Function at 0x1004c910
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10080d6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2f0
push esi
push edi
mov dword [ebp - 0x84], 1
mov dword [ebp - 0x64], 0
jmp 0x1004c94a
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x1004c960
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x2e4], 0x5464b5f5
jmp 0x1004c943
mov byte [ebp - 0x33], 0
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x1004c97d
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
mov dword [ebp - 0x84], 0
jmp 0x1004c996
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jg 0x1004c9bc
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1004c9ba
push 0x2345
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x1004c989
mov dword [ebp - 0x1e4], 5
mov dword [ebp - 0x1e0], 5
mov dword [ebp - 0x1dc], 5
mov dword [ebp - 0x1d8], 5
mov dword [ebp - 0x88], 0x495e3b37
push 1
lea ecx, [ebp - 0x25c]
call fcn.10016c36
and dword [ebp - 4], 0
mov dword [ebp - 0x200], 0x8cc19583
mov dword [ebp - 0x78], 0
jmp 0x1004ca19
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x1004ca35
push dword [ebp - 0x78]
lea ecx, [ebp - 0x25c]
call fcn.10016cc2
mov dword [eax], 0x3413f087
jmp 0x1004ca12
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x1e4], 0x4ec2e0cf
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x1e4], 0
je 0x1004cc0e
mov dword [ebp - 0xa4], 0xc099
mov dword [ebp - 0x94], 0x4872
mov dword [ebp - 0x1e8], 3
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1e4], 0
jne 0x1004cb9e
cmp dword [ebp - 0x88], 0x2b82
jne 0x1004caa3
mov dword [ebp - 0x13c], 1
jmp 0x1004caaa
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x13c]
sub eax, dword [ebp - 0xa4]
je 0x1004cad4
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1e4], 0
je 0x1004cad4
mov dword [ebp - 0x158], 1
jmp 0x1004cadb
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x158], eax
jle 0x1004caf5
mov dword [ebp - 0xc0], 1
jmp 0x1004cafc
and dword [ebp - 0xc0], 0
mov esi, dword [ebp - 0x88]
add esi, dword [ebp - 0xc0]
sub esi, dword [ebp - 0x1e8]
push 0
lea ecx, [ebp - 0x25c]
call fcn.10016cc2
cmp esi, dword [eax]
jge 0x1004cb2b
mov dword [ebp - 0x160], 1
jmp 0x1004cb32
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x160], eax
je 0x1004cb4c
mov dword [ebp - 0xc8], 1
jmp 0x1004cb53
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0xc8], eax
je 0x1004cb76
cmp dword [ebp - 0x94], 0
je 0x1004cb76
mov dword [ebp - 0x168], 1
jmp 0x1004cb7d
and dword [ebp - 0x168], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1e4]
imul eax, dword [ebp - 0x168]
test eax, eax
jne 0x1004cb9e
and dword [ebp - 0xd0], 0
jmp 0x1004cba8
mov dword [ebp - 0xd0], 1
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0xd0], eax
je 0x1004cbc2
mov dword [ebp - 0x170], 1
jmp 0x1004cbc9
and dword [ebp - 0x170], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1e4]
mov ecx, dword [ebp - 0xa4]
imul ecx, dword [ebp - 0x170]
imul eax, ecx
cmp eax, 0x7eb23672
jne 0x1004cbf9
mov dword [ebp - 0xd8], 1
jmp 0x1004cc00
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x200], eax
jmp 0x1004cc33
mov dword [ebp - 0x220], 0x1bd77dfc
push 0x50e1
lea eax, [ebp - 0x220]
push eax
push 0
push 0x7a55
call fcn.1004b75a
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.10016cbd
mov dword [ebp - 0x14], 0xe60f951
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x24], 0x43cc9f19
mov dword [ebp - 0x80], 2
mov dword [ebp - 0x44], 0xb7c39c9d
mov dword [ebp - 0x1c], 0x6920
mov dword [ebp - 0x70], 0
jmp 0x1004cc7c
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 1
jge 0x1004cc8f
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x54], 0x302aff63
jmp 0x1004cc75
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0xe80031aa
jb 0x1004ccaa
mov dword [ebp - 0x9c], 1
jmp 0x1004ccb1
and dword [ebp - 0x9c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x9c]
mov dword [ebp + eax - 0x54], ecx
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x14]
je 0x1004ccdc
mov dword [ebp - 0x178], 1
jmp 0x1004cce3
and dword [ebp - 0x178], 0
imul eax, dword [ebp - 0x178], 0x7d26
cmp eax, dword [ebp - 0x14]
jg 0x1004ccfe
mov dword [ebp - 0xe0], 1
jmp 0x1004cd05
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x80]
jne 0x1004cd25
mov dword [ebp - 0x18c], 1
jmp 0x1004cd2c
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x18c], eax
jg 0x1004cd3b
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0xfffd
cmp dword [ebp - 0x1c], 0
je 0x1004cd5a
cmp dword [ebp - 0x80], 0
je 0x1004cd5a
mov dword [ebp - 0xe8], 1
jmp 0x1004cd61
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xe8], eax
je 0x1004cd78
mov dword [ebp - 0x194], 1
jmp 0x1004cd7f
and dword [ebp - 0x194], 0
mov eax, dword [ebp - 0x80]
imul eax, dword [ebp - 0x194]
cmp eax, dword [ebp - 0x14]
jle 0x1004cd9a
mov dword [ebp - 0xf0], 1
jmp 0x1004cda1
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xf0]
jle 0x1004cdb8
mov dword [ebp - 0x19c], 1
jmp 0x1004cdbf
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x19c]
je 0x1004cddc
cmp dword [ebp - 0x1c], 0
je 0x1004cddc
mov dword [ebp - 0xf8], 1
jmp 0x1004cde3
and dword [ebp - 0xf8], 0
cmp dword [ebp - 0xf8], 0xb8842b4c
ja 0x1004d1a8
mov dword [ebp - 0x20], 3
mov dword [ebp - 0x90], 0x97151158
mov dword [ebp - 0x1cc], 0x94784533
mov dword [ebp - 0x1d4], 1
mov dword [ebp - 0x98], 0x4a48c552
mov dword [ebp - 0x44], 0xf
jmp 0x1004ce32
mov eax, dword [ebp - 0x44]
dec eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
je 0x1004ce89
mov dword [ebp - 0x1c], 0
jmp 0x1004ce48
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 9
jne 0x1004ce87
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x1004ce71
push 0x130d
push 0xdde
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov byte [ebp - 0x37], 0
movzx eax, byte [ebp - 0x37]
test eax, eax
je 0x1004ce85
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
jmp 0x1004ce41
jmp 0x1004ce2b
cmp dword [ebp - 0x20], 0
je 0x1004d0c1
mov dword [ebp - 0x1bc], 0
mov dword [ebp - 0x224], 0xf3aa798d
cmp dword [ebp - 0x44], 0
jne 0x1004ceb9
mov dword [ebp - 0x1ac], 1
jmp 0x1004cec0
and dword [ebp - 0x1ac], 0
cmp dword [ebp - 0x1c], 0xeeb3
jne 0x1004ced5
mov dword [ebp - 0x1a4], 1
jmp 0x1004cedc
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x1a4]
cmp eax, dword [ebp - 0x1c]
jge 0x1004cef6
mov dword [ebp - 0x100], 1
jmp 0x1004cefd
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x100], eax
jg 0x1004cf14
mov dword [ebp - 0x108], 1
jmp 0x1004cf1b
and dword [ebp - 0x108], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x54]
add eax, dword [ebp - 0x1ac]
imul eax, dword [ebp - 0x108]
test eax, eax
jne 0x1004cf48
mov eax, 0x2e6b
test eax, eax
jne 0x1004cf48
and dword [ebp - 0x8c], 0
jmp 0x1004cf52
mov dword [ebp - 0x8c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8c]
mov dword [ebp + eax - 0x54], ecx
cmp dword [ebp - 0x8c], 0xe131
je 0x1004cf7a
mov dword [ebp - 0x1b4], 1
jmp 0x1004cf81
and dword [ebp - 0x1b4], 0
cmp dword [ebp - 0x1b4], 0xa3e85184
jb 0x1004cf99
mov dword [ebp - 0x1f8], 1
jmp 0x1004cfa0
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x50], eax
je 0x1004cfc6
mov dword [ebp - 0x110], 1
jmp 0x1004cfcd
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x110], eax
jge 0x1004cfe4
mov dword [ebp - 0x1f4], 1
jmp 0x1004cfeb
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x298], eax
mov eax, 0xeb13
test eax, eax
je 0x1004d012
cmp dword [ebp - 0x20], 0
je 0x1004d012
mov dword [ebp - 0x118], 1
jmp 0x1004d019
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x118]
jne 0x1004d04b
mov eax, 0x717824ff
test eax, eax
je 0x1004d04b
mov eax, 0x70d2
test eax, eax
je 0x1004d04b
mov eax, 0x70a2
test eax, eax
je 0x1004d04b
mov dword [ebp - 0x1c4], 1
jmp 0x1004d052
and dword [ebp - 0x1c4], 0
cmp dword [ebp - 0x1c4], 0xea21
je 0x1004d06f
xor eax, eax
inc eax
jne 0x1004d06f
mov dword [ebp - 0x120], 1
jmp 0x1004d076
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x1cc]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x29c], eax
mov dword [ebp - 0x98], 0xa5dbdfdd
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x224], eax
jmp 0x1004d1a6
mov dword [ebp - 0x17c], 0xfffffffd
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x90], 0
je 0x1004d0fb
cmp dword [ebp - 0x98], 0
je 0x1004d0fb
mov dword [ebp - 0x134], 1
jmp 0x1004d102
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x80], eax
jg 0x1004d119
mov dword [ebp - 0x12c], 1
jmp 0x1004d120
and dword [ebp - 0x12c], 0
cmp dword [ebp - 0x12c], 0xc99cc0f7
ja 0x1004d137
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x54], 0
mov eax, dword [ebp - 0x17c]
cmp dword [ebp - 0x134], eax
jl 0x1004d151
mov dword [ebp - 0x1b0], 1
jmp 0x1004d158
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1b0], eax
jl 0x1004d16f
mov dword [ebp - 0xb4], 1
jmp 0x1004d176
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xb4], eax
jg 0x1004d18d
mov dword [ebp - 0x190], 1
jmp 0x1004d194
and dword [ebp - 0x190], 0
mov eax, dword [ebp - 0x190]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x54], eax
jmp 0x1004d1ea
mov dword [ebp - 0x24], 0xffffffed
jmp 0x1004d1b8
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1c
jge 0x1004d1ea
mov byte [ebp - 0x36], 0
movzx eax, byte [ebp - 0x36]
test eax, eax
je 0x1004d1e8
push 0x13c4
push 0x1385
push 0
push 0
push 0x12b6
push 0x15ca
call dword [sym.imp.USER32.dll_ToUnicode]
jmp 0x1004d1b1
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x50], eax
push 1
lea eax, [ebp - 0x2f0]
push eax
xor edx, edx
inc edx
xor ecx, ecx
call fcn.1004afbf
pop ecx
pop ecx
mov esi, eax
lea edi, [ebp - 0x2c8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x2c8]
lea edi, [ebp - 0x23c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 2
lea ecx, [ebp - 0x230]
call fcn.10016c36
mov dword [ebp - 4], 1
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x68], 0
jmp 0x1004d24a
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 2
jge 0x1004d266
push dword [ebp - 0x68]
lea ecx, [ebp - 0x230]
call fcn.10016cc2
mov dword [eax], 6
jmp 0x1004d243
mov dword [ebp - 0x4c], 0
jmp 0x1004d276
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 1
jg 0x1004d31e
mov dword [ebp - 0x40], 0xa4d073ff
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x230]
call fcn.10016cc2
cmp dword [eax], 0xffffffff
jl 0x1004d2a6
mov dword [ebp - 0x144], 1
jmp 0x1004d2ad
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], 0
jmp 0x1004d2c6
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 1
jg 0x1004d319
mov dword [ebp - 0x1fc], 4
mov dword [ebp - 0x14c], 0x704f3d4e
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1d0], eax
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x230]
call fcn.10016cc2
mov ecx, dword [ebp - 0x1d0]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14c], eax
jmp 0x1004d2bf
jmp 0x1004d26f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
call fcn.10016cbd
mov dword [ebp - 0x48], 1
mov dword [ebp - 0xa0], 0xfffffffa
mov dword [ebp - 0x3c], 3
push 4
lea ecx, [ebp - 0x268]
call fcn.10016c36
mov dword [ebp - 4], 2
lea eax, [ebp - 0x58]
push eax
push 0x3b4c
push 1
lea eax, [ebp - 0x268]
push eax
call fcn.1004b75a
add esp, 0x10
mov dword [ebp - 0x58], 0
jmp 0x1004d383
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x1004d399
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x2fc], 0xffffffff
jmp 0x1004d37c
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x1004d3b9
push 0x5092
push 0
push 0x6281
call fcn.1004c46a
add esp, 0xc
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x278], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x280], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xa0], eax
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x2b8], eax
mov eax, dword [ebp - 0x48]
imul eax, dword [ebp - 0xa0]
sub eax, 0x3572
cmp eax, 0xa0d018d3
ja 0x1004d40b
mov dword [ebp - 0x198], 1
jmp 0x1004d412
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x198], eax
jl 0x1004d429
mov dword [ebp - 0x154], 1
jmp 0x1004d430
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x154], eax
je 0x1004d447
mov dword [ebp - 0x1b8], 1
jmp 0x1004d44e
and dword [ebp - 0x1b8], 0
cmp dword [ebp - 0x1b8], 0x84e5
je 0x1004d466
mov dword [ebp - 0x15c], 1
jmp 0x1004d46d
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x15c]
add eax, 0xb81e
mov dword [ebp - 0x1a0], eax
push 2
lea ecx, [ebp - 0x268]
call fcn.10016cc2
mov ecx, dword [ebp - 0x1a0]
mov dword [eax], ecx
cmp dword [ebp - 0x1a0], 0
jne 0x1004d4ab
cmp dword [ebp - 0x3c], 0
jne 0x1004d4ab
and dword [ebp - 0x164], 0
jmp 0x1004d4b5
mov dword [ebp - 0x164], 1
cmp dword [ebp - 0x164], 0
je 0x1004d504
mov dword [ebp - 0x5c], 0
jmp 0x1004d4ce
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1004d4e4
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1c8], 0x6992f1e5
jmp 0x1004d4c7
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c8]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c8], eax
jmp 0x1004d61a
mov dword [ebp - 0x250], 0x19c44d4e
mov dword [ebp - 0x24c], 0x19c44d4e
mov dword [ebp - 0x248], 0x19c44d4e
mov dword [ebp - 0x244], 0x19c44d4e
lea ecx, [ebp - 0xa9]
call fcn.100091a3
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x2dc]
call fcn.10016cd1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2d4]
call fcn.10016c97
mov byte [ebp - 4], 3
mov dword [ebp - 0x26c], 0
mov dword [ebp - 0x16c], 0x73e70d28
mov dword [ebp - 0x3c], 0
jmp 0x1004d589
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffffc
jge 0x1004d60b
push 3
lea ecx, [ebp - 0x290]
call fcn.10016c36
mov byte [ebp - 4], 4
mov dword [ebp - 0x2b4], 0xe072305a
mov dword [ebp - 0x2b0], 0x43657218
mov dword [ebp - 0x2ac], 0x43657218
mov dword [ebp - 0x2a8], 0x43657218
mov dword [ebp - 0x2a4], 0x43657218
lea eax, [ebp - 0x27c]
push eax
push 1
lea eax, [ebp - 0x290]
push eax
call fcn.1004c46a
add esp, 0xc
mov eax, dword [ebp - 0x16c]
dec eax
mov dword [ebp - 0x16c], eax
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x290]
call fcn.10016cbd
jmp 0x1004d582
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2d4]
call fcn.10016cbd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10016cbd
mov dword [ebp - 0x28], 0x5b9b55bb
mov dword [ebp - 0x6c], 0
jmp 0x1004d640
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1004d653
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x2c], 0x689351f2
jmp 0x1004d639
mov dword [ebp - 0x28], 0
jmp 0x1004d663
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xa
jne 0x1004dc51
mov dword [ebp - 0x10], 0xfffffffb
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0xb0], 0xfffffffa
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x1004d69b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x10], 0
jmp 0x1004d6ab
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1004dc4c
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x74], 0
jmp 0x1004d6cc
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 3
jge 0x1004d6e2
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x188], 0xffffffff
jmp 0x1004d6c5
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x188], 0
jmp 0x1004d710
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x188], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x188], 0
jg 0x1004dc47
push 1
lea ecx, [ebp - 0x210]
call fcn.10016c36
mov dword [ebp - 4], 5
mov dword [ebp - 0x21c], 0xffffffff
mov dword [ebp - 0x7c], 0
jmp 0x1004d752
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1004d76e
push dword [ebp - 0x7c]
lea ecx, [ebp - 0x210]
call fcn.10016cc2
mov dword [eax], 0x492a4153
jmp 0x1004d74b
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x2c], 0
jne 0x1004d877
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x188]
mov dword [ebp - 0x18], eax
push 4
pop eax
imul eax, eax, 0
xor ecx, ecx
inc ecx
sub ecx, dword [ebp + eax - 0x2c]
push 4
pop eax
shl eax, 1
cmp ecx, dword [ebp + eax - 0x188]
jge 0x1004d7b3
mov dword [ebp - 0x1a8], 1
jmp 0x1004d7ba
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1a8], eax
jle 0x1004d7d4
cmp dword [ebp - 0x10], 0
jne 0x1004d7d4
and dword [ebp - 0x174], 0
jmp 0x1004d7de
mov dword [ebp - 0x174], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x174]
sub ecx, 0x26b17019
cmp dword [ebp + eax*4 - 0x2c], ecx
jl 0x1004d7ff
mov dword [ebp - 0x1c0], 1
jmp 0x1004d806
and dword [ebp - 0x1c0], 0
imul eax, dword [ebp - 0x1c0], 0x5d17
test eax, eax
jne 0x1004d823
cmp dword [ebp - 0x28], 0
jne 0x1004d823
and dword [ebp - 0x124], 0
jmp 0x1004d82d
mov dword [ebp - 0x124], 1
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x124], eax
jle 0x1004d844
mov dword [ebp - 0x128], 1
jmp 0x1004d84b
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp dword [ebp - 0x128], eax
jge 0x1004d866
mov dword [ebp - 0x218], 1
jmp 0x1004d86d
and dword [ebp - 0x218], 0
cmp dword [ebp - 0x28], 0
je 0x1004dae7
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x2c], 0
je 0x1004dae7
mov dword [ebp - 0x60], 0
push 0
lea ecx, [ebp - 0x210]
call fcn.10016cc2
cmp dword [eax], 0
jne 0x1004d924
cmp dword [ebp - 0x10], 0
jne 0x1004d8b4
mov dword [ebp - 0xa8], 1
jmp 0x1004d8bb
and dword [ebp - 0xa8], 0
push 0
lea ecx, [ebp - 0x210]
call fcn.10016cc2
mov ecx, dword [ebp - 0xa8]
mov dword [eax], ecx
imul eax, dword [ebp - 0xa8], 0xbd8d
test eax, eax
jne 0x1004d8f0
mov eax, 0xd552b890
test eax, eax
jne 0x1004d8f0
and dword [ebp - 0x130], 0
jmp 0x1004d8fa
mov dword [ebp - 0x130], 1
mov eax, dword [ebp - 0x130]
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0xc588
jne 0x1004d91b
mov eax, 0xfff8
test eax, eax
jne 0x1004d924
and dword [ebp - 0x138], 0
jmp 0x1004d92e
mov dword [ebp - 0x138], 1
cmp dword [ebp - 0x138], 9
jl 0x1004d943
mov dword [ebp - 0x140], 1
jmp 0x1004d94a
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x140]
mov dword [ebp - 0x18], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x18], eax
jl 0x1004d96e
mov dword [ebp - 0x148], 1
jmp 0x1004d975
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x148], eax
jle 0x1004d98c
mov dword [ebp - 0x150], 1
jmp 0x1004d993
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x150], eax
jl 0x1004d9aa
mov dword [ebp - 0xb8], 1
jmp 0x1004d9b1
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x60]
imul eax, dword [ebp - 0xb8]
cmp eax, dword [ebp - 0x10]
jge 0x1004d9cc
mov dword [ebp - 0xbc], 1
jmp 0x1004d9d3
and dword [ebp - 0xbc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp dword [ebp - 0xbc], eax
jl 0x1004d9f4
mov dword [ebp - 0xc4], 1
jmp 0x1004d9fb
and dword [ebp - 0xc4], 0
cmp dword [ebp - 0xc4], 0xffffffff
jge 0x1004da10
mov dword [ebp - 0xcc], 1
jmp 0x1004da17
and dword [ebp - 0xcc], 0
cmp dword [ebp - 0xcc], 0xffffffff
ja 0x1004da2c
mov dword [ebp - 0x204], 1
jmp 0x1004da33
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x294], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x2c]
cmp dword [ebp - 0x60], eax
jg 0x1004da5e
mov dword [ebp - 0xd4], 1
jmp 0x1004da65
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0xd4], eax
je 0x1004da82
cmp dword [ebp - 0x60], 0
je 0x1004da82
mov dword [ebp - 0xdc], 1
jmp 0x1004da89
and dword [ebp - 0xdc], 0
cmp dword [ebp - 0xdc], 0
jle 0x1004da9e
mov dword [ebp - 0xe4], 1
jmp 0x1004daa5
and dword [ebp - 0xe4], 0
cmp dword [ebp - 0xe4], 0x94be
je 0x1004dabd
mov dword [ebp - 0xec], 1
jmp 0x1004dac4
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x21c], eax
push 0
lea ecx, [ebp - 0x210]
call fcn.10016cc2
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
jmp 0x1004dc33
mov dword [ebp - 0x114], 2
mov dword [ebp - 0x18], 0
jmp 0x1004db01
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jg 0x1004db35
mov dword [ebp - 0x214], 0xffffffff
mov dword [ebp - 0x30], 0
jmp 0x1004db21
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jg 0x1004db33
mov dword [ebp - 0x214], 0xc9e433c5
jmp 0x1004db1a
jmp 0x1004dafa
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xb0], eax
jne 0x1004db4c
mov dword [ebp - 0xf4], 1
jmp 0x1004db53
and dword [ebp - 0xf4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x188]
cmp eax, dword [ebp - 0xf4]
jl 0x1004db74
mov dword [ebp - 0x1ec], 1
jmp 0x1004db7b
and dword [ebp - 0x1ec], 0
cmp dword [ebp - 0x18], 1
jne 0x1004db8d
mov dword [ebp - 0xfc], 1
jmp 0x1004db94
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x114]
cmp eax, dword [ebp - 0xfc]
jne 0x1004dbb7
mov eax, 0xaf2c41e7
test eax, eax
je 0x1004dbb7
mov dword [ebp - 0x104], 1
jmp 0x1004dbbe
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0xfffffffe
jl 0x1004dbd3
mov dword [ebp - 0x1f0], 1
jmp 0x1004dbda
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x10], 0x62a08d8d
jg 0x1004dbf8
mov dword [ebp - 0x10c], 1
jmp 0x1004dbff
and dword [ebp - 0x10c], 0
xor eax, eax
sub eax, dword [ebp - 0x10c]
cmp eax, dword [ebp - 0x30]
jge 0x1004dc18
mov dword [ebp - 0x11c], 1
jmp 0x1004dc1f
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x114]
imul eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x2c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x210]
call fcn.10016cbd
jmp 0x1004d6f5
jmp 0x1004d6a4
jmp 0x1004d65c
cmp dword [ebp - 0x23c], 0
je 0x1004dc6e
push 3
push dword [ebp - 0x234]
push dword [ebp - 0x238]
call dword [ebp - 0x23c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret