Function at 0x1001270e
Capabilities:
Allocate thread local storage
Get common file path
Get disk information
Get thread local storage value
Identify system language via api
Query environment variable
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080c1a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1164
call fcn.1007cb90
push esi
push edi
mov dword [ebp - 0xa8], 0xffffffff
mov dword [ebp - 0xbb4], 1
mov dword [ebp - 0x2a4], 0
jmp 0x1001275f
mov eax, dword [ebp - 0x2a4]
inc eax
mov dword [ebp - 0x2a4], eax
cmp dword [ebp - 0x2a4], 2
jge 0x1001277b
mov eax, dword [ebp - 0x2a4]
mov dword [ebp + eax*4 - 0x194], 0xdcec3d7d
jmp 0x10012752
mov dword [ebp - 0xa8], 1
jmp 0x10012794
mov eax, dword [ebp - 0xa8]
dec eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
jl 0x1001295d
mov dword [ebp - 0x9e8], 1
mov dword [ebp - 0xa88], 4
mov dword [ebp - 0xbbc], 0xfffffff6
mov dword [ebp - 0x2ac], 0
jmp 0x100127d8
mov eax, dword [ebp - 0x2ac]
inc eax
mov dword [ebp - 0x2ac], eax
cmp dword [ebp - 0x2ac], 2
jge 0x100127f4
mov eax, dword [ebp - 0x2ac]
mov dword [ebp + eax*4 - 0xe68], 0
jmp 0x100127cb
mov eax, dword [ebp - 0xa8]
cmp dword [ebp + eax*4 - 0x194], 0
jne 0x1001293b
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x194]
mov dword [ebp - 0x10c4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x194]
mov dword [ebp - 0x1008], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x194]
mov dword [ebp - 0xf78], eax
mov eax, dword [ebp - 0xa8]
mov ecx, dword [ebp - 0xa8]
mov ecx, dword [ebp + ecx*4 - 0x194]
cmp dword [ebp + eax*4 - 0x194], ecx
jl 0x10012869
mov dword [ebp - 0x4bc], 1
jmp 0x10012870
and dword [ebp - 0x4bc], 0
mov eax, dword [ebp - 0xa8]
mov eax, dword [ebp + eax*4 - 0x194]
cmp dword [ebp - 0x4bc], eax
je 0x10012891
mov dword [ebp - 0x9d8], 1
jmp 0x10012898
and dword [ebp - 0x9d8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x194]
add eax, dword [ebp - 0x9d8]
je 0x100128c9
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x194], 0
je 0x100128c9
mov dword [ebp - 0x9e0], 1
jmp 0x100128d0
and dword [ebp - 0x9e0], 0
mov eax, dword [ebp - 0x9e0]
mov dword [ebp - 0x9e8], eax
mov eax, dword [ebp - 0x9e8]
sub eax, 7
mov dword [ebp - 0xa88], eax
mov eax, 0x4087a912
add eax, 4
cmp eax, 0x73046773
jle 0x10012906
mov dword [ebp - 0x9f0], 1
jmp 0x1001290d
and dword [ebp - 0x9f0], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x194]
cmp dword [ebp - 0x9f0], eax
jle 0x1001292e
mov dword [ebp - 0x9f8], 1
jmp 0x10012935
and dword [ebp - 0x9f8], 0
mov eax, dword [ebp - 0xbb4]
mov eax, dword [ebp - 0xbbc]
mov dword [ebp - 0x1098], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe68], 7
jmp 0x10012787
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0xbcc], 1
mov dword [ebp - 0x2b4], 0
jmp 0x10012987
mov eax, dword [ebp - 0x2b4]
inc eax
mov dword [ebp - 0x2b4], eax
cmp dword [ebp - 0x2b4], 2
jge 0x100129a3
mov eax, dword [ebp - 0x2b4]
mov dword [ebp + eax*4 - 0x1a4], 0xdcec3d7d
jmp 0x1001297a
mov dword [ebp - 0x78], 1
jmp 0x100129b3
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0
jl 0x10012b6a
mov dword [ebp - 0x37c], 1
mov dword [ebp - 0xbc4], 4
mov dword [ebp - 0xbd4], 0xfffffff6
mov dword [ebp - 0x260], 0
jmp 0x100129f4
mov eax, dword [ebp - 0x260]
inc eax
mov dword [ebp - 0x260], eax
cmp dword [ebp - 0x260], 2
jge 0x10012a10
mov eax, dword [ebp - 0x260]
mov dword [ebp + eax*4 - 0xe74], 0
jmp 0x100129e7
mov eax, dword [ebp - 0x78]
cmp dword [ebp + eax*4 - 0x1a4], 0
jne 0x10012b48
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x1a4]
mov dword [ebp - 0xe40], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4]
mov dword [ebp - 0xe44], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4]
mov dword [ebp - 0xe4c], eax
mov eax, dword [ebp - 0x78]
mov ecx, dword [ebp - 0x78]
mov ecx, dword [ebp + ecx*4 - 0x1a4]
cmp dword [ebp + eax*4 - 0x1a4], ecx
jl 0x10012a79
mov dword [ebp - 0xa00], 1
jmp 0x10012a80
and dword [ebp - 0xa00], 0
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp + eax*4 - 0x1a4]
cmp dword [ebp - 0xa00], eax
je 0x10012a9e
mov dword [ebp - 0xa08], 1
jmp 0x10012aa5
and dword [ebp - 0xa08], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4]
add eax, dword [ebp - 0xa08]
je 0x10012ad6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1a4], 0
je 0x10012ad6
mov dword [ebp - 0xa10], 1
jmp 0x10012add
and dword [ebp - 0xa10], 0
mov eax, dword [ebp - 0xa10]
mov dword [ebp - 0x37c], eax
mov eax, dword [ebp - 0x37c]
sub eax, 7
mov dword [ebp - 0xbc4], eax
mov eax, 0x4087a912
add eax, 4
cmp eax, 0x73046773
jle 0x10012b13
mov dword [ebp - 0x888], 1
jmp 0x10012b1a
and dword [ebp - 0x888], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1a4]
cmp dword [ebp - 0x888], eax
jle 0x10012b3b
mov dword [ebp - 0x384], 1
jmp 0x10012b42
and dword [ebp - 0x384], 0
mov eax, dword [ebp - 0xbcc]
mov eax, dword [ebp - 0xbd4]
mov dword [ebp - 0xe54], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe74], 7
jmp 0x100129ac
mov dword [ebp - 0x5c], 0xd688
mov dword [ebp - 0xd3c], 0xfffffff6
mov dword [ebp - 0xd38], 0xfffffff6
mov dword [ebp - 0xd34], 0xfffffff6
mov dword [ebp - 0xd30], 0xfffffff6
mov dword [ebp - 0x148], 0x56e74e80
mov dword [ebp - 0x3b4], 0x2aff635
mov dword [ebp - 0x3bc], 0x7d266845
mov dword [ebp - 0x32c], 6
mov dword [ebp - 0x1b0], 0x1e13ca4d
mov dword [ebp - 0x8b0], 0xfffffff9
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xe5c], eax
cmp dword [ebp - 0x5c], 0
je 0x10012c60
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x5c]
jne 0x10012bfe
mov eax, 0x51af
test eax, eax
jne 0x10012bfe
and dword [ebp - 0x890], 0
jmp 0x10012c08
mov dword [ebp - 0x890], 1
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x890], eax
jg 0x10012c25
cmp dword [ebp - 0x5c], 0
je 0x10012c25
mov dword [ebp - 0x2d0], 1
jmp 0x10012c2c
and dword [ebp - 0x2d0], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp + eax - 0xd3c], ecx
mov eax, dword [ebp - 0x2d0]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
je 0x10012c60
mov dword [ebp - 0x38c], 1
jmp 0x10012c67
and dword [ebp - 0x38c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x38c], eax
jle 0x10012c7e
mov dword [ebp - 0x898], 1
jmp 0x10012c85
and dword [ebp - 0x898], 0
mov eax, dword [ebp - 0x898]
mov dword [ebp - 0x3b4], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xd3c], 0
jne 0x10012cb3
cmp dword [ebp - 0x148], 0
jne 0x10012cb3
and dword [ebp - 0x394], 0
jmp 0x10012cbd
mov dword [ebp - 0x394], 1
mov eax, dword [ebp - 0x394]
mov dword [ebp - 0x3bc], eax
cmp dword [ebp - 0x5c], 0x4870
jl 0x10012cde
mov dword [ebp - 0x8a0], 1
jmp 0x10012ce5
and dword [ebp - 0x8a0], 0
cmp dword [ebp - 0x8a0], 0x1f0dfbc4
jg 0x10012cfd
mov dword [ebp - 0x39c], 1
jmp 0x10012d04
and dword [ebp - 0x39c], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x39c], eax
jge 0x10012d1b
mov dword [ebp - 0x8a8], 1
jmp 0x10012d22
and dword [ebp - 0x8a8], 0
mov eax, dword [ebp - 0x8a8]
mov dword [ebp - 0x32c], eax
mov eax, dword [ebp - 0x32c]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xeb4], eax
mov eax, 0x88d5
test eax, eax
je 0x10012e11
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xebc], eax
cmp dword [ebp - 0x8b0], 0xcb2d505b
ja 0x10012d77
mov dword [ebp - 0x3a4], 1
jmp 0x10012d7e
and dword [ebp - 0x3a4], 0
mov eax, dword [ebp - 0x3a4]
sub eax, dword [ebp - 0x148]
imul eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x32c]
jge 0x10012da5
mov dword [ebp - 0x3ac], 1
jmp 0x10012dac
and dword [ebp - 0x3ac], 0
mov eax, dword [ebp - 0x8b0]
cmp dword [ebp - 0x3ac], eax
jge 0x10012dc6
mov dword [ebp - 0x8b8], 1
jmp 0x10012dcd
and dword [ebp - 0x8b8], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xd3c]
mov ecx, dword [ebp - 0x8b8]
lea eax, [ecx + eax - 5]
cmp eax, 0x7f5e
jle 0x10012df7
mov dword [ebp - 0xbdc], 1
jmp 0x10012dfe
and dword [ebp - 0xbdc], 0
mov eax, dword [ebp - 0x3b4]
mov dword [ebp - 0xec4], eax
cmp dword [ebp - 0x1b0], 0
cmp dword [ebp - 0x1b0], 0x360e5697
jg 0x10012e29
mov dword [ebp - 0x8c0], 1
jmp 0x10012e30
and dword [ebp - 0x8c0], 0
mov eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x8c0]
mov dword [ebp - 0x3bc], eax
mov dword [ebp - 0x150], 0xae97
mov dword [ebp - 0x244], 0
jmp 0x10012e63
mov eax, dword [ebp - 0x244]
inc eax
mov dword [ebp - 0x244], eax
cmp dword [ebp - 0x244], 4
jge 0x10012e7f
mov eax, dword [ebp - 0x244]
mov dword [ebp + eax*4 - 0x1158], 0xa136951a
jmp 0x10012e56
mov eax, dword [ebp - 0x150]
dec eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x150], 0
jmp 0x10012ea5
mov eax, dword [ebp - 0x150]
inc eax
mov dword [ebp - 0x150], eax
cmp dword [ebp - 0x150], 3
jg 0x10012f42
mov dword [ebp - 0x1b8], 0xf47a6de
mov byte [ebp - 0xe3], 0
movzx eax, byte [ebp - 0xe3]
test eax, eax
je 0x10012ed9
push 0x1cf5
call dword [sym.imp.USER32.dll_GetKeyboardType]
mov dword [ebp - 0x1b8], 3
jmp 0x10012ef2
mov eax, dword [ebp - 0x1b8]
dec eax
mov dword [ebp - 0x1b8], eax
cmp dword [ebp - 0x1b8], 0
jl 0x10012f3d
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x188], 3
jmp 0x10012f1e
mov eax, dword [ebp - 0x188]
dec eax
mov dword [ebp - 0x188], eax
cmp dword [ebp - 0x188], 0
jl 0x10012f3b
mov eax, dword [ebp - 0x188]
cmp dword [ebp + eax*4 - 0x1158], 0
je 0x10012f39
jmp 0x10012f3b
jmp 0x10012f11
jmp 0x10012ee5
jmp 0x10012e98
mov dword [ebp - 0x24], 0x38ec
mov dword [ebp - 0x8c8], 0x17b722ba
mov dword [ebp - 0x24c], 0x97b09b37
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xecc], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x8c8], eax
cmp dword [ebp - 0x8c8], 0xfffffffa
jge 0x10012f84
mov dword [ebp - 0x3c4], 1
jmp 0x10012f8b
and dword [ebp - 0x3c4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3c4], eax
jle 0x10012fa2
mov dword [ebp - 0x8d8], 1
jmp 0x10012fa9
and dword [ebp - 0x8d8], 0
mov eax, dword [ebp - 0x8d8]
dec eax
dec eax
imul eax, eax, 0xdd77
cmp eax, dword [ebp - 0x24]
jle 0x10012fc8
mov dword [ebp - 0x3cc], 1
jmp 0x10012fcf
and dword [ebp - 0x3cc], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x3cc]
jl 0x10012fe6
mov dword [ebp - 0x8e0], 1
jmp 0x10012fed
and dword [ebp - 0x8e0], 0
imul eax, dword [ebp - 0x8e0], 0x8f92
cmp eax, 4
je 0x10013008
mov dword [ebp - 0x3d4], 1
jmp 0x1001300f
and dword [ebp - 0x3d4], 0
mov eax, dword [ebp - 0x24]
mov eax, 0x1a9565e0
cmp eax, 0xf18c9a01
ja 0x1001302a
mov dword [ebp - 0x8e8], 1
jmp 0x10013031
and dword [ebp - 0x8e8], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x8e8], eax
jl 0x10013048
mov dword [ebp - 0x3dc], 1
jmp 0x1001304f
and dword [ebp - 0x3dc], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x3dc], eax
jle 0x10013066
mov dword [ebp - 0x8f0], 1
jmp 0x1001306d
and dword [ebp - 0x8f0], 0
mov eax, dword [ebp - 0x8f0]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24c], eax
jge 0x10013090
mov dword [ebp - 0x3e4], 1
jmp 0x10013097
and dword [ebp - 0x3e4], 0
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x3e4]
jg 0x100130ae
mov dword [ebp - 0x8f8], 1
jmp 0x100130b5
and dword [ebp - 0x8f8], 0
cmp dword [ebp - 0x8f8], 0x118c84b7
jge 0x1001323f
mov dword [ebp - 0x908], 0xed734895
push 2
lea ecx, [ebp - 0xdf0]
call fcn.10011da1
and dword [ebp - 4], 0
mov dword [ebp - 0xb8], 0
jmp 0x100130f9
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 1
jge 0x10013115
mov eax, dword [ebp - 0xb8]
mov dword [ebp + eax*4 - 0x334], 0xf93be41b
jmp 0x100130ec
mov dword [ebp - 0xb8], 0
jmp 0x1001312e
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 2
jge 0x1001314d
push dword [ebp - 0xb8]
lea ecx, [ebp - 0xdf0]
call fcn.10011e0e
or dword [eax], 0xffffffff
jmp 0x10013121
xor eax, eax
inc eax
je 0x1001315b
cmp dword [ebp - 0x24c], 0
jne 0x10013174
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x334], 0
jne 0x10013174
and dword [ebp - 0x3ec], 0
jmp 0x1001317e
mov dword [ebp - 0x3ec], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x334]
cmp dword [ebp - 0x3ec], eax
jge 0x1001319f
mov dword [ebp - 0x900], 1
jmp 0x100131a6
and dword [ebp - 0x900], 0
cmp dword [ebp - 0x900], 0x5618
je 0x100131be
mov dword [ebp - 0x3f4], 1
jmp 0x100131c5
and dword [ebp - 0x3f4], 0
mov eax, dword [ebp - 0x3f4]
mov dword [ebp - 0x24c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x334]
mov dword [ebp - 0x908], eax
mov esi, dword [ebp - 0x908]
push 1
lea ecx, [ebp - 0xdf0]
call fcn.10011e0e
mov dword [eax], esi
mov dword [ebp - 0x24], 0
jmp 0x10013209
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jg 0x1001322e
mov byte [ebp - 0xec], 0
movzx eax, byte [ebp - 0xec]
test eax, eax
je 0x1001322c
push 0x1c3b
call dword [sym.imp.KERNEL32.dll_ExitThread]
jmp 0x10013202
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xdf0]
call fcn.10011e09
jmp 0x1001325f
mov dword [ebp - 0xbfc], 0xdae1dc63
mov dword [ebp - 0xc04], 0xffffffff
mov eax, dword [ebp - 0xbfc]
mov dword [ebp - 0xc04], eax
mov dword [ebp - 0x80], 0xffffffff
mov dword [ebp - 0xed4], 0x3fa7
mov dword [ebp - 0xc24], 0xfffffff8
mov dword [ebp - 0xc2c], 0xdd3f4672
push 3
lea ecx, [ebp - 0xe08]
call fcn.10011da1
mov dword [ebp - 4], 1
push 1
lea ecx, [ebp - 0xd54]
call fcn.10011da1
mov byte [ebp - 4], 2
mov dword [ebp - 0x33c], 0x93cc2542
mov dword [ebp - 0xc34], 1
mov dword [ebp - 0x28], 0
jmp 0x100132cd
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x100132e6
push dword [ebp - 0x28]
lea ecx, [ebp - 0xe08]
call fcn.10011e0e
or dword [eax], 0xffffffff
jmp 0x100132c6
mov dword [ebp - 0x28], 0
jmp 0x100132f6
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1001330c
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0xc0c], 3
jmp 0x100132ef
mov dword [ebp - 0x28], 0
jmp 0x1001331c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x10013338
push dword [ebp - 0x28]
lea ecx, [ebp - 0xd54]
call fcn.10011e0e
mov dword [eax], 8
jmp 0x10013315
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xc0c], 0xd5467356
jae 0x10013357
mov dword [ebp - 0x3fc], 1
jmp 0x1001335e
and dword [ebp - 0x3fc], 0
mov eax, dword [ebp - 0x33c]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp - 0x3fc]
mov dword [ebp - 0xc1c], eax
mov eax, dword [ebp - 0x33c]
inc eax
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0xc14]
cmp eax, dword [ebp - 0xc1c]
jne 0x1001339d
mov dword [ebp - 0x910], 1
jmp 0x100133a4
and dword [ebp - 0x910], 0
mov eax, dword [ebp - 0xc24]
sub eax, 0xa
jne 0x100133e8
push 0
lea ecx, [ebp - 0xd54]
call fcn.10011e0e
cmp dword [eax], 0xf6a0
jne 0x100133e8
push 0
lea ecx, [ebp - 0xd54]
call fcn.10011e0e
cmp dword [eax], 0
jne 0x100133e8
mov eax, 0x2002
test eax, eax
jne 0x100133e8
and dword [ebp - 0x404], 0
jmp 0x100133f2
mov dword [ebp - 0x404], 1
mov eax, dword [ebp - 0x910]
cmp eax, dword [ebp - 0x404]
jge 0x1001340c
mov dword [ebp - 0x918], 1
jmp 0x10013413
and dword [ebp - 0x918], 0
mov eax, dword [ebp - 0x918]
mov dword [ebp - 0xc2c], eax
mov esi, dword [ebp - 0xc34]
push 2
lea ecx, [ebp - 0xe08]
call fcn.10011e0e
mov dword [eax], esi
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xd54]
call fcn.10011e09
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe08]
call fcn.10011e09
mov dword [ebp - 0xc5c], 1
mov dword [ebp - 0x54], 0x2e91a04
mov dword [ebp - 0x344], 0x6aa16542
mov dword [ebp - 0xedc], 7
mov dword [ebp - 0x54], 0
jmp 0x10013487
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0x1d
jne 0x100135ab
mov dword [ebp - 0x354], 0xfffd
mov dword [ebp - 0x424], 3
mov dword [ebp - 0xc3c], 0x2509e71b
mov eax, dword [ebp - 0x354]
mov dword [ebp - 0xee4], eax
cmp dword [ebp - 0x54], 0xda7ef5d8
ja 0x100134d0
mov dword [ebp - 0x40c], 1
jmp 0x100134d7
and dword [ebp - 0x40c], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x40c]
jl 0x100134ee
mov dword [ebp - 0x920], 1
jmp 0x100134f5
and dword [ebp - 0x920], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0x920]
jge 0x1001350c
mov dword [ebp - 0x414], 1
jmp 0x10013513
and dword [ebp - 0x414], 0
mov eax, dword [ebp - 0x414]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x344], eax
je 0x10013536
mov dword [ebp - 0x928], 1
jmp 0x1001353d
and dword [ebp - 0x928], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x928], eax
jle 0x1001355d
cmp dword [ebp - 0x344], 0
je 0x1001355d
mov dword [ebp - 0x41c], 1
jmp 0x10013564
and dword [ebp - 0x41c], 0
mov eax, dword [ebp - 0x354]
cmp dword [ebp - 0x41c], eax
je 0x1001357e
mov dword [ebp - 0x930], 1
jmp 0x10013585
and dword [ebp - 0x930], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x930]
add eax, dword [ebp - 0x354]
mov dword [ebp - 0x424], eax
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0xc3c], eax
jmp 0x10013480
mov byte [ebp - 0xee], 0
movzx eax, byte [ebp - 0xee]
test eax, eax
je 0x100135c8
push 0x1c4e
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0xd8], 0x60477862
push 3
lea ecx, [ebp - 0x1004]
call fcn.10011da1
mov dword [ebp - 4], 3
mov dword [ebp - 0xeec], 0
mov dword [ebp - 0x1c0], 0
jmp 0x10013609
mov eax, dword [ebp - 0x1c0]
inc eax
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 3
jge 0x1001362b
push dword [ebp - 0x1c0]
lea ecx, [ebp - 0x1004]
call fcn.10011e0e
mov dword [eax], 1
jmp 0x100135fc
mov dword [ebp - 0xd8], 0
jmp 0x10013644
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0xb
jle 0x100136af
mov dword [ebp - 0x254], 0x7c203980
mov dword [ebp - 0x254], 0
jmp 0x10013670
mov eax, dword [ebp - 0x254]
dec eax
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xfffffff6
jge 0x100136ad
mov byte [ebp - 0xf0], 0
movzx eax, byte [ebp - 0xf0]
test eax, eax
je 0x100136ab
push 0
push 0x21f7
push 0x1db5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x10013663
jmp 0x10013637
mov dword [ebp - 0xd8], 2
jmp 0x100136c8
mov eax, dword [ebp - 0xd8]
dec eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0
jl 0x10013718
mov dword [ebp - 0x1c8], 0x11151
mov dword [ebp - 0x1c8], 0
jmp 0x100136f4
mov eax, dword [ebp - 0x1c8]
inc eax
mov dword [ebp - 0x1c8], eax
cmp dword [ebp - 0x1c8], 2
jg 0x10013716
mov dword [ebp - 0x938], 0
mov eax, dword [ebp - 0x938]
dec eax
mov dword [ebp - 0x938], eax
jmp 0x100136e7
jmp 0x100136bb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1004]
call fcn.10011e09
mov dword [ebp - 0x25c], 0
jmp 0x10013740
mov eax, dword [ebp - 0x25c]
inc eax
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 2
jge 0x1001375c
mov eax, dword [ebp - 0x25c]
mov dword [ebp + eax*4 - 0x19c], 0xdcec3d7d
jmp 0x10013733
mov dword [ebp - 0x80], 1
jmp 0x1001376c
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0
jl 0x10013923
mov dword [ebp - 0x948], 1
mov dword [ebp - 0xc54], 4
mov dword [ebp - 0xc64], 0xfffffff6
mov dword [ebp - 0x1d0], 0
jmp 0x100137ad
mov eax, dword [ebp - 0x1d0]
inc eax
mov dword [ebp - 0x1d0], eax
cmp dword [ebp - 0x1d0], 2
jge 0x100137c9
mov eax, dword [ebp - 0x1d0]
mov dword [ebp + eax*4 - 0xe80], 0
jmp 0x100137a0
mov eax, dword [ebp - 0x80]
cmp dword [ebp + eax*4 - 0x19c], 0
jne 0x10013901
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0x19c]
mov dword [ebp - 0xef4], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x19c]
mov dword [ebp - 0xefc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x19c]
mov dword [ebp - 0xf04], eax
mov eax, dword [ebp - 0x80]
mov ecx, dword [ebp - 0x80]
mov ecx, dword [ebp + ecx*4 - 0x19c]
cmp dword [ebp + eax*4 - 0x19c], ecx
jl 0x10013832
mov dword [ebp - 0x42c], 1
jmp 0x10013839
and dword [ebp - 0x42c], 0
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp + eax*4 - 0x19c]
cmp dword [ebp - 0x42c], eax
je 0x10013857
mov dword [ebp - 0x940], 1
jmp 0x1001385e
and dword [ebp - 0x940], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x19c]
add eax, dword [ebp - 0x940]
je 0x1001388f
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x19c], 0
je 0x1001388f
mov dword [ebp - 0x434], 1
jmp 0x10013896
and dword [ebp - 0x434], 0
mov eax, dword [ebp - 0x434]
mov dword [ebp - 0x948], eax
mov eax, dword [ebp - 0x948]
sub eax, 7
mov dword [ebp - 0xc54], eax
mov eax, 0x4087a912
add eax, 4
cmp eax, 0x73046773
jle 0x100138cc
mov dword [ebp - 0x43c], 1
jmp 0x100138d3
and dword [ebp - 0x43c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x19c]
cmp dword [ebp - 0x43c], eax
jle 0x100138f4
mov dword [ebp - 0x950], 1
jmp 0x100138fb
and dword [ebp - 0x950], 0
mov eax, dword [ebp - 0xc5c]
mov eax, dword [ebp - 0xc64]
mov dword [ebp - 0xf0c], eax
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0xe80], 7
jmp 0x10013765
mov dword [ebp - 0x10f8], 0xa5d6c05b
mov dword [ebp - 0x10f4], 0xa5d6c05b
mov dword [ebp - 0x10f0], 0xa5d6c05b
mov dword [ebp - 0x10ec], 0xa5d6c05b
mov dword [ebp - 0x264], 0xffffffff
mov dword [ebp - 0x464], 0
push 1
lea ecx, [ebp - 0xc74]
call fcn.10011da1
mov dword [ebp - 4], 4
push 2
lea ecx, [ebp - 0xa78]
call fcn.10011da1
mov byte [ebp - 4], 5
mov dword [ebp - 0xbac], 0xd14c
mov dword [ebp - 0xb0], 0
jmp 0x100139a7
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x100139c6
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xc74]
call fcn.10011e0e
and dword [eax], 0
jmp 0x1001399a
mov dword [ebp - 0xb0], 0
jmp 0x100139df
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 2
jge 0x10013a01
push dword [ebp - 0xb0]
lea ecx, [ebp - 0xa78]
call fcn.10011e0e
mov dword [eax], 0x6f7fbf21
jmp 0x100139d2
mov dword [ebp - 0x264], 0
jmp 0x10013a1a
mov eax, dword [ebp - 0x264]
inc eax
mov dword [ebp - 0x264], eax
cmp dword [ebp - 0x264], 3
jg 0x10013a75
mov dword [ebp - 0x1d8], 0
jmp 0x10013a3c
mov eax, dword [ebp - 0x1d8]
inc eax
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x1d8], 1
jge 0x10013a58
mov eax, dword [ebp - 0x1d8]
mov dword [ebp + eax*4 - 0x444], 0
jmp 0x10013a2f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x444]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x444], eax
jmp 0x10013a0d
push 0
lea ecx, [ebp - 0xa78]
call fcn.10011e0e
cmp dword [eax], 0
jne 0x10013b60
mov eax, 0x17f4
test eax, eax
je 0x10013ab2
push 0
lea ecx, [ebp - 0xc74]
call fcn.10011e0e
cmp dword [eax], 0
je 0x10013ab2
mov dword [ebp - 0x958], 1
jmp 0x10013ab9
and dword [ebp - 0x958], 0
mov esi, dword [ebp - 0x958]
sub esi, 0x4594bd42
push 1
lea ecx, [ebp - 0xa78]
call fcn.10011e0e
cmp esi, dword [eax]
jl 0x10013ae2
mov dword [ebp - 0x44c], 1
jmp 0x10013ae9
and dword [ebp - 0x44c], 0
mov esi, dword [ebp - 0x44c]
add esi, 7
push 0
lea ecx, [ebp - 0xc74]
call fcn.10011e0e
cmp esi, dword [eax]
jg 0x10013b0f
mov dword [ebp - 0x960], 1
jmp 0x10013b16
and dword [ebp - 0x960], 0
push 1
lea ecx, [ebp - 0xa78]
call fcn.10011e0e
mov ecx, dword [ebp - 0x960]
cmp ecx, dword [eax]
jne 0x10013b42
cmp dword [ebp - 0x464], 0
je 0x10013b42
mov dword [ebp - 0x454], 1
jmp 0x10013b49
and dword [ebp - 0x454], 0
mov eax, dword [ebp - 0xbac]
cmp eax, dword [ebp - 0x454]
jl 0x10013b60
and dword [ebp - 0x968], 0
jmp 0x10013b6a
mov dword [ebp - 0x968], 1
push 0
lea ecx, [ebp - 0xa78]
call fcn.10011e0e
mov ecx, dword [ebp - 0x968]
cmp ecx, dword [eax]
jne 0x10013b8d
mov dword [ebp - 0x45c], 1
jmp 0x10013b94
and dword [ebp - 0x45c], 0
push 0
lea ecx, [ebp - 0xc74]
call fcn.10011e0e
mov ecx, dword [ebp - 0x45c]
cmp ecx, dword [eax]
jge 0x10013bb7
mov dword [ebp - 0x970], 1
jmp 0x10013bbe
and dword [ebp - 0x970], 0
mov eax, dword [ebp - 0x970]
mov dword [ebp - 0x464], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xa78]
call fcn.10011e09
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc74]
call fcn.10011e09
mov dword [ebp - 0x10b8], 0xa5d6c05b
mov dword [ebp - 0x10b4], 0xa5d6c05b
mov dword [ebp - 0x10b0], 0xa5d6c05b
mov dword [ebp - 0x10ac], 0xa5d6c05b
mov dword [ebp - 0x26c], 0xffffffff
mov dword [ebp - 0x998], 0
push 1
lea ecx, [ebp - 0xc84]
call fcn.10011da1
mov dword [ebp - 4], 6
push 2
lea ecx, [ebp - 0xa60]
call fcn.10011da1
mov byte [ebp - 4], 7
mov dword [ebp - 0xad4], 0xd14c
mov dword [ebp - 0x88], 0
jmp 0x10013c6c
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 1
jge 0x10013c8b
push dword [ebp - 0x88]
lea ecx, [ebp - 0xc84]
call fcn.10011e0e
and dword [eax], 0
jmp 0x10013c5f
mov dword [ebp - 0x88], 0
jmp 0x10013ca4
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 2
jge 0x10013cc6
push dword [ebp - 0x88]
lea ecx, [ebp - 0xa60]
call fcn.10011e0e
mov dword [eax], 0x6f7fbf21
jmp 0x10013c97
mov dword [ebp - 0x26c], 0
jmp 0x10013cdf
mov eax, dword [ebp - 0x26c]
inc eax
mov dword [ebp - 0x26c], eax
cmp dword [ebp - 0x26c], 3
jg 0x10013d3a
mov dword [ebp - 0x1e0], 0
jmp 0x10013d01
mov eax, dword [ebp - 0x1e0]
inc eax
mov dword [ebp - 0x1e0], eax
cmp dword [ebp - 0x1e0], 1
jge 0x10013d1d
mov eax, dword [ebp - 0x1e0]
mov dword [ebp + eax*4 - 0x978], 0
jmp 0x10013cf4
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x978]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x978], eax
jmp 0x10013cd2
push 0
lea ecx, [ebp - 0xa60]
call fcn.10011e0e
cmp dword [eax], 0
jne 0x10013e25
mov eax, 0x17f4
test eax, eax
je 0x10013d77
push 0
lea ecx, [ebp - 0xc84]
call fcn.10011e0e
cmp dword [eax], 0
je 0x10013d77
mov dword [ebp - 0x46c], 1
jmp 0x10013d7e
and dword [ebp - 0x46c], 0
mov esi, dword [ebp - 0x46c]
sub esi, 0x4594bd42
push 1
lea ecx, [ebp - 0xa60]
call fcn.10011e0e
cmp esi, dword [eax]
jl 0x10013da7
mov dword [ebp - 0x980], 1
jmp 0x10013dae
and dword [ebp - 0x980], 0
mov esi, dword [ebp - 0x980]
add esi, 7
push 0
lea ecx, [ebp - 0xc84]
call fcn.10011e0e
cmp esi, dword [eax]
jg 0x10013dd4
mov dword [ebp - 0x474], 1
jmp 0x10013ddb
and dword [ebp - 0x474], 0
push 1
lea ecx, [ebp - 0xa60]
call fcn.10011e0e
mov ecx, dword [ebp - 0x474]
cmp ecx, dword [eax]
jne 0x10013e07
cmp dword [ebp - 0x998], 0
je 0x10013e07
mov dword [ebp - 0x988], 1
jmp 0x10013e0e
and dword [ebp - 0x988], 0
mov eax, dword [ebp - 0xad4]
cmp eax, dword [ebp - 0x988]
jl 0x10013e25
and dword [ebp - 0x47c], 0
jmp 0x10013e2f
mov dword [ebp - 0x47c], 1
push 0
lea ecx, [ebp - 0xa60]
call fcn.10011e0e
mov ecx, dword [ebp - 0x47c]
cmp ecx, dword [eax]
jne 0x10013e52
mov dword [ebp - 0x990], 1
jmp 0x10013e59
and dword [ebp - 0x990], 0
push 0
lea ecx, [ebp - 0xc84]
call fcn.10011e0e
mov ecx, dword [ebp - 0x990]
cmp ecx, dword [eax]
jge 0x10013e7c
mov dword [ebp - 0x484], 1
jmp 0x10013e83
and dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x484]
mov dword [ebp - 0x998], eax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xa60]
call fcn.10011e09
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc84]
call fcn.10011e09
mov dword [ebp - 0x274], 0xffff
push 2
lea ecx, [ebp - 0xa20]
call fcn.10011da1
mov dword [ebp - 4], 8
mov dword [ebp - 0x1e8], 0xffffffff
mov dword [ebp - 0x9c0], 4
mov dword [ebp - 0xaa0], 0x2c512dc6
mov dword [ebp - 0xbc], 0
jmp 0x10013f02
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x10013f24
push dword [ebp - 0xbc]
lea ecx, [ebp - 0xa20]
call fcn.10011e0e
mov dword [eax], 0xfffffff9
jmp 0x10013ef5
mov dword [ebp - 0xbc], 0
jmp 0x10013f3d
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x10013f59
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x360], 1
jmp 0x10013f30
push 0
lea ecx, [ebp - 0xa20]
call fcn.10011e0e
cmp dword [eax], 5
jle 0x10013f77
mov dword [ebp - 0x48c], 1
jmp 0x10013f7e
and dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x274]
mov dword [ebp - 0xa98], eax
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0xbb0], eax
mov eax, dword [ebp - 0x274]
inc eax
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0xa98]
cmp eax, dword [ebp - 0xbb0]
je 0x10013fbd
mov dword [ebp - 0x9a0], 1
jmp 0x10013fc4
and dword [ebp - 0x9a0], 0
push 0
lea ecx, [ebp - 0xa20]
call fcn.10011e0e
mov ecx, dword [ebp - 0x9a0]
cmp ecx, dword [eax]
jg 0x10013fe7
mov dword [ebp - 0x494], 1
jmp 0x10013fee
and dword [ebp - 0x494], 0
cmp dword [ebp - 0x494], 0x61c0f806
jl 0x1001400f
cmp dword [ebp - 0x274], 0
jge 0x1001400f
mov dword [ebp - 0x9a8], 1
jmp 0x10014016
and dword [ebp - 0x9a8], 0
push 0
lea ecx, [ebp - 0xa20]
call fcn.10011e0e
mov ecx, dword [ebp - 0x9a8]
mov dword [eax], ecx
push 3
pop eax
cmp eax, 0x8b06
jb 0x10014041
mov dword [ebp - 0x49c], 1
jmp 0x10014048
and dword [ebp - 0x49c], 0
cmp dword [ebp - 0x49c], 0x38d9
je 0x10014060
mov dword [ebp - 0x9b0], 1
jmp 0x10014067
and dword [ebp - 0x9b0], 0
mov eax, dword [ebp - 0x1e8]
add eax, dword [ebp - 0x9b0]
mov dword [ebp - 0x1e8], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1e8]
mov dword [ebp + eax - 0x360], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x360]
mov dword [ebp - 0xf14], eax
push 1
lea ecx, [ebp - 0xa20]
call fcn.10011e0e
mov eax, dword [ebp - 0x9c0]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x360]
cmp dword [ebp - 0x1e8], eax
jle 0x100140d3
mov dword [ebp - 0x4a4], 1
jmp 0x100140da
and dword [ebp - 0x4a4], 0
mov eax, dword [ebp - 0x4a4]
mov dword [ebp - 0xaa0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x360], 0xffff
ja 0x10014105
mov dword [ebp - 0x9b8], 1
jmp 0x1001410c
and dword [ebp - 0x9b8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x360]
imul eax, dword [ebp - 0x9b8]
cmp eax, 0xffffffff
je 0x10014131
mov dword [ebp - 0x4ac], 1
jmp 0x10014138
and dword [ebp - 0x4ac], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x4ac]
mov dword [ebp + eax - 0x360], ecx
push 0
lea ecx, [ebp - 0xa20]
call fcn.10011e0e
mov eax, dword [ebp - 0x9c0]
mov dword [ebp - 0xf1c], eax
push 0
lea ecx, [ebp - 0xa20]
call fcn.10011e0e
and dword [eax], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa20]
call fcn.10011e09
mov dword [ebp - 0x90], 0x2bbef7d6
push 2
lea ecx, [ebp - 0xc94]
call fcn.10011da1
mov dword [ebp - 4], 9
mov dword [ebp - 0x100], 0xfffa
mov dword [ebp - 0xaa8], 1
mov dword [ebp - 0xbb8], 0x3f045180
mov dword [ebp - 0xf24], 2
mov dword [ebp - 0x27c], 0
jmp 0x100141e2
mov eax, dword [ebp - 0x27c]
inc eax
mov dword [ebp - 0x27c], eax
cmp dword [ebp - 0x27c], 2
jge 0x10014201
push dword [ebp - 0x27c]
lea ecx, [ebp - 0xc94]
call fcn.10011e0e
or dword [eax], 0xffffffff
jmp 0x100141d5
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xf2c], eax
push 0
lea ecx, [ebp - 0xc94]
call fcn.10011e0e
mov dword [eax], 0x5689
cmp dword [ebp - 0x90], 0x5689
jl 0x10014238
mov dword [ebp - 0xc4c], 1
jmp 0x1001423f
and dword [ebp - 0xc4c], 0
mov eax, 0x6cd8
cmp eax, 8
jae 0x10014255
mov dword [ebp - 0x4b4], 1
jmp 0x1001425c
and dword [ebp - 0x4b4], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x4b4], eax
jle 0x10014276
mov dword [ebp - 0x9c8], 1
jmp 0x1001427d
and dword [ebp - 0x9c8], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x9c8], eax
jl 0x10014297
mov dword [ebp - 0x9d0], 1
jmp 0x1001429e
and dword [ebp - 0x9d0], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x9d0], eax
jle 0x100142b8
mov dword [ebp - 0x4c0], 1
jmp 0x100142bf
and dword [ebp - 0x4c0], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0x4c0], eax
je 0x100142e2
cmp dword [ebp - 0x90], 0
je 0x100142e2
mov dword [ebp - 0x790], 1
jmp 0x100142e9
and dword [ebp - 0x790], 0
mov eax, dword [ebp - 0x790]
mov dword [ebp - 0xaa8], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xf34], eax
mov eax, dword [ebp - 0x100]
dec eax
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0xf3c], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0xf44], eax
mov eax, 0x6ae3d475
neg eax
imul eax, eax, 0xa117
cmp eax, 0xf4a8
jle 0x10014346
mov dword [ebp - 0x4c8], 1
jmp 0x1001434d
and dword [ebp - 0x4c8], 0
mov eax, dword [ebp - 0x4c8]
neg eax
jne 0x10014397
mov dword [ebp - 0x780], 0x1fa6f63e
mov dword [ebp - 0x100], 0xfffffff7
jmp 0x1001437a
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x25
je 0x10014392
mov eax, dword [ebp - 0x780]
inc eax
mov dword [ebp - 0x780], eax
jmp 0x1001436d
jmp 0x1001441f
mov dword [ebp - 0x4d0], 0xd4938140
mov dword [ebp - 0x1f0], 0x95cc9e52
mov eax, dword [ebp - 0xbb8]
mov dword [ebp - 0xf4c], eax
push 1
lea ecx, [ebp - 0xc94]
call fcn.10011e0e
mov dword [ebp - 0x4d0], 0x2a6add33
mov esi, dword [ebp - 0x4d0]
mov edi, dword [ebp - 0x1f0]
push 1
lea ecx, [ebp - 0xc94]
call fcn.10011e0e
sub edi, dword [eax]
sub esi, edi
mov eax, dword [ebp - 0x1f0]
lea eax, [esi + eax + 5]
cmp eax, dword [ebp - 0x1f0]
jl 0x10014409
mov dword [ebp - 0x784], 1
jmp 0x10014410
and dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x784]
sub eax, 7
mov dword [ebp - 0x1f0], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc94]
call fcn.10011e09
mov dword [ebp - 0x10a8], 0xa5d6c05b
mov dword [ebp - 0x10a4], 0xa5d6c05b
mov dword [ebp - 0x10a0], 0xa5d6c05b
mov dword [ebp - 0x109c], 0xa5d6c05b
mov dword [ebp - 0x284], 0xffffffff
mov dword [ebp - 0x4f8], 0
push 1
lea ecx, [ebp - 0xcac]
call fcn.10011da1
mov dword [ebp - 4], 0xa
push 2
lea ecx, [ebp - 0xa6c]
call fcn.10011da1
mov byte [ebp - 4], 0xb
mov dword [ebp - 0xab0], 0xd14c
mov dword [ebp - 0x6c], 0
jmp 0x100144a9
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x100144c2
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xcac]
call fcn.10011e0e
and dword [eax], 0
jmp 0x100144a2
mov dword [ebp - 0x6c], 0
jmp 0x100144d2
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 2
jge 0x100144ee
push dword [ebp - 0x6c]
lea ecx, [ebp - 0xa6c]
call fcn.10011e0e
mov dword [eax], 0x6f7fbf21
jmp 0x100144cb
mov dword [ebp - 0x284], 0
jmp 0x10014507
mov eax, dword [ebp - 0x284]
inc eax
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x284], 3
jg 0x10014562
mov dword [ebp - 0x1f8], 0
jmp 0x10014529
mov eax, dword [ebp - 0x1f8]
inc eax
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 1
jge 0x10014545
mov eax, dword [ebp - 0x1f8]
mov dword [ebp + eax*4 - 0x4d8], 0
jmp 0x1001451c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x4d8]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x4d8], eax
jmp 0x100144fa
push 0
lea ecx, [ebp - 0xa6c]
call fcn.10011e0e
cmp dword [eax], 0
jne 0x1001464d
mov eax, 0x17f4
test eax, eax
je 0x1001459f
push 0
lea ecx, [ebp - 0xcac]
call fcn.10011e0e
cmp dword [eax], 0
je 0x1001459f
mov dword [ebp - 0x97c], 1
jmp 0x100145a6
and dword [ebp - 0x97c], 0
mov esi, dword [ebp - 0x97c]
sub esi, 0x4594bd42
push 1
lea ecx, [ebp - 0xa6c]
call fcn.10011e0e
cmp esi, dword [eax]
jl 0x100145cf
mov dword [ebp - 0x4e0], 1
jmp 0x100145d6
and dword [ebp - 0x4e0], 0
mov esi, dword [ebp - 0x4e0]
add esi, 7
push 0
lea ecx, [ebp - 0xcac]
call fcn.10011e0e
cmp esi, dword [eax]
jg 0x100145fc
mov dword [ebp - 0x78c], 1
jmp 0x10014603
and dword [ebp - 0x78c], 0
push 1
lea ecx, [ebp - 0xa6c]
call fcn.10011e0e
mov ecx, dword [ebp - 0x78c]
cmp ecx, dword [eax]
jne 0x1001462f
cmp dword [ebp - 0x4f8], 0
je 0x1001462f
mov dword [ebp - 0x4e8], 1
jmp 0x10014636
and dword [ebp - 0x4e8], 0
mov eax, dword [ebp - 0xab0]
cmp eax, dword [ebp - 0x4e8]
jl 0x1001464d
and dword [ebp - 0x8dc], 0
jmp 0x10014657
mov dword [ebp - 0x8dc], 1
push 0
lea ecx, [ebp - 0xa6c]
call fcn.10011e0e
mov ecx, dword [ebp - 0x8dc]
cmp ecx, dword [eax]
jne 0x1001467a
mov dword [ebp - 0x4f0], 1
jmp 0x10014681
and dword [ebp - 0x4f0], 0
push 0
lea ecx, [ebp - 0xcac]
call fcn.10011e0e
mov ecx, dword [ebp - 0x4f0]
cmp ecx, dword [eax]
jge 0x100146a4
mov dword [ebp - 0x794], 1
jmp 0x100146ab
and dword [ebp - 0x794], 0
mov eax, dword [ebp - 0x794]
mov dword [ebp - 0x4f8], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0xa6c]
call fcn.10011e09
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xcac]
call fcn.10011e09
mov dword [ebp - 0x28c], 0xffff
push 2
lea ecx, [ebp - 0xa30]
call fcn.10011da1
mov dword [ebp - 4], 0xc
mov dword [ebp - 0x200], 0xffffffff
mov dword [ebp - 0x520], 4
mov dword [ebp - 0xbc0], 0x2c512dc6
mov dword [ebp - 0x98], 0
jmp 0x1001472a
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x1001474c
push dword [ebp - 0x98]
lea ecx, [ebp - 0xa30]
call fcn.10011e0e
mov dword [eax], 0xfffffff9
jmp 0x1001471d
mov dword [ebp - 0x98], 0
jmp 0x10014765
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 2
jge 0x10014781
mov eax, dword [ebp - 0x98]
mov dword [ebp + eax*4 - 0x370], 1
jmp 0x10014758
push 0
lea ecx, [ebp - 0xa30]
call fcn.10011e0e
cmp dword [eax], 5
jle 0x1001479f
mov dword [ebp - 0xa0c], 1
jmp 0x100147a6
and dword [ebp - 0xa0c], 0
mov eax, dword [ebp - 0x28c]
mov dword [ebp - 0xc48], eax
mov eax, dword [ebp - 0xa0c]
mov dword [ebp - 0xab8], eax
mov eax, dword [ebp - 0x28c]
inc eax
mov dword [ebp - 0x28c], eax
mov eax, dword [ebp - 0xc48]
cmp eax, dword [ebp - 0xab8]
je 0x100147e5
mov dword [ebp - 0x500], 1
jmp 0x100147ec
and dword [ebp - 0x500], 0
push 0
lea ecx, [ebp - 0xa30]
call fcn.10011e0e
mov ecx, dword [ebp - 0x500]
cmp ecx, dword [eax]
jg 0x1001480f
mov dword [ebp - 0x79c], 1
jmp 0x10014816
and dword [ebp - 0x79c], 0
cmp dword [ebp - 0x79c], 0x61c0f806
jl 0x10014837
cmp dword [ebp - 0x28c], 0
jge 0x10014837
mov dword [ebp - 0x508], 1
jmp 0x1001483e
and dword [ebp - 0x508], 0
push 0
lea ecx, [ebp - 0xa30]
call fcn.10011e0e
mov ecx, dword [ebp - 0x508]
mov dword [eax], ecx
push 3
pop eax
cmp eax, 0x8b06
jb 0x10014869
mov dword [ebp - 0x8e4], 1
jmp 0x10014870
and dword [ebp - 0x8e4], 0
cmp dword [ebp - 0x8e4], 0x38d9
je 0x10014888
mov dword [ebp - 0x510], 1
jmp 0x1001488f
and dword [ebp - 0x510], 0
mov eax, dword [ebp - 0x200]
add eax, dword [ebp - 0x510]
mov dword [ebp - 0x200], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x200]
mov dword [ebp + eax - 0x370], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x370]
mov dword [ebp - 0xf54], eax
push 1
lea ecx, [ebp - 0xa30]
call fcn.10011e0e
mov eax, dword [ebp - 0x520]
push 4
pop ecx
imul ecx, ecx, 0
add eax, dword [ebp + ecx - 0x370]
cmp dword [ebp - 0x200], eax
jle 0x100148fb
mov dword [ebp - 0x7a4], 1
jmp 0x10014902
and dword [ebp - 0x7a4], 0
mov eax, dword [ebp - 0x7a4]
mov dword [ebp - 0xbc0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x370], 0xffff
ja 0x1001492d
mov dword [ebp - 0x518], 1
jmp 0x10014934
and dword [ebp - 0x518], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x370]
imul eax, dword [ebp - 0x518]
cmp eax, 0xffffffff
je 0x10014959
mov dword [ebp - 0x984], 1
jmp 0x10014960
and dword [ebp - 0x984], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x984]
mov dword [ebp + eax - 0x370], ecx
push 0
lea ecx, [ebp - 0xa30]
call fcn.10011e0e
mov eax, dword [ebp - 0x520]
mov dword [ebp - 0xf5c], eax
push 0
lea ecx, [ebp - 0xa30]
call fcn.10011e0e
and dword [eax], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa30]
call fcn.10011e09
mov dword [ebp - 0x160], 1
mov dword [ebp - 0x294], 0
jmp 0x100149ce
mov eax, dword [ebp - 0x294]
inc eax
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x294], 3
jge 0x100149ea
mov eax, dword [ebp - 0x294]
mov dword [ebp + eax*4 - 0x1014], 0xfffffffb
jmp 0x100149c1
mov dword [ebp - 0x160], 2
jmp 0x10014a03
mov eax, dword [ebp - 0x160]
dec eax
mov dword [ebp - 0x160], eax
cmp dword [ebp - 0x160], 0
jl 0x10014a40
mov eax, dword [ebp - 0x160]
mov ecx, dword [ebp - 0x160]
mov eax, dword [ebp + eax*4 - 0x1014]
mov dword [ebp + ecx*4 - 0x1014], eax
mov byte [ebp - 0xf2], 0
movzx eax, byte [ebp - 0xf2]
test eax, eax
je 0x10014a3e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x100149f6
mov dword [ebp - 0x3c], 7
mov dword [ebp - 0xac0], 0x9d1fe905
mov dword [ebp - 0x3c], 9
jmp 0x10014a61
cmp dword [ebp - 0x3c], 0x1b
jl 0x10014d80
mov dword [ebp - 0x2d8], 0xad9ddcef
push 1
lea ecx, [ebp - 0xcbc]
call fcn.10011da1
mov dword [ebp - 4], 0xd
mov dword [ebp - 0x530], 0xb11de2a9
mov dword [ebp - 0xce0], 0
mov dword [ebp - 0x29c], 0
jmp 0x10014ab6
mov eax, dword [ebp - 0x29c]
inc eax
mov dword [ebp - 0x29c], eax
cmp dword [ebp - 0x29c], 1
jge 0x10014ad5
push dword [ebp - 0x29c]
lea ecx, [ebp - 0xcbc]
call fcn.10011e0e
or dword [eax], 0xffffffff
jmp 0x10014aa9
mov eax, dword [ebp - 0x3c]
neg eax
cmp eax, dword [ebp - 0x3c]
je 0x10014ba3
push 3
lea ecx, [ebp - 0xde4]
call fcn.10011da1
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x170], 0xffffffff
mov dword [ebp - 0x20c], 0
jmp 0x10014b17
cmp dword [ebp - 0x20c], 3
jge 0x10014b39
mov dword [ebp - 0x320], 0x22a1
mov dword [ebp - 0x8f4], 0x5b3d925d
push 0
lea ecx, [ebp - 0xcbc]
call fcn.10011e0e
mov ecx, dword [ebp - 0x3c]
cmp dword [eax], ecx
jle 0x10014bd7
mov dword [ebp - 0x7ac], 1
jmp 0x10014bde
and dword [ebp - 0x7ac], 0
mov eax, dword [ebp - 0x320]
cmp dword [ebp - 0x7ac], eax
je 0x10014bf8
mov dword [ebp - 0xc4], 0x2bbef7d6
push 2
lea ecx, [ebp - 0xccc]
call fcn.10011da1
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x108], 0xfffa
mov dword [ebp - 0xbc8], 1
mov dword [ebp - 0xad0], 0x3f045180
mov dword [ebp - 0xf64], 2
mov dword [ebp - 0x210], 0
jmp 0x10014ddf
mov eax, dword [ebp - 0x210]
inc eax
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 2
jge 0x10014dfe
push dword [ebp - 0x210]
lea ecx, [ebp - 0xccc]
call fcn.10011e0e
or dword [eax], 0xffffffff
jmp 0x10014dd2
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0xf6c], eax
push 0
lea ecx, [ebp - 0xccc]
call fcn.10011e0e
mov dword [eax], 0x5689
cmp dword [ebp - 0xc4], 0x5689
jl 0x10014e35
mov dword [ebp - 0xac8], 1
jmp 0x10014e3c
and dword [ebp - 0xac8], 0
mov eax, 0x6cd8
cmp eax, 8
jae 0x10014e52
mov dword [ebp - 0x7c4], 1
jmp 0x10014e59
and dword [ebp - 0x7c4], 0
mov eax, dword [ebp - 0xc4]
cmp dword [ebp - 0x7c4], eax
jle 0x10014e73