, ecx
jne 0x10018c3f
mov ecx, edx
jmp 0x10018c42
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
sub edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x64]
dec edx
cmp edx, dword [eax]
setne cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xa705
mov eax, dword [ebp - 0x14]
setge cl
neg eax
sbb eax, eax
inc eax
cmp eax, ecx
mov eax, dword [ebp - 0x98]
je 0x10018c82
cmp dword [eax + 4], 0
je 0x10018c8d
cmp dword [eax + 4], 0
je 0x10018c8d
xor ecx, ecx
inc ecx
jmp 0x10018c8f
xor ecx, ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
add eax, ecx
xor ecx, ecx
cmp eax, 0xfff6
setne cl
cmp ecx, dword [ebp - 0x34]
jg 0x10018cb6
mov eax, dword [ebp - 0x64]
cmp dword [eax], 0
jne 0x10018cb6
cmp dword [ebp - 0x30], 0
jne 0x10018cb6
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp eax, 0xc7bc
mov eax, dword [ebp - 0x64]
setne dl
xor ecx, ecx
cmp edx, dword [eax]
mov eax, dword [ebp - 0x98]
setg cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov dword [eax + 4], 0x73cd9e64
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
cmp dword [eax], ecx
lea ecx, [ebp - 0x98]
setle dl
mov dword [ebp - 0x14], edx
call fcn.10016dee
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.10016dee
push 1
lea ecx, [ebp - 0x58]
call fcn.10016d92
xor eax, eax
lea ecx, [ebp - 0x100]
inc eax
push eax
mov dword [ebp - 4], eax
call fcn.10016d92
xor edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x38], 0x3b6182ea
mov dword [ebp - 0x14], 0
jmp 0x10018d4c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0xda11525
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10018d39
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x10018d66
call ebx
push eax
call edi
mov eax, dword [ebp - 0x100]
lea ecx, [ebp - 0x100]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
call fcn.10016dee
lea eax, [ebp - 0x58]
push eax
push 0x7c83
push 0x443a
push 0x4fe2
lea eax, [ebp - 0x164]
push eax
push 0
call fcn.1001a4bb
mov dword [ebp - 0x14], 1
add esp, 0x18
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x10018dc7
push 0x1dc6
push 0x1dac
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_LineTo]
mov dword [ebp - 0x14], 0
jmp 0x10018ddd
mov dword [ebp - 0x24], 0xe0b4074d
inc dword [ebp - 0x24]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffa
jl 0x10018dd0
push 3
pop esi
mov dword [ebp - 0x2c], 0x39b642c7
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x24], 0xffffffff
push esi
call fcn.10016d92
push 2
pop edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], 0xc01e6e2b
mov dword [ebp - 0x14], 0
jmp 0x10018e26
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0x86e871d9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10018e16
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], edx
jg 0x10018ee3
mov edi, dword [ebp - 0x7c]
push 4
lea ecx, [ebp - 0xdc]
call fcn.10016d92
mov dword [ebp - 0x20], 0
jmp 0x10018e6b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x184], 0xf7b6fe6d
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10018e5a
mov dword [ebp - 0x20], 0
jmp 0x10018e8d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 0xde6fc608
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10018e7a
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov esi, dword [ebp - 0x2c]
mov eax, dword [edi + 4]
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x30]
cmp dword [edx + esi*4], eax
sete cl
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x7c]
imul ecx, dword [eax]
mov eax, dword [ebp - 0xdc]
sub ecx, 0x4414
mov dword [eax + 8], ecx
lea ecx, [ebp - 0xdc]
call fcn.10016dee
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jle 0x10018e44
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 1
call fcn.10016dee
mov eax, dword [ebp - 0x58]
mov dword [eax], 0x1a
jmp 0x10019bf0
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0x88]
push 1
call fcn.10016d92
mov dword [ebp - 0x20], 0x60b4ffb8
xor edx, edx
mov dword [ebp - 0x1c], 0x35ca4204
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x14], edx
jmp 0x10018f39
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x88]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10018f29
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], edx
jg 0x10018fb5
mov esi, dword [ebp - 0x20]
mov ecx, 0x3153
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov edx, dword [ebp - 0x88]
xor eax, eax
cmp dword [edx + esi*4], ecx
sete al
mov dword [ebp - 0x1c], eax
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x88]
mov eax, dword [edx + eax*4]
add eax, dword [edx + ecx*4]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [edx + esi*4]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, eax
mov eax, dword [ebp - 0x88]
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, dword [eax + edi*4]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [eax + ebx*4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x10018f47
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], edx
jmp 0x10018fca
mov dword [ebp - 0x24], 0xfffffffd
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff0
jl 0x10018fba
lea ecx, [ebp - 0x88]
call fcn.10016dee
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], 0xfa97f51e
mov dword [ebp - 0x1c], 0x9fdf99ff
mov dword [ebp - 0x1c], 0xfffffffa
jmp 0x10019025
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x14], 0xfffffffb
jmp 0x1001901c
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x10019019
call dword [sym.imp.USER32.dll_CreateMenu]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jge 0x10019009
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffec
jne 0x10018ff9
push 3
lea ecx, [ebp - 0x140]
call fcn.10016d92
mov byte [ebp - 4], 3
xor edx, edx
mov dword [ebp - 0x14], 0x76820624
inc edx
mov dword [ebp - 0x24], 0xf8067e3
mov dword [ebp - 0x14], edx
jmp 0x10019062
mov dword [ebp - 0x24], 0x5e00fe1c
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jge 0x10019052
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x10019096
push ecx
push 0xdca
push 0xee9
call ebx
mov edi, dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
xor edx, edx
xor ecx, ecx
inc edx
jmp 0x1001909c
mov edi, dword [sym.imp.USER32.dll_GetDC]
push 3
mov dword [ebp - 0x14], ecx
pop esi
cmp dword [ebp - 0x14], esi
jge 0x100190c1
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0xfffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100190a7
xor ecx, ecx
mov eax, dword [ebp - 0x58]
cmp dword [eax], edx
je 0x10019625
push 4
lea ecx, [ebp - 0x70]
call fcn.10016d92
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x28], 0x98a59c17
push 2
call fcn.10016d92
xor edx, edx
mov byte [ebp - 4], 5
mov dword [ebp - 0x20], edx
jmp 0x10019109
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], 0xe1a3622b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x100190f9
mov dword [ebp - 0x20], edx
jmp 0x10019127
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10019114
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x10019143
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor edx, edx
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], edx
jl 0x1001928d
xor ecx, ecx
mov dword [ebp - 0x1c], 0x22a149ce
mov dword [ebp - 0x14], edx
inc ecx
jmp 0x10019168
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001915e
mov dword [ebp - 0x48], edx
jmp 0x10019193
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x70]
cmp dword [eax + ecx*4], edx
jne 0x10019198
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10019190
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetCommState]
xor edx, edx
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], esi
jle 0x10019172
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x1c], edx
jl 0x10019284
mov dword [ebp - 0x20], 0x49fcfbce
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
cmp dword [eax + ecx*4], edx
je 0x100191db
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x70]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp - 0xb8]
mov dword [eax], ecx
jmp 0x10019279
mov dword [ebp - 0x18], 0x592758e9
xor edx, edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xb8]
add ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
cmp ecx, eax
setg dl
mov dword [ebp - 0x20], edx
xor edx, edx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0xffffffee
jne 0x1001927b
push esi
lea ecx, [ebp - 0xe8]
call fcn.10016d92
mov dword [ebp - 0x14], 0
jmp 0x10019233
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0x55ebda18
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10019220
mov dword [ebp - 0x20], 0xfffffff9
cmp dword [ebp - 0x20], 0xfffffffc
jne 0x10019262
mov ecx, dword [ebp - 0xe8]
mov eax, dword [ecx + 4]
mov dword [ebp - 0x24], 0xa6001648
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffc
je 0x1001924c
lea ecx, [ebp - 0xe8]
call fcn.10016dee
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffee
push 3
pop esi
je 0x1001920b
xor edx, edx
dec dword [ebp - 0x1c]
jns 0x100191a4
dec dword [ebp - 0x28]
jns 0x1001914f
lea ecx, [ebp - 0xb8]
call fcn.10016dee
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 3
call fcn.10016dee
xor ecx, ecx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 2
jg 0x10019a73
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x14], ecx
jmp 0x100192d4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], 0xfff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100192c6
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ecx
jl 0x100192f9
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x100192f4
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor ecx, ecx
dec dword [ebp - 0x1c]
jns 0x100192e2
mov dword [ebp - 0x1c], 3
jmp 0x1001938c
mov dword [ebp - 0x14], 0xfffffff9
xor edx, edx
mov dword [ebp - 0x18], 0x2d683a7e
mov eax, dword [ebp - 0x4c]
cmp eax, 1
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
sub ecx, dword [ebp - 0x24]
jne 0x10019330
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
je 0x10019349
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jge 0x1001936d
cmp dword [ebp - 0x14], ecx
jne 0x1001936d
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x10019389
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x10019389
cmp dword [ebp - 0x1c], ecx
jne 0x10019396
mov dword [ebp - 0x18], 0xffffffea
jmp 0x10019383
cmp dword [ebp - 0x18], ecx
jne 0x10019389
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1d
je 0x1001937b
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffff
jge 0x10019305
push 0x7116
push 0
lea eax, [ebp - 0x41]
mov byte [ebp - 0x41], 0
push 0x7764
push eax
call fcn.1001c4c6
add esp, 0x10
lea ecx, [ebp - 0xf4]
push 4
call fcn.10016d92
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x38], 0x4f3f7e81
push 1
call fcn.10016d92
xor edx, edx
mov byte [ebp - 4], 7
mov dword [ebp - 0x18], edx
jmp 0x100193fc
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf4]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100193e9
mov dword [ebp - 0x18], edx
jmp 0x1001941a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x160]
mov dword [eax + ecx*4], 0x76fda024
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10019407
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], edx
jl 0x100195f3
mov dword [ebp - 0x1c], 1
lea ecx, [ebp - 0x134]
push 2
call fcn.10016d92
mov byte [ebp - 4], 8
mov dword [ebp - 0x14], 0
jmp 0x10019464
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 0x35357f45
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10019451
mov dword [ebp - 0x1c], 0
jmp 0x1001949d
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x10019485
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1001949a
push 1
call ebx
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10019473
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], 0
jl 0x100195db
mov dword [ebp - 0x28], 0x20bd035c
lea ecx, [ebp - 0xd0]
push 1
call fcn.10016d92
mov byte [ebp - 4], 9
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x14], 0
jmp 0x100194ef
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x100194dc
mov dword [ebp - 0x28], 3
cmp dword [ebp - 0x28], 0
jl 0x100195c3
mov dword [ebp - 0x18], 0x92f644a
mov dword [ebp - 0x38], 0x7e3bc4ae
mov dword [ebp - 0x38], 0x45b3659e
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x18], 0
jmp 0x100195b0
mov dword [ebp - 0x38], 0xffffffff
lea ecx, [ebp - 0x17c]
push 2
call fcn.10016d92
xor edx, edx
mov dword [ebp - 0x14], edx
jmp 0x1001955c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], 0x36378284
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10019549
inc dword [ebp - 0x34]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xf4]
cmp dword [eax + ecx*4], edx
jne 0x10019595
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd0]
cmp dword [eax], edx
jne 0x10019585
cmp dword [ebp - 0x34], edx
je 0x10019588
xor edx, edx
inc edx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
setg cl
dec ecx
je 0x10019598
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0xd0]
neg ecx
mov dword [eax], ecx
lea ecx, [ebp - 0x17c]
call fcn.10016dee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1001952e
dec dword [ebp - 0x28]
jns 0x10019506
lea ecx, [ebp - 0xd0]
mov byte [ebp - 4], 8
call fcn.10016dee
dec dword [ebp - 0x1c]
jns 0x100194b4
lea ecx, [ebp - 0x134]
mov byte [ebp - 4], 7
call fcn.10016dee
dec dword [ebp - 0x24]
jns 0x10019430
lea ecx, [ebp - 0x160]
call fcn.10016dee
lea ecx, [ebp - 0xf4]
mov byte [ebp - 4], 3
call fcn.10016dee
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
push 0
pop ecx
jle 0x100192b3
jmp 0x10019a73
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x20], ecx
jmp 0x10019a69
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x2c], ecx
jl 0x10019951
mov dword [ebp - 0x18], edx
lea ecx, [ebp - 0x170]
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x128], edx
mov dword [ebp - 0x124], edx
mov dword [ebp - 0x120], edx
mov dword [ebp - 0x11c], edx
push edx
call fcn.10016d92
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x28], 0
jmp 0x1001968e
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], 0xe7eb6652
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x1001967b
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x100196b1
push 0xe4d
push 0xa53
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x18]
neg esi
mov eax, dword [ebp - 0x18]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
setne dl
cmp edx, esi
je 0x10019720
mov dword [ebp - 0x24], 0xd07
mov dword [ebp - 0x18], 0xfffffff7
jmp 0x1001970e
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1001970b
push 0x1d2
push 0
push 0xd51
push 0x1afd
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jl 0x100196e4
mov dword [ebp - 0x24], 7
jmp 0x100197d2
xor eax, eax
lea ecx, [ebp - 0x10c]
inc eax
mov dword [ebp - 0x24], eax
push eax
call fcn.10016d92
xor edx, edx
mov dword [ebp - 0x28], edx
jmp 0x1001974c
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], 0x6d9e96bb
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 1
jl 0x10019739
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], dl
je 0x1001976c
push 0x1350
push edx
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
xor edx, edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0x27f3
setne cl
cmp ecx, dword [ebp - 0x24]
jl 0x10019784
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
inc ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x124], eax
jne 0x100197ab
cmp dword [ebp - 0x24], edx
jne 0x100197ab
mov eax, edx
xor edx, edx
cmp eax, 0x5c2dd78f
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10c]
setg cl
mov dword [eax], ecx
lea ecx, [ebp - 0x10c]
call fcn.10016dee
lea ecx, [ebp - 0x170]
mov byte [ebp - 4], 3
call fcn.10016dee
mov dword [ebp - 0x30], 2
xor ecx, ecx
cmp dword [ebp - 0x30], ecx
jl 0x10019892
mov dword [ebp - 0x24], 0xba772304
lea ecx, [ebp - 0x118]
push 4
call fcn.10016d92
mov dword [ebp - 0x28], 0
jmp 0x10019823
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10019810
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x1001983f
call ebx
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x118]
mov dword [eax + 8], ecx
lea ecx, [ebp - 0x118]
call fcn.10016dee
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], cl
je 0x10019889
push 0x3bff
push 0x1764
push 0x5ebb
push ecx
push 0x5920
call fcn.1001c52f
add esp, 0x14
xor ecx, ecx
dec dword [ebp - 0x30]
jns 0x100197f3
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x28], ecx
jmp 0x100198af
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x190], 6
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 3
jl 0x1001989e
mov dword [ebp - 0x1c], ecx
jmp 0x10019904
mov dword [ebp - 0x18], 0x88a137b1
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x100198e5
push 0x686
push ecx
push ecx
push 0x1d70
push ecx
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
jmp 0x100198fb
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x190], 0x1f782a18
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100198ea
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x100198ba
mov dword [ebp - 0x1c], 0xffffffee
jmp 0x1001992d
cmp byte [ebp - 0xd], 0
je 0x1001992a
push ecx
push ecx
call ebx
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
xor ecx, ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe9
mov byte [ebp - 0xd], cl
je 0x10019913
cmp byte [ebp - 0xd], 0
je 0x10019945
push ecx
call fcn.1001b569
pop ecx
xor ecx, ecx
dec dword [ebp - 0x2c]
push 1
pop edx
jns 0x10019644
mov dword [ebp - 0x14], 0x97f6af11
mov dword [ebp - 0x14], 0xfffffff2
jmp 0x10019a57
mov dword [ebp - 0x1c], 0x5c19c5a6
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 2
jge 0x1001998d
push 2
pop esi
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x154], 0xa414
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10019977
cmp dword [ebp - 0x1c], ecx
jne 0x10019a61
mov dword [ebp - 0x1c], 0x11
jmp 0x10019a4a
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x18], ecx
jmp 0x100199b4
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3c], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100199aa
mov dword [ebp - 0x18], ecx
jmp 0x100199cf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xac], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100199be
mov dword [ebp - 0x3c], ecx
jmp 0x100199f1
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x100199ee
call dword [sym.imp.USER32.dll_DestroyCaret]
xor edx, edx
xor ecx, ecx
inc edx
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], edx
jle 0x100199da
mov dword [ebp - 0xa8], ecx
jmp 0x10019a3f
mov dword [ebp - 0x24], 0x3672d714
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x154]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x3c], eax
je 0x10019a34
mov eax, dword [ebp - 0x3c]
cmp eax, 0x85b6478c
mov dword [ebp - 0x3c], eax
mov eax, edx
jne 0x10019a36
mov eax, ecx
mov dword [ebp - 0x24], eax
inc dword [ebp - 0xa8]
cmp dword [ebp - 0xa8], edx
jle 0x100199fe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x17
jge 0x100199a2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x19
jg 0x10019964
cmp dword [ebp - 0x38], ecx
jne 0x10019a73
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10019634
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x18], 0x1d102278
mov dword [ebp - 0x24], 0x19adb821
mov dword [ebp - 0x14], 0x932e3ca3
mov dword [ebp - 0x34], 0x9523dd97
push 4
call fcn.10016d92
xor edx, edx
mov dword [ebp - 0x28], 0xe67b38eb
mov dword [ebp - 0x28], edx
jmp 0x10019abd
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x10019aad
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
je 0x10019adf
xor eax, eax
inc eax
jmp 0x10019ae1
mov eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x1c]
je 0x10019af4
cmp dword [ebp - 0x1c], edx
je 0x10019af4
xor edx, edx
inc edx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], edx
jne 0x10019b11
cmp dword [ebp - 0x1c], edx
jne 0x10019b11
mov eax, edx
jmp 0x10019b14
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], edx
je 0x10019b26
cmp dword [ebp - 0x18], edx
je 0x10019b26
xor ecx, ecx
inc ecx
jmp 0x10019b28
mov ecx, edx
mov eax, 0x665683c8
sub eax, ecx
je 0x10019b39
cmp dword [ebp - 0x24], edx
je 0x10019b39
xor edx, edx
inc edx
mov eax, dword [ebp - 0xc4]
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x24]
cmp edx, eax
sete cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
cmp eax, 0x7ea8
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
add ecx, 5
cmp eax, ecx
setne dl
xor ecx, ecx
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc4]
cmp edx, dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setle cl
xor edx, edx
dec ecx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
neg ecx
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0xc4]
call fcn.10016dee
mov eax, dword [ebp - 0x30]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x58]
cmp dword [eax], ecx
lea ecx, [ebp - 0x140]
sete dl
xor eax, eax
cmp edx, 0xffffffff
setge al
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
call fcn.10016dee
mov eax, dword [ebp - 0x58]
dec dword [eax]
mov eax, dword [ebp - 0x58]
cmp dword [eax], 0x19
je 0x10018efd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.10016dee
xor ebx, ebx
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x38], ebx
xor eax, eax
mov dword [ebp - 0x38], 0x8ade19d2
inc eax
mov dword [ebp - 0x38], 0x25b0e446
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x38], 0xba07e4fc
push 2
call fcn.10016d92
mov dword [ebp - 0x24], 0xfffffffe
mov dword [ebp - 0x30], ebx
jmp 0x10019c5a
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0xfe30f587
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x10019c47
dec dword [ebp - 0x24]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10019c7f
push ebx
push 0x19eb
push ebx
push ebx
push 0x10d9
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp - 0x14c]
call fcn.10016dee
mov eax, dword [ebp - 0x9c]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0x8c]
mov edi, edx
mov esi, eax
call fcn.10018a27
mov ecx, dword [ebp - 0xc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret