Function at 0x1001a925
Capabilities:
Check os version
Create process on windows
Get common file path
Get disk information
Get graphical window text

Disassembly:
mov eax, 0x10081d68
call fcn.10081628
sub esp, 0x178
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xd4], edx
push edi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x34], 0xc7979b38
push 1
mov dword [ebp - 0x20], 0xc34f1d4b
mov dword [ebp - 0x80], ecx
mov dword [ebp - 0x1c], ebx
pop edi
jmp 0x1001a969
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc8], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1001a95c
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
sub eax, 0x66762ddf
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
imul eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0x177e
sub eax, 0x78f2268a
je 0x1001a9c5
mov dword [ebp - 0x20], 0xab1d6a56
inc dword [ebp - 0x20]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001aa1e
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnregisterClassA]
jmp 0x1001aa1e
mov dword [ebp - 0x20], edi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001a9d6
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp dword [ebp - 0x20], ebx
je 0x1001aa11
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x34], eax
jl 0x1001a9f8
mov edx, edi
cmp dword [ebp - 0x20], ebx
jne 0x1001a9fa
mov edx, ebx
mov eax, dword [ebp - 0xc8]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov eax, edi
jmp 0x1001aa13
mov eax, ebx
cmp eax, 0xb99bf0bb
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
push 0xfffffffffffffffa
pop eax
push 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x1001aa36
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x64], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001aa2c
mov ecx, dword [ebp - 0x64]
xor edx, edx
mov eax, dword [ebp - 0x60]
cmp eax, ecx
setg dl
add edx, 0xc57e
je 0x1001aa58
mov eax, edi
cmp dword [ebp - 0x64], ebx
jne 0x1001aa5a
mov eax, ebx
add eax, 4
imul eax, dword [ebp - 0x60]
test eax, eax
jne 0x1001aa6c
mov eax, ebx
cmp dword [ebp - 0x60], ebx
je 0x1001aa6e
mov eax, edi
cmp eax, dword [ebp - 0x60]
je 0x1001aa7a
mov ecx, edi
cmp dword [ebp - 0x64], ebx
jne 0x1001aa7c
mov ecx, ebx
mov eax, dword [ebp - 0x64]
xor edx, edx
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
add ecx, eax
mov eax, dword [ebp - 0x60]
cmp eax, ecx
push 0xffffffffffffffff
setle dl
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x5c]
sub ecx, eax
pop ecx
je 0x1001aab9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x1001aaf9
call esi
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
jmp 0x1001aaf9
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 0x294b
mov dword [ebp - 0x1c], ebx
jmp 0x1001aadc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x174], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001aacf
inc dword [ebp - 0x20]
cmp dword [ebp - 0x18], ebx
jne 0x1001aaf4
mov eax, ebx
cmp dword [ebp - 0x16c], ebx
je 0x1001aaf6
mov eax, edi
mov dword [ebp - 0x18], eax
push dword [ebp - 0x80]
movdqa xmm0, xmmword [0x10007c70]
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x168]
mov dword [ebp - 0x58], ebx
push eax
push ebx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x54], ebx
movdqu xmmword [ebp - 0x168], xmm0
mov dword [ebp - 0x50], ebx
call fcn.10019fde
mov dword [ebp - 4], ebx
or eax, 0xffffffff
mov dword [ebp - 0x18], 0x4aa0d722
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x2c], 0x51ebf0d
mov dword [ebp - 0x20], 0xfff9
mov dword [ebp - 0x24], 0x5943e2f7
mov dword [ebp - 0x1c], ebx
jmp 0x1001ab71
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x184], 0x6171
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1001ab60
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
je 0x1001ab86
inc dword [ebp - 0x20]
mov eax, edi
jne 0x1001ab88
mov eax, ebx
xor ecx, ecx
test eax, eax
mov eax, dword [ebp - 0x34]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x2c]
setle cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], edi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
neg ecx
sbb ecx, ecx
or eax, 0xffffffff
inc ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0x364fef53
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], edi
jge 0x1001ac04
push 0xfffffffffffffffa
pop ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001abf5
mov dword [ebp - 0x14], ebx
jmp 0x1001ac17
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], 0x925b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001ac09
mov dword [ebp - 0x40], 8
jmp 0x1001ad78
mov dword [ebp - 0x14], 0x45db34e6
mov dword [ebp - 0x24], 0x75b167d3
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001ac4b
push ebx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1001ad75
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
je 0x1001ac86
mov eax, dword [ebp - 0x14]
mov ecx, edi
cmp dword [ebp + eax*4 - 0x4c], ebx
jne 0x1001ac88
mov ecx, ebx
xor eax, eax
cmp ecx, 0x77cccaea
setg al
cmp eax, 9
sbb eax, eax
neg eax
add eax, dword [ebp - 0x40]
jne 0x1001aca6
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x48]
xor ecx, ecx
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x40]
sub edx, 0xfad0
cmp edx, eax
setl cl
lea eax, [ecx + 0x52bf]
cmp eax, dword [ebp - 0x14]
jle 0x1001acd8
mov ecx, edi
cmp dword [ebp - 0x14], ebx
jne 0x1001acda
mov ecx, ebx
mov eax, dword [ebp - 0x40]
imul eax, ecx
test eax, eax
je 0x1001acef
mov eax, dword [ebp - 0x14]
mov ecx, edi
cmp dword [ebp + eax*4 - 0x4c], ebx
jne 0x1001acf1
mov ecx, ebx
mov eax, dword [ebp - 0x14]
add eax, ecx
cmp eax, 0xac116e07
je 0x1001ad09
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], ecx
jmp 0x1001ad6c
mov dword [ebp - 0x24], ebx
xor edx, edx
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x40]
add ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setg dl
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], 0xffffffe3
jmp 0x1001ad66
mov dword [ebp - 0x24], 0xbde8aff6
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x4c]
mov dword [ebp - 0x24], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001ad63
push ebx
push 0x205a
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 6
jl 0x1001ad3a
dec dword [ebp - 0x14]
jns 0x1001ac5b
dec dword [ebp - 0x40]
cmp dword [ebp - 0x40], 0xfffffff8
jge 0x1001ac29
cmp dword [ebp - 0x4c], ebx
je 0x1001ad8e
mov eax, edi
cmp dword [ebp - 0x40], ebx
jne 0x1001ad90
mov eax, ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x2b08f18e
mov dword [ebp - 0x18], 0x7a4a12b5
mov dword [ebp - 0x1c], ebx
jmp 0x1001adb7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x148], 0x2799ac78
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1001ada6
mov esi, dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1001ade6
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001ade1
push 0x22c7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
dec dword [ebp - 0x18]
jns 0x1001adca
mov dword [ebp - 0x38], 0x7d4e8587
mov dword [ebp - 0x2c], 0xe4b28306
mov dword [ebp - 0x34], 0x2250db85
mov dword [ebp - 0x14], 0x8a062b00
mov dword [ebp - 0x18], 0xa3187110
mov dword [ebp - 0x1c], 0xfffffffd
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001ae30
push 0x21be
push 0x1cc0
push ebx
push 0x163e
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x2c]
cmp edx, edi
je 0x1001ae4c
mov eax, edi
cmp dword [ebp - 0x2c], ebx
jne 0x1001ae4e
mov eax, ebx
or ecx, 0xffffffff
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 3
setne cl
imul eax, ecx, 0xfffffffc
test eax, eax
je 0x1001b09a
mov dword [ebp - 0x28], 0xfff7
lea ecx, [ebp - 0x11c]
push 4
call fcn.100188f1
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x24], 0xfffb
mov dword [ebp - 0x24], 0x77dd35ab
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x24], 0xf0f4353c
mov dword [ebp - 0x1c], ebx
jmp 0x1001aeb7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1001aea8
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x18], ebx
jne 0x1001afca
mov eax, dword [ebp - 0x34]
xor edx, edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x28]
setl dl
sub edx, 0xc23cea2f
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor edx, edx
cmp ecx, 0x1bd53d2a
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x34]
setge cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
cmp dword [ebp - 0x24], eax
setle cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setl cl
imul edx, ecx, 0xb834
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setle cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
cmp dword [ebp - 0x24], eax
setl cl
cmp ecx, dword [ebp - 0x18]
jne 0x1001afca
mov dword [ebp - 0x20], 0xfffffff7
xor ecx, ecx
mov dword [ebp - 0x1c], 0xfffffff9
mov dword [ebp - 0x24], 0xfffffff6
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x715c
setl cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
jmp 0x1001b084
mov dword [ebp - 0x20], 0x5156be82
mov dword [ebp - 0x14], 0x17
jmp 0x1001b07a
mov dword [ebp - 0x24], 0xfffb
mov dword [ebp - 0x38], 0xfffffffb
mov dword [ebp - 0x1c], ebx
jmp 0x1001b001
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x144], 0xb254
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001aff0
cmp dword [ebp - 0x20], ebx
je 0x1001b06b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
je 0x1001b065
mov eax, dword [ebp - 0x144]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
cmp eax, edi
setl cl
xor eax, eax
cmp ecx, 0xffffffff
setle al
xor ecx, ecx
cmp eax, 0xfffffffe
setg cl
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x11c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax + 4], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x2c], ebx
jne 0x1001b065
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x144]
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
jne 0x1001afdd
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x11c]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
call fcn.10018973
jmp 0x1001b0b3
mov dword [ebp - 0x24], 0xfff8
mov dword [ebp - 0x38], 0x77089988
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x20], 0x2eb57571
mov dword [ebp - 0x20], 0x7a4a12b5
mov dword [ebp - 0x18], ebx
jmp 0x1001b0d7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xdc], 0x2799ac78
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001b0c6
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x1001b100
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b0fb
push 0x22c7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
dec dword [ebp - 0x20]
jns 0x1001b0e4
mov eax, dword [ebp - 0x58]
cmp dword [eax], ebx
jne 0x1001b116
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ecx]
cmp eax, dword [ecx + 0xc]
mov ecx, ebx
jne 0x1001b118
mov ecx, edi
mov eax, dword [ebp - 0x30]
sub ecx, eax
je 0x1001b3bb
mov eax, 0x1a04
mov dword [ebp - 0x138], eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x2c], 0x971c1ec2
mov dword [ebp - 0x2c], ebx
jmp 0x1001b15d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x138], 0x2212
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1001b14c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b182
push 0x5cd
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], ebx
or eax, 0xffffffff
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0xb70f7348
mov dword [ebp - 0x38], 0xfffffff8
cmp dword [ebp - 0x30], ebx
je 0x1001b22e
mov dword [ebp - 0x20], 0x97a0b891
mov dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x20], ebx
je 0x1001b1d0
mov eax, dword [ebp - 0x58]
cmp dword [eax], ebx
mov eax, edi
jne 0x1001b1d2
mov eax, ebx
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x18]
sub edx, dword [eax]
mov eax, dword [ebp - 0x20]
imul ecx, edx
add ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax + 4], ecx
cmp ecx, 0x7b12
jne 0x1001b1fd
mov ecx, edi
cmp dword [ebp - 0x30], ebx
jne 0x1001b1ff
mov ecx, ebx
mov eax, dword [ebp - 0x30]
imul eax, ecx
mov dword [ebp - 0x34], eax
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b3f9
push ebx
push ebx
push 0x2d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1001b3f9
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], 0xbaae
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x18], 0x4004
mov dword [ebp - 0x24], 0x16a80d17
mov dword [ebp - 0x20], 0x5b8c0b7b
mov eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x30]
je 0x1001b269
mov ecx, ebx
cmp dword [ebp - 0x14], ebx
je 0x1001b26b
mov ecx, edi
xor eax, eax
cmp ecx, 0x9d2a
setg al
add eax, dword [ebp - 0x30]
je 0x1001b27e
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp - 0x34]
cmp eax, edx
setge cl
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x58]
mov eax, dword [esi + 8]
add eax, 3
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x28], ebx
je 0x1001b2fa
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
setle dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], ebx
jne 0x1001b2f3
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x1001b2f5
mov eax, edi
mov edx, edi
inc eax
jne 0x1001b2fc
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setle cl
imul eax, ecx, 0x8674
test eax, eax
je 0x1001b315
cmp dword [ebp - 0x34], ebx
jne 0x1001b31c
mov edx, ebx
cmp dword [ebp - 0x30], ebx
je 0x1001b31e
mov edx, edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x2c]
jne 0x1001b33b
mov ecx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1001b33d
mov ecx, edi
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x58]
mov dword [eax], edx
mov eax, dword [ebp - 0x38]
imul eax, ecx
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xffffffff
setge al
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], ebx
jne 0x1001b36e
mov ecx, ebx
cmp dword [esi + 8], ebx
je 0x1001b370
mov ecx, edi
xor eax, eax
cmp ecx, 0xfffffffd
setle al
xor ecx, ecx
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setle cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
sub ecx, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
jne 0x1001b3a8
cmp dword [ebp - 0x20], ebx
je 0x1001b3ad
cmp dword [ebp - 0x24], ebx
jne 0x1001b3b4
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1001b3b6
mov eax, edi
mov dword [ebp - 0x20], eax
jmp 0x1001b3f9
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0x78fb111d
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b3f9
push ebx
push 0x1abb
push ebx
push ebx
push 0x1578
push 0x2425
push 0x1c8b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
or eax, 0xffffffff
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], eax
call fcn.10018973
push dword [ebp - 0xdc]
movdqa xmm0, xmmword [0x10007c90]
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x158]
mov dword [ebp - 0xb0], ebx
push eax
push ebx
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0xac], ebx
movdqu xmmword [ebp - 0x158], xmm0
mov dword [ebp - 0xa8], ebx
call fcn.10019fde
mov dword [ebp - 0x24], edi
or edx, 0xffffffff
mov dword [ebp - 0x24], 0xbf5bf816
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 2
jge 0x1001b46b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x7c], edx
inc dword [ebp - 0x18]
jmp 0x1001b459
push 7
pop esi
cmp dword [ebp - 0x78], ebx
je 0x1001b4a5
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b486
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b5c7
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetParent]
jmp 0x1001b5c7
mov dword [ebp - 0x34], 0x647dc4b4
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x34], ebx
cmp dword [ebp - 0x34], edi
jg 0x1001b5c7
mov dword [ebp - 0x28], 0x4cdb8faa
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x1001b59e
mov esi, dword [ebp - 0xb0]
mov dword [ebp - 0x20], 0x32f3f608
mov dword [ebp - 0x24], 0x3f8de905
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x20], 0xbc383c67
cmp dword [ebp - 0x20], ebx
jne 0x1001b545
mov dword [ebp - 0x24], 0x91ee4cff
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
je 0x1001b529
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x7c]
mov dword [esi + 4], 4
mov dword [ebp - 0x104], edi
mov eax, dword [ebp - 0x34]
cmp dword [ebp - 0x78], edi
jge 0x1001b54a
cmp dword [esi + 4], ebx
jne 0x1001b550
mov eax, dword [ebp - 0x108]
mov dword [ebp - 0x24], edi
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
dec ecx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x7c]
sub eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
neg eax
cmp eax, 0x2097
setne cl
mov dword [ebp - 0x24], ecx
dec dword [ebp - 0x28]
jns 0x1001b4f2
or edx, 0xffffffff
mov dword [ebp - 0x28], ebx
jmp 0x1001b5b2
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 4
jl 0x1001b5a3
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], edi
jle 0x1001b4be
push 7
pop esi
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b5d7
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
lea ecx, [ebp - 0xb0]
call fcn.10018973
mov dword [ebp - 0x14], 0x4182bd7b
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x30], 0xf321248c
push 4
call fcn.100188f1
mov dword [ebp - 0x18], ebx
jmp 0x1001b61c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001b60c
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
je 0x1001b69e
mov ecx, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, edi
setl cl
xor edx, edx
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
mov dword [ebp - 0x24], edx
xor edx, edx
cmp eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x14]
jne 0x1001b677
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xb2d3
setg al
sub eax, 0xffff
cmp eax, 4
je 0x1001b69a
cmp dword [ebp - 0x14], ebx
je 0x1001b69e
mov eax, edi
jmp 0x1001b6a0
mov eax, ebx
cmp eax, dword [ebp - 0x28]
jle 0x1001b74f
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0xa323
mov dword [ebp - 0x20], 0x2ff7a2d4
mov dword [ebp - 0x18], 0x41ac
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 0x13251f81
setle al
imul eax, dword [ebp - 0x30]
cmp esi, eax
mov eax, dword [ebp - 0x28]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x14]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x18], 0x3c09
jne 0x1001b727
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8c]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0xfffffff6
setge cl
mov dword [ebp - 0x38], ecx
jmp 0x1001b7de
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jle 0x1001b7de
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x20], eax
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0x15
jmp 0x1001b7cd
mov dword [ebp - 0x38], 0x9eed
mov dword [ebp - 0x30], ebx
jmp 0x1001b795
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 0x99626dac
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 4
jl 0x1001b782
mov dword [ebp - 0x30], 3
cmp dword [ebp - 0x30], ebx
jl 0x1001b7ca
mov esi, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x8c]
mov edx, dword [ebp - 0x8c]
mov eax, dword [eax + ecx*4]
mov dword [edx + esi*4], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
dec dword [ebp - 0x30]
jns 0x1001b7a7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x39
jl 0x1001b776
inc dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x28], ebx
jg 0x1001b764
lea ecx, [ebp - 0x8c]
call fcn.10018973
mov dword [ebp - 0xc0], 8
lea ecx, [ebp - 0xe8]
push 2
call fcn.100188f1
mov dword [ebp - 0x24], 0x8c66f5a9
mov dword [ebp - 0x18], ebx
jmp 0x1001b81f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe8]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001b80c
mov eax, dword [ebp - 0xe8]
mov esi, dword [sym.imp.GDI32.dll_MoveToEx]
mov dword [eax], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b857
push ebx
push 0xd92
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov eax, dword [ebp - 0xe8]
dec dword [eax]
mov ecx, dword [eax]
cmp ecx, 0xfffffff7
jge 0x1001b833
mov dword [eax + 4], ecx
lea ecx, [ebp - 0xe8]
call fcn.10018973
mov dword [ebp - 0xd8], 0xfff8
lea ecx, [ebp - 0x98]
push edi
call fcn.100188f1
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x18], ebx
jmp 0x1001b8a5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001b892
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], ebx
jg 0x1001b9e9
push 0xfffffffffffffffa
pop esi
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x98]
cmp dword [eax + ecx*4], ebx
jne 0x1001b8dd
mov eax, dword [ebp - 0x30]
mov edx, ebx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x98]
cmp dword [eax + ecx*4], edi
jge 0x1001b8df
mov edx, edi
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x98]
mov eax, dword [eax + ecx*4]
add eax, edx
je 0x1001b8f2
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x98]
cmp esi, dword [ecx + eax*4]
sbb eax, eax
inc eax
cmp eax, dword [ecx + edx*4]
jl 0x1001b9be
mov dword [ebp - 0x1c], 0xf906d8bc
mov dword [ebp - 0x18], ebx
jmp 0x1001b92a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa4], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1001b919
mov dword [ebp - 0x9c], ebx
cmp dword [ebp - 0x9c], ebx
jl 0x1001b966
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b95e
push 0x5b4
push 0x125d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
dec dword [ebp - 0x9c]
jns 0x1001b93e
mov dword [ebp - 0x1c], ebx
jmp 0x1001b9b6
mov dword [ebp - 0x20], 0x1dbdae4f
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa4], ecx
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x1001b9b3
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b9ae
push 0xb37
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
dec dword [ebp - 0x20]
jns 0x1001b992
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x1001b96b
jmp 0x1001b9d7
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001b9d7
push 0x1ef5
push 0x15da
call dword [sym.imp.USER32.dll_SetCaretPos]
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], ebx
jle 0x1001b8b9
mov esi, dword [sym.imp.GDI32.dll_MoveToEx]
lea ecx, [ebp - 0x98]
call fcn.10018973
mov dword [ebp - 0xb4], 0x96673e7e
mov dword [ebp - 0x24], 0x1342f3d4
mov dword [ebp - 0x24], 0xe3cb5af9
mov dword [ebp - 0x38], 9
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
jmp 0x1001ba29
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3c], 0x7d21
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001ba1b
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x3c]
cmp edx, eax
setg cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
imul eax, dword [ebp - 0x3c], 7
cmp eax, 0xf49c23ed
mov eax, dword [ebp - 0x3c]
sbb edx, edx
add edx, 0xdc2268d5
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [ebp - 0x3c]
setg cl
add edx, ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x3c]
neg edx
sbb edx, edx
inc edx
add ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setne dl
add eax, edx
cmp eax, dword [ebp - 0x3c]
jge 0x1001ba92
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
mov dword [ebp - 0x24], edx
xor edx, edx
cmp dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x3c]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 6
setg al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], ebx
jmp 0x1001bae1
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001bade
push ebx
push 0x82c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
jle 0x1001bac7
push 2
lea ecx, [ebp - 0x100]
call fcn.100188f1
mov dword [ebp - 0x24], 0x8c66f5a9
mov dword [ebp - 0x18], ebx
jmp 0x1001bb13
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x100]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001bb00
mov eax, dword [ebp - 0x100]
mov dword [eax], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001bb45
push ebx
push 0xd92
push 0x975
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
mov eax, dword [ebp - 0x100]
dec dword [eax]
mov ecx, dword [eax]
cmp ecx, 0xfffffff7
jge 0x1001bb21
mov dword [eax + 4], ecx
lea ecx, [ebp - 0x100]
call fcn.10018973
mov dword [ebp - 0xb8], ebx
mov dword [ebp - 0xbc], 0xf1fdbd01
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x28], 0xab39e224
mov dword [ebp - 0x18], ebx
jmp 0x1001bb8f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x74], 0xc64a6847
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1001bb81
push 3
pop esi
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1001bd55
push 7
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x35ff5744
mov dword [ebp - 0x18], 0x9cbadbef
mov dword [ebp - 0x24], 0xdc28bf2f
mov dword [ebp - 0x24], 0x6f6066fa
mov dword [ebp - 0x24], 0x89736453
mov eax, dword [ebp - 0x14]
push 0xfffffffffffffff7
pop ecx
mov eax, dword [ebp + eax*4 - 0x74]
sub ecx, eax
je 0x1001bc23
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x74], 0xdef9
jl 0x1001bbf2
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x1001bbf4
mov eax, edi
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
imul eax, eax, 0x4348f2d8
cmp eax, dword [ebp - 0x68]
jle 0x1001bc19
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov ecx, edi
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x6c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x74]
mov dword [ebp - 0x1c], 0x772679f1
mov dword [ebp - 0x38], 0xc7a8f60f
mov eax, dword [ebp - 0x20]
sub ecx, eax
je 0x1001bc8a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
add eax, 4
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], ebx
jl 0x1001bd46
mov dword [ebp - 0x1c], ebx
jmp 0x1001bc7b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001bc78
push ebx
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jle 0x1001bc68
dec dword [ebp - 0x28]
jns 0x1001bc63
jmp 0x1001bd46
push edi
lea ecx, [ebp - 0x128]
call fcn.100188f1
mov dword [ebp - 0x18], ebx
jmp 0x1001bcab
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x128]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001bc9b
mov eax, dword [ebp - 0x128]
xor ecx, ecx
cmp dword [eax], ebx
mov eax, dword [ebp - 0x20]
setne cl
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
cmp eax, 0xffffffff
setge cl
xor eax, eax
cmp ecx, 0x4d18
setge al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 4
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x74]
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], 0xfffffff6
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x74]
cmp eax, edi
setg cl
xor eax, eax
cmp dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x128]
setg al
mov dword [ebp - 0x24], eax
call fcn.10018973
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x14]
jns 0x1001bba4
mov dword [ebp - 0x14], ebx
jmp 0x1001bd7a
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001bd77
push edi
push ebx
push 0x7fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffff8
jg 0x1001bd5a
push 0x235f
lea eax, [ebp - 0xbc]
push eax
push ebx
lea eax, [ebp - 0xc0]
push eax
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xb8]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.1001ce45
mov dword [ebp - 0x2c], 0xfffffff8
add esp, 0x1c
mov dword [ebp - 0x20], 0xd73ae4c7
mov dword [ebp - 0x18], ebx
jmp 0x1001bdd5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd0], 0xae355683
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1001bdc4
mov dword [ebp - 0x2c], ebx
jmp 0x1001bec9
mov dword [ebp - 0x28], 0xb659d568
or eax, 0xffffffff
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0x3063
mov dword [ebp - 0x18], 0x5702
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001be0d
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov eax, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x18]
je 0x1001be5c
mov edx, edi
cmp dword [ebp - 0x2c], ebx
jne 0x1001be5e
mov edx, ebx
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp edx, eax
setl cl
cmp dword [ebp - 0x28], ecx
jne 0x1001be8c
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001bec6
push edi
push ebx
push 0x13d2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemInt]
jmp 0x1001bec6
mov dword [ebp - 0x28], ebx
jmp 0x1001beb9
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001beb6
push 0x3ea
push 0xb05
push 0x8bf
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x1001be91
cmp dword [ebp - 0xd0], ebx
jne 0x1001bed2
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jle 0x1001bde3
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001bee9
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001befb
call dword [sym.imp.USER32.dll_DestroyCaret]
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1001bf16
push 0x227
push 0x604
push 0x79
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov edx, 0x2c31
xor cl, cl
call fcn.1001c0b4
mov dword [ebp - 0x20], 0xc3ec3d4e
lea ecx, [ebp - 0xf4]
push esi
call fcn.100188f1
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x18], ebx
jmp 0x1001bf58
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001bf48
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0xf4]
cmp dword [esi + 4], 0xa4e66596
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
sub edx, 6
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [esi + 4]
sub edx, 0x8ec3
cmp edx, eax
sete cl
cmp ecx, 0x38e486ae
je 0x1001bfa0
mov edx, edi
cmp dword [ebp - 0x20], ebx
jne 0x1001bfa2
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
push 8
sete cl
pop eax
cmp eax, ecx
sbb eax, eax
neg eax
add eax, 0x72710f98
cmp eax, 0x493876a4
jl 0x1001bfc6
cmp dword [esi + 4], ebx
jne 0x1001bfc8
mov edi, ebx
xor eax, eax
cmp edi, dword [esi + 4]
setne al
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ebx
jmp 0x1001bfe8
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xf4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1001bfd8
lea ecx, [ebp - 0xf4]
call fcn.10018973
mov eax, dword [ebp - 0xd4]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0x80]
mov esi, edx
mov edi, eax
call fcn.1001a8b3
mov ecx, dword [ebp - 0xc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret