Function at 0x1002a68e
Capabilities:
Get thread local storage value
Query environment variable

Disassembly:
mov eax, 0x1008ea06
call fcn.1008ddf8
sub esp, 0x134
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x54], edx
xor ebx, ebx
cmp dword [edi + 0x10], ebx
jne 0x1002a6b3
xor al, al
jmp 0x1002b43e
mov dword [ebp - 0x34], 0xc8a81d5f
mov dword [ebp - 0x10], ebx
jmp 0x1002a6d0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x124], 0xb57f
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002a6bf
xor ecx, ecx
mov dword [ebp - 0x10], ebx
inc ecx
jmp 0x1002a6ec
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x3c], 0xc184c506
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x1002a6de
push esi
mov dword [ebp - 0x3c], ecx
push 3
pop esi
cmp dword [ebp - 0x3c], ebx
jl 0x1002a808
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ebx
jl 0x1002a7ff
mov dword [ebp - 0x18], 0x9dfcf09c
mov dword [ebp - 0x28], 0x18b47430
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
jl 0x1002a7e0
mov dword [ebp - 0x1c], 0xfffffffe
mov dword [ebp - 0x10], ebx
jmp 0x1002a747
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x140], 0xfffffffc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002a736
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002a774
push 0xe28
push 0x8c3
push 0x235f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
call dword [sym.imp.USER32.dll_PeekMessageA]
xor ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], ebx
jl 0x1002a7d7
mov dword [ebp - 0x24], 0xd1dc
mov dword [ebp - 0x2c], 0xfffffff7
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x2c], ebx
je 0x1002a79d
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x20]
jge 0x1002a79d
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x124]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x140], 0xdd9ae65c
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002a7cf
push 0x5f0
call dword [sym.imp.USER32.dll_GetSysColor]
dec dword [ebp - 0x1c]
jns 0x1002a77c
xor ecx, ecx
inc ecx
dec dword [ebp - 0x18]
jns 0x1002a72a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002a7f3
push 0x237d
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
dec dword [ebp - 0x20]
push 1
pop ecx
jns 0x1002a710
dec dword [ebp - 0x3c]
jns 0x1002a701
mov eax, dword [ebp - 0x54]
mov dword [eax], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], 0xedc0223d
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x10], 6
mov dword [ebp - 0x24], 0xf9531def
mov dword [ebp - 0x10], ebx
jmp 0x1002a841
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x108], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002a834
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
xor edx, edx
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
xor ecx, ecx
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, edx
setle cl
xor edx, edx
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [ebp - 0x20]
jne 0x1002a8ac
cmp dword [ebp - 0x20], ebx
je 0x1002a8ac
xor eax, eax
inc eax
jmp 0x1002a8ae
mov eax, ebx
cmp eax, 1
lea ecx, [ebp - 0xa0]
push 1
sbb eax, eax
inc eax
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], 1
sbb eax, eax
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
call fcn.1001a25e
push 2
lea ecx, [ebp - 0x114]
mov dword [ebp - 4], ebx
call fcn.1001a25e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x1c], 0xaf8716b5
push esi
call fcn.1001a25e
push 2
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1002a92a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x114]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002a917
mov dword [ebp - 0x10], ebx
jmp 0x1002a947
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0xdb2b058e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1002a934
push 0xffffffffffffffff
mov dword [ebp - 0x10], ebx
pop esi
jmp 0x1002a961
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x11c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002a954
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0xb8]
mov eax, dword [ebp - 0xb8]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x118], ebx
call fcn.1001ab22
lea ecx, [ebp - 0x114]
mov byte [ebp - 4], bl
call fcn.1001ab22
xor edx, edx
mov dword [ebp - 0x40], 0x52061f66
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1002a9b9
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa0]
mov dword [eax + ecx*4], 0x8d327cb3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002a9a6
mov dword [ebp - 0x18], 0xd6c05baf
mov dword [ebp - 0x24], 0x4c8d3c89
mov dword [ebp - 0x28], esi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002a9e8
push ebx
push ebx
push 0x122d
call dword [sym.imp.ADVAPI32.dll_CopySid]
xor edx, edx
inc edx
mov dword [ebp - 0x18], ebx
jmp 0x1002aa04
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], 0x8c66
mov eax, dword [ebp - 0x28]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x15
jle 0x1002a9ed
mov dword [ebp - 0x40], ebx
cmp dword [ebp - 0x40], ebx
jl 0x1002ad55
mov eax, 0x4a87fce6
jmp 0x1002aa20
xor edx, edx
inc edx
mov dword [ebp - 0x18], 0x20452a26
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x20], 0x3bfa32a1
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x28], 0x3f29c8dd
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x18], ebx
jmp 0x1002aa5e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x38], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1002aa54
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
sub ecx, eax
cmp dword [ebp - 0x38], ecx
jge 0x1002aa85
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x18], eax
jge 0x1002aa85
mov eax, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1002aa87
mov eax, edx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x38], ebx
je 0x1002aa9a
cmp dword [ebp - 0x18], ebx
jne 0x1002aaa1
mov ecx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x1002aaa3
mov ecx, edx
xor eax, eax
cmp ecx, 0xa4c
setle al
mov dword [ebp - 0x74], eax
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x6c]
sub ecx, eax
mov eax, dword [ebp - 0x20]
add eax, ecx
je 0x1002aad9
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002ab32
push edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x1002ab32
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x74]
setle cl
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setne dl
sub edx, 0xfffffffc
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x24], 0xb1d70f3f
push 2
lea ecx, [ebp - 0x8c]
call fcn.1001a25e
push 2
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x1002ab5c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], 0x3342eb9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002ab4e
mov dword [ebp - 0x10], ebx
jmp 0x1002ab79
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x8c]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002ab66
mov esi, dword [ebp - 0x8c]
xor edx, edx
inc edx
mov dword [esi + 4], edx
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x20], 0xb0b4ef66
mov dword [ebp - 0x10], ebx
jmp 0x1002ac0d
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x48], ebx
je 0x1002abe9
mov eax, dword [esi + 4]
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [esi + 4]
mov eax, dword [ebp + eax*4 - 0x48]
cmp eax, 0xc218
setg cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp eax, 0xfffffffd
setle cl
sub ecx, 0x8558
neg ecx
sbb ecx, ecx
add ecx, 0xcce3a785
neg ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x10]
test ecx, ecx
jne 0x1002abeb
mov edx, ebx
mov eax, dword [esi + 4]
mov ecx, dword [ebp + eax*4 - 0x48]
xor eax, eax
cmp edx, 0xb89b
setg al
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], ecx
inc dword [ebp - 0x10]
inc edx
cmp dword [ebp - 0x10], edx
jle 0x1002ab9d
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x1002acf5
mov dword [ebp - 0x28], 0xf7c295a5
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002ac49
push ebx
push 0x256e
push 0x2362
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
xor edx, edx
inc edx
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x1002acec
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 0xd44f
mov dword [ebp - 0x2c], 0x41b0ce7a
mov dword [ebp - 0x1c], ebx
jmp 0x1002acde
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x48]
cmp dword [ebp - 0x18], ebx
je 0x1002ac7a
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x18]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setne dl
sub edx, dword [ebp + eax*4 - 0x48]
neg edx
sbb edx, edx
inc edx
cmp edx, dword [esi + 4]
jl 0x1002acbb
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1002acb4
mov ecx, dword [ebp - 0x28]
mov eax, dword [esi + 4]
sub ecx, 4
mov dword [ebp + eax*4 - 0x48], ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1002aca4
jmp 0x1002acd4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002acd1
push 0xc25
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor edx, edx
inc edx
mov dword [ebp - 0x2c], 0xa7221ebc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jle 0x1002ac6b
dec dword [ebp - 0x20]
jns 0x1002ac55
dec dword [ebp - 0x10]
jns 0x1002ac1e
dec dword [esi + 4]
jns 0x1002ab8a
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x1002ad23
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
cmp dword [eax + ecx*4], 5
sete dl
mov dword [eax + esi*4], edx
dec dword [ebp - 0x18]
jns 0x1002ad06
lea ecx, [ebp - 0x8c]
call fcn.1001ab22
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0xa0]
push eax
push ebx
call fcn.1002cd69
add esp, 0xc
mov eax, 0x4a87fce6
dec dword [ebp - 0x40]
push 0xffffffffffffffff
pop esi
jns 0x1002aa1d
or esi, esi
mov byte [ebp - 0x11], bl
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x24], 0x1fc80ae7
push 4
call fcn.1001a25e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x18], 0x8d2ca8e1
push 2
call fcn.1001a25e
mov dword [ebp - 0x10], ebx
jmp 0x1002ad97
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x50], 0x32384b6d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 1
jl 0x1002ad89
mov dword [ebp - 0x10], ebx
jmp 0x1002adb2
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x80]
mov dword [eax + ecx*4], 0xcdab0b82
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x1002ada2
mov dword [ebp - 0x10], ebx
jmp 0x1002add0
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 0xb5ad8edc
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002adbd
mov dword [ebp - 0x10], 0xffffffea
cmp dword [ebp - 0x10], 0x1a
jge 0x1002aec9
mov esi, dword [ebp - 0x80]
mov dword [ebp - 0x24], 0xf0a290be
mov dword [ebp - 0x20], 0xa22e974a
mov dword [ebp - 0x2c], 0x889e
mov dword [ebp - 0x34], 0x94ad8a0f
mov dword [ebp - 0x28], 4
mov dword [ebp - 0x1c], ebx
jmp 0x1002ae23
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xf4], 0x94fb389f
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002ae12
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
add edx, 6
cmp edx, eax
setg cl
cmp dword [ebp - 0x10], ecx
jg 0x1002ae49
cmp dword [ebp - 0x10], ebx
je 0x1002ae53
cmp dword [ebp - 0x10], ebx
je 0x1002ae53
xor eax, eax
inc eax
jmp 0x1002ae55
mov eax, ebx
cmp eax, dword [ebp - 0x2c]
jge 0x1002ae62
cmp dword [ebp - 0x20], ebx
jne 0x1002ae62
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x50]
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 0x24]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
jne 0x1002ae8d
cmp dword [ebp - 0x18], ebx
jne 0x1002ae8d
xor eax, eax
inc eax
jmp 0x1002ae8f
mov eax, ebx
cmp eax, dword [ebp - 0xf0]
je 0x1002aea0
cmp dword [ebp - 0x20], ebx
jne 0x1002aea0
mov ecx, ebx
jmp 0x1002aea3
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
sub ecx, eax
add ecx, dword [ebp - 0x28]
xor eax, eax
cmp ecx, 0x59458d81
setg al
mov dword [ebp - 0x18], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1a
jl 0x1002adea
or esi, 0xffffffff
mov eax, dword [ebp - 0x18]
mov ecx, 0xb34d7aeb
cmp ecx, eax
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x80]
sbb edx, edx
inc edx
imul ecx, edx
mov dword [eax + 8], edx
xor edx, edx
mov eax, dword [ebp - 0xc4]
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
add ecx, 6
cmp esi, ecx
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x50]
sbb esi, esi
xor edx, edx
neg esi
cmp ecx, eax
lea ecx, [ebp - 0xc4]
setg dl
imul esi, edx
mov dword [ebp - 0x18], esi
call fcn.1001ab22
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], bl
call fcn.1001ab22
cmp byte [ebp - 0x11], 0
je 0x1002af3e
push 0x3c70
push ebx
call fcn.1002ccc1
pop ecx
pop ecx
or eax, 0xffffffff
lea ecx, [ebp - 0xa0]
mov dword [ebp - 4], eax
call fcn.1001ab22
push 2
lea ecx, [ebp - 0xdc]
call fcn.1001a25e
mov dword [ebp - 0x18], 0x2ee76f50
mov dword [ebp - 0x1c], ebx
jmp 0x1002af7b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xdc]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002af68
mov esi, dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], ebx
jl 0x1002afd7
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xdc]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002afd2
push 0x1f7b
push 0x8bd
push 0x1cd1
push 0x64f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
dec dword [ebp - 0x18]
jns 0x1002af93
lea ecx, [ebp - 0xdc]
call fcn.1001ab22
cmp dword [edi + 0x14], 0x10
jb 0x1002afec
mov ecx, dword [edi]
jmp 0x1002afee
mov ecx, edi
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x4c], ecx
jb 0x1002affb
mov edx, dword [edi]
jmp 0x1002affd
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
push 3
cmp ecx, eax
je 0x1002b112
mov dword [ebp - 0x2c], 1
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x18], ebx
call fcn.1001a25e
push 0x55df
lea eax, [ebp - 0xec]
mov dword [ebp - 4], 3
push eax
push 0x7cee
lea eax, [ebp - 0xe0]
push eax
push ebx
call fcn.1002d2e6
add esp, 0x14
cmp dword [ebp - 0x2c], 6
ja 0x1002b059
cmp dword [ebp - 0x2c], ebx
je 0x1002b059
inc dword [ebp - 0x18]
jmp 0x1002b086
mov dword [ebp - 0x18], ebx
jmp 0x1002b071
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b06e
push ebx
call fcn.1002c52f
pop ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1002b05e
lea eax, [ebp - 0x2d]
mov byte [ebp - 0x2d], bl
push ebx
push eax
call fcn.1002caa3
pop ecx
pop ecx
or eax, 0xffffffff
lea ecx, [ebp - 0xec]
mov dword [ebp - 4], eax
call fcn.1001ab22
mov eax, dword [ebp - 0x4c]
mov al, byte [eax]
cmp al, 0x30
jl 0x1002b0c3
cmp al, 0x39
jg 0x1002b0c3
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push 0x1c13
call fcn.10034feb
mov ecx, dword [ebp - 0x4c]
add esp, 0x10
inc ecx
jmp 0x1002afee
lea eax, [ebp - 0x54]
push eax
push 0x77b7
push ebx
push 0x3cdd
call fcn.1002c90e
add esp, 0x10
mov dword [ebp - 0x1c], ebx
jmp 0x1002b0f0
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x134], 0xbcd8c45c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002b0df
lea eax, [ebp - 0x2f]
mov byte [ebp - 0x2f], bl
push eax
push ebx
call fcn.1002d645
dec dword [ebp - 0x12c]
xor al, al
pop ecx
pop ecx
jmp 0x1002b43d
lea ecx, [ebp - 0xac]
call fcn.1001a25e
mov dword [ebp - 0x28], 0x23b6182e
mov dword [ebp - 0x1c], ebx
jmp 0x1002b138
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xac]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1002b129
mov eax, dword [ebp - 0xac]
mov ecx, dword [eax]
sub ecx, dword [eax + 8]
mov dword [ebp - 0x28], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b198
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x841
push 0x597
push 0x24
push ebx
push 0x1ce3
push 0x22cc
call edi
push eax
call esi
push eax
push 0x353
push 0x2689
push 0x1b94
push 0x1260
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
lea ecx, [ebp - 0xac]
call fcn.1001ab22
push 2
lea ecx, [ebp - 0x64]
call fcn.1001a25e
push 4
pop edi
mov dword [ebp - 4], edi
xor edx, edx
mov dword [ebp - 0x20], 3
inc edx
mov dword [ebp - 0x18], 0xd3650dfa
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 2
jge 0x1002b1db
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1c]
jmp 0x1002b1c7
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x1002b2dc
mov dword [ebp - 0x10], 0x2a2c7c8a
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x1002b284
lea eax, [ebp - 0x2e]
mov byte [ebp - 0x2e], bl
push eax
push ebx
call fcn.1002cf3b
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
neg eax
pop ecx
sbb eax, eax
inc eax
pop ecx
add eax, dword [ebp - 0x20]
je 0x1002b21c
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
cmp eax, 0x63a7
setge cl
add ecx, 0xde65903
cmp ecx, 0xb8ce
jge 0x1002b243
cmp dword [ebp - 0x20], ebx
jne 0x1002b243
mov edx, ebx
jmp 0x1002b246
xor edx, edx
inc edx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x64]
cmp dword [eax + ecx*4], edx
jge 0x1002b25b
cmp dword [ebp - 0x10], ebx
je 0x1002b25b
xor ecx, ecx
inc ecx
jmp 0x1002b25d
mov ecx, ebx
mov esi, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x20]
cmp ecx, eax
mov eax, dword [ebp - 0x64]
sete dl
xor ecx, ecx
cmp dword [eax + esi*4], edx
sete cl
mov dword [ebp - 0x18], ecx
dec dword [ebp - 0x10]
jns 0x1002b1fa
xor edx, edx
inc edx
mov dword [ebp - 0x18], ebx
jmp 0x1002b2ce
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], ebx
jl 0x1002b2cb
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x64]
cmp dword [eax + ecx*4], ebx
jne 0x1002b2c8
push 0x7553
push ebx
push 0x62d7
push 0x4e5
push 0xc75
push 0x5023
push 0x2270
call fcn.1002c981
add esp, 0x1c
dec dword [ebp - 0x10]
jns 0x1002b291
xor edx, edx
inc edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jle 0x1002b289
dec dword [ebp - 0x20]
jns 0x1002b1e7
or esi, 0xffffffff
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], esi
call fcn.1001ab22
push edi
lea ecx, [ebp - 0xd0]
call fcn.1001a25e
mov dword [ebp - 0x18], 0xdf251d69
xor edx, edx
mov dword [ebp - 0x2c], 5
inc edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x34], 0x629aa810
mov dword [ebp - 0x34], 0x283066c9
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x28], 0xd3335637
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], 0xfffc
mov dword [ebp - 0x24], 0xeb94
mov dword [ebp - 0x20], 0x8323
mov dword [ebp - 0x10], ebx
jmp 0x1002b35b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jl 0x1002b34c
mov dword [ebp - 0x10], ebx
jmp 0x1002b373
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x58], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x1002b365
mov dword [ebp - 0x10], ebx
jmp 0x1002b38e
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x94], 0xb000cd9d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1002b37d
mov dword [ebp - 0x10], ebx
jmp 0x1002b3aa
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x100], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1002b399
dec dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x2c], 0x644bb323
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0xd0]
cmp dword [eax], 0xbab0
mov eax, dword [ebp - 0xfc]
sete cl
add eax, ecx
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x18], eax
jge 0x1002b3fd
cmp dword [ebp - 0x20], ebx
jne 0x1002b3fd
mov edx, ebx
mov eax, dword [ebp - 0x34]
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, dword [ebp - 0x1c]
jl 0x1002b411
cmp dword [ebp - 0x1c], ebx
je 0x1002b414
xor ebx, ebx
inc ebx
neg ebx
xor eax, eax
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x2c], 0x8f1edd1e
mov edx, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x2c]
cmp ecx, edx
lea ecx, [ebp - 0xd0]
setle al
mov dword [ebp - 0x34], eax
call fcn.1001ab22
mov al, 1
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret