Function at 0x1001a0a5
Capabilities:
Check os version
Extract resource via kernel32 functions
Get disk information
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
or esi, 0xffffffff
mov dword [ebp - 0x90], edx
xor ebx, ebx
mov dword [ebp - 0x44], esi
mov byte [ebp - 1], bl
push edi
mov dword [ebp - 0x80], ecx
cmp byte [ebp - 1], bl
je 0x1001a0d1
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001a0e0
push ebx
call dword [sym.imp.GDI32.dll_CreatePalette]
mov dword [ebp - 0x20], 0xac204e2
xor edi, edi
mov dword [ebp - 0xc], 0xddc85f70
inc edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0x566e66b6
mov dword [ebp - 0x24], 0x2efa
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x10], 0xfaf1becd
mov dword [ebp - 0xec], esi
mov dword [ebp - 0xe8], esi
mov dword [ebp - 0xe4], esi
mov dword [ebp - 0xe0], esi
mov dword [ebp - 0x18], 0xfffffff9
mov dword [ebp - 0xc], ebx
jmp 0x1001a1fe
mov dword [ebp - 0x20], 0x52c5
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0xc], ebx
je 0x1001a17a
mov dword [ebp - 0x10], esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, esi
jl 0x1001a16d
mov eax, dword [ebp - 0x20]
neg eax
cmp eax, dword [ebp - 0x20]
jle 0x1001a167
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x20]
neg eax
sbb eax, eax
inc eax
jmp 0x1001a1f8
mov dword [ebp - 0x10], 0x321210cb
mov dword [ebp - 0x14], ebx
jmp 0x1001a197
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x94], 0xfffffffe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001a186
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x94], ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
setg dl
add edx, dword [ebp - 0xc]
imul edx, dword [ebp - 8]
test edx, edx
je 0x1001a1c1
mov edx, edi
cmp dword [ebp - 0x10], ebx
jne 0x1001a1c3
mov edx, ebx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0x197c
jne 0x1001a1dc
mov ecx, ebx
cmp dword [ebp - 0x10], ebx
je 0x1001a1de
mov ecx, edi
imul eax, dword [ebp - 0x20], 0xc3d2
add eax, dword [ebp - 0x20]
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 7
jl 0x1001a136
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
add eax, 0x1dec7435
cmp eax, 0xad92edcd
jne 0x1001a23c
mov ecx, edi
cmp dword [ebp - 8], ebx
jne 0x1001a23e
mov ecx, ebx
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 8], ebx
jne 0x1001a270
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1001a272
mov eax, edi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
je 0x1001a2b6
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x1001a321
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xec], ebx
jne 0x1001a321
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001a2af
push ebx
push 0x19e0
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
dec dword [ebp - 0x1c]
jns 0x1001a28a
jmp 0x1001a321
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001a2cb
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x9c], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001a2be
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x28]
jne 0x1001a2ef
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edi
setle cl
mov dword [ebp - 0x9c], ecx
test ecx, ecx
je 0x1001a2ef
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0xc]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
add edx, 6
cmp edx, eax
mov eax, dword [ebp - 0x18]
setl cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], 0xbac64a68
mov dword [ebp - 0x14], ebx
jmp 0x1001a341
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x100], 0xba33
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001a330
mov dword [ebp - 0x20], 0xfffffff1
jmp 0x1001a397
mov dword [ebp - 0x14], ebx
jmp 0x1001a366
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xac], 0x50e6da50
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1001a355
mov dword [ebp - 0xa4], ebx
jmp 0x1001a38b
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x100], 0x74bf
inc dword [ebp - 0xa4]
cmp dword [ebp - 0xa4], 2
jl 0x1001a374
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
jle 0x1001a350
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001a3d2
push ebx
push 0xd65
push ebx
push ebx
push 0x12a7
push 0x1bbe
push 0xdf
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
or eax, 0xffffffff
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x44], eax
mov dword [ebp - 8], edi
mov dword [ebp - 0x18], 0x9537
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x10], 0x871e
mov dword [ebp - 0x18], 0x10aa4aec
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001a416
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c], 0x91a049fe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001a408
mov dword [ebp - 8], ebx
jmp 0x1001a51f
mov dword [ebp - 0x1c], 0xb8114768
mov dword [ebp - 0x14], ebx
jmp 0x1001a440
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8c], 5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001a42f
mov dword [ebp - 0x1c], ebx
jmp 0x1001a513
mov dword [ebp - 0xc], 2
mov dword [ebp - 0x28], 0xdcee0524
mov dword [ebp - 0xc], ebx
jmp 0x1001a4f7
mov dword [ebp - 0x18], 0x8e7ea1b1
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp dword [ebp - 0x1c], ebx
jne 0x1001a484
mov ecx, edi
cmp dword [ebp - 0xc], ebx
jne 0x1001a486
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, eax
setge dl
xor ecx, ecx
imul edx, dword [ebp - 0xc]
add edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setge cl
mov dword [ebp - 0x28], ecx
mov ecx, 0x1b8d8131
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 8]
sub ecx, eax
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x8c], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x1001a463
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001a510
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1001a44d
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x1001a423
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add edx, 0xffff0000
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [ebp - 0x2c]
cmp edx, eax
mov eax, dword [ebp - 0x2c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x18]
sub edx, eax
mov eax, dword [ebp - 8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
cmp eax, ecx
setne dl
mov dword [ebp - 0x24], edx
xor edx, edx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setg dl
or ecx, 0xffffffff
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x88], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], 0x1cecb457
mov dword [ebp - 0x20], 0x9febb674
mov dword [ebp - 0xc], 0x519d8147
mov dword [ebp - 0x60], ebx
mov dword [ebp - 8], 0x3de81d53
mov dword [ebp - 0xc], ebx
jmp 0x1001a5f9
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x34], 0x1e814b73
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x1001a5eb
mov dword [ebp - 0xc], ebx
jmp 0x1001a60d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x30], edi
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edi
jl 0x1001a603
inc dword [ebp - 8]
mov dword [ebp - 0xc], ebx
push 0xfffffffffffffff8
pop edi
cmp dword [ebp - 0xc], ebx
jg 0x1001a894
mov dword [ebp - 0x14], 0xd479ea40
mov dword [ebp - 0x28], 0x2e0c2805
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x1001a727
xor edi, edi
inc edi
mov dword [ebp - 0x24], 0xc7e9a03a
mov dword [ebp - 0x1c], ebx
jmp 0x1001a712
mov dword [ebp - 8], ebx
jmp 0x1001a706
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x1001a703
mov dword [ebp - 0x18], 9
mov eax, dword [ebp - 8]
push 0xffffffffffffffff
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x30]
add eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
sub eax, 0xbc71f8b1
neg eax
sbb eax, eax
inc eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
cmp edi, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp ecx, eax
sbb eax, eax
neg eax
cmp edi, eax
mov eax, dword [ebp - 0x1c]
sbb edx, edx
inc edx
mov ecx, dword [ebp + eax*4 - 0x34]
mov eax, dword [ebp - 0x34]
sub ecx, edx
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
or ecx, 0xffffffff
mov eax, dword [ebp + eax*4 - 0x34]
sub eax, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
sbb ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0x34], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x20]
pop ecx
cmp dword [ebp - 0x20], ebx
jle 0x1001a664
or ecx, ecx
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x1001a658
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x1001a650
dec dword [ebp - 0x10]
jns 0x1001a641
push 0xfffffffffffffff8
pop edi
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1001a7c9
xor edi, edi
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x34]
cmp eax, 0x310e27a8
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x34]
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xece9518
setle al
sub eax, dword [ebp - 0x28]
je 0x1001a76c
lea edx, [edi + 1]
cmp dword [ebp - 0x20], ebx
jne 0x1001a76e
mov edx, ebx
mov eax, dword [ebp - 0xc]
push 6
mov ecx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x30], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x34]
sub edx, eax
mov eax, dword [ebp - 0x10]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setge dl
imul edx, dword [ebp + eax*4 - 0x34]
pop eax
cmp eax, edx
mov eax, dword [ebp - 0xc]
sbb ecx, ecx
neg ecx
mov dword [ebp + eax*4 - 0x34], ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x1c]
jns 0x1001a735
push 0xfffffffffffffff8
pop edi
mov dword [ebp - 8], ebx
jmp 0x1001a876
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
sub eax, edi
neg eax
push 0
sbb eax, eax
inc eax
pop eax
sets al
sub eax, dword [ebp - 0x30]
je 0x1001a7f8
cmp dword [ebp - 8], ebx
je 0x1001a7f8
xor eax, eax
lea esi, [eax + 1]
jmp 0x1001a7fa
mov esi, ebx
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x30]
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x30]
cmp esi, eax
mov eax, dword [ebp - 0xc]
setg cl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0xc]
setne bl
xor edx, edx
sub ebx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x30]
cmp ebx, eax
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
add edx, 0x640b5d92
mov eax, dword [ebp + eax*4 - 0x30]
cmp eax, edx
setge cl
xor edx, edx
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x30]
inc dword [ebp - 8]
xor ebx, ebx
cmp dword [ebp - 8], ebx
jle 0x1001a7d1
inc dword [ebp - 0xc]
push 0xffffffffffffffff
pop ecx
cmp dword [ebp - 0xc], ebx
jle 0x1001a624
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor ecx, ecx
mov dword [ebp - 0x98], 0x24b34d7a
inc ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x10], ebx
jmp 0x1001a8b6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xf8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001a8a9
mov dword [ebp - 8], ebx
jmp 0x1001a8d9
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a8d6
push 0x1e99
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffe7
jne 0x1001a8c0
mov dword [ebp - 8], ebx
jmp 0x1001a933
mov dword [ebp - 0x10], ebx
jmp 0x1001a8f3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x78], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001a8e9
mov dword [ebp - 0x74], ebx
cmp dword [ebp - 0x74], ebx
jl 0x1001a930
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a911
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a92b
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
dec dword [ebp - 0x74]
jns 0x1001a901
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xffffffec
jge 0x1001a8e4
mov dword [ebp - 0x20], 0x19
cmp dword [ebp - 0x20], 0x1b
jle 0x1001b240
mov edx, 0x763523e2
xor ecx, ecx
inc ecx
or eax, 0xffffffff
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x18], 0x1abdf11c
mov dword [ebp - 0x24], 0xec6f
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0xd8], edx
mov dword [ebp - 0xd4], edx
mov dword [ebp - 0xd0], edx
mov dword [ebp - 0x10], ebx
jmp 0x1001a99d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x118], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001a990
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001a9b7
push ebx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [ebp - 8]
xor edx, edx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 8]
neg edx
mov dword [ebp - 0x114], edx
mov eax, dword [ebp - 0x28]
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
cmp dword [ebp - 8], ecx
jle 0x1001aa23
cmp dword [ebp - 0x14], ebx
jne 0x1001aa23
mov eax, ebx
jmp 0x1001aa26
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
or ecx, 0xffffffff
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x24], 0xc769
cmp ecx, eax
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 8], 0x60477862
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 8], ebx
jmp 0x1001aaba
mov dword [ebp - 0xc], 0x7c203980
mov dword [ebp - 0xc], 0xffffffee
jmp 0x1001aab1
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x68], eax
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0x18
jne 0x1001aa83
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffff3
jg 0x1001aa73
mov dword [ebp - 8], 3
cmp dword [ebp - 8], ebx
jl 0x1001ab07
mov eax, dword [ebp - 8]
cmp dword [ebp + eax*4 - 0x70], ebx
je 0x1001aadc
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x70]
mov eax, dword [ebp - 0x68]
mov edx, 0x2053
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x70]
sub edx, eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x70]
cmp eax, edx
mov eax, dword [ebp - 8]
setg cl
mov dword [ebp + eax*4 - 0x70], ecx
dec dword [ebp - 8]
jns 0x1001aacc
mov dword [ebp - 8], 0x90197f0a
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x28], 0xbec
mov dword [ebp - 0x60], 0xdcff2fd6
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 0x2739425a
mov dword [ebp - 0x14], 0xdfe1db4d
mov dword [ebp - 0x10], ebx
jmp 0x1001ab4a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x130], 0xcb52c22a
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001ab39
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 8]
inc ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], ecx
jne 0x1001aca0
mov dword [ebp - 0x1c], 0xdd7582ba
xor edx, edx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x1c], 0x6a69
cmp eax, 0x5976
setge dl
xor ecx, ecx
sub edx, dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setge cl
xor edx, edx
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
setge al
xor edx, edx
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
cmp ecx, eax
setle dl
cmp edx, dword [ebp - 0xc]
jne 0x1001abdc
cmp dword [ebp - 0xc], ebx
jne 0x1001abdc
xor edx, edx
mov ecx, ebx
inc edx
jmp 0x1001abe1
xor edx, edx
inc edx
mov ecx, edx
mov eax, dword [ebp - 0xc]
sub ecx, eax
add ecx, dword [ebp - 0x1c]
je 0x1001abf0
cmp dword [ebp - 0xc], ebx
jne 0x1001abf2
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0x14], ebx
je 0x1001ac64
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
sub edx, 0x4572
neg edx
push 6
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
cmp edx, eax
pop eax
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge bl
xor ecx, ecx
cmp ebx, eax
setge cl
imul eax, ecx, 0x68d3
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
je 0x1001ac62
xor eax, eax
xor ebx, ebx
lea edx, [eax + 1]
jmp 0x1001ac66
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
sete cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x130]
neg ecx
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x60cc19ab
setne al
mov dword [ebp - 0x14], eax
jmp 0x1001ace0
mov dword [ebp - 0xc], 0xfffffffc
jmp 0x1001acba
mov dword [ebp - 0x18], 0x4863fccf
mov dword [ebp - 0x18], 0xabb57ddd
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001aca9
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001ace3
push ebx
push 0x2132
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ebx
jmp 0x1001acf6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x5c], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001ace8
mov dword [ebp - 0x14], 0x3859
mov dword [ebp - 0x10], 0x898d
mov dword [ebp - 0x24], 0x971db956
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x18], 0x75df1563
mov dword [ebp - 8], ebx
jmp 0x1001ad32
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x50], 0x2124
inc dword [ebp - 8]
cmp dword [ebp - 8], ecx
jl 0x1001ad24
mov dword [ebp - 8], ebx
jmp 0x1001ad4d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0xf4], 0xfffffff9
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x1001ad3c
dec dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
setg dl
add ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x50]
setne dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x1001add4
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001adc5
push 0x12b4
push 0xa2f
push 0x1b51
push 0x945
push 0x4ab
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x50]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x10]
jns 0x1001ad93
mov dword [ebp - 8], ebx
jmp 0x1001b224
mov dword [ebp - 0x14], 0x33fcb50b
mov dword [ebp - 0x10], ebx
jmp 0x1001adf9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x14c], 0xfffffffd
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001ade8
mov dword [ebp - 0x14], ebx
jmp 0x1001ae30
mov dword [ebp - 0x10], 0xfffffff7
mov dword [ebp - 0x10], ebx
jmp 0x1001ae27
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001ae24
push ebx
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x1001ae10
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x1001ae04
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x5c]
cmp dword [ebp - 0x20], ebx
je 0x1001aec2
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x5c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x5c]
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x58]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x28]
setge cl
add eax, 0xfffffffd
add ecx, eax
mov eax, dword [ebp - 8]
sub ecx, dword [ebp + eax*4 - 0x5c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
sub ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x58]
sub ecx, 0x1494
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, 0x2570d978
je 0x1001aec2
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 8]
mov eax, dword [ebp + eax*4 - 0x5c]
mov ecx, dword [ebp - 0x58]
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
imul eax, ecx, 0x6bb2
test eax, eax
je 0x1001b1fd
xor ecx, ecx
inc ecx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x18], 0x624039b6
mov dword [ebp - 0x18], 0xb743d837
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x18], 0x5e00fe1c
mov dword [ebp - 0xc], 0xf8067e3
mov dword [ebp - 0x18], 0x869ec427
mov dword [ebp - 0x1c], 0x1fa147b8
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0xe7ed6f18
mov dword [ebp - 0x18], 0xe6e2bfbd
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], ebx
jmp 0x1001af4b
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x10c], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001af3a
dec dword [ebp - 0x108]
mov dword [ebp - 0x24], 0xf7b6fe6d
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], ebx
je 0x1001afe1
mov dword [ebp - 0x18], 0x734cb441
mov dword [ebp - 0xc], ebx
jmp 0x1001af7f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001af75
mov dword [ebp - 0xc], ebx
jmp 0x1001af93
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x48], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001af89
cmp dword [ebp - 0x14], 0xfffc
ja 0x1001afb9
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
inc dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x4c], ebx
jne 0x1001afc5
mov eax, ebx
cmp dword [ebp - 0x48], ebx
je 0x1001afc7
mov eax, ecx
neg eax
add eax, eax
mov dword [ebp - 0x18], eax
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001b03b
push ebx
push ebx
call dword [sym.imp.GDI32.dll_CopyEnhMetaFileA]
jmp 0x1001b03b
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001b000
push 0xd3b
push 0x56
push 0x7ea
call esi
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
cmp dword [ebp - 0xc], ebx
mov byte [ebp - 1], bl
je 0x1001b02b
cmp byte [ebp - 1], 0
je 0x1001b03b
push ebx
push 0xe84
push 0x26c8
push 0x115b
push 0x227a
call dword [sym.imp.GDI32.dll_CreateBitmap]
jmp 0x1001b03b
cmp byte [ebp - 1], 0
je 0x1001b03b
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
lea eax, [ebp - 0x88]
push eax
push ebx
lea edx, [ebp - 0x7c]
lea ecx, [ebp - 0x38]
call fcn.1001b602
pop ecx
mov dword [ebp - 0x38], 0xd
cmp dword [ebp - 0x38], 0x14
pop ecx
jl 0x1001b221
or edi, 0xffffffff
mov dword [ebp - 0x24], 0x17be1879
xor ecx, ecx
mov dword [ebp - 0x10], ebx
inc ecx
mov dword [ebp - 0x18], 0xef51
push 3
mov dword [ebp - 0x14], 0x6b34
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0xc], ebx
jmp 0x1001b094
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x40], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001b08a
mov dword [ebp - 0xc], ebx
jmp 0x1001b0af
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xb4], 0xdac842f8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001b09e
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setne dl
xor eax, eax
cmp eax, edx
mov eax, dword [ebp - 0x40]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x40]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xb0]
setne cl
xor edx, edx
cmp ecx, 0x528a
mov ecx, dword [ebp - 0x18]
setne dl
imul eax, edx
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0xb0]
jne 0x1001b140
push 0x5656
lea eax, [ebp - 0x3a]
mov byte [ebp - 0x3a], bl
push ebx
push eax
call fcn.10022a9f
push ebx
lea eax, [ebp - 0x38]
push eax
push 0x798e
call fcn.1001e526
add esp, 0x18
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jle 0x1001addc
inc dword [ebp - 0x20]
mov edx, 0x763523e2
cmp dword [ebp - 0x20], 0x1b
jg 0x1001a94f
xor ecx, ecx
inc ecx
or edx, 0xffffffff
mov dword [ebp - 8], ecx
mov dword [ebp - 0x20], 0x9f8d
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0xa3c3d214
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 0xcf9e
mov dword [ebp - 0x18], 0xe695ef2b
mov dword [ebp - 0xc], ebx
jmp 0x1001b27d
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x84], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001b270
mov dword [ebp - 0xc], ebx
jmp 0x1001b294
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x13c], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 3
jl 0x1001b287
dec dword [ebp - 8]
jne 0x1001b30a
mov eax, dword [ebp - 0x20]
mov edx, ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 8], ebx
jne 0x1001b2b1
mov edx, ebx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 8]
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
cmp edx, eax
mov eax, dword [ebp - 8]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
setne dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle bl
xor edx, edx
cmp ecx, eax
setle dl
cmp edx, ebx
jge 0x1001b2fc
xor ebx, ebx
cmp dword [ebp - 0x14], ebx
jne 0x1001b2fe
xor ecx, ecx
mov eax, ebx
inc ecx
jmp 0x1001b303
xor ebx, ebx
xor ecx, ecx
inc ecx
mov eax, ecx
cmp eax, dword [ebp - 8]
mov eax, ebx
jle 0x1001b30c
mov eax, ecx
mov dword [ebp - 0x10], eax
xor edx, edx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setle dl
imul edx, dword [ebp - 0x20]
imul eax, edx, 0xf89
xor edx, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, 0x406c
setg dl
xor ecx, ecx
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 8]
jg 0x1001b362
cmp dword [ebp - 0x14], ebx
je 0x1001b362
xor eax, eax
lea ecx, [eax + 1]
jmp 0x1001b364
mov ecx, ebx
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setl dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
setle cl
sub edx, ecx
neg edx
sbb edx, edx
inc edx
sub edx, eax
mov dword [ebp - 0x84], edx
lea ecx, [edx + 0x75c2caab]
imul ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xe712
setg al
xor edx, edx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setle dl
xor cl, cl
mov dword [ebp - 0x18], edx
lea edx, [ebp - 0x98]
call fcn.1001b649
mov dword [ebp - 0x28], 0x847dfa86
push 2
mov dword [ebp - 0x20], 0xb274bf90
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1001b3ed
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcc], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001b3e0
cmp dword [ebp - 0x28], ebx
je 0x1001b41c
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001b51f
push 0x7a2
push 0x57a
call esi
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
jmp 0x1001b51f
mov dword [ebp - 0x14], 0xc9e53e58
mov eax, 0x80254f8
mov dword [ebp - 0x24], 0xdac0faab
xor edx, edx
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0xc0], eax
mov dword [ebp - 0xbc], eax
mov dword [ebp - 0xb8], eax
or eax, 0xffffffff
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
xor eax, eax
inc eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x2b21a35c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
sub ecx, dword [ebp - 0x24]
add ecx, 0xbc0d
mov dword [ebp - 0xcc], ecx
neg ecx
je 0x1001b4b8
mov dword [ebp - 0x20], ebx
jmp 0x1001b4b0
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001b4ad
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff3
jle 0x1001b49e
jmp 0x1001b51f
mov dword [ebp - 0x18], 0xe69ed994
mov dword [ebp - 0x10], ebx
jmp 0x1001b4d5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x124], 0x604491d0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1001b4c4
mov dword [ebp - 0x24], 7
xor ecx, ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc0], eax
mov eax, dword [ebp - 0x14]
test eax, eax
setg cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc0]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x120]
cmp eax, 1
mov eax, dword [ebp - 0x14]
setle cl
sub edi, ecx
sub edi, eax
mov dword [ebp - 0x44], edi
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001b551
push 0x12b4
push 0xa2f
push 0x1b51
push 0x945
push 0x4ab
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [ebp - 0x90]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0x80]
mov esi, edx
mov edi, eax
call fcn.1001a033
add eax, esi
add eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret