Function at 0x1020f669
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov edx, dword [ebp + 0x10]
sub esp, 0xc
cmp byte [0x1029ab54], 0
push ebx
mov bl, byte [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
jne 0x1020f48b
cmp bl, 0xf4
je 0x1020f48b
mov al, byte [edi]
cmp al, 0xc1
je 0x1020f472
cmp al, 0xc3
je 0x1020f472
cmp al, 0xc2
je 0x1020f46e
cmp al, 0xc4
je 0x1020f46e
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, 4
jmp 0x1020f474
mov al, 3
movzx ecx, al
cmp ecx, edx
jae 0x1020f48b
nop dword [eax + eax]
sub byte [ecx + edi], bl
lea eax, [ecx + edi]
inc ecx
cmp ecx, edx
jb 0x1020f480
push edx
mov edx, edi
mov cl, bl
call fcn.1020eda0
movzx ebx, bl
add esp, 4
lea eax, [ebx - 0x14]
cmp eax, 0xe6
ja case.0x1020f4b0.21
movzx eax, byte [eax + 0x1020fa9c]
jmp dword [eax*4 + 0x1020fa5c]
cmp byte [edi], 0xc1
jne 0x1020f4c1
mov al, byte [edi + 3]
jmp 0x1020f4c4
mov al, byte [edi + 4]
cmp al, 3
jne case.0x1020f4b0.21
movzx esi, word [edi + 0x14]
lea eax, [edi + 4]
push eax
xorps xmm0, xmm0
push 0x1029058c
push 0x10299f88
movups xmmword [0x10299f88], xmm0
call fcn.100093d0
add esp, 0xc
mov word [0x10299f84], si
jmp case.0x1020f4b0.21
push edi
call fcn.1000ad10
jmp case.0x1020f4b0.21
cmp byte [edi], 0xc1
jne 0x1020f511
mov al, byte [edi + 3]
jmp 0x1020f514
mov al, byte [edi + 4]
movzx eax, al
add eax, 0xffffffec
cmp eax, 0xc
ja case.0x1020f4b0.21
movzx eax, byte [eax + 0x1020fb98]
jmp dword [eax*4 + 0x1020fb84]
movzx eax, byte [edi + 8]
sub esp, 8
push eax
call fcn.10009660
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [edi + 8]
movzx eax, byte [edi + 4]
push eax
call fcn.10009b00
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [edi + 4]
push eax
call fcn.100098c0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.1020fe20
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x10295d89], 0
je case.0x1020f4b0.21
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 4]
shl ecx, 9
add ecx, eax
movzx eax, cx
cmp eax, dword [0x10299f54]
je case.0x1020f4b0.21
mov al, byte [edi + 5]
cmp al, 3
je case.0x1020f853.180
cmp al, 0x11
jne case.0x1020f4b0.21
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 4]
shl ecx, 8
or ecx, eax
and ecx, 0x7fff
cmp dword [0x10299f54], ecx
jne case.0x1020f4b0.21
mov dword [0x10299f50], 0
jmp case.0x1020f4b0.21
cmp byte [edi], 0xc1
jne 0x1020f608
mov al, byte [edi + 3]
jmp 0x1020f60b
mov al, byte [edi + 4]
movzx eax, al
sub eax, 0
je 0x1020f62b
sub eax, 1
jne case.0x1020f4b0.21
movzx eax, byte [edi + 4]
push eax
call fcn.10210db0
jmp case.0x1020f4b0.21
mov ecx, edi
call fcn.1020fd00
jmp case.0x1020f4b0.21
cmp byte [edi], 0xc1
jne 0x1020f641
mov al, byte [edi + 3]
jmp 0x1020f644
mov al, byte [edi + 4]
cmp al, 0x51
jne case.0x1020f4b0.21
cmp dword [0x1029ab4c], 0
jne case.0x1020f4b0.21
cmp byte [edi + 0xc], 0
sete byte [0x1029ab38]
jmp case.0x1020f4b0.21
cmp byte [edi], 0xc1
jne 0x1020f673
mov al, byte [edi + 3]
jmp 0x1020f676
mov al, byte [edi + 4]
movzx eax, al
sub eax, 0
je 0x1020f6c0
sub eax, 1
je 0x1020f6b1
sub eax, 1
jne case.0x1020f4b0.21
cmp byte [edi + 4], al
jne 0x1020f698
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov dword [0x1029ab50], 2
mov dword [0x1029ab4c], 0
jmp case.0x1020f4b0.21
movzx eax, byte [edi + 4]
push eax
call fcn.10210e20
jmp case.0x1020f4b0.21
mov ecx, edi
call fcn.1020fd50
jmp case.0x1020f4b0.21
mov eax, dword [edi + 3]
lea ecx, [esp + 0x10]
mov edx, 8
mov dword [esp + 0x10], 0x1fa08c1
mov dword [esp + 0x14], eax
call fcn.1020ff00
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi], 0xc1
jne 0x1020f6ff
mov al, byte [edi + 3]
jmp 0x1020f702
mov al, byte [edi + 4]
movzx eax, al
add eax, 0xfffffff4
cmp eax, 0xc
ja case.0x1020f4b0.21
movzx eax, byte [eax + 0x1020fbbc]
jmp dword [eax*4 + 0x1020fba8]
push edi
call fcn.10002ee0
jmp case.0x1020f4b0.21
push edi
call fcn.10003020
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.10003380
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.10003bb0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 4]
shl ecx, 8
or ecx, eax
and ecx, 0x7fff
cmp dword [0x10299f54], ecx
jne case.0x1020f4b0.21
mov eax, dword [edi + 0xd]
mov dword [0x10299f50], eax
mov eax, dword [edi + 0x11]
mov dword [0x10299f4c], eax
jmp case.0x1020f4b0.21
movzx ecx, byte [edi + 3]
movzx eax, byte [edi + 4]
shl ecx, 8
or ecx, eax
and ecx, 0x7fff
cmp dword [0x10299f54], ecx
jne case.0x1020f4b0.21
mov eax, dword [edi + 0x11]
mov dword [0x10299f50], eax
mov eax, dword [edi + 0x15]
mov dword [0x10299f4c], eax
jmp case.0x1020f4b0.21
mov al, byte [edi + 3]
cmp al, 0xfe
jne 0x1020f7da
mov eax, dword [edi + 9]
mov dword [0x10299f40], eax
mov eax, dword [edi + 0xd]
mov dword [0x10299f3c], eax
jmp case.0x1020f4b0.21
cmp al, 0xff
jne case.0x1020f4b0.21
mov eax, dword [edi + 9]
mov dword [0x10299f50], eax
mov eax, dword [edi + 0xd]
mov dword [0x10299f4c], eax
jmp case.0x1020f4b0.21
mov al, byte [edi + 3]
cmp al, 0xfe
jne 0x1020f809
mov eax, dword [edi + 8]
mov dword [0x10299f38], eax
mov eax, dword [edi + 0xc]
mov dword [0x10297f34], eax
jmp case.0x1020f4b0.21
cmp al, 0xff
jne case.0x1020f4b0.21
mov eax, dword [edi + 8]
mov dword [0x10299f48], eax
mov eax, dword [edi + 0xc]
mov dword [0x10299f44], eax
push 1
push dword [ebp + 0x10]
mov eax, 0xd5758d
push edi
push ebx
call eax
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi], 0xc1
jne 0x1020f83f
mov al, byte [edi + 3]
jmp 0x1020f842
mov al, byte [edi + 4]
movzx eax, al
cmp eax, 0xe2
ja case.0x1020f4b0.21
movzx eax, byte [eax + 0x1020fc18]
jmp dword [eax*4 + 0x1020fbcc]
call fcn.10210eb0
cmp dword [0x1029ab50], 1
jne case.0x1020f4b0.21
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.1020fd90
jmp 0x1020f85f
mov eax, dword [edi + 0x20]
mov dword [0x10299f50], eax
mov eax, dword [edi + 0x24]
mov dword [0x10299f48], eax
mov eax, dword [edi + 0x2c]
mov dword [0x10299f4c], eax
mov eax, dword [edi + 0x28]
jmp 0x1020f818
mov eax, dword [edi + 0x18]
mov dword [0x10299f40], eax
mov eax, dword [edi + 0x1c]
mov dword [0x10299f38], eax
mov eax, dword [edi + 0x24]
mov dword [0x10299f3c], eax
mov eax, dword [edi + 0x20]
mov dword [0x10297f34], eax
mov ax, word [edi + 4]
mov word [0x10299f77], ax
jmp case.0x1020f4b0.21
mov eax, dword [edi + 0x20]
mov dword [0x10299f40], eax
mov eax, dword [edi + 0x24]
mov dword [0x10299f38], eax
mov eax, dword [edi + 0x2c]
mov dword [0x10299f3c], eax
mov eax, dword [edi + 0x28]
mov dword [0x10297f34], eax
jmp case.0x1020f4b0.21
mov eax, dword [edi + 0x14]
mov dword [0x10299f40], eax
mov eax, dword [edi + 0x18]
mov dword [0x10299f38], eax
mov eax, dword [edi + 0x20]
mov dword [0x10299f3c], eax
mov eax, dword [edi + 0x1c]
mov dword [0x10297f34], eax
mov ax, word [edi + 4]
mov word [0x10299f79], ax
jmp case.0x1020f4b0.21
push edi
call fcn.10002d20
jmp case.0x1020f4b0.21
push 0x10290704
lea eax, [edi + 5]
push eax
movzx eax, byte [edi + 4]
push eax
call fcn.10210610
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
call fcn.1000adf0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi + 4]
mov dword [0x1029a098], eax
mov eax, dword [edi + 8]
mov dword [0x1029a09c], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.10010020
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [edi + 4]
push eax
lea eax, [edi + 0x69]
push eax
lea eax, [edi + 5]
push eax
call fcn.102105e0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edi + 4], 1
sete byte [0x10299fc4]
mov eax, dword [edi + 5]
mov dword [0x10299fc8], eax
cmp byte [edi + 9], 1
sete byte [0x10299fcc]
mov eax, dword [edi + 0xa]
mov dword [0x10299fd0], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movups xmm0, xmmword [edi]
mov ecx, 0x10297d3d
movups xmmword [0x10299f68], xmm0
mov eax, dword [edi + 0x10]
mov dword [0x10299f78], eax
mov ax, word [edi + 0x14]
mov word [0x10299f7c], ax
mov al, byte [edi + 0x16]
mov byte [0x10299f7e], al
mov al, 1
xchg byte [ecx], al
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edi]
mov dword [0x10299f60], eax
mov eax, dword [edi + 4]
mov dword [0x10299f64], eax
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.102102c0
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, edi
call fcn.10210550
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret