Function at 0x1001ba8e
Capabilities:
Get disk size
Identify system language via api

Disassembly:
mov eax, 0x10087ec3
call fcn.10087a98
sub esp, 0xfc
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x3c], ecx
je 0x1001bed2
xor edi, edi
mov dword [ebp - 0x10], 0xc70bb743
inc edi
xor ebx, ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp + 8], ebx
jmp 0x1001bad6
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x30], 8
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1001bac8
push 3
mov dword [ebp - 0x10], ebx
pop esi
jmp 0x1001bcad
mov dword [ebp - 0x18], 0x976ff55e
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1001bcaa
mov dword [ebp + 8], 0xfffffffd
mov dword [ebp - 0x28], 0x46ed4d34
mov dword [ebp + 8], ebx
cmp dword [ebp + 8], ebx
jl 0x1001bc46
mov dword [ebp - 0x2c], edi
lea ecx, [ebp - 0xa0]
mov dword [ebp - 0x34], 0xffffffff
push esi
call fcn.10019b12
mov dword [ebp - 0x1c], ebx
jmp 0x1001bb47
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa0]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001bb34
mov eax, dword [ebp + 8]
cmp dword [ebp + eax*4 - 0x30], ebx
jne 0x1001bb5a
cmp dword [ebp - 0x30], ebx
je 0x1001bb65
mov eax, dword [ebp + 8]
mov ecx, edi
cmp dword [ebp + eax*4 - 0x30], ebx
jne 0x1001bb67
mov ecx, ebx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + eax*4 - 0x30]
xor eax, eax
cmp ecx, 0xfffffffb
setle al
xor ecx, ecx
cmp eax, edx
setge cl
inc ecx
jne 0x1001bb87
mov edx, edi
cmp dword [ebp - 0x24], ebx
je 0x1001bb89
mov edx, ebx
mov eax, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x30]
cmp eax, edx
setle cl
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp + 8]
setg dl
sub edx, dword [ebp + eax*4 - 0x30]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x30], edx
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x30]
sub eax, 0x19632e84
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
jne 0x1001bc00
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setle dl
xor eax, eax
cmp edx, 0xb49f2b78
setne al
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
mov eax, ebx
je 0x1001bc02
mov eax, edi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], ebx
jne 0x1001bc11
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x1001bc13
mov eax, edi
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
jne 0x1001bc22
mov ecx, ebx
cmp dword [ebp - 0x2c], ebx
je 0x1001bc24
mov ecx, edi
mov eax, dword [ebp - 0xa0]
add ecx, 0xffffbcaa
mov dword [eax], ecx
lea ecx, [ebp - 0xa0]
call fcn.1001a36d
dec dword [ebp + 8]
jns 0x1001bb19
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
setle dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x2c]
cmp ecx, eax
sete dl
sub edx, dword [ebp - 0x28]
mov eax, dword [ebp + 8]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x18]
jns 0x1001baff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001bae6
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jne 0x1001bcc5
mov edx, ebx
cmp dword [ebp - 0x20], ebx
jne 0x1001bcc7
mov edx, edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x20]
test ecx, ecx
jne 0x1001bcdc
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x10], 0x85a0455d
lea ecx, [ebp - 0xd8]
mov dword [ebp + 8], 0xffffffff
mov dword [ebp + 8], ebx
mov dword [ebp + 8], 0xec2db221
push edi
call fcn.10019b12
mov dword [ebp + 8], 0x8f3c34ee
mov dword [ebp + 8], 0xfffffff9
mov dword [ebp + 8], 0x1b68
mov dword [ebp + 8], esi
mov dword [ebp - 0x20], 0xf9953e80
mov dword [ebp + 8], 0xfffd
mov dword [ebp + 8], ebx
jmp 0x1001bd3e
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xd8]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1001bd2b
mov dword [ebp + 8], ebx
jmp 0x1001bd55
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0xcc], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1001bd48
inc dword [ebp - 0x20]
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1001bd78
push ebx
push ebx
push 0x180
push 0xa67
push ebx
call dword [sym.imp.USER32.dll_ModifyMenuW]
lea ecx, [ebp - 0xd8]
call fcn.1001a36d
movdqa xmm0, xmmword [0x1000abf0]
lea eax, [ebp - 0xdc]
mov dword [ebp + 8], esi
lea ecx, [ebp - 0x58]
push dword [ebp + 8]
mov dword [ebp - 0x28], 0x425a80e3
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], 0x8b5131d8
push eax
mov dword [ebp - 0x28], 0xffffffff
lea eax, [ebp - 0xec]
mov dword [ebp - 0x14], 0x3a92bd42
push eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x28], 0xffffffff
push ebx
movdqu xmmword [ebp - 0xec], xmm0
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
call fcn.1001b12b
mov dword [ebp - 0x28], 0xc099
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], 0xc86f8036
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], 0xbcae
mov dword [ebp - 0x14], ebx
jmp 0x1001be1d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xdc], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1001be10
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x58]
cmp dword [eax + 4], edi
setl cl
cmp ecx, 9
jne 0x1001be53
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
inc dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x28], eax
mov dword [ebp + 8], ebx
jmp 0x1001be9e
mov dword [ebp - 0x24], 0xeddd8d7c
xor ecx, ecx
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
cmp eax, edi
setge cl
cmp ecx, dword [ebp - 0x24]
jne 0x1001be96
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x1001be98
mov eax, edi
mov dword [ebp - 0x28], eax
inc dword [ebp + 8]
cmp dword [ebp + 8], 0xc
jge 0x1001be6a
lea ecx, [ebp - 0x58]
call fcn.1001a36d
mov edx, dword [ebp - 0x3c]
mov dword [edx], ebx
cmp dword [edx], esi
jge 0x1001c579
mov edi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0x92715ee5
inc dword [edx]
cmp dword [edx], esi
jl 0x1001bebc
jmp 0x1001c579
push 3
pop esi
push esi
lea ecx, [ebp - 0xac]
call fcn.10019b12
xor ebx, ebx
mov dword [ebp + 8], ebx
jmp 0x1001bef8
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xac]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x1001bee8
mov dword [ebp + 8], ebx
jmp 0x1001bf0c
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x4c], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x1001bf02
mov dword [ebp - 0x48], ebx
jmp 0x1001bf63
mov dword [ebp + 8], ebx
jmp 0x1001bf29
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x70], 0xe08974b6
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x1001bf1b
mov eax, dword [ebp - 0x48]
mov edx, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [ebp - 0x70], 0x18
jmp 0x1001bf5a
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1001bf57
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
dec dword [ebp - 0x70]
cmp dword [ebp - 0x70], 9
jge 0x1001bf49
inc dword [ebp - 0x48]
cmp dword [ebp - 0x48], 2
jle 0x1001bf16
lea ecx, [ebp - 0xac]
call fcn.1001a36d
mov dword [ebp - 0x14], ebx
mov dword [ebp + 8], 0x85faafe3
mov dword [ebp + 8], 0xffffffff
mov dword [ebp + 8], 0xc2e7ccc8
mov dword [ebp + 8], 0xffffffff
mov dword [ebp + 8], 0x8555145c
mov dword [ebp + 8], 0x245f5b1b
push 1
mov dword [ebp - 0x20], 0x66e9
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x1001c05c
mov dword [ebp + 8], 0xfffffffa
mov dword [ebp + 8], ebx
jmp 0x1001bfd0
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0xc8], 0xe1d925b0
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1001bfbf
mov dword [ebp + 8], ebx
jmp 0x1001bfeb
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x104], 7
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x1001bfda
mov dword [ebp + 8], ebx
jmp 0x1001c054
push dword [ebp + 8]
movdqa xmm0, xmmword [0x1000ac10]
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0xfc]
mov dword [ebp - 0x94], ebx
push eax
push ebx
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x90], ebx
movdqu xmmword [ebp - 0xfc], xmm0
mov dword [ebp - 0x8c], ebx
call fcn.1001b12b
mov dword [ebp - 0x3c], 0x4c59cdc3
lea ecx, [ebp - 0x94]
mov dword [ebp - 0x3c], 0xc13fe662
dec dword [ebp - 0x20]
call fcn.1001a36d
inc dword [ebp + 8]
cmp dword [ebp + 8], ebx
jle 0x1001bff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
je 0x1001bfb3
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1001c08d
push 0x1500
push 0x334
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov dword [ebp - 0x1c], 6
mov dword [ebp - 0x10], edi
mov dword [ebp + 8], 0x507b3925
mov dword [ebp + 8], ebx
jmp 0x1001c0b1
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x38], 8
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1001c0a3
mov dword [ebp - 0x1c], 0xe
jmp 0x1001c0c2
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
mov dword [ebp - 0x10], ebx
jg 0x1001c0bf
cmp dword [ebp - 0x10], ebx
jl 0x1001c228
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp + 8], ebx
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1001c0ed
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1001c21c
mov dword [ebp - 0x20], 0xcc65ad6c
xor ecx, ecx
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp + eax*4 - 0x38]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x38]
cmp eax, edx
setle cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
je 0x1001c12b
mov edx, edi
cmp dword [ebp - 0x1c], ebx
jne 0x1001c12d
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setle cl
imul ecx, dword [ebp - 0x18]
add ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, dword [ebp + eax*4 - 0x38]
je 0x1001c153
cmp dword [ebp - 0x10], ebx
je 0x1001c153
mov ecx, edi
cmp dword [ebp - 0x18], ebx
jne 0x1001c155
mov ecx, ebx
mov eax, dword [ebp - 0x18]
add eax, ecx
je 0x1001c15f
mov eax, dword [ebp - 0x18]
mov dword [ebp + 8], 0xb79f
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + eax*4 - 0x38]
mov ecx, dword [ebp - 0x1c]
sub ecx, eax
imul ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x10]
cmp ecx, dword [ebp + eax*4 - 0x38]
je 0x1001c1d1
mov dword [ebp + 8], edi
xor ecx, ecx
mov dword [ebp - 0x20], edi
mov eax, dword [ebp + 8]
cmp eax, edi
setle cl
xor eax, eax
cmp ecx, 4
mov ecx, 0xf12afbca
setg al
cmp ecx, eax
mov ecx, dword [ebp + 8]
sbb eax, eax
xor edx, edx
neg eax
imul esi, eax, 0xffff
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, esi
setl al
xor edx, edx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
setge dl
mov dword [ebp + 8], edx
jmp 0x1001c213
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1001c1f3
push ebx
push ebx
push 0x162c
push ebx
push 0x141c
push ebx
push 0x13a4
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1001c213
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1001c20e
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
dec dword [ebp - 0x18]
jns 0x1001c1fb
dec dword [ebp - 0x1c]
jns 0x1001c0f9
dec dword [ebp - 0x10]
jns 0x1001c0d4
push 3
pop esi
push esi
lea ecx, [ebp - 0xc4]
call fcn.10019b12
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], edi
mov dword [ebp + 8], ebx
jmp 0x1001c252
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 0x825e7a66
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x1001c23f
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1001c2de
push 4
lea ecx, [ebp - 0x7c]
call fcn.10019b12
mov dword [ebp + 8], ebx
mov dword [ebp + 8], ebx
jmp 0x1001c285
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 0x4d073ff8
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jl 0x1001c275
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [ebp - 0x7c]
mov dword [eax], 2
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001c2c3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [ebp - 0x7c]
mov dword [ebp + 8], 0xe58d020b
dec dword [eax]
jns 0x1001c2a6
lea ecx, [ebp - 0x7c]
call fcn.1001a36d
dec dword [ebp - 0x14]
jns 0x1001c263
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc4]
call fcn.1001a36d
push edi
lea ecx, [ebp - 0x64]
call fcn.10019b12
mov dword [ebp + 8], 0xcc86f803
mov dword [ebp + 8], ebx
jmp 0x1001c310
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x40], 0xc2e0cf57
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1001c302
mov dword [ebp + 8], ebx
jmp 0x1001c32a
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1001c31a
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001c345
push 0xcd0
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov eax, dword [ebp - 0x64]
mov dword [eax], ebx
mov dword [ebp - 0x18], 0xb11accba
mov dword [ebp + 8], 0x979cd329
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x1001c462
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x1001c3f5
mov dword [ebp - 0x24], 0x6d0374c7
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
jl 0x1001c3f2
mov dword [ebp + 8], ebx
jmp 0x1001c397
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x88], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x1001c38a
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001c3b6
push 0x13c4
push 0x1c95
push ebx
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov dword [ebp - 0x88], ebx
cmp dword [ebp - 0x88], ebx
jl 0x1001c3ed
mov dword [ebp + 8], 0x79f6a715
mov dword [ebp - 0x20], 0xe75d
mov dword [ebp + 8], ebx
jmp 0x1001c3e0
mov dword [ebp - 0x34], edi
inc dword [ebp - 0x20]
inc dword [ebp + 8]
cmp dword [ebp + 8], ebx
jle 0x1001c3d7
dec dword [ebp - 0x88]
jns 0x1001c3c4
dec dword [ebp - 0x24]
jns 0x1001c385
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001c376
mov dword [ebp - 0x10], ebx
jmp 0x1001c454
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, 2
mov eax, dword [ebp - 0x64]
setne cl
mov dword [ebp + 8], ecx
xor ecx, ecx
cmp dword [eax], 0x526c
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, dword [ebp + 8]
mov eax, dword [ebp + eax*4 - 0x40]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setne cl
imul ecx, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x40], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001c403
dec dword [ebp - 0x18]
jns 0x1001c367
mov eax, dword [ebp - 0x64]
inc dword [eax]
cmp dword [eax], 0
jle 0x1001c34a
lea ecx, [ebp - 0x64]
call fcn.1001a36d
push 6
pop edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], 0xb2c41ac3
mov dword [ebp + 8], ebx
jmp 0x1001c49b
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0xb8], 9
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x1001c48a
mov dword [ebp - 0x10], ebx
jmp 0x1001c504
mov dword [ebp + 8], edi
mov dword [ebp + 8], ebx
jmp 0x1001c4ef
mov eax, dword [ebp + eax*4 - 0xb8]
cmp dword [ebp + 8], ebx
je 0x1001c4c0
mov eax, dword [ebp + 8]
mov ecx, edi
jmp 0x1001c4c2
mov ecx, ebx
mov eax, dword [ebp - 0xb8]
sub eax, edx
neg eax
sbb eax, eax
inc eax
sub eax, ecx
je 0x1001c4d6
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp eax, 0xf823
setge cl
add ecx, dword [ebp - 0xb8]
mov dword [ebp - 0x14], ecx
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
mov eax, dword [ebp + 8]
jle 0x1001c4ad
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp + 8], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffe5
jle 0x1001c4a5
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov edx, dword [ebp + 0x18]
cmp eax, 0xfffffff7
mov esi, dword [ebp - 0x28]
setge cl
mov dword [ebp - 0x14], ecx
xor ecx, ecx
mov eax, dword [edx]
cmp dword [eax], ebx
setne cl
mov dword [ebp + 8], ecx
xor ecx, ecx
cmp dword [eax], 0x5d76
mov eax, dword [esi]
setg cl
inc dword [esi]
cmp eax, ecx
mov eax, dword [ebp + 0xc]
mov ecx, edi
cmovg ecx, ebx
mov dword [eax], ecx
mov eax, dword [edx]
mov esi, dword [eax]
xor eax, eax
cmp ecx, esi
setge al
cmp eax, 0x223
jne 0x1001c55b
test esi, esi
jne 0x1001c55d
mov edi, ebx
xor edx, edx
cmp edi, esi
setne dl
xor eax, eax
cmp dword [ebp + 8], 0xffffffff
setle al
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp + 0x14]
setl cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret