Function at 0x10028926
Capabilities:
Get thread local storage value
Query environment variable
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1008e9cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push ebx
push esi
xor ebx, ebx
mov dword [esp + 0x10], 0x6fe6d39c
push edi
mov dword [esp + 0xa4], edx
mov dword [esp + 0x58], ecx
mov dword [esp + 0x18], ebx
jmp 0x10028971
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x5c], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10028965
mov eax, dword [esp + 0x64]
xor edx, edx
mov eax, dword [esp + 0x14]
mov esi, 0x6e87
mov ecx, dword [esp + 0x5c]
mov eax, dword [esp + 0x64]
cmp eax, ecx
mov eax, dword [esp + 0x5c]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x64]
setne dl
imul edx, eax
mov eax, dword [esp + 0x5c]
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, esi
setg dl
xor ecx, ecx
cmp edx, 0x8064
setg cl
sub eax, ecx
mov ecx, 0xfff9
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x4d
setle cl
mov dword [esp + 0x64], ecx
mov dword [esp + 0x14], ebx
jmp 0x10028a0b
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x5c], ebx
jne 0x10028a12
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + eax*4 + 0x5c]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x5c], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x100289ed
push 1
lea ecx, [esp + 0x130]
call fcn.1001a25e
mov dword [esp + 0x18], 0x52061f66
mov dword [esp + 0x18], ebx
jmp 0x10028a44
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x12c]
mov dword [eax + ecx*4], 0x8d327cb3
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jl 0x10028a2e
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x10028a70
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x12c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x18]
jns 0x10028a55
mov edi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10028a94
push 0x24b9
push ebx
push 0x250c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
lea ecx, [esp + 0x12c]
call fcn.1001ab22
push 2
lea ecx, [esp + 0x8c]
call fcn.1001a25e
mov dword [esp + 0x24], 3
mov dword [esp + 0x18], 0xd3650dfa
mov dword [esp + 0x18], ebx
jmp 0x10028ada
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x88]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jl 0x10028ac4
mov dword [esp + 0x24], 1
cmp dword [esp + 0x24], ebx
jl 0x10028c27
mov dword [esp + 0x14], 0x2a2c7c8a
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], ebx
jl 0x10028bbe
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10028b31
push 0x23c5
push 0x1a04
push 0x953
push 0x26eb
call dword [sym.imp.GDI32.dll_CreateRectRgn]
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
add eax, dword [esp + 0x24]
je 0x10028b48
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x14]
cmp eax, 0x63a7
setge cl
add ecx, 0xde65903
cmp ecx, 0xb8ce
jge 0x10028b72
cmp dword [esp + 0x24], ebx
jne 0x10028b72
mov edx, ebx
jmp 0x10028b75
xor edx, edx
inc edx
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x88]
cmp dword [eax + ecx*4], edx
jge 0x10028b90
cmp dword [esp + 0x14], ebx
je 0x10028b90
xor ecx, ecx
inc ecx
jmp 0x10028b92
mov ecx, ebx
mov esi, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + 0x24]
cmp ecx, eax
mov eax, dword [esp + 0x88]
sete dl
xor ecx, ecx
cmp dword [eax + esi*4], edx
sete cl
mov dword [esp + 0x18], ecx
dec dword [esp + 0x14]
jns 0x10028b0d
mov dword [esp + 0x18], ebx
jmp 0x10028c11
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], ebx
jl 0x10028c0d
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x88]
cmp dword [eax + ecx*4], ebx
jne 0x10028c0d
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10028c07
push ebx
push 0x26f2
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
dec dword [esp + 0x14]
jns 0x10028bd2
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x10028bc4
dec dword [esp + 0x24]
jns 0x10028af3
mov esi, 0x6e87
lea ecx, [esp + 0x88]
call fcn.1001ab22
mov dword [esp + 0x1c], 1
lea ecx, [esp + 0x1c8]
mov dword [esp + 0x18], ebx
push 3
call fcn.1001a25e
mov dword [esp + 0x20], ebx
jmp 0x10028c69
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c8]
mov dword [eax + ecx*4], 0x4ebb0cb8
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 3
jl 0x10028c53
cmp dword [esp + 0x1c], 6
ja 0x10028c83
cmp dword [esp + 0x1c], ebx
je 0x10028c83
inc dword [esp + 0x18]
jmp 0x10028cbb
mov dword [esp + 0x18], ebx
jmp 0x10028c99
cmp byte [esp + 0x13], bl
je 0x10028c95
call dword [sym.imp.KERNEL32.dll_GetACP]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
mov byte [esp + 0x13], bl
jle 0x10028c89
cmp byte [esp + 0x13], bl
je 0x10028cbb
push 0xc06
push 0x122d
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
lea ecx, [esp + 0x1c8]
call fcn.1001ab22
mov dword [esp + 0x24], 0x6fe6d39c
mov dword [esp + 0x18], ebx
jmp 0x10028ce1
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x74], ebx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jl 0x10028cd5
mov dword [esp + 0x18], ebx
jmp 0x10028d01
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0x1dc], 0xbcd8c45c
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x10028cee
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10028d19
push ebx
call dword [sym.imp.USER32.dll_IsRectEmpty]
dec dword [esp + 0x1e4]
xor edx, edx
mov eax, dword [esp + 0x7c]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x74]
mov eax, dword [esp + 0x7c]
cmp eax, ecx
mov eax, dword [esp + 0x74]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x24]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x78]
mov ecx, dword [esp + 0x7c]
setne dl
imul edx, eax
mov eax, dword [esp + 0x74]
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, esi
setg dl
xor ecx, ecx
cmp edx, 0x8064
setg cl
sub eax, ecx
mov ecx, 0xfff9
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x4d
setle cl
mov dword [esp + 0x7c], ecx
mov dword [esp + 0x24], ebx
jmp 0x10029050
push esi
lea ecx, [esp + 0x198]
call fcn.1001a25e
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], ebx
jmp 0x10028dc4
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x194]
mov dword [eax + ecx*4], 0x9f9b
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10028dae
mov dword [esp + 0x18], ebx
jmp 0x10028de9
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10028de5
push 0x24db
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 1
jle 0x10028dd0
lea ecx, [esp + 0x194]
call fcn.1001ab22
push esi
lea ecx, [esp + 0xe0]
call fcn.1001a25e
mov dword [esp + 0x18], 9
mov dword [esp + 0x14], ebx
jmp 0x10028e27
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x4c], 0x3342eb9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10028e17
mov dword [esp + 0x14], ebx
jmp 0x10028e49
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xdc]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10028e33
mov esi, dword [esp + 0xdc]
xor edx, edx
inc edx
mov dword [esi + 4], edx
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x20], 0xb0b4ef66
mov dword [esp + 0x14], ebx
jmp 0x10028ee8
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x4c], ebx
je 0x10028ec2
mov eax, dword [esi + 4]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x4c]
mov eax, dword [esi + 4]
mov eax, dword [esp + eax*4 + 0x4c]
cmp eax, 0xc218
setg cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, 0xfffffffd
setle cl
sub ecx, 0x8558
neg ecx
sbb ecx, ecx
add ecx, 0xcce3a785
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x10028ec4
mov edx, ebx
mov eax, dword [esi + 4]
mov ecx, dword [esp + eax*4 + 0x4c]
xor eax, eax
cmp edx, 0xb89b
setg al
xor edx, edx
imul ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x4c], ecx
inc dword [esp + 0x14]
inc edx
cmp dword [esp + 0x14], edx
jle 0x10028e72
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x10028ff2
mov dword [esp + 0x30], 0xf7c295a5
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10028f29
push ebx
push 0x256e
push 0x2362
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor edx, edx
inc edx
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], ebx
jl 0x10028fe8
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0xd44f
mov dword [esp + 0x2c], 0x41b0ce7a
mov dword [esp + 0x1c], ebx
jmp 0x10028fd4
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x4c]
cmp dword [esp + 0x18], ebx
je 0x10028f66
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x4c]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov eax, dword [esp + 0x20]
setne dl
sub edx, dword [esp + eax*4 + 0x4c]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [esi + 4]
jl 0x10028fae
xor edx, edx
mov dword [esp + 0x18], ebx
inc edx
jmp 0x10028fa6
mov ecx, dword [esp + 0x30]
mov eax, dword [esi + 4]
sub ecx, 4
mov dword [esp + eax*4 + 0x4c], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jle 0x10028f94
jmp 0x10028fc8
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10028fc5
push 0xc25
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor edx, edx
inc edx
mov dword [esp + 0x2c], 0xa7221ebc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x10028f54
dec dword [esp + 0x20]
jns 0x10028f37
dec dword [esp + 0x14]
jns 0x10028efc
dec dword [esi + 4]
jns 0x10028e5c
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], ebx
jl 0x10029026
mov ecx, dword [esp + 0x18]
xor edx, edx
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0xdc]
cmp dword [eax + ecx*4], 5
sete dl
mov dword [eax + esi*4], edx
dec dword [esp + 0x18]
jns 0x10029005
lea ecx, [esp + 0xdc]
call fcn.1001ab22
mov eax, dword [esp + 0x24]
cmp dword [esp + eax*4 + 0x74], ebx
jne 0x1002905f
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + eax*4 + 0x74]
mov eax, dword [esp + 0x24]
mov dword [esp + eax*4 + 0x74], ecx
inc dword [esp + 0x24]
push 2
pop esi
cmp dword [esp + 0x24], esi
jle 0x10028d93
jmp 0x10029062
push 2
pop esi
mov dword [esp + 0x24], 3
xor ecx, ecx
inc ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], 0xedc0223d
mov dword [esp + 0x1c], 5
mov dword [esp + 0x1c], 6
mov dword [esp + 0x14], 0xf9531def
mov dword [esp + 0x1c], ebx
jmp 0x100290a6
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1a0], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10029097
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
neg edx
sbb edx, edx
inc edx
sub edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor edx, edx
add ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, edx
setle cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setl dl
sub edx, dword [esp + 0x20]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [esp + 0x18]
jne 0x10029121
cmp dword [esp + 0x18], ebx
je 0x10029121
xor eax, eax
inc eax
jmp 0x10029123
mov eax, ebx
cmp eax, 1
lea ecx, [esp + 0x114]
push esi
sbb eax, eax
inc eax
mov dword [esp + 0x1a4], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
inc eax
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
cmp dword [esp + 0x1c], 1
sbb eax, eax
neg eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
call fcn.1001a25e
mov dword [esp + 0x18], 0x2ee76f50
mov dword [esp + 0x1c], ebx
jmp 0x1002918b
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10029175
xor esi, esi
inc esi
mov dword [esp + 0x18], esi
cmp dword [esp + 0x18], ebx
jl 0x100291eb
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x114]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x100291e5
push 0x1f7b
push 0x8bd
push 0x1cd1
push 0x64f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
dec dword [esp + 0x18]
jns 0x1002919e
lea ecx, [esp + 0x114]
call fcn.1001ab22
push esi
lea ecx, [esp + 0x154]
call fcn.1001a25e
push 3
lea ecx, [esp + 0x124]
mov dword [esp + 0x238], ebx
call fcn.1001a25e
mov dword [esp + 0x2c], 0x23b6182e
mov dword [esp + 0x1c], ebx
jmp 0x10029239
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x10029227
mov eax, dword [esp + 0x120]
mov ecx, dword [eax]
sub ecx, dword [eax + 8]
mov dword [esp + 0x2c], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100292a6
push 0x841
push 0x597
push 0x24
push ebx
push 0x1ce3
push 0x22cc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x353
push 0x2689
push 0x1b94
push 0x1260
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
lea ecx, [esp + 0x120]
call fcn.1001ab22
mov dword [esp + 0x18], 0x52061f66
lea ecx, [esp + 0x108]
push 4
call fcn.1001a25e
mov dword [esp + 0x30], 0xdf251d69
xor edx, edx
mov dword [esp + 0x1c], 5
inc edx
mov dword [esp + 0x28], edx
or eax, 0xffffffff
mov dword [esp + 0x28], 0x629aa810
mov dword [esp + 0x28], 0x283066c9
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0xfffffffc
mov dword [esp + 0x2c], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x2c], 0xd3335637
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], 0xfffc
mov dword [esp + 0x18], 0xeb94
mov dword [esp + 0x24], 0x8323
mov dword [esp + 0x14], ebx
jmp 0x10029342
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10029330
mov dword [esp + 0x14], ebx
jmp 0x10029362
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xa0], 9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jl 0x1002934f
push 2
mov dword [esp + 0x18], ebx
pop esi
jmp 0x10029384
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x100], 0xb000cd9d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10029371
mov dword [esp + 0x14], ebx
jmp 0x100293a3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x15c], 0xfffffff6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x10029390
dec dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x15c]
mov dword [esp + 0x1c], 0x644bb323
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x104]
mov eax, dword [esp + 0x108]
cmp dword [eax], 0xbab0
mov eax, dword [esp + 0x160]
sete cl
add eax, ecx
mov dword [esp + 0x100], eax
cmp dword [esp + 0x30], eax
jge 0x10029404
cmp dword [esp + 0x24], ebx
jne 0x10029404
mov edx, ebx
mov eax, dword [esp + 0x28]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [esp + 0x20]
jl 0x1002941f
cmp dword [esp + 0x20], ebx
jne 0x1002941f
mov eax, ebx
jmp 0x10029422
xor eax, eax
inc eax
neg eax
xor edx, edx
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], 0x8f1edd1e
mov ecx, dword [esp + 0xa0]
mov eax, dword [esp + 0x1c]
cmp eax, ecx
lea ecx, [esp + 0x108]
setle dl
mov dword [esp + 0x28], edx
call fcn.1001ab22
mov dword [esp + 0x1c], ebx
jmp 0x1002946e
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x150]
mov dword [eax + ecx*4], 0x8d327cb3
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x10029458
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], ebx
jl 0x1002949a
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x150]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x18]
jns 0x1002947f
push esi
lea ecx, [esp + 0x1ac]
call fcn.1001a25e
mov byte [esp + 0x234], 1
lea ecx, [esp + 0x138]
mov dword [esp + 0x1c], 0xaf8716b5
push 3
call fcn.1001a25e
mov dword [esp + 0x14], ebx
jmp 0x100294e1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x1a8]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100294cb
mov dword [esp + 0x14], ebx
jmp 0x10029503
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x138]
mov dword [eax + ecx*4], 0xdb2b058e
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x100294ed
mov dword [esp + 0x14], ebx
jmp 0x10029523
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x1d4], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10029510
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x138]
mov eax, dword [esp + 0x138]
or dword [eax + 4], 0xffffffff
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1d8], ebx
call fcn.1001ab22
lea ecx, [esp + 0x1a8]
call fcn.1001ab22
mov dword [esp + 0x1c], 0xd6c05baf
or ecx, 0xffffffff
mov dword [esp + 0x18], 0x4c8d3c89
mov dword [esp + 0x28], ecx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10029591
push ebx
push ebx
push 0x122d
call dword [sym.imp.ADVAPI32.dll_CopySid]
or ecx, 0xffffffff
xor edx, edx
mov dword [esp + 0x1c], ebx
inc edx
cmp dword [esp + 0x1c], 0x15
jg 0x100295be
mov dword [esp + 0x28], edx
mov dword [esp + 0x18], 0x8c66
mov eax, dword [esp + 0x28]
imul eax, dword [esp + 0x18]
mov dword [esp + 0x28], eax
inc dword [esp + 0x1c]
jmp 0x10029598
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x1002973c
mov dword [esp + 0x18], 0x20452a26
mov eax, 0x4a87fce6
mov dword [esp + 0x24], 9
mov dword [esp + 0x1c], 0x3bfa32a1
mov dword [esp + 0xb4], eax
mov dword [esp + 0xb8], eax
mov dword [esp + 0xbc], eax
mov dword [esp + 0xc0], eax
mov dword [esp + 0x28], 0x3f29c8dd
mov dword [esp + 0x1c], 7
mov dword [esp + 0x1c], ebx
jmp 0x10029628
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x34], ecx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1002961c
mov eax, dword [esp + 0x34]
mov dword [esp + 0x18], eax
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
sub ecx, eax
cmp dword [esp + 0x34], ecx
jge 0x10029658
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x18], eax
jge 0x10029658
mov eax, ebx
cmp dword [esp + 0x24], ebx
je 0x1002965a
mov eax, edx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
cmp dword [esp + 0x34], ebx
je 0x10029672
cmp dword [esp + 0x18], ebx
jne 0x1002967a
mov ecx, ebx
cmp dword [esp + 0x24], ebx
je 0x1002967c
mov ecx, edx
xor eax, eax
cmp ecx, 0xa4c
setle al
mov dword [esp + 0xb4], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0xbc]
sub ecx, eax
mov eax, dword [esp + 0x1c]
add eax, ecx
je 0x100296be
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10029728
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x10029728
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0xb4]
setle cl
xor edx, edx
add ecx, eax
mov eax, dword [esp + 0x20]
cmp ecx, eax
setne dl
sub edx, 0xfffffffc
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], 0xb1d70f3f
push 0x24b9
push ebx
push 0x250c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
or edi, 0xffffffff
lea ecx, [esp + 0x150]
mov dword [esp + 0x234], edi
call fcn.1001ab22
mov dword [esp + 0x28], 0x5a9c4c8d
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x1c], ebx
jmp 0x10029777
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x80], 8
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10029764
mov dword [esp + 0x80], ebx
jmp 0x100297a9
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100297a2
push 0x5ed
push 0x25b6
push ebx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
dec dword [esp + 0x80]
cmp dword [esp + 0x80], 0xfffffff5
jl 0x10029786
mov eax, dword [esp + 0x80]
lea ecx, [esp + 0xc4]
add eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
push esi
call fcn.1001a25e
mov dword [esp + 0x18], 9
mov dword [esp + 0x14], ebx
jmp 0x100297ed
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3c], 0x3342eb9
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100297dd
mov dword [esp + 0x14], ebx
jmp 0x1002980f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc4]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100297f9
mov esi, dword [esp + 0xc4]
xor edx, edx
inc edx
mov dword [esi + 4], edx
mov dword [esp + 0x14], edi
mov dword [esp + 0x20], 0xb0b4ef66
mov dword [esp + 0x14], ebx
jmp 0x100298aa
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x3c], ebx
je 0x10029884
mov eax, dword [esi + 4]
xor ecx, ecx
mov eax, dword [esp + eax*4 + 0x3c]
mov eax, dword [esi + 4]
mov eax, dword [esp + eax*4 + 0x3c]
cmp eax, 0xc218
setg cl
mov dword [esp + 0x20], ecx
xor ecx, ecx
mov eax, dword [esp + 0x20]
cmp eax, 0xfffffffd
setle cl
sub ecx, 0x8558
neg ecx
sbb ecx, ecx
add ecx, 0xcce3a785
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x10029886
mov edx, ebx
mov eax, dword [esi + 4]
mov ecx, dword [esp + eax*4 + 0x3c]
xor eax, eax
cmp edx, 0xb89b
setg al
xor edx, edx
imul ecx, eax
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x3c], ecx
inc dword [esp + 0x14]
inc edx
cmp dword [esp + 0x14], edx
jle 0x10029834
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x100299b6
mov dword [esp + 0x28], 0xf7c295a5
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100298ec
push ebx
push 0x256e
push 0x2362
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor edx, edx
inc edx
mov dword [esp + 0x20], edx
cmp dword [esp + 0x20], ebx
jl 0x100299ac
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0xd44f
mov dword [esp + 0x2c], 0x41b0ce7a
mov dword [esp + 0x1c], ebx
jmp 0x10029998
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x3c]
cmp dword [esp + 0x18], ebx
je 0x10029929
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x3c]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov eax, dword [esp + 0x20]
setne dl
sub edx, dword [esp + eax*4 + 0x3c]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [esi + 4]
jl 0x10029971
xor edx, edx
mov dword [esp + 0x18], ebx
inc edx
jmp 0x10029969
mov ecx, dword [esp + 0x28]
mov eax, dword [esi + 4]
sub ecx, 4
mov dword [esp + eax*4 + 0x3c], ecx
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jle 0x10029957
jmp 0x1002998c
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10029989
push 0xc25
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor edx, edx
inc edx
mov dword [esp + 0x2c], 0xa7221ebc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jle 0x10029917
dec dword [esp + 0x20]
jns 0x100298fa
dec dword [esp + 0x14]
jns 0x100298be
dec dword [esi + 4]
jns 0x10029822
mov dword [esp + 0x18], edx
cmp dword [esp + 0x18], ebx
jl 0x100299ea
mov ecx, dword [esp + 0x18]
xor edx, edx
mov esi, dword [esp + 0x18]
mov eax, dword [esp + 0xc4]
cmp dword [eax + ecx*4], 5
sete dl
mov dword [eax + esi*4], edx
dec dword [esp + 0x18]
jns 0x100299c9
lea ecx, [esp + 0xc4]
call fcn.1001ab22
push 2
pop esi
push esi
lea ecx, [esp + 0xac]
call fcn.1001a25e
mov dword [esp + 0x234], esi
lea ecx, [esp + 0xd0]
mov dword [esp + 0x24], 3
mov dword [esp + 0x14], edi
mov dword [esp + 0x1c], 0x1fc80ae7
push 4
call fcn.1001a25e
mov byte [esp + 0x234], 3
lea ecx, [esp + 0x144]
mov dword [esp + 0x18], 0x8d2ca8e1
push esi
call fcn.1001a25e
mov dword [esp + 0x14], ebx
jmp 0x10029a62
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x54], 0x32384b6d
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 1
jl 0x10029a52
mov dword [esp + 0x14], ebx
jmp 0x10029a85
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd0]
mov dword [eax + ecx*4], 0xcdab0b82
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10029a6f
mov dword [esp + 0x14], ebx
jmp 0x10029aa8
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x144]
mov dword [eax + ecx*4], 0xb5ad8edc
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10029a92
push 0x1a
mov dword [esp + 0x18], 0xffffffea
pop edi
cmp dword [esp + 0x14], edi
jge 0x10029bc7
mov esi, dword [esp + 0xd0]
mov dword [esp + 0x24], 0xf0a290be
mov dword [esp + 0x20], 0xa22e974a
mov dword [esp + 0x30], 0x889e
mov dword [esp + 0x28], 0x94ad8a0f
mov dword [esp + 0x28], 4
mov dword [esp + 0x1c], ebx
jmp 0x10029b0b
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x1c0], 0x94fb389f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x10029af8
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
add edx, 6
cmp edx, eax
setg cl
cmp dword [esp + 0x14], ecx
jg 0x10029b38
mov eax, dword [esp + 0x18]
mov ecx, 0xb34d7aeb
cmp ecx, eax
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0xd0]
sbb edx, edx
inc edx
imul ecx, edx
mov dword [eax + 8], edx
xor edx, edx
mov eax, dword [esp + 0x144]
cmp ecx, dword [eax]
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
or eax, 0xffffffff
add ecx, 6
cmp eax, ecx
mov ecx, dword [esp + 0x54]
mov eax, dword [esp + 0x54]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
lea ecx, [esp + 0x144]
setg dl
imul esi, edx
mov dword [esp + 0x18], esi
call fcn.1001ab22
lea ecx, [esp + 0xd0]
call fcn.1001ab22
push 2
mov dword [esp + 0x1c], 0xd3650dfa
mov dword [esp + 0x20], ebx
pop esi
jmp 0x10029c60
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x10029c4a
mov dword [esp + 0x24], 1
cmp dword [esp + 0x24], ebx
jl 0x10029dac