Function at 0x100178e5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1007b7d1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [esp + 0x7c], edx
push 2
mov dword [esp + 0x20], ebx
mov dword [esp + 0x38], ecx
mov dword [esp + 0x28], ebx
pop esi
jmp 0x10017933
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x184], 0xfffffff8
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x10017920
xor ecx, ecx
mov dword [esp + 0x1c], ebx
inc ecx
jmp 0x10017979
mov dword [esp + 0x24], 0x1265ab3e
mov dword [esp + 0x24], ebx
jmp 0x1001796f
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], bl
je 0x1001796b
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
xor ecx, ecx
inc ecx
inc dword [esp + 0x24]
cmp dword [esp + 0x24], ecx
jle 0x10017950
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jle 0x10017942
mov dword [esp + 0x10], ebx
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 0xffffffee
jge 0x10017c06
mov dword [esp + 0xc], 0x665683c8
lea ecx, [esp + 0x8c]
push 4
call fcn.100158b8
mov dword [esp + 0x1c4], ebx
mov dword [esp + 0x24], ebx
jmp 0x100179cb
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x8c]
mov dword [eax + ecx*4], 0xdb821342
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 4
jl 0x100179b5
mov dword [esp + 0xc], 0xfffffffe
jmp 0x10017bd5
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0xffffffff
jmp 0x10017bc6
push 4
lea ecx, [esp + 0x84]
call fcn.100158b8
xor eax, eax
lea ecx, [esp + 0x5c]
inc eax
push esi
mov byte [esp + 0x1c8], al
call fcn.100158b8
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], ebx
jmp 0x10017a36
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x80]
mov dword [eax + ecx*4], 0x9006
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10017a20
mov dword [esp + 0x14], ebx
jmp 0x10017a56
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 0xba86ba47
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10017a43
mov eax, dword [esp + 0x80]
mov edi, dword [esp + 0x5c]
mov eax, dword [eax]
mov dword [edi + 4], eax
mov dword [esp + 0x28], 0xffffffe8
cmp dword [esp + 0x28], 0xd
jge 0x10017ba6
xor edx, edx
inc edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], 0xfffffffb
mov dword [esp + 0x20], 0x38d679bd
mov dword [esp + 0x24], ebx
jmp 0x10017aaf
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x10c], 0x55a6
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jl 0x10017a9c
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10017ad2
push ebx
push ebx
push 0xcf2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edx, edx
inc edx
mov dword [esp + 0x24], 3
cmp dword [esp + 0x24], ebx
jl 0x10017b97
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x20], 0x2fa5d872
dec dword [esp + 0x14]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x80]
mov eax, dword [esp + 0x14]
push 0
cmp dword [ecx + edx*4], eax
pop eax
setne al
neg eax
neg eax
sbb eax, eax
xor edx, edx
neg eax
inc edx
mov dword [esi + 0xc], eax
mov dword [esp + 0x14], ebx
jmp 0x10017b84
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
cmp dword [eax + ecx*4], ebx
jne 0x10017b8a
cmp dword [esp + 0x10c], ebx
jne 0x10017b55
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x5c]
cmp dword [eax + ecx*4], ebx
je 0x10017b51
mov eax, dword [esp + 0x8c]
cmp dword [eax], ebx
jne 0x10017b55
mov ecx, ebx
jmp 0x10017b57
mov ecx, edx
mov eax, dword [esp + 0x1c]
add eax, ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov dword [edi + 4], eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jle 0x10017b23
dec dword [esp + 0x24]
jns 0x10017aeb
push 2
pop esi
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0xd
jl 0x10017a82
lea ecx, [esp + 0x5c]
call fcn.10016178
lea ecx, [esp + 0x80]
mov byte [esp + 0x1c4], bl
call fcn.10016178
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x17
jg 0x100179f0
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 0xb
jge 0x100179df
or dword [esp + 0x1c4], 0xffffffff
lea ecx, [esp + 0x8c]
call fcn.10016178
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffee
jl 0x10017992
xor ecx, ecx
inc ecx
push 5
pop edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x14], 0x2ee76f50
mov dword [esp + 0xc], 0x19c9214a
mov dword [esp + 0xc], ebx
jmp 0x10017c3b
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x30], 0xc85f
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x10017c2b
mov dword [esp + 0x14], ebx
jmp 0x10017c57
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x30], 0xffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], ecx
jl 0x10017c47
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], 0xe780
mov eax, dword [esp + 0xc]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x14], ebx
je 0x10017c8b
mov edx, ecx
cmp dword [esp + 0xc], ebx
jne 0x10017c8d
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], 0xbd97a888
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], 6
mov dword [esp + 0x10], 0xfffffff0
jmp 0x10017d6e
push esi
lea ecx, [esp + 0x118]
call fcn.100158b8
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0xc], ebx
jmp 0x10017cee
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 0xe1d9
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10017cd8
xor ecx, ecx
mov dword [esp + 0x1c], ebx
inc ecx
jmp 0x10017d50
mov dword [esp + 0x14], 0x887cf2e5
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], ebx
jl 0x10017d4c
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x10], ecx
jne 0x10017d21
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
imul eax, dword [esp + 0x1c]
mov dword [esp + 0x24], eax
dec dword [esp + 0x14]
jns 0x10017d0f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], ecx
jle 0x10017cfd
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x114]
mov dword [esp + 0x1c], eax
call fcn.10016178
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1a
jg 0x10017cbd
mov dword [esp + 0x24], 0xfffffffc
jmp 0x10017dfb
xor eax, eax
lea ecx, [esp + 0x100]
inc eax
push eax
call fcn.100158b8
xor edx, edx
mov dword [esp + 0xc], ebx
inc edx
jmp 0x10017db2
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x100]
mov dword [eax + ecx*4], 0xf9e6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10017d9c
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], ebx
jl 0x10017deb
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10017de5
push 0x1674
push 0x65
push 0x45b
push 0x1dd7
push ebx
call dword [sym.imp.USER32.dll_SetRect]
dec dword [esp + 0x10]
jns 0x10017dc2
lea ecx, [esp + 0x100]
call fcn.10016178
inc dword [esp + 0x24]
cmp dword [esp + 0x24], edi
jl 0x10017d83
mov dword [esp + 0x20], ebx
mov eax, 0x53e58bfc
mov dword [esp + 0x10], 0xfffffffe
mov dword [esp + 0xd8], eax
mov dword [esp + 0xdc], eax
mov dword [esp + 0xe0], eax
mov dword [esp + 0xe4], eax
mov dword [esp + 0x20], 0x37c1d6b3
mov dword [esp + 0xc], 0x29c8ddac
mov dword [esp + 0x10], 0xffffffee
jmp 0x10017e81
mov dword [esp + 0x20], 0xc4ab
xor edx, edx
mov dword [esp + 0x28], 0xdcad2086
mov dword [esp + 0x20], ebx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov eax, dword [esp + 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0xdc], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff4
je 0x10017e48
push 3
pop edi
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], ebx
jl 0x10017ec3
mov dword [esp + 0x20], 0xf9d44c03
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x20], 0xa4ccfd6
mov dword [esp + 0x20], ebx
mov dword [esp + 0x20], 0xffffffff
inc dword [esp + 0xc]
dec dword [esp + 0x10]
jns 0x10017e95
mov dword [esp + 0x20], 0x7f2fb5a5
xor ecx, ecx
mov dword [esp + 0x20], 0xd035c573
inc ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x20], 0xef20fe6e
mov dword [esp + 0xc], ebx
jmp 0x10017ef8
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x58], 0xbeccce1e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], ecx
jl 0x10017ee8
mov eax, dword [esp + 0x28]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x58], eax
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], al
je 0x10017f32
push ebx
push 0x202f
push ebx
push 0x20ed
push 0x13d
call dword [sym.imp.GDI32.dll_ExtCreatePen]
xor ecx, ecx
inc ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], 0x7862fd41
mov dword [esp + 0x28], 0xbefcdf1
mov dword [esp + 0xc], ebx
jmp 0x10017f5f
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0xbc], 0xcfda6c2e
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10017f4c
mov dword [esp + 0x1c], 0xfffffffb
jmp 0x10018067
mov dword [esp + 0x10], 0x70ade21
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ebx
jmp 0x10017ffb
mov dword [esp + 0xc], 0xfffffffa
mov dword [esp + 0x20], 0xe018
mov dword [esp + 0x20], 0x6be856df
cmp dword [esp + 0xc], ebx
jne 0x10017fb2
mov dword [esp + 0x20], 0x714ad38
mov edx, ebx
cmp dword [esp + 0x20], ebx
je 0x10017fb4
mov edx, ecx
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0xc]
jge 0x10017fc6
mov esi, ecx
cmp dword [esp + 0x28], ebx
jne 0x10017fc8
mov esi, ebx
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x1c]
push 1
sete cl
xor edx, edx
cmp ecx, eax
pop ecx
setg dl
sub edx, esi
neg edx
sbb edx, edx
add edx, 7
sub edx, dword [esp + 0x28]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x20], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x11
jle 0x10017f84
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
cmp eax, 0x7bf7
mov eax, dword [esp + 0x10]
setne cl
xor edx, edx
sub ecx, eax
mov dword [esp + 0xc0], ecx
mov eax, dword [esp + 0x28]
cmp ecx, eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
setle dl
imul ecx, edx
xor edx, edx
push 1
cmp ecx, eax
mov eax, dword [esp + 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
cmp eax, ecx
pop ecx
setg dl
mov dword [esp + 0x10], edx
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffe3
jle 0x10017f72
mov eax, dword [esp + 0xc4]
mov dword [esp + 0xc0], eax
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x1c], 0xac204e2
mov dword [esp + 0xc], ebx
jmp 0x100180a9
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1ac], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edi
jl 0x10018096
mov dword [esp + 0x1c], ebx
jmp 0x100180d1
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100180cd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff9
jne 0x100180b5
push 2
pop esi
mov dword [esp + 0x1c], esi
cmp dword [esp + 0x1c], ebx
jl 0x10018103
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100180fd
push 0x184a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
dec dword [esp + 0x1c]
jns 0x100180e5
mov dword [esp + 0x24], 0x5c96dd1e
xor ecx, ecx
mov dword [esp + 0xc], 0xf2f4a8b1
inc ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x10], ebx
jmp 0x1001813c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x68], 0xe149cff2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1001812c
mov dword [esp + 0x10], ebx
jmp 0x1001815b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x18c], 0x17b38e51
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10018148
mov eax, dword [esp + 0x24]
mov ecx, 0xa729
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
sub ecx, eax
sub ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x20]
jne 0x10018182
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
xor edx, edx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0xc]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
sub ecx, dword [esp + 0x28]
mov dword [esp + 0x1c], ecx
xor ecx, ecx
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
sub edx, 0x5900
cmp eax, edx
setl cl
mov dword [esp + 0xc], ecx
cmp dword [esp + 0x20], ebx
je 0x100181d4
cmp dword [esp + 0xc], ebx
je 0x100181d4
xor eax, eax
lea edx, [eax + 1]
jmp 0x100181d6
mov edx, ebx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [esp + 0x24]
test ecx, ecx
jne 0x100181f4
cmp dword [esp + 0x1c], ebx
jne 0x100181f4
mov eax, ebx
jmp 0x100181f7
xor eax, eax
inc eax
mov dword [esp + 0x68], eax
lea ecx, [esp + 0xa4]
push esi
call fcn.100158b8
mov dword [esp + 0x1c4], esi
lea eax, [esp + 0x164]
push dword [esp + 0x34]
movdqa xmm0, xmmword [0x10008040]
lea ecx, [esp + 0x44]
push eax
lea eax, [esp + 0x15c]
mov dword [esp + 0x48], ebx
push eax
push ebx
movdqu xmmword [esp + 0x164], xmm0
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
call fcn.10016f9b
mov dword [esp + 0x1c], 0x184c506d
mov dword [esp + 0x1c], ebx
jmp 0x1001833c
mov dword [esp + 0x10], 0x6b950ba1
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], ebx
jl 0x10018338
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
mov dword [esp + 0xc], ebx
jmp 0x1001829a
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x13c], 0x63a74adf
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10018287
mov eax, dword [esp + 0x10]
sub eax, 0x795ed7c6
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ecx + 4]
je 0x100182c4
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
cmp dword [eax + ecx*4], ebx
jne 0x100182c4
mov edi, ebx
jmp 0x100182c9
xor eax, eax
lea edi, [eax + 1]
mov edx, dword [esp + 0x10]
xor ecx, ecx
mov esi, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
sub edi, eax
imul edi, dword [esp + 0x10]
mov eax, dword [esp + 0x40]
push 2
cmp edi, dword [eax + edx*4]
setg cl
xor edx, edx
cmp ecx, dword [eax + esi*4]
setg dl
xor eax, eax
mov dword [esp + 0x144], edx
cmp edx, 0xf219a6f
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x20]
sete al
mov ecx, dword [esp + 0x44]
xor edx, edx
cmp dword [ecx + esi*4], eax
pop esi
setle dl
xor eax, eax
sub edx, dword [ecx]
cmp dword [ecx + edi*4], edx
mov ecx, dword [esp + 0x28]
setne al
mov dword [esp + 0x20], eax
dec dword [esp + 0x10]
jns 0x10018281
push 3
pop edi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x1001825b
lea ecx, [esp + 0x40]
call fcn.10016178
xor ecx, ecx
mov dword [esp + 0x20], 9
mov dword [esp + 0x10], ebx
inc ecx
jmp 0x10018370
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x78], 0xfffffff9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x10018360
mov dword [esp + 0x10], ebx
jmp 0x10018392
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xa4]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001837c
mov eax, dword [esp + 0xa4]
lea ecx, [esp + 0xa4]
dec dword [eax + 4]
or dword [esp + 0x1c4], 0xffffffff
call fcn.10016178
mov dword [esp + 0x14], 8
xor ecx, ecx
mov dword [esp + 0xc], 0x76acb8f2
inc ecx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ebx
jmp 0x100183e6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x170], 0x72c02a3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100183d3
mov dword [esp + 0x10], ebx
jmp 0x10018405
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1a0], 0xabac89d7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100183f2
mov dword [esp + 0x14], ebx
jmp 0x100184d0
mov dword [esp + 0x20], 0xc234
mov dword [esp + 0x1c], 0xfffffffe
cmp dword [esp + 0x14], ebx
je 0x10018440
mov eax, dword [esp + 0x14]
mov edx, ecx
neg eax
sbb eax, eax
neg eax
imul eax, eax, 0xe661
test eax, eax
jne 0x10018442
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x14]
cmp edx, eax
setle cl
add ecx, dword [esp + 0x14]
mov dword [esp + 0xc], ecx
xor ecx, ecx
mov eax, dword [esp + 0xc]
inc ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp ecx, eax
sbb edx, edx
neg edx
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [esp + 0x170], ecx
mov dword [esp + 0x1c], 0xffffffff
jmp 0x100184c2
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100184be
push ebx
push 0x1de3
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0x15
jg 0x100184a7
inc dword [esp + 0x14]
xor ecx, ecx
inc ecx
cmp dword [esp + 0x14], ecx
jge 0x10018414
mov dword [esp + 0xc], 0xffffffff
xor edx, edx
mov dword [esp + 0x20], ecx
mov dword [esp + 0x28], 0xe6a3735b
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x20]
sub ecx, 0x2d68d631
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xe60f
sete al
cmp dword [esp + 0xc], eax
je 0x1001852a
mov dword [esp + 0x20], 0xffff
mov dword [esp + 0x20], 0xffffffff
jmp 0x10018532
mov dword [esp + 0x28], 0xf65e790e
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x1001855e
push ebx
push 0xd59
push 0x167d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
mov dword [esp + 0x14], 0x60477862
lea ecx, [esp + 0x4c]
push esi
call fcn.100158b8
mov dword [esp + 0x1c4], 3
mov dword [esp + 0xc], ebx
jmp 0x10018594
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x4c]
mov dword [eax + ecx*4], 6
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x10018581
mov dword [esp + 0x14], ebx
jmp 0x10018610
push dword [esp + 0x78]
movdqa xmm0, xmmword [0x10008010]
lea eax, [esp + 0x158]
push eax
lea eax, [esp + 0x14c]
mov dword [esp + 0x14], 0xfff8
push eax
mov dword [esp + 0x2c], 0x5c62e089
lea ecx, [esp + 0x78]
push ebx
movdqu xmmword [esp + 0x154], xmm0
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], ebx
call fcn.10016f9b
mov eax, dword [esp + 0xc]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x6c]
mov dword [eax], ecx
lea ecx, [esp + 0x6c]
call fcn.10016178
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffff
je 0x100185a0
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
jl 0x10018726
mov dword [esp + 0x1c], 0x49f6d4a0
mov dword [esp + 0x20], 0xfffffffc
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x1001870f
mov dword [esp + 0xc], 0xffffffff
lea ecx, [esp + 0x98]
push 4
call fcn.100158b8
mov dword [esp + 0xc], ebx
jmp 0x1001867b
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x10018665
mov esi, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x4c]
mov eax, dword [eax + ecx*4]
mov dword [edx + esi*4], eax
xor edx, edx
mov dword [esp + 0x20], eax
inc edx
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
cmp edx, eax
sbb eax, eax
neg eax
cmp eax, edx
jb 0x100186ec
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x4c]
mov eax, dword [eax + ecx*4]
dec eax
je 0x100186dd
cmp dword [esp + 0x14], ebx
je 0x100186dd
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x4c]
cmp dword [eax + ecx*4], ebx
mov ecx, edx
jne 0x100186ee
mov ecx, ebx
mov eax, dword [esp + 0x98]
mov dword [eax + 8], ecx
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x98]
call fcn.10016178
inc dword [esp + 0x1c]
xor eax, eax
inc eax
cmp dword [esp + 0x1c], eax
jle 0x10018649
dec dword [esp + 0x14]
jns 0x10018628
push 2
pop esi
or dword [esp + 0x1c4], 0xffffffff
lea ecx, [esp + 0x4c]
call fcn.10016178
mov dword [esp + 0xc], ebx
jmp 0x1001874d
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x38], 8
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jl 0x1001873d
xor eax, eax
lea ecx, [esp + 0xf4]
inc eax
mov dword [esp + 0x1c], eax
push 3
call fcn.100158b8
xor eax, eax
inc eax
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], ebx
jmp 0x1001878b
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xf4]
mov dword [eax + ecx*4], 0x13d
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x10018775
mov dword [esp + 0x1c], 0x1a
cmp dword [esp + 0x1c], 0x1b
jl 0x100188b5
mov eax, 0xf1e5c8a5
mov dword [esp + 0x24], 0x772304b2
mov dword [esp + 0xc8], eax
mov dword [esp + 0xcc], eax
mov dword [esp + 0xd0], eax
mov dword [esp + 0xd4], eax
mov dword [esp + 0x20], 0xc44d4e2b
mov dword [esp + 0x24], ebx
jmp 0x1001886e
mov dword [esp + 0x10], 8
mov dword [esp + 0x10], ebx
jmp 0x10018864
mov dword [esp + 0x28], 0xea66e58d
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], esi
cmp dword [esp + 0x28], ebx
jl 0x10018834
mov dword [esp + 0xc], 0xe135e1f6
mov dword [esp + 0xc], ebx
jmp 0x10018828
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x10018824
push ebx
push ebx
call dword [sym.imp.GDI32.dll_RectInRegion]
inc dword [esp + 0xc]
cmp dword [esp + 0xc], esi
jle 0x10018811
dec dword [esp + 0x28]
jns 0x10018803
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x28], 0xc3f4f880
sbb eax, eax
inc eax
mov dword [esp + 0xd0], eax
jne 0x10018858
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x100187ed
inc dword [esp + 0x24]
cmp dword [esp + 0x24], esi
jle 0x100187df
cmp dword [esp + 0x14], ebx
je 0x10018888
mov dword [esp + 0x14], 0xd91f06e8
jmp 0x100188a1
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100188a1
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
inc dword [esp + 0x1c]
mov eax, 0xf1e5c8a5
cmp dword [esp + 0x1c], 0x1b
jge 0x100187aa
mov byte [esp + 0x1b], bl
cmp byte [esp + 0x1b], 0
je 0x100188d0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
lea ecx, [esp + 0xf4]
call fcn.10016178
push 0x1f3d
push ebx
lea eax, [esp + 0x37]
mov byte [esp + 0x37], bl
push eax
push 0x193
call fcn.10019530
add esp, 0x10
mov dword [esp + 0x28], 0xffffffff
xor eax, eax
mov dword [esp + 0x20], 0xfff9
inc eax
lea ecx, [esp + 0xe8]
push eax
call fcn.100158b8
xor edx, edx
mov dword [esp + 0x1c4], 4
mov dword [esp + 0xc], ebx
inc edx
jmp 0x10018942
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xe8]
mov dword [eax + ecx*4], 0xdfd99643
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x1001892c
mov dword [esp + 0x28], ebx
jmp 0x100189ac
push edx
lea ecx, [esp + 0xb4]
call fcn.100158b8
xor edx, edx
mov dword [esp + 0x20], 0x3b0639e6
inc edx
mov dword [esp + 0x20], edx
mov dword [esp + 0xc], ebx
jmp 0x10018986
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0xb0]
mov dword [eax + ecx*4], 0xeede0b40
inc dword [esp + 0xc]
cmp dword [esp + 0xc], edx
jl 0x10018970
mov eax, dword [esp + 0xb0]
lea ecx, [esp + 0xb0]
mov dword [eax], 9
call fcn.10016178
dec dword [esp + 0x28]
push 1
pop edx
cmp dword [esp + 0x28], 0xffffffe6
jg 0x1001894e
or dword [esp + 0x1c4], 0xffffffff
lea ecx, [esp + 0xe8]
call fcn.10016178
mov dword [esp + 0x38], 0xfffffffd
cmp dword [esp + 0x38], 0x14
je 0x10018bd2
push 3
pop edi
mov dword [esp + 0x20], 0xfffffffa
lea ecx, [esp + 0x120]
xor eax, eax
inc eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0x398070a
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], 0x8974b666
mov dword [esp + 0x20], 0x367f5ed9
push esi
call fcn.100158b8
mov dword [esp + 0x12c], edi
mov dword [esp + 0x130], edi
mov dword [esp + 0x134], edi
mov dword [esp + 0x138], edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], ebx
jmp 0x10018a59
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0x11151c3c
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10018a43
mov dword [esp + 0x10], ebx
jmp 0x10018a78
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x17c], 0xfb2c41ac
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10018a65
inc dword [esp + 0x20]
lea ecx, [esp + 0x120]
call fcn.10016178
mov byte [esp + 0x2e], bl
xor ecx, ecx
mov dword [esp + 0x14], 8
inc ecx
mov dword [esp + 0xc], 0x76acb8f2
mov dword [esp + 0x20], ecx
mov dword [esp + 0x10], ebx
jmp 0x10018ac2
mov eax, dword [esp + 0x7c]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x34]
mov edi, edx
mov esi, eax
call fcn.10017873
mov ecx, dword [esp + 0x1bc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret