Function at 0x10021e71
Capabilities:
Allocate thread local storage
Get common file path
Get disk information
Get thread local storage value
Identify system language via api
Query environment variable
Start service

Disassembly:
mov eax, 0x10080ee2
call fcn.100803d8
sub esp, 0x26c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x18], 0xffffffff
inc edi
mov dword [ebp - 0xc0], edx
xor ebx, ebx
mov dword [ebp - 0x24], edi
push 2
mov dword [ebp - 0xb0], ecx
mov dword [ebp - 0x10], ebx
pop esi
jmp 0x10021eb5
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x40], 0xdcec3d7d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10021ea7
mov dword [ebp - 0x18], edi
cmp dword [ebp - 0x18], ebx
jl 0x10021f5d
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x10], ebx
jmp 0x10021ee9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x238], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10021edc
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x40], ebx
jne 0x10021f47
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x40]
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x40]
je 0x10021f33
mov eax, edi
cmp dword [ebp - 0x3c], ebx
jne 0x10021f35
mov eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, 7
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x238], 7
dec dword [ebp - 0x18]
jns 0x10021ec6
mov eax, 0xa5d6c05b
lea ecx, [ebp - 0xfc]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], ebx
push edi
call fcn.10011da1
push esi
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], ebx
call fcn.10011da1
mov dword [ebp - 0x18], 0xd14c
mov dword [ebp - 0x28], ebx
jmp 0x10021fba
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xfc]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x10021fab
mov dword [ebp - 0x28], ebx
jmp 0x10021fd7
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0x6f7fbf21
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jl 0x10021fc4
mov dword [ebp - 0x24], ebx
jmp 0x10021ffb
mov dword [ebp - 0x10], ebx
jmp 0x10021ff0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x6c], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x10021fe6
dec dword [ebp - 0x6c]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x10021fe1
mov esi, dword [ebp - 0xa8]
cmp dword [esi], ebx
jne 0x1002204c
mov eax, dword [ebp - 0xfc]
mov edx, dword [eax]
xor eax, eax
test edx, edx
setne al
xor ecx, ecx
add eax, 0xba6b42be
cmp eax, dword [esi + 4]
setge cl
xor eax, eax
add ecx, 7
cmp ecx, edx
setle al
cmp eax, dword [esi + 4]
jne 0x1002203d
mov eax, edi
cmp dword [ebp - 0x20], ebx
jne 0x1002203f
mov eax, ebx
cmp dword [ebp - 0x18], eax
mov eax, ebx
mov esi, dword [ebp - 0xa8]
jge 0x1002204e
mov eax, edi
xor edx, edx
cmp eax, dword [esi]
mov eax, dword [ebp - 0xfc]
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xa8]
call fcn.10012004
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xfc]
call fcn.10012004
push 2
pop edi
mov eax, 0xffff
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x10], eax
push edi
call fcn.10011da1
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x18], 0x2c512dc6
mov dword [ebp - 0x28], ebx
jmp 0x100220c3
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x100220b0
xor esi, esi
mov dword [ebp - 0x28], ebx
inc esi
cmp dword [ebp - 0x28], edi
jge 0x100220df
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x64], esi
inc dword [ebp - 0x28]
jmp 0x100220ce
mov eax, dword [ebp - 0x90]
xor ecx, ecx
mov edx, esi
cmp dword [eax], 5
mov eax, dword [ebp - 0x10]
setg cl
inc dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x90]
cmove edx, ebx
xor ecx, ecx
cmp edx, dword [eax]
setle cl
cmp ecx, 0x61c0f806
jl 0x10022116
mov ecx, esi
cmp dword [ebp - 0x10], ebx
jl 0x10022118
mov ecx, ebx
mov eax, dword [ebp - 0x90]
xor edx, edx
mov dword [eax], ecx
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x20]
add ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov ecx, 0xffff
setg dl
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x60]
cmp ecx, eax
mov eax, dword [ebp - 0x60]
sbb ecx, ecx
inc ecx
imul eax, ecx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x60], ecx
lea ecx, [ebp - 0x90]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x90]
mov dword [eax], ebx
call fcn.10012004
mov dword [ebp - 0x24], 0xffffffff
lea ecx, [ebp - 0x12c]
mov dword [ebp - 0x18], 0x2bbef7d6
push edi
call fcn.10011da1
mov dword [ebp - 0x24], 0xfffa
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], 0x3f045180
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x10], ebx
jmp 0x100221b8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x12c]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100221a8
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
test eax, eax
mov eax, dword [ebp - 0x18]
sets cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x18]
je 0x100221ea
mov eax, esi
cmp dword [ebp - 0x18], ebx
jne 0x100221ec
mov eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x12c]
mov dword [eax], 0x5689
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], 0xd4938140
mov dword [ebp - 0x10], 0x95cc9e52
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x20], 0x2a6add33
mov eax, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x20]
add ecx, 5
add eax, edx
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
lea ecx, [ebp - 0x12c]
setge dl
sub edx, 7
mov dword [ebp - 0x10], edx
call fcn.10012004
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], ebx
jmp 0x10022274
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x210], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10022263
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x100222aa
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x210]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x210], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100222a5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
dec dword [ebp - 0x10]
jns 0x10022282
mov dword [ebp - 0x10], ebx
jmp 0x100222bd
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], 0xdcec3d7d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x100222af
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x18], 0x9d1fe905
mov dword [ebp - 0x1c], 9
jmp 0x10022441
mov dword [ebp - 0x24], 0xad9ddcef
lea ecx, [ebp - 0xbc]
push esi
call fcn.10011da1
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], 0xb11de2a9
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x10], ebx
jmp 0x10022311
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xbc]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10022301
mov eax, dword [ebp - 0x1c]
neg eax
cmp eax, dword [ebp - 0x1c]
je 0x1002237e
push 3
lea ecx, [ebp - 0x1ec]
call fcn.10011da1
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], ebx
jmp 0x10022348
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1ec]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10022339
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x1002236e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10022366
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x10]
dec dword [ebp - 0x10]
jns 0x10022356
lea ecx, [ebp - 0x1ec]
call fcn.10012004
jmp 0x1002242f
mov dword [ebp - 0x10], 0x22a1
xor ebx, ebx
mov dword [ebp - 0x20], 0x5b3d925d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xbc]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x10]
setg bl
xor edx, edx
cmp ebx, eax
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xbc]
cmp edx, dword [eax]
setg cl
xor edx, edx
add ecx, 0x874b
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov ecx, 0xd45b0e82
setge dl
xor eax, eax
add edx, dword [ebp - 0x1c]
cmp edx, 0xffffffff
setg al
sub eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x10]
neg eax
cmp ecx, eax
sbb ecx, ecx
neg ecx
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x24]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
xor ebx, ebx
imul edx, dword [ebp - 0x18]
imul eax, edx, 0xb26d
sub eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x10], ebx
jne 0x1002244d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.10012004
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x1b
jge 0x100222dc
jmp 0x1002245c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.10012004
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x24], esi
cmp dword [ebp - 0x24], ebx
jl 0x10022b37
mov dword [ebp - 0x20], esi
lea ecx, [ebp - 0x190]
mov dword [ebp - 0x18], 6
push 2
call fcn.10011da1
push 2
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x38], 0x82a10aa4
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xe1b1b55
mov dword [ebp - 0x28], 0xfffffffe
mov dword [ebp - 0x20], 0xfffffff8
push 8
pop ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x16c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x38], 0x6bc044b0
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0x51a93826
push eax
call fcn.10011da1
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1f8]
mov dword [ebp - 0x2c], esi
push 3
call fcn.10011da1
push 2
mov dword [ebp - 0x10], 0x9052196d
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x10022513
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x190]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10022500
mov dword [ebp - 0x1c], ebx
jmp 0x1002252c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x16c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002251d
mov dword [ebp - 0x1c], ebx
jmp 0x10022547
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x258], 0x75da2ca3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10022536
mov dword [ebp - 0x1c], ebx
jmp 0x10022564
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1f8]
mov dword [eax + ecx*4], 0x9873
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10022551
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0x6994
setge cl
xor edx, edx
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
imul ecx, ecx, 0xf1f3
cmp eax, ecx
mov eax, dword [ebp - 0x16c]
setge dl
cmp edx, dword [eax]
jge 0x1002259c
mov eax, esi
cmp dword [ebp - 0x38], ebx
jne 0x1002259e
mov eax, ebx
xor ecx, ecx
mov edx, esi
cmp ecx, eax
mov eax, dword [ebp - 0x10]
sbb ecx, ecx
inc ecx
inc dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
cmove edx, ebx
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x190]
setge cl
imul ecx, ecx, 0xf38e
sub ecx, dword [eax + 4]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
lea ecx, [ebp - 0x1f8]
neg eax
sbb eax, eax
inc eax
neg eax
mov dword [ebp - 0x38], eax
call fcn.10012004
lea ecx, [ebp - 0x16c]
call fcn.10012004
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x190]
call fcn.10012004
push 4
pop eax
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x120]
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0xbb086619
push esi
call fcn.10011da1
mov dword [ebp - 0x10], ebx
jmp 0x1002263b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002262c
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002265b
push ebx
push 0x1bc1
push ebx
push 0x1843
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
mov dword [ebp - 0x18], ebx
jmp 0x100227c6
mov dword [ebp - 0x1c], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x28], ebx
mov eax, dword [ebp - 0x20]
cmp eax, esi
mov eax, dword [ebp - 0x1c]
setl cl
neg eax
sbb eax, eax
inc eax
add ecx, eax
cmp ecx, dword [ebp - 0x18]
jle 0x10022748
mov dword [ebp - 0x10], 0x3418
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
je 0x100226ce
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
add edx, dword [ebp - 0x10]
imul edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x120]
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
mov eax, esi
jg 0x100226d0
mov eax, ebx
push 8
pop ecx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
add edx, dword [ebp - 0x20]
mov byte [ebp - 0x11], bl
je 0x1002271d
cmp byte [ebp - 0x11], 0
je 0x1002270b
push ebx
push 0x1750
push 0x1f3
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10022731
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
jmp 0x10022731
cmp byte [ebp - 0x11], 0
je 0x10022731
push ebx
push 0xda4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100227c3
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
jmp 0x100227c3
push 4
pop eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], eax
push 8
mov dword [ebp - 0x10], 0xedb9cc51
pop eax
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10022786
push 0x1ac4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x10], 0xcc425f8e
cmp dword [ebp - 0x10], 0xfc5a51f
jl 0x100227a3
mov edx, ebx
cmp dword [ebp - 0x20], ebx
je 0x100227a5
mov edx, esi
mov eax, dword [ebp - 0x144]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x120]
mov dword [eax], ecx
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff3
je 0x10022663
lea ecx, [ebp - 0x120]
call fcn.10012004
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x28], 0xfffffffa
jmp 0x100228fb
mov dword [ebp - 0x1c], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x18], 0xd9e62b56
mov edx, 0x4f6c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
cmp eax, esi
mov eax, dword [ebp - 0x18]
setl cl
sub edx, ecx
xor ecx, ecx
cmp edx, eax
setne cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
add ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setge dl
xor ebx, ebx
sub edx, 0x704f4bb4
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
cmp edx, eax
setle bl
sub ebx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
neg ebx
sbb ebx, ebx
xor ecx, ecx
inc ebx
cmp ebx, eax
setl cl
xor ebx, ebx
cmp dword [ebp - 0x1c], ecx
jl 0x10022875
mov ecx, esi
cmp dword [ebp - 0x1c], ebx
jne 0x10022877
mov ecx, ebx
mov eax, dword [ebp - 0x28]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x71e
setg al
cmp eax, 2
mov eax, dword [ebp - 0x10]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x28]
je 0x100228b2
mov edx, ebx
cmp dword [ebp - 0x20], ebx
je 0x100228b4
mov edx, esi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 3
jl 0x100228d3
mov dword [ebp - 0x34], 0xdeb2
mov dword [ebp - 0x10], esi
jmp 0x100228f8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100228e2
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100228f8
push ebx
push 0x11ac
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0xe
jne 0x100227f4
mov dword [ebp - 0x10], ebx
jmp 0x10022917
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1d4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002290a
push 3
pop eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x78]
push eax
call fcn.10011da1
mov dword [ebp - 0x18], 0x7c869b7d
mov dword [ebp - 0x10], ebx
jmp 0x10022944
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10022938
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jne 0x10022955
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], esi
mov eax, dword [ebp - 0x1c]
add eax, 7
jne 0x10022987
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x78]
setl dl
cmp edx, dword [eax]
jge 0x10022987
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10022989
mov ecx, esi
mov eax, dword [ebp - 0x18]
imul eax, ecx
test eax, eax
jne 0x10022996
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1c], ebx
je 0x10022aa1
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 2
jg 0x10022ac0
push 2
pop edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edi
jg 0x10022a5c
mov dword [ebp - 0x10], 0xe5fef407
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x10022a11
mov edi, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x78]
cmp dword [eax + ecx*4], 0x5b50
mov eax, dword [ebp - 0x18]
setle dl
cmp edx, 0xfffffff6
sbb esi, esi
xor ecx, ecx
neg esi
cmp eax, 8
setne cl
xor edx, edx
cmp ecx, dword [edi + 4]
setg dl
xor eax, eax
cmp esi, edx
setl al
mov dword [ebp - 0x28], eax
dec dword [ebp - 0x10]
jns 0x100229d3
push 2
pop edi
mov dword [ebp - 0x10], edi
cmp dword [ebp - 0x10], ebx
jl 0x10022a4d
mov dword [ebp - 0x38], 4
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x78]
cmp dword [eax + ecx*4], 0x8320
setge dl
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x28], ebx
jmp 0x10022a43
mov dword [ebp - 0x20], ebx
inc dword [ebp - 0x20]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x10022a3a
dec dword [ebp - 0x10]
jns 0x10022a19
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x100229c1
xor esi, esi
inc esi
mov dword [ebp - 0x1c], ebx
jmp 0x10022a88
mov dword [ebp - 0x28], ebx
jmp 0x10022a80
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x78]
cmp dword [eax + ecx*4], ebx
jne 0x10022a85
mov edx, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x78]
mov dword [eax + edx*4], ecx
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jle 0x10022a66
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10022a61
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x100229b2
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
jmp 0x10022ac0
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10022ac0
push 0x1e09
push ebx
push 0xf51
push 0x1b16
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea ecx, [ebp - 0x78]
call fcn.10012004
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x48], ebx
jne 0x10022b21
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x48]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x48]
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x48]
je 0x10022b0d
mov eax, esi
cmp dword [ebp - 0x44], ebx
jne 0x10022b0f
mov eax, ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, 7
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1d4], 7
dec dword [ebp - 0x24]
jns 0x1002246e
mov dword [ebp - 0x2c], 7
lea ecx, [ebp - 0x1c0]
mov dword [ebp - 0x2c], 0x45cdbe8e
mov dword [ebp - 0x2c], 0xe5a60d00
mov dword [ebp - 0x20], 0x7c04ccb6
push 2
call fcn.10011da1
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10022b79
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x250], 0xfb6318d5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10022b68
mov dword [ebp - 0x18], ebx
jmp 0x10022b96
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c0]
mov dword [eax + ecx*4], 0x8146cdea
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10022b83
dec dword [ebp - 0x20]
lea ecx, [ebp - 0x1c0]
call fcn.10012004
mov dword [ebp - 0x18], 0x2e91a04
mov dword [ebp - 0x20], 0x6aa16542
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x18], ebx
jmp 0x10022c36
mov dword [ebp - 0x10], 0xfffd
mov ecx, 0xda7ef5d8
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x2c], 0x2509e71b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setne dl
cmp edx, dword [ebp - 0x18]
jle 0x10022c18
mov edx, esi
cmp dword [ebp - 0x20], ebx
jne 0x10022c1a
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setne cl
add ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1d
je 0x10022bc3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10022c50
push 0x1c4e
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x24], 0x60477862
lea ecx, [ebp - 0x228]
push 3
call fcn.10011da1
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x10], ebx
jmp 0x10022c7b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x228]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10022c6c
mov dword [ebp - 0x24], ebx
jmp 0x10022cc2
mov dword [ebp - 0x10], 0x7c203980
mov dword [ebp - 0x10], ebx
jmp 0x10022cb9
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10022cb6
push ebx
push 0x21f7
push 0x1db5
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff6
jl 0x10022c92
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xb
jg 0x10022c86
push 2
pop eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
jl 0x10022cf2
mov dword [ebp - 0x10], 0x11151
mov dword [ebp - 0x10], ebx
jmp 0x10022ce8
mov dword [ebp - 0x20], ebx
dec dword [ebp - 0x20]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x10022cdf
dec dword [ebp - 0x24]
jns 0x10022cd3
lea ecx, [ebp - 0x228]
call fcn.10012004
mov eax, 0xa5d6c05b
lea ecx, [ebp - 0x138]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], ebx
push esi
call fcn.10011da1
push 2
lea ecx, [ebp - 0xcc]
mov dword [ebp - 4], 4
call fcn.10011da1
mov dword [ebp - 0x2c], 0xd14c
mov dword [ebp - 0x18], ebx
jmp 0x10022d5f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10022d50
mov dword [ebp - 0x18], ebx
jmp 0x10022d7c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 0x6f7fbf21
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10022d69
mov dword [ebp - 0x24], ebx
jmp 0x10022da1
mov dword [ebp - 0x10], ebx
jmp 0x10022d96
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x68], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10022d8c
dec dword [ebp - 0x68]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jle 0x10022d87
mov esi, dword [ebp - 0xcc]
cmp dword [esi], ebx
jne 0x10022df7
mov eax, dword [ebp - 0x138]
mov edx, dword [eax]
xor eax, eax
test edx, edx
setne al
xor ecx, ecx
add eax, 0xba6b42be
cmp eax, dword [esi + 4]
setge cl
xor eax, eax
add ecx, 7
cmp ecx, edx
setle al
cmp eax, dword [esi + 4]
jne 0x10022de6
cmp dword [ebp - 0x20], ebx
je 0x10022de6
xor eax, eax
inc eax
jmp 0x10022de8
mov eax, ebx
cmp dword [ebp - 0x2c], eax
mov esi, dword [ebp - 0xcc]
jl 0x10022df7
mov eax, ebx
jmp 0x10022dfa
xor eax, eax
inc eax
xor edx, edx
cmp eax, dword [esi]
mov eax, dword [ebp - 0x138]
sete dl
xor ecx, ecx
cmp edx, dword [eax]
setl cl
mov dword [ebp - 0x20], ecx
lea ecx, [ebp - 0xcc]
call fcn.10012004
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.10012004
mov dword [ebp - 0x24], 0xffffffff
xor esi, esi
mov dword [ebp - 0x30], ebx
inc esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0xfd47030f
mov dword [ebp - 0x2c], 0xb51ad5b4
mov dword [ebp - 0x20], 0xea1325a4
mov dword [ebp - 0x2c], 0x533b016f
mov dword [ebp - 0x2c], 0xffffffff
push 3
pop ecx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x34], 6
mov dword [ebp - 0x34], 0x9794
mov dword [ebp - 0x18], ebx
jmp 0x10022e92
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x140], 0x1639956a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10022e81
mov dword [ebp - 0x18], ebx
jmp 0x10022eae
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x26c], 0xfffffff8
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10022e9d
cmp dword [ebp - 0x140], ebx
je 0x10022ec1
mov eax, dword [ebp - 0x140]
mov eax, dword [ebp - 0x2c]
mov ecx, esi
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], 0x4aa8a31c
push 9
mov dword [ebp - 0x2c], ebx
pop edx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x20]
sub ecx, eax
sub ecx, dword [ebp - 0x20]
mov eax, 0xffff
sub ecx, edx
neg ecx
push 2
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x10], eax
call fcn.10011da1
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x20], 4
push 2
mov dword [ebp - 0x2c], 0x2c512dc6
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10022f30
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x84]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10022f1d
mov dword [ebp - 0x18], ebx
jmp 0x10022f44
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10022f3a
mov eax, dword [ebp - 0x84]
xor ecx, ecx
mov edx, esi
cmp dword [eax], 5
mov eax, dword [ebp - 0x10]
setg cl
inc dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x84]
cmove edx, ebx
xor ecx, ecx
cmp edx, dword [eax]
setle cl
cmp ecx, 0x61c0f806
jl 0x10022f80
mov ecx, esi
cmp dword [ebp - 0x10], ebx
jl 0x10022f82
mov ecx, ebx
mov eax, dword [ebp - 0x84]
xor edx, edx
mov dword [eax], ecx
inc dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
add ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, ecx
mov ecx, 0xffff
setg dl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x58]
cmp ecx, eax
mov eax, dword [ebp - 0x58]
sbb ecx, ecx
inc ecx
imul eax, ecx
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [ebp - 0x58], ecx
lea ecx, [ebp - 0x84]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x84]
mov dword [eax], ebx
call fcn.10012004
mov dword [ebp - 0x24], 0xf7e2799a
mov dword [ebp - 0x24], 0x1d
jmp 0x10023046
mov dword [ebp - 0x2c], 0x4d2e
mov dword [ebp - 0x20], 0xefa9
mov dword [ebp - 0x10], ebx
jmp 0x10023013
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xd0], 0x196a162c
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10023002
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xd0], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10023043
push 0xaf6
push 0x11d5
call edi
push eax
call dword [sym.imp.USER32.dll_EnableScrollBar]
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xa
jne 0x10022fef
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002305b
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x178]
mov dword [ebp - 0x10], 0x42a1
mov dword [ebp - 0x20], ebx
push esi
call fcn.10011da1
mov dword [ebp - 0x2c], 0xbc43cc9f
mov dword [ebp - 0x18], ebx
jmp 0x10023093
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x178]
mov dword [eax + ecx*4], 0x4157736d
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10023080
mov dword [ebp - 0x18], ebx
jmp 0x100230ae
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x278], 0xfffffffd
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002309d
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x178]
mov dword [eax], esi
mov dword [ebp - 0x2c], 7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100230f1
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
lea ecx, [ebp - 0x178]
call fcn.10012004
mov dword [ebp - 0x24], 0x2bbef7d6
lea ecx, [ebp - 0x114]
push 2
call fcn.10011da1
mov dword [ebp - 0x20], 0xfffa
mov dword [ebp - 0x2c], esi
push 2
mov dword [ebp - 0x30], 0x3f045180
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x10], ebx
jmp 0x1002313c
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x114]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002312c
mov eax, dword [ebp - 0x24]
xor ecx, ecx
mov eax, dword [ebp - 0x24]
test eax, eax
mov eax, dword [ebp - 0x24]
sets cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, dword [ebp - 0x24]
je 0x1002316e
mov eax, esi
cmp dword [ebp - 0x24], ebx
jne 0x10023170
mov eax, ebx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x114]
mov dword [eax], 0x5689
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
dec dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], 0xd4938140
mov dword [ebp - 0x10], 0x95cc9e52
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x114]
mov dword [ebp - 0x20], 0x2a6add33
mov eax, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
mov ecx, dword [ebp - 0x10]
sub edx, eax
mov eax, dword [ebp - 0x20]
add ecx, 5
add eax, edx
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
lea ecx, [ebp - 0x114]
setge dl
sub edx, 7
mov dword [ebp - 0x10], edx
call fcn.10012004
mov dword [ebp - 0x18], 0xd688
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0xec], eax
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0x10], 0x56e74e80
mov dword [ebp - 0x28], 0x2aff635
mov dword [ebp - 0x20], 0x7d266845
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x24], 0x1e13ca4d
mov dword [ebp - 0x1c], 0xfffffff9
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
je 0x10023254
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10023242
mov eax, esi
cmp dword [ebp - 0x18], ebx
jne 0x10023244
mov eax, ebx
mov dword [ebp - 0xec], eax
mov edx, esi
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], ebx
jne 0x10023256
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0xec], ebx
jne 0x10023272
mov eax, ebx
cmp dword [ebp - 0x10], ebx
je 0x10023274
mov eax, esi
mov dword [ebp - 0x20], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0x4870
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, 0x1f0dfbc4
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe4]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp eax, 0x360e5697
setle cl
imul ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x10], 0xae97
mov dword [ebp - 0x24], ebx
jmp 0x100232f4
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x248], 0xa136951a
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 4
jl 0x100232e3
dec dword [ebp - 0x10]
mov dword [ebp - 0x10], ebx
jmp 0x10023351
mov dword [ebp - 0x18], 0xf47a6de
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002331d
push 0x1cf5
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], ebx
jl 0x1002334e
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x24], 3
cmp dword [ebp - 0x24], ebx
jl 0x10023349
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x248], ebx
jne 0x10023349
dec dword [ebp - 0x24]
jns 0x10023338
dec dword [ebp - 0x18]
jns 0x10023329
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jle 0x10023302
mov dword [ebp - 0x10], ebx
jmp 0x1002336a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], 0xdcec3d7d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002335c
mov dword [ebp - 0x1c], 0x38ec
xor edx, edx
mov dword [ebp - 0x20], 0x17b722ba
mov dword [ebp - 0x10], 0x97b09b37
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp eax, esi
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
xor edx, edx
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
setle cl
cmp ecx, 0x118c84b7
jge 0x10023484
mov dword [ebp - 0x20], 0xed734895
lea ecx, [ebp - 0x184]
push 2
call fcn.10011da1
mov dword [ebp - 0x18], ebx
jmp 0x100233fe
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x54], 0xf93be41b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100233f0
mov dword [ebp - 0x18], ebx
jmp 0x10023418
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x184]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10023408
cmp dword [ebp - 0x10], ebx
jne 0x1002342a
mov dword [ebp - 0x2c], 0xdae1dc63
mov dword [ebp - 0x30], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x10], ebx
jmp 0x100234b1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x21c], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x100234a0
mov dword [ebp - 0x10], 2
cmp dword [ebp - 0x10], ebx
jl 0x100234eb
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x21c]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x21c], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100234e6
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
dec dword [ebp - 0x10]
jns 0x100234c3
mov dword [ebp - 0x2c], 0x3fa7
lea ecx, [ebp - 0x19c]
mov dword [ebp - 0x2c], 0xfffffff8
mov dword [ebp - 0x30], 0xdd3f4672
push 3
call fcn.10011da1
push esi
lea ecx, [ebp - 0x204]
mov dword [ebp - 4], 5
call fcn.10011da1
mov dword [ebp - 0x20], 0x93cc2542
push 3
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x1c], ebx
pop edx
jmp 0x10023542
cmp dword [ebp - 0x1c], edx
jl 0x10023532