Function at 0x1000a229
Capabilities:
Create process on windows
Create thread
Get common file path
Get geographical location
Identify system language via api
Query or enumerate registry key

Disassembly:
mov eax, 0x10067cdb
call fcn.100673b8
sub esp, 0xf54
push ebx
xor ebx, ebx
mov byte [ebp - 0x69], dl
mov dword [ebp - 0x14c], ebx
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
mov dword [ebp - 0x24], edx
push esi
mov esi, 0xafa9b64f
mov dword [ebp - 0x68], ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
push edi
cmp eax, dword [ebp - 0x1c]
jl 0x1000a281
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], bl
je 0x1000a29e
push 0xa42
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
xor edx, edx
inc edx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jl 0x1000a2cd
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], bl
je 0x1000a2ea
push 0xa42
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
xor edx, edx
inc edx
push 3
mov dword [ebp - 0x34], edx
pop esi
mov dword [ebp - 0x10], 0xfffffffe
push 0xfffffffffffffff9
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x2c], ebx
pop ecx
jmp 0x1000a313
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x6d0], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1000a306
mov dword [ebp - 0x34], 0x1a
mov edi, 0x34a2c930
cmp dword [ebp - 0x34], 0xffffffe2
je 0x1000a46c
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
add eax, 0xc520
cmp eax, 0xc8d4
mov eax, edx
setl cl
xor edx, edx
sub eax, ecx
cmp eax, 0x6ec7
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x18]
cmp ebx, eax
mov eax, dword [ebp - 0x34]
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x6d0]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x6d0], edi
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setg dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, edi
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, 9
jb 0x1000a3ee
cmp dword [ebp - 0x4c], ebx
jne 0x1000a469
jmp 0x1000a459
push 0xfffffffffffffffd
mov dword [ebp - 0x1c], ebx
pop eax
cmp dword [ebp - 0x1c], eax
je 0x1000a44a
push eax
pop edi
push esi
lea ecx, [ebp - 0x488]
call fcn.10016d71
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], esi
jge 0x1000a426
or edx, 0xffffffff
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x488]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jl 0x1000a412
mov eax, dword [ebp - 0x488]
lea ecx, [ebp - 0x488]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
call fcn.10016f47
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jne 0x1000a3fb
mov edi, 0x34a2c930
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], bl
je 0x1000a459
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe2
push 1
pop edx
jne 0x1000a32e
xor edx, edx
inc edx
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x198]
push edx
call fcn.10016d71
xor edx, edx
mov dword [ebp - 0x2c], ebx
inc edx
jmp 0x1000a496
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x198]
mov dword [eax + ecx*4], 0x5d6c05ba
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1000a483
mov byte [ebp - 0x45], bl
cmp byte [ebp - 0x45], 0
je 0x1000a4ae
push ebx
call dword [sym.imp.GDI32.dll_CreatePenIndirect]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x198]
mov edi, 0x10008224
mov dword [eax], ebx
mov dword [ebp - 0x10], 0x9c4c8d3c
mov dword [ebp - 0x10], ebx
jmp 0x1000a4d8
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x98], 0x74dd032
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000a4c7
mov dword [ebp - 0x10], ebx
jmp 0x1000a4f3
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x72c], 0xc8210466
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1000a4e2
mov dword [ebp - 0x10], ebx
jmp 0x1000a511
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x98]
mov dword [ebp - 0x98], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1000a4fe
mov dword [ebp - 0x4c], 0x26af
cmp dword [ebp - 0x4c], 0x7dd
jge 0x1000a5d9
lea eax, [ebp - 0xec]
mov dword [ebp - 0xec], ebx
push eax
push 0x10008214
call fcn.1004f2db
lea eax, [ebp - 0x140]
mov dword [ebp - 0x140], ebx
push eax
push 0x10008214
call fcn.1004f2db
add esp, 0x10
mov dword [ebp - 0x13c], ebx
cmp dword [ebp - 0xec], 0
mov esi, ebx
mov dword [ebp - 0x148], ebx
jle 0x1000a5ce
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x13c]
push eax
push 0x10008218
call fcn.1004f2db
mov eax, dword [ebp - 0x13c]
add esp, 0xc
mov ecx, dword [ebp - 0x140]
cmp eax, ecx
je 0x1000a72e
add eax, ecx
cmp eax, 7
je 0x1000a72e
mov eax, dword [ebp - 0x148]
cmp eax, ecx
je 0x1000a72e
add eax, ecx
cmp eax, 7
je 0x1000a72e
inc esi
cmp esi, dword [ebp - 0xec]
jl 0x1000a572
push 0x10008220
call fcn.10050586
pop ecx
mov eax, dword [ebp - 0x98]
cmp dword [ebp - 0x10], ebx
jne 0x1000a5e7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x10]
xor edx, edx
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x198]
push 0
cmp ecx, dword [eax]
setg dl
add esi, edx
neg esi
sbb esi, esi
xor ecx, ecx
inc esi
mov dword [ebp - 0x98], esi
mov eax, dword [ebp - 0x10]
cmp esi, eax
mov eax, dword [ebp - 0x198]
setle cl
xor edx, edx
cmp ecx, dword [eax]
setle dl
xor ebx, ebx
cmp edx, dword [eax]
mov dword [ebp - 0x728], edx
mov ecx, dword [ebp - 0x10]
setge bl
mov eax, dword [ebp - 0x198]
sub ebx, 8
neg ebx
sbb ebx, ebx
xor edx, edx
inc ebx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
add edx, ebx
cmp edx, eax
mov eax, dword [ebp - 0x198]
pop ebx
setne cl
push 1
inc dword [eax]
cmp dword [eax], 6
mov dword [ebp - 0x10], ecx
pop edx
jle 0x1000a4bb
lea ecx, [ebp - 0x198]
call fcn.10016f47
push 3
pop edi
mov dword [ebp - 0x24], 1
lea ecx, [ebp - 0x66c]
mov dword [ebp - 0x34], 0x3ed15de0
mov dword [ebp - 0x4c], 0x2949
push edi
call fcn.10016d71
mov dword [ebp - 4], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0x34172034
mov dword [ebp - 0x38], 0x24307a32
mov dword [ebp - 0x4c], 0x2327
cmp dword [ebp - 0x4c], 0x876
jge 0x1000a777
lea eax, [ebp - 0xa4]
push eax
push 0x10008210
call fcn.1004f2db
mov eax, dword [ebp - 0xa4]
pop ecx
pop ecx
test eax, eax
je 0x1000a770
dec eax
mov dword [ebp - 0xa4], eax
lea eax, [ebp - 0x144]
push eax
push 0x10008210
call fcn.1004f2db
xor eax, eax
mov esi, eax
mov edi, eax
mov eax, dword [ebp - 0x144]
pop ecx
pop ecx
test eax, eax
jle 0x1000a744
lea eax, [ebp - 0x238]
push eax
push 0x10008210
call fcn.1004f2db
mov eax, dword [ebp - 0x238]
pop ecx
pop ecx
cmp eax, ebx
jl 0x1000a734
mov esi, ebx
mov ebx, eax
jmp 0x1000a739
push edi
jmp 0x1000a5d3
cmp eax, esi
cmovg esi, eax
mov eax, dword [ebp - 0x144]
inc edi
cmp edi, eax
jl 0x1000a70b
add eax, 0xfffffffe
lea ecx, [esi - 1]
cmp eax, ecx
cmovl ecx, eax
push ecx
push 0x10008228
call fcn.1004ff5e
mov eax, dword [ebp - 0xa4]
pop ecx
pop ecx
push 0
pop ebx
test eax, eax
jne 0x1000a6e1
push 3
pop edi
dec eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x10], ebx
jmp 0x1000a78f
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x66c]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000a77c
xor ecx, ecx
mov dword [ebp - 0x10], ebx
inc ecx
jmp 0x1000a7ad
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x718], 0x53494abc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1000a79c
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
neg esi
push 2
sbb esi, esi
sub eax, 0x8d581621
neg esi
neg eax
sbb eax, eax
xor edx, edx
inc eax
test eax, eax
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp esi, eax
pop esi
setge cl
xor eax, eax
cmp edx, ecx
setne al
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x34], ebx
jmp 0x1000a840
push 1
lea ecx, [ebp - 0x6e8]
call fcn.10016d71
mov dword [ebp - 0x58], ebx
xor edx, edx
mov dword [ebp - 0x54], ebx
inc edx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x24], 0x55f9
mov dword [ebp - 0x2c], ebx
jmp 0x1000a82a
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x6e8]
mov dword [eax + ecx*4], 0x26a7609f
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1000a817
dec dword [ebp - 0x24]
lea ecx, [ebp - 0x6e8]
call fcn.10016f47
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], esi
jle 0x1000a7ef
or eax, 0xffffffff
lea ecx, [ebp - 0x66c]
mov dword [ebp - 4], eax
call fcn.10016f47
lea ecx, [ebp - 0x814]
mov dword [ebp - 0x18], 0xafa9b64f
push ecx
lea eax, [ebp - 0x804]
mov dword [ebp - 0x4c], ebx
push eax
xorps xmm0, xmm0
push ecx
lea ecx, [ebp - 0x7b8]
movdqu xmmword [ebp - 0x814], xmm0
call fcn.10016f21
mov dword [ebp - 0x3c], 0xf415d724
mov dword [ebp - 0x10], ebx
jmp 0x1000a8a2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x384], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000a891
mov dword [ebp - 0x10], ebx
jmp 0x1000a8bd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x8a8], 0xfa4c8210
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000a8ac
imul eax, dword [ebp - 0x3c], 0xaed6
mov ecx, dword [ebp - 0x7b8]
inc dword [ecx + 0xc]
mov dword [ebp - 0x384], eax
mov eax, dword [ebp - 0x3c]
xor eax, eax
cmp dword [ecx + 0xc], 0x1c946b43
sete al
imul eax, dword [ecx + 0xc]
add eax, dword [ebp - 0x3c]
jne 0x1000a8f6
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x8a4], 0x4ab653b1
lea ecx, [ebp - 0x7b8]
call fcn.10016f47
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jl 0x1000a92e
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x854]
movdqa xmm0, xmmword [0x10008990]
inc eax
mov dword [ebp - 0x4c], eax
xor esi, esi
push ecx
lea eax, [ebp - 0x844]
mov dword [ebp - 0x4c], 0x58d32ffa
push eax
push ecx
inc esi
lea ecx, [ebp - 0x684]
mov dword [ebp - 0x38], esi
movdqu xmmword [ebp - 0x854], xmm0
call fcn.10016f21
push 0xfffffffffffffff7
pop eax
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x530]
mov dword [ebp - 0x3c], eax
push edi
call fcn.10016d71
mov dword [ebp - 0x2c], ebx
jmp 0x1000a999
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x530]
mov dword [eax + ecx*4], 0xa835
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1000a986
mov eax, dword [ebp - 0x530]
inc dword [eax + 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x684]
mov eax, dword [ebp - 0x3c]
mov dword [ecx + 8], eax
lea ecx, [ebp - 0x530]
call fcn.10016f47
or esi, 0xffffffff
lea ecx, [ebp - 0x684]
mov dword [ebp - 4], esi
call fcn.10016f47
movdqa xmm0, xmmword [0x10008980]
lea ecx, [ebp - 0x834]
push ecx
lea eax, [ebp - 0x824]
mov byte [ebp - 0x45], bl
push eax
push ecx
lea ecx, [ebp - 0x308]
movdqu xmmword [ebp - 0x834], xmm0
call fcn.10016f21
mov dword [ebp - 4], 2
mov dword [ebp - 0x34], 0x8d581621
mov dword [ebp - 0x4c], 0xc2489102
mov dword [ebp - 0x4c], 0x13bf
cmp dword [ebp - 0x4c], 0x600
jge 0x1000aac5
lea eax, [ebp - 0xdc]
mov dword [ebp - 0xd0], ebx
push eax
lea eax, [ebp - 0xd0]
mov dword [ebp - 0xdc], ebx
push eax
push 0x10008230
call fcn.1004f2db
xor eax, eax
add esp, 0xc
mov edi, eax
cmp dword [ebp - 0xd0], eax
jle 0x1000aab0
mov dword [ebp - 0x16c], eax
lea eax, [ebp - 0x16c]
push eax
push 0x10008210
call fcn.1004f2db
pop ecx
pop ecx
mov ecx, dword [ebp - 0x16c]
cmp esi, ecx
jge 0x1000aa8b
mov esi, ecx
jmp 0x1000aaa4
sub esi, ecx
mov eax, esi
cdq
idiv dword [ebp - 0xdc]
inc eax
mov esi, eax
imul esi, dword [ebp - 0xdc]
add esi, ecx
add ebx, eax
inc edi
push 0
pop eax
cmp edi, dword [ebp - 0xd0]
jl 0x1000aa64
push ebx
push 0x10008228
call fcn.1004ff5e
pop ecx
pop ecx
push 3
xor ebx, ebx
or esi, 0xffffffff
pop edi
mov eax, dword [ebp - 0x308]
mov dword [eax], ebx
push 2
lea ecx, [ebp - 0x554]
call fcn.10016d71
mov dword [ebp - 0x2c], ebx
jmp 0x1000aaf2
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x554]
mov dword [eax + ecx*4], 0xb023
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1000aadf
cmp dword [ebp - 0x34], ebx
jne 0x1000ab8d
xor ecx, ecx
mov dword [ebp - 0x34], ebx
inc ecx
jmp 0x1000ab6a
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x1000ab67
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
neg eax
cmp eax, dword [ebp - 0x2c]
je 0x1000ab2e
mov eax, ecx
cmp dword [ebp - 0x2c], ebx
jne 0x1000ab30
mov eax, ebx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x1c]
push 0xfffffffffffffff7
pop ecx
push 1
cmp ecx, eax
mov eax, dword [ebp - 0x308]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x2c]
setl dl
imul eax, edx
pop ecx
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x1c]
jns 0x1000ab17
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], ecx
jle 0x1000ab09
lea ecx, [ebp - 0x554]
call fcn.10016f47
mov eax, dword [ebp - 0x308]
dec dword [eax]
cmp dword [eax], 0xfffffffe
jg 0x1000aacd
jmp 0x1000ab98
lea ecx, [ebp - 0x554]
call fcn.10016f47
lea ecx, [ebp - 0x308]
mov dword [ebp - 4], esi
call fcn.10016f47
cmp byte [ebp - 0x45], 0
je 0x1000abb7
push 0xa42
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [ebp - 0x10], 9
xor edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], 0x43af7806
mov dword [ebp - 0x40], 0x607800ff
mov dword [ebp - 0x2c], ebx
jmp 0x1000abe8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x118], 0xbd43
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1000abd7
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 0xf
jl 0x1000af90
mov dword [ebp - 0x18], 0xab6ec79c
lea ecx, [ebp - 0x338]
mov dword [ebp - 0x1c], 0x2395e2de
mov dword [ebp - 0x3c], 0x90dfc1f7
mov dword [ebp - 0x60], 0xca0e2c23
push edi
call fcn.10016d71
mov dword [ebp - 4], edi
mov dword [ebp - 0x2c], ebx
jmp 0x1000ac3e
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x338]
mov dword [eax + ecx*4], 0x5340
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1000ac2b
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
sub eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 0xe0d1
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, eax, 0xf1f1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf748
setne cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], 0xffff6e48
jg 0x1000ac9f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], ebx
je 0x1000acfc
mov dword [ebp - 0x38], 0x795c380a
lea ecx, [ebp - 0x764]
push 4
call fcn.10016d71
mov dword [ebp - 0x2c], ebx
jmp 0x1000ace0
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x764]
mov dword [eax + ecx*4], 0x6d1d89e1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1000accd
inc dword [ebp - 0x118]
lea ecx, [ebp - 0x764]
call fcn.10016f47
jmp 0x1000af27
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x4c], 0x1627
cmp dword [ebp - 0x4c], 0xa9f
jge 0x1000af15
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0xf8]
push eax
push 0x1000823c
call fcn.1004f2db
add esp, 0xc
lea eax, [ebp - 0x84]
push eax
push 0x10008214
call fcn.1004f2db
pop ecx
pop ecx
lea eax, [ebp - 0x740]
mov dword [ebp - 0x158], ebx
push eax
push dword [ebp - 0x84]
xorps xmm0, xmm0
mov dword [ebp - 0x154], ebx
lea ecx, [ebp - 0x158]
movlpd qword [ebp - 0x740], xmm0
mov dword [ebp - 0x150], ebx
call fcn.100183b2
mov eax, dword [ebp - 0x84]
mov esi, dword [ebp - 0x158]
test eax, eax
jle 0x1000ada3
mov edi, esi
push edi
push 0x10008248
call fcn.1004f2db
mov eax, dword [ebp - 0x84]
inc ebx
pop ecx
add edi, 8
pop ecx
cmp ebx, eax
jl 0x1000ad88
xor ecx, ecx
xor ebx, ebx
inc ecx
cmp dword [esi + eax*8 - 8], ecx
jne 0x1000add3
cmp dword [esi + eax*8 - 4], ebx
jne 0x1000add3
add dword [esi + eax*8 - 0x10], ecx
mov edi, dword [ebp - 0x154]
adc dword [esi + eax*8 - 0xc], ebx
sub edi, 8
dec dword [ebp - 0x84]
mov dword [ebp - 0x154], edi
jmp 0x1000add9
mov edi, dword [ebp - 0x154]
mov edx, ebx
mov dword [ebp - 0x1dc], ebx
mov ecx, ebx
mov dword [ebp - 0x1e4], edx
mov dword [ebp - 0x1e0], ecx
mov byte [ebp - 4], 5
mov eax, dword [ebp - 0xf4]
cmp eax, ebx
jl 0x1000aea5
mov ebx, dword [ebp - 0xf8]
jg 0x1000ae11
test ebx, ebx
je 0x1000aea3
mov edx, dword [ebp - 0x104]
mov ecx, dword [ebp - 0x108]
test edx, edx
jl 0x1000ae97
jg 0x1000ae27
test ecx, ecx
je 0x1000ae97
push edx
push ecx
push eax
push ebx
call fcn.100673e0
mov dword [ebp - 0x398], eax
lea ecx, [ebp - 0x1e4]
lea eax, [ebp - 0x398]
mov dword [ebp - 0x394], edx
push eax
call fcn.10016f7a
mov eax, dword [ebp - 0x104]
mov ebx, dword [ebp - 0x108]
push eax
push ebx
push dword [ebp - 0xf4]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0xf8]
call fcn.10067490
mov ecx, eax
mov dword [ebp - 0xf8], ebx
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0x108], ecx
mov dword [ebp - 0x104], edx
test eax, eax
jg 0x1000ae1d
jl 0x1000ae97
test ebx, ebx
jne 0x1000ae1d
mov ecx, dword [ebp - 0x1e0]
mov edx, dword [ebp - 0x1e4]
xor ebx, ebx
sub ecx, edx
sub edi, esi
sar ecx, 3
sar edi, 3
cmp edi, ecx
sete byte [ebp - 0x45]
test edi, edi
je 0x1000aedf
sub edx, esi
cmp ebx, ecx
jae 0x1000aedf
mov eax, dword [esi]
cmp eax, dword [edx + esi]
jne 0x1000afd6
mov eax, dword [esi + 4]
cmp eax, dword [edx + esi + 4]
jne 0x1000afd6
inc ebx
add esi, 8
cmp ebx, edi
jb 0x1000aebb
xor ebx, ebx
cmp byte [ebp - 0x45], 0
mov ecx, 0x10008224
mov eax, 0x10008220
cmove eax, ecx
push eax
call fcn.10050586
pop ecx
lea ecx, [ebp - 0x1e4]
call fcn.10016f47
lea ecx, [ebp - 0x158]
call fcn.10016f47
push 3
pop edi
or esi, 0xffffffff
cmp byte [ebp - 0x11], 0
je 0x1000af27
push ebx
push 0x12d2
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x118], ebx
je 0x1000af40
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x338]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x118]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x118]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x60]
mov eax, dword [ebp - 0x338]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x118]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x338]
mov dword [ebp - 4], esi
call fcn.10016f47
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xf
jge 0x1000abfb
xor edx, edx
inc edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x10], 0xfffffffe
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], edi
jge 0x1000afbe
push 0xfffffffffffffff9
pop ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x648], ecx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1000afac
mov dword [ebp - 0x34], 0x1a
cmp dword [ebp - 0x34], 0xffffffe2
je 0x1000b33a
mov edi, 0x10008278
jmp 0x1000afe3
xor ebx, ebx
mov byte [ebp - 0x45], bl
jmp 0x1000aee1
xor edx, edx
inc edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x1c], 0xfffffff8
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x4c], ebx
mov eax, dword [ebp - 0x34]
inc dword [ebp - 0x3c]
mov eax, dword [ebp - 0x10]
dec eax
neg eax
sbb eax, eax
xor ecx, ecx
neg eax
add eax, 0xc520
cmp eax, 0xc8d4
mov eax, edx
setl cl
xor edx, edx
sub eax, ecx
cmp eax, 0x6ec7
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setg bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x18]
cmp ebx, eax
mov eax, dword [ebp - 0x34]
mov ebx, 0x34a2c930
setg dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x648]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x648], ebx
sbb eax, eax
xor edx, edx
neg eax
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
cmp ecx, eax
setg dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
sub eax, ebx
neg eax
sbb eax, eax
xor ebx, ebx
inc eax
cmp eax, 9
jb 0x1000b0af
cmp dword [ebp - 0x4c], ebx
jne 0x1000b337
jmp 0x1000b32a
push 0xfffffffffffffffd
mov dword [ebp - 0x1c], ebx
pop eax
cmp dword [ebp - 0x1c], eax
je 0x1000b107
push eax
pop edi
push 3
lea ecx, [ebp - 0x3e0]
call fcn.10016d71
mov dword [ebp - 0x2c], ebx
jmp 0x1000b0dd
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3e0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x1000b0ce
mov eax, dword [ebp - 0x3e0]
lea ecx, [ebp - 0x3e0]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
call fcn.10016f47
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jne 0x1000b0bc
mov edi, 0x10008278
mov dword [ebp - 0x4c], 0x184d
cmp dword [ebp - 0x4c], 0xf9d
jge 0x1000b31a
push ebx
push ebx
lea ecx, [ebp - 0x3b0]
mov dword [ebp - 0x3a0], ebx
mov dword [ebp - 0x39c], ebx
call fcn.10017ecb
push ebx
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x374]
push ebx
mov dword [ebp - 0x364], ebx
mov dword [ebp - 0x360], ebx
call fcn.10017ecb
mov dword [ebp - 0xa78], 0x10008410
mov dword [ebp - 0xa08], 0x10001ef4
push ebx
push ebx
lea eax, [ebp - 0xa68]
mov byte [ebp - 4], 8
or dword [ebp - 0x14c], 1
lea ecx, [ebp - 0xa78]
push eax
call fcn.10017f0f
mov dword [ebp - 4], 9
mov eax, dword [ebp - 0xa78]
push ebx
mov eax, dword [eax + 4]
mov dword [ebp + eax - 0xa78], 0x100083e8
mov eax, dword [ebp - 0xa78]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x70]
mov dword [ebp + ecx - 0xa7c], eax
lea ecx, [ebp - 0xa68]
call fcn.1001844c
sub esp, 0xc
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa78]
call fcn.1001702e
lea edx, [ebp - 0x3b0]
lea ecx, [ebp - 0xa78]
call fcn.1001d542
lea edx, [ebp - 0x374]
mov ecx, eax
call fcn.1001d542
lea ecx, [ebp - 0xa68]
call fcn.10018470
test eax, eax
jne 0x1000b21e
mov eax, dword [ebp - 0xa78]
lea ecx, [ebp - 0xa78]
push ebx
mov eax, dword [eax + 4]
add ecx, eax
mov eax, dword [ecx + 0xc]
or eax, 2
push eax
call fcn.100180c0
push 0x1000825c
push 0x10008260
call fcn.100500d1
pop ecx
pop ecx
mov edx, 0x1000826c
lea ecx, [ebp - 0x3b0]
mov esi, eax
call fcn.1001c4dc
test al, al
je 0x1000b25d
mov edx, 0x10008274
lea ecx, [ebp - 0x374]
call fcn.1001c4dc
test al, al
jne 0x1000b2dd
mov edx, 0x1000826c
lea ecx, [ebp - 0x3b0]
call fcn.1001c4dc
test al, al
je 0x1000b28d
mov edx, 0x1000827c
lea ecx, [ebp - 0x374]
call fcn.1001c4dc
test al, al
je 0x1000b28d
push esi
push 0x10008280
jmp 0x1000b2df
mov edx, 0x10008284
lea ecx, [ebp - 0x3b0]
call fcn.1001c4dc
test al, al
je 0x1000b2b5
mov edx, 0x10008274
lea ecx, [ebp - 0x374]
call fcn.1001c4dc
test al, al
jne 0x1000b285
mov edx, 0x10008284
lea ecx, [ebp - 0x3b0]
call fcn.1001c4dc
test al, al
je 0x1000b2e6
mov edx, 0x1000827c
lea ecx, [ebp - 0x374]
call fcn.1001c4dc
test al, al
je 0x1000b2e6
push esi
push edi
call fcn.1004f37b
pop ecx
pop ecx
push esi
call fcn.10050792
pop ecx
lea ecx, [ebp - 0xa78]
call fcn.100108d8
push ebx
push 1
lea ecx, [ebp - 0x374]
call fcn.10017ecb
push ebx
or esi, 0xffffffff
lea ecx, [ebp - 0x3b0]
push 1
mov dword [ebp - 4], esi
call fcn.10017ecb
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b32a
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
dec dword [ebp - 0x34]
cmp dword [ebp - 0x34], 0xffffffe2
jne 0x1000afe0
push 3
pop edi
mov eax, 0xf665683c
mov dword [ebp - 0x5ac], eax
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 0x5a4], eax
mov dword [ebp - 0x5a0], eax
mov dword [ebp - 0x38], 0xc405b401
mov dword [ebp - 0x24], 0x1867b8f5
mov dword [ebp - 0x3c], 0xffff
mov dword [ebp - 0x4c], 0x9d5fac12
mov dword [ebp - 0x2c], ebx
jmp 0x1000b389
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x978], 0xc3707822
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1000b378
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b3a0
push 0x6d
push ebx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x5a4]
dec dword [ebp - 0x3c]
cmp eax, ecx
jle 0x1000b3bb
xor eax, eax
inc eax
jmp 0x1000b3bd
mov eax, ebx
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x7ac]
xor eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3c], 0xfa72
mov dword [ebp - 0x1c], 0xe0091df8
mov dword [ebp - 0x24], 8
push eax
call fcn.10016d71
xor edx, edx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x2c], ebx
inc edx
jmp 0x1000b401
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x7ac]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edx
jl 0x1000b3f2
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
dec dword [ebp - 0x18]
mov dword [ebp - 0x3c], 0xfb37
mov eax, dword [ebp - 0x1c]
cmp eax, 0x73672d71
setl cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x1c], 0x83d78398
mov eax, dword [ebp - 0x3c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x18], ebx
je 0x1000b47e
mov dword [ebp - 0x38], 0x4292978d
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0x3fc2
mov dword [ebp - 0x2c], ebx
jmp 0x1000b474
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x96c], ebx
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1000b467
dec dword [ebp - 0x40]
jmp 0x1000b48b
mov dword [ebp - 0x4c], 0x68993dd6
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x7ac]
call fcn.10016f47
mov dword [ebp - 0x10], 9
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x24], 0x43af7806
mov dword [ebp - 0x40], 0x607800ff
mov dword [ebp - 0x2c], ebx
jmp 0x1000b4c8
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x120], 0xbd43
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 2
jl 0x1000b4b7
mov dword [ebp - 0x10], ebx
jmp 0x1000b648
mov dword [ebp - 0x18], 0xab6ec79c
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 0x1c], 0x2395e2de
mov dword [ebp - 0x3c], 0x90dfc1f7
mov dword [ebp - 0x4c], 0xca0e2c23
call fcn.10016d71
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x2c], ebx
jmp 0x1000b51c
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2d8]
mov dword [eax + ecx*4], 0x5340
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], edi
jl 0x1000b509
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
sub eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, 0xe0d1
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
imul eax, eax, 0xf1f1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0xf748
setne cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x10], 0xffff6e48
jg 0x1000b57d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setl dl
mov dword [ebp - 0x40], edx
cmp dword [ebp - 0x40], ebx
je 0x1000b5d7
mov dword [ebp - 0x38], 0x795c380a
lea ecx, [ebp - 0x6ac]
push 4
call fcn.10016d71
mov dword [ebp - 0x2c], ebx
jmp 0x1000b5be
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x6ac]
mov dword [eax + ecx*4], 0x6d1d89e1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x1000b5ab
inc dword [ebp - 0x120]
lea ecx, [ebp - 0x6ac]
call fcn.10016f47
jmp 0x1000b5ec
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b5ec
push ebx
push 0x12d2
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
cmp dword [ebp - 0x120], ebx
je 0x1000b605
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2d8]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x120]
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x120]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x2d8]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x120]
setge dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x2d8]
mov dword [ebp - 4], esi
call fcn.10016f47
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xf
push edi
jge 0x1000b4d6
lea ecx, [ebp - 0x3f8]
call fcn.10016d71
mov dword [ebp - 0x3c], 0xf054a20a
mov dword [ebp - 0x40], 0x2ca9
mov dword [ebp - 0x24], 0xe28de637
mov dword [ebp - 0x10], ebx
jmp 0x1000b68b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x3f8]
mov dword [eax + ecx*4], 0x34d0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000b678
mov dword [ebp - 0x10], ebx
jmp 0x1000b6a6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x500], 0xe136dc99
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1000b695
mov esi, dword [ebp - 0x3f8]
mov eax, dword [esi + 8]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], ebx
je 0x1000b6df
xor ecx, ecx
inc ecx
mov dword [ebp - 0x40], ecx
mov edx, ecx
mov dword [ebp - 0x24], 0xfff9
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x40]
imul eax, eax, 0xc537
add eax, 0x22dc1119
jne 0x1000b6e1
mov edx, ebx
mov eax, dword [ebp - 0x4fc]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp dword [esi + 8], ecx
setl al
xor ecx, ecx
cmp eax, 0x11c3fc02
mov eax, dword [ebp - 0x4f8]
setle cl
sub ecx, eax
inc ecx
je 0x1000b715
cmp dword [ebp - 0x3c], ebx
je 0x1000b715
xor eax, eax
inc eax
jmp 0x1000b717
mov eax, ebx
add eax, 0xffff5c85
lea ecx, [ebp - 0x3f8]
mov dword [ebp - 0x4fc], eax
call fcn.10016f47
xor edx, edx
inc edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x24], 0xa5202749
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0x2ef703c5
mov dword [ebp - 0x24], 0x11fc80ae
mov dword [ebp - 0x4c], 0x79655965
mov dword [ebp - 0x20], ebx
jmp 0x1000b768
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x63c], 0x8ee4
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000b757
mov dword [ebp - 0x20], ebx
jmp 0x1000b784
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x77c], 0x72b90f99
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000b773
mov dword [ebp - 0x20], ebx
jmp 0x1000b79f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8b4], 0xa6b719d8
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x1000b78e
mov esi, ebx
cmp dword [ebp - 0x630], ebx
je 0x1000b7b0
mov esi, edx
mov dword [ebp - 0x24], 0x8dfb
xor ecx, ecx
mov eax, dword [ebp - 0x778]
cmp eax, 0x1887
setg cl
cmp dword [ebp - 0x24], ecx
jl 0x1000b7d6
mov eax, edx
cmp dword [ebp - 0x63c], ebx
jne 0x1000b7d8
mov eax, ebx
mov dword [ebp - 0x24], eax
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x778]
cmp ecx, eax
mov eax, dword [ebp - 0x630]
setge dl
xor ecx, ecx
cmp edx, eax
push 0xfffffffffffffffd
sete cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x8ac], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
pop ecx
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp esi, eax
setge cl
xor eax, eax
cmp ecx, 0x97f0
mov ecx, 0xcef3cf68
setle al
sub eax, 0x1af9d66d
neg eax
sbb eax, eax
inc eax
imul eax, eax, 0xfffd
sub eax, 0xa6c65b0b
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b85b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov dword [ebp - 0x2c], 0xfffffffe
lea ecx, [ebp - 0x6c4]
push 4
mov dword [ebp - 0x34], 7
pop esi
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x3c], 0x55cc25b
mov dword [ebp - 0x18], esi
push edi
call fcn.10016d71
push 0xfffffffffffffffb
pop eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], ebx
jmp 0x1000b8aa
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6c4]
mov dword [eax + ecx*4], 0x713e19f2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000b897
mov edx, dword [ebp - 0x34]
xor ecx, ecx
add edx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x34]
cmp eax, edx
setl cl
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x1c], eax
jge 0x1000b8d9
cmp dword [ebp - 0x1c], ebx
je 0x1000b8d9
xor eax, eax
inc eax
jmp 0x1000b8db
mov eax, ebx
mov dword [ebp - 0x3c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
dec dword [ebp - 0x40]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp eax, 0xfffffff6
setl cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b928
push ebx
push ebx
push 0x5db
push ebx
call dword [sym.imp.USER32.dll_AppendMenuA]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000b93f
push 0x1d56
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
lea ecx, [ebp - 0x6c4]
call fcn.10016f47
mov dword [ebp - 0x44], 0xfffe
lea ecx, [ebp - 0x7dc]
push edi
call fcn.10016d71
or eax, 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x38], 0x7fd8b26d
mov dword [ebp - 0x38], 0x74d4
mov dword [ebp - 0x38], 0x4633be61
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], ebx
jmp 0x1000b992
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7dc]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000b983
dec dword [ebp - 0x3c]
jne 0x1000b99f
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x40]
sub ecx, eax
mov eax, 0xf47dfb07
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x40]
imul ecx, dword [ebp - 0x44]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [ebp - 0x44]
setle dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x18], ecx
lea ecx, [ebp - 0x7dc]
call fcn.10016f47
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x4c], 0x2011
cmp dword [ebp - 0x4c], 0xc4e
jge 0x1000ba4d
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x694]
push eax
lea eax, [ebp - 0x278]
push eax
lea eax, [ebp - 0x23c]
push eax
push 0x1000828c
call fcn.1004f2db
mov eax, dword [ebp - 0x23c]
add esp, 0x14
add eax, dword [ebp - 0x278]
add eax, dword [ebp - 0x244]
lea eax, [eax*2 + 4]
push eax
push 0x10008228
call fcn.1004ff5e
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edi
jge 0x1000ba6a
push 0xfffffffffffffff9
pop ecx
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x794], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x1000ba58
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x410]
mov dword [ebp - 0x3c], 0xab97
push esi
call fcn.10016d71
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x20], ebx
jmp 0x1000ba9d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x874], 0xdf99
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000ba8c
mov dword [ebp - 0x4c], 0x1565
cmp dword [ebp - 0x4c], 0x9fe
jge 0x1000bbd8
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0xa0]
push eax
push 0x1000829c
call fcn.1004f2db
add esp, 0x10
mov dword [ebp - 0x2a0], ebx
lea eax, [ebp - 0x2a0]
lea ecx, [ebp - 0x56c]
push eax
push dword [ebp - 0xa0]
call fcn.10016dad
mov byte [ebp - 4], 0xd
mov edi, ebx
cmp dword [ebp - 0xa0], 0
mov ebx, dword [ebp - 0x56c]
jle 0x1000bb26
mov esi, ebx
push esi
push 0x10008210
call fcn.1004f2db
inc edi
add esi, 4
pop ecx
pop ecx
cmp edi, dword [ebp - 0xa0]
jl 0x1000bb0d
push dword [ebp - 0x568]
push ebx
call fcn.1001c53a
mov esi, dword [ebp - 0x178]
mov edx, dword [ebp - 0x15c]
pop ecx
pop ecx
cmp esi, edx
jle 0x1000bb56
mov eax, esi
mov esi, edx
mov edx, eax
mov dword [ebp - 0x178], esi
mov dword [ebp - 0x15c], edx
mov eax, dword [ebp - 0xa0]
xorps xmm2, xmm2
movapd xmm1, xmm2
lea ecx, [eax - 1]
sub eax, esi
jmp 0x1000bb78
movd xmm0, dword [ebx + ecx*4]
dec ecx
cvtdq2pd xmm0, xmm0
addsd xmm2, xmm0
cmp ecx, eax
jge 0x1000bb6a
lea ecx, [eax - 1]
sub eax, edx
jmp 0x1000bb91
movd xmm0, dword [ebx + ecx*4]
dec ecx
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp ecx, eax
jge 0x1000bb83
movd xmm0, esi
cvtdq2pd xmm0, xmm0
push ecx
push ecx
divsd xmm2, xmm0
movd xmm0, edx
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
addsd xmm1, xmm2
movsd qword [esp], xmm1
push 0x100082a8
call fcn.1004ff5e
add esp, 0xc
lea ecx, [ebp - 0x56c]
call fcn.10016f47
push 3
pop edi
push 4
xor ebx, ebx
pop esi
mov dword [ebp - 0x20], ebx
jmp 0x1000bbee
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x920], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000bbdd
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jge 0x1000bc12
push 0xfffffffffffffff9
pop edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x410]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000bbfe
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1000bcbb
mov esi, dword [ebp - 0x410]
mov dword [ebp - 0x1c], 0x92ea21e1
xor edx, edx
mov dword [ebp - 0x24], 0x2891ba80
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
cmp edx, 0xc619a80b
je 0x1000bc53
cmp dword [ebp - 0x874], ebx
jne 0x1000bc53
mov eax, ebx
jmp 0x1000bc56
xor eax, eax
inc eax
xor ecx, ecx
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x870]
setne cl
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
cmp ecx, 2
jl 0x1000bc8d
cmp dword [ebp - 0x3c], ebx
jne 0x1000bc8d
mov eax, ebx
jmp 0x1000bc90
xor eax, eax
inc eax
mov dword [ebp - 0x1c], eax
xor edx, edx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setg dl
mov dword [ebp - 0x91c], edx
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [esi + 8], eax
dec dword [ebp - 0x18]
jns 0x1000bc24
or esi, 0xffffffff
lea ecx, [ebp - 0x410]
mov dword [ebp - 4], esi
call fcn.10016f47
mov dword [ebp - 0x1c], 0x1a
cmp dword [ebp - 0x1c], 0xffffffe2
je 0x1000c9dc
lea esi, [ebp - 0x2cc]
lea edi, [ebp - 0x2bc]
push 3
lea ecx, [ebp - 0x320]
call fcn.10016d71
push 0xfffffffffffffff9
mov dword [ebp - 4], 0xe
pop eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x4c], 0x92891f43
mov dword [ebp - 0x10], ebx
jmp 0x1000bd22
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x320]
mov dword [eax + ecx*4], 0xf5540d7f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000bd0f
xor ecx, ecx
mov dword [ebp - 0x10], ebx
inc ecx
jmp 0x1000bd41
cmp dword [ebp - 0x10], ecx
jl 0x1000bd30
mov dword [ebp - 0x3c], 0xf572
lea ecx, [ebp - 0x470]
mov dword [ebp - 0x40], 0x30f94f37
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x24], esi
push 1
call fcn.10016d71
mov dword [ebp - 0x2c], 0x585c
xor edx, edx
mov dword [ebp - 0x40], 8
inc edx
mov dword [ebp - 0x10], ebx
jmp 0x1000ca29
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x470]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1000ca1a
mov dword [ebp - 0x10], ebx
jmp 0x1000ca44
cmp dword [ebp - 0x10], edx
jl 0x1000ca33