Function at 0x10009011
Capabilities:
Identify system language via api
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10079716
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xe50
push esi
push edi
push 4
lea ecx, [ebp - 0x334]
call fcn.100159d0
and dword [ebp - 4], 0
mov dword [ebp - 0x1e0], 0xfffffff9
mov dword [ebp - 0x770], 0
mov dword [ebp - 0x9fc], 6
mov dword [ebp - 0x9f8], 6
mov dword [ebp - 0x9f4], 6
mov dword [ebp - 0x9f0], 6
lea ecx, [ebp - 0x229]
call fcn.10015a7d
push eax
lea eax, [ebp - 0x9ec]
push eax
lea eax, [ebp - 0x9fc]
push eax
lea ecx, [ebp - 0xdac]
call fcn.10015a80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc34]
call fcn.10015a2c
mov byte [ebp - 4], 1
mov dword [ebp - 0x780], 1
push 4
lea ecx, [ebp - 0x934]
call fcn.100159d0
mov byte [ebp - 4], 2
mov dword [ebp - 0x814], 0x7df39f3c
mov dword [ebp - 0x2c], 0
jmp 0x100090ec
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10009108
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x334]
call fcn.10015a6e
mov dword [eax], 0x81d2
jmp 0x100090e5
mov dword [ebp - 0x2c], 0
jmp 0x10009118
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 1
jge 0x1000912e
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x740], 0x2db80ebb
jmp 0x10009111
mov dword [ebp - 0x2c], 0
jmp 0x1000913e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10009154
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xdec], 0xdb8846b5
jmp 0x10009137
mov dword [ebp - 0x2c], 0
jmp 0x10009164
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 4
jge 0x10009180
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x934]
call fcn.10015a6e
mov dword [eax], 7
jmp 0x1000915d
push 3
lea ecx, [ebp - 0x334]
call fcn.10015a6e
cmp dword [eax], 0
jne 0x100092ff
push 3
lea ecx, [ebp - 0x334]
call fcn.10015a6e
cmp dword [eax], 0
je 0x10009217
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0xd24], eax
push 3
lea ecx, [ebp - 0x334]
call fcn.10015a6e
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x740]
mov dword [ebp - 0x3c0], eax
push 0
lea ecx, [ebp - 0x334]
call fcn.10015a6e
mov ecx, dword [ebp - 0x3c0]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x3c0]
mov eax, dword [eax]
mov dword [ebp - 0x770], eax
cmp dword [ebp - 0x770], 0
je 0x10009217
mov eax, 0xfff7
test eax, eax
je 0x10009217
mov dword [ebp - 0x778], 1
jmp 0x1000921e
and dword [ebp - 0x778], 0
mov esi, dword [ebp - 0x778]
add esi, 0x11db4d18
push 3
lea ecx, [ebp - 0x334]
call fcn.10015a6e
cmp esi, dword [eax]
jl 0x10009247
mov dword [ebp - 0x23c], 1
jmp 0x1000924e
and dword [ebp - 0x23c], 0
push 3
lea ecx, [ebp - 0xc34]
call fcn.10015a6e
mov ecx, dword [ebp - 0x23c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x23c]
mov dword [ebp - 0x780], eax
mov esi, dword [ebp - 0x780]
push 3
lea ecx, [ebp - 0x334]
call fcn.10015a6e
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x788], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x788]
mov dword [ebp + eax - 0xdec], ecx
cmp dword [ebp - 0x788], 0x37fc
je 0x100092b7
mov dword [ebp - 0x790], 1
jmp 0x100092be
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x1e0]
cmp dword [ebp - 0x790], eax
jg 0x100092d8
mov dword [ebp - 0x798], 1
jmp 0x100092df
and dword [ebp - 0x798], 0
push 1
lea ecx, [ebp - 0x334]
call fcn.10015a6e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x798]
jne 0x100092ff
and dword [ebp - 0x7a0], 0
jmp 0x10009309
mov dword [ebp - 0x7a0], 1
mov eax, dword [ebp - 0x1e0]
imul eax, dword [ebp - 0x7a0]
cmp eax, 0xc4eb0a11
jbe 0x10009329
mov dword [ebp - 0x7a8], 1
jmp 0x10009330
and dword [ebp - 0x7a8], 0
cmp dword [ebp - 0x7a8], 0x6709e149
jle 0x10009355
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x740], 0
jne 0x10009355
and dword [ebp - 0x7dc], 0
jmp 0x1000935f
mov dword [ebp - 0x7dc], 1
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0xbe8], eax
push 0
lea ecx, [ebp - 0x934]
call fcn.10015a6e
mov dword [eax], 9
push 9
pop eax
cmp eax, 0x6f63
je 0x10009394
mov dword [ebp - 0x80c], 1
jmp 0x1000939b
and dword [ebp - 0x80c], 0
push 3
lea ecx, [ebp - 0x334]
call fcn.10015a6e
push 2
lea ecx, [ebp - 0x934]
call fcn.10015a6e
mov eax, dword [eax]
mov dword [ebp - 0x814], eax
mov byte [ebp - 0xb4], 0
movzx eax, byte [ebp - 0xb4]
test eax, eax
je 0x100093e9
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x934]
call fcn.10015a52
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc34]
call fcn.10015a52
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.10015a52
push 4
lea ecx, [ebp - 0x34c]
call fcn.100159d0
mov dword [ebp - 4], 3
mov dword [ebp - 0x148], 0xfffffff9
mov dword [ebp - 0x748], 0
mov dword [ebp - 0x9d4], 6
mov dword [ebp - 0x9d0], 6
mov dword [ebp - 0x9cc], 6
mov dword [ebp - 0x9c8], 6
lea ecx, [ebp - 0x231]
call fcn.10015a7d
push eax
lea eax, [ebp - 0x9c4]
push eax
lea eax, [ebp - 0x9d4]
push eax
lea ecx, [ebp - 0xd74]
call fcn.10015a80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc44]
call fcn.10015a2c
mov byte [ebp - 4], 4
mov dword [ebp - 0x750], 1
push 4
lea ecx, [ebp - 0x964]
call fcn.100159d0
mov byte [ebp - 4], 5
mov dword [ebp - 0x82c], 0x7df39f3c
mov dword [ebp - 0x18], 0
jmp 0x100094d4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x100094f0
push dword [ebp - 0x18]
lea ecx, [ebp - 0x34c]
call fcn.10015a6e
mov dword [eax], 0x81d2
jmp 0x100094cd
mov dword [ebp - 0x18], 0
jmp 0x10009500
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10009516
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x38c], 0x2db80ebb
jmp 0x100094f9
mov dword [ebp - 0x18], 0
jmp 0x10009526
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x1000953c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xda4], 0xdb8846b5
jmp 0x1000951f
mov dword [ebp - 0x18], 0
jmp 0x1000954c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 4
jge 0x10009568
push dword [ebp - 0x18]
lea ecx, [ebp - 0x964]
call fcn.10015a6e
mov dword [eax], 7
jmp 0x10009545
push 3
lea ecx, [ebp - 0x34c]
call fcn.10015a6e
cmp dword [eax], 0
jne 0x100096e7
push 3
lea ecx, [ebp - 0x34c]
call fcn.10015a6e
cmp dword [eax], 0
je 0x100095ff
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xca8], eax
push 3
lea ecx, [ebp - 0x34c]
call fcn.10015a6e
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x38c]
mov dword [ebp - 0x368], eax
push 0
lea ecx, [ebp - 0x34c]
call fcn.10015a6e
mov ecx, dword [ebp - 0x368]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x368]
mov eax, dword [eax]
mov dword [ebp - 0x748], eax
cmp dword [ebp - 0x748], 0
je 0x100095ff
mov eax, 0xfff7
test eax, eax
je 0x100095ff
mov dword [ebp - 0x370], 1
jmp 0x10009606
and dword [ebp - 0x370], 0
mov esi, dword [ebp - 0x370]
add esi, 0x11db4d18
push 3
lea ecx, [ebp - 0x34c]
call fcn.10015a6e
cmp esi, dword [eax]
jl 0x1000962f
mov dword [ebp - 0x2ac], 1
jmp 0x10009636
and dword [ebp - 0x2ac], 0
push 3
lea ecx, [ebp - 0xc44]
call fcn.10015a6e
mov ecx, dword [ebp - 0x2ac]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x750], eax
mov esi, dword [ebp - 0x750]
push 3
lea ecx, [ebp - 0x34c]
call fcn.10015a6e
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x378], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x378]
mov dword [ebp + eax - 0xda4], ecx
cmp dword [ebp - 0x378], 0x37fc
je 0x1000969f
mov dword [ebp - 0x758], 1
jmp 0x100096a6
and dword [ebp - 0x758], 0
mov eax, dword [ebp - 0x148]
cmp dword [ebp - 0x758], eax
jg 0x100096c0
mov dword [ebp - 0x380], 1
jmp 0x100096c7
and dword [ebp - 0x380], 0
push 1
lea ecx, [ebp - 0x34c]
call fcn.10015a6e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x380]
jne 0x100096e7
and dword [ebp - 0x760], 0
jmp 0x100096f1
mov dword [ebp - 0x760], 1
mov eax, dword [ebp - 0x148]
imul eax, dword [ebp - 0x760]
cmp eax, 0xc4eb0a11
jbe 0x10009711
mov dword [ebp - 0x768], 1
jmp 0x10009718
and dword [ebp - 0x768], 0
cmp dword [ebp - 0x768], 0x6709e149
jle 0x1000973d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x38c], 0
jne 0x1000973d
and dword [ebp - 0x81c], 0
jmp 0x10009747
mov dword [ebp - 0x81c], 1
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xbf0], eax
push 0
lea ecx, [ebp - 0x964]
call fcn.10015a6e
mov dword [eax], 9
push 9
pop eax
cmp eax, 0x6f63
je 0x1000977c
mov dword [ebp - 0x824], 1
jmp 0x10009783
and dword [ebp - 0x824], 0
push 3
lea ecx, [ebp - 0x34c]
call fcn.10015a6e
push 2
lea ecx, [ebp - 0x964]
call fcn.10015a6e
mov eax, dword [eax]
mov dword [ebp - 0x82c], eax
mov byte [ebp - 0xb5], 0
movzx eax, byte [ebp - 0xb5]
test eax, eax
je 0x100097d1
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x964]
call fcn.10015a52
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc44]
call fcn.10015a52
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34c]
call fcn.10015a52
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0x5a4], 0xffffffff
mov dword [ebp - 0x244], 0x6a3735b2
mov dword [ebp - 0x1b0], 0xffffffff
mov dword [ebp - 0x39c], 0x7b051af7
mov dword [ebp - 0x24c], 1
mov dword [ebp - 0x844], 0x6d0c11e0
mov dword [ebp - 0xd3c], 0xc3b7c39c
mov dword [ebp - 0xbf8], 0x2d683a7e
mov dword [ebp - 0xcb8], 0x9a488d5
mov dword [ebp - 0xc00], 0x4186e145
mov dword [ebp - 0xd1c], 0xba1dd793
mov dword [ebp - 0xc08], 0x2b4cf22a
mov dword [ebp - 0xcc8], 0
mov dword [ebp - 0x2ec], 0xb56bf5e
mov dword [ebp - 0x134], 0
jmp 0x100098aa
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 2
jge 0x100098c6
mov eax, dword [ebp - 0x134]
mov dword [ebp + eax*4 - 0xdc4], 0xc23782ec
jmp 0x1000989d
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x80], eax
jle 0x100098da
mov dword [ebp - 0x834], 1
jmp 0x100098e1
and dword [ebp - 0x834], 0
mov eax, dword [ebp - 0x80]
mov dword [ebp - 0x5a4], eax
cmp dword [ebp - 0x5a4], 0
je 0x10009922
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
mov ecx, dword [ebp - 0x1b0]
dec ecx
mov dword [ebp - 0x1b0], ecx
test eax, eax
je 0x10009922
mov dword [ebp - 0x394], 1
jmp 0x10009929
and dword [ebp - 0x394], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x80], eax
jne 0x1000993d
mov dword [ebp - 0x6b0], 1
jmp 0x10009944
and dword [ebp - 0x6b0], 0
imul eax, dword [ebp - 0x394], 0xfffffff9
mov dword [ebp - 0x39c], eax
mov eax, dword [ebp - 0x6b0]
sub eax, 0x4956
cmp dword [ebp - 0x39c], eax
jl 0x10009970
mov dword [ebp - 0x83c], 1
jmp 0x10009977
and dword [ebp - 0x83c], 0
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x24c], eax
imul eax, dword [ebp - 0x24c], 0xff63
cmp eax, dword [ebp - 0x80]
jle 0x1000999e
mov dword [ebp - 0x5ac], 1
jmp 0x100099a5
and dword [ebp - 0x5ac], 0
mov eax, dword [ebp - 0x80]
cmp dword [ebp - 0x5ac], eax
jle 0x100099bc
mov dword [ebp - 0x3a4], 1
jmp 0x100099c3
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x80]
add eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x844], eax
cmp dword [ebp - 0x244], 0
je 0x100099fe
mov eax, dword [ebp - 0x2ec]
mov ecx, dword [ebp - 0x2ec]
dec ecx
mov dword [ebp - 0x2ec], ecx
test eax, eax
jne 0x100099fe
mov dword [ebp - 0x6b4], 1
jmp 0x10009a05
and dword [ebp - 0x6b4], 0
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x6b4]
mov dword [ebp - 0x24c], eax
push 4
lea ecx, [ebp - 0x328]
call fcn.100159d0
mov dword [ebp - 4], 6
push 2
lea ecx, [ebp - 0xb00]
call fcn.100159d0
mov byte [ebp - 4], 7
mov dword [ebp - 0x12c], 0
mov dword [ebp - 0xb14], 9
mov dword [ebp - 0x150], 0
jmp 0x10009a67
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 2
jge 0x10009a89
push dword [ebp - 0x150]
lea ecx, [ebp - 0xb00]
call fcn.10015a6e
mov dword [eax], 0xfffffffb
jmp 0x10009a5a
mov dword [ebp - 0x12c], 0
jmp 0x10009aa2
mov eax, dword [ebp - 0x12c]
inc eax
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 1
jg 0x10009b14
mov dword [ebp - 0x208], 0x351f2000
mov dword [ebp - 0xb1c], 0xffffffff
mov dword [ebp - 0x208], 0
jmp 0x10009ad8
mov eax, dword [ebp - 0x208]
inc eax
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x208], 1
jg 0x10009b12
mov dword [ebp - 0x3ac], 0xdfbd
mov eax, dword [ebp - 0x3ac]
inc eax
mov dword [ebp - 0x3ac], eax
push dword [ebp - 0x12c]
lea ecx, [ebp - 0xb00]
call fcn.10015a6e
cmp dword [eax], 0
je 0x10009b10
jmp 0x10009b12
jmp 0x10009acb
jmp 0x10009a95
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xb00]
call fcn.10015a52
mov dword [ebp - 0x1c0], 0xfffffff9
mov dword [ebp - 0x50], 0xffffffff
mov dword [ebp - 0x5b4], 0x9598aaf0
push 3
lea ecx, [ebp - 0x874]
call fcn.100159d0
mov byte [ebp - 4], 8
mov dword [ebp - 0x5bc], 0x491ba6b4
push 4
lea ecx, [ebp - 0xa94]
call fcn.100159d0
mov byte [ebp - 4], 9
push 1
lea ecx, [ebp - 0xa7c]
call fcn.100159d0
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x1c], 0
jmp 0x10009b8b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10009ba7
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x874]
call fcn.10015a6e
mov dword [eax], 0xfffffffc
jmp 0x10009b84
mov dword [ebp - 0x1c], 0
jmp 0x10009bb7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x10009bcd
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xbe4], 0xfffffffb
jmp 0x10009bb0
mov dword [ebp - 0x1c], 0
jmp 0x10009bdd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x10009bf9
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa94]
call fcn.10015a6e
mov dword [eax], 0x5bb08661
jmp 0x10009bd6
mov dword [ebp - 0x1c], 0
jmp 0x10009c09
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x10009c22
push dword [ebp - 0x1c]
lea ecx, [ebp - 0xa7c]
call fcn.10015a6e
and dword [eax], 0
jmp 0x10009c02
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x5b4], eax
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x5b4], eax
je 0x10009c49
mov dword [ebp - 0x2b4], 1
jmp 0x10009c50
and dword [ebp - 0x2b4], 0
push 1
lea ecx, [ebp - 0x874]
call fcn.10015a6e
mov ecx, dword [ebp - 0x2b4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x2b4], eax
jge 0x10009c7c
mov dword [ebp - 0x3b4], 1
jmp 0x10009c83
and dword [ebp - 0x3b4], 0
mov eax, dword [ebp - 0x3b4]
add eax, 0x7f191253
cmp eax, dword [ebp - 0x50]
jl 0x10009c9f
mov dword [ebp - 0x734], 1
jmp 0x10009ca6
and dword [ebp - 0x734], 0
cmp dword [ebp - 0x734], 0x6572
jle 0x10009cbe
mov dword [ebp - 0x254], 1
jmp 0x10009cc5
and dword [ebp - 0x254], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x254]
mov dword [ebp + eax - 0xbe4], ecx
cmp dword [ebp - 0x254], 0x17f4
je 0x10009cf0
mov dword [ebp - 0x3bc], 1
jmp 0x10009cf7
and dword [ebp - 0x3bc], 0
mov eax, dword [ebp - 0x3bc]
mov dword [ebp - 0x5bc], eax
cmp dword [ebp - 0x5bc], 0
jne 0x10009d10
cmp dword [ebp - 0x50], 0
push 1
lea ecx, [ebp - 0x874]
call fcn.10015a6e
push 0
lea ecx, [ebp - 0x874]
call fcn.10015a6e
cmp dword [ebp - 0x50], 0xffffffff
jl 0x10009d3c
mov dword [ebp - 0x2dc], 1
jmp 0x10009d43
and dword [ebp - 0x2dc], 0
push 2
lea ecx, [ebp - 0xa94]
call fcn.10015a6e
mov ecx, dword [ebp - 0x2dc]
mov dword [eax], ecx
cmp dword [ebp - 0x2dc], 0
je 0x10009d72
xor eax, eax
inc eax
je 0x10009d72
mov dword [ebp - 0x3c4], 1
jmp 0x10009d79
and dword [ebp - 0x3c4], 0
imul esi, dword [ebp - 0x3c4], 0x3248
imul esi, dword [ebp - 0x50]
imul esi, dword [ebp - 0x50]
push 0
lea ecx, [ebp - 0xa7c]
call fcn.10015a6e
mov dword [eax], esi
mov byte [ebp - 4], 9
lea ecx, [ebp - 0xa7c]
call fcn.10015a52
mov byte [ebp - 4], 8
lea ecx, [ebp - 0xa94]
call fcn.10015a52
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x874]
call fcn.10015a52
mov dword [ebp - 0xb24], 0x49fe387
mov dword [ebp - 0xb2c], 0
mov dword [ebp - 0xb34], 0xfffffffd
push 2
lea ecx, [ebp - 0xc54]
call fcn.100159d0
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xb3c], 1
push 2
lea ecx, [ebp - 0xaac]
call fcn.100159d0
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x6c], 0
jmp 0x10009e21
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10009e3a
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xc54]
call fcn.10015a6e
or dword [eax], 0xffffffff
jmp 0x10009e1a
mov dword [ebp - 0x6c], 0
jmp 0x10009e4a
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x10009e66
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xaac]
call fcn.10015a6e
mov dword [eax], 0x75158018
jmp 0x10009e43
push 0
lea ecx, [ebp - 0xaac]
call fcn.10015a6e
mov dword [ebp - 0x6bc], eax
mov eax, dword [ebp - 0x6bc]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x6bc]
mov dword [ecx], eax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0xaac]
call fcn.10015a52
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xc54]
call fcn.10015a52
mov dword [ebp - 0x6cc], 0
mov dword [ebp - 0x158], 8
mov byte [ebp - 0xb7], 0
movzx eax, byte [ebp - 0xb7]
test eax, eax
je 0x10009ed8
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov dword [ebp - 0x158], 0
jmp 0x10009ef1
mov eax, dword [ebp - 0x158]
dec eax
mov dword [ebp - 0x158], eax
cmp dword [ebp - 0x158], 0xffffffff
jle 0x10009f6b
mov dword [ebp - 0x1b8], 0x22124f84
mov dword [ebp - 0xb44], 0x9ac54c97
mov dword [ebp - 0x3cc], 0
mov dword [ebp - 0x84c], 0xffffffff
mov dword [ebp - 0x1b8], 0
jmp 0x10009f3b
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0xfffffff2
jl 0x10009f66
mov dword [ebp - 0xb4c], 0xa9b64fda
mov dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x3cc]
mov dword [ebp - 0x84c], eax
jmp 0x10009f2e
jmp 0x10009ee4
mov dword [ebp - 0x998], 6
mov dword [ebp - 0x994], 6
mov dword [ebp - 0x990], 6
mov dword [ebp - 0x98c], 6
lea ecx, [ebp - 0x2d1]
call fcn.10015a7d
push eax
lea eax, [ebp - 0x988]
push eax
lea eax, [ebp - 0x998]
push eax
lea ecx, [ebp - 0xe0c]
call fcn.10015a80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xc64]
call fcn.10015a2c
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x25c], 0xffffffff
mov dword [ebp - 0x5dc], 0
mov dword [ebp - 0x73c], 0
mov dword [ebp - 0x160], 0
jmp 0x1000a00a
mov eax, dword [ebp - 0x160]
inc eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 1
jge 0x1000a026
mov eax, dword [ebp - 0x160]
mov dword [ebp + eax*4 - 0xf8], 0xfffffff8
jmp 0x10009ffd
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb54], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xb5c], eax
cmp dword [ebp - 0x14], 0x795010f7
jle 0x1000a04d
mov dword [ebp - 0x5c4], 1
jmp 0x1000a054
and dword [ebp - 0x5c4], 0
cmp dword [ebp - 0x5c4], 0xfffffffd
jg 0x1000a069
mov dword [ebp - 0x3d4], 1
jmp 0x1000a070
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x3d4]
je 0x1000a150
mov dword [ebp - 0xe4], 5
mov dword [ebp - 0x85c], 0x498d20b5
mov dword [ebp - 0x14], 0
jmp 0x1000a0a3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x1000a0fd
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xf8]
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe4], 0
jmp 0x1000a0d2
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0
jg 0x1000a0fb
mov byte [ebp - 0xd7], 0
movzx eax, byte [ebp - 0xd7]
test eax, eax
je 0x1000a0f9
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
jmp 0x1000a0c5
jmp 0x1000a09c
mov dword [ebp - 0x14], 0
jmp 0x1000a10d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x38
jne 0x1000a14b
mov dword [ebp - 0xb64], 0xd8ff8cd3
mov dword [ebp - 0xb6c], 0x177c
mov dword [ebp - 0x854], 0xa1ee3199
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 0x854], eax
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x85c], eax
jmp 0x1000a106
jmp 0x1000a42b
mov dword [ebp - 0x2bc], 0xd7d5
mov dword [ebp - 0x5cc], 0x59a67e99
mov dword [ebp - 0x304], 0xf6bb026e
mov dword [ebp - 0xb74], 0xfffffff6
mov dword [ebp - 0x7f0], 0xc5df97f
mov dword [ebp - 0xb7c], 0xffea059e
mov dword [ebp - 0x264], 0xaa6f69a7
mov dword [ebp - 0x804], 2
mov dword [ebp - 0x1e8], 0
jmp 0x1000a1b9
mov eax, dword [ebp - 0x1e8]
inc eax
mov dword [ebp - 0x1e8], eax
cmp dword [ebp - 0x1e8], 4
jge 0x1000a1d5
mov eax, dword [ebp - 0x1e8]
mov dword [ebp + eax*4 - 0xe4c], 0xfffffffc
jmp 0x1000a1ac
mov dword [ebp - 0x14], 0x10
jmp 0x1000a1e5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3b
jle 0x1000a2aa
mov dword [ebp - 0x168], 2
cmp dword [ebp - 0x168], 0x5f9b
jg 0x1000a22d
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xf8], 0
je 0x1000a22d
cmp dword [ebp - 0x25c], 0x9656
jne 0x1000a22d
mov dword [ebp - 0x774], 1
jmp 0x1000a234
and dword [ebp - 0x774], 0
mov eax, dword [ebp - 0x168]
cmp dword [ebp - 0x774], eax
je 0x1000a24e
mov dword [ebp - 0x864], 1
jmp 0x1000a255
and dword [ebp - 0x864], 0
mov eax, dword [ebp - 0x168]
mov dword [ebp - 0xb84], eax
mov dword [ebp - 0x2bc], 0x46c64e71
mov eax, dword [ebp - 0x5cc]
add eax, dword [ebp - 0x168]
cmp dword [ebp - 0x2bc], eax
jg 0x1000a28b
mov dword [ebp - 0x3dc], 1
jmp 0x1000a292
and dword [ebp - 0x3dc], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3dc]
mov dword [ebp + eax - 0xf8], ecx
jmp 0x1000a1de
cmp dword [ebp - 0x14], 0
je 0x1000a3c3
cmp dword [ebp - 0x5cc], 0
jne 0x1000a3b7
cmp dword [ebp - 0x5dc], 0x89c297e1
jae 0x1000a2d9
mov dword [ebp - 0x3e4], 1
jmp 0x1000a2e0
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x25c]
cmp dword [ebp - 0x3e4], eax
jl 0x1000a2fa
mov dword [ebp - 0x6c4], 1
jmp 0x1000a301
and dword [ebp - 0x6c4], 0
mov eax, dword [ebp - 0x804]
cmp dword [ebp - 0x6c4], eax
je 0x1000a31b
mov dword [ebp - 0x7e8], 1
jmp 0x1000a322
and dword [ebp - 0x7e8], 0
mov eax, dword [ebp - 0x304]
mov dword [ebp - 0xb8c], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], eax
jne 0x1000a342
mov dword [ebp - 0x3ec], 1
jmp 0x1000a349
and dword [ebp - 0x3ec], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xf8]
cmp dword [ebp - 0x3ec], eax
jg 0x1000a36a
mov dword [ebp - 0x5d4], 1
jmp 0x1000a371
and dword [ebp - 0x5d4], 0
mov eax, dword [ebp - 0x73c]
cmp dword [ebp - 0x5d4], eax
jge 0x1000a38b
mov dword [ebp - 0x3f4], 1
jmp 0x1000a392
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x2bc]
mov ecx, dword [ebp - 0x264]
sub ecx, dword [ebp - 0x3f4]
neg ecx
mov edx, dword [ebp - 0x264]
inc edx
mov dword [ebp - 0x264], edx
cmp ecx, eax
jg 0x1000a3c3
mov dword [ebp - 0x8dc], 1
jmp 0x1000a3ca
and dword [ebp - 0x8dc], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x7f0], eax
jg 0x1000a3e1
mov dword [ebp - 0x904], 1
jmp 0x1000a3e8
and dword [ebp - 0x904], 0
mov eax, dword [ebp - 0x304]
imul eax, dword [ebp - 0x304]
sub eax, 0x4ef5d9ce
je 0x1000a40e
cmp dword [ebp - 0x73c], 0
jne 0x1000a40e
and dword [ebp - 0x3fc], 0
jmp 0x1000a418
mov dword [ebp - 0x3fc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x3fc]
mov dword [ebp + eax - 0xf8], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x5dc]
mov dword [ebp + eax - 0xf8], ecx
mov dword [ebp - 0x5e4], 1
push 4
lea ecx, [ebp - 0x940]
call fcn.100159d0
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x800], 0x7df39f3c
mov dword [ebp - 0x20], 0
jmp 0x1000a473
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000a48f
push dword [ebp - 0x20]
lea ecx, [ebp - 0x328]
call fcn.10015a6e
mov dword [eax], 0x81d2
jmp 0x1000a46c
mov dword [ebp - 0x20], 0
jmp 0x1000a49f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x1000a4b5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x6d4], 0x2db80ebb
jmp 0x1000a498
mov dword [ebp - 0x20], 0
jmp 0x1000a4c5
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000a4db
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe1c], 0xdb8846b5
jmp 0x1000a4be
mov dword [ebp - 0x20], 0
jmp 0x1000a4eb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1000a507
push dword [ebp - 0x20]
lea ecx, [ebp - 0x940]
call fcn.10015a6e
mov dword [eax], 7
jmp 0x1000a4e4
push 3
lea ecx, [ebp - 0x328]
call fcn.10015a6e
cmp dword [eax], 0
jne 0x1000a686
push 3
lea ecx, [ebp - 0x328]
call fcn.10015a6e
cmp dword [eax], 0
je 0x1000a59e
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0xb94], eax
push 3
lea ecx, [ebp - 0x328]
call fcn.10015a6e
push 4
pop eax
imul eax, eax, 0
lea eax, [ebp + eax - 0x6d4]
mov dword [ebp - 0x404], eax
push 0
lea ecx, [ebp - 0x328]
call fcn.10015a6e
mov ecx, dword [ebp - 0x404]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0x404]
mov eax, dword [eax]
mov dword [ebp - 0x6cc], eax
cmp dword [ebp - 0x6cc], 0
je 0x1000a59e
mov eax, 0xfff7
test eax, eax
je 0x1000a59e
mov dword [ebp - 0x40c], 1
jmp 0x1000a5a5
and dword [ebp - 0x40c], 0
mov esi, dword [ebp - 0x40c]
add esi, 0x11db4d18
push 3
lea ecx, [ebp - 0x328]
call fcn.10015a6e
cmp esi, dword [eax]
jl 0x1000a5ce
mov dword [ebp - 0x26c], 1
jmp 0x1000a5d5
and dword [ebp - 0x26c], 0
push 3
lea ecx, [ebp - 0xc64]
call fcn.10015a6e
mov ecx, dword [ebp - 0x26c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x5e4], eax
mov esi, dword [ebp - 0x5e4]
push 3
lea ecx, [ebp - 0x328]
call fcn.10015a6e
mov eax, dword [eax]
add eax, esi
mov dword [ebp - 0x414], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x414]
mov dword [ebp + eax - 0xe1c], ecx
cmp dword [ebp - 0x414], 0x37fc
je 0x1000a63e
mov dword [ebp - 0x794], 1
jmp 0x1000a645
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x1c0]
cmp dword [ebp - 0x794], eax
jg 0x1000a65f
mov dword [ebp - 0x41c], 1
jmp 0x1000a666
and dword [ebp - 0x41c], 0
push 1
lea ecx, [ebp - 0x328]
call fcn.10015a6e
mov eax, dword [eax]
cmp eax, dword [ebp - 0x41c]
jne 0x1000a686
and dword [ebp - 0x5ec], 0
jmp 0x1000a690
mov dword [ebp - 0x5ec], 1
mov eax, dword [ebp - 0x1c0]
imul eax, dword [ebp - 0x5ec]
cmp eax, 0xc4eb0a11
jbe 0x1000a6b0
mov dword [ebp - 0x424], 1
jmp 0x1000a6b7
and dword [ebp - 0x424], 0
cmp dword [ebp - 0x424], 0x6709e149
jle 0x1000a6dc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x6d4], 0
jne 0x1000a6dc
and dword [ebp - 0x7f8], 0
jmp 0x1000a6e6
mov dword [ebp - 0x7f8], 1
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0xb9c], eax
push 0
lea ecx, [ebp - 0x940]
call fcn.10015a6e
mov dword [eax], 9
push 9
pop eax
cmp eax, 0x6f63
je 0x1000a71b
mov dword [ebp - 0x8e4], 1
jmp 0x1000a722
and dword [ebp - 0x8e4], 0
push 3
lea ecx, [ebp - 0x328]
call fcn.10015a6e
push 2
lea ecx, [ebp - 0x940]
call fcn.10015a6e
mov eax, dword [eax]
mov dword [ebp - 0x800], eax
mov byte [ebp - 0xac], 0
movzx eax, byte [ebp - 0xac]
test eax, eax
je 0x1000a770
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x940]
call fcn.10015a52
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xc64]
call fcn.10015a52
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x328]
call fcn.10015a52
push 3
lea ecx, [ebp - 0xac4]
call fcn.100159d0
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x108], 0x7df2f4a8
mov dword [ebp - 0x170], 0
jmp 0x1000a7d4
mov eax, dword [ebp - 0x170]
inc eax
mov dword [ebp - 0x170], eax
cmp dword [ebp - 0x170], 3
jge 0x1000a7f6
push dword [ebp - 0x170]
lea ecx, [ebp - 0xac4]
call fcn.10015a6e
mov dword [eax], 0xff0ea75c
jmp 0x1000a7c7
mov dword [ebp - 0x108], 2
jmp 0x1000a80f
mov eax, dword [ebp - 0x108]
dec eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jl 0x1000a8e6
mov dword [ebp - 0x200], 0
jmp 0x1000a835
mov eax, dword [ebp - 0x200]
inc eax
mov dword [ebp - 0x200], eax
cmp dword [ebp - 0x200], 3
jge 0x1000a851
mov eax, dword [ebp - 0x200]
mov dword [ebp + eax*4 - 0x958], 0x6801fc3e
jmp 0x1000a828
mov byte [ebp - 0xce], 0
movzx eax, byte [ebp - 0xce]
test eax, eax
je 0x1000a86f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push dword [ebp - 0x108]
lea ecx, [ebp - 0xac4]
call fcn.10015a6e
cmp dword [eax], 0
je 0x1000a887
jmp 0x1000a8e6
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x958], 2
jmp 0x1000a8b5
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x958]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x958], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x958], 0
jl 0x1000a8e1
mov byte [ebp - 0xae], 0
movzx eax, byte [ebp - 0xae]
test eax, eax
je 0x1000a8df
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x1000a89a
jmp 0x1000a802
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac4]
call fcn.10015a52
mov dword [ebp - 0xba4], 0x862f
mov byte [ebp - 0xd0], 0
movzx eax, byte [ebp - 0xd0]
test eax, eax
je 0x1000a91b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov byte [ebp - 0xb0], 0
movzx eax, byte [ebp - 0xb0]
test eax, eax
je 0x1000a933
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
push 3
lea ecx, [ebp - 0xadc]
call fcn.100159d0
mov dword [ebp - 4], 0x10
mov dword [ebp - 0x114], 0x7df2f4a8
mov dword [ebp - 0x178], 0
jmp 0x1000a96a
mov eax, dword [ebp - 0x178]
inc eax
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 3
jge 0x1000a98c
push dword [ebp - 0x178]
lea ecx, [ebp - 0xadc]
call fcn.10015a6e
mov dword [eax], 0xff0ea75c
jmp 0x1000a95d
mov dword [ebp - 0x114], 2
jmp 0x1000a9a5
mov eax, dword [ebp - 0x114]
dec eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
jl 0x1000aa7c
mov dword [ebp - 0x1c8], 0
jmp 0x1000a9cb
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 3
jge 0x1000a9e7
mov eax, dword [ebp - 0x1c8]
mov dword [ebp + eax*4 - 0x970], 0x6801fc3e
jmp 0x1000a9be
mov byte [ebp - 0xd2], 0
movzx eax, byte [ebp - 0xd2]
test eax, eax
je 0x1000aa05
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push dword [ebp - 0x114]
lea ecx, [ebp - 0xadc]
call fcn.10015a6e
cmp dword [eax], 0
je 0x1000aa1d
jmp 0x1000aa7c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x970], 2
jmp 0x1000aa4b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x970]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x970], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x970], 0
jl 0x1000aa77
mov byte [ebp - 0xda], 0
movzx eax, byte [ebp - 0xda]
test eax, eax
je 0x1000aa75
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x1000aa30
jmp 0x1000a998
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xadc]
call fcn.10015a52
mov dword [ebp - 0x180], 0xd5e48d32
mov dword [ebp - 0xbac], 0x3c8fc558
mov dword [ebp - 0x180], 0x1a
jmp 0x1000aab8
mov eax, dword [ebp - 0x180]
dec eax
mov dword [ebp - 0x180], eax
cmp dword [ebp - 0x180], 0xfffffff1
jl 0x1000aae3
mov byte [ebp - 0xb2], 0
movzx eax, byte [ebp - 0xb2]
test eax, eax
je 0x1000aae1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x1000aaab
push 3
lea ecx, [ebp - 0xaf4]
call fcn.100159d0
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x124], 0x7df2f4a8
mov dword [ebp - 0x1f0], 0
jmp 0x1000ab1a
mov eax, dword [ebp - 0x1f0]
inc eax
mov dword [ebp - 0x1f0], eax
cmp dword [ebp - 0x1f0], 3
jge 0x1000ab3c
push dword [ebp - 0x1f0]
lea ecx, [ebp - 0xaf4]
call fcn.10015a6e
mov dword [eax], 0xff0ea75c
jmp 0x1000ab0d
mov dword [ebp - 0x124], 2
jmp 0x1000ab55
mov eax, dword [ebp - 0x124]
dec eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 0
jl 0x1000ac2c
mov dword [ebp - 0x188], 0
jmp 0x1000ab7b
mov eax, dword [ebp - 0x188]
inc eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 3
jge 0x1000ab97
mov eax, dword [ebp - 0x188]
mov dword [ebp + eax*4 - 0x94c], 0x6801fc3e
jmp 0x1000ab6e
mov byte [ebp - 0xd4], 0
movzx eax, byte [ebp - 0xd4]
test eax, eax
je 0x1000abb5
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
push dword [ebp - 0x124]
lea ecx, [ebp - 0xaf4]
call fcn.10015a6e
cmp dword [eax], 0
je 0x1000abcd
jmp 0x1000ac2c
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x94c], 2
jmp 0x1000abfb
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x94c]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x94c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x94c], 0
jl 0x1000ac27
mov byte [ebp - 0xd6], 0
movzx eax, byte [ebp - 0xd6]
test eax, eax
je 0x1000ac25
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x1000abe0
jmp 0x1000ab48
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xaf4]
call fcn.10015a52
mov dword [ebp - 0x9c0], 5
mov dword [ebp - 0x9bc], 5
mov dword [ebp - 0x9b8], 5
mov dword [ebp - 0x9b4], 5
lea ecx, [ebp - 0x221]
call fcn.10015a7d
push eax
lea eax, [ebp - 0x9b0]
push eax
lea eax, [ebp - 0x9c0]
push eax
lea ecx, [ebp - 0xe24]
call fcn.10015a80
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x340]
call fcn.10015a2c
mov dword [ebp - 4], 0x12
mov dword [ebp - 0x2c4], 1
push 3
lea ecx, [ebp - 0xb0c]
call fcn.100159d0
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x43c], 0
mov dword [ebp - 0x924], 0x7b400765
mov dword [ebp - 0x58], 0
jmp 0x1000acde
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1000acfa
push dword [ebp - 0x58]
lea ecx, [ebp - 0xb0c]
call fcn.10015a6e
mov dword [eax], 0x2891ba8
jmp 0x1000acd7
mov dword [ebp - 0x58], 0
jmp 0x1000ad0a
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 4
jge 0x1000ad20
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0xdbc], 0xfffffff7
jmp 0x1000ad03
push 0
lea ecx, [ebp - 0x340]
call fcn.10015a6e
push 3
lea ecx, [ebp - 0x340]
call fcn.10015a6e
mov esi, eax
push 2
lea ecx, [ebp - 0x340]
call fcn.10015a6e
mov esi, dword [esi]
imul esi, dword [eax]
dec esi
dec esi
push 3
lea ecx, [ebp - 0x340]
call fcn.10015a6e
cmp esi, dword [eax]
jne 0x1000ad6d
mov dword [ebp - 0x42c], 1
jmp 0x1000ad74
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0x17f
jne 0x1000ad9e
cmp dword [ebp - 0x2c4], 0
jne 0x1000ad9e
and dword [ebp - 0x274], 0
jmp 0x1000ada8
mov dword [ebp - 0x274], 1
push 2
lea ecx, [ebp - 0xb0c]
call fcn.10015a6e
mov ecx, dword [ebp - 0x274]
mov dword [eax], ecx
cmp dword [ebp - 0x274], 0xf2f3
jle 0x1000add5
mov dword [ebp - 0x5f4], 1
jmp 0x1000addc
and dword [ebp - 0x5f4], 0
push 3
lea ecx, [ebp - 0x340]
call fcn.10015a6e
mov ecx, dword [ebp - 0x5f4]
imul ecx, dword [eax]
cmp ecx, 0xbd3e018e
jae 0x1000ae06
mov dword [ebp - 0x434], 1
jmp 0x1000ae0d
and dword [ebp - 0x434], 0
push 3
lea ecx, [ebp - 0x340]
call fcn.10015a6e
mov ecx, dword [ebp - 0x434]
cmp ecx, dword [eax]
jle 0x1000ae30
mov dword [ebp - 0x744], 1
jmp 0x1000ae37
and dword [ebp - 0x744], 0
mov eax, dword [ebp - 0x744]
mov dword [ebp - 0x43c], eax
cmp dword [ebp - 0x43c], 0
jne 0x1000ae58
mov dword [ebp - 0x5fc], 1
jmp 0x1000ae5f
and dword [ebp - 0x5fc], 0
push 3
lea ecx, [ebp - 0x340]
call fcn.10015a6e
imul eax, dword [eax], 0x7329
mov ecx, dword [ebp - 0x5fc]
neg ecx
cmp eax, ecx
jl 0x1000ae8a
mov dword [ebp - 0x444], 1
jmp 0x1000ae91
and dword [ebp - 0x444], 0
push 3
lea ecx, [ebp - 0x340]
call fcn.10015a6e
mov esi, dword [eax]
imul esi, dword [ebp - 0x444]
push 0
lea ecx, [ebp - 0x340]
call fcn.10015a6e
sub esi, dword [eax]
je 0x1000aec4
mov dword [ebp - 0x6dc], 1
jmp 0x1000aecb
and dword [ebp - 0x6dc], 0
cmp dword [ebp - 0x6dc], 0xe10d32de
jne 0x1000aee3
mov dword [ebp - 0x44c], 1
jmp 0x1000aeea
and dword [ebp - 0x44c], 0
mov eax, dword [ebp - 0x924]
cmp dword [ebp - 0x44c], eax
jne 0x1000af04
mov dword [ebp - 0x604], 1
jmp 0x1000af0b
and dword [ebp - 0x604], 0
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x604]
mov dword [ebp + eax - 0xdbc], ecx
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0xb0c]
call fcn.10015a52
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x340]
call fcn.10015a52
mov dword [ebp - 0xbb4], 0x862f
mov byte [ebp - 0xb6], 0
movzx eax, byte [ebp - 0xb6]
test eax, eax
je 0x1000af61
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov byte [ebp - 0xd8], 0
movzx eax, byte [ebp - 0xd8]
test eax, eax
je 0x1000af79
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [ebp - 0x94], 1
push 3
lea ecx, [ebp - 0xc74]
call fcn.100159d0
mov dword [ebp - 4], 0x14
mov dword [ebp - 0xbbc], 0xfcfbce00
mov dword [ebp - 0x1d0], 0
jmp 0x1000afba
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 3
jge 0x1000afdc
push dword [ebp - 0x1d0]
lea ecx, [ebp - 0xc74]
call fcn.10015a6e
mov dword [eax], 0x4ebb0cb8
jmp 0x1000afad
mov dword [ebp - 0x94], 0
jmp 0x1000aff5
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0x11
jge 0x1000b096
mov dword [ebp - 0x190], 0xcdf98a59
mov byte [ebp - 0xb8], 0
movzx eax, byte [ebp - 0xb8]
test eax, eax
je 0x1000b024
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 0x190], 0
jmp 0x1000b03d
cmp dword [ebp - 0x190], 0xfffffffb
je 0x1000b091
mov byte [ebp - 0xde], 0
movzx eax, byte [ebp - 0xde]
test eax, eax
je 0x1000b075
push 0
push 0x15c
push 0x53
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
mov byte [ebp - 0xbd], 0
movzx eax, byte [ebp - 0xbd]
test eax, eax
je 0x1000b08f
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x1000b030
jmp 0x1000afe8
mov dword [ebp - 0x94], 0
jmp 0x1000b0af
cmp dword [ebp - 0x94], 2
jg 0x1000b159
mov dword [ebp - 0x198], 0xc79e672c
mov dword [ebp - 0x210], 0
jmp 0x1000b0df
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 1
jge 0x1000b0fb
mov eax, dword [ebp - 0x210]
mov dword [ebp + eax*4 - 0xbc4], 0xfffffffb
jmp 0x1000b0d2
mov dword [ebp - 0x198], 2
jmp 0x1000b114
cmp dword [ebp - 0x198], 0
jl 0x1000b154
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc74]
call fcn.10015a52
mov dword [ebp - 0x1d8], 0xd5e48d32
mov dword [ebp - 0xbf4], 0x3c8fc558
mov dword [ebp - 0x1d8], 0x1a
jmp 0x1000b195
cmp dword [ebp - 0x1d8], 0xfffffff1
jl 0x1000b1c0
mov byte [ebp - 0xa9], 0
movzx eax, byte [ebp - 0xa9]
test eax, eax
je 0x1000b1be
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x1000b188
mov dword [ebp - 0x44], 0x647dc4b4
push 1
lea ecx, [ebp - 0xaa0]
call fcn.100159d0
mov dword [ebp - 4], 0x15
mov dword [ebp - 0x74c], 0xfffffffb
mov dword [ebp - 0x808], 0
mov dword [ebp - 0x5c], 0
jmp 0x1000b1ff
cmp dword [ebp - 0x5c], 1
jge 0x1000b215