Function at 0x1005c4d
Capabilities:
Allocate thread local storage

Disassembly:
push 0x328
mov eax, 0x1088472
call fcn.010023ba
xor esi, esi
lea ecx, [ebp - 0x334]
mov dword [ebp - 0x228], esi
call fcn.0100cff5
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], esi
call fcn.0100603d
cmp byte [0x10981f4], 0
mov byte [ebp - 4], 1
je 0x101e3e5
call fcn.0100af44
test al, al
jne 0x101e420
cmp byte [0x10981eb], 0
jne 0x101e429
cmp byte [0x10981f0], 0
je 0x1005cbe
call fcn.0101de08
test al, al
jne 0x1005fec
call fcn.0100ba98
push esi
push esi
call dword [sym.imp.KERNEL32.dll_RegisterApplicationRestart]
lea eax, [ebp - 0x230]
push eax
push 1
push esi
push 0x100ad6c
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x101de4a
push dword [ebp - 0x230]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x10980d8], eax
cmp eax, 0xffffffff
je 0x101e435
lea eax, [ebp - 0x228]
push eax
call fcn.0100afb0
mov ebx, eax
cmp ebx, esi
jl 0x1005fbb
cmp dword [ebp - 0x228], esi
mov edi, 0x10000
setne byte [ebp - 0x21d]
cmp byte [ebp - 0x21d], 0
je 0x1005ec3
cmp byte [0x10981f0], 0
je 0x1005d58
call fcn.0101dd15
test al, al
jne 0x101de6d
lea eax, [ebp - 0x21e]
push eax
call fcn.0100b38e
mov ebx, eax
cmp ebx, esi
jl 0x1005fbb
cmp byte [ebp - 0x21e], 0
jne 0x101e45e
cmp byte [0x10981f0], 0
mov esi, 0x80010000
je 0x1005e4d
cmp dword [0x109897c], 0
je 0x1005e4d
mov dl, byte [0x1098980]
cmp dl, 4
jb 0x101de74
mov eax, dword [0x1098968]
mov ecx, dword [0x109896c]
and eax, edi
and ecx, esi
or eax, ecx
je 0x1005df6
mov ebx, dword [0x1098970]
mov ecx, dword [0x1098974]
mov eax, ebx
and eax, edi
and ecx, esi
cmp eax, ebx
jne 0x1005df6
cmp ecx, dword [0x1098974]
jne 0x1005df6
push 0x1006018
push dword [0x10982bc]
push dword [0x10982b8]
call fcn.0100af23
mov dl, byte [0x1098980]
cmp dword [0x109897c], 0
je 0x1005e4d
cmp dl, 4
jb 0x101de81
mov eax, dword [0x1098968]
mov ecx, dword [0x109896c]
and eax, edi
and ecx, esi
or eax, ecx
je 0x1005e4d
mov edx, dword [0x1098970]
mov ebx, dword [0x1098974]
mov eax, edx
mov ecx, ebx
and eax, edi
and ecx, esi
cmp eax, edx
jne 0x1005e4d
cmp ecx, ebx
jne 0x1005e4d
push 0x1006028
push dword [0x10982bc]
push dword [0x10982b8]
call fcn.0100af23
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.0100c881
push 0
lea ecx, [ebp - 0x334]
call fcn.0100c08f
mov ebx, eax
mov dword [ebp - 0x22c], ebx
test ebx, ebx
jl 0x1005fbb
cmp byte [0x10981fc], 0
jne 0x101e495
lea ecx, [ebp - 0x334]
call fcn.0100b155
mov ebx, eax
test ebx, ebx
jl 0x1005fbb
cmp ebx, 1
jne 0x1005ec3
cmp byte [0x10981f0], 0
jne 0x101deb1
cmp byte [0x10981f2], 0
jne 0x101deb1
mov byte [0x10981fc], 0
push 0
push 0x100dd50
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, dword [sym.imp.USER32.dll_PostMessageW]
mov esi, eax
mov dword [ebp - 0x224], esi
test esi, esi
je 0x1005f51
lea eax, [ebp - 0x22c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 0x22c]
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
cmp byte [0x10981e8], 0
mov cl, byte [0x10981ea]
mov al, byte [0x10981e9]
je 0x101e533
xor esi, esi
test al, al
jne 0x101e55e
test cl, cl
jne 0x101e564
cmp byte [0x10980c0], 0
je 0x1005f3d
push 1
push 0xd22
push 0
call sub.ntdll.dll_WinSqmIncrementDWORD
call fcn.0100e819
push eax
push esi
push 0x7e8
push dword [ebp - 0x224]
call ebx
cmp byte [ebp - 0x21d], 0
je 0x101de6d
cmp dword [0x109897c], 0
je 0x1005f90
mov al, byte [0x1098980]
cmp al, 4
jb 0x101dea4
mov eax, dword [0x1098968]
mov ecx, dword [0x109896c]
mov esi, 0x80000000
and eax, edi
and ecx, esi
or eax, ecx
jne 0x101e56c
call fcn.0100e7a5
push 0
call fcn.01017534
push 1
push 0
push 0x453
call dword [sym.imp.USER32.dll_GetShellWindow]
push eax
call ebx
lea ecx, [ebp - 0x334]
call fcn.0100e91d
mov ebx, eax
lea ecx, [ebp - 0x334]
call fcn.0101b03e
cmp dword [ebp - 0x228], 0
je 0x1005fe5
mov ecx, 0x1098928
call fcn.01005479
push dword [ebp - 0x228]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.0101aa71
mov esi, ebx
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call fcn.01002611
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.0101b254
mov eax, esi
call fcn.010024a1
ret
push esi
push esi
push 1
push 0x96bf
push 0x1098318
call dword [sym.imp.ATL.DLL_AtlModuleUpdateRegistryFromResourceD]
mov ebx, eax
cmp ebx, esi
jge 0x1005cf9
jmp 0x1005fbb
xor ebx, ebx
jmp 0x1005fbb
test dl, dl
je 0x1005da9
jmp 0x1005df6
test dl, dl
je 0x1005e08
jmp 0x1005e4d
test dl, dl
je 0x101dedd
jmp 0x101df2b
test dl, dl
je 0x101df41
jmp 0x1005fbb
test al, al
je 0x1005f74
jmp 0x1005f90
push 0
call fcn.0101ae10
cmp byte [0x10981f0], 0
je 0x1005fbb
cmp dword [0x109897c], 0
je 0x1005fbb
mov dl, byte [0x1098980]
cmp dl, 4
jb 0x101de8e
mov eax, dword [0x1098968]
mov ecx, dword [0x109896c]
and eax, edi
and ecx, esi
or eax, ecx
je 0x101df2b
mov eax, dword [0x1098970]
mov ecx, dword [0x1098974]
and eax, edi
and ecx, esi
cmp eax, dword [0x1098970]
jne 0x101df2b
cmp ecx, dword [0x1098974]
jne 0x101df2b
push 0x101dd00
push dword [0x10982bc]
push dword [0x10982b8]
call fcn.0100af23
mov dl, byte [0x1098980]
cmp dword [0x109897c], 0
je 0x1005fbb
cmp dl, 4
jb 0x101de97
mov eax, dword [0x1098968]
mov ecx, dword [0x109896c]
and eax, edi
and ecx, esi
or eax, ecx
je 0x1005fbb
mov edx, dword [0x1098970]
mov eax, edx
and eax, edi
mov edi, dword [0x1098974]
mov ecx, edi
and ecx, esi
cmp eax, edx
jne 0x1005fbb
cmp ecx, edi
jne 0x1005fbb
push 0x101df98
push dword [0x10982bc]
push dword [0x10982b8]
call fcn.0100af23
jmp 0x1005fbb
push 1
call fcn.0102c448
cmp byte [0x10981f0], 0
je 0x101e3fb
push esi
call fcn.0101ae10
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 0
call fcn.01002611
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x334]
call fcn.0101b254
xor eax, eax
jmp 0x100600c
push 4
call fcn.0102c448
jmp 0x101e3fb
push 0x100e3b4
call fcn.0103d1c3
jmp 0x101e3fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
je 0x101e454
jle 0x1005fb9
and eax, 0xffff
or eax, 0x80070000
jmp 0x1005fb9
mov ebx, 0x80004005
jmp 0x1005fbb
lea eax, [ebp - 0x21f]
push eax
call fcn.0103c693
cmp byte [ebp - 0x21f], 0
jne 0x1005d7b
call fcn.0103c367
test al, al
jne 0x1005d7b
push esi
push esi
call fcn.0103cbdc
mov ebx, 0x80070005
jmp 0x1005fbb
and dword [ebp - 0x224], 0
lea eax, [ebp - 0x224]
push eax
mov ebx, 0x101e5b0
push ebx
push 0
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.010062b5
test eax, eax
jl 0x101e507
push 0x10261b0
lea ecx, [ebp - 0x224]
call fcn.0100bff9
test al, al
je 0x101e507
push 0
call fcn.0101ae10
push 0x1001b2c
push ebx
push 0
lea ecx, [ebp - 0x21c]
call fcn.0100cc49
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 1
call fcn.0100229b
mov ebx, dword [ebp - 0x22c]
jmp 0x1005fbb
push 0x100adf0
push 0x100adcc
push 0
lea ecx, [ebp - 0x21c]
call fcn.0100cc49
lea eax, [ebp - 0x224]
push eax
mov byte [ebp - 4], 1
call fcn.0100229b
jmp 0x1005e88
test al, al
jne 0x1005f14
test cl, cl
jne 0x1005f14
cmp byte [0x10981ec], al
je 0x1005f51
push 0
push 0
push 0x7f4
push esi
jmp 0x1005f4f
inc esi
jmp 0x1005f3d
push 2
pop esi
jmp 0x1005f3d
mov eax, dword [0x1098970]
mov ecx, eax
and ecx, edi
mov edi, dword [0x1098974]
mov edx, edi
and edx, esi
cmp ecx, eax
jne 0x1005f90
cmp edx, edi
jne 0x1005f90
push 0x101e5d8
push dword [0x10982bc]
push dword [0x10982b8]
call fcn.0100af23
jmp 0x1005f90