Function at 0x10028d20
Capabilities:
Query environment variable
Set environment variable

Disassembly:
mov eax, 0x10064e57
call fcn.10063950
sub esp, 0x2b0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0xc4], ecx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x20], 0xcf86
mov dword [ebp - 0x24], 0x21c9b6cd
push 2
mov dword [ebp - 0x138], edx
mov dword [ebp - 0x1d8], ebx
call fcn.10004e2c
mov dword [ebp - 0x1c], ebx
jmp 0x10028d84
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0x30fc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10028d71
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
je 0x10028da1
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x20]
inc edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
cmp eax, edx
setge cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x110]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [esi + 4]
jle 0x10028e44
mov dword [ebp - 0x30], 0xffff
mov dword [ebp - 0x24], 0xea38
mov dword [ebp - 0x40], 5
mov dword [ebp - 0x30], 0xffffffff
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x30], 0xfffffff8
jge 0x10028e01
cmp dword [ebp - 0x20], ebx
jne 0x10028e03
mov edx, ebx
lea eax, [edx - 0x49596113]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 7
mov eax, dword [ebp - 0x20]
cmp ecx, eax
setg dl
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x40], edx
xor edx, edx
cmp dword [ebp - 0x40], 0x4acdff90
setl dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x40], ecx
jmp 0x10028e90
mov dword [ebp - 0x30], edx
xor edx, edx
mov dword [ebp - 0x24], 0x8c547fce
mov dword [ebp - 0x40], 0x83ea6de4
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [esi + 4]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10028e90
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
push dword [ebp - 0x110]
call fcn.1004d139
mov dword [ebp - 0x110], ebx
mov dword [ebp - 0x10c], ebx
mov dword [ebp - 0x108], ebx
mov dword [ebp - 0x3c], 0x667a
cmp dword [ebp - 0x3c], 0x6947
pop ecx
mov dword [ebp - 0x2c], str.ykg_nrbxeqj_skgbj_vtsxbj_tbjqvbbh_deq_avpbumf_uupb_zieer_cac_wfy_heeuwtzuh
jle 0x10028f4a
push 0x14a2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, ebx
mov dword [ebp - 0x30], ebx
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov eax, edi
mov edi, ebx
cdq
idiv esi
mov esi, edx
mov eax, esi
lea ecx, [ebp - 0x224]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10028f08
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x224]
call fcn.100052fb
inc edi
cmp edi, 0x33f6
jl 0x10028ee9
mov esi, dword [ebp - 0x24]
mov edi, dword [ebp - 0x30]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x15f7
jl 0x10028ee0
inc edi
mov dword [ebp - 0x30], edi
cmp edi, 0x61ef
jl 0x10028edb
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x20], 0xc7c8a6b9
lea ecx, [ebp - 0x11c]
push 4
call fcn.10004e2c
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], 0x8a9017ca
mov dword [ebp - 0x40], 0x795e
mov dword [ebp - 0x34], 0x1b16eb2d
mov dword [ebp - 0x34], 0x5ee6d54e
mov dword [ebp - 0x24], 0x74307976
mov dword [ebp - 0x18], ebx
jmp 0x10028f9c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], 0x6695998
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10028f89
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x10028fb7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc8], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10028faa
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x11c]
neg eax
push 0
sbb eax, eax
inc eax
mov ecx, dword [esi + 4]
pop eax
sets al
sub eax, ecx
neg eax
sbb eax, eax
inc eax
imul eax, ecx
cmp dword [ebp - 0x20], eax
jne 0x10028ff2
mov eax, edx
cmp dword [esi + 4], ebx
jne 0x10028ff4
mov eax, ebx
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jne 0x10029003
mov eax, ebx
cmp dword [ebp - 0x40], ebx
je 0x10029005
mov eax, edx
cmp dword [ebp - 0x20], eax
jle 0x10029011
mov ecx, ebx
cmp dword [ebp - 0x30], ebx
je 0x10029013
mov ecx, edx
mov eax, dword [ebp - 0xc8]
sub ecx, eax
add ecx, 0xa74a
je 0x1002904d
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x34], 0x60d64c9d
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x40], 0xeec80f21
dec dword [ebp - 0x24]
jmp 0x1002916f
mov dword [ebp - 0x1c], 0xcb7be74f
mov dword [ebp - 0x1c], 0x7bc41bbb
mov dword [ebp - 0x18], 0xf0d602ff
cmp dword [ebp - 0x1c], ebx
je 0x1002906a
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
cmp eax, 1
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x1c]
je 0x10029094
cmp dword [ebp - 0x18], ebx
je 0x10029094
xor edx, edx
inc edx
jmp 0x10029096
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
test eax, eax
sets cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xc8]
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, 0xffffffff
setl dl
xor ecx, ecx
cmp eax, edx
setg cl
cmp ecx, dword [ebp - 0x18]
jg 0x10029154
push 3
lea ecx, [ebp - 0x150]
call fcn.10004e2c
mov dword [ebp - 0x1c], ebx
jmp 0x100290f0
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], 0x75d5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100290dd
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10029130
push 0x6c4
push 0x1f29
push 0x4bd
push 0x1341
push 0x2593
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
mov eax, dword [ebp - 0x150]
push eax
dec dword [eax + 8]
call fcn.1004d139
pop ecx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 0x148], ebx
jmp 0x1002916f
mov dword [ebp - 0x24], 0x573c
dec dword [ebp - 0x24]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1002916f
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x11c]
call fcn.1004d139
pop ecx
mov dword [ebp - 0x11c], ebx
lea ecx, [ebp - 0x90]
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x114], ebx
mov dword [ebp - 0x74], 0x3022801
mov dword [ebp - 0x70], 0xe050d03
mov dword [ebp - 0x6c], 0x3d043006
mov word [ebp - 0x68], 0x2600
mov dword [ebp - 0x18], 0x624cdb8f
push 4
call fcn.10004e2c
mov dword [ebp - 4], 1
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x40], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x100291ed
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x90]
mov dword [eax + ecx*4], 4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100291da
mov eax, dword [ebp - 0x90]
xor edx, edx
mov dword [eax + 4], 0xf3faa32f
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 1
mov eax, dword [ebp - 0x18]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [ebp - 0x18]
jle 0x1002923a
mov eax, dword [ebp - 0x90]
cmp dword [eax], ebx
jne 0x1002923a
mov eax, ebx
jmp 0x1002923d
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0xfffffffc
je 0x10029326
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 3
jg 0x1002931e
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10029278
push ebx
push 0x210b
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov dword [ebp - 0x1c], 0x273b
cmp dword [ebp - 0x1c], 0x2756
jle 0x100292c7
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov edi, esi
mov dword [ebp - 0x24], 0x249e
mov ebx, edi
mov esi, 0x15a1
mov eax, ebx
mov ecx, 0x10080db8
cdq
push edx
push eax
call fcn.10004c02
dec ebx
dec esi
jne 0x1002929d
dec edi
dec dword [ebp - 0x24]
jne 0x10029296
mov esi, dword [ebp - 0x30]
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x5800
jl 0x1002928d
xor ebx, ebx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x90]
cmp dword [eax + ecx*4], ebx
jne 0x10029316
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x2409
jge 0x1002930f
mov edx, str.tsdzt_lddovr_vwmshod_xpub_iezrmdk_vkpsjbcjp_xtctct_elqpfona
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x1002930f
mov dword [ebp - 4], 1
inc dword [ebp - 0x18]
jmp 0x10029256
dec dword [ebp - 0x20]
jmp 0x10029249
cmp dword [ebp - 0x90], 0
je 0x1002934d
push dword [ebp - 0x90]
call fcn.1004d139
pop ecx
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
mov cl, byte [ebp - 0x73]
mov al, cl
and cl, 0x44
or al, 0x44
movzx edx, al
movzx eax, cl
sub dx, ax
movzx eax, byte [ebp - 0x74]
push 2
pop esi
mov word [ebp + eax*2 - 0x178], dx
movzx eax, byte [ebp + esi - 0x76]
movzx edx, byte [ebp + esi - 0x73]
movzx ecx, word [ebp + eax*2 - 0x178]
mov eax, edx
and eax, ecx
add eax, eax
sub edx, eax
movzx eax, byte [ebp + esi - 0x74]
add edx, ecx
add esi, 2
mov word [ebp + eax*2 - 0x178], dx
cmp esi, 0xe
jb 0x1002936f
mov dword [ebp - 0x20], 0x9d43467
mov dword [ebp - 0x18], 0x1c9b
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x40], 0x30fc353
mov dword [ebp - 0x24], 0x91b05987
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0x760fc5c2
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x20], ebx
je 0x10029438
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp eax, 0xfffffff7
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
imul ecx, ecx, 0x82ba
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setne dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
cmp eax, 1
setl cl
mov dword [ebp - 0x24], ecx
mov ecx, 0xb481d3ef
mov eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x18]
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [ebp - 0x20]
mov dword [ebp - 0x40], eax
je 0x10029438
xor edx, edx
inc edx
jmp 0x1002943a
mov edx, ebx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x18]
setge cl
mov dword [ebp - 0x40], ecx
xor ecx, ecx
cmp dword [ebp - 0x40], eax
setg cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x24], ebx
je 0x10029491
cmp dword [ebp - 0x18], ebx
je 0x10029491
xor ecx, ecx
inc ecx
jmp 0x10029493
mov ecx, ebx
xor eax, eax
cmp ecx, 8
setle al
cmp eax, dword [ebp - 0x18]
jle 0x100294b6
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100294e3
push 1
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x100294e3
mov dword [ebp - 0x18], 0xb
jmp 0x100294dd
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100294da
push 0x1c29
push ebx
push 0x515
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1c
jne 0x100294bf
xor eax, eax
cmp dword [ebp - 0x3c], 0x643f
mov word [ebp - 0x16a], ax
jge 0x100294fe
push dword [ebp - 0x2c]
call fcn.1004cf6c
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1bc]
xor eax, eax
mov dword [ebp - 0x1a8], 7
mov word [ebp - 0x1bc], ax
lea eax, [ebp - 0x178]
push eax
mov dword [ebp - 0x1ac], ebx
call fcn.1000533f
mov dword [ebp - 4], 6
mov dword [ebp - 0x1c], ebx
jmp 0x1002954a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x20c], 0x93b4e1a3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10029539
mov dword [ebp - 0x3c], 0xb0e
cmp dword [ebp - 0x3c], 0xddd
jle 0x10029596
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10080db8
cdq
push edx
push eax
call fcn.10004c02
inc edi
cmp edi, 0x617b
jl 0x10029564
inc esi
cmp esi, 0x4e7f
jl 0x10029562
push 0x14a2
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100295ae
push ebx
push 1
push 0x6eb
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
mov byte [ebp - 4], 7
cmp dword [ebp - 0x3c], 0x97a
jge 0x100295e8
mov edx, str.bieak_ixexpm_smb_xpiwvi_tonvtx_yzycm_lpqrg_thb_dzheezl_srbvqvdst
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x100295e8
mov dword [ebp - 4], 6
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1002960d
push 0x2033
push 0xa4a
push 0x9b8
call dword [sym.imp.KERNEL32.dll_HeapCreate]
push 0xfffffffffffffffd
mov eax, ebx
pop edi
mov dword [ebp - 0x2c], eax
cmp eax, 8
jae 0x1002991f
push dword [ebp - 0x34]
movdqa xmm0, xmmword [0x100731f0]
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x200]
mov dword [ebp - 0xc0], ebx
push eax
push ebx
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0xbc], ebx
movdqu xmmword [ebp - 0x200], xmm0
mov dword [ebp - 0xb8], ebx
call fcn.10007acd
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x34], 0xaf072071
xor eax, eax
mov dword [ebp - 0x44], 0xa1c17c77
inc eax
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x34], 0x615e82aa
push eax
call fcn.10004e2c
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x4c], 0x62a4b15
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x18], 0x33e7
cmp dword [ebp - 0x18], 0x3596
jle 0x10029749
mov dword [ebp - 0x24], ebx
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov edi, esi
mov dword [ebp - 0x1c], 0x230c
mov dword [ebp - 0x30], edi
mov esi, edi
mov dword [ebp - 0x3c], 0x554f
mov edi, dword [ebp - 0x24]
mov eax, edi
lea ecx, [ebp - 0x248]
and eax, esi
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10029702
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x248]
call fcn.100052fb
dec esi
dec dword [ebp - 0x3c]
jne 0x100296e6
mov edi, dword [ebp - 0x30]
dec edi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x30], edi
jne 0x100296da
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x7622
jl 0x100296ce
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x73e4
jl 0x100296c9
push 0xfffffffffffffffd
pop edi
mov dword [ebp - 0x34], edi
cmp dword [ebp - 0x18], 0x3107
jge 0x10029760
push str.kbbpw_vbbdpmw_pddnuy_bcoo_qgip_zglrhmf_dolbnzw_mbo_aqkpyst_rifghvuy
call fcn.1004cf6c
pop ecx
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x40], 0xfffffff8
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x1c], 0x1650
cmp dword [ebp - 0x1c], 0x17b2
jle 0x100297ce
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x3c], 0x4faa
mov esi, dword [ebp - 0x24]
mov edi, ebx
mov eax, edi
mov ecx, 0x10080db8
xor eax, esi
cdq
push edx
push eax
call fcn.10004c02
inc edi
cmp edi, 0x5509
jl 0x1002979a
mov esi, dword [ebp - 0x30]
add dword [ebp - 0x24], esi
dec dword [ebp - 0x3c]
jne 0x10029795
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x559b
jl 0x1002978b
push 0xfffffffffffffffd
pop edi
mov dword [ebp - 0x40], 0xffffffff
mov byte [ebp - 4], 0xd
cmp dword [ebp - 0x1c], 0x14f6
jge 0x10029812
mov edx, str.bjyb_cuamu_tkce
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x10029812
mov dword [ebp - 4], 0xa
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], ebx
jmp 0x10029834
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0x661fbc9f
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10029821
mov dword [ebp - 0x18], ebx
jmp 0x10029850
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x144], 0x552f0c8c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1002983f
mov esi, dword [ebp - 0xc0]
cmp dword [esi + 4], ebx
jne 0x10029888
mov eax, dword [ebp - 0x40]
xor edx, edx
mov dword [ebp - 0x40], eax
inc dword [ebp - 0x24]
mov ecx, dword [ebp - 0x144]
mov eax, dword [ebp - 0x20]
add ecx, eax
mov eax, dword [ebp - 0x24]
cmp eax, ecx
setge dl
cmp edx, dword [ebp - 0x4c]
jle 0x10029888
mov ecx, ebx
jmp 0x1002988b
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0x693009c
sete al
xor edx, edx
cmp eax, 0x9fb1
setne dl
xor ecx, ecx
add edx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x38]
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x285828e8
setl dl
xor eax, eax
cmp dword [esi + 4], edx
setg al
cmp dword [ebp - 0x104], 0
mov dword [ebp - 0x38], eax
je 0x100298ea
push dword [ebp - 0x104]
call fcn.1004d139
pop ecx
mov dword [ebp - 0x104], ebx
mov dword [ebp - 0x100], ebx
mov dword [ebp - 0xfc], ebx
mov byte [ebp - 4], 6
push dword [ebp - 0xc0]
call fcn.1004d139
mov eax, dword [ebp - 0x2c]
pop ecx
xor ecx, ecx
mov dword [ebp - 0xc0], ebx
mov dword [ebp - 0xbc], ebx
mov word [ebp + eax*2 - 0x178], cx
inc eax
mov dword [ebp - 0xb8], ebx
jmp 0x10029612
push dword [ebp - 0x138]
lea ecx, [ebp - 0x1f0]
call fcn.10007fca
push 4
lea ecx, [ebp - 0xf8]
mov byte [ebp - 4], 0xf
call fcn.10004e2c
mov dword [ebp - 0x2c], 0x1ebf0ddd
mov dword [ebp - 0x20], 7
mov dword [ebp - 0x18], ebx
jmp 0x10029967
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10029954
mov dword [ebp - 0x18], ebx
jmp 0x10029983
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x254], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10029972
mov ecx, dword [ebp - 0xf8]
xor eax, eax
mov esi, dword [ecx + 4]
cmp esi, 0x4aa0d722
setg al
xor edx, edx
cmp eax, esi
mov eax, 0xf5047c4d
setg dl
cmp eax, dword [ecx]
sbb eax, eax
inc eax
sub eax, esi
neg eax
sbb eax, eax
inc eax
imul edx, eax
xor eax, eax
cmp esi, edx
setg al
xor ecx, ecx
cmp eax, esi
setne cl
xor eax, eax
cmp ecx, 8
setne al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], ebx
jmp 0x10029a26
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x34], 0xab3cf813
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x34], 0x4c6a37d7
mov dword [ebp - 0x34], 0x44426282
mov dword [ebp - 0x34], 1
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x34], 0x8dc509ca
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x38], 0xfffffff9
inc dword [ebp - 0x2c]
dec dword [ebp - 0x38]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff6
jne 0x100299dc
push dword [ebp - 0xf8]
call fcn.1004d139
mov dword [ebp - 0xf8], ebx
mov dword [ebp - 0xf4], ebx
mov dword [ebp - 0xf0], ebx
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x44], 0x378470ed
mov dword [ebp - 0x30], 0xc4365dea
mov dword [ebp - 0x38], 0xd1c1d686
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x44], 0xf2b8319b
pop ecx
mov dword [ebp - 0x20], 0xf
jmp 0x10029af8
mov dword [ebp - 0x1c], 0xfffe
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], ebx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
setne dl
sub edx, 0xb275
je 0x10029ab7
cmp dword [ebp - 0x30], ebx
je 0x10029ab7
xor ecx, ecx
inc ecx
jmp 0x10029ab9
mov ecx, ebx
mov eax, dword [ebp - 0x30]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x5e1b
setne al
imul edx, eax, 0xfffffff8
sub edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
mov dword [ebp - 0x44], ecx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xd
jge 0x10029a79
push 0x5c
pop eax
mov word [ebp - 0x48], ax
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x5c], 0x46045800
mov word [ebp - 0x58], 0x4a35
mov byte [ebp - 0x56], 0x22
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x34], 6
push 2
call fcn.10004e2c
mov dword [ebp - 0x2c], 0x2c920859
mov dword [ebp - 0x34], 0x582ba8d7
mov dword [ebp - 0x1c], ebx
jmp 0x10029b5b
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xe1b61bab
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10029b48
mov dword [ebp - 0x20], 0x19
jmp 0x10029bc4
mov dword [ebp - 0x34], 0xd4e793
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x34], 0xbf33880e
mov dword [ebp - 0x34], 0x71013923
mov dword [ebp - 0x1c], ebx
jmp 0x10029bb8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x19c], 0xc044b0bf
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10029ba7
inc dword [ebp - 0x2c]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xd
jne 0x10029b6a
cmp dword [ebp - 0xec], 0
je 0x10029bf1
push dword [ebp - 0xec]
call fcn.1004d139
pop ecx
mov dword [ebp - 0xec], ebx
mov dword [ebp - 0xe8], ebx
mov dword [ebp - 0xe4], ebx
push 2
pop esi
mov ecx, ebx
cmp esi, 2
jne 0x10029c02
push 5
pop ecx
push ecx
pop esi
jmp 0x10029c2b
movzx edx, byte [ebp + esi - 0x5b]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x5e]
movzx ecx, word [ebp + eax*2 - 0x48]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x5c]
add ecx, edx
mov word [ebp + eax*2 - 0x48], cx
mov ecx, ebx
add esi, 2
cmp esi, 7
jb 0x10029bf6
mov dword [ebp - 0x2c], 0x3d8c
cmp dword [ebp - 0x2c], 0x4128
jle 0x10029c71
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x10080db8
cdq
push edx
push eax
call fcn.10004c02
inc edi
cmp edi, 0x333
jl 0x10029c4f
inc esi
cmp esi, 0x1775
jl 0x10029c4d
mov byte [ebp - 4], 0x10
cmp dword [ebp - 0x2c], 0x3a4b
jge 0x10029cab
mov edx, str.fagbz_ccjya_dzdk_trvgpfzeh_ehoyhrq_shcthlml_movitdiqn_zltplsfcn
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x10029cab
mov dword [ebp - 4], 0xf
mov dword [ebp - 0x3c], 0x6947
cmp dword [ebp - 0x3c], 0x69e1
jle 0x10029d12
push 0x130a
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], 0x4473
mov esi, dword [ebp - 0x24]
mov edi, ebx
mov eax, edi
mov ecx, 0x10080db8
or eax, esi
cdq
push edx
push eax
call fcn.10004c02
inc edi
cmp edi, 0x2c13
jl 0x10029ce1
mov esi, dword [ebp - 0x38]
add dword [ebp - 0x24], esi
dec dword [ebp - 0x2c]
jne 0x10029cdc
inc esi
mov dword [ebp - 0x38], esi
cmp esi, 0x7022
jl 0x10029cd2
push 2
lea ecx, [ebp - 0xb4]
call fcn.10004e2c
mov byte [ebp - 4], 0x13
cmp dword [ebp - 0x3c], 0x65f3
jge 0x10029d59
mov edx, str.rrfh_jujza_ixyevjk_kzddqdp_otznozpu_thtkhxllg_ioefm_cli_nytxej_kflpds_xlbr_xmxv_lgssrie_kctqarr
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x10029d59
mov dword [ebp - 4], 0x12
lea ecx, [ebp - 0xa8]
mov dword [ebp - 0x1c], 0x9a488d5
push 3
call fcn.10004e2c
mov byte [ebp - 4], 0x15
push 3
mov dword [ebp - 0x4c], 0xe131a3a4
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10029d98
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x84], 4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10029d87
mov dword [ebp - 0x18], ebx
jmp 0x10029db5
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb4]
mov dword [eax + ecx*4], 0xef7d2668
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10029da2
mov dword [ebp - 0x18], ebx
jmp 0x10029dcf
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10029dc0
mov dword [ebp - 0x7c], ebx
cmp dword [ebp - 0x7c], 0x12
jl 0x10029e9d
mov dword [ebp - 0x3c], 0x5d53
cmp dword [ebp - 0x3c], 0x5dad
jle 0x10029e70
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x38], ebx
mov ecx, edi
mov dword [ebp - 0x44], ebx
mov edx, eax
mov edi, ebx
sar edx, cl
mov dword [ebp - 0x2c], edx
mov esi, ebx
mov eax, esi
lea ecx, [ebp - 0x26c]
xor eax, edi
or eax, edx
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10029e29
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x26c]
call fcn.100052fb
mov edx, dword [ebp - 0x2c]
inc esi
cmp esi, 0x265e
jl 0x10029e0b
inc edi
cmp edi, 0x3ebc
jl 0x10029e09
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x11eb
jl 0x10029dfb
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x6851
jl 0x10029df6
mov dword [ebp - 0x2c], 0x77dd6887
cmp dword [ebp - 0x3c], 0x5b1c
jge 0x10029e8b
push str.epq_ike_iqkgwgqjp_uwpqskrp_pbetycxt_ewnhft_pfdauz_bau_xzku
call fcn.1004cf6c
pop ecx
mov dword [ebp - 4], 0x15
inc dword [ebp - 0x2c]
inc dword [ebp - 0x7c]
jmp 0x10029dd7
cmp dword [ebp - 0x7c], 1
jne 0x10029ead
cmp dword [ebp - 0x7c], ebx
je 0x10029ead
xor edx, edx
inc edx
jmp 0x10029eaf
mov edx, ebx
mov eax, dword [ebp - 0x7c]
mov ecx, dword [ebp - 0xb4]
sub eax, edx
neg eax
sbb eax, eax
inc eax
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x7c]
mov eax, dword [ebp - 0x80]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
xor edx, edx
cmp eax, 0x9475
mov eax, dword [ebp - 0x7c]
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
imul eax, ecx, 7
inc eax
cmp eax, 0xb8f3d421
jne 0x1002a1eb
push 3
pop eax
mov dword [ebp - 0x20], 0x186e1459
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x34], 0xffffffff
push eax
call fcn.10004e2c
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x18], ebx
jmp 0x10029f32
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], 0x22a1efe0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10029f1f
mov dword [ebp - 0x18], ebx
jmp 0x10029f4e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x198], 0x760
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10029f3d
mov eax, dword [ebp - 0xa8]
dec dword [eax + 8]
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0xfffffffb
jg 0x1002a1c2
mov dword [ebp - 0x30], 0x6b786ae2
mov dword [ebp - 0x3c], 0x1c56
cmp dword [ebp - 0x3c], 0x1ca3
jle 0x1002a013
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x38], ebx
cdq
mov esi, ebx
idiv edi
mov dword [ebp - 0x2c], esi
mov eax, edx
mov dword [ebp - 0x44], eax
cdq
mov edi, ebx
idiv esi
mov esi, edx
mov eax, esi
lea ecx, [ebp - 0x290]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10029fc2
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x290]
call fcn.100052fb
inc edi
cmp edi, 0x59a1
jl 0x10029fa3
mov esi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x71af
jl 0x10029f9c
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x4fa8
jl 0x10029f8f
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x684a
jl 0x10029f8a
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x198]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], 3
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x7c], ebx
cmp dword [ebp - 0x3c], 0x18b3
jge 0x1002a049
push str.wqnoidzvn_gndpe_kucmsy_vedimh_kevsc_rizihtj_auhyrey_rsor_wfrnfhtds_bjkxclh_mgyt_xzqr_clhuxwu_mnumkqjet
call fcn.1004cf6c
pop ecx
mov dword [ebp - 4], 0x18
mov dword [ebp - 0x20], 0xfffffffe
cmp dword [ebp - 0x20], 0xffffffe6
jl 0x1002a1ba
mov dword [ebp - 0x3c], 0x7d33
cmp dword [ebp - 0x3c], 0x7e16
jle 0x1002a0e4
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x38], ebx
mov ecx, edi
mov dword [ebp - 0x44], eax
mov edi, eax
mov esi, ebx
shl edi, cl
mov eax, edi
mov ecx, esi
mov edx, ebx
shl eax, cl
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x44], eax
mov ecx, edx
sar eax, cl
mov ecx, 0x10080db8
cdq
push edx
push eax
call fcn.10004c02
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x44]
inc edx
mov dword [ebp - 0x2c], edx
cmp edx, 0x3b28
jl 0x1002a094
inc esi
cmp esi, 0x3fcb
jl 0x1002a086
mov edi, dword [ebp - 0x38]
mov eax, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x38], edi
cmp edi, 0x47b9
jl 0x1002a07b
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x2ca6
jl 0x1002a076
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 4], 0x1b
cmp dword [ebp - 0x3c], 0x7b56
jge 0x1002a121
mov edx, str.xztkowb_yqptzbiy_psiqeo_villid_mwvvizjun_yfxm_evaohlymr_ftqcy
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x1002a121
mov dword [ebp - 4], 0x18
xor edx, edx
mov eax, dword [ebp - 0xd4]
mov ecx, dword [ebp - 0x30]
mov dword [eax], 0xdb7a8971
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setl dl
sub edx, 0xffff
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
imul edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setne cl
cmp ecx, 0xdb7a8971
jle 0x1002a165
mov eax, dword [ebp - 0x2c]
mov esi, dword [ebp - 0xb4]
xor eax, eax
mov ecx, 0xfb38ba70
cmp dword [esi + 4], ebx
setg al
cmp ecx, eax
mov ecx, 0xd35eb13e
sbb eax, eax
inc eax
cmp ecx, eax
mov eax, dword [ebp - 0xa8]
sbb edx, edx
add edx, 0xffff224a
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax + 8]
setg cl
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x4c]
setle dl
imul eax, edx
add eax, 2
mov dword [esi + 4], eax
dec dword [ebp - 0x20]
jmp 0x1002a057
dec dword [ebp - 0x18]
jmp 0x10029f60
cmp dword [ebp - 0xd4], 0
je 0x1002a1f9
push dword [ebp - 0xd4]
call fcn.1004d139
pop ecx
mov dword [ebp - 0xd4], ebx
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
jmp 0x1002a1f9
mov dword [ebp - 0x44], 0xffdb42e2
mov dword [ebp - 0x44], 1
cmp dword [ebp - 0xa8], 0
je 0x1002a220
push dword [ebp - 0xa8]
call fcn.1004d139
pop ecx
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
mov dword [ebp - 0xa0], ebx
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0xb4], 0
je 0x1002a24b
push dword [ebp - 0xb4]
call fcn.1004d139
pop ecx
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
xor eax, eax
mov word [ebp - 0x46], ax
mov dword [ebp - 0x34], 0xfffffffa
mov dword [ebp - 0x34], 0xfffffff8
mov dword [ebp - 0x34], 0x251d69f4
mov dword [ebp - 0x34], 0x1891f782
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], ebx
jmp 0x1002a28a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2b8], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x1002a279
dec dword [ebp - 0x20]
mov dword [ebp - 0x20], 0x13
jmp 0x1002a2a7
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], ebx
jne 0x1002a2ad
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x1c
jge 0x1002a29c
xor eax, eax
mov dword [ebp - 0x154], 7
mov word [ebp - 0x168], ax
lea ecx, [ebp - 0x168]
lea eax, [ebp - 0x48]
mov dword [ebp - 0x158], ebx
push eax
call fcn.1000533f
mov byte [ebp - 4], 0x1d
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x20], 0xfffffffc
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 0xf
jne 0x1002a423
mov dword [ebp - 0x30], 0x22124f84
mov dword [ebp - 0x30], 2
cmp dword [ebp - 0x30], 3
jg 0x1002a41b
push 2
lea ecx, [ebp - 0xe0]
call fcn.10004e2c
mov byte [ebp - 4], 0x1e
mov dword [ebp - 0x34], 8
mov dword [ebp - 0x1c], ebx
jmp 0x1002a335
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xe0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1002a325
mov dword [ebp - 0x18], 0x35dc
cmp dword [ebp - 0x18], 0x38a8
jle 0x1002a3a7
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, esi
mov dword [ebp - 0x24], 0x791e
mov dword [ebp - 0x3c], eax
mov edi, eax
mov dword [ebp - 0x38], 0x4e60
mov eax, edi
mov esi, 0x599
mov dword [ebp - 0x2c], eax
cdq
mov ecx, 0x10080db8
push edx
push eax
call fcn.10004c02
mov eax, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x2c], eax
dec esi
jne 0x1002a36f
dec edi
dec dword [ebp - 0x38]
jne 0x1002a365
mov eax, dword [ebp - 0x3c]
dec eax
dec dword [ebp - 0x24]
mov dword [ebp - 0x3c], eax
jne 0x1002a35c
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x3144
jl 0x1002a350
mov eax, dword [ebp - 0xe0]
mov byte [ebp - 4], 0x1f
cmp dword [ebp - 0x18], 0x3498
mov dword [eax + 4], ebx
jge 0x1002a3ea
mov edx, str.bdnrxq_gokqrsxxb_nmyc_pusgd_tbfpw_kqu_cjxkhf_frk_hnp_etznhb_vlmuoevqr_hrmrgtjl_xvpncnuv
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x1002a3ea
mov dword [ebp - 4], 0x1e
mov byte [ebp - 4], 0x1d
push dword [ebp - 0xe0]
call fcn.1004d139
mov dword [ebp - 0xe0], ebx
mov dword [ebp - 0xdc], ebx
mov dword [ebp - 0xd8], ebx
inc dword [ebp - 0x30]
pop ecx
jmp 0x1002a2fe
inc dword [ebp - 0x20]
jmp 0x1002a2e6
push 0x5f
pop eax
push 2
mov dword [ebp - 0x64], 0xfc041f00
mov ecx, ebx
mov word [ebp - 0x60], 0xade5
mov byte [ebp - 0x5e], 0x6a
mov word [ebp - 0x50], ax
pop esi
cmp esi, 2
jne 0x1002a44c
push 5
pop ecx
push ecx
pop esi
jmp 0x1002a475
movzx edx, byte [ebp + esi - 0x63]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x66]
movzx ecx, word [ebp + eax*2 - 0x50]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x64]
add ecx, edx
mov word [ebp + eax*2 - 0x50], cx
mov ecx, ebx
add esi, 2
cmp esi, 7
jb 0x1002a440
mov dword [ebp - 0x3c], 0x2754
cmp dword [ebp - 0x3c], 0x2834
jle 0x1002a4cd
mov esi, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x2c], 0x57d4
mov edi, ebx
mov eax, edi
mov ecx, 0x10080db8
or eax, esi
cdq
push edx
push eax
call fcn.10004c02
inc edi
cmp edi, 0x7825
jl 0x1002a49e
dec esi
dec dword [ebp - 0x2c]
jne 0x1002a49c
mov esi, dword [ebp - 0x38]
inc esi
mov dword [ebp - 0x38], esi
cmp esi, 0x22a
jl 0x1002a492
xor eax, eax
mov byte [ebp - 4], 0x21
cmp dword [ebp - 0x3c], 0x265e
mov word [ebp - 0x4e], ax
jge 0x1002a50d
mov edx, str.vyr_msfunfqpv_fvfbxmmd
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x1002a50d
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x38], 0x761a
cmp dword [ebp - 0x38], 0x7932
jle 0x1002a56e
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x2c], 0x4b71
mov eax, edi
lea ecx, [ebp - 0x2a8]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002a549
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2a8]
call fcn.100052fb
add edi, esi
dec dword [ebp - 0x2c]
jne 0x1002a52f
inc esi
cmp esi, 0xe6a
jl 0x1002a526
mov dword [ebp - 0x1c], 0x3ae35568
cmp dword [ebp - 0x38], 0x75eb
jge 0x1002a589
push str.wbylkzzvl_nmwkinqm_djzbmee_qdmqr_ixlqmgzxr_jsde_vjuqc_hmtihrx_tvnq_ginysas_hwgtxk_jzvdr_mss_tvekkdmxg
call fcn.1004cf6c
pop ecx
mov dword [ebp - 4], 0x1d
mov dword [ebp - 0x1c], 0xffffffee
jmp 0x1002a624
push 2
lea ecx, [ebp - 0x9c]
call fcn.10004e2c
mov dword [ebp - 0x18], ebx
jmp 0x1002a5bf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x230], 0x3eb905d0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002a5ae
mov dword [ebp - 0x18], ebx
jmp 0x1002a5dd
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 0x1738ab65
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002a5ca
mov eax, dword [ebp - 0x9c]
mov dword [eax], ebx
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1002a5fb
push ebx
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
mov eax, dword [ebp - 0x9c]
inc dword [eax]
cmp dword [eax], 2
jle 0x1002a5eb
push eax
call fcn.1004d139
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x98], ebx
mov dword [ebp - 0x9c], ebx
inc dword [ebp - 0x1c]
pop ecx
cmp dword [ebp - 0x1c], 0xb
jl 0x1002a59c
xor eax, eax
mov dword [ebp - 0x1c0], 7
mov word [ebp - 0x1d4], ax
lea ecx, [ebp - 0x1d4]
lea eax, [ebp - 0x50]
mov dword [ebp - 0x1c4], ebx
push eax
call fcn.1000533f
mov byte [ebp - 4], 0x25
xor ecx, ecx
mov dword [ebp - 0x20], 0xc68ec0ae
inc ecx
mov dword [ebp - 0x30], 0xf47a6de
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x24], ebx
push 3
pop edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x54], 0xa6f44401
mov dword [ebp - 0x13c], 0xffffffff
mov dword [ebp - 0x190], 0xfffffffc
mov dword [ebp - 0x18c], 0xfffffffc
mov dword [ebp - 0x188], 0xfffffffc
mov dword [ebp - 0x184], 0xfffffffc
mov dword [ebp - 0x140], 0x299e885d
mov dword [ebp - 0x40], 0xf407293c
mov dword [ebp - 0x54], 0x1295
mov dword [ebp - 0x54], 0x6113
mov dword [ebp - 0x20], 0xfffffff5
jmp 0x1002a70a
mov dword [ebp - 0x78], 0x6cce57bf
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x2c], 0x3e2f7c62
mov dword [ebp - 0x1c], ebx
jmp 0x1002a6ff
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x278], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1002a6ee
dec dword [ebp - 0x2c]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffb
jl 0x1002a6d8
mov dword [ebp - 0x1c], 8
cmp dword [ebp - 0x1c], 0xfffffff0
jl 0x1002a8af
mov dword [ebp - 0x44], ebx
lea ecx, [ebp - 0x128]
push 4
call fcn.10004e2c
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x134]
mov dword [ebp - 0x78], 0x98dc509c
mov dword [ebp - 0x4c], 0x187b35f1
mov dword [ebp - 0x3c], 9
push 3
call fcn.10004e2c
xor edx, edx
inc edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x2c], 0x499e98c5
mov dword [ebp - 0x38], 0x267a
mov dword [ebp - 0x18], ebx
jmp 0x1002a783
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002a770
mov dword [ebp - 0x18], ebx
jmp 0x1002a79d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002a78e
mov dword [ebp - 0x18], ebx
jmp 0x1002a7b5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x180], edx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002a7a8
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x190]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x20], ebx
jne 0x1002a7e2
mov ecx, ebx
cmp dword [ebp - 0x140], ebx
je 0x1002a7e4
mov ecx, edx
mov eax, dword [ebp - 0x13c]
sub ecx, eax
mov dword [ebp - 0x184], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x134]
cmp dword [eax], 0xd872
jl 0x1002a806
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0x40f2
mov dword [ebp - 0x20], 0x2e889ec
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], 0x8cbd6cd5
mov dword [ebp - 0x30], ebx
jmp 0x1002a8e7
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x1a4], 6
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], 2
jl 0x1002a8d6
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x18]
jne 0x1002a8fb
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], ecx
cmp dword [ebp - 0x30], ebx
je 0x1002a914
cmp dword [ebp - 0x18], ebx
jne 0x1002a916
mov ecx, ebx
cmp ecx, dword [ebp - 0x1c]
jg 0x1002a920
cmp dword [ebp - 0x30], ebx
je 0x1002a923
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
test eax, eax
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x18]
sete cl
imul ecx, ecx, 0x952e
xor edx, edx
cmp ecx, eax
setg dl
add edx, 3
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], 0x1a34
cmp dword [ebp - 0x38], 0x1b5a
jle 0x1002a9c0
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov dword [ebp - 0x40], ebx
mov eax, edi
mov dword [ebp - 0x34], ebx
cdq
mov edi, ebx
idiv esi
mov dword [ebp - 0x54], edx
mov esi, ebx
mov ebx, dword [ebp - 0x54]
lea eax, [esi + edi]
mov ecx, 0x10080db8
or eax, ebx
cdq
push edx
push eax
call fcn.10004c02
inc esi
cmp esi, 0x4333
jl 0x1002a97b
inc edi
push 0
pop ebx
cmp edi, 0x368
jl 0x1002a976
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x2c]
inc esi
mov dword [ebp - 0x40], esi
cmp esi, 0x53d
jl 0x1002a969
inc edi
mov dword [ebp - 0x2c], edi
cmp edi, 0x61c7
jl 0x1002a964
mov dword [ebp - 0x20], 9
jmp 0x1002a9d8
mov dword [ebp - 0x34], 0xfffffff9
cmp dword [ebp - 0x34], ebx
jne 0x1002a9de
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 6
je 0x1002a9c9
mov byte [ebp - 4], 0x27
cmp dword [ebp - 0x38], 0x1652
jge 0x1002aa18