Function at 0x100384a8
Capabilities:
Get common file path
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006979b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e8
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10038515
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x230], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c4], eax
push dword [ebp - 0x1c4]
push 0x93b
push 0x35da
push 0x4f73
push 0x544c
push 1
push dword [ebp - 0x230]
push 0x1990
call fcn.100397d0
add esp, 0x20
jmp 0x100397c1
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x214], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x238], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c0], eax
push 1
lea ecx, [ebp - 0xd8]
call fcn.10029e7b
and dword [ebp - 4], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x74], 0
jmp 0x1003856b
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 1
jge 0x10038587
push dword [ebp - 0x74]
lea ecx, [ebp - 0xd8]
call fcn.10029f5b
mov dword [eax], 0x97f6af11
jmp 0x10038564
push 0
lea ecx, [ebp - 0xd8]
call fcn.10029f5b
and dword [eax], 0
jmp 0x100385bd
push 0
lea ecx, [ebp - 0xd8]
call fcn.10029f5b
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0xd8]
call fcn.10029f5b
cmp dword [eax], 2
jge 0x10038793
mov dword [ebp - 0xa4], 0
jmp 0x100385ec
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x10038608
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x29c], 0x8cd54673
jmp 0x100385df
cmp dword [ebp - 0x64], 9
je 0x1003861a
mov dword [ebp - 0x14c], 1
jmp 0x10038621
and dword [ebp - 0x14c], 0
push 0
lea ecx, [ebp - 0xd8]
call fcn.10029f5b
imul ecx, dword [ebp - 0x14c], 0xfff8
cmp dword [eax], ecx
jl 0x10038648
mov dword [ebp - 0x1a8], 1
jmp 0x1003864f
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x1a8]
sub eax, 0x92e6
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x29c]
jne 0x10038675
mov dword [ebp - 0xe8], 1
jmp 0x1003867c
and dword [ebp - 0xe8], 0
cmp dword [ebp - 0xe8], 0x684593f6
jne 0x100386a1
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x29c], 0
jne 0x100386a1
and dword [ebp - 0x148], 0
jmp 0x100386ab
mov dword [ebp - 0x148], 1
mov eax, dword [ebp - 0x64]
imul eax, dword [ebp - 0x148]
sub eax, dword [ebp - 0x64]
cmp eax, 0x68993dd6
jle 0x100386cb
mov dword [ebp - 0xf0], 1
jmp 0x100386d2
and dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0xc0a9
jne 0x100386ea
mov dword [ebp - 0x17c], 1
jmp 0x100386f1
and dword [ebp - 0x17c], 0
push 0
lea ecx, [ebp - 0xd8]
call fcn.10029f5b
mov esi, eax
push 0
lea ecx, [ebp - 0xd8]
call fcn.10029f5b
mov esi, dword [esi]
imul esi, dword [eax]
push 0
lea ecx, [ebp - 0xd8]
call fcn.10029f5b
mov eax, dword [eax]
imul eax, dword [ebp - 0x17c]
cmp esi, eax
jge 0x10038738
mov dword [ebp - 0xf8], 1
jmp 0x1003873f
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x64]
cmp dword [ebp - 0xf8], eax
jg 0x10038756
mov dword [ebp - 0x154], 1
jmp 0x1003875d
and dword [ebp - 0x154], 0
cmp dword [ebp - 0x154], 0xffffffff
jne 0x10038772
mov dword [ebp - 0x100], 1
jmp 0x10038779
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x194], eax
jmp 0x10038599
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.10029f30
mov eax, dword [ebp - 0x238]
movzx eax, byte [eax]
test eax, eax
je 0x10039152
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x110], 0x971867b8
mov dword [ebp - 0x7c], 0
jmp 0x100387d4
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x100387ea
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x2ac], 0xfffb
jmp 0x100387cd
mov dword [ebp - 0x5c], 2
jmp 0x100387fa
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0
jl 0x1003890d
push 1
lea ecx, [ebp - 0x1b4]
call fcn.10029e7b
mov dword [ebp - 4], 1
mov dword [ebp - 0xb4], 0
jmp 0x10038831
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 1
jge 0x10038853
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x1b4]
call fcn.10029f5b
mov dword [eax], 1
jmp 0x10038824
push 0
lea ecx, [ebp - 0x1b4]
call fcn.10029f5b
mov dword [eax], 2
jmp 0x1003888c
push 0
lea ecx, [ebp - 0x1b4]
call fcn.10029f5b
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x108]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x1b4]
call fcn.10029f5b
cmp dword [eax], 0
jl 0x100388f9
mov eax, dword [ebp - 0x5c]
mov eax, dword [ebp + eax*4 - 0x2ac]
mov dword [ebp - 0x284], eax
push 0
lea ecx, [ebp - 0x1b4]
call fcn.10029f5b
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x2ac], 0xc370
jle 0x100388d6
mov dword [ebp - 0x15c], 1
jmp 0x100388dd
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x15c]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0
je 0x100388f4
jmp 0x100388f9
jmp 0x10038868
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b4]
call fcn.10029f30
jmp 0x100387f3
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x10038939
push 0
push 0x1a9a
push 0x143c
push 0
push 0xef6
push 0x1636
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov eax, dword [ebp - 0x214]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1ec], eax
push 3
lea ecx, [ebp - 0x2bc]
call fcn.10029e7b
mov dword [ebp - 4], 2
mov dword [ebp - 0x84], 0
jmp 0x1003897e
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x100389a0
push dword [ebp - 0x84]
lea ecx, [ebp - 0x2bc]
call fcn.10029f5b
mov dword [eax], 0xb3c692be
jmp 0x10038971
mov byte [ebp - 0x47], 0
movzx eax, byte [ebp - 0x47]
test eax, eax
je 0x100389b4
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x100389cf
push 0
push 0x735
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2bc]
call fcn.10029f30
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0x94], 0xfff7
mov dword [ebp - 0x1e4], 0xfffffffc
mov dword [ebp - 0x1dc], 0xfe9f4864
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x2c], 0xffffffea
jmp 0x10038a1d
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 2
jg 0x10038d52
mov dword [ebp - 0x4c], 0xaa9ac70c
mov dword [ebp - 0x258], 0x3b6f
mov dword [ebp - 0x254], 0x3b6f
mov dword [ebp - 0x250], 0x3b6f
mov dword [ebp - 0x24c], 0x3b6f
mov dword [ebp - 0x120], 0x70e7ad53
mov dword [ebp - 0x4c], 0
jmp 0x10038a70
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffea
jl 0x10038d4d
mov dword [ebp - 0x8c], 0xfffffffa
mov dword [ebp - 0x50], 0xfffffff8
cmp dword [ebp - 0x8c], 0
je 0x10038aa6
cmp dword [ebp - 0x4c], 0
je 0x10038aa6
mov dword [ebp - 0x1fc], 1
jmp 0x10038aad
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x8c]
cmp dword [ebp - 0x94], eax
je 0x10038ad0
mov dword [ebp - 0x184], 1
jmp 0x10038ad7
and dword [ebp - 0x184], 0
cmp dword [ebp - 0x184], 0
je 0x10038aec
mov dword [ebp - 0x1cc], 1
jmp 0x10038af3
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x27c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x258], 0xfffffffb
ja 0x10038b1b
mov dword [ebp - 0x204], 1
jmp 0x10038b22
and dword [ebp - 0x204], 0
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x26c], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x258], 0x1fc65786
jne 0x10038b4d
mov dword [ebp - 0x118], 1
jmp 0x10038b54
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x118]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x94], 0
je 0x10038c18
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x164], 1
mov dword [ebp - 0xb0], 0
jmp 0x10038b9d
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 1
jge 0x10038bb9
mov eax, dword [ebp - 0xb0]
mov dword [ebp + eax*4 - 0x2e0], 0
jmp 0x10038b90
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x24], 0xfffffffa
jmp 0x10038bd0
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x29
jge 0x10038c13
mov dword [ebp - 0x2e8], 0xdf39281c
mov dword [ebp - 0x2e4], 0x314b8123
mov dword [ebp - 0x2b0], 0xfffffffe
mov dword [ebp - 0x278], 0x9b95520
mov eax, dword [ebp - 0x164]
inc eax
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x50], eax
jmp 0x10038bc9
jmp 0x10038d48
mov dword [ebp - 0xa8], 0xb7bfbc35
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0xa8]
sub eax, dword [ebp - 0x1d4]
jne 0x10038ca1
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jbe 0x10038c5a
mov dword [ebp - 0x1a4], 1
jmp 0x10038c61
and dword [ebp - 0x1a4], 0
cmp dword [ebp - 0x1a4], 0
jne 0x10038c79
cmp dword [ebp - 0x50], 0
jne 0x10038c79
and dword [ebp - 0x208], 0
jmp 0x10038c83
mov dword [ebp - 0x208], 1
mov eax, dword [ebp - 0x1dc]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0xa8], 0
jne 0x10038ca1
and dword [ebp - 0x128], 0
jmp 0x10038cab
mov dword [ebp - 0x128], 1
cmp dword [ebp - 0x128], 0
jbe 0x10038cc0
mov dword [ebp - 0x234], 1
jmp 0x10038cc7
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0xa8], 0
je 0x10038cf1
cmp dword [ebp - 0x94], 0
je 0x10038cf1
mov dword [ebp - 0x16c], 1
jmp 0x10038cf8
and dword [ebp - 0x16c], 0
cmp dword [ebp - 0x16c], 0xffffffff
jge 0x10038d0d
mov dword [ebp - 0x130], 1
jmp 0x10038d14
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x130], eax
jne 0x10038d2b
mov dword [ebp - 0x18c], 1
jmp 0x10038d32
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x50]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
jmp 0x10038a69
jmp 0x10038a16
mov eax, dword [ebp - 0x210]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp - 0x1ec]
mov dword [ebp - 0x200], eax
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x54], 0
mov dword [ebp - 0x6c], 0
jmp 0x10038d88
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10038d9e
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x268], 0x2abac89d
jmp 0x10038d81
mov dword [ebp - 0x14], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x10038de1
mov dword [ebp - 0x14], 3
jmp 0x10038dbb
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x34
jle 0x10038ddc
mov byte [ebp - 0x1f], 0
movzx eax, byte [ebp - 0x1f]
test eax, eax
je 0x10038dda
push 0
push 0x25f8
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10038db4
jmp 0x1003912b
mov dword [ebp - 0x58], 0x8d0d3f7b
mov dword [ebp - 0xb8], 0xc774
mov dword [ebp - 0x34], 0xe9973063
cmp dword [ebp - 0x58], 0
jne 0x10038ebc
mov eax, dword [ebp - 0xb8]
cmp dword [ebp - 0x14], eax
jne 0x10038e1a
mov dword [ebp - 0x138], 1
jmp 0x10038e21
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
cmp eax, dword [ebp - 0x138]
jge 0x10038e41
mov dword [ebp - 0x174], 1
jmp 0x10038e48
and dword [ebp - 0x174], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x54], eax
xor eax, eax
sub eax, 0x167c28ca
mov ecx, dword [ebp - 0x174]
sub ecx, eax
jne 0x10038e71
cmp dword [ebp - 0x14], 0
jne 0x10038e71
and dword [ebp - 0x140], 0
jmp 0x10038e7b
mov dword [ebp - 0x140], 1
cmp dword [ebp - 0x140], 1
jg 0x10038e99
mov eax, 0xffff
test eax, eax
je 0x10038e99
mov dword [ebp - 0x19c], 1
jmp 0x10038ea0
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0x19c]
add eax, 0x79ae
imul eax, dword [ebp - 0x14]
test eax, eax
jne 0x10038ebc
and dword [ebp - 0xe0], 0
jmp 0x10038ec6
mov dword [ebp - 0xe0], 1
cmp dword [ebp - 0xe0], 0x72c02a3
jne 0x10038ede
mov dword [ebp - 0xe4], 1
jmp 0x10038ee5
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xe4], eax
jne 0x10038efc
mov dword [ebp - 0xdc], 1
jmp 0x10038f03
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0
jmp 0x10038f1c
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 3
jg 0x1003912b
mov dword [ebp - 0x54], 3
jmp 0x10038f36
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x1003911f
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x268]
mov dword [ebp - 0x288], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xf4], eax
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0xf4]
mov dword [ebp + eax - 0x268], ecx
cmp dword [ebp - 0xf4], 0
je 0x10038f8e
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x268], 0
je 0x10038f8e
mov dword [ebp - 0xfc], 1
jmp 0x10038f95
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0xfc]
neg eax
je 0x10038fb6
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x10038fb1
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
jmp 0x1003911a
mov dword [ebp - 0x22c], 0x1f7d
cmp dword [ebp - 0x22c], 0x137c
jge 0x100390fb
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x1f4]
push eax
push 0x10008490
call fcn.1004f9f0
add esp, 0x14
mov byte [ebp - 0xe], 0
mov byte [ebp - 0xd], 0
mov byte [ebp - 0xc9], 0
mov byte [ebp - 0x15], 1
and dword [ebp - 0xc4], 0
jmp 0x10039022
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0xc4]
cmp eax, dword [ebp - 0x114]
jge 0x1003908b
lea eax, [ebp - 0x9c]
push eax
push 0x10008110
call fcn.1004f9f0
pop ecx
pop ecx
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x104]
jne 0x10039055
mov byte [ebp - 0xe], 1
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x10c]
jne 0x10039067
mov byte [ebp - 0xd], 1
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x104]
jl 0x10039083
mov eax, dword [ebp - 0x9c]
cmp eax, dword [ebp - 0x10c]
jle 0x10039089
mov byte [ebp - 0x15], 0
jmp 0x1003908b
jmp 0x10039015
movzx eax, byte [ebp - 0x15]
test eax, eax
je 0x100390e3
movzx eax, byte [ebp - 0xe]
test eax, eax
jne 0x100390a7
mov dword [ebp - 0x11c], 1
jmp 0x100390ae
and dword [ebp - 0x11c], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
jne 0x100390c2
mov dword [ebp - 0x124], 1
jmp 0x100390c9
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x114]
add eax, dword [ebp - 0x11c]
add eax, dword [ebp - 0x124]
cmp eax, dword [ebp - 0x1f4]
jle 0x100390f0
push 0x100084a0
call fcn.100500e1
pop ecx
jmp 0x100390fb
push 0x100084ac
call fcn.100500e1
pop ecx
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x1003910d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x268], ecx
jmp 0x10038f2f
mov dword [ebp - 0x58], 0
jmp 0x10038f15
call fcn.10050632
mov esi, eax
mov ecx, dword [ebp - 0x200]
call fcn.100296f7
mov ecx, eax
mov eax, esi
xor edx, edx
div ecx
mov eax, dword [ebp - 0x1bc]
mov dword [eax], edx
jmp 0x100397c1
mov dword [ebp - 0xac], 0xffffffff
mov dword [ebp - 0xac], 0
jmp 0x10039175
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x18
jge 0x100391a2
mov byte [ebp - 0x46], 0
movzx eax, byte [ebp - 0x46]
test eax, eax
je 0x100391a0
push 0
push 0
push 0x80f
push 0x1a6a
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x10039168
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x100391bb
push 0x8e6
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1f8], eax
mov dword [ebp - 0x1c], 0xfffffffb
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x1d0], 0x924b5411
mov dword [ebp - 0x160], 0xfffe
mov dword [ebp - 0x248], 0xb5e49576
mov dword [ebp - 0x244], 0xb5e49576
mov dword [ebp - 0x240], 0xb5e49576
mov dword [ebp - 0x23c], 0xb5e49576
mov dword [ebp - 0xc8], 0xd485
mov dword [ebp - 0x70], 0
jmp 0x1003922b
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10039241
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x228], 0xa117
jmp 0x10039224
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x44], eax
jne 0x1003925b
mov dword [ebp - 0x1c8], 1
jmp 0x10039262
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x44], 0x5b05
mov eax, dword [ebp - 0x44]
add eax, dword [ebp - 0x1c]
cmp eax, 0x40874b28
jge 0x1003928b
mov dword [ebp - 0x12c], 1
jmp 0x10039292
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
sub eax, dword [ebp - 0x1c]
cmp eax, 0xab227d37
jbe 0x100392b7
cmp dword [ebp - 0x1d0], 0
je 0x100392b7
mov dword [ebp - 0x134], 1
jmp 0x100392be
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x160]
cmp dword [ebp - 0x134], eax
je 0x100392d8
mov dword [ebp - 0x13c], 1
jmp 0x100392df
and dword [ebp - 0x13c], 0
cmp dword [ebp - 0x13c], 1
jne 0x100392f4
mov dword [ebp - 0x144], 1
jmp 0x100392fb
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x144]
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x248], eax
mov eax, dword [ebp - 0xc8]
cmp dword [ebp - 0x1c], eax
jne 0x100393a3
mov dword [ebp - 0x290], 0xec58f553
mov dword [ebp - 0x2d0], 6
push 1
lea ecx, [ebp - 0x2cc]
call fcn.10029e7b
mov dword [ebp - 4], 3
mov dword [ebp - 0x78], 0
jmp 0x10039358
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 1
jge 0x10039374
push dword [ebp - 0x78]
lea ecx, [ebp - 0x2cc]
call fcn.10029f5b
mov dword [eax], 0xfffffff6
jmp 0x10039351
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x228]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x228], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2cc]
call fcn.10029f30
jmp 0x10039793
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x1d8], 0x145f
cmp dword [ebp - 0x1d8], 0x1175
jge 0x100395d5
and dword [ebp - 0x68], 0
lea eax, [ebp - 0x68]
push eax
push 0x10008118
call fcn.1004f9f0
pop ecx
pop ecx
and dword [ebp - 0x1e0], 0
lea eax, [ebp - 0x1e0]
push eax
push dword [ebp - 0x68]
lea ecx, [ebp - 0x220]
call fcn.10029f88
mov dword [ebp - 4], 4
and dword [ebp - 0x60], 0
jmp 0x10039408
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x68]
jge 0x1003946c
and dword [ebp - 0x80], 0
jmp 0x1003941d
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x80]
cmp eax, dword [ebp - 0x68]
jge 0x1003945f
and dword [ebp - 0x150], 0
lea eax, [ebp - 0x150]
push eax
push 0x10008110
call fcn.1004f9f0
pop ecx
pop ecx
mov eax, dword [ebp - 0x60]
cmp eax, dword [ebp - 0x80]
jne 0x1003945d
push dword [ebp - 0x60]
lea ecx, [ebp - 0x220]
call fcn.10029f5b
mov ecx, dword [ebp - 0x150]
mov dword [eax], ecx
jmp 0x10039416
push 0x100082ec
call fcn.1004f9f0
pop ecx
jmp 0x10039401
and dword [ebp - 0x88], 0
lea eax, [ebp - 0x88]
push eax
push 0x10008130
call fcn.1004f9f0
pop ecx
pop ecx
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x1e8], 0
je 0x100395bb
and dword [ebp - 0x90], 0
lea eax, [ebp - 0x90]
push eax
push 0x10008110
call fcn.1004f9f0
pop ecx
pop ecx
cmp dword [ebp - 0x90], 1
je 0x100394d8
cmp dword [ebp - 0x90], 2
jne 0x1003953a
and dword [ebp - 0xbc], 0
lea eax, [ebp - 0xbc]
push eax
push 0x10008118
call fcn.1004f9f0
pop ecx
pop ecx
mov eax, dword [ebp - 0xbc]
dec eax
push eax
lea ecx, [ebp - 0x220]
call fcn.10029f5b
cmp dword [eax], 0
jne 0x10039516
mov dword [ebp - 0x158], 1
jmp 0x1003951d
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0xbc]
dec eax
push eax
lea ecx, [ebp - 0x220]
call fcn.10029f5b
mov ecx, dword [ebp - 0x158]
mov dword [eax], ecx
jmp 0x100395b6
cmp dword [ebp - 0x90], 3
jne 0x100395b6
and dword [ebp - 0xc0], 0
and dword [ebp - 0x98], 0
jmp 0x10039560
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
cmp eax, dword [ebp - 0x68]
jge 0x1003958c
push dword [ebp - 0x98]
lea ecx, [ebp - 0x220]
call fcn.10029f5b
mov ecx, dword [ebp - 0xc0]
add ecx, dword [eax]
mov dword [ebp - 0xc0], ecx
jmp 0x10039553
mov eax, dword [ebp - 0xc0]
and eax, 0x80000001
jns 0x1003959e
dec eax
or eax, 0xfffffffe
inc eax
push eax
push 0x10008110
call fcn.1004fd81
pop ecx
pop ecx
push 0x100082ec
call fcn.1004f9f0
pop ecx
jmp 0x10039486
push 0x1000807d
call fcn.100500e1
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x220]
call fcn.10029f30
mov dword [ebp - 0x168], 0x2039ce85
mov dword [ebp - 0xa0], 0
jmp 0x100395f8
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 3
jge 0x10039614
mov eax, dword [ebp - 0xa0]
mov dword [ebp + eax*4 - 0x2f4], 0x7df39f3c
jmp 0x100395eb
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x1003962a
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2a0], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x2d4], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x248], 0xfffffffb
mov eax, dword [ebp - 0x1c]
sub eax, 5
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x228]
sub ecx, eax
imul ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x168], ecx
mov eax, dword [ebp - 0x168]
sub eax, dword [ebp - 0x44]
jne 0x10039692
mov eax, 0xfffc
test eax, eax
jne 0x10039692
cmp dword [ebp - 0x3c], 0
jne 0x10039692
and dword [ebp - 0x170], 0
jmp 0x1003969c
mov dword [ebp - 0x170], 1
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x170], eax
jne 0x100396b3
mov dword [ebp - 0x1f0], 1
jmp 0x100396ba
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x3c]
neg eax
cmp eax, 0x3f2a
jge 0x100396db
mov dword [ebp - 0x178], 1
jmp 0x100396e2
and dword [ebp - 0x178], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x178], eax
jg 0x100396f9
mov dword [ebp - 0x188], 1
jmp 0x10039700
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x180], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x180]
mov dword [ebp + eax - 0x2f4], ecx
mov eax, dword [ebp - 0x180]
neg eax
cmp eax, dword [ebp - 0x188]
jg 0x10039737
mov dword [ebp - 0x190], 1
jmp 0x1003973e
and dword [ebp - 0x190], 0
cmp dword [ebp - 0x190], 0xffffffff
jge 0x1003975c
cmp dword [ebp - 0xc8], 0
je 0x1003975c
mov dword [ebp - 0x198], 1
jmp 0x10039763
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x198], eax
jge 0x10039780
cmp dword [ebp - 0xc8], 0
jne 0x10039780
and dword [ebp - 0x1a0], 0
jmp 0x1003978a
mov dword [ebp - 0x1a0], 1
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x100397ac
push 0x1905
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [ebp - 0x1f8]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
and dword [eax], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret