Function at 0x100166d5
Capabilities:
Identify system language via api
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006b756
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x138
push ebx
push esi
push edi
mov dword [esp + 0x40], ecx
lea ecx, [esp + 0x54]
mov dword [esp + 0x10], 0xfffffffd
mov dword [esp + 0x20], 0xd8da8e97
mov dword [esp + 0x24], 0xffff
push 3
mov dword [esp + 0x64], edx
call fcn.10014761
xor ebx, ebx
mov dword [esp + 0x14c], ebx
mov dword [esp + 0x20], ebx
jmp 0x10016746
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x54]
mov dword [eax + ecx*4], 0xbefa1e1c
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10016733
mov dword [esp + 0x20], ebx
jmp 0x10016766
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0xf8], 0xffffffff
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x10016753
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x24]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x20]
setne dl
sub eax, dword [esp + 0x20]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x20]
setle cl
xor edx, edx
cmp eax, ecx
setge dl
sub edx, 0xd14c
neg edx
sbb edx, edx
inc edx
add edx, dword [esp + 0x24]
add edx, dword [esp + 0x20]
je 0x1001696e
mov dword [esp + 0x28], 0x97eedf66
mov dword [esp + 0x30], 0x5c8a2db
mov dword [esp + 0x10], ebx
cmp dword [esp + 0x10], 2
jg 0x100169c1
mov edi, dword [esp + 0x54]
push 3
lea ecx, [esp + 0xa8]
call fcn.10014761
mov dword [esp + 0x1c], 5
mov dword [esp + 0x18], ebx
jmp 0x10016828
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xa4]
mov dword [eax + ecx*4], 0xb4b1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10016812
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x54]
mov esi, dword [esp + 0xa4]
mov ecx, dword [eax + ecx*4]
mov eax, dword [esp + 0x20]
add ecx, 0x70a80ab6
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, dword [esi + 4]
imul eax, ecx
test eax, eax
jne 0x10016865
cmp dword [esp + 0x24], ebx
jne 0x10016865
mov edx, ebx
jmp 0x10016868
xor edx, edx
inc edx
mov ecx, dword [esp + 0x10]
xor eax, eax
cmp edx, dword [edi + 4]
push 0
setge al
xor edx, edx
imul eax, dword [edi + 8]
cmp eax, dword [edi + 8]
mov eax, dword [esp + 0x58]
setl dl
sub edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [esp + 0x28]
cmp edx, eax
mov eax, dword [esp + 0x2c]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x28]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x34]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x34]
setle cl
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [esp + 0x28]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [esp + 0x20], edx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
cmp eax, dword [esi + 4]
mov eax, dword [esp + 0x58]
setl cl
cmp ecx, dword [eax + edx*4]
mov eax, dword [esp + 0x24]
pop ecx
setge cl
sub ecx, eax
je 0x10016906
cmp dword [esp + 0x24], ebx
je 0x10016906
xor esi, esi
inc esi
jmp 0x10016908
mov esi, ebx
mov ecx, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x54]
cmp dword [eax + ecx*4], esi
mov ecx, dword [esp + 0x30]
setge dl
xor eax, eax
cmp edx, dword [edi + 4]
setg al
xor edx, edx
cmp eax, 0x718ce682
mov eax, dword [esp + 0xf8]
setg dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
lea ecx, [esp + 0xa4]
setl dl
xor eax, eax
cmp edx, 0x17f4
setge al
cmp dword [esp + 0x28], ebx
mov dword [edi + 8], eax
call fcn.100147e3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x100167f6
jmp 0x100169c1
mov dword [esp + 0x1c], 1
mov dword [esp + 0x24], ebx
jmp 0x100169ba
mov dword [esp + 0x20], 0x18
cmp dword [esp + 0x20], 0xf
jge 0x100169b6
mov esi, dword [esp + 0x54]
mov eax, dword [esp + 0x1c]
xor edx, edx
cmp eax, 0x27fa52e9
mov eax, dword [esp + 0x1c]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
mov dword [esi + 4], ecx
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xf
jl 0x1001698f
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 6
jg 0x1001697c
or dword [esp + 0x14c], 0xffffffff
lea ecx, [esp + 0x54]
call fcn.100147e3
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], 0xffffffff
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x10016a10
push 0x74e
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_Polygon]
cmp dword [esp + 0x18], ebx
jne 0x10016a34
mov eax, dword [esp + 0x18]
add eax, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x30], eax
cmp dword [esp + 0x30], ebx
jne 0x10016a34
mov edx, ebx
jmp 0x10016a37
xor edx, edx
inc edx
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], ebx
jne 0x10016a50
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x30], ebx
je 0x10016a7a
mov dword [esp + 0x1c], 0x50f82bae
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x10016a74
push 0x1418
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
dec dword [esp + 0x1c]
jmp 0x10016a90
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], bl
je 0x10016a90
push ebx
push 0x15ee
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push 0xfffffffffffffffe
pop esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], ebx
jmp 0x10016aad
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x70], 0x13b9
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10016a9d
mov dword [esp + 0x10], ebx
jmp 0x10016ac8
mov eax, dword [esp + 0x10]
cmp dword [esp + eax*4 + 0x70], ebx
jne 0x10016ace
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ebx
jle 0x10016aba
push 3
lea ecx, [esp + 0x68]
call fcn.10014761
mov dword [esp + 0x14c], 1
mov dword [esp + 0x34], ebx
mov dword [esp + 0x10], 0x91a049fe
mov dword [esp + 0x1c], 0x70cd5099
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10016b10
push ebx
push 0x2d3
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
push 9
mov dword [esp + 0x14], 0xfffffff6
pop eax
jmp 0x10016b3f
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], 0x1c
jmp 0x10016b35
cmp dword [esp + 0x1c], ebx
jne 0x10016b3b
dec dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x10016b2b
inc dword [esp + 0x10]
cmp dword [esp + 0x10], eax
jge 0x10016b1d
mov dword [esp + 0x1c], 0x126ff23b
mov dword [esp + 0x10], 0x5043c4ab
mov dword [esp + 0x1c], eax
mov dword [esp + 0x2c], 0xddac0faa
mov dword [esp + 0x18], ebx
jmp 0x10016b77
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x3c], 5
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10016b67
cmp dword [esp + 0x10], ebx
je 0x10016bb0
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x3c], eax
test eax, eax
jne 0x10016bb0
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0xfff8
setne al
add eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10016be8
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [esp + 0x24], 0x8cccddd
lea ecx, [esp + 0xbc]
mov dword [esp + 0x28], 0xffffffff
push 1
call fcn.10014761
mov dword [esp + 0x18], 0xb96ca2c
mov dword [esp + 0x18], ebx
jmp 0x10016c2a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xbc]
mov dword [eax + ecx*4], 0x47dfa860
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10016c14
mov dword [esp + 0x18], ebx
jmp 0x10016c48
mov eax, dword [esp + 0xbc]
mov dword [eax], 0x6da5043c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jle 0x10016c37
lea ecx, [esp + 0xbc]
call fcn.100147e3
push dword [esp + 0x40]
movdqa xmm0, xmmword [0x10007a70]
lea eax, [esp + 0x12c]
push eax
lea eax, [esp + 0x120]
mov dword [esp + 0x24], 0xfffffff7
push eax
push ebx
lea ecx, [esp + 0x84]
mov dword [esp + 0x84], ebx
movdqu xmmword [esp + 0x128], xmm0
mov dword [esp + 0x88], ebx
mov dword [esp + 0x8c], ebx
call fcn.10015e1d
push 1
lea ecx, [esp + 0x90]
mov byte [esp + 0x150], 2
call fcn.10014761
mov dword [esp + 0x1c], 0xfffb
mov dword [esp + 0x18], ebx
jmp 0x10016ce0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x8c]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10016cce
mov eax, dword [esp + 0x8c]
mov dword [eax], ebx
mov dword [esp + 0x20], 0x60b0ceaf
mov dword [esp + 0x10], 0xed45
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10016d18
push ebx
push 0xad4
push ebx
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov dword [esp + 0x20], ebx
jmp 0x10016e12
mov edx, dword [esp + 0x8c]
mov ecx, dword [esp + 0x74]
push 0
mov eax, dword [edx]
cmp dword [ecx + eax*4], ebx
pop eax
sete al
mov dword [esp + 0x1c], eax
mov eax, dword [edx]
mov edx, dword [ecx + eax*4]
xor ecx, ecx
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x1c], eax
setge cl
inc ecx
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x82ca9683
sbb eax, eax
xor ecx, ecx
inc eax
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, edx
mov ecx, 0xa98815cb
setne al
sub eax, 0x6de4f51e
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x20]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x10]
jle 0x10016dc8
mov dword [esp + 0x10], ebx
jmp 0x10016da8
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10016da4
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x10016d8e
mov dword [esp + 0x10], ebx
jmp 0x10016dbf
cmp dword [esp + 0x20], ebx
jne 0x10016dd6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x10016db5
jmp 0x10016dd6
mov dword [esp + 0x1c], 0x311c3fc0
cmp dword [esp + 0x1c], ebx
jne 0x10016e1d
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10016e0e
push 0x25cf
push 0x136e
push 0x73b
push 0x1730
push 0x241c
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jle 0x10016d21
mov eax, dword [esp + 0x8c]
inc dword [eax]
cmp dword [eax], 3
jle 0x10016cf0
lea ecx, [esp + 0x8c]
call fcn.100147e3
lea ecx, [esp + 0x74]
mov byte [esp + 0x14c], 1
call fcn.100147e3
push 0xfffffffffffffffb
pop esi
mov dword [esp + 0x30], ebx
lea ecx, [esp + 0xd4]
mov dword [esp + 0x2c], esi
push 3
call fcn.10014761
push 3
pop edx
mov byte [esp + 0x14c], dl
mov dword [esp + 0x10], 0xfffffff7
mov dword [esp + 0x1c], 0x2e08974b
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], 0x1e3ff14e
mov dword [esp + 0x1c], 0xfffffffe
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x1c], 0x3aaf5bfb
mov dword [esp + 0x1c], 7
mov dword [esp + 0x1c], 0xfc9b996a
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x1c], 1
mov dword [esp + 0x1c], 0xd1883800
mov dword [esp + 0x18], ebx
jmp 0x10016f03
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xd4]
mov dword [eax + ecx*4], 0x77862fd4
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10016eed
mov dword [esp + 0x10], 2
cmp dword [esp + 0x10], ebx
jl 0x10016ffa
push dword [esp + 0x40]
movdqa xmm0, xmmword [0x10007a40]
lea eax, [esp + 0x11c]
push eax
lea eax, [esp + 0x110]
mov dword [esp + 0x24], 0xffffffff
push eax
push ebx
lea ecx, [esp + 0x90]
mov dword [esp + 0x90], ebx
movdqu xmmword [esp + 0x118], xmm0
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
call fcn.10015e1d
push 4
lea ecx, [esp + 0xcc]
mov byte [esp + 0x150], 4
call fcn.10014761
push 4
mov dword [esp + 0x20], 0x3d97
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x10016fa3
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc8]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10016f91
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xd4]
cmp dword [eax + ecx*4], ebx
lea ecx, [esp + 0xc8]
jne 0x10016fe9
inc dword [esp + 0x1c]
call fcn.100147e3
lea ecx, [esp + 0x80]
mov byte [esp + 0x14c], 3
call fcn.100147e3
dec dword [esp + 0x10]
jns 0x10016f1b
jmp 0x10016ffa
call fcn.100147e3
lea ecx, [esp + 0x80]
call fcn.100147e3
mov dword [esp + 0x18], ebx
jmp 0x10017010
mov dword [esp + 0x1c], 8
inc dword [esp + 0x1c]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x10017000
lea ecx, [esp + 0xd4]
mov byte [esp + 0x14c], 1
call fcn.100147e3
mov dword [esp + 0x1c], 0xb34e6d4f
mov dword [esp + 0x18], ebx
jmp 0x10017049
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x38], 0xfffffffa
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10017039
mov dword [esp + 0x38], ebx
jmp 0x1001707c
mov dword [esp + 0x1c], 1
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10017070
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
inc dword [esp + 0x38]
cmp dword [esp + 0x38], 0x1c
jl 0x10017056
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x1001709e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov dword [esp + 0x18], ebx
jmp 0x100170b7
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x64]
mov dword [eax + ecx*4], 0xc69aed23
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x100170a4
push 0xfffffffffffffff9
mov dword [esp + 0x20], 0x2e0cf572
pop esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0xfffffff8
mov dword [esp + 0x10], ebx
jmp 0x100170ee
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x100], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x100170db
mov dword [esp + 0x10], ebx
jmp 0x1001710b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], 0x425a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100170fb
dec dword [esp + 0x18]
cmp dword [esp + 0x44], ebx
je 0x1001713f
mov ecx, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
cmp ecx, eax
setge dl
xor eax, eax
cmp edx, 9
setg al
mov dword [esp + 0x100], eax
xor eax, eax
inc eax
jmp 0x10017141
mov eax, ebx
mov edx, dword [esp + 0x44]
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x18]
cmp edx, eax
sete cl
add ecx, dword [esp + 0x44]
mov dword [esp + 0x1c], ecx
inc dword [esp + 0x30]
mov eax, dword [esp + 0x64]
cmp dword [eax], ebx
jne 0x10017178
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x34], ebx
jne 0x10017178
mov edx, ebx
jmp 0x1001717b
xor edx, edx
inc edx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
imul ecx, dword [esp + 0x2c]
mov dword [esp + 0x28], ecx
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x64]
setl dl
mov dword [esp + 0x1c], edx
mov ecx, dword [esp + 0x1c]
mov eax, dword [eax]
sub ecx, eax
imul ecx, eax
mov dword [esp + 0x24], ecx
cmp dword [esp + 0x24], ebx
je 0x10017627
mov dword [esp + 0x20], ebx
mov dword [esp + 0x34], 0x752570e
mov dword [esp + 0x18], 0xd40a7fc
mov dword [esp + 0x18], ebx
jmp 0x100171ec
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xb0], 0xf572
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x100171d9
mov eax, dword [esp + 0xb8]
mov dword [esp + 0x20], eax
mov dword [esp + 0x20], ebx
jmp 0x1001732a
push 1
lea ecx, [esp + 0x9c]
call fcn.10014761
mov dword [esp + 0x10], 0xb6d0374c
mov dword [esp + 0x10], ebx
jmp 0x10017239
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x98]
mov dword [eax + ecx*4], 0xad86e52d
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10017223
mov dword [esp + 0x10], ebx
jmp 0x10017259
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x134], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x10017246
mov eax, dword [esp + 0x98]
mov dword [eax], ebx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + eax*4 + 0xb0]
mov edx, dword [esp + 0x98]
mov eax, dword [edx]
inc dword [edx]
cmp dword [edx], 2
mov dword [esp + eax*4 + 0xb0], ecx
jle 0x10017269
mov dword [esp + 0x10], ebx
jmp 0x100172d6
mov dword [esp + 0x34], 0x8475761a
mov dword [esp + 0x2c], 0xfffffff6
mov eax, dword [esp + 0x10]
mov eax, dword [esp + eax*4 + 0xb0]
inc eax
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x98]
mov dword [eax], ecx
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100172d2
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jle 0x10017291
mov dword [esp + 0x18], 2
cmp dword [esp + 0x18], ebx
jl 0x1001731a
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100172fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x10017314
push ebx
push 0x2d3
push ebx
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
dec dword [esp + 0x18]
jns 0x100172eb
lea ecx, [esp + 0x98]
call fcn.100147e3
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x10017207
mov dword [esp + 0x34], 0x7d3709e8
mov dword [esp + 0x28], 0x6ff5
mov dword [esp + 0x20], 0xe7ed6f18
mov dword [esp + 0x18], 3
mov dword [esp + 0x24], 0xe9ab5c29
mov dword [esp + 0x10], ebx
jmp 0x10017373
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x4c], 0x9869ec42
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10017363
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x50]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x18]
cmp ecx, eax
setne dl
lea eax, [edx + 0xc608]
cmp dword [esp + 0x28], eax
jne 0x100173bb
cmp dword [esp + 0x50], ebx
jne 0x100173bb
mov ecx, ebx
jmp 0x100173be
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x28]
add eax, ecx
cmp eax, dword [esp + 0x24]
jl 0x100173ee
mov byte [esp + 0x17], bl
cmp byte [esp + 0x17], 0
je 0x100174db
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
jmp 0x100174db
mov dword [esp + 0x24], ebx
jmp 0x100174d0
mov dword [esp + 0x2c], esi
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], ebx
jmp 0x100174c1
push 3
lea ecx, [esp + 0xf0]
call fcn.10014761
push 3
mov dword [esp + 0x14], ebx
pop edx
jmp 0x10017432
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x128], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x10017423
mov dword [esp + 0x10], ebx
jmp 0x10017454
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xec]
mov dword [eax + ecx*4], 4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1001743e
cmp dword [esp + 0x18], ebx
jne 0x10017484
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x2c]
neg eax
sbb eax, eax
neg eax
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xec]
mov dword [eax + 8], ecx
mov dword [esp + 0x128], 4
xor edx, edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0xec]
call fcn.100147e3
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 1
jle 0x1001740c
inc dword [esp + 0x24]
cmp dword [esp + 0x24], 1
jle 0x100173f7
mov eax, dword [esp + 0x28]
xor dl, dl
neg eax
mov ecx, 0x651
mov dword [esp + 0x18], eax
push 0x3f37
call fcn.10017709
xor eax, eax
mov dword [esp + 0x1c], 0xfffc
inc eax
mov dword [esp + 0x2c], eax
pop ecx
mov dword [esp + 0x34], 0x69be541
lea ecx, [esp + 0xe0]
mov dword [esp + 0x2c], 0xca335c22
mov dword [esp + 0x10], eax
push 2
call fcn.10014761
mov dword [esp + 0x34], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x10], ebx
jmp 0x10017546
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x48], 0x52a2c7a2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x10017536
mov dword [esp + 0x10], ebx
jmp 0x10017569
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xe0]
mov dword [eax + ecx*4], 8
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10017553
mov eax, dword [esp + 0x28]
imul eax, dword [esp + 0x18]
test eax, eax
je 0x10017588
cmp dword [esp + 0x2c], ebx
je 0x10017588
xor edx, edx
inc edx
jmp 0x1001758a
mov edx, ebx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x2c]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x2c]
setl dl
sub edx, 0xfffd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
cmp dword [esp + 0x18], ecx
jg 0x100175c2
cmp dword [esp + 0x28], ebx
je 0x100175c5
xor ebx, ebx
inc ebx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0xe0]
cmp dword [eax + 4], 1
sbb ecx, ecx
inc ecx
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [eax + 4]
xor eax, eax
test ecx, ecx
mov dword [esp + 0x48], ecx
lea ecx, [esp + 0xe0]
setne al
neg eax
mov dword [esp + 0x34], eax
call fcn.100147e3
mov ecx, dword [esp + 0x30]
xor edx, edx
mov eax, dword [esp + 0x64]
cmp dword [eax], ecx
mov eax, dword [esp + 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x34], ecx
jmp 0x1001763a
push ebx
push 0x2cdf
push 0x7551
call fcn.10019edf
add esp, 0xc
or dword [esp + 0x14c], 0xffffffff
lea ecx, [esp + 0x64]
call fcn.100147e3
mov eax, dword [esp + 0x60]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x40]
mov edi, edx
mov esi, eax
call fcn.10016663
mov ecx, dword [esp + 0x144]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret