Function at 0x10029b29
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10089f7a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1f0
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10029fdd
mov dword [ebp - 0x70], 0
jmp 0x10029b64
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x10029b7a
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x170], 0x24a8c6a5
jmp 0x10029b5d
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x170], 0xffffffff
jmp 0x10029ba8
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x170]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x170], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x170], 0x14
je 0x10029be6
mov byte [ebp - 0x33], 0
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x10029bd2
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x10029be4
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x10029b8d
mov byte [ebp - 0x36], 0
movzx eax, byte [ebp - 0x36]
test eax, eax
je 0x10029c00
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
push 2
lea ecx, [ebp - 0x60]
call fcn.1001a36d
and dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
jmp 0x10029c1e
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x10029c37
push dword [ebp - 0x24]
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
mov dword [eax], 0x13b91020
jmp 0x10029c17
mov dword [ebp - 0x24], 0
jmp 0x10029c47
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 3
jge 0x10029c5d
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x1c0], 0x93765224
jmp 0x10029c40
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
mov dword [eax], 0xffffffea
jmp 0x10029c90
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x128]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
cmp dword [eax], 0xfffffffa
jge 0x10029f5d
push 2
lea ecx, [ebp - 0x84]
call fcn.1001a36d
mov byte [ebp - 4], 1
push 3
lea ecx, [ebp - 0x1d4]
call fcn.1001a36d
mov byte [ebp - 4], 2
mov dword [ebp - 0x28], 0
jmp 0x10029cd5
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 2
jge 0x10029cf1
push dword [ebp - 0x28]
lea ecx, [ebp - 0x84]
call fcn.1001a3f7
mov dword [eax], 1
jmp 0x10029cce
mov dword [ebp - 0x28], 0
jmp 0x10029d01
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x10029d1d
push dword [ebp - 0x28]
lea ecx, [ebp - 0x1d4]
call fcn.1001a3f7
mov dword [eax], 0x71639956
jmp 0x10029cfa
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x10029d35
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
cmp dword [eax], 0
jne 0x10029f1d
push 1
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
cmp dword [eax], 0
jne 0x10029dee
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
cmp dword [eax], 0
jl 0x10029d76
mov dword [ebp - 0x154], 1
jmp 0x10029d7d
and dword [ebp - 0x154], 0
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
cmp dword [eax], 6
jne 0x10029daa
push 1
lea ecx, [ebp - 0x84]
call fcn.1001a3f7
cmp dword [eax], 0
je 0x10029daa
mov dword [ebp - 0x15c], 1
jmp 0x10029db1
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x154]
cmp eax, dword [ebp - 0x15c]
jl 0x10029dcb
mov dword [ebp - 0x174], 1
jmp 0x10029dd2
and dword [ebp - 0x174], 0
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
push 1
lea ecx, [ebp - 0x84]
call fcn.1001a3f7
cmp dword [eax], 7
jle 0x10029e09
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
cmp dword [eax], 0
je 0x10029e09
mov dword [ebp - 0x158], 1
jmp 0x10029e10
and dword [ebp - 0x158], 0
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
mov ecx, dword [ebp - 0x158]
cmp ecx, dword [eax]
jle 0x10029e30
mov dword [ebp - 0x190], 1
jmp 0x10029e37
and dword [ebp - 0x190], 0
push 1
lea ecx, [ebp - 0x84]
call fcn.1001a3f7
cmp dword [eax], 0
jne 0x10029e61
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
cmp dword [eax], 0
jne 0x10029e61
and dword [ebp - 0x90], 0
jmp 0x10029e6b
mov dword [ebp - 0x90], 1
push 1
lea ecx, [ebp - 0x84]
call fcn.1001a3f7
mov ecx, dword [ebp - 0x90]
cmp ecx, dword [eax]
jl 0x10029e8e
mov dword [ebp - 0x104], 1
jmp 0x10029e95
and dword [ebp - 0x104], 0
push 1
lea ecx, [ebp - 0x84]
call fcn.1001a3f7
mov ecx, dword [ebp - 0x104]
cmp ecx, dword [eax]
jle 0x10029eb8
mov dword [ebp - 0x98], 1
jmp 0x10029ebf
and dword [ebp - 0x98], 0
push 0
lea ecx, [ebp - 0x84]
call fcn.1001a3f7
mov ecx, dword [ebp - 0x98]
cmp ecx, dword [eax]
jne 0x10029ee2
mov dword [ebp - 0x10c], 1
jmp 0x10029ee9
and dword [ebp - 0x10c], 0
push 1
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [eax]
jne 0x10029f09
mov dword [ebp - 0xa0], 1
jmp 0x10029f10
and dword [ebp - 0xa0], 0
push 1
lea ecx, [ebp - 0x84]
call fcn.1001a3f7
push 0
lea ecx, [ebp - 0x60]
call fcn.1001a3f7
mov esi, eax
push 1
lea ecx, [ebp - 0x1d4]
call fcn.1001a3f7
mov ecx, dword [esi]
mov dword [eax], ecx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1d4]
call fcn.1001a3f2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x84]
call fcn.1001a3f2
jmp 0x10029c6f
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x1c0], 0
jmp 0x10029f8b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1c0]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x1c0], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1c0], 0xfffffffc
jge 0x10029fc6
mov dword [ebp - 0x198], 0xffffffff
mov byte [ebp - 0x37], 0
movzx eax, byte [ebp - 0x37]
test eax, eax
je 0x10029fb9
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
cmp dword [ebp - 0x198], 0
je 0x10029fc4
jmp 0x10029fc6
jmp 0x10029f70
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.1001a3f2
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
jmp 0x1002aa97
mov dword [ebp - 0x1c], 0xdf2f4a8b
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xdc], 0x1a16747b
mov dword [ebp - 0x1a0], 0
mov dword [ebp - 0x74], 0
jmp 0x1002a01d
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 2
jge 0x1002a033
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x1c8], 0xee4f120b
jmp 0x1002a016
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1c]
inc eax
je 0x1002a04f
cmp dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1f0], eax
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x1c], eax
jg 0x1002a072
mov dword [ebp - 0x114], 1
jmp 0x1002a079
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
dec eax
cmp eax, dword [ebp - 0x1c]
jl 0x1002a094
cmp dword [ebp - 0x1c], 0
jne 0x1002a094
and dword [ebp - 0xa8], 0
jmp 0x1002a09e
mov dword [ebp - 0xa8], 1
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1c], eax
je 0x1002a366
mov dword [ebp - 0x64], 0
jmp 0x1002a0c3
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 1
jge 0x1002a0d6
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x10], 0
jmp 0x1002a0bc
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1e8], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x10]
dec ecx
push 4
pop edx
imul edx, edx, 0
mov dword [ebp + edx - 0x10], ecx
test eax, eax
jne 0x1002a351
mov eax, 0x61e33ecd
test eax, eax
je 0x1002a345
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x30]
cmp dword [ebp + eax - 0x10], ecx
jl 0x1002a12e
mov dword [ebp - 0x11c], 1
jmp 0x1002a135
and dword [ebp - 0x11c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0x11c], eax
je 0x1002a153
mov dword [ebp - 0xb0], 1
jmp 0x1002a15a
and dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 0x1b2d
jl 0x1002a172
mov dword [ebp - 0x124], 1
jmp 0x1002a179
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x30]
imul eax, dword [ebp - 0x124]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x10]
jle 0x1002a19b
mov dword [ebp - 0xb8], 1
jmp 0x1002a1a2
and dword [ebp - 0xb8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp eax, dword [ebp - 0xb8]
jne 0x1002a1c0
mov dword [ebp - 0x12c], 1
jmp 0x1002a1c7
and dword [ebp - 0x12c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp eax, dword [ebp - 0x12c]
jg 0x1002a1e5
mov dword [ebp - 0xc0], 1
jmp 0x1002a1ec
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0xc0], eax
jle 0x1002a209
mov eax, 0x1b16
test eax, eax
jne 0x1002a209
and dword [ebp - 0x134], 0
jmp 0x1002a213
mov dword [ebp - 0x134], 1
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x134], eax
jne 0x1002a230
cmp dword [ebp - 0x30], 0
je 0x1002a230
mov dword [ebp - 0xc8], 1
jmp 0x1002a237
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x30]
add eax, dword [ebp - 0xc8]
cmp eax, 0x11659018
jle 0x1002a253
mov dword [ebp - 0x13c], 1
jmp 0x1002a25a
and dword [ebp - 0x13c], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x13c]
sub ecx, dword [ebp + eax - 0x10]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 0xc1dc0ac7
jne 0x1002a282
mov dword [ebp - 0xd0], 1
jmp 0x1002a289
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x1c], eax
je 0x1002a2a6
mov dword [ebp - 0x144], 1
jmp 0x1002a2ad
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x144], eax
jl 0x1002a2c4
mov dword [ebp - 0x14c], 1
jmp 0x1002a2cb
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x10]
mov dword [ebp - 0xdc], eax
je 0x1002a2ed
cmp dword [ebp - 0x14], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x10], 0x8c0e
jl 0x1002a309
mov dword [ebp - 0xe0], 1
jmp 0x1002a310
and dword [ebp - 0xe0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x10]
cmp dword [ebp - 0xe0], eax
jge 0x1002a32b
mov dword [ebp - 0x78], 1
jmp 0x1002a32f
and dword [ebp - 0x78], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x78]
mov dword [ebp + eax - 0x1c8], ecx
cmp dword [ebp - 0x78], 0
jne 0x1002a351
mov dword [ebp - 0x120], 1
jmp 0x1002a358
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x1a0], eax
jmp 0x1002a3d7
mov dword [ebp - 0x14], 0
jmp 0x1002a376
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 8
je 0x1002a3bc
mov dword [ebp - 0x20], 1
jmp 0x1002a38c
mov eax, dword [ebp - 0x20]
dec eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jl 0x1002a3a3
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x1c8], 0
je 0x1002a3a1
jmp 0x1002a3a3
jmp 0x1002a385
mov byte [ebp - 0x38], 0
movzx eax, byte [ebp - 0x38]
test eax, eax
je 0x1002a3ba
push 0x1daf
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
jmp 0x1002a36f
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x1002a3d7
push 0x79b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x194], eax
mov dword [ebp - 0x18], 1
mov dword [ebp - 0xec], 0xee3199f2
mov dword [ebp - 0x184], 0x24be18a1
mov dword [ebp - 0x2c], 0
jmp 0x1002a414
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002a42a
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x168], 1
jmp 0x1002a40d
mov dword [ebp - 0x2c], 0
jmp 0x1002a43a
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1002a44d
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x48], 0x2fe22364
jmp 0x1002a433
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x48], 2
jmp 0x1002a472
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x48], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x48], 0
jl 0x1002aa4f
mov dword [ebp - 0x3c], 0xd3bed162
mov dword [ebp - 0x68], 0xcd95ff79
mov dword [ebp - 0x50], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x168]
mov dword [ebp - 0xe8], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
mov ecx, dword [ebp - 0xe8]
mov dword [ebp + eax*4 - 0x168], ecx
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0xe8], eax
jle 0x1002a4d9
mov dword [ebp - 0x140], 1
jmp 0x1002a4e0
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x140]
jle 0x1002a4f7
mov dword [ebp - 0xf0], 1
jmp 0x1002a4fe
and dword [ebp - 0xf0], 0
cmp dword [ebp - 0xf0], 0x20b5
jge 0x1002a516
mov dword [ebp - 0x1a8], 1
jmp 0x1002a51d
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x1d8], eax
cmp dword [ebp - 0x3c], 0
jne 0x1002a543
or eax, 0xffffffff
jne 0x1002a543
and dword [ebp - 0x88], 0
jmp 0x1002a54d
mov dword [ebp - 0x88], 1
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x88], eax
jle 0x1002a56b
mov dword [ebp - 0xf8], 1
jmp 0x1002a572
and dword [ebp - 0xf8], 0
cmp dword [ebp - 0xf8], 0xce4b0ad8
jb 0x1002a58a
mov dword [ebp - 0x150], 1
jmp 0x1002a591
and dword [ebp - 0x150], 0
cmp dword [ebp - 0x150], 9
jle 0x1002a5a6
mov dword [ebp - 0x100], 1
jmp 0x1002a5ad
and dword [ebp - 0x100], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
add eax, dword [ebp - 0x100]
push 4
pop ecx
shl ecx, 0
cmp eax, dword [ebp + ecx - 0x48]
jg 0x1002a5d5
mov dword [ebp - 0x130], 1
jmp 0x1002a5dc
and dword [ebp - 0x130], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x130], eax
jge 0x1002a5fa
mov dword [ebp - 0x108], 1
jmp 0x1002a601
and dword [ebp - 0x108], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x108], eax
jge 0x1002a61f
mov dword [ebp - 0x148], 1
jmp 0x1002a626
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x148], eax
jl 0x1002a63d
mov dword [ebp - 0x110], 1
jmp 0x1002a644
and dword [ebp - 0x110], 0
cmp dword [ebp - 0x110], 0xfffffffe
jle 0x1002a659
mov dword [ebp - 0x138], 1
jmp 0x1002a660
and dword [ebp - 0x138], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0x138], eax
jle 0x1002a67e
mov dword [ebp - 0x118], 1
jmp 0x1002a685
and dword [ebp - 0x118], 0
cmp dword [ebp - 0x118], 0xffffffff
ja 0x1002a69a
mov dword [ebp - 0xd8], 1
jmp 0x1002a6a1
and dword [ebp - 0xd8], 0
imul eax, dword [ebp - 0xd8], 0x1a7e
cmp eax, 0x5ad3
jle 0x1002a6be
mov dword [ebp - 0xd4], 1
jmp 0x1002a6c5
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xfffa
jb 0x1002a6e9
cmp dword [ebp - 0x18], 0
je 0x1002a6e9
mov dword [ebp - 0xe4], 1
jmp 0x1002a6f0
and dword [ebp - 0xe4], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0xe4], eax
jg 0x1002a71d
mov eax, dword [ebp - 0xec]
dec eax
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x50], eax
jmp 0x1002aa4a
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x54], 0xb64e3176
push 1
lea ecx, [ebp - 0x1b4]
call fcn.1001a36d
mov dword [ebp - 4], 3
mov dword [ebp - 0x6c], 0
jmp 0x1002a752
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 1
jge 0x1002a76e
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x1b4]
call fcn.1001a3f7
mov dword [eax], 0x26eb
jmp 0x1002a74b
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp + eax*4 - 0x168], 0
je 0x1002a8f8
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x1e4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
mov eax, dword [ebp + eax*4 - 0x168]
mov dword [ebp - 0x50], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x168]
mov dword [ebp - 0x1ec], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x1f4], eax
cmp dword [ebp - 0x68], 0
jne 0x1002a7d4
cmp dword [ebp - 0x18], 0
jne 0x1002a7d4
and dword [ebp - 0xf4], 0
jmp 0x1002a7de
mov dword [ebp - 0xf4], 1
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0xf4], eax
jne 0x1002a7f5
mov dword [ebp - 0xfc], 1
jmp 0x1002a7fc
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0xfc]
sub eax, 3
sub eax, dword [ebp - 0x3c]
cmp eax, dword [ebp - 0x18]
jl 0x1002a819
mov dword [ebp - 0x8c], 1
jmp 0x1002a820
and dword [ebp - 0x8c], 0
mov eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x8c], eax
jne 0x1002a83a
mov dword [ebp - 0x178], 1
jmp 0x1002a841
and dword [ebp - 0x178], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x48]
xor ecx, ecx
sub ecx, dword [ebp + eax*4 - 0x168]
push 4
pop eax
shl eax, 0
cmp ecx, dword [ebp + eax - 0x48]
jne 0x1002a86c
mov dword [ebp - 0x94], 1
jmp 0x1002a873
and dword [ebp - 0x94], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x94], eax
je 0x1002a88a
mov dword [ebp - 0x9c], 1
jmp 0x1002a891
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x9c], eax
je 0x1002a8a8
mov dword [ebp - 0x17c], 1
jmp 0x1002a8af
and dword [ebp - 0x17c], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1fc], eax
cmp dword [ebp - 0xa4], 0xfffffffe
jl 0x1002a8d3
mov eax, 0x7cec4480
test eax, eax
jne 0x1002a8d3
and dword [ebp - 0xac], 0
jmp 0x1002a8dd
mov dword [ebp - 0xac], 1
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0
je 0x1002a8f8
mov dword [ebp - 0xb4], 1
jmp 0x1002a8ff
and dword [ebp - 0xb4], 0
push 0
lea ecx, [ebp - 0x1b4]
call fcn.1001a3f7
mov ecx, dword [ebp - 0xb4]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x168], 0
je 0x1002a9fb
mov dword [ebp - 0x1a4], 0
mov dword [ebp - 0x18c], 0xc157b4c7
mov dword [ebp - 0x18], 0x1b
jmp 0x1002a94c
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 6
jl 0x1002a9f9
mov dword [ebp - 0x188], 1
xor eax, eax
inc eax
je 0x1002a983
mov eax, dword [ebp - 0x188]
sub eax, 0x11f6f1e4
cmp eax, 0xcb3f04bf
jbe 0x1002a983
mov dword [ebp - 0xbc], 1
jmp 0x1002a98a
and dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0xbc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
neg eax
cmp eax, 0xfffffffc
jbe 0x1002a9a9
mov dword [ebp - 0xc4], 1
jmp 0x1002a9b0
and dword [ebp - 0xc4], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x48]
cmp dword [ebp - 0xc4], eax
jle 0x1002a9cd
mov dword [ebp - 0xcc], 1
jmp 0x1002a9d4
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x1a4]
imul eax, dword [ebp - 0xcc]
mov dword [ebp - 0x18c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x48]
mov dword [ebp - 0x54], eax
jmp 0x1002a945
jmp 0x1002aa3b
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x1002aa24
push 0
push 0
push 0
push 0
push 0xe19
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [ebp - 0x18], 0
je 0x1002aa3b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b4]
call fcn.1001a3f2
jmp 0x1002aa4f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1b4]
call fcn.1001a3f2
jmp 0x1002a45d
mov eax, dword [ebp - 0x19c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x194]
mov dword [ebp - 0x180], eax
mov eax, dword [ebp - 0x4c]
mov dword [eax], 0
jmp 0x1002aa7a
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x4c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x4c]
cmp dword [eax], 2
jge 0x1002aa97
mov eax, dword [ebp - 0x4c]
push dword [eax]
mov ecx, dword [ebp - 0x180]
call fcn.1001a3f7
or dword [eax], 0xffffffff
jmp 0x1002aa6f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret