Function at 0x100270f1
Capabilities:
Create process on windows
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007510f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x354
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x310], 8
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x10027146
push 0
push 0
push 0
push 0
push 0
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x1002715e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x184], 0x43250e6d
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0xe0], 0x1434a938
push 3
lea ecx, [ebp - 0x2a4]
call fcn.10024355
and dword [ebp - 4], 0
mov dword [ebp - 0x84], 0
jmp 0x100271aa
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x100271c9
push dword [ebp - 0x84]
lea ecx, [ebp - 0x2a4]
call fcn.100243d3
and dword [eax], 0
jmp 0x1002719d
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x184], eax
mov eax, dword [ebp - 0x184]
cmp eax, dword [ebp - 0x20]
jle 0x100271e9
mov dword [ebp - 0x108], 1
jmp 0x100271f0
and dword [ebp - 0x108], 0
cmp dword [ebp - 0x20], 1
jle 0x10027209
push 0xfffffffffffffffd
pop eax
test eax, eax
je 0x10027209
mov dword [ebp - 0x218], 1
jmp 0x10027210
and dword [ebp - 0x218], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x218], eax
jle 0x10027227
mov dword [ebp - 0x220], 1
jmp 0x1002722e
and dword [ebp - 0x220], 0
mov eax, dword [ebp - 0x20]
imul eax, dword [ebp - 0x220]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
je 0x1002725f
cmp dword [ebp - 0x4c], 0
je 0x1002725f
cmp dword [ebp - 0x20], 0
je 0x1002725f
cmp dword [ebp - 0x4c], 0
je 0x1002725f
mov dword [ebp - 0x214], 1
jmp 0x10027266
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0x20], 0xdfe9
jne 0x10027287
mov dword [ebp - 0x1b8], 1
jmp 0x1002728e
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1b8]
je 0x100272a5
mov dword [ebp - 0x1c8], 1
jmp 0x100272ac
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x108]
cmp eax, dword [ebp - 0x1c8]
jge 0x100272c6
mov dword [ebp - 0x110], 1
jmp 0x100272cd
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x110], eax
jge 0x100272e4
mov dword [ebp - 0x1d0], 1
jmp 0x100272eb
and dword [ebp - 0x1d0], 0
push 1
lea ecx, [ebp - 0x2a4]
call fcn.100243d3
mov ecx, dword [ebp - 0x1d0]
mov dword [eax], ecx
mov dword [ebp - 0x20], 0
jmp 0x10027310
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x33
je 0x100273fb
mov dword [ebp - 0x44], 2
cmp dword [ebp - 0xe0], 0
je 0x1002736a
cmp dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2fc], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x44]
jle 0x1002734b
mov dword [ebp - 0x118], 1
jmp 0x10027352
and dword [ebp - 0x118], 0
cmp dword [ebp - 0x118], 0x1aa435c5
jl 0x1002736a
mov dword [ebp - 0x240], 1
jmp 0x10027371
and dword [ebp - 0x240], 0
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x44]
cmp eax, 0x83cd
jl 0x1002738a
mov dword [ebp - 0x1d8], 1
jmp 0x10027391
and dword [ebp - 0x1d8], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x1d8], eax
je 0x100273a8
mov dword [ebp - 0x120], 1
jmp 0x100273af
and dword [ebp - 0x120], 0
mov esi, dword [ebp - 0x4c]
push 1
lea ecx, [ebp - 0x2a4]
call fcn.100243d3
mov ecx, dword [ebp - 0x120]
sub ecx, dword [eax]
imul ecx, esi
cmp dword [ebp - 0x4c], ecx
jne 0x100273db
mov dword [ebp - 0x1e0], 1
jmp 0x100273e2
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0x4c], 0
je 0x100273f6
jmp 0x100273fb
jmp 0x10027309
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.100243b7
movzx eax, byte [0x106e16f4]
test eax, eax
je 0x10027428
mov esi, 0x1007b890
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100289a8
mov dword [ebp - 0x324], 0x1007b890
mov dword [ebp - 0xb0], 0xfd3df75d
push 3
lea ecx, [ebp - 0x2d8]
call fcn.10024355
mov dword [ebp - 4], 1
mov dword [ebp - 0x88], 0
jmp 0x10027469
mov eax, dword [ebp - 0x88]
inc eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 3
jge 0x1002748b
push dword [ebp - 0x88]
lea ecx, [ebp - 0x2d8]
call fcn.100243d3
mov dword [eax], 3
jmp 0x1002745c
mov dword [ebp - 0xb0], 0
jmp 0x100274a4
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xc
jge 0x100274f1
mov dword [ebp - 0x248], 0xffffffff
mov dword [ebp - 0x304], 0xa11c1574
mov dword [ebp - 0x248], 0x35f394a2
push 1
lea ecx, [ebp - 0x2d8]
call fcn.100243d3
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x128]
mov dword [ecx], eax
jmp 0x10027497
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d8]
call fcn.100243b7
mov dword [ebp - 0x2e0], 0x1007b894
and dword [ebp - 0x2cc], 0
and dword [ebp - 0x2c8], 0
and dword [ebp - 0x2c4], 0
and dword [ebp - 0x2c0], 0
lea ecx, [ebp - 0xbd]
call fcn.100243e2
push eax
lea eax, [ebp - 0x2bc]
push eax
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x34c]
call fcn.100243e5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xf0]
call fcn.10024391
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0xe5ccc90a
mov dword [ebp - 0x28], 3
jmp 0x10027579
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10027b3f
mov dword [ebp - 0x3c], 0xfffffffc
mov dword [ebp - 0x16c], 5
mov dword [ebp - 0x70], 1
mov dword [ebp - 0x3c], 0
jmp 0x100275ab
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 3
jg 0x10027b3a
mov dword [ebp - 0x38], 4
mov dword [ebp - 0x1e8], 0x11b0
mov dword [ebp - 0x268], 0x100083b0
cmp dword [ebp - 0x1e8], 0x11c3
jle 0x10027688
and dword [ebp - 0x90], 0
jmp 0x100275f6
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0x6197
jge 0x10027688
and dword [ebp - 0xa8], 0
jmp 0x1002761c
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x27f
jge 0x10027683
and dword [ebp - 0x98], 0
jmp 0x1002763e
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x5aed
jge 0x10027681
mov eax, dword [ebp - 0x90]
add eax, dword [ebp - 0xa8]
or eax, dword [ebp - 0x98]
cdq
mov dword [ebp - 0x254], eax
mov dword [ebp - 0x250], edx
push dword [ebp - 0x250]
push dword [ebp - 0x254]
mov ecx, 0x1061d018
call fcn.10024240
jmp 0x10027631
jmp 0x1002760f
jmp 0x100275e9
mov dword [ebp - 0x278], 0x24e8160a
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1e8], 0x1037
jge 0x100276b2
mov edx, dword [ebp - 0x268]
mov ecx, 0x1061d018
call fcn.10025e4a
jmp 0x100276ce
mov dword [ebp - 4], 2
jmp 0x100276de
mov dword [ebp - 0x38], 3
jmp 0x100276ee
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x10027b22
push 3
lea ecx, [ebp - 0x23c]
call fcn.10024355
mov byte [ebp - 4], 5
mov dword [ebp - 0x270], 9
mov dword [ebp - 0x64], 0xbab91ee3
mov dword [ebp - 0xac], 0
jmp 0x10027733
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 3
jge 0x10027755
push dword [ebp - 0xac]
lea ecx, [ebp - 0x23c]
call fcn.100243d3
mov dword [eax], 0x3cfcb8f1
jmp 0x10027726
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.100243d3
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.100243d3
mov esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.100243d3
mov eax, dword [eax]
cmp eax, dword [esi]
je 0x10027793
mov dword [ebp - 0x130], 1
jmp 0x1002779a
and dword [ebp - 0x130], 0
push 3
lea ecx, [ebp - 0xf0]
call fcn.100243d3
mov eax, dword [eax]
cmp eax, dword [ebp - 0x130]
jl 0x100277bd
mov dword [ebp - 0x1f0], 1
jmp 0x100277c4
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1f0], eax
jge 0x100277db
mov dword [ebp - 0x138], 1
jmp 0x100277e2
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 0x138]
cmp eax, dword [ebp - 0x28]
jle 0x100277fc
mov dword [ebp - 0x1f8], 1
jmp 0x10027803
and dword [ebp - 0x1f8], 0
imul eax, dword [ebp - 0x1f8], 0x954e
mov esi, 0xedac7a8
sub esi, eax
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.100243d3
cmp esi, dword [eax]
je 0x10027832
mov dword [ebp - 0x140], 1
jmp 0x10027839
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x140], eax
jne 0x10027850
mov dword [ebp - 0x200], 1
jmp 0x10027857
and dword [ebp - 0x200], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x200], eax
jg 0x1002786e
mov dword [ebp - 0x148], 1
jmp 0x10027875
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x148], eax
je 0x1002788c
mov dword [ebp - 0x208], 1
jmp 0x10027893
and dword [ebp - 0x208], 0
push 0
lea ecx, [ebp - 0xf0]
call fcn.100243d3
mov ecx, dword [ebp - 0x208]
cmp ecx, dword [eax]
jl 0x100278b6
mov dword [ebp - 0xd8], 1
jmp 0x100278bd
and dword [ebp - 0xd8], 0
push 2
lea ecx, [ebp - 0x23c]
call fcn.100243d3
mov ecx, dword [ebp - 0xd8]
mov dword [eax], ecx
imul eax, dword [ebp - 0xd8], 0xed4b
mov dword [ebp - 0x16c], eax
mov eax, 0xee01e6e8
test eax, eax
jb 0x100278f8
xor eax, eax
jne 0x100278f8
and dword [ebp - 0x210], 0
jmp 0x10027902
mov dword [ebp - 0x210], 1
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x270]
mov dword [ebp - 0x2e8], eax
cmp dword [ebp - 0x278], 0x8d6d
jl 0x1002792f
mov dword [ebp - 0x154], 1
jmp 0x10027936
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x154]
lea eax, [ecx + eax + 0xe0689bb]
cmp eax, dword [ebp - 0x64]
jl 0x10027957
mov dword [ebp - 0x1c0], 1
jmp 0x1002795e
and dword [ebp - 0x1c0], 0
push 2
lea ecx, [ebp - 0x23c]
call fcn.100243d3
mov ecx, dword [ebp - 0x1c0]
cmp ecx, dword [eax]
jle 0x10027990
push 1
lea ecx, [ebp - 0x23c]
call fcn.100243d3
cmp dword [eax], 0
jne 0x10027990
and dword [ebp - 0x15c], 0
jmp 0x1002799a
mov dword [ebp - 0x15c], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x15c], eax
jg 0x100279b1
mov dword [ebp - 0x1c4], 1
jmp 0x100279b8
and dword [ebp - 0x1c4], 0
push 1
lea ecx, [ebp - 0x23c]
call fcn.100243d3
mov ecx, dword [ebp - 0x1c4]
cmp ecx, dword [eax]
jge 0x100279db
mov dword [ebp - 0x164], 1
jmp 0x100279e2
and dword [ebp - 0x164], 0
cmp dword [ebp - 0x164], 0xcf69bad9
jne 0x100279fa
mov dword [ebp - 0x1f4], 1
jmp 0x10027a01
and dword [ebp - 0x1f4], 0
cmp dword [ebp - 0x1f4], 0
jle 0x10027a25
push 0
lea ecx, [ebp - 0xf0]
call fcn.100243d3
cmp dword [eax], 0
jne 0x10027a25
and dword [ebp - 0x1cc], 0
jmp 0x10027a2f
mov dword [ebp - 0x1cc], 1
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x1cc], eax
jg 0x10027a49
mov dword [ebp - 0x174], 1
jmp 0x10027a50
and dword [ebp - 0x174], 0
cmp dword [ebp - 0x174], 4
jge 0x10027a67
push dword [ebp - 0x28]
lea ecx, [ebp - 0xf0]
call fcn.100243d3
mov eax, 0x1afc438f
test eax, eax
je 0x10027a94
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x10027a92
push 0x2482
push 0x219b
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x10027b0e
mov dword [ebp - 0x70], 3
jmp 0x10027aa4
mov eax, dword [ebp - 0x70]
dec eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
jl 0x10027b0e
mov byte [ebp - 0x55], 0
movzx eax, byte [ebp - 0x55]
test eax, eax
je 0x10027ac3
push 0
push 0x15e
call dword [sym.imp.USER32.dll_ShowOwnedPopups]
mov dword [ebp - 0x64], 0
jmp 0x10027ad3
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jg 0x10027b0c
mov dword [ebp - 0x20c], 0x24061354
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x10027afd
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov eax, dword [ebp - 0x20c]
dec eax
mov dword [ebp - 0x20c], eax
jmp 0x10027acc
jmp 0x10027a9d
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x23c]
call fcn.100243b7
jmp 0x100276e7
push dword [ebp - 0x3c]
lea ecx, [ebp - 0xf0]
call fcn.100243d3
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
jmp 0x100275a4
jmp 0x10027572
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf0]
call fcn.100243b7
mov byte [0x106e16f4], 1
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x1007b680
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x2b8], 0xb55bb2c2
mov dword [ebp - 0x2b4], 0xb55bb2c2
mov dword [ebp - 0x2b0], 0xb55bb2c2
mov dword [ebp - 0x2ac], 0xb55bb2c2
lea ecx, [ebp - 0xe1]
call fcn.100243e2
push eax
lea eax, [ebp - 0x2a8]
push eax
lea eax, [ebp - 0x2b8]
push eax
lea ecx, [ebp - 0x344]
call fcn.100243e5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0xd0]
call fcn.10024391
mov dword [ebp - 4], 6
mov dword [ebp - 0x6c], 0xe72e
mov dword [ebp - 0xb4], 2
mov dword [ebp - 0x1ec], 0x76dbd8d4
mov dword [ebp - 0xa0], 0
jmp 0x10027c01
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 1
jge 0x10027c1a
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x1c], 0x689351f2
jmp 0x10027bf4
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c], 3
jmp 0x10027c3f
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
jl 0x10027f33
mov dword [ebp - 0x60], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0xd0]
call fcn.100243d3
cmp dword [eax], 0
jne 0x10027e05
mov eax, dword [ebp - 0x6c]
cmp eax, dword [ebp - 0x6c]
je 0x10027c89
mov dword [ebp - 0x17c], 1
jmp 0x10027c90
and dword [ebp - 0x17c], 0
cmp dword [ebp - 0x17c], 1
jne 0x10027ca5
mov dword [ebp - 0x1d4], 1
jmp 0x10027cac
and dword [ebp - 0x1d4], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0xd0]
call fcn.100243d3
mov esi, dword [ebp - 0x1d4]
imul esi, dword [eax]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0xd0]
call fcn.100243d3
cmp esi, dword [eax]
je 0x10027cef
mov dword [ebp - 0xfc], 1
jmp 0x10027cf6
and dword [ebp - 0xfc], 0
push 3
lea ecx, [ebp - 0xd0]
call fcn.100243d3
mov ecx, dword [ebp - 0xfc]
imul ecx, dword [eax]
test ecx, ecx
je 0x10027d25
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0xd0]
call fcn.100243d3
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
mov dword [ebp - 0x2f0], eax
cmp dword [ebp - 0xb4], 0
je 0x10027d50
cmp dword [ebp - 0x60], 0
je 0x10027d50
mov dword [ebp - 0x1fc], 1
jmp 0x10027d57
and dword [ebp - 0x1fc], 0
or eax, 0xffffffff
sub eax, dword [ebp - 0x1fc]
cmp eax, dword [ebp - 0x60]
jne 0x10027d71
mov dword [ebp - 0x18c], 1
jmp 0x10027d78
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x18c], eax
jne 0x10027d8f
mov dword [ebp - 0x1dc], 1
jmp 0x10027d96
and dword [ebp - 0x1dc], 0
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0x1dc]
test eax, eax
jne 0x10027db6
mov eax, 0xfb18ba70
test eax, eax
jne 0x10027db6
and dword [ebp - 0x194], 0
jmp 0x10027dc0
mov dword [ebp - 0x194], 1
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0xd0]
call fcn.100243d3
mov ecx, dword [ebp - 0x194]
imul ecx, dword [eax]
test ecx, ecx
jne 0x10027e05
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0xd0]
call fcn.100243d3
cmp dword [eax], 0
jne 0x10027e05
and dword [ebp - 0x21c], 0
jmp 0x10027e0f
mov dword [ebp - 0x21c], 1
mov esi, dword [ebp - 0xb4]
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0xd0]
call fcn.100243d3
mov ecx, dword [ebp - 0x21c]
imul ecx, dword [eax]
cmp ecx, esi
jne 0x10027e43
mov dword [ebp - 0x294], 1
jmp 0x10027e4a
and dword [ebp - 0x294], 0
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x2f8], eax
or eax, 0xffffffff
cmp eax, 0x7a0
jl 0x10027e69
mov dword [ebp - 0x19c], 1
jmp 0x10027e70
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x60]
add eax, dword [ebp - 0x19c]
cmp eax, dword [ebp - 0xb4]
jne 0x10027e9c
push 0
lea ecx, [ebp - 0xd0]
call fcn.100243d3
cmp dword [eax], 0
jne 0x10027e9c
and dword [ebp - 0x1e4], 0
jmp 0x10027ea6
mov dword [ebp - 0x1e4], 1
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x1e4], eax
jg 0x10027ebd
mov dword [ebp - 0x1a4], 1
jmp 0x10027ec4
and dword [ebp - 0x1a4], 0
push 4
pop eax
imul eax, eax, 0
push dword [ebp + eax - 0x1c]
lea ecx, [ebp - 0xd0]
call fcn.100243d3
mov eax, dword [eax]
cmp eax, dword [ebp - 0x1a4]
jge 0x10027eef
mov dword [ebp - 0x204], 1
jmp 0x10027ef6
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x204]
neg eax
cmp eax, dword [ebp - 0xb4]
jle 0x10027f12
mov dword [ebp - 0x1ac], 1
jmp 0x10027f19
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x1ac]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x1ec], eax
jmp 0x10027c2a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd0]
call fcn.100243b7
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x1007b680
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0xc4], 0xaebb1bb3
mov dword [ebp - 0x24c], 0xfffffffc
mov dword [ebp - 0x78], 0
jmp 0x10027f7e
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 2
jge 0x10027f94
mov eax, dword [ebp - 0x78]
mov dword [ebp + eax*4 - 0xf8], 0x3342eb9
jmp 0x10027f77
mov dword [ebp - 0x14], 0
jmp 0x10027fa4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jg 0x1002838e
mov dword [ebp - 0x150], 0xb09b37d0
mov dword [ebp - 0x74], 0xf4e55b65
mov dword [ebp - 0x68], 0xffffffff
mov dword [ebp - 0x5c], 0x83a09977
mov dword [ebp - 0xbc], 0
jmp 0x10027fe6
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 3
jge 0x10028002
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x33c], 0xd5eb
jmp 0x10027fd9
mov dword [ebp - 0x1a8], 0x2c82
mov dword [ebp - 0x27c], 0x1000843c
cmp dword [ebp - 0x1a8], 0x2f5c
jle 0x100280eb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
and dword [ebp - 0x80], 0
jmp 0x1002803d
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x6b19
jge 0x100280e3
and dword [ebp - 0x7c], 0
jmp 0x10028057
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0xdcc
jge 0x100280de
and dword [ebp - 0x8c], 0
jmp 0x10028076
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0x1bc4
jge 0x100280d9
mov eax, dword [ebp - 0x80]
sub eax, dword [ebp - 0x7c]
or eax, dword [ebp - 0x8c]
cdq
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], edx
push dword [ebp - 0x25c]
push dword [ebp - 0x260]
lea ecx, [ebp - 0x364]
call fcn.1000aa40
pop ecx
pop ecx
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x244]
call fcn.10024220
push eax
call fcn.1005bb96
pop ecx
lea ecx, [ebp - 0x364]
call fcn.10024216
jmp 0x10028069
jmp 0x10028050
jmp 0x10028036
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xf8], 0
jne 0x1002831f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x300], eax
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x308], eax
mov eax, 0x4d25
sub eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x74]
jl 0x10028127
mov dword [ebp - 0x1b4], 1
jmp 0x1002812e
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x1b4]
sub eax, dword [ebp - 0x14]
jne 0x1002813f
cmp dword [ebp - 0x14], 0
je 0x10028151
cmp dword [ebp - 0x14], 0
je 0x10028151
mov dword [ebp - 0x1bc], 1
jmp 0x10028158
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0x1bc]
test eax, eax
jne 0x1002816a
cmp dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xf8]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14c]
mov dword [ebp + eax*4 - 0xf8], ecx
cmp dword [ebp - 0x14c], 0x5f93be41
je 0x100281a2
mov dword [ebp - 0x158], 1
jmp 0x100281a9
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x150], eax
mov eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x158]
jne 0x100281cc
mov dword [ebp - 0x160], 1
jmp 0x100281d3
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0xf8]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x68], 0
jne 0x100281f9
cmp dword [ebp - 0x5c], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x5c]
jl 0x1002820d
mov dword [ebp - 0x168], 1
jmp 0x10028214
and dword [ebp - 0x168], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x5c]
jge 0x1002822e
mov dword [ebp - 0x170], 1
jmp 0x10028235
and dword [ebp - 0x170], 0
imul eax, dword [ebp - 0x170], 0xd9d6
cmp eax, 0xe96f
jle 0x10028255
cmp dword [ebp - 0x14], 0
jne 0x10028255
and dword [ebp - 0x178], 0
jmp 0x1002825f
mov dword [ebp - 0x178], 1
cmp dword [ebp - 0x178], 0xffffffff
jl 0x10028274
mov dword [ebp - 0x180], 1
jmp 0x1002827b
and dword [ebp - 0x180], 0
mov eax, dword [ebp - 0x180]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jne 0x1002829b
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0xf8], 0
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x68]
jge 0x100282b2
mov dword [ebp - 0x188], 1
jmp 0x100282b9
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x188]
cmp eax, dword [ebp - 0x14]
jle 0x100282e4
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0xf8], 0
je 0x100282e4
mov dword [ebp - 0x190], 1
jmp 0x100282eb
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0x190], eax
jle 0x10028302
mov dword [ebp - 0x198], 1
jmp 0x10028309
and dword [ebp - 0x198], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x68]
add ecx, dword [ebp - 0x198]
cmp ecx, dword [ebp + eax - 0x33c]
cmp dword [ebp - 0x5c], 2
jge 0x10028331
mov dword [ebp - 0x1a0], 1
jmp 0x10028338
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x24c], eax
mov dword [ebp - 4], 7
cmp dword [ebp - 0x1a8], 0x2a68
jge 0x10028363
push dword [ebp - 0x27c]
call fcn.1005bb96
pop ecx
jmp 0x1002837f
or dword [ebp - 4], 0xffffffff
jmp 0x10028389
jmp 0x10027f9d
mov byte [ebp - 0x40], 0
movzx eax, byte [ebp - 0x40]
test eax, eax
je 0x100283aa
push 0x17cd
push 0x1d66
call dword [sym.imp.GDI32.dll_SetStretchBltMode]
mov eax, dword [ebp - 0x1b0]
mov dword [0x1007b890], eax
mov eax, dword [ebp - 0xd4]
mov dword [0x1007b894], eax
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0xd4]
mov edx, dword [edx + eax]
mov eax, dword [ebp - 0x1b0]
mov ecx, dword [eax + ecx]
call fcn.100270b0
mov dword [ebp - 0x258], eax
push 4
lea ecx, [ebp - 0x31c]
call fcn.10024355
mov dword [ebp - 4], 9
mov dword [ebp - 0x32c], 0xd94b4b13
mov dword [ebp - 0x2dc], 0xfffffffb
mov dword [ebp - 0x2e4], 0xce96b779
mov dword [ebp - 0x30], 0
jmp 0x1002842b
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 4
jge 0x10028444
push dword [ebp - 0x30]
lea ecx, [ebp - 0x31c]
call fcn.100243d3
and dword [eax], 0
jmp 0x10028424
mov dword [ebp - 0x30], 0
jmp 0x10028454
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 1
jge 0x1002846a
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x94], 0xe1e87df2
jmp 0x1002844d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x94], 3
jmp 0x10028498
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x94]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x94], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94], 0
jl 0x10028581
push 3
lea ecx, [ebp - 0x288]
call fcn.10024355
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x30c], 0x31d26ec1
mov dword [ebp - 0x2ec], 0x7858f9c2
mov dword [ebp - 0x104], 1
mov dword [ebp - 0x9c], 0
jmp 0x100284f4
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jge 0x10028516
push dword [ebp - 0x9c]
lea ecx, [ebp - 0x288]
call fcn.100243d3
mov dword [eax], 0x801fc3ee
jmp 0x100284e7
push 0
lea ecx, [ebp - 0x288]
call fcn.100243d3
and dword [eax], 0
jmp 0x1002854c
push 0
lea ecx, [ebp - 0x288]
call fcn.100243d3
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x100]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x288]
call fcn.100243d3
cmp dword [eax], 3
jg 0x1002856d
mov eax, dword [ebp - 0x104]
dec eax
mov dword [ebp - 0x104], eax
jmp 0x10028528
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x288]
call fcn.100243b7
jmp 0x1002847d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x31c]
call fcn.100243b7
push dword [ebp - 0xd4]
mov edx, 0x1007b62c
mov ecx, dword [ebp - 0x258]
call fcn.100270bc
pop ecx
mov dword [ebp - 0x290], 0x16df
cmp dword [ebp - 0x290], 0x849
jge 0x10028708
and dword [ebp - 0x24], 0
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x1000848c
call fcn.1005b97b
add esp, 0xc
mov eax, dword [ebp - 0x24]
dec eax
cmp dword [ebp - 0x34], eax
je 0x100285ef
mov eax, dword [ebp - 0x34]
cmp eax, dword [ebp - 0x24]
jne 0x10028648
and dword [ebp - 0xa4], 0
jmp 0x10028605
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
mov eax, dword [ebp - 0x34]
add eax, dword [ebp - 0x24]
cmp dword [ebp - 0xa4], eax
jge 0x10028643
mov eax, dword [ebp - 0xa4]
and eax, 0x80000001
jns 0x10028625
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x10028636
push 0x10008498
call fcn.1005bb96
pop ecx
jmp 0x10028641
push 0x1000849c
call fcn.1005bb96
pop ecx
jmp 0x100285f8
jmp 0x10028708
mov eax, dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x34], eax
jl 0x100286fd
mov eax, dword [ebp - 0x24]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x34], eax
jg 0x100286fd
and dword [ebp - 0x54], 0
mov eax, dword [ebp - 0x24]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x34], eax
jne 0x1002867e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x54], eax
jmp 0x1002868b
mov ecx, dword [ebp - 0x24]
inc ecx
mov eax, dword [ebp - 0x34]
cdq
idiv ecx
mov dword [ebp - 0x54], edx
mov eax, dword [ebp - 0x24]
inc eax
cmp dword [ebp - 0x34], eax
jne 0x100286a1
push 0x1000849c
call fcn.1005bb96
pop ecx
jmp 0x100286b3
push 0x100084a0
call fcn.1005bb96
pop ecx
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
and dword [ebp - 0xdc], 0
jmp 0x100286c9
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
cmp eax, dword [ebp - 0x24]
jge 0x100286fb
cmp dword [ebp - 0x54], 0
jle 0x100286e7
push 0x100084a4
call fcn.1005bb96
pop ecx
jmp 0x100286f2
push 0x100084a8
call fcn.1005bb96
pop ecx
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
jmp 0x100286bc
jmp 0x10028708
push 0x100084ac
call fcn.1005be01
pop ecx
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x230], 0xe42a43d9
mov dword [ebp - 0x22c], 0xe42a43d9
mov dword [ebp - 0x228], 0xe42a43d9
mov dword [ebp - 0x224], 0xe42a43d9
mov dword [ebp - 0x274], 0xffffffff
mov dword [ebp - 0x2c], 0
jmp 0x10028751
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xfffffff0
jle 0x100287a3
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0xb8], 3
jmp 0x1002877a
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0
jl 0x100287a1
mov byte [ebp - 0x3f], 0
movzx eax, byte [ebp - 0x3f]
test eax, eax
je 0x1002879f
push 0x20bb
push 0x204c
call dword [sym.imp.GDI32.dll_SetMapMode]
jmp 0x1002876d
jmp 0x1002874a
mov dword [ebp - 0x2c], 0xffffffe2
jmp 0x100287b3
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0xffffffe2
jle 0x1002899a
mov dword [ebp - 0x18], 0xaf8b5131
mov dword [ebp - 0x18], 0
jmp 0x100287d4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x1002898c
mov dword [ebp - 0x12c], 0xd0d1d847
mov dword [ebp - 0x26c], 0x1fe511bd
mov dword [ebp - 0x298], 0xfffffffc
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x230], 0
jne 0x10028815
mov dword [ebp - 0x264], 1
jmp 0x1002881c
and dword [ebp - 0x264], 0
cmp dword [ebp - 0x2c], 0
jne 0x10028831
cmp dword [ebp - 0x18], 0
jne 0x10028831
and dword [ebp - 0x10c], 0
jmp 0x1002883b
mov dword [ebp - 0x10c], 1
mov eax, dword [ebp - 0x18]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x230]
cmp ecx, dword [ebp + eax*4 - 0x230]
jl 0x10028860
mov dword [ebp - 0x114], 1
jmp 0x10028867
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x114]
jle 0x10028881
mov dword [ebp - 0x11c], 1
jmp 0x10028888
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x230]
imul eax, dword [ebp - 0x11c]
test eax, eax
jne 0x100288b5
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x230], 0
jne 0x100288b5
and dword [ebp - 0x124], 0
jmp 0x100288bf
mov dword [ebp - 0x124], 1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x230]
imul eax, dword [ebp - 0x124]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x328], eax
cmp dword [ebp - 0x2c], 0x9b3a
jge 0x100288f7
mov dword [ebp - 0x134], 1
jmp 0x100288fe
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
sub eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x18]
jne 0x10028918
mov dword [ebp - 0x13c], 1
jmp 0x1002891f
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x13c], eax
je 0x10028936
mov dword [ebp - 0x28c], 1
jmp 0x1002893d
and dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x230]
mov dword [ebp - 0x2f4], eax
mov eax, dword [ebp - 0x26c]
mov dword [ebp - 0x320], eax
mov eax, 0xcc86f803
test eax, eax
je 0x10028974
cmp dword [ebp - 0x18], 0
je 0x10028974
mov dword [ebp - 0x144], 1
jmp 0x1002897b
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x298], eax
jmp 0x100287cd
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x274], eax
jmp 0x100287ac
mov esi, 0x1007b890
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret