Function at 0x1001f957
Capabilities:
Allocate thread local storage
Get session user name
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push ebx
push esi
push edi
or esi, 0xffffffff
mov dword [ebp - 0xe0], ecx
xor ebx, ebx
mov dword [ebp - 0x18], esi
push 2
mov dword [ebp - 0xdc], edx
mov dword [ebp - 0x10], ebx
pop ecx
jmp 0x1001f990
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x140], 0x8bbca631
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001f97f
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1001f9c2
mov dword [ebp - 0x10], 0x265ab3e9
mov dword [ebp - 0x10], ebx
jmp 0x1001f9ba
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x140], 0x624cdb8f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001f9a9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1001f99d
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x140], 0x77ab3921
mov dword [ebp - 0x10], 0x53b26bdd
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x28], esi
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x24], 0x883faa05
mov dword [ebp - 0x10], ebx
jmp 0x1001fa3e
mov dword [ebp - 0x1c], 0xcc5d9b4e
mov dword [ebp - 0x28], 0x12a2ef7e
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001fa1f
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x1c]
dec ecx
neg ecx
push 2
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, edx
pop ecx
setg al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x1001f9fa
mov dword [ebp - 0xc], 0x3ae35568
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x14], 0x6cedda56
mov dword [ebp - 0x10], ebx
jmp 0x1001fa6a
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x204], 6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1001fa59
push 7
mov dword [ebp - 0xc], 0xffffffea
pop eax
cmp dword [ebp - 0xc], eax
jne 0x1001fae9
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], 8
mov dword [ebp - 0x14], 0x28d029b4
mov eax, dword [ebp - 0x1c]
neg eax
push 7
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
sub ecx, eax
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x1425
setl al
sub eax, dword [ebp - 0xc]
sub eax, 0x132
mov dword [ebp - 0x204], eax
inc dword [ebp - 0xc]
pop eax
cmp dword [ebp - 0xc], eax
je 0x1001fa7e
push 2
pop ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], 0x9a2b441
mov dword [ebp - 0x10], 0xbb35b689
mov dword [ebp - 0x1c], 0xbf0bb9a6
mov dword [ebp - 0x1a4], eax
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0x19c], eax
mov dword [ebp - 0x198], eax
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x14], 0xda390e6
mov dword [ebp - 0xc], ebx
jmp 0x1001fb44
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0xd8], 0xe468a07c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001fb33
mov dword [ebp - 0xc], ebx
jmp 0x1001fb5f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1c0], 0x8470fb2e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001fb4e
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
jg 0x1001fb79
mov ecx, ebx
cmp dword [ebp - 4], ebx
je 0x1001fb7b
mov ecx, edx
mov eax, dword [ebp - 4]
add eax, ecx
je 0x1001fb89
mov eax, edx
cmp dword [ebp - 4], ebx
jne 0x1001fb8b
mov eax, ebx
mov dword [ebp - 0x18], eax
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 3
mov eax, dword [ebp - 0xd8]
setle cl
imul eax, ecx
cmp dword [ebp - 4], eax
jle 0x1001fcea
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x2c], 0x9d3388a0
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x2c], 0xfffffff9
push 3
mov dword [ebp - 0x28], 0xf2d4e203
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x1001fbea
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x174], 0x7dbc8b69
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001fbd9
mov dword [ebp - 0xc], ebx
jmp 0x1001fc05
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x22c], 0xb36282dc
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001fbf4
mov dword [ebp - 0x18], ebx
jmp 0x1001fc5d
mov dword [ebp - 0x10], 0xb7a7
mov dword [ebp - 0xc], 0xfffffffb
cmp dword [ebp - 0x20], ebx
jne 0x1001fc63
mov eax, dword [ebp - 0x10]
mov ecx, edx
inc dword [ebp - 0x10]
cmp eax, 0x94bb489f
mov eax, dword [ebp - 0x1c]
cmovne ecx, ebx
add eax, dword [ebp - 4]
jne 0x1001fc3f
cmp dword [ebp - 0xc], ebx
je 0x1001fc42
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x10
jg 0x1001fc0f
mov eax, dword [ebp - 4]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x22c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x228]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x16c]
inc dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
cmp eax, ecx
mov ecx, 0x9109b52f
setne dl
xor eax, eax
cmp edx, 0x18d27381
setl al
cmp ecx, eax
mov eax, dword [ebp - 0x16c]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setne dl
mov dword [ebp - 0x170], edx
cmp edx, dword [ebp - 0xd8]
jge 0x1001fcd2
cmp dword [ebp - 0x1c0], ebx
je 0x1001fcd2
xor ecx, ecx
inc ecx
jmp 0x1001fcd4
mov ecx, ebx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
sub eax, ecx
mov dword [ebp - 0x19c], eax
jmp 0x1001fd6f
push 2
mov dword [ebp - 0x20], 8
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1001fd06
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x90], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1001fcf9
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x8c]
imul ecx, eax
mov eax, dword [ebp - 0x8c]
imul eax, ecx
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setge cl
sub eax, ecx
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x8c]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x24], ecx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001fd6f
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_ValidateRgn]
or eax, 0xffffffff
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xc], ebx
jmp 0x1001fd8f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x6c], 6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x1001fd81
mov dword [ebp - 0xc], ebx
jmp 0x1001fda8
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x50], 0xeaa32b1c
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x1001fd9a
push 4
pop ecx
mov dword [ebp - 0x50], 1
push 5
pop edx
cmp dword [ebp - 0x50], ebx
jl 0x1001ff97
mov dword [ebp - 4], 0xfffffff9
mov dword [ebp - 0xc], 0xcf7d1649
mov dword [ebp - 0x10], 0xffff
mov dword [ebp - 4], ebx
jmp 0x1001ff76
mov dword [ebp - 0x24], 0xa1b4bc71
xor ecx, ecx
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 4]
cmp ecx, eax
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0xf209
setge dl
sub edx, 0xfffffff8
neg edx
sbb edx, edx
inc edx
neg edx
sub edx, 0x70ca
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 4]
mov eax, dword [ebp - 0x6c]
neg edx
sbb edx, edx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 4]
setg dl
sub edx, 7
neg edx
sbb edx, edx
inc edx
imul edx, dword [ebp + eax*4 - 0x6c]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], ebx
jne 0x1001fe57
mov eax, dword [ebp - 4]
cmp dword [ebp + eax*4 - 0x6c], ebx
jne 0x1001fe57
mov esi, ebx
jmp 0x1001fe5a
xor esi, esi
inc esi
mov eax, dword [ebp - 4]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x6c]
mov eax, dword [ebp - 0x10]
cmp esi, eax
sete cl
lea eax, [edx + 0xfffe]
add eax, ecx
jne 0x1001ff9c
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x30], 0x6ac1dea9
mov dword [ebp - 0x10], ebx
jmp 0x1001ff66
mov dword [ebp - 0x20], 0xd0863e87
mov dword [ebp - 0x18], ebx
jmp 0x1001ff44
mov dword [ebp - 0x2c], 0x8a251abe
mov dword [ebp - 0xc], ebx
jmp 0x1001fed3
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001feb8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001fed0
push ebx
push 0x261e
push ebx
call edi
push eax
call dword [sym.imp.USER32.dll_SetTimer]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jle 0x1001feaa
cmp dword [ebp - 4], ebx
je 0x1001fee8
cmp dword [ebp - 0x20], ebx
je 0x1001fee8
xor ecx, ecx
inc ecx
jmp 0x1001feea
mov ecx, ebx
mov eax, dword [ebp - 0x18]
push 4
mov edx, dword [ebp + eax*4 - 0x6c]
pop eax
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp edx, eax
setne cl
xor edx, edx
cmp ecx, 1
setge dl
xor eax, eax
add edx, dword [ebp - 0x20]
cmp edx, 0xd538
setg al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x6c]
cmp dword [ebp - 0xc], ebx
je 0x1001ff33
cmp dword [ebp - 0x24], ebx
je 0x1001ff33
xor eax, eax
inc eax
jmp 0x1001ff35
mov eax, ebx
push 0xfffffffffffffffc
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jle 0x1001fe9e
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1001ff63
push ebx
push ebx
push 0x1a40
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jle 0x1001fe8f
push 5
pop edx
inc dword [ebp - 4]
cmp dword [ebp - 4], 1
jle 0x1001fde1
cmp dword [ebp - 4], ebx
jne 0x1001ff8e
dec dword [ebp - 0x50]
jns 0x1001fdc4
mov esi, dword [sym.imp.USER32.dll_GetDC]
push 4
pop ecx
mov dword [ebp - 0x10], ebx
jmp 0x1001ffc3
push 5
pop edx
mov dword [ebp - 0x24], edx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 3
setne cl
mov dword [ebp - 0x24], ecx
jmp 0x1001ff73
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x150], 0x8bbca631
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001ffb2
mov dword [ebp - 0xc], ebx
jmp 0x1001ffdb
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x1fc], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jl 0x1001ffce
mov dword [ebp - 0xc], ebx
jmp 0x1001fff7
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x168], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1001ffe6
mov dword [ebp - 0x160], ebx
jmp 0x10020036
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1002001f
push ebx
push 0x1824
push ebx
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x10020030
call edi
push eax
call dword [sym.imp.USER32.dll_GetParent]
inc dword [ebp - 0x160]
cmp dword [ebp - 0x160], ebx
jle 0x10020004
mov dword [ebp - 0x14], ebx
jmp 0x1002050a
mov dword [ebp - 0x10], ebx
jmp 0x1002005c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x258], 0xa684
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002004b
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x10020071
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x10020090
push ebx
push 0x666
push 0xc90
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MoveToEx]
mov dword [ebp - 0x10], 0x265ab3e9
or edx, 0xffffffff
mov dword [ebp - 4], ebx
mov dword [ebp - 0x28], 0x590
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], 2
jge 0x100200b9
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x74], edx
inc dword [ebp - 0x10]
jmp 0x100200a7
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 4]
jge 0x1002018c
mov dword [ebp - 0x10], 0x37c0
xor ecx, ecx
mov dword [ebp - 0x1c], 0xabff5ecc
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x24], 0xd69b45c
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
cmp eax, edx
push 5
setle cl
imul ecx, dword [ebp - 0x10]
pop eax
imul ecx, dword [ebp - 0x10]
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xfffffffc
mov eax, dword [ebp - 4]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 4]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 4]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 4]
setl dl
xor ecx, ecx
neg edx
cmp edx, eax
setne cl
sub ecx, dword [ebp - 4]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
add ecx, 0x12a2ef7e
cmp ecx, eax
setne dl
add edx, dword [ebp - 4]
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x70], edx
xor edx, edx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
cmp ecx, eax
setl dl
cmp edx, dword [ebp - 4]
jle 0x1002017c
cmp dword [ebp - 0x74], ebx
jne 0x10020181
cmp dword [ebp - 0x1c], ebx
je 0x10020184
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x1002033e
mov dword [ebp - 0x30], 0x3d82f881
mov dword [ebp - 4], ebx
jmp 0x1002032d
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x2c], 0xe8e356d6
mov dword [ebp - 0x10], 0xffffffe6
cmp dword [ebp - 0x10], 0xfffffff7
jne 0x1002032a
push 0xfffffffffffffffc
pop eax
mov dword [ebp - 0xc], 0x5866b388
mov dword [ebp - 0x20], eax
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], ebx
jl 0x1002031d
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x24], 0xc51c
mov dword [ebp - 0x28], 0xfffffffb
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 1
jg 0x10020311
mov dword [ebp - 0x1c], 6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 7
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp + eax*4 - 0x74]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], 0x5a1b
cmp dword [ebp - 0x20], ebx
je 0x100202ec
mov edx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x20]
inc edx
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0xc]
setg cl
xor edx, edx
imul ecx, ecx, 0x1fd1
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0xfff6
test eax, eax
jne 0x10020270
cmp dword [ebp - 0xc], ebx
jne 0x10020270
mov ecx, ebx
jmp 0x10020273
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x316a
push 3
setge al
or ecx, 0xffffffff
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setl cl
cmp eax, ecx
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x18]
jl 0x100202a9
cmp dword [ebp - 0x10], ebx
je 0x100202a9
xor edx, edx
inc edx
jmp 0x100202ab
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, edx
setg cl
sub ecx, dword [ebp - 0xc]
jne 0x100202c3
cmp dword [ebp - 0x18], ebx
jne 0x100202c3
mov eax, ebx
jmp 0x100202c6
xor eax, eax
inc eax
or ecx, 0xffffffff
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x70]
sete dl
xor ecx, ecx
cmp eax, edx
setl cl
imul eax, ecx, 0x8194
cmp eax, 0xb022
jge 0x100202ec
xor ecx, ecx
inc ecx
jmp 0x100202ee
mov ecx, ebx
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x74], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x2c]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jle 0x100201fc
or edx, 0xffffffff
dec dword [ebp - 0xc]
jns 0x100201de
push 0xfffffffffffffffc
pop eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff7
je 0x100201c4
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffffd
jg 0x1002019b
mov dword [ebp - 0x70], 0xfffffffb
mov dword [ebp - 0x10], ebx
jmp 0x100204fd
push 4
mov dword [ebp - 0xc], ebx
pop ecx
jmp 0x1002035f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x88], 0x937d8e6e
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ecx
jl 0x1002034e
mov dword [ebp - 0xc], ebx
jmp 0x10020377
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], 0xbec0351
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10020369
imul eax, dword [ebp - 0x80], 0xffff
or ecx, 0xffffffff
cmp eax, ecx
jae 0x1002039a
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x80]
mov eax, dword [ebp - 0x80]
xor eax, eax
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x84], ebx
je 0x100203ad
cmp dword [ebp - 0x48], ebx
jne 0x100203af
mov eax, ebx
cmp dword [ebp - 0x80], eax
jne 0x100203b7
mov eax, dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ebx
je 0x100203da
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x100204ec
push ebx
push ebx
push 0x9e7
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x100204ec
mov dword [ebp - 4], ecx
xor ecx, ecx
mov dword [ebp - 0xc], 0xfff6
mov dword [ebp - 0x24], 0xfffffff8
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x84]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
cmp eax, 0x8594
push 3
setge cl
xor edx, edx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 0xc]
imul ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x4c]
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setge dl
xor ecx, ecx
cmp edx, eax
pop eax
setge cl
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 4], eax
cmp dword [ebp - 4], ebx
jl 0x100204ec
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 1
jge 0x1002046a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x78], 0x1beba424
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10020453
push 3
pop eax
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x10020482
push ebx
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
push 3
pop eax
mov dword [ebp - 0xc], ebx
jmp 0x100204de
mov dword [ebp - 0x1c], 0x5c66b319
xor edx, edx
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x78]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x88]
add ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
push 3
sete dl
or ecx, 0xffffffff
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x78]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
sbb ecx, ecx
neg ecx
sub ecx, eax
xor eax, eax
cmp ecx, 0xf8c5
setne al
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x48], 0x1947684a
inc dword [ebp - 0xc]
pop eax
cmp dword [ebp - 0xc], eax
jle 0x10020487
dec dword [ebp - 4]
jns 0x10020443
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x150], 0x624cdb8f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10020346
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jle 0x10020046
mov dword [ebp - 0x150], 0x77ab3921
push 5
pop eax
mov dword [ebp - 0x28], eax
mov eax, 0x4c46983c
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x18c], eax
push 4
mov dword [ebp - 0x188], eax
mov dword [ebp - 4], ebx
pop ecx
jmp 0x1002055a
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x128], 0xa8eac8b
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10020549
mov dword [ebp - 4], ebx
jmp 0x10020571
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xa0], ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10020564
mov dword [ebp - 4], ebx
jmp 0x1002058c
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x1dc], 0x8e85a7b0
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1002057b
push 3
pop edx
mov dword [ebp - 0x94], edx
cmp dword [ebp - 0x94], ebx
mov ebx, dword [sym.imp.GDI32.dll_GetDIBits]
jl 0x10020718
xor ecx, ecx
mov dword [ebp - 0x10], 0xfffffff6
mov dword [ebp - 0x20], 0x9fe57f6c
mov dword [ebp - 0x18], 6
mov dword [ebp - 0x14], ecx
jmp 0x100205da
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1d4], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100205c9
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ecx
jl 0x100206ff
or eax, 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], eax
push 0xfffffffffffffffc
mov dword [ebp - 0x28], 0x56e74e80
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x7ef2
mov dword [ebp - 0x14], ecx
jmp 0x1002061b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x208], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1002060e
mov byte [ebp - 5], cl
cmp byte [ebp - 5], 0
je 0x10020644
push 0x2421
push ecx
push ecx
push 0x18e1
push 0x20a3
push ecx
call edi
push eax
call esi
push eax
call ebx
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x128]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x1d0], ecx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x1c]
cmp eax, ecx
jge 0x100206a7
mov eax, dword [ebp - 0x94]
xor ecx, ecx
mov edx, dword [ebp + eax*4 - 0x128]
mov eax, dword [ebp - 0x18]
add edx, eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x128]
cmp eax, edx
mov eax, 0x694a2199
setne cl
cmp ecx, 0xfffa
sbb ecx, ecx
neg ecx
sub eax, ecx
mov dword [ebp - 0x190], eax
je 0x100206a7
xor ecx, ecx
jmp 0x100206aa
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
push 0
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, 0x56bf5ee8
mov eax, dword [ebp + eax*4 - 0x128]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x94]
setl cl
mov dword [ebp + eax*4 - 0x128], ecx
lea eax, [ecx - 0x34219488]
mov dword [ebp - 0x18], eax
dec dword [ebp - 0x10]
pop ecx
jns 0x100205ec
push 3
pop edx
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp + eax*4 - 0x128]
dec dword [ebp - 0x94]
jns 0x100205af
mov eax, dword [ebp - 0x94]
or edi, 0xffffffff
mov dword [ebp - 0x1d8], eax
xor esi, esi
mov dword [ebp - 0x18], edi
inc esi
mov dword [ebp - 4], 0x2b1c
mov dword [ebp - 0xc], 0x9d81479b
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp - 0x14], 0
jmp 0x10020759
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x3c], 0x145c1747
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002074b
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x10020773
push 0xf67
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov eax, dword [ebp - 4]
sub eax, 0x89a5
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
neg eax
sbb eax, eax
neg eax
sub eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0x18]
sub edx, 0x8f69f7fd
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor edx, edx
cmp dword [ebp - 4], ecx
jne 0x100207cf
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x3c], eax
jmp 0x10020829
mov dword [ebp - 4], edx
jmp 0x10020824
mov dword [ebp - 0x14], edx
jmp 0x100207ea
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x108], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100207d9
mov dword [ebp - 0xc], edx
jmp 0x1002081c
mov dword [ebp - 0x18], edx
jmp 0x1002080d
mov ecx, dword [ebp + eax*4 - 0x3c]
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x3c], ecx
mov dword [ebp - 0x108], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
jle 0x100207f9
mov eax, dword [ebp + eax*4 - 0x3c]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jle 0x100207f4
inc dword [ebp - 4]
cmp dword [ebp - 4], edx
jle 0x100207d4
mov dword [ebp - 0x14], edx
jmp 0x1002083f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1b8], 0x624039b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002082e
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x10020859
push esi
push 0x36
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
xor edx, edx
mov byte [ebp - 5], dl
cmp byte [ebp - 5], 0
je 0x1002086c
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor edx, edx
mov dword [ebp - 0x10], 0x928c176b
mov eax, 0x6f9b6917
mov dword [ebp - 0x20], 0x7d50f82b
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x1ac], eax
mov dword [ebp - 0x1a8], eax
mov dword [ebp - 0x10], edx
jmp 0x1002092a
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x30], esi
cmp dword [ebp - 0x1c], edx
je 0x100208b8
mov eax, esi
cmp dword [ebp - 0x1c], esi
jl 0x100208ba
mov eax, edx
cmp eax, 4
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setg dl
xor ecx, ecx
sub edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setle cl
mov dword [ebp - 0x1b0], ecx
test ecx, ecx
je 0x1002091a
mov dword [ebp - 0x24], 0xd76270e7
mov eax, dword [ebp - 0x30]
sub eax, 0x3d3b
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x24], eax
mov byte [ebp - 5], dl
cmp byte [ebp - 5], dl
je 0x10020927
push 0x246f
push 0x9ae
push edx
call dword [sym.imp.USER32.dll_OffsetRect]
xor edx, edx
jmp 0x10020927
xor edx, edx
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x1c], edx
jne 0x10020934
inc dword [ebp - 0x2c]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x15
jge 0x1002089f
push 5
pop eax
mov dword [ebp - 0x28], eax
mov eax, 0x4c46983c
mov dword [ebp - 0x184], eax
mov dword [ebp - 0x180], eax
mov dword [ebp - 0x17c], eax
mov dword [ebp - 0x178], eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], 0xf18ee85e
mov dword [ebp - 0x18], 0x51acae7b
mov dword [ebp - 0x14], 0xb903
push 3
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], edx
pop ecx
jmp 0x10020988
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x64], 0xf0ed
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x1002097a
push 2
mov dword [ebp - 4], edx
pop edi
jmp 0x100209a6
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0xf4], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10020995
mov dword [ebp - 4], edx
jmp 0x100209c1
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x250], 0xffffffff
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x100209b0
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0x5c]
jge 0x10020a77
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
jne 0x100209e5
cmp dword [ebp - 0x64], edx
je 0x100209e7
mov edx, esi
mov eax, dword [ebp - 0x64]
xor ecx, ecx
cmp edx, eax
setl cl
imul eax, ecx, 0x5bed
test eax, eax
jne 0x10020a00
cmp dword [ebp - 0x64], eax
je 0x10020a03
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
sub edx, eax
mov dword [ebp - 0xf0], edx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
mov eax, dword [ebp - 0x64]
setle cl
cmp ecx, 0xe402095d
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
sub edx, 0x78c0
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setge cl
sub ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x60]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, esi
setl cl
xor edx, edx
mov dword [ebp - 0x24c], ecx
cmp ecx, dword [ebp - 0x1c]
jge 0x10020a79
mov eax, edx
mov dword [ebp - 0x10], eax
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x64]
cmp eax, 0x6f4e
setg cl
lea eax, [ecx + 0x50e1]
cmp eax, dword [ebp - 0x64]
mov byte [ebp - 5], dl
jle 0x10020add
cmp byte [ebp - 5], 0
je 0x10020aad
push edx
push edx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
xor edx, edx
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], edx
jl 0x10020aec
cmp byte [ebp - 5], 0
je 0x10020aec
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor edx, edx
mov dword [ebp - 0x10], 0xfffffffd
or ecx, 0xffffffff
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x18], 0x801fc3ee
mov dword [ebp - 0x28], 0xbef7d651
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1ec], esi
mov dword [ebp - 0x1e8], esi
mov dword [ebp - 0x1e4], esi
mov dword [ebp - 0x1e0], esi
mov dword [ebp - 0x1c], 0xf39c
mov dword [ebp - 0x14], 0xda8d
mov dword [ebp - 0x28], ecx
push 5
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], 0xa93f0451
mov dword [ebp - 0x30], 0xb9d37639
mov dword [ebp - 4], edx
jmp 0x10020b6d