Function at 0x401c25
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x4c51bd
call fcn.004c4dd0
sub esp, 0x1f4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x48], edx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x24], 0x62db8e96
xor edi, edi
inc edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x24], 0xa87a5eaf
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], 0xe13f5e3
mov dword [ebp - 0x2c], 0x3703
mov dword [ebp - 0x30], 0x72737ae9
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
jmp 0x401c9a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xec], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x401c89
mov dword [ebp - 0x24], 0x9310
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setl dl
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp eax, ecx
setle dl
add edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
cmp eax, edx
setl cl
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
mov esi, dword [ebp - 0x20]
sub esi, edx
neg esi
sbb esi, esi
inc esi
mov ecx, dword [ebp - 0x28]
imul ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
imul eax, esi
sub ecx, eax
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x28]
cmp ecx, eax
mov ecx, edi
cmovg ecx, ebx
mov eax, dword [ebp - 0x18]
imul eax, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0xa6eb
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0xe8], edx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0xd800
setg cl
xor eax, eax
cmp edx, ecx
setg al
mov dword [ebp - 0x24], eax
push 3
pop esi
cmp byte [ebp - 0x11], bl
je 0x40301b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x18], 0x185299da
mov dword [ebp - 0x24], 0xbeb0647d
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x28], 0xee39f3fa
push esi
lea ecx, [ebp - 0x1cc]
call fcn.0040b279
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x48], 0xc5ad058b
mov dword [ebp - 0x1c], ebx
jmp 0x401db4
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1cc]
mov dword [eax + ecx*4], 0xf3b8cff2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x401da1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], ebx
je 0x401dca
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 0x14b5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, ecx
setl dl
imul edx, dword [ebp - 0x18]
xor eax, eax
cmp edx, dword [ebp - 0x30]
setge al
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
je 0x401dfd
cmp dword [ebp - 0x18], ebx
jne 0x401e00
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 0x7af2c9a1
lea ecx, [ebp - 0x1cc]
call fcn.0040b34b
lea eax, [ebp + 8]
mov dword [ebp - 0x48], eax
push edi
lea ecx, [ebp - 0x138]
call fcn.0040b279
mov dword [ebp - 0x40], 0x38dd
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], 0x27213ec7
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x1c], ebx
jmp 0x401e6a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x138]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x401e57
dec dword [ebp - 0x28]
lea ecx, [ebp - 0x138]
call fcn.0040b34b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0x1c], ebx
jmp 0x401e99
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x68], 9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x401e8b
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x60], 0xbfb66feb
sbb ecx, ecx
neg ecx
mov eax, dword [ebp - 0x60]
imul eax, ecx
test eax, eax
jne 0x401f00
cmp dword [ebp - 0x64], ebx
jne 0x401f00
mov dword [ebp - 0x1c], 0xc9b996a5
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x1c], ebx
jmp 0x401ef8
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x401ef0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x68], 0xb64d07dd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x401ee2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x401ed6
jmp 0x401f0e
mov dword [ebp - 0x2c], 0xcdf1
mov dword [ebp - 0x2c], 0xcdf9c775
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 0x2c29a3df
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], 0x3cc25429
mov dword [ebp - 0x18], ebx
jmp 0x401f45
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x90], 0xf1124f01
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x401f34
mov dword [ebp - 0x18], ebx
jmp 0x401f60
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a4], 0xfa72c25
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x401f4f
mov dword [ebp - 0x20], ebx
jmp 0x401fb8
mov dword [ebp - 0x38], 0x449c9fb3
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0xbb6bc3ec
push edi
lea ecx, [ebp - 0x158]
call fcn.0040b279
mov dword [ebp - 0x1c], ebx
jmp 0x401fa2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x401f93
inc dword [ebp - 0x28]
lea ecx, [ebp - 0x158]
call fcn.0040b34b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x401f6a
cmp dword [ebp - 0x30], ebx
je 0x401fd4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x402046
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x402046
push edi
lea ecx, [ebp - 0x120]
call fcn.0040b279
mov dword [ebp - 0x1c], ebx
jmp 0x401ff8
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x120]
mov dword [eax + ecx*4], 0xb3493876
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x401fe5
mov ecx, dword [ebp - 0x90]
mov eax, dword [ebp - 0x2c]
xor edx, edx
cmp ecx, eax
setne dl
dec edx
mov eax, dword [ebp - 0x24]
xor ebx, ebx
cmp edx, eax
setg bl
mov eax, dword [ebp - 0x24]
xor ecx, ecx
cmp eax, 0xce6fc2e7
setl cl
xor edx, edx
cmp ecx, ebx
setge dl
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
lea ecx, [ebp - 0x120]
call fcn.0040b34b
xor ebx, ebx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], 0xc3a0b8ee
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x34], 8
push 4
lea ecx, [ebp - 0x8c]
call fcn.0040b279
mov dword [ebp - 0x24], 0x274952f
mov dword [ebp - 0x28], 0x4361a6b7
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 0x17d239f9
mov dword [ebp - 0x38], 0xb826fbc7
mov dword [ebp - 0x1c], ebx
jmp 0x4020a5
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x402092
cmp dword [ebp - 0x20], ebx
je 0x4020f6
mov eax, dword [ebp - 0x28]
inc dword [ebp - 0x28]
cmp eax, 0x6173
jne 0x4020db
mov edx, dword [ebp - 0x8c]
xor eax, eax
cmp dword [edx + 0xc], eax
setl al
xor ecx, ecx
cmp eax, dword [edx + 0xc]
setne cl
imul ecx, dword [edx]
cmp ecx, dword [ebp - 0x20]
jle 0x4020e2
cmp dword [ebp - 0x24], ebx
mov ecx, ebx
je 0x4020e4
mov ecx, edi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
imul eax, ecx
test eax, eax
mov ecx, edi
jne 0x4020f8
mov ecx, ebx
mov eax, dword [ebp - 0x20]
add eax, ecx
jne 0x402104
cmp dword [ebp - 0x24], ebx
je 0x402106
mov ebx, edi
mov eax, dword [ebp - 0x8c]
mov dword [eax + 0xc], ebx
inc dword [ebp - 0x30]
jne 0x40211d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x8c]
mov dword [eax + 4], edi
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], 0xa26c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
xor edx, edx
cmp eax, ecx
setge dl
mov eax, dword [ebp - 0x18]
xor ebx, ebx
cmp edx, eax
setg bl
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp eax, ebx
setge cl
mov dword [ebp - 0x34], ecx
lea ecx, [ebp - 0x8c]
call fcn.0040b34b
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x18], 0x16
xor ebx, ebx
cmp dword [ebp - 0x18], 0xfffffffe
jg 0x4021a9
mov dword [ebp - 0x1c], 0xfffffffc
mov dword [ebp - 0x1c], ebx
jmp 0x40219e
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x402195
cmp dword [ebp - 0x20], ebx
jne 0x40219b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xe
jle 0x40218d
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffe8
je 0x402181
dec dword [ebp - 0x18]
jmp 0x40216f
mov dword [ebp - 0x24], 0xac204e2d
mov dword [ebp - 0x2c], 0xf6872920
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x4021d0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x14c], 0x14a02569
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x4021bf
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x4021ea
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x2c], eax
mov eax, 0x4ab462a7
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x108], eax
mov dword [ebp - 0x18], 0x185299da
mov dword [ebp - 0x24], 0xbeb0647d
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x34], 0xee39f3fa
push esi
lea ecx, [ebp - 0x164]
call fcn.0040b279
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0xc5ad058b
mov dword [ebp - 0x1c], ebx
jmp 0x40225e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x164]
mov dword [eax + ecx*4], 0xf3b8cff2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x40224b
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x18], ebx
mov dword [ebp - 0x28], ebx
je 0x402274
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], 0x14b5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, ecx
setl dl
imul edx, dword [ebp - 0x18]
xor eax, eax
cmp edx, dword [ebp - 0x28]
setge al
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
je 0x4022a7
cmp dword [ebp - 0x18], ebx
jne 0x4022aa
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 0x7af2c9a1
lea ecx, [ebp - 0x164]
call fcn.0040b34b
mov dword [ebp - 0x24], 0xffffffe3
cmp dword [ebp - 0x24], 0xe
jle 0x402cdb
push 4
lea ecx, [ebp - 0xbc]
call fcn.0040b279
or ecx, 0xffffffff
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x40230a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xc8], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4022fd
mov dword [ebp - 0x50], 2
cmp dword [ebp - 0x50], ebx
jl 0x4023cb
push esi
lea ecx, [ebp - 0x104]
call fcn.0040b279
mov dword [ebp - 0x34], 0xb9dbea52
mov dword [ebp - 0x34], 0x8382bdb9
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x402354
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0x374c7af
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x402341
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0xc8]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x104]
mov dword [eax + 8], ecx
mov dword [ebp - 0x34], ecx
cmp dword [ebp - 0x34], ebx
je 0x40238d
cmp dword [ebp - 0x50], ebx
jne 0x40237f
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x50]
cmp dword [ebp + eax*4 - 0xc8], edi
mov eax, edi
jg 0x40238f
mov eax, ebx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0xc8]
mov ecx, dword [ebp - 0x34]
sub ecx, eax
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp + eax*4 - 0xc8]
imul eax, ecx
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x104]
call fcn.0040b34b
dec dword [ebp - 0x50]
jns 0x40231f
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x4023db
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x2c], 0x5761be36
mov dword [ebp - 0x30], 0x41311e2d
mov dword [ebp - 0x18], 0xbd4856cd
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x3c], 0x7b00
cmp dword [ebp - 0x3c], 0x7be0
jle 0x402469
mov eax, ebx
mov dword [ebp - 0x28], ebx
mov ecx, ebx
mov dword [ebp - 0x34], ebx
cdq
idiv ecx
mov eax, edx
cdq
push edx
push eax
lea ecx, [ebp - 0x200]
call fcn.00401a48
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x402438
mov eax, dword [eax]
push eax
call fcn.004af8e7
pop ecx
push ebx
push edi
lea ecx, [ebp - 0x200]
call fcn.0040b827
mov ecx, dword [ebp - 0x34]
inc ecx
mov dword [ebp - 0x34], ecx
cmp ecx, 0x1782
mov eax, dword [ebp - 0x28]
jl 0x40241b
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x5935
jl 0x402416
cmp dword [ebp - 0x1c], 0xf72d4ea6
jbe 0x40249a
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0xd94b
setg cl
mov eax, 0x81d21f1e
cmp eax, ecx
sbb eax, eax
inc eax
mov ecx, 0xa831d26e
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x1c]
mov ecx, edi
jg 0x40249c
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
add eax, ecx
je 0x40251a
mov dword [ebp - 0x20], 0xfffa
mov dword [ebp - 0x34], 0x799333c7
mov dword [ebp - 0x2c], 0x58f5537c
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x38], 0xf7bdd484
mov dword [ebp - 0x28], edi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x4024e8
push ebx
push 0x172
push 0x11df
push 0xab0
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], ebx
je 0x4024f9
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp ecx, eax
setl dl
mov dword [ebp - 0x30], edx
jmp 0x40267f
push 4
lea ecx, [ebp - 0x74]
call fcn.0040b279
mov dword [ebp - 0x2c], 0xc1dc0ac7
mov dword [ebp - 0x18], ebx
jmp 0x402540
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x74]
mov dword [eax + ecx*4], 0x4f163671
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x402530
mov dword [ebp - 0x18], ebx
jmp 0x40255c
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x190], 0x9c36de1f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x40254b
mov dword [ebp - 0x20], ebx
jmp 0x40266e
mov dword [ebp - 0xe4], 0x21a1
mov dword [ebp - 0xe0], 0x21a1
mov dword [ebp - 0xdc], 0x21a1
mov dword [ebp - 0xd8], 0x21a1
mov dword [ebp - 0x28], 0x3e67b33d
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x4025b8
push ebx
push 0x402
push 0x158c
push 0x182a
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x4025c9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x40266b
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp eax, edi
setge cl
xor ebx, ebx
mov eax, dword [ebp - 0x74]
cmp ecx, dword [eax + edx*4]
setne bl
mov eax, dword [ebp - 0x30]
xor edx, edx
cmp ebx, eax
setge dl
xor ecx, ecx
mov eax, dword [ebp - 0x74]
cmp edx, dword [eax + esi*4]
setge cl
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0xe4]
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0xd8]
xor ecx, ecx
cmp edx, eax
setg cl
mov esi, dword [ebp - 0x2c]
cmp ecx, dword [esi + 0xc]
je 0x402634
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x74]
mov eax, dword [ecx + eax*4]
xor ebx, ebx
cmp eax, dword [ecx + edx*4]
setge bl
mov dword [esi + 0xc], ebx
mov dword [ebp - 0x190], ebx
mov dword [ebp - 0x30], ebx
dec dword [ebp - 0x18]
jns 0x4025db
xor ebx, ebx
push 3
pop esi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x40256a
lea ecx, [ebp - 0x74]
call fcn.0040b34b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x3c], 0x7aec
jge 0x402696
push str.kdf_badmfnf_goif_rdqhqn_xqkcdv_deitg_kaskfe_ksrbr_azrrqcgx
call fcn.004af8e7
pop ecx
or dword [ebp - 4], 0xffffffff
jmp 0x4026c2
mov dword [ebp - 0x18], 0xffffffed
jmp 0x402700
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x4026fd
push 0x2076
push 0xf72
push 0x4c9
push 0x2682
push 0x21f3
push 0x2484
push 0x25d8
call dword [sym.imp.GDI32.dll_RoundRect]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jge 0x4026cb
mov dword [ebp - 0x20], 0x60477862
mov dword [ebp - 0x2c], 0xdfc9b996
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0xf4df7b14
mov dword [ebp - 0x2c], 0xfffffff6
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x2c], 0xfffffffd
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x2c], 5
push 2
lea ecx, [ebp - 0x17c]
call fcn.0040b279
push 2
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x2c], 0xbb5fb49a
mov dword [ebp - 0x3c], 0xffff
mov dword [ebp - 0x1c], ebx
jmp 0x40277a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x17c]
mov dword [eax + ecx*4], 0x205300ce
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x402767
mov dword [ebp - 0x20], ebx
jmp 0x4027ca
mov dword [ebp - 0x30], 0xffff
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
xor ecx, ecx
test eax, eax
setle cl
cmp ecx, dword [ebp - 0x20]
je 0x4027a7
cmp dword [ebp - 0x30], ebx
mov edx, ebx
je 0x4027a9
mov edx, edi
mov eax, dword [ebp - 0x30]
dec eax
neg eax
sbb eax, eax
inc eax
xor ecx, ecx
cmp eax, edx
setg cl
mov eax, dword [ebp - 0x20]
add eax, ecx
cmp eax, 7
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xf
je 0x402784
dec dword [ebp - 0x3c]
lea ecx, [ebp - 0x17c]
call fcn.0040b34b
mov dword [ebp - 0x1c], ebx
jmp 0x4027f6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0x7ca0029b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x4027e3
push edi
lea ecx, [ebp - 0x188]
call fcn.0040b279
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x2c], 0xfffffff8
push 8
pop eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x3c], 0xffff
mov dword [ebp - 0x1c], ebx
jmp 0x402853
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x188]
mov dword [eax + ecx*4], 0x1713b910
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x402840
mov dword [ebp - 0x30], ebx
cmp dword [ebp - 0x30], ebx
jl 0x402931
push 2
lea ecx, [ebp - 0x1c0]
call fcn.0040b279
mov dword [ebp - 0x2c], 0x4678dc2a
mov dword [ebp - 0x2c], 9
push esi
lea ecx, [ebp - 0x170]
call fcn.0040b279
mov dword [ebp - 0x2c], 0xd9827359
mov dword [ebp - 0x18], ebx
jmp 0x4028aa
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c0]
mov dword [eax + ecx*4], 0x7be7e550
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x402897
mov dword [ebp - 0x18], ebx
jmp 0x4028c8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x170]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x4028b5
dec dword [ebp - 0x3c]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x402912
push ebx
push 0x62f
push 0x2000
push 0x213b
push 0x26d5
push 0x877
push 0x1ede
push 0x979
push 0xefc
push 0xf3f
push 0x1a75
call dword [sym.imp.GDI32.dll_StretchBlt]
lea ecx, [ebp - 0x170]
call fcn.0040b34b
lea ecx, [ebp - 0x1c0]
call fcn.0040b34b
dec dword [ebp - 0x30]
jns 0x402864
lea ecx, [ebp - 0x188]
call fcn.0040b34b
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x402b8c
mov dword [ebp - 0x28], 0xae355683
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 0xffffffeb
jle 0x402ae9
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], 0xffffffff
cmp dword [ebp - 0x30], 0xffffffff
jg 0x402ae1
mov dword [ebp - 0x18], 0x26d2e858
mov dword [ebp - 0x1c], ebx
jmp 0x402994
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1e8], esi
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x402987
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xffffffe7
jne 0x402ab1
mov dword [ebp - 0x2c], 0x5bc3
cmp dword [ebp - 0x2c], 0x5f31
jle 0x402a06
mov eax, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov dword [ebp - 0x38], ebx
cdq
idiv ecx
mov eax, edx
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x34], 0xd47
cdq
push edx
push eax
mov ecx, 0xade298
call fcn.0040b052
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
dec dword [ebp - 0x34]
jne 0x4029d0
mov ecx, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x38], ecx
cmp ecx, 0x46d0
mov eax, dword [ebp - 0x1c]
jl 0x4029c1
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x1fa7
jl 0x4029bc
push edi
lea ecx, [ebp - 0xd4]
call fcn.0040b279
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x5a6a
jge 0x402a31
mov edx, str.limgitcw_goog_sxjkzhftw_epojdkzn_qez_uahlgre_xthri
mov ecx, 0xade298
call fcn.0040d8d7
or dword [ebp - 4], 0xffffffff
jmp 0x402a5d
mov dword [ebp - 0x1c], ebx
jmp 0x402a75
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], 0xbc7dcd66
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x402a62
mov eax, dword [ebp - 0xd4]
mov dword [eax], ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
jne 0x402aaa
mov eax, dword [ebp - 0xd4]
inc dword [eax]
cmp dword [eax], esi
jle 0x402a82
lea ecx, [ebp - 0xd4]
call fcn.0040b34b
dec dword [ebp - 0x18]
jmp 0x40299d
push ebx
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x402ad9
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x402aca
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x1e8]
dec dword [ebp - 0x18]
jns 0x402ab9
inc dword [ebp - 0x30]
jmp 0x402971
dec dword [ebp - 0x28]
jmp 0x402952
push 2
lea ecx, [ebp - 0x1b0]
call fcn.0040b279
mov dword [ebp - 0x30], ebx
jmp 0x402b0e
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1b0]
mov dword [eax + ecx*4], 0x1b0c
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x402afb
mov eax, dword [ebp - 0x20]
mov ecx, edi
sub ecx, eax
add ecx, dword [ebp - 0x20]
je 0x402b27
cmp dword [ebp - 0x24], ebx
mov edx, edi
jne 0x402b29
mov edx, ebx
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0xbc]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax + ecx*4]
mov dword [esi + edi*4], eax
lea eax, [edx + 0x886a]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov edx, dword [ebp - 0x2c]
sub edx, 0x3e3f
neg edx
sbb edx, edx
inc edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
setne cl
imul ecx, dword [esi + edi*4]
neg ecx
mov dword [ebp - 0x10c], ecx
lea ecx, [ebp - 0x1b0]
call fcn.0040b34b
dec dword [ebp - 0x20]
xor edi, edi
inc edi
push 3
pop esi
jmp 0x40293f
mov dword [ebp - 0x2c], 0x8748
mov dword [ebp - 0x18], 7
push 2
lea ecx, [ebp - 0xf8]
call fcn.0040b279
mov dword [ebp - 0x28], 0xfffffff6
mov dword [ebp - 0x38], 0xfffffffd
mov dword [ebp - 0x20], ebx
jmp 0x402bcb
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xac], 0xfffffffe
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x402bba
mov dword [ebp - 0x20], ebx
jmp 0x402be8
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0xa2e712c5
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x402bd5
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x2c], 0x52c58fb7
mov dword [ebp - 0xac], edi
mov eax, dword [ebp - 0xf8]
mov dword [eax], edi
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edi
setle cl
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
setl dl
imul edx, dword [ebp - 0x18]
sub edx, 0x1210
cmp edx, 0x90ef874a
sbb ecx, ecx
inc ecx
add ecx, dword [ebp - 0x18]
xor eax, eax
cmp ecx, 0xffffffff
setne al
cmp eax, 0xffffffff
sbb edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, ecx
setge dl
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xa8]
mov eax, dword [ebp - 0x38]
xor edx, edx
cmp ecx, eax
setge dl
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x18], 0x11
jmp 0x402cab
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x402ca8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1c
jge 0x402c99
lea ecx, [ebp - 0xf8]
call fcn.0040b34b
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax + 0xc]
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0xbc]
call fcn.0040b34b
inc dword [ebp - 0x24]
jmp 0x4022cf
push edi
lea ecx, [ebp - 0x12c]
call fcn.0040b279
mov dword [ebp - 0x20], ebx
jmp 0x402cfa
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x44], 0x4fd3df75
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x402cec
mov dword [ebp - 0x2c], 0x43b1
cmp dword [ebp - 0x2c], 0x465f
jle 0x402d58
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov eax, edi
cdq
idiv dword [ebp - 0x24]
lea eax, [ecx + edx]
cdq
push edx
push eax
mov ecx, 0xade298
call fcn.0040b052
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x342c
mov ecx, dword [ebp - 0x28]
jl 0x402d19
inc edi
cmp edi, 0x15a
jl 0x402d16
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x5154
jl 0x402d14
xor edi, edi
inc edi
mov dword [ebp - 0x20], ebx
jmp 0x402d6c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x12c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x402d5d
mov dword [ebp - 4], 4
cmp dword [ebp - 0x2c], 0x40c1
jge 0x402d90
mov edx, str.konb_nneabfsdl_ritgr_axowtgpp_pswuoaj
mov ecx, 0xade298
call fcn.0040d8d7
or dword [ebp - 4], 0xffffffff
jmp 0x402dbc
mov dword [ebp - 0x44], 0x1b
jmp 0x402ddc
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x402dd9
push 0x44c
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
dec dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0xffffffe9
jne 0x402dc5
lea ecx, [ebp - 0x12c]
call fcn.0040b34b
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x402dfe
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
mov dword [ebp - 0x20], 0xfff8
mov eax, 0x960f
mov dword [ebp - 0xa0], eax
mov dword [ebp - 0x9c], eax
mov dword [ebp - 0x98], eax
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x18], 0x69c1477a
mov dword [ebp - 0x28], 0xfffffffd
mov dword [ebp - 0x2c], 5
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x24], ebx
jmp 0x402e50
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1d8], 0xffffffff
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x402e3f
inc dword [ebp - 0x20]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jg 0x402feb
push 2
lea ecx, [ebp - 0x80]
call fcn.0040b279
mov dword [ebp - 0x2c], 0x5c1b
mov dword [ebp - 0x3c], 0x1cd43a1e
mov dword [ebp - 0x2c], 0xfffffffa
mov dword [ebp - 0x24], ebx
jmp 0x402e98
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x80]
mov dword [eax + ecx*4], 0x6be856df
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x402e88
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x402eae
push ebx
call dword [sym.imp.USER32.dll_SetCursor]
mov esi, dword [ebp - 0x80]
lea edx, [esi + 4]
mov dword [ebp - 0x2c], edx
cmp dword [edx], ebx
jne 0x402ecb
imul eax, dword [esi], 0xffff
cmp eax, dword [esi]
jge 0x402ecb
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x80]
mov eax, dword [esi]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
push 7
pop esi
sub esi, dword [edx]
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp eax, 0x57b17b4d
setne dl
sub edx, dword [ebp - 0x18]
xor ecx, ecx
cmp esi, edx
setle cl
xor eax, eax
mov esi, dword [ebp - 0x2c]
cmp ecx, dword [esi]
setg al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jne 0x402f0e
cmp dword [ebp - 0x28], ebx
mov ecx, ebx
je 0x402f10
mov ecx, edi
mov eax, dword [ebp - 0x80]
cmp ecx, dword [eax]
jle 0x402f1e
cmp dword [ebp - 0x18], ebx
mov edx, edi
jne 0x402f20
mov edx, ebx
mov ecx, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xa0], ecx
imul ecx, edx
sub ecx, dword [esi]
add ecx, 0xfffffff6
mov dword [esi], ecx
mov eax, dword [ebp - 0x3c]
imul eax, ecx
test eax, eax
je 0x402f4e
cmp dword [ebp - 0x9c], ebx
mov ecx, edi
jne 0x402f50
mov ecx, ebx
xor eax, eax
cmp ecx, 0xfffffffa
sete al
mov dword [ebp - 0x1d4], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x80]
cmp dword [eax], ecx
jne 0x402f72
cmp dword [ebp - 0xa0], ebx
mov edx, edi
jne 0x402f74
mov edx, ebx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
sete cl
mov eax, dword [ebp - 0x20]
xor edx, edx
cmp ecx, eax
setl dl
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [ebp - 0x18]
jge 0x402fab
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x402fd6
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x402fd6
mov dword [ebp - 0x2c], 0xfc71010f
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x2c], 0x206cbc8c
mov dword [ebp - 0x24], ebx
jmp 0x402fce
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1b4], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edi
jl 0x402fc1
inc dword [ebp - 0x38]
lea ecx, [ebp - 0x80]
call fcn.0040b34b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x402e64
push 0x64e6
push dword [ebp - 0xb0]
push dword [ebp - 0x40]
push 0x22d
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
push eax
push 0x7309
push ebx
push dword [ebp - 0x4c]
call fcn.00407f0b
add esp, 0x20
jmp 0x403167
mov dword [ebp - 0x20], 0x4e2
mov dword [ebp - 0x24], ebx
jmp 0x403038
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x144], 0x898f01ba
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x403027
dec dword [ebp - 0x20]
mov dword [ebp - 0x20], ebx
jmp 0x40313f
mov dword [ebp - 0x18], 0xea122098
cmp dword [ebp - 0x20], ebx
je 0x4030ab
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x24], 0x1b17d72b
mov dword [ebp - 0x4c], edi
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x140], eax
dec dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor edx, edx
cmp ecx, eax
setle dl
add edx, 0x108fc3a9
mov eax, dword [ebp - 0x18]
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x40312c
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x40312c
mov dword [ebp - 0x24], 0xae7b1b0c
mov dword [ebp - 0x24], ebx
jmp 0x403111
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], ebx
jl 0x40310e
mov dword [ebp - 0x1c], 0x29207965
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x4030ee
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x1c], ebx
jmp 0x403104
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x144], 0x653e3f36
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x4030f3
dec dword [ebp - 0x28]
jns 0x4030d6
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jle 0x4030c3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x403127
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
dec dword [ebp - 0x18]
jns 0x4030b7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x40313c
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x12
jl 0x403048
push ebx
push dword [ebp + 0x18]
push dword [ebp - 0x48]
push 0x2dcd
push 0x12a6
push 0x63fd
call fcn.0040a000
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret