Function at 0x10015944
Capabilities:
Check os version
Delete directory
Delete file
Get geographical location
Get thread local storage value
Log keystrokes via polling
Query or enumerate registry key
Read .ini file
Resume thread

Disassembly:
mov eax, 0x10072686
call fcn.10071b18
sub esp, 0xc9c
push ebx
push esi
push edi
mov dword [ebp - 0x34], 0x2162
cmp dword [ebp - 0x34], 0x1193
push 0
mov byte [ebp - 0x61], dl
mov dword [ebp - 0x60], ecx
pop ebx
jge 0x100159fc
push 0x1dfe5c
push 0xffffffffffffffff
push 0x10e1ae48
mov esi, ebx
call fcn.1002a7c8
add esp, 0xc
push 2
pop ecx
mov edi, ebx
test esi, esi
jle 0x100159a6
mov eax, ecx
cdq
idiv dword [edi*4 + 0x10e1ab70]
test edx, edx
je 0x100159ae
inc edi
cmp edi, esi
jl 0x10015993
mov dword [esi*4 + 0x10e1ab70], ecx
inc esi
inc ecx
cmp ecx, 0xb5
jl 0x1001598d
lea eax, [ebp - 0x36c]
push eax
lea eax, [ebp - 0x338]
push eax
push 0x1000ddc8
call fcn.10058fc2
mov ecx, dword [ebp - 0x338]
add esp, 0xc
mov edx, dword [ebp - 0x36c]
test ecx, ecx
jne 0x100159e6
test edx, edx
je 0x100159fc
push ebx
call fcn.10015478
pop ecx
push eax
push 0x1000ddd0
call fcn.10057526
pop ecx
pop ecx
jmp 0x100159b7
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x34], 0x1443
cmp dword [ebp - 0x34], 0xdfd
jge 0x10015b4a
lea eax, [ebp - 0xd4]
push eax
push 0x1000ddc4
call fcn.10058fc2
pop ecx
pop ecx
jmp 0x10015b35
dec eax
mov dword [ebp - 0xd4], eax
lea eax, [ebp - 0xa0]
push eax
push 0x1000ddc4
call fcn.10058fc2
pop ecx
pop ecx
push dword [ebp - 0xa0]
lea ecx, [ebp - 0x2f8]
call fcn.10010e51
mov dword [ebp - 4], ebx
mov edi, ebx
cmp dword [ebp - 0xa0], 0
jle 0x10015a89
mov esi, dword [ebp - 0x2f8]
push 4
pop ebx
push esi
push 0x1000ddc4
call fcn.10058fc2
inc edi
add esi, ebx
pop ecx
pop ecx
cmp edi, dword [ebp - 0xa0]
jl 0x10015a71
mov ebx, dword [ebp - 0x2f8]
lea ecx, [ebp - 0x35c]
call fcn.10022d65
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0xa0]
test ecx, ecx
jle 0x10015b06
mov esi, eax
mov dword [ebp - 0x28], eax
mov edi, esi
cmp esi, ecx
jge 0x10015af6
mov esi, dword [ebp - 0x2f8]
mov eax, dword [esi + edi*4]
sub eax, dword [ebx]
mov dword [ebp - 0x370], eax
movzx eax, byte [0x118c2bd2]
push eax
lea eax, [ebp - 0x370]
push eax
push ecx
lea eax, [ebp - 0x95c]
push eax
lea ecx, [ebp - 0x35c]
call fcn.100240d8
mov ecx, dword [ebp - 0xa0]
inc edi
cmp edi, ecx
jl 0x10015abb
mov esi, dword [ebp - 0x28]
inc esi
push 4
pop eax
add ebx, eax
mov dword [ebp - 0x28], esi
lea eax, [esi - 1]
cmp eax, ecx
jl 0x10015aaf
push dword [ebp - 0x358]
push 0x1000ddd4
call fcn.10057526
pop ecx
pop ecx
lea ecx, [ebp - 0x35c]
call fcn.1001ca97
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f8]
call fcn.1001142d
push 0
pop ebx
mov eax, dword [ebp - 0xd4]
test eax, eax
jne 0x10015a2f
dec eax
mov dword [ebp - 0xd4], eax
xor ecx, ecx
mov byte [ebp - 0x35], cl
cmp byte [ebp - 0x35], cl
je 0x10015b67
push ecx
push 0x1908
push 0x1195
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor ecx, ecx
push 0x10
pop ebx
mov dword [ebp - 0x24], ebx
jmp 0x10015b90
mov dword [ebp - 0x14], ecx
jmp 0x10015b81
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x460], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10015b74
inc dword [ebp - 0x45c]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe9
jge 0x10015b6f
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x10], 0x14
jmp 0x10015c1d
mov dword [ebp - 0x14], 0x29a3df60
mov dword [ebp - 0x14], ecx
jmp 0x10015bbf
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x8e8], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10015bb2
mov dword [ebp - 0x14], 0xffffffed
jmp 0x10015c14
mov dword [ebp - 0x2c], 2
cmp dword [ebp - 0x10], 0xffffffff
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x2c], ecx
jmp 0x10015c0b
mov dword [ebp - 0x20], 0xf82d83d7
mov dword [ebp - 0x20], ecx
jmp 0x10015c02
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x8e8], 0xfffffff6
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10015bf1
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x38
jge 0x10015be5
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 8
jge 0x10015bce
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xffffffec
jge 0x10015ba6
mov dword [ebp - 0x24], 6
mov byte [ebp - 0x35], cl
cmp byte [ebp - 0x35], 0
je 0x10015c46
push ecx
push 0x1908
push 0x1195
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor ecx, ecx
mov esi, dword [sym.imp.USER32.dll_ClientToScreen]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], 0xffffffe9
mov ebx, dword [sym.imp.GDI32.dll_SetROP2]
jl 0x10015eba
xor edi, edi
inc edi
mov dword [ebp - 0x20], 0x862fd41e
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x34], 0xb64d07dd
mov dword [ebp - 0x4c], 0x2e255bb5
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 3
jg 0x10015d14
xor edx, edx
inc edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x14], 0x4c8f
mov dword [ebp - 0x4c], 0xda3bb1d4
mov dword [ebp - 0x4c], ecx
mov byte [ebp - 0x35], cl
cmp byte [ebp - 0x35], 0
je 0x10015cbf
push 0x266e
push ecx
push ecx
push 0x24e7
push ecx
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
xor edx, edx
xor ecx, ecx
inc edx
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], 0xffffffff
cmp dword [ebp - 0x20], ecx
jne 0x10015cf6
mov dword [ebp - 0x58], ecx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jle 0x10015ce3
mov eax, dword [ebp - 0x58]
cmp dword [ebp - 0x14], ecx
jle 0x10015cef
mov eax, ecx
cmp dword [ebp - 0x30], ecx
je 0x10015cf1
mov eax, edx
cmp eax, dword [ebp - 0x34]
jl 0x10015cf8
mov ecx, edx
mov eax, dword [ebp - 0x30]
imul eax, ecx
push 0
pop ecx
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10015c8a
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x108]
call fcn.10010e51
xor edx, edx
mov dword [ebp - 0x6a0], edx
mov dword [ebp - 0x69c], edx
mov dword [ebp - 0x698], edx
mov dword [ebp - 0x694], edx
mov dword [ebp - 0x10], edx
jmp 0x10015d50
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1bc], 0x64a6847d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10015d3f
mov dword [ebp - 0x10], edx
jmp 0x10015d6e
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x108]
mov dword [eax + ecx*4], 0xfb871c7b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10015d5b
mov byte [ebp - 0x35], dl
cmp byte [ebp - 0x35], dl
je 0x10015d89
push 0x1d6b
push 0x232c
call ebx
xor edx, edx
mov eax, dword [ebp - 0x108]
mov dword [eax], edx
mov byte [ebp - 0x35], dl
cmp byte [ebp - 0x35], 0
je 0x10015da4
push edx
push 0x23e7
call esi
xor edx, edx
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 2
jg 0x10015e6b
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1bc]
sub eax, 0x1ddbfe25
je 0x10015df9
mov eax, dword [ebp - 0x1b4]
mov eax, dword [ebp - 0x108]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1bc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x69c]
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x108]
setne cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [eax]
setge dl
mov eax, dword [ebp + eax*4 - 0x1bc]
mov ecx, dword [ebp - 0x10]
add ecx, edx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x10015dce
xor edx, edx
mov eax, dword [ebp - 0x108]
inc dword [eax]
cmp dword [eax], 2
jle 0x10015d91
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x108]
call fcn.1001142d
xor ecx, ecx
mov dword [ebp - 0x14], ecx
jmp 0x10015e9f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x470], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10015e92
inc dword [ebp - 0x46c]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe9
jge 0x10015c62
jmp 0x10015ebd
xor edi, edi
inc edi
push edi
lea ecx, [ebp - 0x118]
call fcn.10010e51
xor edx, edx
mov dword [ebp - 0x680], edx
mov dword [ebp - 0x67c], edx
mov dword [ebp - 0x678], edx
mov dword [ebp - 0x674], edx
mov dword [ebp - 0x10], edx
jmp 0x10015ef9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1cc], 0x64a6847d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10015ee8
mov dword [ebp - 0x10], edx
jmp 0x10015f17
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x118]
mov dword [eax + ecx*4], 0xfb871c7b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10015f04
mov byte [ebp - 0x35], dl
cmp byte [ebp - 0x35], dl
je 0x10015f30
push 0x1d6b
push 0x232c
call ebx
mov eax, dword [ebp - 0x118]
xor ebx, ebx
mov dword [eax], ebx
mov byte [ebp - 0x35], bl
cmp byte [ebp - 0x35], bl
je 0x10015f4a
push ebx
push 0x23e7
call esi
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1cc]
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x10], ebx
jmp 0x10015ffa
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1cc]
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1cc]
sub eax, 0x1ddbfe25
je 0x10015f94
mov eax, dword [ebp - 0x1c4]
mov eax, dword [ebp - 0x118]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1cc]
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1cc]
mov eax, dword [ebp - 0x118]
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x1cc]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x67c]
cmp eax, 0xfffffff6
mov eax, dword [ebp - 0x118]
setne cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [eax]
setge dl
mov eax, dword [ebp + eax*4 - 0x1cc]
mov ecx, dword [ebp - 0x10]
add ecx, edx
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x34], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
mov eax, dword [ebp - 0x118]
jle 0x10015f6f
inc dword [eax]
cmp dword [eax], 2
jle 0x10015f3a
lea ecx, [ebp - 0x118]
call fcn.1001142d
push 3
pop edi
mov dword [ebp - 0x24], 6
lea ecx, [ebp - 0x304]
push edi
call fcn.10010e51
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x28], 0x457a23a
mov dword [ebp - 0x10], ebx
jmp 0x10016055
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x304]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10016045
push 2
mov dword [ebp - 0x10], ebx
pop esi
jmp 0x10016073
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x480], 0xefc16765
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10016062
mov byte [ebp - 0x35], bl
cmp byte [ebp - 0x35], bl
je 0x10016098
push 0x127f
push ebx
push ebx
push 0x146e
push ebx
push 0x18cd
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [ebp - 0x18], ebx
jmp 0x10016113
xor edx, edx
inc edx
mov dword [ebp - 0x58], edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x304]
cmp dword [eax + ecx*4], ebx
je 0x100160bf
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
jmp 0x100160c1
mov edx, ebx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x304]
mov eax, dword [eax + ecx*4]
imul eax, edx
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x47c], eax
test eax, eax
jne 0x100160ec
cmp dword [ebp - 0x47c], ebx
jne 0x100160ec
mov eax, ebx
jmp 0x100160ef
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor edx, edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x304]
cmp dword [eax + ecx*4], 0x8fcfed58
sete dl
sub edx, dword [ebp - 0x58]
mov dword [ebp - 0x58], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jle 0x1001609d
lea ecx, [ebp - 0x304]
call fcn.1001142d
push 4
pop eax
push eax
lea ecx, [ebp - 0x254]
call fcn.10010e51
mov dword [ebp - 4], edi
xor eax, eax
mov ecx, 0xbdd7
inc eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x3a8], ecx
mov dword [ebp - 0x3a4], ecx
mov dword [ebp - 0x3a0], ecx
mov dword [ebp - 0x39c], ecx
lea ecx, [ebp - 0x420]
mov dword [ebp - 0x14], 0xc3997b09
push eax
call fcn.10010e51
push 4
pop edx
mov byte [ebp - 4], dl
mov dword [ebp - 0x10], ebx
jmp 0x10016189
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x254]
mov dword [eax + ecx*4], 0x3342
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10016176
xor edx, edx
mov dword [ebp - 0x10], ebx
inc edx
jmp 0x100161a9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x420]
mov dword [eax + ecx*4], 0x37b3
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10016196
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x100161cb
mov byte [ebp - 0x35], bl
cmp byte [ebp - 0x35], 0
je 0x100161c6
push ebx
call dword [sym.imp.COMDLG32.dll_FindTextW]
dec dword [ebp - 0x18]
jns 0x100161b6
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x1001634b
mov edi, dword [ebp - 0x254]
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x10], 0xfffffff8
xor ecx, ecx
mov dword [ebp - 0x34], 0xfffffffe
mov edx, dword [ebp - 0x18]
mov esi, dword [edi + 4]
cmp esi, 0x4b0b4ef6
mov eax, dword [ebp - 0x254]
setle cl
cmp dword [eax + edx*4], ecx
jge 0x10016232
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x254]
inc edx
cmp dword [eax + ecx*4], edx
jge 0x10016225
mov eax, edx
cmp dword [ebp - 0x39c], ebx
jne 0x10016227
mov eax, ebx
mov esi, dword [edi + 4]
cmp eax, esi
jge 0x10016235
mov ecx, ebx
jmp 0x10016237
xor edx, edx
inc edx
mov ecx, edx
xor eax, eax
test ecx, ecx
setne al
inc eax
jne 0x10016247
mov ecx, ebx
test esi, esi
je 0x10016249
mov ecx, edx
xor eax, eax
cmp ecx, 0x7dcd
sete al
xor ecx, ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x8f8f
setg cl
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 3
jg 0x1001633c
mov edi, dword [ebp - 0x254]
push 2
lea ecx, [ebp - 0x4c0]
call fcn.10010e51
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x100162ac
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c0]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10016299
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov esi, dword [ebp - 0x18]
inc ecx
mov eax, dword [ebp - 0x420]
xor ebx, ebx
mov dword [eax], ecx
mov ecx, dword [ebp - 0x10]
add ecx, dword [edi + 0xc]
mov eax, dword [ebp - 0x254]
cmp dword [eax + edx*4], ecx
setle bl
xor ecx, ecx
imul ebx, dword [eax + esi*4]
mov eax, dword [ebp - 0x4c0]
mov dword [eax], ebx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x3a8]
mov eax, dword [ebp - 0x420]
mov edx, dword [eax]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setg cl
xor eax, eax
sub ecx, edx
cmp ecx, edx
lea ecx, [ebp - 0x4c0]
setle al
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
call fcn.1001142d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
push 0
pop ebx
jle 0x10016280
mov edi, dword [ebp - 0x5c]
dec dword [ebp - 0x18]
jns 0x100161e0
push 3
pop edi
push 2
pop esi
lea ecx, [ebp - 0x420]
call fcn.1001142d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x254]
call fcn.1001142d
mov byte [ebp - 0x19], bl
mov dword [ebp - 0x34], 0xe08974b6
mov dword [ebp - 0x5c], 7
mov dword [ebp - 0x14], ebx
jmp 0x1001638c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x158], 0x477862fd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001637b
mov dword [ebp - 0x154], ebx
jmp 0x100163b0
mov byte [ebp - 0x35], bl
cmp byte [ebp - 0x35], 0
je 0x100163aa
push ebx
push ebx
call dword [sym.imp.USER32.dll_CopyRect]
inc dword [ebp - 0x154]
cmp dword [ebp - 0x154], 0xc
jne 0x10016399
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x5c], eax
cmp byte [ebp - 0x19], 0
je 0x100163dc
push ebx
push 0x1908
push 0x1195
call dword [sym.imp.KERNEL32.dll_GetCPInfoExW]
xor ecx, ecx
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x100163fc
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x84], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100163eb
mov dword [ebp - 0x2c], 5
jmp 0x10016560
mov dword [ebp - 0x18], 0x3c69aed2
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x58], 0xfffffff6
mov dword [ebp - 0x34], 9
mov dword [ebp - 0x18], ebx
jmp 0x10016517
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001644e
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x384], 0xdf8e3bf1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001643d
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jg 0x100164ea
mov eax, dword [ebp - 0x18]
mov ecx, 0xe80d68f9
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
mov eax, dword [ebp - 0x18]
setne cl
add ecx, dword [ebp + eax*4 - 0x84]
add ecx, dword [ebp - 0x84]
je 0x100164b1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x84]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setg dl
cmp edx, 7
sbb ecx, ecx
inc ecx
mov dword [ebp + eax*4 - 0x84], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001645f
xor ecx, ecx
inc ecx
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jl 0x10016514
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x84]
mov dword [ebp - 0x384], eax
mov dword [ebp - 0x28], 0xfffffffa
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x58], eax
dec dword [ebp - 0x10]
jns 0x100164f2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x10016431
mov eax, dword [ebp - 0x84]
xor ecx, ecx
cmp eax, 0xfffffff9
push 1
setge cl
xor edx, edx
mov dword [ebp - 0x58], ecx
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
cmp ecx, 0x6082f4e5
pop ecx
setg al
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 0x16
jg 0x1001640d
mov dword [ebp - 0x24], 0x10
jmp 0x1001698c
push 4
pop edi
push edi
lea ecx, [ebp - 0x4d8]
call fcn.10010e51
xor eax, eax
mov dword [ebp - 4], 5
inc eax
lea ecx, [ebp - 0x324]
push eax
call fcn.10010e51
mov byte [ebp - 4], 6
mov dword [ebp - 0x4c], 0xcb8ce3e6
mov dword [ebp - 0x34], 0x21ea
cmp dword [ebp - 0x34], 0x681
jge 0x10016806
lea eax, [ebp - 0xa8]
push eax
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0xd8]
push eax
push 0x1000dddc
call fcn.10058fc2
add esp, 0x10
lea ecx, [ebp - 0x610]
push dword [ebp - 0xa8]
call fcn.10010e51
mov byte [ebp - 4], 7
mov edi, ebx
cmp dword [ebp - 0xa8], 0
jle 0x1001661d
mov esi, dword [ebp - 0x610]
push esi
push 0x1000ddc4
call fcn.10058fc2
pop ecx
pop ecx
push 4
pop eax
inc edi
add esi, eax
cmp edi, dword [ebp - 0xa8]
jl 0x10016602
mov eax, dword [ebp - 0xd8]
lea ecx, [ebp - 0x314]
inc eax
push eax
call fcn.10022cc3
mov byte [ebp - 4], 8
mov esi, ebx
cmp dword [ebp - 0x1f0], 0
jle 0x10016695
lea eax, [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x198]
push eax
push 0x1000dde8
call fcn.10058fc2
imul ecx, dword [ebp - 0x198], 0xc
lea eax, [ebp - 0x1e8]
add esp, 0xc
add ecx, dword [ebp - 0x314]
push eax
call fcn.10022d12
imul ecx, dword [ebp - 0x1e8], 0xc
lea eax, [ebp - 0x198]
push eax
add ecx, dword [ebp - 0x314]
call fcn.10022d12
inc esi
cmp esi, dword [ebp - 0x1f0]
jl 0x1001663f
mov esi, dword [ebp - 0xd8]
lea eax, [ebp - 0x91]
push ecx
push eax
inc esi
mov byte [ebp - 0x91], bl
push esi
lea ecx, [ebp - 0x6c0]
mov edi, ebx
call fcn.10022ffb
push esi
lea ecx, [ebp - 0x6c0]
mov byte [ebp - 4], 9
call fcn.10022f76
xor ecx, ecx
mov byte [ebp - 4], 0xa
mov eax, ecx
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0xa8], eax
jle 0x10016756
mov dword [ebp - 0x1a8], ecx
mov dword [ebp - 0xfc], ecx
lea ecx, [ebp - 0xfc]
push ecx
lea ecx, [ebp - 0x1a8]
push ecx
lea ecx, [ebp - 0x6c0]
push ecx
mov ecx, dword [ebp - 0x610]
mov edx, dword [ecx + eax*4]
lea ecx, [ebp - 0x314]
call fcn.10015500
mov esi, dword [ebp - 0x1a8]
add esp, 0xc
cmp ebx, esi
mov eax, esi
cmovg eax, ebx
mov ebx, eax
mov eax, dword [ebp - 0xfc]
cdq
sub eax, edx
mov ecx, eax
lea eax, [esi - 1]
imul eax, esi
sar ecx, 1
push 0
mov dword [ebp - 0xfc], ecx
cdq
sub eax, edx
sar eax, 1
sub eax, ecx
add edi, eax
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
pop ecx
cmp eax, dword [ebp - 0xa8]
jl 0x100166db
xor eax, eax
mov esi, ecx
inc eax
mov dword [ebp - 0x58], esi
mov edx, eax
mov dword [ebp - 0x28], edx
cmp dword [ebp - 0xd8], eax
jl 0x100167c5
mov eax, dword [ebp - 0x314]
add eax, 0xc
mov dword [ebp - 0x30], eax
push edx
lea eax, [ebp - 0x944]
push eax
lea ecx, [ebp - 0x6c0]
call fcn.10022c6a
xor ecx, ecx
mov esi, dword [eax]
lea edx, [ecx + 1]
mov ecx, dword [eax + 4]
shl edx, cl
mov ecx, dword [ebp - 0x30]
test dword [esi], edx
mov esi, dword [ebp - 0x58]
jne 0x100167b0
mov eax, dword [ecx + 4]
add edi, ebx
sub eax, dword [ecx]
sar eax, 2
add esi, eax
inc ebx
mov dword [ebp - 0x58], esi
mov edx, dword [ebp - 0x28]
add ecx, 0xc
inc edx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x28], edx
cmp edx, dword [ebp - 0xd8]
jle 0x10016777
mov eax, esi
cdq
sub eax, edx
sar eax, 1
neg eax
add edi, eax
push edi
push 0x1000ddd4
call fcn.10057526
pop ecx
pop ecx
lea ecx, [ebp - 0x6c0]
call fcn.10022c4a
lea ecx, [ebp - 0x314]
call fcn.1002308b
lea ecx, [ebp - 0x610]
call fcn.1001142d
push 2
pop esi
push 4
xor ebx, ebx
pop edi
mov dword [ebp - 0x4c], 8
xor edx, edx
inc edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], 0x71247adf
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x4c], 5
mov dword [ebp - 0x10], ebx
jmp 0x1001683c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x4d8]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10016829
mov dword [ebp - 0x10], ebx
jmp 0x10016859
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x324]
mov dword [eax + ecx*4], 0x2ba39464
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10016846
mov eax, dword [ebp - 0x324]
push 3
pop edi
mov dword [eax], edi
mov dword [ebp - 0x20], 0x609c
mov dword [ebp - 0x14], 0x1da622a1
mov dword [ebp - 0x4c], 0x40ed3c15
mov dword [ebp - 0x28], 0x8e92eda8
mov dword [ebp - 0x14], ebx
jmp 0x1001689b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x964], 0x12d2c87a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001688a
dec dword [ebp - 0x28]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], edi
jg 0x100168de
mov dword [ebp - 0x20], ebx
jmp 0x100168ce
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x324]
mov ecx, dword [ebp - 0x4d8]
mov edx, dword [eax]
mov eax, dword [ecx + esi*4 + 4]
mov dword [ecx + edx*4], eax
xor edx, edx
inc dword [ebp - 0x20]
inc edx
cmp dword [ebp - 0x20], edx
jle 0x100168b0
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x100168ab
push 2
pop esi
mov eax, dword [ebp - 0x324]
dec dword [eax]
jns 0x10016869
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x100168ff
push 0xb1c
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
lea ecx, [ebp - 0x324]
call fcn.1001142d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4d8]
call fcn.1001142d
mov dword [ebp - 0x14], ebx
jmp 0x1001692b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x458], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001691e
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001694d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x6e4], 0xcff0ea75
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1001693c
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jge 0x1001696f
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6e4], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001695d
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10016983
push 0x2403
call dword [sym.imp.USER32.dll_GetKeyState]
inc dword [ebp - 0x454]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe9
jge 0x10016576
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x100169b2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb4], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100169a1
mov dword [ebp - 0x10], ebx
jmp 0x100169cd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x268], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x100169bc
mov ecx, dword [ebp - 0xb4]
xor edx, edx
mov eax, dword [ebp - 0xb4]
cmp ecx, eax
mov ecx, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
setge dl
imul ecx, edx
imul eax, ecx
test eax, eax
jne 0x10016a09
cmp dword [ebp - 0xb0], ebx
jne 0x10016a09
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb4]
xor edx, edx
mov eax, dword [ebp - 0xb0]
mov esi, 0xc1cc
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x264], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 8
setne al
xor edi, edi
inc edi
cmp edi, eax
mov eax, dword [ebp - 0xb4]
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, eax
mov eax, dword [ebp - 0xb4]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xb4]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xffff
sbb eax, eax
neg eax
cmp eax, 0x3936
jl 0x10016b04
xor ecx, ecx
mov dword [ebp - 0x268], 0xffffffff
mov dword [ebp - 0x2c], ebx
inc ecx
jmp 0x10016af1
mov dword [ebp - 0x18], ebx
jmp 0x10016ae9
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x268], ebx
jne 0x10016aee
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x10016ada
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x10016ad5
xor edi, edi
inc edi
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x10016b38
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10016af9
push 0x23d1
push ebx
push 0xe8d
push ebx
push 0x2ec
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringW]
jmp 0x10016af9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xcc], 0xfffffffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10016b27
mov dword [ebp - 0x10], ebx
jmp 0x10016b54
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x298], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10016b43
mov ecx, dword [ebp - 0xcc]
xor edx, edx
mov eax, dword [ebp - 0xcc]
cmp ecx, eax
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xc4]
setge dl
imul ecx, edx
imul eax, ecx
test eax, eax
jne 0x10016b91
cmp dword [ebp - 0xc8], ebx
jne 0x10016b91
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xcc]
xor edx, edx
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc4]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 8
setne al
cmp edi, eax
mov eax, dword [ebp - 0xcc]
sbb edx, edx
xor ecx, ecx
neg edx
imul edx, eax
mov eax, dword [ebp - 0xcc]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp ecx, esi
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0xcc]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 0xffff
sbb eax, eax
neg eax
cmp eax, 0x3936
jl 0x10016cbe
xor ecx, ecx
mov dword [ebp - 0x298], 0xffffffff
mov dword [ebp - 0x2c], ebx
inc ecx
jmp 0x10016c71
mov dword [ebp - 0x18], ebx
jmp 0x10016c69
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x298], ebx
jne 0x10016c6e
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jle 0x10016c5a
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], ecx
jle 0x10016c55
xor edi, edi
inc edi
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x3fc]
mov dword [ebp - 0x2c], ebx
push 3
call fcn.10010e51
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x18], 0x9dada439
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x44], 5
mov dword [ebp - 0x20], 0xa9634d71
mov dword [ebp - 0x34], 0xfffb
mov dword [ebp - 0x4c], 0x2e7dfe98
mov dword [ebp - 0x14], ebx
jmp 0x10016cf4
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x10016c79
push 0x23d1
push ebx
push 0xe8d
push ebx
push 0x2ec
push ebx
call dword [sym.imp.KERNEL32.dll_CompareStringW]
jmp 0x10016c79
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x3fc]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10016ce1
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10016dab
mov esi, dword [ebp - 0x3fc]
push 2
lea ecx, [ebp - 0x414]
call fcn.10010e51
mov dword [ebp - 0x14], ebx
jmp 0x10016d35
cmp dword [ebp - 0x14], 2
jl 0x10016d22
mov dword [ebp - 0x20], 0xe
cmp dword [ebp - 0x20], 0xfffffff7
jg 0x10016e48
mov esi, dword [ebp - 0x3fc]
push 2
lea ecx, [ebp - 0x604]
call fcn.10010e51
mov dword [ebp - 0x5c], 0x97e65fb
mov dword [ebp - 0x28], 6
mov dword [ebp - 0x14], ebx
jmp 0x10016df2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3fc]
call fcn.1001142d
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ebx
jmp 0x10016e7f