Function at 0x1002dc59
Capabilities:
Check os version
Connect pipe
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10084688
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1b0
push ebx
push esi
push edi
mov edi, edx
mov dword [esp + 0x50], ecx
mov edx, 0xffff
mov dword [esp + 0x38], edi
mov dword [esp + 0x30], edx
or esi, 0xffffffff
mov dword [esp + 0x1c], 0x462ccd20
xor ebx, ebx
mov dword [esp + 0x24], esi
xor ecx, ecx
mov dword [esp + 0x14], 0x2e71
inc ecx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], ebx
jmp 0x1002dcc6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x48], 0xa90ef874
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1002dcb6
mov dword [esp + 0x10], ebx
jmp 0x1002dce5
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x8c], 0x1a0197cb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1002dcd2
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x30], ebx
je 0x1002dd22
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x1c]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
cmp dword [esp + 0x24], edx
jne 0x1002dd3a
cmp dword [esp + 0x48], ebx
je 0x1002dd42
mov eax, ecx
cmp dword [esp + 0x48], ebx
jne 0x1002dd44
mov eax, ebx
add eax, 0x3da550e8
cmp eax, dword [esp + 0x1c]
jle 0x1002dd57
mov eax, ecx
cmp dword [esp + 0x30], ebx
jne 0x1002dd59
mov eax, ebx
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], ecx
mov dword [esp + 0x94], ecx
mov dword [esp + 0x98], ecx
mov dword [esp + 0x9c], ecx
lea ecx, [esp + 0x160]
mov dword [esp + 0x30], esi
push 2
call fcn.10025495
mov dword [esp + 0x1c4], ebx
mov dword [esp + 0x14], 0x7a7c2039
mov dword [esp + 0x2c], 0xc75d
mov dword [esp + 0x2c], 0xf997ec53
mov dword [esp + 0x1c], ebx
jmp 0x1002ddc9
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x160]
mov dword [eax + ecx*4], 0x862fd41e
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1002ddb3
mov dword [esp + 0x14], 1
cmp dword [esp + 0x14], ebx
jl 0x1002dece
push 4
lea ecx, [esp + 0x11c]
call fcn.10025495
mov byte [esp + 0x1c4], 1
lea eax, [esp + 0x184]
push dword [esp + 0x50]
movdqa xmm0, xmmword [0x10007a90]
lea ecx, [esp + 0xa4]
push eax
lea eax, [esp + 0x17c]
mov dword [esp + 0xa8], ebx
push eax
push ebx
movdqu xmmword [esp + 0x184], xmm0
mov dword [esp + 0xb4], ebx
mov dword [esp + 0xb8], ebx
call fcn.1002671b
mov dword [esp + 0x1c], ebx
jmp 0x1002de57
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x118]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1002de45
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x1002de78
push ebx
push ebx
push 0xe68
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x1002dea5
push 0x157f
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
lea ecx, [esp + 0xa0]
call fcn.1002554b
lea ecx, [esp + 0x118]
mov byte [esp + 0x1c4], bl
call fcn.1002554b
dec dword [esp + 0x14]
jns 0x1002dde2
lea ecx, [esp + 0x160]
mov dword [esp + 0x1c4], esi
call fcn.1002554b
mov dword [esp + 0x1c], 0xbda73a15
mov eax, 0x7eede0b4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x108], eax
mov dword [esp + 0x10c], eax
mov dword [esp + 0x110], eax
mov dword [esp + 0x114], eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x18], ebx
jmp 0x1002df44
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], ebx
jmp 0x1002df39
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x108], 0x8d3c891c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x1002df26
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 3
jge 0x1002df1c
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0xcc]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], 8
mov dword [esp + 0x2c], esi
mov dword [esp + 0x24], 0xfffffff7
mov dword [esp + 0x30], 0xd1454bcd
mov dword [esp + 0x18], 7
push 3
call fcn.10025495
push 3
pop edx
mov dword [esp + 0x1c4], edx
mov dword [esp + 0x24], 0x50b7f45
mov dword [esp + 0x1c], edx
mov dword [esp + 0x10], ebx
jmp 0x1002dfb9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x40], 0x68ec0ae9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1002dfa9
mov dword [esp + 0x10], ebx
jmp 0x1002dfdc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 0xafa01777
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1002dfc6
mov dword [esp + 0x40], ebx
cmp dword [esp + 0x40], 0xffffffeb
jge 0x1002e145
jmp 0x1002dff6
push 3
pop edx
mov dword [esp + 0x14], 0x6cce57bf
lea ecx, [esp + 0x154]
mov dword [esp + 0x2c], esi
mov dword [esp + 0x20], 0x1b9849b7
mov dword [esp + 0x2c], 0xab3cf813
mov dword [esp + 0x2c], 0xec352115
mov dword [esp + 0x2c], esi
push edx
call fcn.10025495
mov byte [esp + 0x1c4], 4
mov dword [esp + 0x2c], 9
mov dword [esp + 0x1c], ebx
jmp 0x1002e057
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x154]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1002e041
mov dword [esp + 0x14], 0xfffffffe
jmp 0x1002e100
mov dword [esp + 0x2c], 9
lea ecx, [esp + 0x130]
mov dword [esp + 0x2c], 0x76b87d0f
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x2c], 0x61ece30
mov dword [esp + 0x2c], esi
mov dword [esp + 0x2c], 0x7d393e75
mov dword [esp + 0x2c], 0x80eec299
mov dword [esp + 0x2c], 0x3d5943e2
mov dword [esp + 0x2c], 0xfffffffe
mov dword [esp + 0x2c], 0x7c869b7d
mov dword [esp + 0x2c], 0x9a275ff4
push 1
call fcn.10025495
mov dword [esp + 0x1c], ebx
jmp 0x1002e0e5
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 1
jl 0x1002e0cf
inc dword [esp + 0x24]
lea ecx, [esp + 0x130]
call fcn.1002554b
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jge 0x1002e06b
cmp dword [esp + 0x18], ebx
je 0x1002e11c
cmp dword [esp + 0x20], ebx
je 0x1002e11c
xor eax, eax
inc eax
jmp 0x1002e11e
mov eax, ebx
mov dword [esp + 0x1c], eax
lea ecx, [esp + 0x154]
mov byte [esp + 0x1c4], 3
call fcn.1002554b
dec dword [esp + 0x40]
cmp dword [esp + 0x40], 0xffffffeb
jl 0x1002dff3
cmp dword [esp + 0x1c], ebx
jne 0x1002e155
cmp dword [esp + 0x40], ebx
jne 0x1002e155
mov esi, ebx
jmp 0x1002e158
xor esi, esi
inc esi
mov ecx, dword [esp + 0xcc]
xor edx, edx
mov eax, dword [esp + 0x30]
cmp eax, dword [ecx + 8]
mov eax, dword [esp + 0x44]
setle dl
xor ecx, ecx
cmp eax, 7
mov eax, dword [esp + 0x40]
setle cl
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, esi
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xcc]
mov eax, dword [esp + 0x24]
inc eax
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x44], eax
or dword [esp + 0x1c4], 0xffffffff
call fcn.1002554b
mov dword [esp + 0x30], ebx
cmp dword [esp + 0x30], 3
jg 0x1002e522
mov edi, 0xffff
mov dword [esp + 0x14], 0x9dada439
mov dword [esp + 0x1c], ebx
jmp 0x1002e1e7
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x184], ebx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 3
jl 0x1002e1d8
mov dword [esp + 0x14], ebx
jmp 0x1002e21c
mov eax, dword [esp + 0x14]
cmp dword [esp + eax*4 + 0x184], ebx
jne 0x1002e223
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x1002e218
push 0x10d9
push ebx
call dword [sym.imp.USER32.dll_CharUpperBuffW]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x1002e1f4
mov dword [esp + 0x24], ebx
lea ecx, [esp + 0x6c]
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], 0x2e0cf572
push 3
call fcn.10025495
mov dword [esp + 0x14], ebx
push 3
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x20], ebx
pop esi
jmp 0x1002e26a
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x6c]
mov dword [eax + ecx*4], 0x2bb11acc
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1002e257
cmp dword [esp + 0x10], ebx
je 0x1002e294
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x1002e357
push 7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
jmp 0x1002e357
mov dword [esp + 0x10], ebx
jmp 0x1002e34c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0x1de9829c
mov dword [esp + 0x18], ebx
jmp 0x1002e33d
mov dword [esp + 0x24], 0x153413f0
mov eax, dword [esp + 0x18]
neg eax
sbb eax, eax
neg eax
imul ecx, eax, 0xa00d
mov eax, dword [esp + 0x6c]
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
inc ecx
cmp ecx, 0x52487223
jge 0x1002e2e7
cmp dword [esp + 0x18], ebx
jne 0x1002e2e7
mov ecx, ebx
jmp 0x1002e2ea
xor ecx, ecx
inc ecx
mov eax, dword [esp + 0x24]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
setl cl
cmp edi, ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setne dl
sub edx, edi
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x1b07
setl al
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0x24], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 2
jle 0x1002e2b2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 8
jne 0x1002e29d
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x24]
sub eax, 0xbe734e2e
neg eax
sbb eax, eax
add eax, 0x61949f0e
sub ecx, eax
mov eax, dword [esp + 0x6c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp dword [eax + 4], ecx
mov eax, dword [esp + 0x14]
setge dl
mov dword [esp + 0x24], edx
xor edx, edx
cmp eax, dword [esp + 0x24]
mov eax, dword [esp + 0x6c]
setne dl
xor ecx, ecx
cmp edx, dword [eax + 8]
setge cl
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x6c]
call fcn.1002554b
mov byte [esp + 0x3e], bl
lea ecx, [esp + 0x13c]
mov dword [esp + 0x1c], 0xb9f9b319
mov dword [esp + 0x2c], 0xf506e60b
push esi
call fcn.10025495
mov dword [esp + 0x1c], ebx
jmp 0x1002e3ec
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x13c]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1002e3d9
mov dword [esp + 0x1c], ebx
jmp 0x1002e40c
mov dword [esp + 0x24], 0x4d00693e
inc dword [esp + 0x24]
mov eax, dword [esp + 0x24]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffffc
je 0x1002e3f8
lea ecx, [esp + 0x13c]
call fcn.1002554b
push 0x6527
lea eax, [esp + 0x42]
push eax
push ebx
call fcn.100316d5
add esp, 0xc
cmp dword [esp + 0x30], ebx
je 0x1002e452
mov ecx, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x30]
cmp eax, ecx
setle dl
cmp edx, dword [esp + 0x20]
jl 0x1002e452
xor eax, eax
inc eax
jmp 0x1002e454
mov eax, ebx
xor ecx, ecx
test eax, eax
sete cl
sub ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
neg ecx
mov dword [esp + 0x24], 1
mov esi, dword [esp + 0x24]
sbb ecx, ecx
xor edx, edx
mov dword [esp + 0x90], esi
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x30]
setge dl
mov dword [esp + 0x1c], edx
xor edx, edx
cmp dword [esp + 0x1c], eax
setle dl
xor ecx, ecx
imul edx, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
cmp edx, eax
mov eax, dword [esp + 0x20]
setle cl
xor edx, edx
cmp eax, ecx
setl dl
xor eax, eax
sub edx, dword [esp + 0x30]
cmp esi, edx
setne al
imul eax, dword [esp + 0x30]
test eax, eax
je 0x1002e4d0
cmp dword [esp + 0x98], ebx
je 0x1002e4d0
xor ecx, ecx
inc ecx
jmp 0x1002e4d2
mov ecx, ebx
mov eax, dword [esp + 0x20]
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x20]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [esp + 0x20], ecx
cmp dword [esp + 0x20], ebx
jne 0x1002e4f6
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov eax, dword [esp + 0x98]
cmp eax, 0xc0e4
setl cl
mov dword [esp + 0x1c], ecx
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 3
jle 0x1002e1ca
mov edi, dword [esp + 0x38]
mov dword [esp + 0x30], 9
lea ecx, [esp + 0x60]
mov dword [esp + 0x1c], 0x72c34ccb
mov dword [esp + 0x24], 0x6f444694
mov dword [esp + 0x18], 0xd945ad33
push 2
call fcn.10025495
push 3
mov dword [esp + 0x1c8], 5
lea ecx, [esp + 0x14c]
pop esi
mov dword [esp + 0x20], 0xba70a1ee
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], 0x82ea9177
push esi
call fcn.10025495
mov dword [esp + 0x10], ebx
jmp 0x1002e599
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x60]
mov dword [eax + ecx*4], 0xd790
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1002e586
mov dword [esp + 0x10], ebx
jmp 0x1002e5bc
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1002e5a6
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov eax, dword [esp + 0x30]
sub eax, 0xffff
cmp eax, 0xe3d0
setl cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x1c], ebx
je 0x1002e5e7
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x24], 0x3713
mov edx, dword [esp + 0x24]
sub edx, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
mov dword [esp + 0x18], ecx
cmp dword [esp + 0x18], ebx
mov ecx, dword [esp + 0x60]
jne 0x1002e620
cmp dword [ecx], ebx
jne 0x1002e620
xor edx, edx
mov eax, ebx
inc edx
jmp 0x1002e625
xor edx, edx
inc edx
mov eax, edx
sub eax, dword [ecx]
push 0
pop eax
setns al
mov dword [esp + 0x20], eax
cmp dword [esp + 0x20], ebx
je 0x1002e63b
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
xor ecx, ecx
mov dword [esp + 0x18], edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
cmp dword [eax], 0xe7680dd3
sete cl
sub ecx, dword [eax]
je 0x1002e6e3
mov dword [esp + 0x24], 0x856065d6
mov dword [esp + 0x1c], 0x48ec
mov dword [esp + 0x14], ebx
jmp 0x1002e6d7
mov dword [esp + 0x38], 0xe47cee57
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], 0x13
jmp 0x1002e6cc
mov dword [esp + 0x20], ebx
jmp 0x1002e6bc
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x1c], edx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jle 0x1002e6ac
cmp dword [esp + 0x24], ebx
jne 0x1002e6d3
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x1c
jl 0x1002e6a6
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x17
je 0x1002e690
jmp 0x1002e783
mov dword [esp + 0x24], 0xfffffff9
mov dword [esp + 0x10], ebx
jmp 0x1002e704
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xfc], 6
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1002e6f1
mov dword [esp + 0x10], ebx
jmp 0x1002e723
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x16c], 4
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1002e710
mov eax, dword [esp + 0x60]
cmp dword [eax], ebx
jne 0x1002e736
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0x100]
mov eax, 0xffff
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x16c]
mov eax, dword [esp + 0x100]
cmp eax, ecx
mov eax, dword [esp + 0x100]
setl dl
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
neg eax
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x148]
call fcn.1002554b
or dword [esp + 0x1c4], 0xffffffff
lea ecx, [esp + 0x60]
call fcn.1002554b
mov dword [esp + 0x30], 0xffffffe4
jmp 0x1002ef2f
mov dword [esp + 0x1c], ebx
cmp dword [esp + 0x1c], 0xffffffed
jg 0x1002ef2b
mov dword [esp + 0x24], 8
mov dword [esp + 0x10], ebx
jmp 0x1002e7da
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x54], 0xe1757117
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1002e7ca
mov dword [esp + 0x10], ebx
jmp 0x1002e7f7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x4c], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x1002e7e7
mov dword [esp + 0x54], 3
jmp 0x1002ea43
push 3
lea ecx, [esp + 0xf4]
call fcn.10025495
mov dword [esp + 0x1c4], 6
lea ecx, [esp + 0xac]
mov dword [esp + 0x78], 0xffffffff
mov dword [esp + 0x7c], 0xffffffff
push 3
mov dword [esp + 0x84], 0xffffffff
pop esi
mov dword [esp + 0x84], 0xffffffff
mov dword [esp + 0x24], 0x44871830
mov dword [esp + 0x14], 7
push esi
call fcn.10025495
push esi
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1002e885
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf0]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1002e872
mov dword [esp + 0x10], ebx
jmp 0x1002e8a7
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xac]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1002e891
mov esi, dword [esp + 0xf0]
mov dword [esi + 4], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], 0xf3c88fed
cmp dword [esp + 0x20], ebx
je 0x1002e8d8
mov eax, dword [esi + 4]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x54]
mov eax, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x4c]
cmp dword [esi + 4], 0xa4ab
mov eax, dword [esp + 0x84]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x84]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x18]
setg cl
mov dword [esp + 0x38], ecx
xor ecx, ecx
cmp dword [esp + 0x38], eax
mov eax, dword [esp + 0x18]
setg cl
xor edx, edx
cmp ecx, eax
setl dl
xor ecx, ecx
xor eax, eax
neg edx
inc ecx
cmp edx, ecx
setg al
sub eax, 0xd476
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x18]
jl 0x1002e9f1
mov dword [esp + 0x38], 0x93911e74
xor edx, edx
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x58]
mov dword [esp + 0x24], 0x4f39
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xac]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x18]
cmp eax, 1
mov eax, dword [esp + 0x84]
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, dword [esi + 4]
setge al
xor ecx, ecx
cmp eax, 0xad46d232
mov eax, dword [esp + 0x78]
setne cl
imul eax, ecx
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 2
cmp dword [esp + 0x14], ebx
jl 0x1002ea12
mov ecx, dword [esi + 4]
mov eax, dword [esp + 0xac]
mov eax, dword [eax + ecx*4 + 4]
mov dword [esp + 0x20], eax
dec dword [esp + 0x14]
jns 0x1002e9d7
jmp 0x1002ea12
mov dword [esp + 0x38], ecx
mov ecx, dword [esp + 0x38]
mov eax, dword [esi + 4]
mov dword [esp + eax*4 + 0x4c], ecx
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x1002ea12
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc dword [esi + 4]
cmp dword [esi + 4], 0
jle 0x1002e8b7
lea ecx, [esp + 0xac]
call fcn.1002554b
or dword [esp + 0x1c4], 0xffffffff
lea ecx, [esp + 0xf0]
call fcn.1002554b
inc dword [esp + 0x54]
cmp dword [esp + 0x54], 9
jg 0x1002e80b
mov dword [esp + 0x24], 3
cmp dword [esp + 0x24], ebx
jl 0x1002ef19
mov dword [esp + 0x20], 0x25b9b55b
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x20], 0xffffffe8
jmp 0x1002eb0f
mov dword [esp + 0x18], 1
mov dword [esp + 0x14], 0x1ae9a07b
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x1002eaab
push 0xfb8
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x20], 0x3a33bd5c
jg 0x1002eadb
cmp dword [esp + 0x14], ebx
jne 0x1002eadb
mov edx, ebx
jmp 0x1002eade
xor edx, edx
inc edx
xor ecx, ecx
mov dword [esp + 0x18], 1
mov eax, dword [esp + 0x14]
cmp edx, eax
mov eax, dword [esp + 0x18]
sete cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esp + 0x20]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x14], ecx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 6
jg 0x1002ea85
mov dword [esp + 0x2c], 0xb2c2
mov dword [esp + 0x2c], 0xda2282d5
push 4
pop ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x2c], 5
mov dword [esp + 0x2c], 0x2c5d177c
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], ebx
jmp 0x1002eb5e
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x1a8], 0x2236432a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], ecx
jl 0x1002eb4b
mov dword [esp + 0x10], ebx
jmp 0x1002eb7d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x190], 1
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1002eb6a
dec dword [esp + 0x14]
lea ecx, [esp + 0x124]
mov byte [esp + 0x37], bl
mov dword [esp + 0x20], 9
mov dword [esp + 0x2c], 0xbd085c9e
mov dword [esp + 0x2c], ebx
push 3
call fcn.10025495
mov dword [esp + 0x1c4], 7
xor edx, edx
mov dword [esp + 0x18], 0x4ccfd66c
inc edx
mov dword [esp + 0x10], ebx
jmp 0x1002ebd9
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x88], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1002ebca
push 3
mov dword [esp + 0x14], ebx
pop esi
jmp 0x1002ebfa
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x124]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1002ebe8
mov dword [esp + 0x20], ebx
jmp 0x1002ecf7
mov dword [esp + 0x2c], 0x703d
lea ecx, [esp + 0xb8]
push 2
call fcn.10025495
mov dword [esp + 0x38], 0xdac0faab
mov dword [esp + 0x10], 0x8595
mov dword [esp + 0x2c], 0x4f63abef
mov dword [esp + 0x14], ebx
jmp 0x1002ec4f
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xb8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1002ec3d
cmp dword [esp + 0x38], ebx
jne 0x1002ec9d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [esp + 0xb8]
setle cl
cmp dword [eax + 4], ecx
jg 0x1002ec87
cmp dword [esp + 0x20], ebx
je 0x1002ec87
xor edx, edx
inc edx
jmp 0x1002ec89
mov edx, ebx
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 4
jb 0x1002ec9d
mov edx, ebx
jmp 0x1002eca0
xor edx, edx
inc edx
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + eax*4 + 0x88]
mov eax, dword [esp + 0x20]
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
inc dword [esp + 0x18]
cmp eax, edx
jne 0x1002ecc9
xor edx, edx
inc edx
jmp 0x1002eccb
mov edx, ebx
mov ecx, dword [esp + 0xb8]
xor eax, eax
cmp edx, dword [ecx + 4]
setge al
sub eax, 0x4432
neg eax
sbb eax, eax
inc eax
mov dword [ecx + 4], eax
lea ecx, [esp + 0xb8]
call fcn.1002554b
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1002ec09
mov byte [esp + 0x2b], bl
cmp byte [esp + 0x2b], 0
je 0x1002ed1a
push ebx
push ebx
push 0x3c4
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
or dword [esp + 0x1c4], 0xffffffff
lea ecx, [esp + 0x124]
call fcn.1002554b
cmp byte [esp + 0x37], 0
je 0x1002ee66
mov dword [esp + 0x10], 0x6de713a4
mov dword [esp + 0x18], 5
mov dword [esp + 0x14], ebx
jmp 0x1002ed5e
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x19c], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1002ed4f
cmp dword [esp + 0x10], ebx
je 0x1002eda7
mov eax, dword [esp + 0x10]
xor edx, edx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esp + 0x10]
setne cl
mov dword [esp + 0x2c], ecx
xor ecx, ecx
cmp dword [esp + 0x2c], eax
setge cl
or eax, 0xffffffff
sub eax, ecx
add eax, dword [esp + 0x10]
jne 0x1002eda7
inc eax
jmp 0x1002eda9
mov eax, ebx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x18], ebx
je 0x1002edc4
mov dword [esp + 0x14], 0xc7747bb7
dec dword [esp + 0x14]
jmp 0x1002ee5a
mov dword [esp + 0x2c], 0xfffffffc
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x18], 0xffffffe9
jmp 0x1002ee37
mov dword [esp + 0x20], 0xde661fbc
cmp dword [esp + 0x20], ebx
jne 0x1002ee3d
mov dword [esp + 0x20], ebx
jmp 0x1002ee2c
mov dword [esp + 0x2c], 0x9eb818f8
cmp dword [esp + 0x18], ebx
jne 0x1002ee20
mov eax, dword [esp + 0x20]
xor edx, edx
cmp eax, 7
mov eax, dword [esp + 0x20]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
cmp ecx, 4
jge 0x1002ee1c
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x1002edee
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jg 0x1002edda
mov dword [esp + 0x10], ebx
jmp 0x1002ee53
mov dword [esp + 0x14], 1
dec dword [esp + 0x14]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x17
jg 0x1002ee43
push 0x1135
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [esp + 0x14], 0xb26bdde0
mov dword [esp + 0x14], ebx
jmp 0x1002ee90
mov byte [esp + 0x37], bl
cmp byte [esp + 0x37], 0
je 0x1002ee86
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
cmp dword [esp + 0x14], ebx
jne 0x1002ee97
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0xa
jne 0x1002ee74
mov byte [esp + 0x3f], bl
lea ecx, [esp + 0xe4]
push esi
call fcn.10025495
mov dword [esp + 0x14], ebx
jmp 0x1002eec4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1002eeae
mov byte [esp + 0x37], bl
cmp byte [esp + 0x37], 0
je 0x1002eedd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov eax, dword [esp + 0xe4]
lea ecx, [esp + 0xe4]
mov dword [eax + 4], 0xec0ae971
call fcn.1002554b
push 0x670
lea eax, [esp + 0x43]
push eax
push ebx
push 0x3cb8
call fcn.1002f803
add esp, 0x10
dec dword [esp + 0x24]
jns 0x1002ea60
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffed
jle 0x1002e7bc
push 3
pop esi
inc dword [esp + 0x30]
cmp dword [esp + 0x30], 0xffffffff
jne 0x1002e7ad
mov dword [esp + 0x18], 0x19ac196a
lea ecx, [esp + 0xd8]
mov dword [esp + 0x14], 0x9570
push 2
call fcn.10025495
push 2
mov dword [esp + 0x14], ebx
pop edx
jmp 0x1002ef74
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0xc4], 7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1002ef61
mov dword [esp + 0x10], ebx
jmp 0x1002ef92
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x1002ef80
mov eax, dword [esp + 0x18]
xor edx, edx
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add ecx, 0x5c6f8b8a
cmp ecx, eax
setl dl
mov dword [esp + 0xc8], edx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
imul ecx, edx
xor edx, edx
cmp ecx, eax
setle dl
xor ecx, ecx
add edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp eax, edx
setne cl
xor edx, edx
cmp ecx, 0x2c6e
setl dl
xor ecx, ecx
imul edx, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
cmp edx, eax
setle cl
cmp ecx, dword [esp + 0x18]
jne 0x1002f027
mov dword [esp + 0x14], 0xffffffe8
jmp 0x1002f01e
mov byte [esp + 0x37], bl
cmp byte [esp + 0x37], 0
je 0x1002f01a
push ebx
call dword [sym.imp.USER32.dll_CharUpperW]
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 0x31
jle 0x1002f008
jmp 0x1002f093
mov dword [esp + 0x24], 0x46e74a6e
mov dword [esp + 0x2c], 0x280bfe73
mov dword [esp + 0x38], 4
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], 1
mov dword [esp + 0x2c], 0x8214d2fc
mov dword [esp + 0x2c], 0x14ba09a1
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x2c], esi
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0xd8]
inc dword [eax]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc8], eax
lea ecx, [esp + 0xd8]
call fcn.1002554b
mov eax, edi
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [esp + 0x50]
mov esi, edx
mov edi, eax
call fcn.1002dbe7
mov ecx, dword [esp + 0x1bc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret