Function at 0x1001800d
Capabilities:
Get common file path
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1bc
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0xffffffff
xor ebx, ebx
push 3
mov dword [ebp - 0x20], 0x40c8e82b
mov dword [ebp - 0xb8], edx
mov dword [ebp - 0xb4], ecx
mov dword [ebp - 8], ebx
pop edi
jmp 0x10018047
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x44], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x1001803d
mov dword [ebp - 8], ebx
jmp 0x10018062
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xe4], 0x9884cb8
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x10018051
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov esi, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
setne dl
sub esi, edx
neg esi
push 1
sbb esi, esi
xor ecx, ecx
inc esi
cmp eax, esi
pop esi
setne cl
cmp ecx, dword [ebp - 0x44]
jg 0x10018097
mov eax, esi
cmp dword [ebp - 0x40], ebx
jne 0x10018099
mov eax, ebx
mov ecx, dword [ebp - 0x44]
xor edx, edx
imul ecx, eax
push 0xfffffffffffffff6
mov dword [ebp - 0xe4], ecx
mov eax, dword [ebp - 0x44]
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x44]
sete bl
xor ecx, ecx
cmp ebx, eax
pop ebx
setg cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0xe4], eax
test eax, eax
je 0x10018176
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe4]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x44]
setl cl
xor edx, edx
sub ecx, 0x1b0ce7ae
cmp ecx, 0x5835
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ebx, ecx
mov dword [ebp - 0xdc], ecx
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
imul ecx, eax, 0x9773
mov eax, dword [ebp - 0x40]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0xb705
setg al
cmp eax, 0x8d7c584e
mov eax, dword [ebp - 0x14]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, 2
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, 0xa
sub ecx, dword [ebp - 0x44]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
neg eax
je 0x10018176
mov eax, esi
xor ebx, ebx
jmp 0x1001817a
xor ebx, ebx
mov eax, ebx
cmp eax, dword [ebp - 0x40]
jne 0x10018182
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x44]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xe7aebb1b
push 9
setg cl
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0xfc], eax
pop eax
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
push 2
mov dword [ebp - 0x10c], eax
mov dword [ebp - 8], ebx
pop ecx
jmp 0x100181f0
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x64], 0xffffffff
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x100181e2
mov dword [ebp - 8], ebx
jmp 0x1001820b
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x164], 0x637b3047
inc dword [ebp - 8]
cmp dword [ebp - 8], edi
jl 0x100181fa
cmp dword [ebp - 0x60], ebx
je 0x10018270
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0xc], ebx
jmp 0x1001822e
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xc8], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10018221
mov dword [ebp - 0xc8], ebx
jmp 0x10018250
mov eax, dword [ebp - 0xc8]
mov dword [ebp + eax*4 - 0x64], 0xfffffffe
inc dword [ebp - 0xc8]
cmp dword [ebp - 0xc8], ecx
jl 0x1001823c
mov dword [ebp - 0x10], ebx
jmp 0x10018269
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x64], ebx
jne 0x10018282
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x1001825d
jmp 0x10018282
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001827f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x60]
xor edx, edx
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x108]
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
setg dl
xor eax, eax
cmp edx, 0x895c
setg al
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10], 0x3b26bdde
mov dword [ebp - 0x10], ebx
jmp 0x10018312
mov dword [ebp - 0xc], ebx
jmp 0x100182e9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xac], 0x18d58162
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100182d8
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018307
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RealizePalette]
cmp dword [ebp - 0xac], ebx
jne 0x10018318
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff5
jl 0x100182d3
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x10], 0xf93bd5de
mov dword [ebp - 0x18], 0x50270f9e
mov dword [ebp - 0xc], 0x70e7ad53
mov dword [ebp - 0x28], 0x4edc0223
mov dword [ebp - 0x14], 0x2d5fba25
mov dword [ebp - 0x1c], 0xfffc
mov dword [ebp - 0x2c], 0x35309f33
mov dword [ebp - 8], ebx
jmp 0x10018366
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x84], 0x6310feca
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jl 0x10018355
mov dword [ebp - 8], ebx
jmp 0x1001837e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xa4], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10018371
cmp dword [ebp - 0x84], ebx
jle 0x100183a2
mov eax, dword [ebp - 0x80]
mov edx, esi
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x18], ebx
jne 0x100183a4
mov edx, ebx
mov eax, dword [ebp - 0x80]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
sete cl
imul eax, ecx
mov ecx, dword [ebp - 0x80]
neg ecx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0xc], ecx
je 0x100183cc
mov edx, esi
cmp dword [ebp - 0x80], ebx
jne 0x100183ce
mov edx, ebx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
sete cl
imul ecx, dword [ebp - 0x80]
test ecx, ecx
jne 0x100183ea
mov ecx, ebx
cmp dword [ebp - 0x84], ebx
je 0x100183ec
mov ecx, esi
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
neg eax
shl eax, 2
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x2d1f
setg al
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0x76e3b61e
mov dword [ebp - 0x28], 0x1b4adc7c
mov dword [ebp - 0x20], 0x6ffb
mov dword [ebp - 0xc], ebx
jmp 0x10018479
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x138], 0xe4bca0f9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10018468
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x100184ab
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xfffffff6
mov dword [ebp - 0x24], 0x1dd571b4
dec dword [ebp - 0x130]
dec dword [ebp - 0x14]
jns 0x1001848b
mov eax, dword [ebp - 0x20]
xor edx, edx
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x130]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
imul eax, dword [ebp - 0xc]
sub edx, eax
add edx, dword [ebp - 0x138]
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 8], 0x25062d7b
mov dword [ebp - 0xc], ebx
jmp 0x100184fa
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], 0x13dd33a4
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x100184ec
mov dword [ebp - 0x48], 0xfffffffd
cmp dword [ebp - 0x48], 0xc
jge 0x100186cb
mov eax, 0xe65251c6
mov edi, 0xffff
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0xc], ebx
jmp 0x10018544
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x18c], 0xfffffffa
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10018533
mov eax, dword [ebp - 0x4c]
xor edx, edx
imul eax, dword [ebp - 0x48]
imul ecx, eax, 0xffff
imul eax, dword [ebp - 0x4c], 0x92f6
add ecx, 0x3a3d
cmp eax, ecx
setl dl
sub edx, 0x42fca3a9
je 0x1001857a
mov eax, esi
cmp dword [ebp - 0x54], ebx
jne 0x1001857c
mov eax, ebx
imul eax, eax, 0x8c9f
push 3
pop edx
mov dword [ebp - 8], eax
mov dword [ebp - 8], ebx
jmp 0x100186a8
mov dword [ebp - 0x1c], 0x57a67d92
mov dword [ebp - 0x1c], ebx
jmp 0x100185b4
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x5c], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1001859c
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jl 0x100186a5
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp + eax*4 - 0x5c], 0x51cd
test eax, eax
jne 0x10018618
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x5c]
cmp dword [ebp - 0x54], eax
jl 0x100185e9
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, ebx
setg dl
cmp edx, dword [ebp - 0x18c]
jle 0x1001861a
mov eax, esi
imul eax, eax, 0x7253
xor ecx, ecx
cmp eax, 0x5e34605d
setg cl
cmp edi, ecx
sbb eax, eax
inc eax
cmp eax, 0xbf567d7
jne 0x1001863d
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1001863f
mov ecx, esi
mov eax, dword [ebp - 0x1c]
push 3
mov edx, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 0x1c]
add edx, ecx
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x5c]
cmp edx, eax
pop edx
setl cl
xor eax, eax
cmp ecx, 0xffffffff
setg al
sub eax, dword [ebp - 0x18c]
neg eax
sbb eax, eax
inc eax
imul ecx, eax, 0x1ede
mov eax, dword [ebp - 0x1c]
sub ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x10], ebx
jmp 0x10018697
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018694
push 0x22
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
push 3
pop edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1001867f
dec dword [ebp - 0x1c]
jns 0x100185c5
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jle 0x10018590
inc dword [ebp - 0x48]
mov eax, 0xe65251c6
cmp dword [ebp - 0x48], 0xc
jl 0x1001851b
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
jmp 0x100186ce
push 3
pop edx
mov dword [ebp - 0xc], 0xa023703a
mov dword [ebp - 0x10], 0x48bbca63
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], 0x4a90611b
mov dword [ebp - 0x20], 0x67ee39f3
mov dword [ebp - 0x10], 0x1a
jmp 0x10018713
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], 0x5e07
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
je 0x100186f6
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], 0x8ef8a6eb
mov dword [ebp - 0x10], 0xa115252c
mov dword [ebp - 0x10], ebx
jmp 0x10018740
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x198], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001872f
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001875f
push ebx
push esi
push 0x22a2
push ebx
call dword [sym.imp.USER32.dll_SetMenuItemInfoW]
push 3
pop edx
mov dword [ebp - 0x10], ebx
jmp 0x10018771
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x198], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10018764
push 2
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1001878f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf8], 0xa11600d5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001877e
mov dword [ebp - 0x1c], 0xb21a35ca
mov dword [ebp - 0x14], 0x2a26f3f1
mov dword [ebp - 8], 0x37c1
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x24], 0x174a
mov dword [ebp - 0x28], 0x2679f1a7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x100187d6
mov eax, dword [ebp - 0x1c]
mov ecx, esi
cmp dword [ebp - 8], ebx
jne 0x100187d8
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0xd5d7
setne dl
imul eax, ecx, 9
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x10], ecx
mov ecx, 0xffff
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x1c]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x10], ebx
je 0x1001889a
mov dword [ebp - 0x18], 0xf585950c
mov dword [ebp - 0x10], ebx
jmp 0x10018835
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb0], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10018828
mov dword [ebp - 8], ebx
jmp 0x10018864
mov dword [ebp - 0x24], 0xfffffff6
inc dword [ebp - 0x18]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018861
push ebx
push 0x2020
call edi
push eax
call dword [sym.imp.USER32.dll_GetScrollInfo]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x33
je 0x1001883f
push 0xb
mov dword [ebp - 0x18], 0x15
pop eax
jmp 0x10018890
mov dword [ebp - 0x14], ebx
jmp 0x10018888
mov dword [ebp - 0xb0], 0x1d976d99
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jne 0x1001887b
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
jle 0x10018876
jmp 0x10018935
mov dword [ebp - 0x28], 0x7b1aa435
mov dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x100188f1
mov dword [ebp - 0x14], 0xfffffff7
cmp dword [ebp - 0x14], ebx
jne 0x100188c2
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov edx, esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
sub eax, 0xfffffff8
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 8], ebx
jne 0x100188f3
mov edx, ebx
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffffb
sete cl
xor edx, edx
imul eax, ecx, 0xffff
cmp eax, 0xf606
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp eax, ecx
pop ecx
sbb eax, eax
neg eax
cmp ecx, eax
mov eax, dword [ebp - 8]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], ebx
jmp 0x10018c02
mov dword [ebp - 0x14], 0xffffffff
push 3
mov dword [ebp - 0x24], 0x40c8e82b
mov dword [ebp - 8], ebx
pop ecx
jmp 0x1001895d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x38], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10018953
mov dword [ebp - 8], ebx
jmp 0x10018978
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xf0], 0x9884cb8
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x10018967
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov esi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
setne dl
sub esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
cmp eax, esi
setne cl
cmp ecx, dword [ebp - 0x38]
jg 0x100189af
cmp dword [ebp - 0x34], ebx
je 0x100189af
xor esi, esi
inc esi
mov eax, esi
jmp 0x100189b4
xor esi, esi
mov eax, ebx
inc esi
mov ecx, dword [ebp - 0x38]
xor edx, edx
imul ecx, eax
mov dword [ebp - 0xf0], ecx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x38]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x38]
sete bl
xor ecx, ecx
cmp ebx, eax
setg cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xf0], eax
test eax, eax
je 0x10018a91
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf0]
neg edx
push 0xfffffffffffffff6
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setl cl
xor edx, edx
sub ecx, 0x1b0ce7ae
cmp ecx, 0x5835
setl dl
xor ecx, ecx
cmp edx, eax
pop eax
setle cl
cmp eax, ecx
mov dword [ebp - 0xe8], ecx
sbb eax, eax
xor edx, edx
inc eax
add eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
imul ecx, eax, 0x9773
mov eax, dword [ebp - 0x34]
cmp eax, ecx
setne dl
xor eax, eax
cmp edx, 0xb705
setg al
cmp eax, 0x8d7c584e
mov eax, dword [ebp - 0x14]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setne cl
xor edx, edx
cmp ecx, 2
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, 0xa
sub ecx, dword [ebp - 0x38]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
neg eax
je 0x10018a91
mov eax, esi
xor ebx, ebx
jmp 0x10018a95
xor ebx, ebx
mov eax, ebx
cmp eax, dword [ebp - 0x34]
jne 0x10018a9d
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x38]
xor edx, edx
mov eax, dword [ebp - 0x30]
cmp eax, ecx
mov eax, dword [ebp - 0x38]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], 0x2d9e
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0xe0648261
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], ebx
jmp 0x10018ae5
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018ae2
call edi
push eax
call dword [sym.imp.USER32.dll_ShowCaret]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe3
je 0x10018ad0
mov dword [ebp - 0x1c], ebx
jmp 0x10018b52
cmp dword [ebp - 0x14], esi
jge 0x10018b09
mov ecx, 0xffff
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10018afa
mov eax, dword [ebp - 0x68]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x1c]
imul edx, eax
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x68]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
sub eax, edx
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jg 0x10018b4a
mov eax, esi
cmp dword [ebp - 0x1c], ebx
jne 0x10018b4c
mov eax, ebx
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
mov dword [ebp - 0x14], ebx
jle 0x10018af0
jmp 0x10018b6e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x170], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10018b5d
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
sub ecx, 0x289fff12
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0xf8], edx
mov eax, dword [ebp - 0x10]
cmp edx, eax
setg cl
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], ebx
je 0x10018bad
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xf8]
xor ecx, ecx
cmp eax, 0xffffffff
setl cl
mov dword [ebp - 0x170], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x16c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], ebx
jmp 0x10018bf9
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018bf6
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x1e
je 0x10018be4
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff2
jl 0x1001893d
mov dword [ebp - 0x14], 0xfffffffe
mov dword [ebp - 0x1c], 0x1647c2c9
mov dword [ebp - 0x18], 5
mov dword [ebp - 8], 0x82c4475e
mov dword [ebp - 0x10], 0x2487223b
mov dword [ebp - 0xc], ebx
jmp 0x10018c41
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1b0], ebx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x10018c34
mov eax, dword [ebp - 0x14]
xor ecx, ecx
sub eax, 0x5184860a
cmp eax, esi
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x10018c68
mov eax, esi
xor edx, edx
cmp eax, 0xb979cd32
mov eax, dword [ebp - 0x14]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
imul ecx, eax
xor eax, eax
test ecx, ecx
mov dword [ebp - 0x1b0], ecx
setne al
mov dword [ebp - 0x10], eax
imul ecx, dword [ebp - 0x10], 0xffff
mov eax, dword [ebp - 0x14]
add eax, 0xffff38eb
add eax, ecx
je 0x10018d35
mov dword [ebp - 0x10], ebx
jmp 0x10018d18
mov dword [ebp - 0x18], 0xfffffff1
cmp dword [ebp - 0x18], 0x12
jge 0x10018d15
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x24], 0x5ca2589d
mov dword [ebp - 0x28], 0x511bd77d
mov dword [ebp - 0x1c], 0x14
jmp 0x10018d07
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018cef
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 8], 0x19
jmp 0x10018cfe
inc dword [ebp - 0x28]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff8
jge 0x10018cf8
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
jle 0x10018cdb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x12
jl 0x10018cc4
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x11
je 0x10018cb4
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018d61
push ebx
push 0x2339
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10018d61
mov dword [ebp - 0x14], 8
jmp 0x10018d5b
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018d58
push 0x1d49
push 0x2034
push ebx
call dword [sym.imp.USER32.dll_RemoveMenu]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jne 0x10018d3e
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018d71
push ebx
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, 0xffff
mov dword [ebp - 0x18], 0x4fd3df75
mov dword [ebp - 0x28], 0xfffffff7
mov dword [ebp - 0x2c], 0x402e31d8
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x18], 0xffffffea
jmp 0x10018e34
mov dword [ebp - 0xc], 0xc157
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x14], esi
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], esi
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x2c], ebx
je 0x10018dd7
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 0xc]
xor ecx, ecx
add esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0xc]
setl cl
xor edx, edx
cmp ecx, esi
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor esi, esi
mov dword [ebp - 0x10], ecx
inc esi
mov ecx, ebx
cmp dword [ebp - 0x10], ebx
je 0x10018e08
mov ecx, esi
mov eax, dword [ebp - 0x14]
sub ecx, eax
cmp ecx, 0xb085bb31
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xfffffffb
setne cl
dec ecx
cmp dword [ebp - 0xc], ecx
jl 0x10018e2c
mov eax, esi
cmp dword [ebp - 0x10], ebx
jne 0x10018e2e
mov eax, ebx
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffec
jg 0x10018da3
mov dword [ebp - 0xc], ebx
jmp 0x10018e54
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1bc], 0x61f9
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x10018e43
mov dword [ebp - 0x18], 0x6d444182
mov dword [ebp - 0x20], 0x465ee6d5
mov dword [ebp - 8], ebx
jmp 0x10018e7e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x158], 0x7fd5464b
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x10018e6d
mov dword [ebp - 8], ebx
jmp 0x10018e9a
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x98], 0xe29ac92d
inc dword [ebp - 8]
cmp dword [ebp - 8], esi
jl 0x10018e89
mov dword [ebp - 0x18], ebx
jmp 0x10018f49
mov dword [ebp - 8], 0xfffffff9
mov dword [ebp - 0x20], 0x3650dfa0
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018ec8
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
mov dword [ebp - 8], ebx
jmp 0x10018f40
mov dword [ebp - 0x2c], 0xffffffff
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x158]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x154]
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x158], ecx
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
inc eax
cmp eax, 0x106ec6e5
setle cl
sub ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
add eax, ecx
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x98], ebx
jne 0x10018f46
inc dword [ebp - 8]
cmp dword [ebp - 8], 3
jle 0x10018ecd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x10018ea7
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018f68
push 0x17c9
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push ebx
call fcn.1001cbeb
mov dword [ebp - 0xc], 0xf9c28ade
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 0xef8a6ebb
mov dword [ebp - 0x20], 0xfffffff8
pop ecx
mov dword [ebp - 0xc], ebx
jmp 0x10018fa0
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1a0], 3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10018f8f
dec dword [ebp - 0x20]
mov dword [ebp - 0xc], esi
cmp dword [ebp - 0xc], ebx
jl 0x10018fc8
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10018fc3
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
dec dword [ebp - 0xc]
jns 0x10018fb1
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x100192a5
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x94], eax
xor edx, edx
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], 0x9d73ae4c
mov dword [ebp - 0x2c], 0x29a2a67f
mov dword [ebp - 0x20], 0xeb818f8f
mov dword [ebp - 0x18], 0xfffd
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x88]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], ebx
jne 0x10019076
mov edx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10019078
mov edx, esi
mov ecx, dword [ebp - 0x8c]
xor eax, eax
neg edx
cmp edx, ecx
setne al
xor edx, edx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x8c]
cmp edx, eax
setge cl
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
je 0x100190b7
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8c]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 0x2fc5
setne al
cmp eax, 0xffffffff
jne 0x10019106
mov dword [ebp - 0x2c], 0xfffffffc
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10019266
push ebx
push 0x1882
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x10019266
mov dword [ebp - 8], 0xd0ee3b00
mov dword [ebp - 0x28], 0xfffffff9
mov dword [ebp - 0x2c], 0x9dd62858
mov dword [ebp - 0xc], ebx
jmp 0x1001912e
cmp dword [ebp - 0xc], 2
jl 0x10019120
mov dword [ebp - 0x18], 0xffffffe8
jmp 0x10019294
push 4
pop edi
mov dword [ebp - 0x14], 0xfffffff7
mov dword [ebp - 0x18], edi
push 0xfffffffffffffff6
mov dword [ebp - 0x24], esi
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], ebx
jmp 0x100192d1
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x9c], 0x845925f8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100192c0
mov dword [ebp - 0xc], esi
xor edx, edx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ebx, ebx
cmp eax, edx
setge bl
xor ecx, ecx
sub ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ebx, eax
setge cl
cmp ecx, 0x5e0b
je 0x10019308
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, 0xffff
mov dword [ebp - 0x18], eax
mov eax, esi
cmp dword [ebp - 0x18], ebx
jne 0x10019327