Function at 0x1000b0e5
Capabilities:
Accept command line arguments
Delete registry key
Get common file path
Get keyboard layout

Disassembly:
mov eax, 0x100726ec
call fcn.10072258
sub esp, 0x16c
mov dword [ebp - 0x20], 8
mov eax, 0x6082f4e5
mov dword [ebp - 0x24], 0x8c9a01c7
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
push ebx
mov dword [ebp - 0xa0], eax
xor ebx, ebx
mov dword [ebp - 0x9c], eax
push esi
mov dword [ebp - 0x30], 0x52705104
mov eax, dword [ebp - 0x20]
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x48], dl
mov dword [ebp - 0x54], ecx
cmp eax, dword [ebp - 0x20]
jg 0x1000b377
xor esi, esi
inc esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x2c], 0xa527
mov dword [ebp - 0x40], 0x1e183a09
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x18], ebx
jne 0x1000b160
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, esi
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], ecx
xor ecx, ecx
cmp dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
mov dword [ebp - 0xa4], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
neg ecx
je 0x1000b1e2
mov ecx, esi
cmp dword [ebp - 0x18], ebx
jne 0x1000b1e4
mov ecx, ebx
xor eax, eax
cmp ecx, 7
setge al
sub eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x2c]
jg 0x1000b202
cmp dword [ebp - 0x24], ebx
jne 0x1000b209
mov eax, ebx
cmp dword [ebp - 0x20], ebx
je 0x1000b20b
mov eax, esi
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000b222
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009a60]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x140]
mov dword [ebp - 0x30], 9
push eax
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0xd8]
mov dword [ebp - 0x34], 0xd453606d
push ebx
movdqu xmmword [ebp - 0x140], xmm0
mov dword [ebp - 0xd8], ebx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
call fcn.100124f1
mov dword [ebp - 0x2c], 0xfffffffd
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b28d
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
inc dword [ebp - 0x2c]
lea ecx, [ebp - 0xd8]
call fcn.1000fa6d
mov edi, dword [0x100795fc]
mov dword [ebp - 0x24], 0x50a5
cmp dword [ebp - 0x24], 0x5401
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x68], edi
jle 0x1000b323
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov eax, edi
mov dword [ebp - 0x2c], 0x1f49
mov dword [ebp - 0x1c], eax
mov edi, ebx
add eax, edi
lea ecx, [ebp - 0x160]
cdq
push edx
push eax
call fcn.1000b06a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000b2e8
mov eax, dword [eax]
push eax
call fcn.100598a3
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x160]
call fcn.1000ff15
mov eax, dword [ebp - 0x1c]
inc edi
cmp edi, 0x555
jl 0x1000b2ce
dec eax
dec dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
jne 0x1000b2cc
mov edi, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x757e
jl 0x1000b2c0
mov edi, dword [ebp - 0x68]
mov dword [ebp - 0x2c], 3
xor ecx, ecx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x34], 0x5a592c6e
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x34], 0x632c5b64
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x2c]
cmp eax, 0x19ac196a
setne cl
xor eax, eax
cmp ecx, esi
setl al
xor ecx, ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sbb edx, edx
inc edx
cmp eax, edx
setge cl
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0x19
jmp 0x1000b476
mov dword [ebp - 0x18], 0xd734895c
mov dword [ebp - 0x24], 5
cmp dword [ebp - 0x24], 5
jge 0x1000b3d7
cmp dword [ebp - 0x18], ebx
jne 0x1000b3d7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1000b3d2
push ebx
push 0x841
push 0x20c0
push ebx
push 0x6fb
push 0x67d
push 0x4e1
push 0x2cb
push 0x17a1
push 0xbd2
push 0x1b75
push 0x1889
call dword [sym.imp.GDI32.dll_MaskBlt]
inc dword [ebp - 0x24]
jmp 0x1000b385
push 3
xor esi, esi
mov dword [ebp - 0x20], ebx
pop edi
inc esi
cmp dword [ebp - 0x20], edi
jg 0x1000b222
mov dword [ebp - 0x34], 0xf6ec
mov dword [ebp - 0x18], ebx
jmp 0x1000b429
mov dword [ebp - 0x40], 0xf1db06d6
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa8], esi
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x40], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x1000b3f5
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1000b456
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b445
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa8], ebx
jne 0x1000b456
dec dword [ebp - 0x18]
jns 0x1000b436
inc dword [ebp - 0x20]
jmp 0x1000b3e0
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xfc36fe5a
mov dword [ebp - 0x2c], 0x678e045d
inc dword [ebp - 0x2c]
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x15
je 0x1000b45b
cmp dword [ebp - 0x24], 0x4e3d
jge 0x1000b490
push 0x10007810
call fcn.100598a3
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x48], 0
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
je 0x1000b4ba
cmp edi, esi
jne 0x1000b4ba
mov dword [eax + 8], 4
mov dword [eax + 0xc], 0x100795fc
mov dword [ebp - 0x28], 0x8a61928c
lea ecx, [ebp - 0xf0]
mov dword [ebp - 0x34], 0x10fecafe
mov dword [ebp - 0x38], ebx
push 2
call fcn.1000fa0b
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x1c], ebx
jmp 0x1000b4fe
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], 0x515466bc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000b4eb
mov dword [ebp - 0x28], ebx
jmp 0x1000b639
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x18], ebx
jmp 0x1000b525
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11c], 8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000b514
mov dword [ebp - 0x18], ebx
jmp 0x1000b53e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x70], 0xcfe04822
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000b530
mov dword [ebp - 0x70], 3
cmp dword [ebp - 0x70], ebx
jl 0x1000b636
mov edi, dword [ebp - 0xf0]
mov dword [ebp - 0x1c], 0x4bc662a2
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x50], 0xf6e229ed
mov dword [ebp - 0x24], 0x921e124d
mov dword [ebp - 0x1c], ebx
jmp 0x1000b58f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x130], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000b582
mov dword [ebp - 0x1c], ebx
jmp 0x1000b5b1
mov dword [ebp - 0x34], 0x917ab6da
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xd76270e7
dec dword [ebp - 0x2c]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x1000b59a
mov eax, dword [ebp - 0x70]
cmp dword [ebp + eax*4 - 0x11c], ebx
jne 0x1000b60f
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, esi
mov eax, dword [ebp - 0x114]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x70]
setg dl
mov dword [ebp - 0x38], edx
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp dword [ebp - 0x38], eax
setge cl
lea eax, [ecx - 0x38967981]
xor ecx, ecx
add eax, edx
setns cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x12c]
xor ecx, ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x70]
mov eax, dword [ebp + eax*4 - 0x11c]
cmp dword [edi + 4], eax
setl cl
mov dword [ebp - 0x38], ecx
dec dword [ebp - 0x70]
jns 0x1000b55a
dec dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xffffffed
jg 0x1000b50c
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b65a
push ebx
push ebx
push ebx
push 0x1d69
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
lea ecx, [ebp - 0xf0]
call fcn.1000fa6d
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x54], eax
jge 0x1000c344
mov dword [ebp - 0x34], 0x862fd41e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b688
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b699
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, 0x10079600
mov dword [ebp - 0x34], 0xbcd
mov dword [ebp - 0x34], 0xfffffff8
lea ecx, [ebp - 0x128]
push 4
mov dword [ebp - 0x24], edi
call fcn.1000fa0b
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], 0x260389a9
mov dword [ebp - 0x1c], ebx
jmp 0x1000b6e5
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1000b6d2
dec dword [ebp - 0x2c]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b705
push ebx
push ebx
push 0x141
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
lea ecx, [ebp - 0x128]
call fcn.1000fa6d
cmp dword [ebp - 0x54], 0
mov dword [ebp - 0x44], ebx
jle 0x1000bc69
mov dword [ebp - 0x20], 0x60b4ffb8
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], 0xdbc9b780
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x20], ebx
je 0x1000b79f
mov dword [ebp - 0x2c], 0xffff9f6c
xor edx, edx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
cmp ecx, eax
setl dl
mov dword [ebp - 0x24], edx
mov ecx, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
cmp ecx, 8
jle 0x1000b779
cmp dword [ebp - 0x20], ebx
jne 0x1000b77c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x59c3f908
setge al
imul eax, dword [ebp - 0x20]
test eax, eax
mov eax, esi
jne 0x1000b7a1
mov eax, ebx
cmp dword [ebp - 0x20], eax
je 0x1000b7e8
mov dword [ebp - 0x1c], ebx
jmp 0x1000b7bc
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x148], 0x54c3ebe1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000b7ab
mov dword [ebp - 0x24], ebx
jmp 0x1000b7e1
mov dword [ebp - 0x2c], 0xad4db1d7
mov dword [ebp - 0x18], ebx
jmp 0x1000b7d9
inc dword [ebp - 0x2c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1000b7d3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1000b7c7
jmp 0x1000b804
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b804
push ebx
push ebx
push 0x1a8c
push 0x1698
push ebx
call dword [sym.imp.USER32.dll_ModifyMenuW]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, 0xad33dc28
setne cl
imul ecx, dword [ebp - 0x18]
cmp ecx, 0xbd28a218
jne 0x1000b820
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov ecx, 0xa8f60f1b
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x24]
push 3
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
lea ecx, [ebp - 0xe4]
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x50], eax
call fcn.1000fa0b
mov dword [ebp - 0x28], 0xcd9d7
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x1c], ebx
jmp 0x1000b891
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe4]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000b881
inc dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0xe4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 0x28]
cmp edx, eax
mov eax, dword [ebp - 0xe4]
sete cl
add ecx, 8
imul ecx, dword [eax + 8]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0xcbe9
setne al
sub eax, edx
jne 0x1000b8d6
mov ecx, ebx
cmp dword [ebp - 0x28], ebx
je 0x1000b8d8
mov ecx, esi
mov eax, dword [ebp - 0x28]
imul eax, ecx
lea ecx, [ebp - 0xe4]
neg eax
mov dword [ebp - 0x30], eax
call fcn.1000fa6d
mov eax, dword [edi + 4]
lea ecx, [ebp - 0xc0]
push 2
mov dword [ebp - 0x38], eax
call fcn.1000fa0b
mov dword [ebp - 0x24], 0xeef20fe6
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x1c], ebx
jmp 0x1000b923
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0x77e8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000b910
mov dword [ebp - 0x24], ebx
jmp 0x1000ba1d
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], 4
mov dword [ebp - 0x18], 0xbc6c8951
cmp dword [ebp - 0x24], ebx
je 0x1000b980
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp eax, 0xa969
mov ecx, 0xffff0f87
setl dl
sub edx, 0x68a07c69
neg edx
sbb edx, edx
inc edx
sub ecx, edx
add ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc0]
cmp dword [eax + 4], 0xa88e00f6
sbb eax, eax
neg eax
cmp eax, ecx
mov ecx, esi
jne 0x1000b982
mov ecx, ebx
xor eax, eax
cmp ecx, 0x4495231f
setle al
sub eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x28]
test eax, eax
je 0x1000ba00
mov dword [ebp - 0x34], 0x35300547
cmp dword [ebp - 0x24], 0x8a019320
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
je 0x1000b9f1
mov dword [ebp - 0x2c], ebx
dec dword [ebp - 0x2c]
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], ebx
jl 0x1000ba1a
mov eax, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc0]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [ebp - 0x28]
jns 0x1000b9d8
jmp 0x1000ba1a
mov dword [ebp - 0x30], 0x82b00025
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x28], eax
jmp 0x1000ba1a
mov dword [ebp - 0x30], 0xffffffff
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x24]
mov dword [ebp - 0x30], edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jle 0x1000b931
lea ecx, [ebp - 0xc0]
call fcn.1000fa6d
mov dword [ebp - 0x18], 0xce125d16
lea ecx, [ebp - 0x94]
push esi
add edi, 8
call fcn.1000fa0b
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x18], ebx
jmp 0x1000ba5f
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x88], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000ba52
mov dword [ebp - 0x18], ebx
jmp 0x1000ba7d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x94]
mov dword [eax + ecx*4], 0xdb69
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000ba6a
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x1000baa4
mov dword [ebp - 0x30], 0x82a1836c
cmp dword [ebp - 0x30], ebx
jne 0x1000baa4
cmp dword [ebp - 0x80], ebx
jne 0x1000baa4
dec dword [ebp - 0x18]
jns 0x1000ba8e
cmp dword [ebp - 0x88], ebx
je 0x1000bae8
cmp dword [ebp - 0x18], ebx
je 0x1000bae8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x94]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x94]
imul ecx, dword [eax]
mov eax, dword [ebp - 0x18]
sub ecx, eax
mov eax, dword [ebp - 0x88]
add ecx, eax
mov eax, dword [ebp - 0x18]
add eax, 0xf8b4
add eax, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x94]
cmp dword [eax], ebx
jne 0x1000baff
mov eax, ebx
cmp dword [ebp - 0x84], ebx
je 0x1000bb01
mov eax, esi
mov dword [ebp - 0x88], eax
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x30], eax
call fcn.1000fa6d
cmp dword [ebp - 0x38], 0
jne 0x1000bb1e
add edi, 8
mov ecx, 0xa12b57e8
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x60], ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x24], 0xcf04b064
mov dword [ebp - 0x1c], ebx
jmp 0x1000bb49
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x4c], 0x799ac789
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1000bb3b
mov dword [ebp - 0x64], ebx
jmp 0x1000bc4a
mov eax, dword [ebp - 0x64]
mov edx, 0xf456
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
sub edx, eax
mov eax, dword [ebp - 0x60]
cmp edx, eax
setl cl
cmp ecx, 0xa6e483bb
jb 0x1000bc1e
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x1c], 0x630971cf
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x64]
neg eax
sbb eax, eax
inc eax
add ecx, eax
je 0x1000bbbf
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, 0x7e01
setg cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4c]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000bbf8
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000bc3d
push 0x1308
push ebx
push 0x2027
push 0xf50
push 0x224e
call dword [sym.imp.GDI32.dll_ExtFloodFill]
jmp 0x1000bc3d
mov dword [ebp - 0x24], ebx
jmp 0x1000bc37
mov dword [ebp - 0x30], 0xffffffff
cmp dword [ebp - 0x30], ebx
jne 0x1000bc3d
cmp dword [ebp - 0x4c], ebx
jne 0x1000bc3d
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x34
jl 0x1000bc23
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp + eax*4 - 0x4c]
mov dword [ebp - 0x4c], eax
inc dword [ebp - 0x64]
cmp dword [ebp - 0x64], ebx
jle 0x1000bb56
mov eax, dword [ebp - 0x44]
add edi, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x44], eax
cmp eax, dword [ebp - 0x54]
jl 0x1000b71d
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x1c], ebx
jmp 0x1000bc90
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xcc], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000bc7f
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0xfffffff7
jge 0x1000bf47
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0xb4]
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], 7
push 3
call fcn.1000fa0b
mov dword [ebp - 4], 2
mov dword [ebp - 0x50], 0xfffffff7
mov dword [ebp - 0x1c], ebx
jmp 0x1000bcea
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xc01d4c3f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1000bcd7
mov dword [ebp - 0x18], 0x16
cmp dword [ebp - 0x18], 0xffffffe5
jl 0x1000bf30
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x44], 0x2b07
cmp dword [ebp - 0x44], 0x2c37
jle 0x1000bd64
mov eax, ebx
mov dword [ebp - 0x54], ebx
mov edi, ebx
add eax, edi
lea ecx, [ebp - 0x178]
cdq
push edx
push eax
call fcn.1000b06a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000bd39
mov eax, dword [eax]
push eax
call fcn.100598a3
pop ecx
push ebx
push esi
lea ecx, [ebp - 0x178]
call fcn.1000ff15
mov eax, dword [ebp - 0x54]
inc edi
cmp edi, 0x2fd3
jl 0x1000bd1f
inc eax
mov dword [ebp - 0x54], eax
cmp eax, 0x60d
jl 0x1000bd1d
mov dword [ebp - 0x1c], 0x6b37990
cmp dword [ebp - 0x44], 0x29be
jge 0x1000bd7f
push 0x10007854
call fcn.100598a3
pop ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x54], 9
cmp dword [ebp - 0x20], ebx
jne 0x1000bddb
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0xfff839e0
setne cl
xor edx, edx
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xffff
setle cl
cmp eax, ecx
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, 0x6f9ee43d
cmp eax, edx
setne cl
imul ecx, dword [ebp - 0x20]
test ecx, ecx
mov ecx, ebx
je 0x1000bddd
mov ecx, esi
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
sub edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setge cl
xor eax, eax
imul ecx, dword [ebp - 0x1c]
cmp ecx, 0x77ab
setg al
add eax, 0x30b9
je 0x1000beee
mov dword [ebp - 0x3c], 0x2699
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x28], 0x2cfb1158
mov dword [ebp - 0x3c], 0xd7d231d5
mov dword [ebp - 0x44], 0xf23d37f4
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jle 0x1000be7c
inc dword [ebp - 0x50]
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x2c]
sub eax, 0x4060a3b7
neg eax
sbb eax, eax
inc eax
sub ecx, eax
sub ecx, dword [ebp - 0x30]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0xcc], ecx
je 0x1000be73
mov eax, dword [ebp - 0xb4]
cmp dword [eax], ebx
mov eax, esi
jne 0x1000be75
mov eax, ebx
mov edx, esi
cmp eax, dword [ebp - 0x1c]
jle 0x1000be7e
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, 0xfe98d7e9
sbb eax, eax
neg eax
sub eax, dword [ebp - 0x28]
neg eax
sbb eax, eax
add eax, 7
imul eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x1c], ebx
jmp 0x1000bee6
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000beba
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov dword [ebp - 0x28], 0xfffffff3
jmp 0x1000bedd
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000beda
push ebx
push 0x11e7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x15
jge 0x1000bec3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x12
je 0x1000bea8
jmp 0x1000bef8
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], 0x6833686a
mov eax, dword [ebp - 0x30]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x54]
mov eax, dword [ebp - 0xb4]
mov dword [eax], edx
mov eax, dword [ebp - 0x34]
cmp edx, eax
setne cl
mov dword [ebp - 0xc4], ecx
dec dword [ebp - 0x18]
jmp 0x1000bcf7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb4]
call fcn.1000fa6d
dec dword [ebp - 0x20]
jmp 0x1000bc99
mov eax, dword [ebp - 0x24]
mov edi, dword [eax]
mov eax, 0xcfdfe92
mov dword [ebp - 0x20], 0xa339
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x34], 0x938f738f
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x100], eax
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x20], ebx
jne 0x1000bfea
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jne 0x1000bf94
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, 0xfffffff7
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0x3f29
mov ecx, ebx
setge dl
sub edx, dword [ebp - 0x20]
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor eax, eax
inc edx
cmp edx, 0xe22401db
setne al
imul eax, dword [ebp - 0x18]
cmp eax, 0xbd52a284
jne 0x1000bfec
mov ecx, esi
mov eax, dword [ebp - 0x18]
add eax, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000c00a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x10c], 7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000bff9
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x40]
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x44], 0x6b75
cmp dword [ebp - 0x44], 0x6e49
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x34], eax
jle 0x1000c082
mov dword [ebp - 0x50], ebx
mov ecx, ebx
mov dword [ebp - 0x38], 0x5ad9
mov dword [ebp - 0x30], ecx
mov edi, ecx
mov esi, 0x3fa8
mov eax, edi
mov ecx, 0x1061a6b8
cdq
push edx
push eax
call fcn.1000f7b3
dec edi
dec esi
jne 0x1000c050
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x50]
add ecx, eax
dec dword [ebp - 0x38]
mov dword [ebp - 0x30], ecx
jne 0x1000c049
inc eax
mov dword [ebp - 0x50], eax
cmp eax, 0x4504
jl 0x1000c03d
mov edi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x20], 0xb
jmp 0x1000c09f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000c09c
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffef
jl 0x1000c08b
mov dword [ebp - 4], 5
cmp dword [ebp - 0x44], 0x69fd
jge 0x1000c0c4
mov edx, 0x10007878
mov ecx, 0x1061a6b8
call fcn.10011dbf
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, esi
mov eax, dword [ebp - 0x20]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, 0x729694d2
cmp ecx, 0x6e7f737a
jge 0x1000c104
mov ecx, ebx
cmp dword [ebp - 0x20], ebx
je 0x1000c106
mov ecx, esi
mov eax, dword [ebp - 0x20]
sub eax, 6
imul eax, ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ebp - 0x18], 0x68ec0ae9
mov dword [ebp - 0x34], 0x5ec35211
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x18], 0x17
jmp 0x1000c1f0
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x30], 0xe44fa3fd
mov dword [ebp - 0x3c], esi
cmp dword [ebp - 0x18], ebx
je 0x1000c1a7
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
sub eax, edx
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
cmp eax, 0x7b187b35
setge cl
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x20], ebx
jmp 0x1000c1e7
mov dword [ebp - 0x3c], 4
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe2
jle 0x1000c1d7
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x16
je 0x1000c16e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000c20c
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
add ecx, eax
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xffffffef
mov dword [ebp - 0x24], ecx
je 0x1000c278
push esi
lea ecx, [ebp - 0xfc]
call fcn.1000fa0b
mov dword [ebp - 0x28], ebx
jmp 0x1000c24e
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], 0xe5f36f6d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x1000c23b
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xfc]
mov dword [eax], ecx
lea ecx, [ebp - 0xfc]
call fcn.1000fa6d
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffef
jne 0x1000c22a
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x50], 0
jne 0x1000c344
cmp byte [ebp - 0x48], 0
je 0x1000c296
cmp dword [ebp - 0x68], esi
jne 0x1000c296
mov edx, dword [ebp + 8]
lea eax, [edi + eax*4]
add dword [edx + 8], eax
mov eax, dword [ecx]
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
push edi
mov eax, dword [ecx]
add ecx, dword [ebp - 0x40]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], ecx
call fcn.10054a30
pop ecx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x7c]
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], ebx
push eax
push edi
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
call fcn.10010164
mov eax, dword [ebp - 0x1c]
mov edi, ebx
mov ecx, dword [ebp - 0x7c]
test eax, eax
jle 0x1000c323
mov eax, edi
and eax, 0x80000001
jns 0x1000c2ec
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x34]
add eax, edi
add eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x3c]
jmp 0x1000c301
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x1c]
cmp word [ecx + edx*2], bx
jne 0x1000c2fe
mov eax, dword [ebp - 0x24]
mov word [ecx + edx*2], si
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x30]
mov byte [edi + edx], al
inc edi
mov eax, dword [ebp - 0x1c]
cmp edi, eax
jl 0x1000c2de
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp - 0x30]
mov dword [edi + 4], eax
test ecx, ecx
je 0x1000c347
push ecx
call fcn.10059aaa
pop ecx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
jmp 0x1000c347
mov edi, dword [ebp + 8]
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp + 8], 0x9532bb11
mov dword [ebp - 0x1c], esi
jmp 0x1000c378
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1000c375
push 0x2011
push ebx
push ebx
push 0x10b8
call dword [sym.imp.GDI32.dll_PolyPolygon]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xb
jle 0x1000c35a
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret