Function at 0x1002891b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008bc4f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x284
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x100293e5
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x3c], 0xd4e06482
mov dword [ebp - 0x230], 5
mov dword [ebp - 0x224], 0
push 3
lea ecx, [ebp - 0x270]
call fcn.10018816
and dword [ebp - 4], 0
mov dword [ebp - 0x238], 0x33631af6
mov dword [ebp - 0x20], 0
jmp 0x100289a6
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jge 0x100289c2
push dword [ebp - 0x20]
lea ecx, [ebp - 0x270]
call fcn.10018883
mov dword [eax], 0xfffffffa
jmp 0x1002899f
mov dword [ebp - 0x20], 0
jmp 0x100289d2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x100289e8
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x220], 0x167d
jmp 0x100289cb
mov dword [ebp - 0x3c], 0x1b
jmp 0x100289f8
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xffffffed
je 0x10028c3e
mov dword [ebp - 0x58], 0xd925b0e4
mov dword [ebp - 0x58], 0
jmp 0x10028a19
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0x18
jl 0x10028c39
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x8c], 0x7cccaea0
mov dword [ebp - 0x84], 0
jmp 0x10028a4d
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x10028a69
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x170], 0xcf2e
jmp 0x10028a40
mov dword [ebp - 0x28], 2
jmp 0x10028a79
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x10028c34
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x34], 2
jmp 0x10028a9a
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x10028c2f
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x170], 0
je 0x10028ab6
jmp 0x10028c2f
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x170], 0
je 0x10028c18
mov dword [ebp - 0x2c], 0xc59cdc34
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x170], 0
je 0x10028ae0
jmp 0x10028c2f
mov dword [ebp - 0x2c], 2
jmp 0x10028af0
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
jl 0x10028c16
mov dword [ebp - 0x164], 0x54d8142c
mov dword [ebp - 0x1e8], 0xffffffff
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp + eax*4 - 0x170]
mov dword [ebp + ecx*4 - 0x170], eax
mov eax, dword [ebp - 0x8c]
mov dword [ebp - 0x240], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x248], eax
mov eax, dword [ebp - 0x2c]
cmp dword [ebp + eax*4 - 0x170], 4
je 0x10028b50
mov dword [ebp - 0xf0], 1
jmp 0x10028b57
and dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0x737ae9f9
je 0x10028b6f
mov dword [ebp - 0x150], 1
jmp 0x10028b76
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x150]
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
add eax, 0x87a5
cmp eax, 0x93e6
jl 0x10028baf
cmp dword [ebp - 0x3c], 0
jne 0x10028baf
and dword [ebp - 0xac], 0
jmp 0x10028bb9
mov dword [ebp - 0xac], 1
mov eax, 0xfffa
sub eax, dword [ebp - 0xac]
sub eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x58]
jle 0x10028bde
cmp dword [ebp - 0x34], 0
jne 0x10028bde
and dword [ebp - 0x10c], 0
jmp 0x10028be8
mov dword [ebp - 0x10c], 1
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0x10c]
mov dword [ebp - 0x1e8], eax
mov byte [ebp - 0x4d], 0
movzx eax, byte [ebp - 0x4d]
test eax, eax
je 0x10028c11
push 0
push 0x14f8
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x10028ae9
jmp 0x10028c2a
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x170], 0
je 0x10028c2a
jmp 0x10028c2f
jmp 0x10028a93
jmp 0x10028a72
jmp 0x10028a12
jmp 0x100289f1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x220]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x220], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.1001887e
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x54], 0xa8bc07c2
mov dword [ebp - 0x250], 0xfffffffc
mov dword [ebp - 0x258], 0x722abac8
mov dword [ebp - 0x260], 0xed09
push 3
lea ecx, [ebp - 0x280]
call fcn.10018816
mov dword [ebp - 4], 1
mov dword [ebp - 0x22c], 2
mov dword [ebp - 0x254], 0xa57461d0
mov dword [ebp - 0xcc], 0x8d5680a2
mov dword [ebp - 0x14], 0
jmp 0x10028cd6
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10028cec
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x184], 0xae35
jmp 0x10028ccf
mov dword [ebp - 0x14], 0
jmp 0x10028cfc
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10028d12
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x234], 0x4c7ba3f3
jmp 0x10028cf5
mov dword [ebp - 0x14], 0
jmp 0x10028d22
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10028d3e
push dword [ebp - 0x14]
lea ecx, [ebp - 0x280]
call fcn.10018883
mov dword [eax], 1
jmp 0x10028d1b
mov dword [ebp - 0x18], 0
jmp 0x10028d4e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jg 0x10028f65
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x184]
neg eax
cmp eax, 0xffffffff
jae 0x10028d78
mov dword [ebp - 0xb4], 1
jmp 0x10028d7f
and dword [ebp - 0xb4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x184]
cmp eax, dword [ebp - 0xb4]
jl 0x10028d9f
mov dword [ebp - 0x114], 1
jmp 0x10028da6
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x114], eax
je 0x10028dc7
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x184], 0
jne 0x10028dc7
and dword [ebp - 0xbc], 0
jmp 0x10028dd1
mov dword [ebp - 0xbc], 1
cmp dword [ebp - 0xbc], 0xffffffff
je 0x10028de6
mov dword [ebp - 0x118], 1
jmp 0x10028ded
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x184]
sub eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0x18]
cmp eax, dword [ebp + ecx*4 - 0x184]
je 0x10028e1b
cmp dword [ebp - 0x18], 0
je 0x10028e1b
mov dword [ebp - 0xc4], 1
jmp 0x10028e22
and dword [ebp - 0xc4], 0
cmp dword [ebp - 0xc4], 1
jne 0x10028e37
mov dword [ebp - 0x140], 1
jmp 0x10028e3e
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x140]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x10028e68
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x184], 0
je 0x10028e63
jmp 0x10028f65
jmp 0x10028f45
mov dword [ebp - 0x54], 2
jmp 0x10028e78
mov eax, dword [ebp - 0x54]
dec eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
jl 0x10028f45
mov dword [ebp - 0x70], 0
jmp 0x10028e92
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10028ea8
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x178], 0x6986d6db
jmp 0x10028e8b
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x178], 0
jmp 0x10028ed6
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x178]
inc eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x178], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x178], 2
jg 0x10028f40
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x88], 2
jmp 0x10028f09
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x10028f3b
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x10028f39
push 0
push 0x339
push 0x1a20
push 0x10e3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x10028efc
jmp 0x10028ebb
jmp 0x10028e71
mov byte [ebp - 0x45], 0
movzx eax, byte [ebp - 0x45]
test eax, eax
je 0x10028f60
push 1
push 0x1dad
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x10028d47
mov eax, dword [ebp - 0xcc]
dec eax
mov dword [ebp - 0xcc], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x280]
call fcn.1001887e
mov eax, dword [ebp - 0x1f0]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x78], 0x540d7f82
mov dword [ebp - 0x200], 0xfffffff7
mov dword [ebp - 0x78], 0xc
jmp 0x10028fab
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xfffffffd
jge 0x10028fdf
mov dword [ebp - 0x120], 1
mov dword [ebp - 0x1f8], 0xa4d073ff
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x200], eax
jmp 0x10028fa4
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x10028ffa
push 0x1537
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x1cc], eax
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x68]
mov dword [eax], 3
jmp 0x10029028
mov eax, dword [ebp - 0x68]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x68]
mov dword [ecx], eax
mov eax, dword [ebp - 0x68]
cmp dword [eax], 0
jl 0x1002904c
mov eax, dword [ebp - 0x198]
push dword [eax]
mov ecx, dword [ebp - 0x1cc]
call fcn.10018883
cmp dword [eax], 0
je 0x1002904a
jmp 0x1002904c
jmp 0x1002901d
push 2
lea ecx, [ebp - 0x218]
call fcn.10018816
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0x9c]
call fcn.10018816
mov byte [ebp - 4], 3
mov dword [ebp - 0x19c], 0xfff9
mov dword [ebp - 0x24], 0x4c3f4f88
mov dword [ebp - 0x60], 0xd91f06e8
mov dword [ebp - 0x1c], 0
jmp 0x10029099
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x100290b5
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x218]
call fcn.10018883
mov dword [eax], 1
jmp 0x10029092
mov dword [ebp - 0x1c], 0
jmp 0x100290c5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x100290e1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x9c]
call fcn.10018883
mov dword [eax], 0xa66fe7d8
jmp 0x100290be
push 0
lea ecx, [ebp - 0x9c]
call fcn.10018883
and dword [eax], 0
jmp 0x10029117
push 0
lea ecx, [ebp - 0x9c]
call fcn.10018883
mov dword [ebp - 0xd4], eax
mov eax, dword [ebp - 0xd4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xd4]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x9c]
call fcn.10018883
cmp dword [eax], 1
jg 0x100293c2
mov dword [ebp - 0x44], 0x94d03572
mov dword [ebp - 0x110], 0xffffffff
cmp dword [ebp - 0x44], 0
jne 0x10029150
mov dword [ebp - 0x160], 1
jmp 0x10029157
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x19c]
cmp dword [ebp - 0x160], eax
jl 0x10029171
mov dword [ebp - 0xec], 1
jmp 0x10029178
and dword [ebp - 0xec], 0
cmp dword [ebp - 0x44], 0xec5e
jl 0x1002918d
mov dword [ebp - 0xdc], 1
jmp 0x10029194
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xdc], eax
jg 0x100291ab
mov dword [ebp - 0x128], 1
jmp 0x100291b2
and dword [ebp - 0x128], 0
push 0
lea ecx, [ebp - 0x9c]
call fcn.10018883
mov ecx, dword [ebp - 0x128]
add ecx, dword [eax]
cmp ecx, 8
je 0x100291d8
mov dword [ebp - 0xe4], 1
jmp 0x100291df
and dword [ebp - 0xe4], 0
cmp dword [ebp - 0xe4], 0xffffffff
jg 0x100291f4
mov dword [ebp - 0x148], 1
jmp 0x100291fb
and dword [ebp - 0x148], 0
push 0
lea ecx, [ebp - 0x9c]
call fcn.10018883
mov ecx, dword [ebp - 0x148]
cmp ecx, dword [eax]
jge 0x1002921e
mov dword [ebp - 0x130], 1
jmp 0x10029225
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x130]
je 0x1002924b
cmp dword [ebp - 0x44], 0
je 0x1002924b
mov dword [ebp - 0xf4], 1
jmp 0x10029252
and dword [ebp - 0xf4], 0
push 0
lea ecx, [ebp - 0x9c]
call fcn.10018883
mov ecx, dword [ebp - 0xf4]
sub ecx, dword [eax]
je 0x1002927e
mov eax, 0xdc86695c
test eax, eax
je 0x1002927e
mov dword [ebp - 0x158], 1
jmp 0x10029285
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x60]
cmp dword [ebp - 0x158], eax
jg 0x1002929c
mov dword [ebp - 0x1f4], 1
jmp 0x100292a3
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x284], eax
cmp dword [ebp - 0x44], 0x51ea
jle 0x100292c1
mov dword [ebp - 0x138], 1
jmp 0x100292c8
and dword [ebp - 0x138], 0
push 0
lea ecx, [ebp - 0x9c]
call fcn.10018883
push dword [eax]
lea ecx, [ebp - 0x218]
call fcn.10018883
mov dword [ebp - 0xfc], eax
push 0
lea ecx, [ebp - 0x9c]
call fcn.10018883
push dword [eax]
lea ecx, [ebp - 0x218]
call fcn.10018883
mov ecx, dword [ebp - 0xfc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 0xfc]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x138]
jg 0x10029328
mov dword [ebp - 0x104], 1
jmp 0x1002932f
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x104]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
sub eax, 0x2305aba9
je 0x10029350
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x24], eax
jmp 0x1002939c
mov dword [ebp - 0x60], 0
jmp 0x10029360
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 0x14
jl 0x1002939c
mov dword [ebp - 0x24], 0xffffffe9
jmp 0x10029376
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0xffffffe5
jle 0x1002939a
mov byte [ebp - 0x4f], 0
movzx eax, byte [ebp - 0x4f]
test eax, eax
je 0x10029398
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
jmp 0x1002936f
jmp 0x10029359
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x100293bd
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamA]
jmp 0x100290f3
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x9c]
call fcn.1001887e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x218]
call fcn.1001887e
jmp 0x100299f0
mov dword [ebp - 0x10], 0x948708ef
push 2
lea ecx, [ebp - 0x20c]
call fcn.10018816
mov dword [ebp - 4], 4
mov dword [ebp - 0x1d4], 0
mov dword [ebp - 0x80], 0
jmp 0x1002941a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jge 0x10029436
push dword [ebp - 0x80]
lea ecx, [ebp - 0x20c]
call fcn.10018883
mov dword [eax], 0x38e85a7b
jmp 0x10029413
cmp dword [ebp - 0x10], 0
je 0x10029572
cmp dword [ebp - 0x10], 0x123d
jle 0x10029455
mov dword [ebp - 0xa4], 1
jmp 0x1002945c
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xa4], eax
jle 0x10029473
mov dword [ebp - 0xa8], 1
jmp 0x1002947a
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xa8]
jg 0x10029491
mov dword [ebp - 0xb0], 1
jmp 0x10029498
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xb0], eax
jl 0x100294a7
cmp dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0
je 0x100294b1
cmp dword [ebp - 0x10], 0
push 1
lea ecx, [ebp - 0x20c]
call fcn.10018883
mov dword [eax], 0x1880
cmp dword [ebp - 0x10], 0x1880
jg 0x100294d9
mov dword [ebp - 0xb8], 1
jmp 0x100294e0
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xb8]
add eax, 0xf196
neg eax
cmp eax, dword [ebp - 0x10]
jle 0x100294fe
mov dword [ebp - 0xc0], 1
jmp 0x10029505
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0xc0], 0xe13c
jle 0x1002951d
mov dword [ebp - 0xc8], 1
jmp 0x10029524
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xc8], eax
jl 0x1002953b
mov dword [ebp - 0x1a4], 1
jmp 0x10029542
and dword [ebp - 0x1a4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x23c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x25c], eax
push 1
lea ecx, [ebp - 0x20c]
call fcn.10018883
cmp dword [eax], 0
je 0x10029572
mov dword [ebp - 0xd0], 1
jmp 0x10029579
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xd0], eax
jge 0x10029590
mov dword [ebp - 0xd8], 1
jmp 0x10029597
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xd8], eax
jg 0x100295b4
cmp dword [ebp - 0x10], 0
je 0x100295b4
mov dword [ebp - 0xe0], 1
jmp 0x100295bb
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xe0]
sub eax, dword [ebp - 0x10]
add eax, 0x339b8842
mov dword [ebp - 0x1d4], eax
mov byte [ebp - 0x4e], 0
movzx eax, byte [ebp - 0x4e]
test eax, eax
je 0x100295f2
push 0x371
push 0x24c6
push 0x158f
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20c]
call fcn.1001887e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x4c], 0x462d5e48
mov dword [ebp - 0x1ec], 0x83c8fc55
mov dword [ebp - 0x100], 0xffffffff
mov dword [ebp - 0x7c], 0x5e3edfa8
mov dword [ebp - 0x11c], 0xffffffff
mov dword [ebp - 0x1dc], 0x224
mov dword [ebp - 0x6c], 0
jmp 0x10029662
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x10029675
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x5c], 0x4990069f
jmp 0x1002965b
mov dword [ebp - 0x4c], 0xd
jmp 0x10029685
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xc
jl 0x100296ed
mov dword [ebp - 0x244], 0x5b40194d
push 4
lea ecx, [ebp - 0x290]
call fcn.10018816
mov dword [ebp - 4], 5
mov dword [ebp - 0x74], 0
jmp 0x100296b9
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x100296d5
push dword [ebp - 0x74]
lea ecx, [ebp - 0x290]
call fcn.10018883
mov dword [eax], 0x822e6e7f
jmp 0x100296b2
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x290]
call fcn.1001887e
jmp 0x1002967e
cmp dword [ebp - 0x7c], 0
jne 0x10029709
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x5c], 0
jne 0x10029709
and dword [ebp - 0x1ac], 0
jmp 0x10029713
mov dword [ebp - 0x1ac], 1
mov eax, dword [ebp - 0x100]
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x7c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x5c]
cmp eax, dword [ebp - 0x4c]
jne 0x1002973d
mov dword [ebp - 0xe8], 1
jmp 0x10029744
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0xe8]
sub eax, 4
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x11c]
cmp dword [ebp - 0x4c], eax
jg 0x10029767
mov dword [ebp - 0xa0], 1
jmp 0x1002976e
and dword [ebp - 0xa0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
cmp eax, dword [ebp - 0xa0]
jle 0x1002978c
mov dword [ebp - 0xf8], 1
jmp 0x10029793
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0xf8]
je 0x100297b6
mov eax, 0xb16e2c9b
test eax, eax
je 0x100297b6
mov dword [ebp - 0x108], 1
jmp 0x100297bd
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x108]
jle 0x100297d7
mov dword [ebp - 0x1b4], 1
jmp 0x100297de
and dword [ebp - 0x1b4], 0
mov eax, dword [ebp - 0x11c]
mov dword [ebp - 0x24c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x5c]
mov dword [ebp - 0x264], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1dc]
mov dword [ebp + eax - 0x5c], ecx
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x1bc]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1e4]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1a0]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x1a8]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp - 0x64]
mov dword [eax], 2
jmp 0x100298aa
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x64]
mov dword [ecx], eax
mov eax, dword [ebp - 0x64]
cmp dword [eax], 0
jl 0x100299f0
mov dword [ebp - 0x1b8], 0xffffffff
mov dword [ebp - 0x12c], 0xfffffffb
mov dword [ebp - 0x15c], 0xa65d3384
mov eax, dword [ebp - 0x1b0]
mov eax, dword [eax]
mov dword [ebp - 0x228], eax
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
dec eax
cmp eax, dword [ebp - 0x1b8]
jne 0x100298ff
mov dword [ebp - 0x124], 1
jmp 0x10029906
and dword [ebp - 0x124], 0
imul eax, dword [ebp - 0x124], 0xffff
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 4
je 0x1002992b
mov dword [ebp - 0x134], 1
jmp 0x10029932
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x1c0]
mov eax, dword [eax]
sub eax, dword [ebp - 0x134]
mov dword [ebp - 0x13c], eax
mov eax, dword [ebp - 0x64]
push dword [eax]
mov ecx, dword [ebp - 0x1c8]
call fcn.10018883
mov ecx, dword [ebp - 0x13c]
mov dword [eax], ecx
cmp dword [ebp - 0x13c], 0x278a4911
je 0x10029976
mov dword [ebp - 0x144], 1
jmp 0x1002997d
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x1d0]
mov eax, dword [eax]
cmp dword [ebp - 0x144], eax
je 0x10029999
mov dword [ebp - 0x154], 1
jmp 0x100299a0
and dword [ebp - 0x154], 0
mov eax, dword [ebp - 0x14c]
mov eax, dword [eax]
cmp dword [ebp - 0x154], eax
jge 0x100299bc
mov dword [ebp - 0x90], 1
jmp 0x100299c3
and dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x1d8]
mov ecx, dword [ebp - 0x90]
mov dword [eax], ecx
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x1e0]
mov ecx, dword [ebp - 0x15c]
mov dword [eax], ecx
jmp 0x1002989f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret