Function at 0x10048fac
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10089225
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x37c
push esi
push edi
mov dword [ebp - 0x10], 0x2e91a049
mov dword [ebp - 0x14], 0x64276038
push 3
lea ecx, [ebp - 0x248]
call fcn.100280d9
and dword [ebp - 4], 0
mov dword [ebp - 0x9c], 0x9db2213a
mov dword [ebp - 0x288], 0xe7a5
mov dword [ebp - 0x78], 0
jmp 0x1004900f
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 3
jge 0x1004902b
push dword [ebp - 0x78]
lea ecx, [ebp - 0x248]
call fcn.10028177
mov dword [eax], 0xe80c6548
jmp 0x10049008
mov dword [ebp - 0x10], 0xc
jmp 0x1004903b
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xfffffff5
jge 0x1004928b
mov dword [ebp - 0x50], 0x2124f84b
push 2
lea ecx, [ebp - 0x2fc]
call fcn.100280d9
mov byte [ebp - 4], 1
mov dword [ebp - 0xec], 0xcaa5d732
mov dword [ebp - 0x278], 3
mov dword [ebp - 0xa0], 0
jmp 0x1004908a
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 2
jge 0x100490ac
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x2fc]
call fcn.10028177
mov dword [eax], 0x8dee21af
jmp 0x1004907d
mov dword [ebp - 0x50], 0
jmp 0x100490bc
mov eax, dword [ebp - 0x50]
dec eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xfffffff3
jl 0x10049277
mov dword [ebp - 0x68], 0x8af8
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x68], eax
jl 0x100490e1
mov dword [ebp - 0x270], 1
jmp 0x100490e8
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x230], eax
push 2
lea ecx, [ebp - 0x248]
call fcn.10028177
mov ecx, dword [ebp - 0x230]
mov dword [eax], ecx
cmp dword [ebp - 0x230], 0
jne 0x1004911b
mov dword [ebp - 0x20c], 1
jmp 0x10049122
and dword [ebp - 0x20c], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x20c], eax
jl 0x10049139
mov dword [ebp - 0x184], 1
jmp 0x10049140
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x33c], eax
or eax, 0xffffffff
neg eax
cmp eax, dword [ebp - 0x68]
jl 0x1004916e
mov dword [ebp - 0x18c], 1
jmp 0x10049175
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x18c], eax
je 0x1004918c
mov dword [ebp - 0xf4], 1
jmp 0x10049193
and dword [ebp - 0xf4], 0
cmp dword [ebp - 0xf4], 0xb9c3
jg 0x100491ab
mov dword [ebp - 0x194], 1
jmp 0x100491b2
and dword [ebp - 0x194], 0
imul eax, dword [ebp - 0x194], 0x6194
cmp eax, 0x1b8d
jne 0x100491cf
mov dword [ebp - 0x19c], 1
jmp 0x100491d6
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xfc], eax
push 0
lea ecx, [ebp - 0x2fc]
call fcn.10028177
mov ecx, dword [ebp - 0xfc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xfc]
cmp eax, dword [ebp - 0x19c]
jg 0x1004920e
mov dword [ebp - 0x104], 1
jmp 0x10049215
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x104], eax
jne 0x1004922c
mov dword [ebp - 0x1a4], 1
jmp 0x10049233
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x1a4], eax
je 0x1004924a
mov dword [ebp - 0x10c], 1
jmp 0x10049251
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x10c], eax
jle 0x10049269
push 0
lea ecx, [ebp - 0x248]
call fcn.10028177
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x278], eax
jmp 0x100490b5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2fc]
call fcn.1002815b
jmp 0x10049034
mov dword [ebp - 0x14], 0
jmp 0x1004929b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x31
jne 0x10049726
push 1
lea ecx, [ebp - 0x254]
call fcn.100280d9
mov byte [ebp - 4], 2
mov dword [ebp - 0x290], 5
mov dword [ebp - 0xc0], 0
mov dword [ebp - 0x80], 0
jmp 0x100492da
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 1
jge 0x100492f6
push dword [ebp - 0x80]
lea ecx, [ebp - 0x254]
call fcn.10028177
mov dword [eax], 0xfffffffb
jmp 0x100492d3
mov byte [ebp - 0x4b], 0
movzx eax, byte [ebp - 0x4b]
test eax, eax
je 0x10049308
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x340], eax
push 2
lea ecx, [ebp - 0x248]
call fcn.10028177
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x9c], eax
mov esi, dword [ebp - 0x9c]
add esi, 4
push 0
lea ecx, [ebp - 0x254]
call fcn.10028177
cmp esi, dword [eax]
jge 0x10049352
mov dword [ebp - 0x1ac], 1
jmp 0x10049359
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1ac], eax
jne 0x10049370
mov dword [ebp - 0x114], 1
jmp 0x10049377
and dword [ebp - 0x114], 0
push 0
lea ecx, [ebp - 0x254]
call fcn.10028177
mov ecx, dword [ebp - 0x114]
sub ecx, dword [ebp - 0x14]
cmp dword [eax], ecx
jge 0x1004939d
mov dword [ebp - 0x1b4], 1
jmp 0x100493a4
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
sub eax, 0xe8af
cmp eax, 0xfffffff8
jae 0x100493c0
mov dword [ebp - 0x280], 1
jmp 0x100493c7
and dword [ebp - 0x280], 0
push 2
lea ecx, [ebp - 0x248]
call fcn.10028177
mov esi, dword [eax]
dec esi
push 0
lea ecx, [ebp - 0x254]
call fcn.10028177
cmp esi, dword [eax]
jne 0x10049451
mov dword [ebp - 0xa8], 0
jmp 0x10049401
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 2
jge 0x1004941d
mov eax, dword [ebp - 0xa8]
mov dword [ebp + eax*4 - 0x328], 0xf668
jmp 0x100493f4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x328], 0x8fba323a
jbe 0x1004943c
mov dword [ebp - 0x11c], 1
jmp 0x10049443
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x10], eax
jmp 0x10049712
mov dword [ebp - 0xb8], 0xe95372a7
mov dword [ebp - 0x20], 0x2a25
mov dword [ebp - 0x200], 0x74ecb9a7
mov dword [ebp - 0x88], 0
jmp 0x10049485
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x100494a1
mov eax, dword [ebp - 0x88]
mov dword [ebp + eax*4 - 0x298], 0xfffffff6
jmp 0x10049478
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x338], eax
mov eax, 0x2ed16080
cmp eax, 0x3e8932a2
jle 0x100494c2
mov dword [ebp - 0x1bc], 1
jmp 0x100494c9
and dword [ebp - 0x1bc], 0
cmp dword [ebp - 0x1bc], 1
jl 0x100494de
mov dword [ebp - 0x124], 1
jmp 0x100494e5
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x1c4], eax
push 0
lea ecx, [ebp - 0x254]
call fcn.10028177
mov ecx, dword [ebp - 0x1c4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c4], eax
jl 0x10049529
mov dword [ebp - 0x12c], 1
jmp 0x10049530
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
sub eax, dword [ebp - 0x20]
cmp eax, 0xdfb9
jle 0x1004954c
mov dword [ebp - 0x1cc], 1
jmp 0x10049553
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x288]
cmp eax, dword [ebp - 0x1cc]
jge 0x1004956d
mov dword [ebp - 0x134], 1
jmp 0x10049574
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x20], eax
je 0x100495a3
push 0
lea ecx, [ebp - 0x254]
call fcn.10028177
cmp dword [eax], 0
je 0x100495a3
mov dword [ebp - 0x1d4], 1
jmp 0x100495aa
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x290]
jg 0x100495c8
mov dword [ebp - 0x13c], 1
jmp 0x100495cf
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x13c]
cmp eax, dword [ebp - 0x20]
jle 0x100495ea
mov dword [ebp - 0x1dc], 1
jmp 0x100495f1
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1dc], eax
jl 0x10049608
mov dword [ebp - 0x144], 1
jmp 0x1004960f
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x144], eax
jne 0x10049629
mov dword [ebp - 0x1f8], 1
jmp 0x10049630
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1f8], eax
jne 0x10049647
mov dword [ebp - 0x14c], 1
jmp 0x1004964e
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 0xfff6
ja 0x10049672
mov dword [ebp - 0x154], 1
jmp 0x10049679
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0xc0]
cmp dword [ebp - 0x154], eax
jge 0x10049693
mov dword [ebp - 0x208], 1
jmp 0x1004969a
and dword [ebp - 0x208], 0
push 2
lea ecx, [ebp - 0x248]
call fcn.10028177
mov ecx, dword [ebp - 0x208]
cmp ecx, dword [eax]
jle 0x100496bd
mov dword [ebp - 0x15c], 1
jmp 0x100496c4
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0xb8]
mov ecx, dword [ebp - 0x15c]
dec ecx
sub ecx, dword [ebp - 0xc0]
imul eax, ecx
cmp eax, dword [ebp - 0x14]
je 0x100496f8
mov dword [ebp - 0x210], 1
jmp 0x100496ff
and dword [ebp - 0x210], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x210]
mov dword [ebp + eax - 0x298], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x254]
call fcn.1002815b
jmp 0x10049294
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x248]
call fcn.1002815b
push 2
lea ecx, [ebp - 0x26c]
call fcn.100280d9
mov dword [ebp - 4], 3
mov dword [ebp - 0x34], 0xdf1febae
mov dword [ebp - 0x164], 0x3b2c57e7
mov dword [ebp - 0x90], 0
jmp 0x10049773
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 2
jge 0x10049795
push dword [ebp - 0x90]
lea ecx, [ebp - 0x26c]
call fcn.10028177
mov dword [eax], 0xfffffffb
jmp 0x10049766
mov dword [ebp - 0x34], 0
jmp 0x100497a5
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 1
jg 0x100498e9
mov dword [ebp - 0x38], 0xbeccce1e
mov dword [ebp - 0x38], 0
jmp 0x100497c6
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 1
jg 0x100498e4
mov dword [ebp - 0x64], 4
mov dword [ebp - 0x218], 0x41a62a96
mov byte [ebp - 0x49], 0
movzx eax, byte [ebp - 0x49]
test eax, eax
je 0x10049808
push 0x36
push 0x1b47
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
mov dword [ebp - 0x64], 0
jmp 0x10049818
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jg 0x100498df
mov dword [ebp - 0x2a0], 0x3895196e
mov dword [ebp - 0x27c], 6
push dword [ebp - 0x34]
lea ecx, [ebp - 0x26c]
call fcn.10028177
push dword [ebp - 0x34]
lea ecx, [ebp - 0x26c]
call fcn.10028177
mov dword [ebp - 0x2a0], 0xe9c9
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x38], eax
je 0x10049879
mov dword [ebp - 0x274], 1
jmp 0x10049880
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x218]
mov dword [ebp - 0x334], eax
push dword [ebp - 0x64]
lea ecx, [ebp - 0x26c]
call fcn.10028177
mov dword [ebp - 0x16c], eax
push 1
lea ecx, [ebp - 0x26c]
call fcn.10028177
mov ecx, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x16c]
mov eax, dword [eax]
mov dword [ebp - 0x27c], eax
jmp 0x10049811
jmp 0x100497bf
jmp 0x1004979e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x26c]
call fcn.1002815b
push 1
lea ecx, [ebp - 0x23c]
call fcn.100280d9
mov dword [ebp - 4], 4
mov dword [ebp - 0x40], 0xc93b4e1a
mov dword [ebp - 0x94], 0
jmp 0x1004992c
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 4
jge 0x10049948
mov eax, dword [ebp - 0x94]
mov dword [ebp + eax*4 - 0x374], 0xfffffffd
jmp 0x1004991f
mov dword [ebp - 0x40], 0xc
jmp 0x10049958
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
jle 0x10049996
mov dword [ebp - 0x58], 0xf759609c
mov dword [ebp - 0x58], 0
jmp 0x10049975
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jg 0x10049994
mov eax, dword [ebp - 0x58]
cmp dword [ebp + eax*4 - 0x374], 0
je 0x1004998a
jmp 0x10049994
cmp dword [ebp - 0x58], 0
je 0x10049992
jmp 0x10049994
jmp 0x1004996e
jmp 0x10049951
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x40], eax
push 2
lea ecx, [ebp - 0x260]
call fcn.100280d9
mov byte [ebp - 4], 5
mov dword [ebp - 0x74], 0xffff
mov dword [ebp - 0x294], 1
mov dword [ebp - 0x29c], 0x7e318b47
mov dword [ebp - 0x220], 0x10f7
mov dword [ebp - 0xd0], 0x528ace4b
push 4
lea ecx, [ebp - 0x2b0]
call fcn.100280d9
mov byte [ebp - 4], 6
mov dword [ebp - 0xc8], 0x53f3ac9d
mov dword [ebp - 0x2b4], 9
push 2
lea ecx, [ebp - 0x314]
call fcn.100280d9
mov byte [ebp - 4], 7
mov dword [ebp - 0x284], 0xffffffff
mov dword [ebp - 0x1c], 0
jmp 0x10049a35
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10049a51
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x2b0]
call fcn.10028177
mov dword [eax], 1
jmp 0x10049a2e
mov dword [ebp - 0x1c], 0
jmp 0x10049a61
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10049a7d
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x314]
call fcn.10028177
mov dword [eax], 0x79facd4a
jmp 0x10049a5a
mov eax, dword [ebp - 0x220]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x220], 0xad94
jge 0x10049aa1
mov dword [ebp - 0x174], 1
jmp 0x10049aa8
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0x174]
mov dword [ebp - 0xd0], eax
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x228], eax
push 0
lea ecx, [ebp - 0x2b0]
call fcn.10028177
mov ecx, dword [ebp - 0x228]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc8]
imul eax, dword [ebp - 0x228]
test eax, eax
je 0x10049b02
cmp dword [ebp - 0xd0], 0
je 0x10049b02
push 4
pop eax
test eax, eax
je 0x10049b02
mov dword [ebp - 0xe0], 1
jmp 0x10049b09
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0x2b4]
cmp dword [ebp - 0xe0], eax
jle 0x10049b23
mov dword [ebp - 0x180], 1
jmp 0x10049b2a
and dword [ebp - 0x180], 0
cmp dword [ebp - 0x180], 0
je 0x10049b3f
mov dword [ebp - 0x1e0], 1
jmp 0x10049b46
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1e0]
add eax, 0x6d8ff8cd
jne 0x10049b6e
push 0
lea ecx, [ebp - 0x2b0]
call fcn.10028177
cmp dword [eax], 0
jne 0x10049b6e
and dword [ebp - 0x188], 0
jmp 0x10049b78
mov dword [ebp - 0x188], 1
mov eax, dword [ebp - 0x188]
sub eax, dword [ebp - 0xc8]
je 0x10049b8d
cmp dword [ebp - 0xc8], 0
or eax, 0xffffffff
je 0x10049bb0
push 0
lea ecx, [ebp - 0x2b0]
call fcn.10028177
cmp dword [eax], 0
je 0x10049bb0
mov dword [ebp - 0xd8], 1
jmp 0x10049bb7
and dword [ebp - 0xd8], 0
push 0
lea ecx, [ebp - 0x314]
call fcn.10028177
mov ecx, dword [ebp - 0xd8]
mov dword [eax], ecx
cmp dword [ebp - 0xd8], 0x351f2000
jl 0x10049be4
mov dword [ebp - 0x1f0], 1
jmp 0x10049beb
and dword [ebp - 0x1f0], 0
cmp dword [ebp - 0x1f0], 0x13532fe2
jne 0x10049c03
mov dword [ebp - 0x190], 1
jmp 0x10049c0a
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x284], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x314]
call fcn.1002815b
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2b0]
call fcn.1002815b
push 0x5618
push 0x4935
lea eax, [ebp - 0x2c4]
push eax
push 0
lea eax, [ebp - 0x23c]
push eax
call fcn.100451f0
add esp, 0x14
push 2
lea ecx, [ebp - 0x308]
call fcn.100280d9
mov byte [ebp - 4], 8
mov dword [ebp - 0x60], 2
mov dword [ebp - 0xa4], 0
jmp 0x10049c87
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 2
jge 0x10049ca9
push dword [ebp - 0xa4]
lea ecx, [ebp - 0x308]
call fcn.10028177
mov dword [eax], 9
jmp 0x10049c7a
mov dword [ebp - 0x60], 1
jmp 0x10049cb9
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0
jl 0x10049d26
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x8c], 0
jmp 0x10049ce2
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jg 0x10049d24
mov byte [ebp - 0x41], 0
movzx eax, byte [ebp - 0x41]
test eax, eax
je 0x10049d0d
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RectVisible]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x308]
call fcn.10028177
cmp dword [eax], 0
je 0x10049d22
jmp 0x10049d24
jmp 0x10049cd5
jmp 0x10049cb2
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x308]
call fcn.1002815b
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x2c4]
push eax
push 0x6f2e
push 1
push 0x660e
call fcn.100451f0
add esp, 0x14
mov dword [ebp - 0x2c], 0xfcc58a01
mov dword [ebp - 0xbc], 0xe76d238e
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x54], 0xffffffff
mov dword [ebp - 0x2f0], 8
mov dword [ebp - 0x2ec], 8
mov dword [ebp - 0x2e8], 8
mov dword [ebp - 0x2e4], 8
lea ecx, [ebp - 0xd9]
call fcn.10008cd5
push eax
lea eax, [ebp - 0x2e0]
push eax
lea eax, [ebp - 0x2f0]
push eax
lea ecx, [ebp - 0x364]
call fcn.10028186
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x320]
call fcn.10028135
mov byte [ebp - 4], 9
mov eax, 0x4fddd3f4
test eax, eax
je 0x10049ed1
cmp dword [ebp - 0x2c], 2
jl 0x10049ed1
xor eax, eax
jne 0x10049dff
cmp dword [ebp - 0x2c], 0
je 0x10049e0e
cmp dword [ebp - 0x2c], 0
jne 0x10049e0e
and dword [ebp - 0x1ec], 0
jmp 0x10049e18
mov dword [ebp - 0x1ec], 1
mov eax, dword [ebp - 0x1ec]
add eax, 8
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x2c], 0xf068cd54
jbe 0x10049e4e
mov eax, 0x493876a4
test eax, eax
je 0x10049e4e
mov dword [ebp - 0x198], 1
jmp 0x10049e55
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0xe6fc2e60
jb 0x10049e73
mov dword [ebp - 0x22c], 1
jmp 0x10049e7a
and dword [ebp - 0x22c], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x22c], eax
jne 0x10049e91
mov dword [ebp - 0x1a0], 1
jmp 0x10049e98
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1a0], eax
jge 0x10049eaf
mov dword [ebp - 0x1f4], 1
jmp 0x10049eb6
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1f4]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x10049ed1
mov dword [ebp - 0x1a8], 1
jmp 0x10049ed8
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x1a8], eax
jg 0x10049eef
mov dword [ebp - 0x214], 1
jmp 0x10049ef6
and dword [ebp - 0x214], 0
mov esi, dword [ebp - 0x2c]
imul esi, dword [ebp - 0x214]
push 2
lea ecx, [ebp - 0x320]
call fcn.10028177
cmp esi, dword [eax]
jle 0x10049f1d
mov dword [ebp - 0x1b0], 1
jmp 0x10049f24
and dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 1
jb 0x1004a0bb
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x204], 1
mov dword [ebp - 0x1c0], 0xffffffff
mov dword [ebp - 0x70], 0
jmp 0x10049f5f
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10049f75
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x37c], 0
jmp 0x10049f58
mov dword [ebp - 0x54], 0xfffffffe
jmp 0x10049f85
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xfffffff3
jg 0x10049fa1
mov byte [ebp - 0x4c], 0
movzx eax, byte [ebp - 0x4c]
test eax, eax
je 0x10049f9f
push 0
call dword [sym.imp.USER32.dll_RegisterClassA]
jmp 0x10049f7e
mov dword [ebp - 0x48], 0
jmp 0x10049fb1
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 9
jne 0x1004a0b6
mov dword [ebp - 0x1e4], 0xa7b48fe2
mov dword [ebp - 0x28c], 7
cmp dword [ebp - 0x204], 0x81cd
jge 0x10049fe7
mov dword [ebp - 0x1fc], 1
jmp 0x10049fee
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x224]
imul eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0xbc]
je 0x1004a00f
mov dword [ebp - 0x1b8], 1
jmp 0x1004a016
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x224]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c0], eax
mov esi, dword [ebp - 0x1c0]
push 2
lea ecx, [ebp - 0x320]
call fcn.10028177
cmp esi, dword [eax]
jle 0x1004a051
mov dword [ebp - 0x1c8], 1
jmp 0x1004a058
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x204]
cmp dword [ebp - 0x1c8], eax
jle 0x1004a072
mov dword [ebp - 0x21c], 1
jmp 0x1004a079
and dword [ebp - 0x21c], 0
cmp dword [ebp - 0x21c], 0x6eb81f94
jge 0x1004a091
mov dword [ebp - 0x1d0], 1
jmp 0x1004a098
and dword [ebp - 0x1d0], 0
imul eax, dword [ebp - 0x1d0], 0
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x28c], eax
jmp 0x10049faa
jmp 0x1004a163
mov dword [ebp - 0x98], 0
jmp 0x1004a0d4
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 3
jge 0x1004a0f0
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x350], 0xffffffff
jmp 0x1004a0c7
mov dword [ebp - 0x18], 0
jmp 0x1004a100
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1004a13b
mov dword [ebp - 0x2c0], 0xffffffff
mov eax, dword [ebp - 0x2c0]
mov dword [ebp - 0x48], eax
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x1004a139
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
jmp 0x1004a0f9
mov dword [ebp - 0x18], 0
jmp 0x1004a14b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xf
je 0x1004a163
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x350], 0x609e00c2
jmp 0x1004a144
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x320]
call fcn.1002815b
push 0
lea ecx, [ebp - 0x23c]
call fcn.10028177
cmp dword [eax], 0
jae 0x1004a190
mov dword [ebp - 0x1d8], 1
jmp 0x1004a197
and dword [ebp - 0x1d8], 0
push 1
lea ecx, [ebp - 0x260]
call fcn.10028177
mov ecx, dword [ebp - 0x1d8]
mov dword [eax], ecx
push 1
lea ecx, [ebp - 0x260]
call fcn.10028177
push 0
lea ecx, [ebp - 0x23c]
call fcn.10028177
mov esi, eax
push 0
lea ecx, [ebp - 0x23c]
call fcn.10028177
mov ecx, dword [esi]
cmp ecx, dword [eax]
jle 0x1004a1e7
mov dword [ebp - 0x1e8], 1
jmp 0x1004a1ee
and dword [ebp - 0x1e8], 0
mov esi, dword [ebp - 0x74]
add esi, dword [ebp - 0x1e8]
imul esi, dword [ebp - 0x74]
push 1
lea ecx, [ebp - 0x260]
call fcn.10028177
cmp esi, dword [eax]
jge 0x1004a218
mov dword [ebp - 0x178], 1
jmp 0x1004a21f
and dword [ebp - 0x178], 0
push 0
lea ecx, [ebp - 0x23c]
call fcn.10028177
mov eax, dword [eax]
cmp eax, dword [ebp - 0x178]
jle 0x1004a242
mov dword [ebp - 0x17c], 1
jmp 0x1004a249
and dword [ebp - 0x17c], 0
push 1
lea ecx, [ebp - 0x260]
call fcn.10028177
mov ecx, dword [ebp - 0x17c]
cmp ecx, dword [eax]
jle 0x1004a26c
mov dword [ebp - 0xc4], 1
jmp 0x1004a273
and dword [ebp - 0xc4], 0
push 0
lea ecx, [ebp - 0x260]
call fcn.10028177
mov ecx, dword [ebp - 0xc4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xc4], eax
jne 0x1004a29f
mov dword [ebp - 0xe4], 1
jmp 0x1004a2a6
and dword [ebp - 0xe4], 0
push 0
lea ecx, [ebp - 0x23c]
call fcn.10028177
mov ecx, dword [ebp - 0xe4]
sub ecx, dword [ebp - 0x294]
cmp dword [eax], ecx
jne 0x1004a2cf
mov dword [ebp - 0xe8], 1
jmp 0x1004a2d6
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xe8], eax
jle 0x1004a2ed
mov dword [ebp - 0xf0], 1
jmp 0x1004a2f4
and dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0xfffffff7
jne 0x1004a309
mov dword [ebp - 0x2b8], 1
jmp 0x1004a310
and dword [ebp - 0x2b8], 0
mov eax, 0x6eb2
dec eax
cmp eax, 0x801465ee
jb 0x1004a329
mov dword [ebp - 0xf8], 1
jmp 0x1004a330
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x29c], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x260]
call fcn.1002815b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x23c]
call fcn.1002815b
push 1
lea eax, [ebp - 0x388]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.10027e0a
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x35c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x35c]
lea edi, [ebp - 0x2dc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x7c], 0
jmp 0x1004a3a0
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1004a3b6
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x2d0], 1
jmp 0x1004a399
mov dword [ebp - 0x5c], 0
jmp 0x1004a3c6
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xb
jg 0x1004a7c1
mov dword [ebp - 0x6c], 0x78f1e0c8
mov dword [ebp - 0x28], 0xfffffffa
mov dword [ebp - 0x140], 0xef31
mov dword [ebp - 0x84], 0
jmp 0x1004a401
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1004a41d
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0xb4], 0x67a876e6
jmp 0x1004a3f4
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xb4], 0
jmp 0x1004a44b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb4]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0xb4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb4], 0xffffffeb
jg 0x1004a786
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0x24], 0xaf7806aa
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb4]
mov dword [ebp - 0xcc], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp eax, dword [ebp - 0xcc]
jg 0x1004a4a4
mov dword [ebp - 0x120], 1
jmp 0x1004a4ab
and dword [ebp - 0x120], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x6c]
cmp dword [ebp + eax - 0xb4], ecx
je 0x1004a4c9
mov dword [ebp - 0x100], 1
jmp 0x1004a4d0
and dword [ebp - 0x100], 0
cmp dword [ebp - 0x100], 0xc1da
je 0x1004a4e8
mov dword [ebp - 0x108], 1
jmp 0x1004a4ef
and dword [ebp - 0x108], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x108]
add ecx, dword [ebp + eax - 0xb4]
mov dword [ebp - 0x110], ecx
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x110]
mov dword [ebp + eax - 0x2d0], ecx
mov eax, dword [ebp - 0x110]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
je 0x1004a53c
cmp dword [ebp - 0x24], 0
je 0x1004a53c
mov dword [ebp - 0x118], 1
jmp 0x1004a543
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x118]
neg eax
cmp dword [ebp - 0x120], eax
je 0x1004a55f
mov dword [ebp - 0x128], 1
jmp 0x1004a566
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x5c]
neg eax
cmp eax, dword [ebp - 0x128]
je 0x1004a57f
mov dword [ebp - 0x130], 1
jmp 0x1004a586
and dword [ebp - 0x130], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xb4]
cmp dword [ebp - 0x130], eax
jl 0x1004a5a8
xor eax, eax
jne 0x1004a5a8
and dword [ebp - 0x138], 0
jmp 0x1004a5b2
mov dword [ebp - 0x138], 1
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0xb4]
add eax, dword [ebp - 0x138]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 2
jmp 0x1004a5d7
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x1004a781
mov dword [ebp - 0xd4], 0x8c74c3ee
mov dword [ebp - 0x2a4], 0xffffffff
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x2d0], 0
je 0x1004a607
jmp 0x1004a781
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb4], 0
je 0x1004a680
mov dword [ebp - 0x6c], 0
jmp 0x1004a627
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jg 0x1004a658
mov byte [ebp - 0x4a], 0
movzx eax, byte [ebp - 0x4a]
test eax, eax
je 0x1004a656
push 0
push 0x1220
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x1004a620
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x1004a67b
push 0x2478
push 0x22f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x1004a77c
mov dword [ebp - 0x2bc], 0xfffffff7
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x140], eax
jg 0x1004a6ab
mov dword [ebp - 0x148], 1
jmp 0x1004a6b2
and dword [ebp - 0x148], 0
cmp dword [ebp - 0x24], 0
jne 0x1004a6d1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xb4], 0
jne 0x1004a6d1
and dword [ebp - 0x150], 0
jmp 0x1004a6db
mov dword [ebp - 0x150], 1
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
cmp eax, dword [ebp - 0x150]
jge 0x1004a701
mov dword [ebp - 0x158], 1
jmp 0x1004a708
and dword [ebp - 0x158], 0
cmp dword [ebp - 0x158], 0xfffffff9
je 0x1004a71d
mov dword [ebp - 0x160], 1
jmp 0x1004a724
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0xcc]
cmp dword [ebp - 0x160], eax
je 0x1004a744
cmp dword [ebp - 0xd4], 0
jne 0x1004a744
and dword [ebp - 0x168], 0
jmp 0x1004a74e
mov dword [ebp - 0x168], 1
cmp dword [ebp - 0x168], 0xffffffff
jae 0x1004a763
mov dword [ebp - 0x170], 1
jmp 0x1004a76a
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x2bc]
add eax, dword [ebp - 0x170]
mov dword [ebp - 0x2a4], eax
jmp 0x1004a5d0
jmp 0x1004a430
mov dword [ebp - 0x28], 2
jmp 0x1004a796
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1004a7bc
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x2d0], 0
je 0x1004a7ab
jmp 0x1004a7bc
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x2d0], 0
je 0x1004a7ba
jmp 0x1004a78f
jmp 0x1004a78f
jmp 0x1004a3bf
cmp dword [ebp - 0x2dc], 0
je 0x1004a7de
push 1
push dword [ebp - 0x2d4]
push dword [ebp - 0x2d8]
call dword [ebp - 0x2dc]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret