Function at 0x1001d24d
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x1008ea13
call fcn.1008e0e8
sub esp, 0x104
mov dword [ebp - 0x10], 0xffffffff
xor eax, eax
inc eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0xe8], eax
mov dword [ebp - 0xe4], eax
mov dword [ebp - 0xe0], eax
push ebx
mov dword [ebp - 0xdc], eax
xor ebx, ebx
mov dword [ebp - 0x10], eax
push esi
mov dword [ebp - 0x10], ebx
mov esi, edx
cmp dword [ebp - 0x10], 4
push edi
jge 0x1001d2ac
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x44], 0x78948018
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1001d295
xor eax, eax
inc eax
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp dword [ebp - 0x3c], ebx
je 0x1001d3f9
mov dword [ebp - 0x18], 0xfffffffc
lea ecx, [ebp - 0xa4]
push eax
call fcn.1001abea
mov dword [ebp - 0x10], ebx
jmp 0x1001d2e2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1001d2d3
mov dword [ebp - 0x18], ebx
jmp 0x1001d382
mov eax, dword [ebp - 0xa4]
xor edx, edx
mov dword [eax], 0xe283
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
test eax, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
lea ecx, [ecx*4 - 1]
cmp ecx, eax
mov eax, dword [ebp - 0x3c]
setne dl
cmp edx, 0xbb66efe0
sbb ecx, ecx
xor edx, edx
neg ecx
imul ecx, eax
mov eax, dword [ebp - 0x3c]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setle dl
mov eax, dword [ebp + eax*4 - 0x44]
imul eax, dword [ebp - 0x38]
imul eax, edx
test eax, eax
je 0x1001d358
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
inc ecx
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
sub ecx, eax
imul ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x38]
imul ecx, ecx, 0xfffffffc
cmp ecx, eax
setle dl
mov dword [ebp - 0x10], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jle 0x1001d2f0
mov dword [ebp - 0x10], 0x12
jmp 0x1001d3e6
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x18], 0x13
jmp 0x1001d3da
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001d3d1
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1001d3ce
push 0x265d
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xf
jl 0x1001d3b1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x14
jne 0x1001d3a5
inc dword [ebp - 0x1c]
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 6
jge 0x1001d395
lea ecx, [ebp - 0xa4]
call fcn.1001ac6c
jmp 0x1001d414
mov dword [ebp - 0x1c], 0x8698
mov dword [ebp - 0x10], 3
cmp dword [ebp - 0x10], ebx
jl 0x1001d414
dec dword [ebp - 0x1c]
dec dword [ebp - 0x10]
jns 0x1001d40c
mov byte [ebp - 0x1d], bl
cmp byte [ebp - 0x1d], bl
je 0x1001d431
push ebx
push ebx
push 0x1e90
push 0x1f7f
call edi
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
cmp byte [ebp + 8], bl
je 0x1001d772
push 1
lea ecx, [ebp - 0x58]
call fcn.1001abea
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x1c], 0xca3191b4
mov dword [ebp + 8], 0xbc43cc9f
mov dword [ebp + 8], ebx
jmp 0x1001d471
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], 1
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jl 0x1001d461
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001d576
push 1
lea ecx, [ebp - 0xb0]
call fcn.1001abea
push 4
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.1001abea
mov dword [ebp - 0x10], 0xd0c11e04
mov dword [ebp + 8], ebx
jmp 0x1001d4c0
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], 0x47d2038
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jl 0x1001d4ad
mov dword [ebp + 8], ebx
jmp 0x1001d4da
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x98]
mov dword [eax + ecx*4], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jl 0x1001d4cb
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb0]
mov edx, dword [ebp - 0x14]
mov dword [eax], ebx
mov eax, dword [ebp - 0x58]
mov ecx, dword [eax]
mov dword [eax + edx*4], ecx
cmp ecx, 1
jle 0x1001d50f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x58]
cmp dword [eax + ecx*4], 0xe5b14f4e
jne 0x1001d50f
xor ecx, ecx
inc ecx
jmp 0x1001d511
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
sub ecx, eax
jne 0x1001d521
cmp dword [ebp - 0x1c], ebx
jne 0x1001d521
mov eax, ebx
jmp 0x1001d524
xor eax, eax
inc eax
cmp eax, 0xffff
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x98]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax + 0xc], ecx
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ecx + edx*4]
sub ecx, eax
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x98]
call fcn.1001ac6c
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], bl
call fcn.1001ac6c
dec dword [ebp - 0x14]
jns 0x1001d483
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.1001ac6c
mov dword [ebp - 0x10], 0x5d6c05ba
xor ecx, ecx
mov dword [ebp - 0x1c], 0x3c6fe23a
inc ecx
mov dword [ebp + 8], 0x50e35260
mov dword [ebp - 0x28], ecx
mov dword [ebp + 8], 0x2628
mov dword [ebp - 0x10], 0xa
jmp 0x1001d752
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp + 8], ebx
jmp 0x1001d5ca
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x30], 0xde0b4074
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x1001d5bc
mov dword [ebp + 8], ebx
jmp 0x1001d5e6
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0xc8], 0x84a8988e
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x1001d5d5
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ebx
jl 0x1001d74f
mov dword [ebp + 8], 0x2be197e7
mov dword [ebp - 0x24], 0x5051dd2e
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x18], 0x549c4b05
mov dword [ebp - 0x48], 0x1f9
mov dword [ebp - 0x1c], 0xb96
mov dword [ebp + 8], 7
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
add ecx, eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x30]
cmp ecx, eax
setne dl
sub edx, 0x67120dd9
imul edx, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
neg edx
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setg dl
imul eax, edx
cmp eax, dword [ebp - 0x28]
jg 0x1001d673
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setg dl
xor eax, eax
test edx, edx
setle al
add eax, 0xa3a6
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
add eax, 9
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], ebx
jmp 0x1001d73a
push 4
lea ecx, [ebp - 0x8c]
call fcn.1001abea
mov dword [ebp + 8], ebx
jmp 0x1001d6cf
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp + 8]
cmp dword [ebp + 8], 4
jl 0x1001d6bc
cmp dword [ebp - 0x10], ebx
jne 0x1001d6dd
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x8c]
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc4], eax
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001d72c
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
lea ecx, [ebp - 0x8c]
call fcn.1001ac6c
inc dword [ebp - 0x18]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x18], ecx
jle 0x1001d6aa
dec dword [ebp - 0x14]
jns 0x1001d5f8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1d
jge 0x1001d5b0
push ebx
push 0x1c7b
push 0x1722
call dword [sym.imp.GDI32.dll_CreatePen]
jmp 0x1001dc32
xor edx, edx
inc edx
mov dword [ebp - 0x14], edx
mov dword [ebp + 8], ebx
jmp 0x1001d78b
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x4c], 0x251d69f4
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jl 0x1001d77d
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0x12
jle 0x1001d7c8
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1001d7bc
push ebx
push 0x1ef0
push 0xaa0
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x12
jg 0x1001d799
xor edx, edx
inc edx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001d7de
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x4c], ebx
jne 0x1001d7de
dec dword [ebp - 0x14]
jns 0x1001d7d0
mov dword [ebp - 0x10], 0x16df251d
mov dword [ebp + 8], ebx
jmp 0x1001d7fb
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0xc0], 0x4a8c6a53
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jl 0x1001d7ea
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], ebx
jg 0x1001d875
mov dword [ebp - 0x18], 4
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1001d81f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x18], ebx
jmp 0x1001d865
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x1001d85d
mov dword [ebp - 0x1c], 0xe327439c
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x1001d85a
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1001d855
push 0xf3a
call edi
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
dec dword [ebp - 0x1c]
jns 0x1001d83f
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x1001d830
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1001d824
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001d808
xor edx, edx
inc edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x10], 0x5c8094a1
mov dword [ebp + 8], ebx
jmp 0x1001d895
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x10c], 0xfffffffd
inc dword [ebp + 8]
cmp dword [ebp + 8], 2
jl 0x1001d884
mov dword [ebp - 0x10], ebx
jmp 0x1001d8b5
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x1001d8b2
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
xor edx, edx
inc edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x1001d8a0
mov dword [ebp - 0x24], 0xc8094a18
mov eax, 0x36f6dd8d
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp + 8], ebx
jmp 0x1001d8eb
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x104], 0xfffffffa
inc dword [ebp + 8]
cmp dword [ebp + 8], 3
jl 0x1001d8da
push 4
mov dword [ebp + 8], ebx
pop edi
jmp 0x1001d90a
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0xd8], 0xfffffff8
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1001d8f9
cmp dword [ebp - 0x74], 0xafb
jle 0x1001d91f
mov ecx, ebx
cmp dword [ebp - 0x24], ebx
je 0x1001d921
mov ecx, edx
xor eax, eax
cmp ecx, 3
setge al
add eax, 0x70ed99ea
je 0x1001d93a
mov eax, edx
cmp dword [ebp - 0xd8], ebx
jne 0x1001d93c
mov eax, ebx
dec dword [ebp - 0x1c]
mov edx, dword [ebp - 0xd8]
sub edx, eax
mov eax, dword [ebp - 0xd8]
neg edx
push 2
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
xor edx, edx
cmp ecx, 0x93dda37b
setne dl
xor eax, eax
cmp edx, 0xfffffff6
mov dword [ebp - 0x74], edx
setl al
xor edx, edx
cmp eax, 7
mov eax, dword [ebp - 0x1c]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x24]
setle cl
sub eax, ecx
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x104], eax
mov dword [ebp - 0x14], 0x6dd1e1e8
call fcn.1001abea
push 2
pop edx
mov dword [ebp - 4], edx
mov dword [ebp + 8], ebx
jmp 0x1001d9b8
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], 0x999d94b4
inc dword [ebp + 8]
cmp dword [ebp + 8], edx
jl 0x1001d9a8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], 0xf2f4a8b1
mov dword [ebp - 0x14], 0xfffffff8
jmp 0x1001db03
mov dword [ebp - 0x10], 0xfffffffc
lea ecx, [ebp - 0xbc]
push edi
call fcn.1001abea
mov byte [ebp - 4], 3
mov dword [ebp + 8], ebx
jmp 0x1001d9fe
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], ebx
inc dword [ebp + 8]
cmp dword [ebp + 8], edi
jl 0x1001d9ef
cmp dword [ebp - 0x14], ebx
je 0x1001da33
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001daf1
push 0xea4
push 0x557
push ebx
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x1001daf1
movdqa xmm0, xmmword [0x1000b150]
lea eax, [ebp - 0xe8]
mov dword [ebp + 8], 0xffffffff
lea ecx, [ebp - 0x64]
push dword [ebp + 8]
movdqu xmmword [ebp - 0xf8], xmm0
push eax
lea eax, [ebp - 0xf8]
mov dword [ebp - 0x64], ebx
push eax
push ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
call fcn.1001c2db
mov dword [ebp - 0x24], 0xfffffff9
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, 0xffffb50c
neg eax
sbb eax, eax
add eax, 0xffffb036
neg eax
sbb eax, eax
inc eax
cmp eax, 0x1dda
jg 0x1001daa1
cmp dword [ebp - 0x14], ebx
je 0x1001daa1
xor edx, edx
inc edx
jmp 0x1001daa3
mov edx, ebx
mov eax, dword [ebp - 0x10]
xor ecx, ecx
sub edx, eax
mov eax, dword [ebp - 0x14]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x2c4e
setne al
xor edx, edx
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 8]
setle cl
add eax, 0xfffffffb
add ecx, eax
xor edx, edx
mov eax, dword [ebp - 0x10]
cmp eax, ecx
mov eax, dword [ebp - 0x70]
lea ecx, [ebp - 0x64]
setne dl
mov dword [eax], edx
inc dword [ebp - 0x24]
call fcn.1001ac6c
lea ecx, [ebp - 0xbc]
mov byte [ebp - 4], 2
call fcn.1001ac6c
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe3
jg 0x1001d9d3
lea ecx, [ebp - 0x70]
call fcn.1001ac6c
mov dword [ebp - 0x10], 0x77e8
mov dword [ebp + 8], ebx
mov dword [ebp + 8], ebx
jmp 0x1001db32
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x34], 0xfff6
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jl 0x1001db24
cmp dword [ebp - 0x10], ebx
je 0x1001db65
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001dc16
push 0x68d
push ebx
push 0xcdd
push 0x1909
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x1001dc16
mov dword [ebp + 8], 0x63f9e923
mov dword [ebp - 0x1c], 0x796840e
mov dword [ebp - 0x24], 0xe819d338
cmp dword [ebp - 0x10], ebx
jne 0x1001dbb9
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, dword [ebp - 0x34]
imul ecx, eax
mov eax, dword [ebp - 0x34]
cmp ecx, eax
mov eax, dword [ebp + 8]
setne dl
xor ecx, ecx
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0xfffffffb
mov eax, dword [ebp + 8]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x34]
jl 0x1001dbbe
cmp dword [ebp - 0x1c], ebx
jne 0x1001dbc1
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1001dc16
push ebx
push 0x105f
push 0x527
push 0xe4a
push 0x2570
push 0x93d
push 0x145c
push 0x95d
push 0x1eb2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [esi], ebx
cmp dword [esi], 1
jge 0x1001dc32
mov edx, dword [ebp - 0x28]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xfd57
inc dword [esi]
cmp dword [esi], 1
jl 0x1001dc20
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret