Function at 0x1002c0b8
Capabilities:
Get common file path
Log keystrokes via polling
Query environment variable

Disassembly:
push ebp
mov eax, 0x41c0
lea ebp, [esp - 0x74]
call fcn.100b44d0
mov dword [ebp + 0x6c], ecx
lea ecx, [ebp + 0x7c]
call fcn.1000f804
and dword [ebp + 0x60], 0
and dword [ebp + 0x48], 0
mov dword [ebp + 0x58], 1
mov dword [ebp + 0x28], 0xfffffff6
mov byte [ebp + 0x70], 0
mov byte [ebp + 0x53], 0
mov byte [ebp + 0x72], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 0x18], eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x2c], 0x3e8
cmp word [eax], 0x2d
mov byte [ebp + 0x68], 0
mov byte [ebp + 0x71], 0
mov byte [ebp + 0x73], 0x2a
jne 0x1002c11d
mov byte [ebp + 0x73], 0x2d
mov cl, byte [eax]
cmp byte [ebp + 0x73], cl
push ebx
push esi
push edi
push 0x40
pop edi
jne 0x1002c387
mov esi, dword [ebp + 0x7c]
lea edx, [esi + 2]
xor ebx, ebx
mov bx, word [edx]
cmp bx, 0x41
jb 0x1002c35e
cmp bx, 0x2a
je 0x1002c35e
mov eax, ebx
call fcn.10014a5c
test al, al
jne 0x1002c35e
cmp cl, 0x2d
jne 0x1002c176
mov al, bl
or al, 0x20
cmp al, 0x63
jne 0x1002c176
mov al, byte [esi + 4]
or al, 0x20
cmp al, 0x6d
je 0x1002c35e
cmp cl, 0x2a
jne 0x1002c18a
mov eax, ebx
call fcn.1000f81a
test al, al
jne 0x1002c35e
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x100cc320
mov dword [ebp + 0x7c], edx
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c1ad
mov byte [ebp + 0x71], 1
jmp 0x1002c350
push 8
lea eax, [ebp + 0x7c]
push eax
push str.InitSys
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c1cd
mov byte [ebp + 0x53], 1
jmp 0x1002c350
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x100c7ee0
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c1ed
mov byte [ebp + 0x68], 1
jmp 0x1002c350
push 4
lea eax, [ebp + 0x7c]
push eax
push str.sys0
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c20d
mov byte [ebp + 0x68], 0x41
jmp 0x1002c350
push 6
lea eax, [ebp + 0x7c]
push eax
push str.syscmd
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c22d
mov byte [ebp + 0x68], 0x10
jmp 0x1002c350
push 7
lea eax, [ebp + 0x7c]
push eax
push str.sys0cmd
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c24d
mov byte [ebp + 0x68], 0x50
jmp 0x1002c350
push 4
lea eax, [ebp + 0x7c]
push eax
push str.cont
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c270
mov dword [ebp + 0x60], 0x10000
jmp 0x1002c350
push 5
push dword [ebp + 0x7c]
push str.scan:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1002c292
add dword [ebp + 0x7c], 0xa
lea eax, [ebp + 0x28]
jmp 0x1002c339
push 7
lea eax, [ebp + 0x7c]
push eax
push str.scanall
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c2b5
mov dword [ebp + 0x28], 0x1000
jmp 0x1002c350
push 3
lea eax, [ebp + 0x7c]
push eax
push 0x100cb3f8
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c2d1
mov dword [ebp + 0x48], edi
jmp 0x1002c350
push 7
lea eax, [ebp + 0x7c]
push eax
push str.freemem
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c2ff
push 1
call fcn.10041803
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
pop ecx
je 0x1002c87e
jmp 0x1002c350
push 6
lea eax, [ebp + 0x7c]
push eax
push str.thread
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002c31c
mov byte [ebp + 0x72], 1
jmp 0x1002c350
push 4
push dword [ebp + 0x7c]
push str.cur:
call fcn.10040df5
add esp, 0xc
test al, al
je 0x1002c346
add dword [ebp + 0x7c], 8
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.10053a89
pop ecx
jmp 0x1002c34f
lea eax, [ebp + 0x7c]
push eax
call fcn.10008e60
pop ecx
mov eax, dword [ebp + 0x7c]
mov cl, byte [eax]
cmp byte [ebp + 0x73], cl
je 0x1002c12e
cmp byte [ebp + 0x72], 0
je 0x1002c387
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
cmp eax, dword [0x100e2e74]
setne cl
push ecx
push 0x100e34c0
call fcn.1001310a
pop ecx
pop ecx
jmp 0x1002cde1
mov eax, dword [ebp + 0x7c]
cmp byte [eax], 0x2d
jne 0x1002c3ac
cmp byte [eax + 2], 0x2d
jne 0x1002c3ac
mov ax, word [eax + 4]
call fcn.1000f81a
test al, al
je 0x1002c3ac
lea eax, [ebp + 0x7c]
push eax
call fcn.10008e60
pop ecx
cmp byte [ebp + 0x68], 0
je 0x1002c4c3
push 0x100e3d7c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push str.GlobalPECMD:main:lock
lea ecx, [ebp + 0x64]
call fcn.1000fd2b
mov esi, dword [ebp + 0x68]
and esi, edi
push esi
call fcn.1001260b
test eax, eax
pop ecx
mov dword [ebp + 0x60], eax
jne 0x1002c3ef
push esi
push dword [ebp + 0x6c]
call fcn.100195e8
pop ecx
pop ecx
mov dword [ebp + 0x60], eax
test eax, eax
mov dword [ebp + 0x58], 1
je 0x1002c4a4
push dword [ebp + 0x7c]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
call esi
mov edi, eax
add edi, 0x10
lea eax, [edi + 0x65]
push eax
lea ecx, [ebp + 0x6c]
call fcn.10046141
mov eax, dword [ebp + 0x6c]
and word [eax], 0
test byte [ebp + 0x68], 0x10
jne 0x1002c43b
push dword [ebp + 0x18]
push str.THREAD_WAIT__cur:_lu
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push dword [ebp + 0x6c]
call esi
mov ecx, dword [ebp + 0x6c]
inc edi
push edi
push dword [ebp + 0x7c]
lea eax, [ecx + eax*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push dword [ebp + 0x6c]
call esi
add eax, eax
push eax
push dword [ebp + 0x6c]
mov ebx, str.HOTKEY9000000
push 1
push ebx
mov edi, str.SOFTWAREPELOGONRAMDATAHOTKEY
push edi
mov esi, 0x80000002
push esi
call fcn.10040c59
add esp, 0x18
push 0
push 0x895440
push 0x312
push dword [ebp + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
push ebx
push edi
push esi
mov dword [ebp + 0x58], eax
call fcn.10040cb4
add esp, 0xc
lea ecx, [ebp + 0x6c]
call fcn.1003f96c
cmp dword [ebp + 0x64], 0
je 0x1002c4b3
push dword [ebp + 0x64]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x100e3d7c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1002cdde
xor esi, esi
cmp dword [ebp + 0x28], esi
jl 0x1002c5a7
lea ecx, [ebp + 0x48]
mov dword [ebp + 0x60], str.PressKey
call fcn.10046123
mov eax, dword [ebp + 0x7c]
cmp word [eax], si
je 0x1002c4fd
push 0x2c
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.1004907a
mov eax, dword [ebp + 0x48]
add esp, 0xc
mov dword [ebp + 0x60], eax
push 0x3f
xor eax, eax
mov byte [ebp - 0x148], 0
pop ecx
lea edi, [ebp - 0x147]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp + 0x28]
mov edi, 0x100
cmp eax, edi
mov word [ebp - 0x414c], si
jae 0x1002c554
movzx eax, byte [ebp + eax - 0x148]
push eax
lea eax, [ebp - 0x414c]
push 0x100cc278
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x1002c57c
xor esi, esi
lea ebx, [ebp - 0x414c]
movzx eax, byte [ebp + esi - 0x148]
push eax
push 0x100cc278
push ebx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
inc esi
add ebx, 0xa
cmp esi, edi
jl 0x1002c55c
mov ecx, dword [ebp + 0x6c]
and word [ebp - 0x374e], 0
lea eax, [ebp - 0x414c]
push eax
push dword [ebp + 0x60]
call fcn.100457c2
lea ecx, [ebp + 0x48]
call fcn.1003f96c
and dword [ebp + 0x58], 0
jmp 0x1002cda4
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x2d
mov esi, 0x80000000
mov edi, esi
mov dword [ebp + 0x68], edi
mov dword [ebp + 0x4c], 0xfffffc18
jne 0x1002c5e9
lea ecx, [edx + 2]
mov ax, word [ecx]
or ax, 0x20
cmp ax, 0x63
je 0x1002c5e9
cmp ax, 0x64
je 0x1002c5e9
mov dword [ebp + 0x7c], ecx
lea ecx, [ebp + 0x7c]
mov byte [ebp + 0x70], 1
call fcn.1000f804
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x3d
jne 0x1002c5f8
mov bl, byte [edx]
inc edx
inc edx
mov dword [ebp + 0x7c], edx
jmp 0x1002c5fa
xor bl, bl
xor ecx, ecx
mov cx, word [edx]
push ecx
call fcn.10045b88
add esp, 4
test al, al
je 0x1002c69e
mov eax, dword [ebp + 0x7c]
fld qword [0x100cc270]
mov dword [ebp + 0x5c], eax
fstp qword [ebp + 0x3c]
lea eax, [ebp + 0x64]
push eax
lea eax, [ebp + 0x5c]
push eax
mov dword [ebp + 0x64], esi
call fcn.10053a89
pop ecx
pop ecx
mov ecx, dword [ebp + 0x7c]
jmp 0x1002c647
mov ax, word [ecx]
call fcn.10002df6
test al, al
jne 0x1002c64c
inc ecx
inc ecx
mov dword [ebp + 0x7c], ecx
cmp ecx, dword [ebp + 0x5c]
jb 0x1002c636
cmp dword [ebp + 0x64], 0
jl 0x1002c68f
cmp word [ecx], 0x2e
mov edi, dword [ebp + 0x64]
mov dword [ebp + 0x68], edi
jne 0x1002c68f
lea eax, [ebp + 0x3c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.10049467
fld qword [ebp + 0x3c]
fcomp qword [0x100c9b80]
pop ecx
pop ecx
fnstsw ax
test ah, 1
jne 0x1002c727
fld qword [ebp + 0x3c]
fadd qword [0x100cc268]
jmp 0x1002c715
lea eax, [ebp + 0x7c]
push eax
call fcn.10008e60
pop ecx
jmp 0x1002c727
cmp cx, 0x28
jne 0x1002c72a
fld qword [0x100cc270]
lea eax, [ebp + 0x3c]
push eax
fstp qword [ebp + 0x3c]
lea eax, [ebp + 0x7c]
push eax
call fcn.10049667
test eax, eax
pop ecx
pop ecx
jle 0x1002c727
fld qword [ebp + 0x3c]
fcomp qword [0x100c9b80]
fnstsw ax
test ah, 1
jne 0x1002c727
fld qword [ebp + 0x3c]
fadd qword [0x100cc268]
fld st(0)
call fcn.100b4728
fld st(0)
mov edi, eax
mov dword [ebp + 0x68], edi
call fcn.100b4728
mov dword [ebp + 0x3c], eax
mov dword [ebp + 0x40], edx
fild qword [ebp + 0x3c]
fsubp st(1)
fcom qword [0x100cc260]
fnstsw ax
test ah, 0x41
jne 0x1002c725
fcom qword [0x100cc258]
fnstsw ax
test ah, 5
jp 0x1002c725
fmul qword [0x100cc250]
call fcn.100b4728
mov dword [ebp + 0x4c], eax
jmp 0x1002c727
fstp st(0)
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0x2a
je 0x1002c8c5
cmp edi, esi
jne 0x1002c742
cmp dword [ebp + 0x4c], 0
jl 0x1002c8c5
and word [ebp - 0x46], 0
and word [ebp - 0x48], 0
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x64], str.PressKey
call fcn.10046123
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x2c
jne 0x1002c786
add dword [ebp + 0x7c], 2
push 0x2c
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.1004907a
mov eax, dword [ebp + 0x5c]
add esp, 0xc
cmp word [eax], 0
je 0x1002c786
mov dword [ebp + 0x64], eax
test bl, bl
jne 0x1002c85a
cmp byte [ebp + 0x70], bl
jne 0x1002c7a4
test edi, edi
jne 0x1002c85c
cmp dword [ebp + 0x4c], edi
jg 0x1002c88b
test edi, edi
jne 0x1002c7b3
cmp byte [ebp + 0x70], 0
jne 0x1002c7b3
push 2
pop eax
jmp 0x1002c7b6
xor eax, eax
inc eax
or eax, dword [ebp + 0x60]
push eax
push edi
call fcn.1001b089
cmp byte [ebp + 0x71], 0
pop ecx
mov ebx, eax
pop ecx
mov dword [ebp + 0x58], ebx
jne 0x1002c7dd
cmp ebx, 0x60
jl 0x1002c7dd
cmp ebx, 0x69
jg 0x1002c7dd
sub ebx, 0x30
mov dword [ebp + 0x58], ebx
test ebx, ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x100c6b48
jle 0x1002c7fc
push ebx
lea eax, [ebp - 0x48]
push edi
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x48]
jmp 0x1002c801
mov eax, 0x100cc244
mov ecx, dword [ebp + 0x6c]
push eax
push str.PressKey.Hex
call fcn.100457c2
test ebx, ebx
jle 0x1002c844
cmp ebx, 0x41
jl 0x1002c81d
cmp ebx, 0x5a
jle 0x1002c82a
push ebx
call fcn.10045b88
add esp, 4
test al, al
je 0x1002c839
and word [ebp - 0x46], 0
movsx ax, bl
mov word [ebp - 0x48], ax
jmp 0x1002c844
push ebx
lea eax, [ebp - 0x48]
push edi
push eax
call esi
add esp, 0xc
mov ecx, dword [ebp + 0x6c]
lea eax, [ebp - 0x48]
push eax
push dword [ebp + 0x64]
call fcn.100457c2
mov esi, 0x80000000
jmp 0x1002c8ab
test edi, edi
jl 0x1002c8ab
test bl, bl
je 0x1002c885
and dword [ebp + 0x58], 0
push edi
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0
jne 0x1002c8ab
lea ecx, [ebp + 0x5c]
call fcn.1003f96c
xor eax, eax
jmp 0x1002cde1
cmp dword [ebp + 0x4c], 0
jle 0x1002c890
mov ecx, dword [ebp + 0x4c]
jmp 0x1002c892
xor ecx, ecx
test edi, edi
jle 0x1002c89a
mov eax, edi
jmp 0x1002c89c
xor eax, eax
push 0
push ecx
mov ecx, dword [ebp + 0x6c]
push eax
call fcn.10011621
mov dword [ebp + 0x58], eax
lea ecx, [ebp + 0x7c]
call fcn.1000f804
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x68], esi
mov byte [ebp + 0x70], 0
call fcn.1003f96c
mov edx, dword [ebp + 0x7c]
cmp word [edx], 0
je 0x1002cda4
xor ebx, ebx
mov dword [ebp + 0x54], ebx
or esi, 0xffffffff
cmp word [edx], 0x2a
mov byte [ebp + 0x71], bl
mov byte [ebp + 0x73], bl
jne 0x1002c8fc
mov eax, dword [ebp + 0x18]
inc edx
xor esi, esi
inc edx
inc esi
mov dword [ebp + 0x54], eax
jmp 0x1002c8f3
inc esi
inc edx
inc edx
mov dword [ebp + 0x7c], edx
cmp word [edx], 0x2a
je 0x1002c8f0
cmp esi, ebx
jle 0x1002c96b
mov ax, word [edx]
cmp ax, 0x2d
jne 0x1002c913
inc edx
inc edx
mov dword [ebp + 0x7c], edx
mov dword [ebp + 0x54], ebx
jmp 0x1002c96b
cmp ax, 0x3d
jne 0x1002c91f
mov byte [ebp + 0x71], 1
jmp 0x1002c929
cmp ax, 0x24
jne 0x1002c931
mov byte [ebp + 0x73], 2
inc edx
inc edx
mov dword [ebp + 0x7c], edx
mov dword [ebp + 0x54], ebx
xor eax, eax
mov ax, word [edx]
push eax
call fcn.10045b88
add esp, 4
test al, al
je 0x1002c953
lea eax, [ebp + 0x54]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.10053a89
pop ecx
pop ecx
dec esi
cmp esi, ebx
jle 0x1002c96b
cmp byte [ebp + 0x73], 0
jne 0x1002c96b
push esi
push dword [ebp + 0x54]
call fcn.10013018
pop ecx
pop ecx
mov dword [ebp + 0x54], eax
or dword [ebp + 0x34], 0xffffffff
lea ecx, [ebp + 0x7c]
call fcn.1000f804
mov eax, dword [ebp + 0x7c]
cmp word [eax], 0x3d
jne 0x1002c98c
mov cl, byte [eax]
inc eax
inc eax
mov byte [ebp + 0x72], cl
mov dword [ebp + 0x7c], eax
jmp 0x1002c990
mov byte [ebp + 0x72], 0
movzx eax, word [eax]
push eax
call fcn.10045b88
add esp, 4
test al, al
je 0x1002c9af
lea eax, [ebp + 0x34]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.10053a89
pop ecx
pop ecx
cmp byte [ebp + 0x73], 0
mov dword [ebp + 0x14], ebx
jne 0x1002c9c0
lea edi, [ebp + 0x14]
mov dword [ebp + 0x4c], edi
jmp 0x1002c9c8
lea eax, [ebp + 0x54]
mov dword [ebp + 0x4c], eax
mov edi, eax
cmp byte [ebp + 0x73], 0
mov dword [ebp + 0x58], ebx
jne 0x1002c9dd
cmp dword [ebp + 0x54], ebx
jne 0x1002c9e8
mov dword [ebp + 0x58], 0x80070057
cmp dword [ebp + 0x54], ebx
je 0x1002ca14
cmp byte [ebp + 0x73], 0
jne 0x1002ca14
cmp byte [ebp + 0x71], 0
push dword [ebp + 0x54]
push ebx
push 0x100000
je 0x1002c9ff
call dword [sym.imp.KERNEL32.dll_OpenThread]
jmp 0x1002ca05
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
mov dword [edi], eax
jne 0x1002ca14
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp + 0x58], eax
push 0x209
lea ecx, [ebp + 0x44]
call fcn.10046141
mov eax, dword [ebp + 0x44]
mov word [eax], bx
push dword [ebp + 0x44]
mov esi, 0x208
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp + 0x44]
push eax
lea ecx, [ebp + 0x30]
call fcn.1005023c
push 0x5c
push dword [ebp + 0x30]
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov eax, dword [ebp + 0x44]
push esi
mov word [eax], bx
push dword [ebp + 0x44]
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp + 0x30]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [ebp + 0x7c]
call fcn.1000f804
lea ecx, [ebp + 0x1c]
call fcn.100463df
mov dword [ebp + 0x40], ebx
jmp 0x1002cba0
cmp byte [0x100e12e4], 0
jle 0x1002cbb4
push 7
lea eax, [ebp + 0x7c]
push eax
push str._delms:
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002cac7
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp + 0x7c]
push eax
call fcn.10053a89
cmp dword [ebp + 0x2c], ebx
pop ecx
pop ecx
jge 0x1002cba0
mov dword [ebp + 0x2c], ebx
jmp 0x1002cba0
push 4
lea eax, [ebp + 0x7c]
push eax
push str._del
call fcn.10048195
add esp, 0xc
test al, al
je 0x1002cb7f
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x38], eax
push 1
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x38]
push eax
mov dword [ebp + 0x60], ebx
call fcn.1001a65a
add esp, 0xc
lea ecx, [ebp + 0x5c]
mov dword [ebp + 0x7c], eax
call fcn.10046123
lea ecx, [ebp + 0x64]
call fcn.10046123
push dword [ebp + 0x60]
lea ecx, [ebp + 0x64]
push dword [ebp + 0x38]
call fcn.10046247
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x64]
call fcn.10013659
pop ecx
pop ecx
lea ecx, [ebp + 0x64]
call fcn.1003f96c
cmp dword [ebp + 0x60], ebx
jle 0x1002cb6d
push 4
call fcn.100b4338
cmp eax, ebx
pop ecx
je 0x1002cb51
mov ecx, dword [ebp + 0x5c]
mov dword [eax], ecx
mov dword [ebp + 0x5c], ebx
mov esi, eax
jmp 0x1002cb53
xor esi, esi
push 4
lea eax, [ebp + 0x20]
push eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp + 0x24]
call fcn.100463a2
add esp, 0x10
mov dword [eax], esi
inc dword [ebp + 0x24]
lea ecx, [ebp + 0x7c]
call fcn.1000f804
lea ecx, [ebp + 0x5c]
call fcn.1003f96c
jmp 0x1002cba0
push 4
lea eax, [ebp + 0x7c]
push eax
push str._cmd
call fcn.10048195
add esp, 0xc
test al, al
jne 0x1002cbae
lea eax, [ebp + 0x7c]
push eax
call fcn.10008e60
pop ecx
mov eax, dword [ebp + 0x7c]
cmp word [eax], bx
jne 0x1002ca83
jmp 0x1002cbb4
mov eax, dword [ebp + 0x7c]
mov dword [ebp + 0x40], eax
cmp byte [ebp + 0x70], 0
je 0x1002cbbd
neg dword [ebp + 0x68]
cmp dword [ebp + 0x48], ebx
jne 0x1002cbcf
cmp dword [edi], ebx
je 0x1002cbcf
push dword [ebp + 0x44]
call fcn.10012162
pop ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
add esi, dword [ebp + 0x68]
cmp dword [edi], ebx
je 0x1002cc62
jmp 0x1002cc59
cmp dword [ebp + 0x68], ebx
je 0x1002cc62
mov edi, 0x3e8
jle 0x1002cc05
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, esi
sub ecx, eax
mov dword [ebp + 0x68], ecx
js 0x1002cc62
cmp ecx, edi
jge 0x1002cc05
mov edi, ecx
push 0x4ff
push edi
push ebx
push dword [ebp + 0x4c]
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
test eax, eax
je 0x1002cc62
push 0x64
pop edi
jmp 0x1002cc50
push 1
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1002cc59
dec edi
je 0x1002cc59
cmp dword [ebp - 4], 0x12
je 0x1002cc59
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp byte [0x100e12e4], 0
jg 0x1002cc20
cmp byte [0x100e12e4], 0
jg 0x1002cbe4
cmp dword [ebp + 0x34], ebx
jl 0x1002cc85
cmp byte [ebp + 0x72], 0
je 0x1002cc78
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1002cc85
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push dword [ebp + 0x34]
call fcn.10011621
cmp dword [ebp + 0x24], ebx
jle 0x1002cd4c
cmp byte [0x100e12e4], 0
jle 0x1002cd4c
cmp dword [ebp + 0x48], ebx
jne 0x1002cca9
push dword [ebp + 0x44]
call fcn.10012162
pop ecx
cmp dword [ebp + 0x24], ebx
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x60], eax
jle 0x1002cd4c
cmp byte [0x100e12e4], 0
jle 0x1002cd4c
mov eax, dword [ebp + 0x24]
xor edi, edi
cmp eax, ebx
mov dword [ebp + 0x38], ebx
mov dword [ebp + 0x64], eax
jle 0x1002cd4c
cmp byte [0x100e12e4], 0
jle 0x1002cd30
mov eax, dword [ebp + 0x60]
lea esi, [eax + edi*4]
mov eax, dword [esi]
cmp eax, ebx
je 0x1002cd28
mov ecx, dword [ebp + 0x6c]
push 0
push dword [eax]
call fcn.1002a07d
mov eax, dword [esi]
push dword [eax]
call fcn.100b3755
test edx, edx
pop ecx
jg 0x1002cd22
jl 0x1002cd09
test eax, eax
ja 0x1002cd22
mov ebx, dword [esi]
test ebx, ebx
je 0x1002cd1d
mov ecx, ebx
call fcn.1003f96c
push ebx
call fcn.100b4234
pop ecx
and dword [esi], 0
jmp 0x1002cd28
lea eax, [edi + 1]
mov dword [ebp + 0x38], eax
inc edi
xor ebx, ebx
cmp edi, dword [ebp + 0x64]
jl 0x1002ccd4
mov esi, dword [ebp + 0x38]
cmp esi, ebx
jle 0x1002cd4c
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push dword [ebp + 0x2c]
call fcn.10011621
mov dword [ebp + 0x24], esi
jmp 0x1002ccb8
cmp dword [ebp + 0x48], ebx
jne 0x1002cd61
mov eax, dword [ebp + 0x4c]
cmp dword [eax], ebx
je 0x1002cd61
push dword [ebp + 0x30]
call fcn.10012162
pop ecx
mov eax, dword [ebp + 0x40]
cmp eax, ebx
je 0x1002cd7c
cmp word [eax], bx
je 0x1002cd7c
mov ecx, dword [ebp + 0x6c]
push ebx
push ebx
push ebx
push eax
call fcn.10034bed
mov dword [ebp + 0x58], eax
lea ecx, [ebp + 0x1c]
call fcn.100ab7c3
lea ecx, [ebp + 0x1c]
call fcn.1003f96c
lea ecx, [ebp + 0x30]
call fcn.1003f96c
lea ecx, [ebp + 0x44]
call fcn.1003f96c
lea ecx, [ebp + 0x14]
call fcn.10002d56
cmp byte [ebp + 0x53], 0
je 0x1002cdd4
call fcn.1001a962
test eax, eax
je 0x1002cdcc
push dword [ebp + 0x6c]
call fcn.10012d3d
mov dword [esp], str.exec
push dword [ebp + 0x6c]
call fcn.1001a98e
pop ecx
pop ecx
push 0
call fcn.1001719b
pop ecx
mov ecx, dword [ebp + 0x6c]
push 0
call fcn.100707a5
mov eax, dword [ebp + 0x58]
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret 4