Function at 0x10030c23
Capabilities:
Accept command line arguments
Check for time delay via gettickcount
Contain obfuscated stackstrings
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10090875
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x698
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100332c8
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x418], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3d8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp - 0x3d8]
movzx eax, byte [eax]
test eax, eax
je 0x100332a5
mov eax, dword [ebp - 0x418]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x420]
mov dword [ebp - 0x2a0], eax
push 4
lea ecx, [ebp - 0x4e8]
call fcn.100254f9
and dword [ebp - 4], 0
mov dword [ebp - 0x110], 0xba76aabe
push 0
lea eax, [ebp - 0x4d8]
push eax
lea eax, [ebp - 0x4e8]
push eax
push 0x3b03
push 0x7d65
push 1
push 0x41c4
push 0x7c92
push 1
call fcn.1002ad58
add esp, 0x24
mov dword [ebp - 0x110], 0
jmp 0x10030cf6
mov eax, dword [ebp - 0x110]
inc eax
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 3
jg 0x10030e3d
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x4ec], 9
mov dword [ebp - 0x524], 1
mov dword [ebp - 0x4fc], 0xa5852835
mov dword [ebp - 0x13c], 0
jmp 0x10030d44
mov eax, dword [ebp - 0x13c]
inc eax
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 3
jg 0x10030e16
push 4
lea ecx, [ebp - 0x474]
call fcn.100254f9
mov byte [ebp - 4], 1
mov dword [ebp - 0x3f4], 0xffffffff
mov dword [ebp - 0x52c], 0xfffffff7
push 1
push 0x5d2b
push 0x63ab
push 0xdba
push 1
lea eax, [ebp - 0x474]
push eax
push 0x737
push 0x74c2
lea eax, [ebp - 0x534]
push eax
push 1
call fcn.1002b241
add esp, 0x28
push 0x5eed
push 1
push 1
push 1
lea eax, [ebp - 0x474]
push eax
push 0x2c6a
push 0x2759
call fcn.1002b4dc
add esp, 0x1c
push 0x7618
push 0x7c60
push 1
push 0x55fc
push 1
push 0x18c5
push 0x6ab9
push 0x239b
lea eax, [ebp - 0x3f4]
push eax
push 1
call fcn.1002d5d5
add esp, 0x28
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x474]
call fcn.1002557b
jmp 0x10030d37
push 0x3a50
push 0x7e00
push 1
push 0x7e8e
push 0x3a06
push 1
push 1
call fcn.1002b745
add esp, 0x1c
jmp 0x10030ce9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4e8]
call fcn.1002557b
mov eax, dword [0x100962ac]
and eax, 1
jne 0x10030e83
mov eax, dword [0x100962ac]
or eax, 1
mov dword [0x100962ac], eax
mov dword [ebp - 4], 2
mov ecx, 0x1009a0a0
call fcn.100255bd
push 0x10091623
call fcn.10082853
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x140], 0xffffffff
mov dword [ebp - 0x19c], 0x51abe719
mov dword [ebp - 0x38], 0xc71f8b10
mov dword [ebp - 0x16c], 0x27a8
mov dword [ebp - 0x50], 0x49c99c4d
mov dword [ebp - 0x284], 0xa14e
mov dword [ebp - 0x120], 0
jmp 0x10030ed2
mov eax, dword [ebp - 0x120]
inc eax
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 1
jge 0x10030eee
mov eax, dword [ebp - 0x120]
mov dword [ebp + eax*4 - 0x224], 0xff020a73
jmp 0x10030ec5
xor eax, eax
je 0x10030ff6
mov dword [ebp - 0x40], 0xffffffff
push 3
lea ecx, [ebp - 0x42c]
call fcn.100254f9
mov dword [ebp - 4], 3
mov dword [ebp - 0x358], 0x86a0230a
push 0x4c5e
push 1
push 0
push 1
push 0x5b88
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.1002b4dc
add esp, 0x1c
mov dword [ebp - 0x40], 0
jmp 0x10030f51
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0x1d
jg 0x10030fa6
mov dword [ebp - 0x304], 0xcf257925
lea eax, [ebp - 0x140]
push eax
push 0x210
lea eax, [ebp - 0x40]
push eax
push 1
push 0
lea eax, [ebp - 0x304]
push eax
lea eax, [ebp - 0x42c]
push eax
call fcn.1002d1ea
add esp, 0x1c
push 0x5a34
push 0x18e7
push 0x3dc7
push 0
call fcn.10033613
add esp, 0x10
jmp 0x10030f4a
lea eax, [ebp - 0x19c]
push eax
push 0x6083
push 1
lea eax, [ebp - 0x40]
push eax
push 1
lea eax, [ebp - 0x38]
push eax
push 0x3426
lea eax, [ebp - 0x42c]
push eax
lea eax, [ebp - 0x358]
push eax
lea eax, [ebp - 0x140]
push eax
push 1
call fcn.10029455
add esp, 0x2c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.1002557b
jmp 0x1003132e
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x174], 0x20eb
mov dword [ebp - 0x2c4], 0x44157f02
mov dword [ebp - 0x23c], 0x599b
mov dword [ebp - 0x30c], 0x10009268
cmp dword [ebp - 0x23c], 0x5b17
jle 0x1003114a
and dword [ebp - 0xa0], 0
jmp 0x1003104b
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x41c7
jge 0x1003114a
and dword [ebp - 0x128], 0
jmp 0x10031071
mov eax, dword [ebp - 0x128]
inc eax
mov dword [ebp - 0x128], eax
cmp dword [ebp - 0x128], 0x74ca
jge 0x10031145
and dword [ebp - 0xa8], 0
jmp 0x10031097
mov eax, dword [ebp - 0xa8]
inc eax
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0x504b
jge 0x10031140
and dword [ebp - 0x100], 0
jmp 0x100310bd
mov eax, dword [ebp - 0x100]
inc eax
mov dword [ebp - 0x100], eax
cmp dword [ebp - 0x100], 0x6b5c
jge 0x1003113b
mov eax, dword [ebp - 0xa0]
add eax, dword [ebp - 0x128]
add eax, dword [ebp - 0xa8]
or eax, dword [ebp - 0x100]
cdq
mov dword [ebp - 0x364], eax
mov dword [ebp - 0x360], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x50c], eax
push dword [ebp - 0x360]
push dword [ebp - 0x364]
lea ecx, [ebp - 0x65c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x3a4], eax
mov ecx, dword [ebp - 0x3a4]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x65c]
call fcn.100252df
jmp 0x100310b0
jmp 0x1003108a
jmp 0x10031064
jmp 0x1003103e
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x224]
sub eax, dword [ebp - 0x140]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x2c4], eax
jne 0x1003117a
mov dword [ebp - 0x21c], 1
jmp 0x10031181
and dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x16c]
cmp dword [ebp - 0x21c], eax
jle 0x1003119b
mov dword [ebp - 0x2b8], 1
jmp 0x100311a2
and dword [ebp - 0x2b8], 0
mov eax, dword [ebp - 0x2b8]
dec eax
cmp dword [ebp - 0x174], eax
jl 0x100311bd
mov dword [ebp - 0x164], 1
jmp 0x100311c4
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x164], eax
jl 0x100311de
cmp dword [ebp - 0x48], 0
jne 0x100311de
and dword [ebp - 0x27c], 0
jmp 0x100311e8
mov dword [ebp - 0x27c], 1
mov eax, dword [ebp - 0x27c]
sub eax, dword [ebp - 0x16c]
push 4
pop ecx
imul ecx, ecx, 0
cmp eax, dword [ebp + ecx - 0x224]
je 0x1003120f
mov dword [ebp - 0x2ac], 1
jmp 0x10031216
and dword [ebp - 0x2ac], 0
mov eax, dword [ebp - 0x174]
cmp dword [ebp - 0x2ac], eax
jl 0x10031236
mov eax, 0xca98
test eax, eax
jne 0x10031236
and dword [ebp - 0x17c], 0
jmp 0x10031240
mov dword [ebp - 0x17c], 1
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0x17c], eax
jne 0x10031257
mov dword [ebp - 0x22c], 1
jmp 0x1003125e
and dword [ebp - 0x22c], 0
cmp dword [ebp - 0x22c], 0xad959fc8
jbe 0x10031276
mov dword [ebp - 0x184], 1
jmp 0x1003127d
and dword [ebp - 0x184], 0
mov eax, dword [ebp - 0x184]
mov dword [ebp - 0x284], eax
mov eax, dword [ebp - 0x284]
sub eax, 0xfffa
cmp eax, dword [ebp - 0x38]
jle 0x100312a5
mov dword [ebp - 0x18c], 1
jmp 0x100312ac
and dword [ebp - 0x18c], 0
mov eax, dword [ebp - 0x38]
cmp eax, dword [ebp - 0x18c]
jg 0x100312c3
mov dword [ebp - 0x234], 1
jmp 0x100312ca
and dword [ebp - 0x234], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x234], eax
jle 0x100312e1
mov dword [ebp - 0x194], 1
jmp 0x100312e8
and dword [ebp - 0x194], 0
cmp dword [ebp - 0x194], 0xfffd
ja 0x10031300
mov dword [ebp - 0x2c8], 1
jmp 0x10031307
and dword [ebp - 0x2c8], 0
mov eax, dword [ebp - 0x48]
sub eax, dword [ebp - 0x2c8]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x23c], 0x578e
jge 0x1003132e
push dword [ebp - 0x30c]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x38], 0xfffffff9
jmp 0x1003133e
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jl 0x1003151e
mov dword [ebp - 0x1a4], 1
mov dword [ebp - 0x314], 0xf261b24c
mov dword [ebp - 0x28c], 0x202d
mov dword [ebp - 0x3b0], 0x100092b8
cmp dword [ebp - 0x28c], 0x20c8
jle 0x1003149a
and dword [ebp - 0xb0], 0
jmp 0x10031396
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x77ba
jge 0x1003149a
and dword [ebp - 0x138], 0
jmp 0x100313bc
mov eax, dword [ebp - 0x138]
inc eax
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0x3aab
jge 0x10031495
and dword [ebp - 0xb8], 0
jmp 0x100313e2
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0x569d
jge 0x10031490
and dword [ebp - 0x108], 0
jmp 0x10031408
mov eax, dword [ebp - 0x108]
inc eax
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0x232b
jge 0x1003148b
mov eax, dword [ebp - 0xb0]
cdq
idiv dword [ebp - 0x138]
mov ecx, dword [ebp - 0xb8]
sub ecx, dword [ebp - 0x108]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x370], eax
mov dword [ebp - 0x36c], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x538], eax
push dword [ebp - 0x36c]
push dword [ebp - 0x370]
lea ecx, [ebp - 0x644]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x41c]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x644]
call fcn.100252df
jmp 0x100313fb
jmp 0x100313d5
jmp 0x100313af
jmp 0x10031389
mov dword [ebp - 0x50], 0
jmp 0x100314aa
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x10031501
cmp dword [ebp - 0x1a4], 0
je 0x100314bb
jmp 0x10031501
push 0x3efd
push 0x3d49
push 0x3138
push 0x316f
push 0x71bd
push 1
push 0x1b1
lea eax, [ebp - 0x1a4]
push eax
push 1
push 0x7f86
lea eax, [ebp - 0x314]
push eax
push 1
push 0x3845
call fcn.1002da76
add esp, 0x34
jmp 0x100314a3
cmp dword [ebp - 0x28c], 0x1fc7
jge 0x10031519
push dword [ebp - 0x3b0]
call fcn.1008287d
pop ecx
jmp 0x10031337
push dword [ebp - 0x190]
lea ecx, [ebp - 0x45c]
call fcn.100252f4
mov dword [ebp - 4], 4
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x5c], 0
push 3
lea ecx, [ebp - 0x438]
call fcn.100254f9
mov byte [ebp - 4], 5
mov dword [ebp - 0x2c], 0
jmp 0x10031568
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x1003157e
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0x444], 0xfffffff9
jmp 0x10031561
mov dword [ebp - 0x2c], 0
jmp 0x1003158e
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 3
jge 0x100315aa
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x438]
call fcn.10025597
mov dword [eax], 0x8bc0d133
jmp 0x10031587
mov eax, dword [ebp - 0x154]
sub eax, dword [ebp - 0x5c]
imul eax, dword [ebp - 0x5c]
cmp eax, 0xa32a17d0
ja 0x100315ca
mov dword [ebp - 0x1ac], 1
jmp 0x100315d1
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x5c]
cmp dword [ebp - 0x1ac], eax
jge 0x100315e8
mov dword [ebp - 0x244], 1
jmp 0x100315ef
and dword [ebp - 0x244], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x244], eax
jl 0x10031609
mov dword [ebp - 0x1b4], 1
jmp 0x10031610
and dword [ebp - 0x1b4], 0
cmp dword [ebp - 0x1b4], 0
jb 0x10031625
mov dword [ebp - 0x2b4], 1
jmp 0x1003162c
and dword [ebp - 0x2b4], 0
cmp dword [ebp - 0x2b4], 0x512a
je 0x10031644
mov dword [ebp - 0x1bc], 1
jmp 0x1003164b
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x1bc]
shl eax, 1
jne 0x10031667
mov eax, 0xcfd6
test eax, eax
jne 0x10031667
and dword [ebp - 0x14c], 0
jmp 0x10031671
mov dword [ebp - 0x14c], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x14c]
mov dword [ebp + eax - 0x444], ecx
mov eax, dword [ebp - 0x14c]
sub eax, 0x448112de
cmp dword [ebp - 0x5c], eax
jne 0x100316a0
mov dword [ebp - 0x24c], 1
jmp 0x100316a7
and dword [ebp - 0x24c], 0
push 0
lea ecx, [ebp - 0x438]
call fcn.10025597
mov ecx, dword [ebp - 0x24c]
mov dword [eax], ecx
mov dword [ebp - 0x2cc], 0x4a43
mov dword [ebp - 0x404], 0x10009308
cmp dword [ebp - 0x2cc], 0x4cec
jle 0x100317c4
and dword [ebp - 0xc8], 0
jmp 0x100316f6
mov eax, dword [ebp - 0xc8]
inc eax
mov dword [ebp - 0xc8], eax
cmp dword [ebp - 0xc8], 0x22a7
jge 0x100317c4
and dword [ebp - 0xc0], 0
jmp 0x1003171c
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x2cb8
jge 0x100317bf
and dword [ebp - 0x11c], 0
jmp 0x10031742
mov eax, dword [ebp - 0x11c]
inc eax
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x11c], 0x6317
jge 0x100317ba
mov eax, dword [ebp - 0xc0]
and eax, dword [ebp - 0x11c]
or eax, dword [ebp - 0xc8]
cdq
mov dword [ebp - 0x37c], eax
mov dword [ebp - 0x378], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x514], eax
push dword [ebp - 0x378]
push dword [ebp - 0x37c]
lea ecx, [ebp - 0x674]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x31c], eax
mov ecx, dword [ebp - 0x31c]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x674]
call fcn.100252df
jmp 0x10031735
jmp 0x1003170f
jmp 0x100316e9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x444]
mov dword [ebp - 0x1c4], eax
push 1
lea ecx, [ebp - 0x438]
call fcn.10025597
mov ecx, dword [ebp - 0x1c4]
mov dword [eax], ecx
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x444]
cmp eax, dword [ebp - 0x1c4]
je 0x1003180d
mov dword [ebp - 0x294], 1
jmp 0x10031814
and dword [ebp - 0x294], 0
cmp dword [ebp - 0x294], 0
jbe 0x10031829
mov dword [ebp - 0x1cc], 1
jmp 0x10031830
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x558], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x4a4], eax
mov eax, 0xff57
cmp eax, 0xe70
jl 0x1003185d
mov dword [ebp - 0x254], 1
jmp 0x10031864
and dword [ebp - 0x254], 0
mov eax, dword [ebp - 0x1cc]
cmp eax, dword [ebp - 0x254]
jge 0x1003187e
mov dword [ebp - 0x1d4], 1
jmp 0x10031885
and dword [ebp - 0x1d4], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x1d4]
mov dword [ebp + eax - 0x444], ecx
cmp dword [ebp - 0x2cc], 0x49cb
jge 0x100318b0
push dword [ebp - 0x404]
call fcn.1008287d
pop ecx
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x438]
call fcn.1002557b
lea eax, [ebp - 0x4a8]
push eax
lea ecx, [ebp - 0x45c]
call fcn.10025be7
push dword [eax]
lea eax, [ebp - 0x4b0]
push eax
lea ecx, [ebp - 0x45c]
call fcn.10025bfb
push dword [eax]
lea eax, [ebp - 0x4b8]
push eax
lea ecx, [ebp - 0x45c]
call fcn.10025be7
push dword [eax]
mov edx, 0x10027503
lea ecx, [ebp - 0x4c0]
call fcn.1004d914
add esp, 0xc
lea ecx, [ebp - 0x45c]
call fcn.1002748e
mov dword [ebp - 0x198], eax
push 0x2c5f
push 0x74fe
push 0x1246
push 1
push 0x44f0
push 1
push 0
call fcn.1002c800
add esp, 0x1c
movzx eax, byte [0x1009a010]
test eax, eax
je 0x10031ad6
mov ecx, 0x1009a0a0
call fcn.1004d5f9
movzx eax, al
test eax, eax
jne 0x10031ad6
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp - 0x1dc]
push eax
mov ecx, 0x1009a0a0
call fcn.10025682
push 0x3099
push 0x6a22
push 0x719
push 1
push 1
call fcn.10029ebe
add esp, 0x14
lea eax, [ebp - 0x4c8]
push eax
mov ecx, 0x1009a0a0
call fcn.10025674
push eax
lea ecx, [ebp - 0x1dc]
call fcn.10025697
movzx eax, al
test eax, eax
je 0x10031ad6
mov dword [ebp - 0x25c], 0x78c6
mov dword [ebp - 0x3bc], 0x10009360
cmp dword [ebp - 0x25c], 0x7b1c
jle 0x10031a94
and dword [ebp - 0x98], 0
jmp 0x100319fa
mov eax, dword [ebp - 0x98]
inc eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0x688f
jge 0x10031a94
and dword [ebp - 0xd0], 0
jmp 0x10031a20
mov eax, dword [ebp - 0xd0]
inc eax
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0x2c47
jge 0x10031a8f
mov eax, dword [ebp - 0x98]
sub eax, dword [ebp - 0xd0]
cdq
mov dword [ebp - 0x388], eax
mov dword [ebp - 0x384], edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x4d0], eax
push dword [ebp - 0x384]
push dword [ebp - 0x388]
lea ecx, [ebp - 0x6a4]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x324], eax
mov ecx, dword [ebp - 0x324]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x6a4]
call fcn.100252df
jmp 0x10031a13
jmp 0x100319ed
lea ecx, [ebp - 0x1dc]
call fcn.1004d602
mov ecx, dword [ebp - 0x2a0]
mov eax, dword [eax + 4]
mov dword [ecx], eax
cmp dword [ebp - 0x25c], 0x77e4
jge 0x10031ac2
push dword [ebp - 0x3bc]
call fcn.1008287d
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x45c]
call fcn.1002538c
jmp 0x100335d6
and dword [ebp - 0x4c], 0
lea eax, [ebp - 0x45c]
push eax
call fcn.10028da9
pop ecx
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x10032ae4
push 0x1939
push 1
push 0x64ac
push 0x3298
push 0x57ba
push 0x7676
push 1
push 0x1c98
push 0x4e5c
push 0x80e
call fcn.1002dda6
add esp, 0x28
cmp dword [0x1009a014], 0
jne 0x100327f7
mov dword [ebp - 0x24], 0x6d8d
mov dword [ebp - 0x148], 8
push 4
lea ecx, [ebp - 0x468]
call fcn.100254f9
mov byte [ebp - 4], 6
mov dword [ebp - 0x414], 0xc013cef3
lea eax, [ebp - 0x58]
push eax
push 0x4b67
push 1
push 0x23d
push 0x4017
push 0x55b0
push 0x1325
push 0x712b
push 0x15ba
push 0x7d54
lea eax, [ebp - 0x468]
push eax
push 1
push 0x7bf2
push 0x3f00
call fcn.1002b9ef
add esp, 0x38
mov dword [ebp - 0x58], 0
jmp 0x10031bba
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x10031bd0
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x568], 0
jmp 0x10031bb3
mov eax, 0xddd3
test eax, eax
je 0x10031cdb
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4a0], eax
xor eax, eax
inc eax
cmp eax, 1
jae 0x10031bfa
mov dword [ebp - 0x1e4], 1
jmp 0x10031c01
and dword [ebp - 0x1e4], 0
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x1e4]
sub eax, ecx
cmp eax, dword [ebp - 0x24]
jge 0x10031c20
mov dword [ebp - 0x29c], 1
jmp 0x10031c27
and dword [ebp - 0x29c], 0
mov eax, dword [ebp - 0x29c]
neg eax
je 0x10031c43
cmp dword [ebp - 0x24], 0
je 0x10031c43
mov dword [ebp - 0x1ec], 1
jmp 0x10031c4a
and dword [ebp - 0x1ec], 0
cmp dword [ebp - 0x1ec], 0x4d3ec93c
jne 0x10031c62
mov dword [ebp - 0x264], 1
jmp 0x10031c69
and dword [ebp - 0x264], 0
mov eax, dword [ebp - 0x264]
mov dword [ebp - 0x148], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x53c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x544], eax
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x148], eax
jge 0x10031ca1
mov dword [ebp - 0x1f4], 1
jmp 0x10031ca8
and dword [ebp - 0x1f4], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x1f4], eax
je 0x10031cbf
mov dword [ebp - 0x32c], 1
jmp 0x10031cc6
and dword [ebp - 0x32c], 0
mov eax, 0x7cde
test eax, eax
je 0x10031cdb
mov dword [ebp - 0x2bc], 1
jmp 0x10031ce2
and dword [ebp - 0x2bc], 0
mov eax, dword [ebp - 0x2bc]
sub eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x24]
jne 0x10031cfc
mov dword [ebp - 0x150], 1
jmp 0x10031d03
and dword [ebp - 0x150], 0
push 2
lea ecx, [ebp - 0x468]
call fcn.10025597
mov ecx, dword [ebp - 0x150]
mov dword [eax], ecx
cmp dword [ebp - 0x150], 0
je 0x10031d3c
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x568], 0
je 0x10031d3c
mov dword [ebp - 0x1fc], 1
jmp 0x10031d43
and dword [ebp - 0x1fc], 0
mov eax, dword [ebp - 0x1fc]
mov dword [ebp - 0x414], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x468]
call fcn.1002557b
push 4
lea ecx, [ebp - 0x3e8]
call fcn.100254f9
mov byte [ebp - 4], 7
mov dword [ebp - 0x34], 0xfffffffc
mov dword [ebp - 0x2fc], 0x2c593c86
mov dword [ebp - 0x354], 0xfffffffb
mov dword [ebp - 0x54c], 0xb4b5a9ce
mov dword [ebp - 0x554], 0x578cca6
mov dword [ebp - 0x33c], 0x2305aba9
push 0x2f87
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x680a
push 0
push 1
push 1
call fcn.10030c23
add esp, 0x1c
mov dword [ebp - 0x10], 0
jmp 0x10031ddb
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031df1
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x59c], 0x5cd1d2a6
jmp 0x10031dd4
mov dword [ebp - 0x10], 0
jmp 0x10031e01
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10031e17
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x520], 0
jmp 0x10031dfa
mov dword [ebp - 0x10], 0
jmp 0x10031e27
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x10031e3d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x574], 0x12f6
jmp 0x10031e20
mov dword [ebp - 0x34], 3
jmp 0x10031e4d
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x10032294
mov dword [ebp - 0x28], 0xa772304b
mov dword [ebp - 0x15c], 0xccedb775
mov dword [ebp - 0x20c], 2
mov dword [ebp - 0x28], 0
jmp 0x10031e82
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x10031ea0
push 0x21f6
push 1
push 1
push 0x303e
call fcn.1002e52e
add esp, 0x10
jmp 0x10031e7b
mov dword [ebp - 0x28], 3
jmp 0x10031eb0
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1003228f
mov dword [ebp - 0x55c], 0xffffffff
mov dword [ebp - 0x144], 0xffff
mov dword [ebp - 0x124], 0
jmp 0x10031ee7
mov eax, dword [ebp - 0x124]
inc eax
mov dword [ebp - 0x124], eax
cmp dword [ebp - 0x124], 1
jge 0x10031f03
mov eax, dword [ebp - 0x124]
mov dword [ebp + eax*4 - 0x3dc], 1
jmp 0x10031eda
cmp dword [ebp - 0x28], 0
je 0x10031f82
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x334], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c8], eax
mov eax, dword [ebp - 0x144]
dec eax
mov dword [ebp - 0x144], eax
mov eax, dword [ebp - 0x334]
cmp eax, dword [ebp - 0x3c8]
jne 0x10031f45
mov dword [ebp - 0x26c], 1
jmp 0x10031f4c
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x33c]
cmp dword [ebp - 0x26c], eax
jge 0x10031f66
mov dword [ebp - 0x204], 1
jmp 0x10031f6d
and dword [ebp - 0x204], 0
cmp dword [ebp - 0x204], 0xfffffff6
jae 0x10031f82
mov dword [ebp - 0x2a4], 1
jmp 0x10031f89
and dword [ebp - 0x2a4], 0
mov eax, dword [ebp - 0x2fc]
add eax, dword [ebp - 0x2a4]
cmp eax, 0x1ec2
jne 0x10031fa8
mov dword [ebp - 0x344], 1
jmp 0x10031faf
and dword [ebp - 0x344], 0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x3e8]
call fcn.10025597
mov dword [ebp - 0x3d4], eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3e8]
call fcn.10025597
mov ecx, dword [ebp - 0x3d4]
mov eax, dword [eax]
mov dword [ecx], eax
cmp dword [ebp - 0x34], 0
je 0x10031ff6
mov eax, 0x449e
test eax, eax
je 0x10031ff6
mov dword [ebp - 0x34c], 1
jmp 0x10031ffd
and dword [ebp - 0x34c], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x520]
mov dword [ebp - 0x504], eax
push 4
pop eax
shl eax, 1
mov ecx, dword [ebp - 0x20c]
cmp dword [ebp + eax - 0x574], ecx
jge 0x10032030
mov dword [ebp - 0x274], 1
jmp 0x10032037
and dword [ebp - 0x274], 0
mov eax, dword [ebp - 0x20c]
cmp dword [ebp - 0x274], eax
jne 0x10032051
mov dword [ebp - 0x3f8], 1
jmp 0x10032058
and dword [ebp - 0x3f8], 0
cmp dword [ebp - 0x15c], 0xe6ee
je 0x10032070
mov dword [ebp - 0x214], 1
jmp 0x10032077
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x354]
cmp dword [ebp - 0x214], eax
jle 0x10032091
mov dword [ebp - 0x2c0], 1
jmp 0x10032098
and dword [ebp - 0x2c0], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x3dc]
cmp dword [ebp - 0x2c0], eax
jge 0x100320b9
mov dword [ebp - 0x160], 1
jmp 0x100320c0
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x15c]
cmp dword [ebp - 0x160], eax
jge 0x100320da
mov dword [ebp - 0x168], 1
jmp 0x100320e1
and dword [ebp - 0x168], 0
xor eax, eax
sub eax, dword [ebp - 0x168]
je 0x10032110
push 0x3e03
push 0x5a5a
push 1
push 1
push 0x3431
push 0x7255
call fcn.1002c35a
add esp, 0x18
jmp 0x10032275
mov dword [ebp - 0x170], 0x5415
mov dword [ebp - 0x400], 0x100093a8
cmp dword [ebp - 0x170], 0x5552
jle 0x1003221a
and dword [ebp - 0xd8], 0
jmp 0x1003214a
mov eax, dword [ebp - 0xd8]
inc eax
mov dword [ebp - 0xd8], eax
cmp dword [ebp - 0xd8], 0x37d7
jge 0x1003221a
and dword [ebp - 0x118], 0
jmp 0x10032170
mov eax, dword [ebp - 0x118]
inc eax
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0x6678
jge 0x10032215
and dword [ebp - 0xe0], 0
jmp 0x10032196
mov eax, dword [ebp - 0xe0]
inc eax
mov dword [ebp - 0xe0], eax
cmp dword [ebp - 0xe0], 0xc6d
jge 0x10032210
mov eax, dword [ebp - 0xd8]
sub eax, dword [ebp - 0x118]
mov ecx, dword [ebp - 0xe0]
shl eax, cl
cdq
mov dword [ebp - 0x394], eax
mov dword [ebp - 0x390], edx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [ebp - 0x540], eax
push dword [ebp - 0x390]
push dword [ebp - 0x394]
lea ecx, [ebp - 0x68c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x35c], eax
mov ecx, dword [ebp - 0x35c]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x68c]
call fcn.100252df
jmp 0x10032189
jmp 0x10032163
jmp 0x1003213d
mov byte [ebp - 0x3a], 0
push 0x3257
push 0xc8a
push 0x2f5a
push 0x1ac7
push 0x6bcb
push 1
push 0x492d
push 0x3820
push 0
push 0x7aca
push 0x6f87
push 1
lea eax, [ebp - 0x3a]
push eax
call fcn.1002da76
add esp, 0x34
cmp dword [ebp - 0x170], 0x525e
jge 0x10032275
push dword [ebp - 0x400]
call fcn.1008287d
pop ecx
push dword [ebp - 0x34]
lea ecx, [ebp - 0x3e8]
call fcn.10025597
cmp dword [eax], 0
je 0x1003228a
jmp 0x1003228f
jmp 0x10031ea9
jmp 0x10031e46
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x3e8]
call fcn.1002557b
mov byte [ebp - 0x78], 2
mov byte [ebp - 0x77], 0x7a
mov byte [ebp - 0x76], 7
mov byte [ebp - 0x75], 0x40
mov byte [ebp - 0x74], 9
mov byte [ebp - 0x73], 0x56
mov byte [ebp - 0x72], 1
mov byte [ebp - 0x71], 0x39
mov byte [ebp - 0x70], 0xa
mov byte [ebp - 0x6f], 8
mov byte [ebp - 0x6e], 0xb
mov byte [ebp - 0x6d], 0
mov byte [ebp - 0x6c], 6
mov byte [ebp - 0x6b], 0x5f
mov byte [ebp - 0x6a], 4
mov byte [ebp - 0x69], 0x56
mov byte [ebp - 0x68], 8
mov byte [ebp - 0x67], 0x4b
mov byte [ebp - 0x66], 0
mov byte [ebp - 0x65], 0x65
mov byte [ebp - 0x64], 5
mov byte [ebp - 0x63], 0x27
mov byte [ebp - 0x62], 1
mov byte [ebp - 0x61], 9
mov byte [ebp - 0x60], 3
mov byte [ebp - 0x5f], 0xb
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x78]
or eax, 8
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x78]
and ecx, 8
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x78]
mov word [ebp + ecx*2 - 0x49c], ax
mov dword [ebp - 0x1c], 2
and dword [ebp - 0x12c], 0
jmp 0x10032354
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1a
jae 0x1003241d
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x78]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x1c], eax
jne 0x10032395
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x78]
inc eax
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x78]
mov ecx, dword [ebp - 0x1c]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x1c], eax
jmp 0x1003234c
mov eax, dword [ebp - 0x1c]
movzx eax, byte [ebp + eax - 0x77]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x12c]
movzx ecx, byte [ebp + ecx - 0x7a]
movzx ecx, word [ebp + ecx*2 - 0x49c]
or eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x77]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x12c]
movzx edx, byte [ebp + edx - 0x7a]
movzx edx, word [ebp + edx*2 - 0x49c]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
movzx ecx, byte [ebp + ecx - 0x78]
mov word [ebp + ecx*2 - 0x49c], ax
push 1
push 0x1d66
push 0x2d31
push 0x5f79
push 0xec1
push 0x6f7f
push 1
push 0x2277
lea eax, [ebp - 0x12c]
push eax
call fcn.1002a26b
add esp, 0x24
jmp 0x1003234c
push 2
pop eax
imul eax, eax, 0xc
xor ecx, ecx
mov word [ebp + eax - 0x49c], cx
push 0x7560
push 1
push 0x24d4
push 1
call fcn.1002c44f
add esp, 0x10
lea eax, [ebp - 0x49c]
push eax
lea ecx, [ebp - 0x5fc]
call fcn.1004d535
mov dword [ebp - 0x368], eax
mov eax, dword [ebp - 0x368]
mov dword [ebp - 0x3ec], eax
mov byte [ebp - 4], 8
push dword [ebp - 0x3ec]
call fcn.10028da9
pop ecx
mov dword [ebp - 0x180], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5fc]
call fcn.1002538c
and dword [ebp - 0xe8], 0
jmp 0x100324a2
mov eax, dword [ebp - 0xe8]
inc eax
mov dword [ebp - 0xe8], eax
cmp dword [ebp - 0xe8], 0xd
jae 0x100324bd
xor eax, eax
mov ecx, dword [ebp - 0xe8]
mov word [ebp + ecx*2 - 0x49c], ax
jmp 0x10032495
cmp dword [ebp - 0x180], 0
je 0x100327f7
mov byte [ebp - 0x94], 1
mov byte [ebp - 0x93], 0xe4
mov byte [ebp - 0x92], 7
mov byte [ebp - 0x91], 0x1d
mov byte [ebp - 0x90], 2
mov byte [ebp - 0x8f], 0x49
mov byte [ebp - 0x8e], 0x50
mov byte [ebp - 0x8d], 3
mov byte [ebp - 0x8c], 0x16
mov byte [ebp - 0x8b], 6
mov byte [ebp - 0x8a], 6
mov byte [ebp - 0x89], 5
mov byte [ebp - 0x88], 0xb
mov byte [ebp - 0x87], 4
mov byte [ebp - 0x86], 0x25
mov byte [ebp - 0x85], 0
mov byte [ebp - 0x84], 0
mov byte [ebp - 0x83], 8
mov byte [ebp - 0x82], 0x2d
mov byte [ebp - 0x81], 2
mov byte [ebp - 0x80], 0
mov byte [ebp - 0x7f], 9
mov byte [ebp - 0x7e], 0x13
mov byte [ebp - 0x7d], 0xb
mov byte [ebp - 0x7c], 0x25
mov byte [ebp - 0x7b], 0xa
mov byte [ebp - 0x7a], 0x2e
xor eax, eax
inc eax
shl eax, 0
movzx eax, byte [ebp + eax - 0x94]
or eax, 0x8b
xor ecx, ecx
inc ecx
shl ecx, 0
movzx ecx, byte [ebp + ecx - 0x94]
and ecx, 0x8b
sub eax, ecx
xor ecx, ecx
inc ecx
imul ecx, ecx, 0
movzx ecx, byte [ebp + ecx - 0x94]
mov byte [ebp + ecx - 0x2f8], al
mov dword [ebp - 0x14], 2
and dword [ebp - 0x130], 0
jmp 0x100325c8
mov eax, dword [ebp - 0x14]
inc eax
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1b
jae 0x10032777
xor eax, eax
inc eax
imul eax, eax, 0
movzx eax, byte [ebp + eax - 0x94]
lea eax, [eax + eax + 2]
cmp dword [ebp - 0x14], eax
jne 0x10032612
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x94]
inc eax
mov dword [ebp - 0x130], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x94]
mov ecx, dword [ebp - 0x14]
lea eax, [ecx + eax - 1]
mov dword [ebp - 0x14], eax
jmp 0x100325c0
mov eax, dword [ebp - 0x14]
movzx eax, byte [ebp + eax - 0x93]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x130]
movzx ecx, byte [ebp + ecx - 0x96]
movsx ecx, byte [ebp + ecx - 0x2f8]
or eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x93]
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x130]
movzx edx, byte [ebp + edx - 0x96]
movsx edx, byte [ebp + edx - 0x2f8]
and ecx, edx
sub eax, ecx
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ebp + ecx - 0x94]
mov byte [ebp + ecx - 0x2f8], al
mov dword [ebp - 0x178], 0x9d3
mov dword [ebp - 0x408], 0x100093f8
cmp dword [ebp - 0x178], 0xbcf
jle 0x10032747
and dword [ebp - 0x134], 0
jmp 0x100326ac
mov eax, dword [ebp - 0x134]
inc eax
mov dword [ebp - 0x134], eax
cmp dword [ebp - 0x134], 0x3876
jge 0x10032747
and dword [ebp - 0xf0], 0
jmp 0x100326d2
mov eax, dword [ebp - 0xf0]
inc eax
mov dword [ebp - 0xf0], eax
cmp dword [ebp - 0xf0], 0x17e1
jge 0x10032742
mov eax, dword [ebp - 0x134]
sub eax, dword [ebp - 0xf0]
cdq
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x39c], edx
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov word [ebp - 0x3f0], ax
push dword [ebp - 0x39c]
push dword [ebp - 0x3a0]
lea ecx, [ebp - 0x5b4]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x374], eax
mov ecx, dword [ebp - 0x374]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x5b4]
call fcn.100252df
jmp 0x100326c5
jmp 0x1003269f
push 1
push 1
lea eax, [ebp - 0x130]
push eax
call fcn.1002e662
add esp, 0xc
cmp dword [ebp - 0x178], 0x708
jge 0x10032772
push dword [ebp - 0x408]
call fcn.1008287d
pop ecx
jmp 0x100325c0
xor eax, eax
inc eax
imul eax, eax, 0xc
mov byte [ebp + eax - 0x2f8], 0
lea eax, [ebp - 0x2f8]
push eax
lea ecx, [ebp - 0x58c]
call fcn.1004d56d
mov byte [ebp - 4], 9
and dword [ebp - 0xf8], 0
jmp 0x100327b1
mov eax, dword [ebp - 0xf8]
inc eax
mov dword [ebp - 0xf8], eax
cmp dword [ebp - 0xf8], 0xd
jae 0x100327ca
mov eax, dword [ebp - 0xf8]
mov byte [ebp + eax - 0x2f8], 0
jmp 0x100327a4
push 0
push 0
lea eax, [ebp - 0x58c]
push eax
push dword [ebp - 0x180]
call fcn.1003ae48
add esp, 0x10
mov dword [0x1009a014], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x58c]
call fcn.10025466
mov dword [ebp - 0xc4], 6
mov dword [ebp - 0x4ac], 0x9aed23b6
mov dword [ebp - 0x528], 0x53072226
mov dword [ebp - 0x4b4], 0xfffffffc
mov dword [ebp - 0x188], 0x7795
mov dword [ebp - 0x410], 0x10009430
cmp dword [ebp - 0x188], 0x7ad6
jle 0x1003295e
and dword [ebp - 0x9c], 0
jmp 0x10032859
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0x19c4
jge 0x1003295e
and dword [ebp - 0xa4], 0
jmp 0x1003287f
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0x6061
jge 0x10032959
and dword [ebp - 0xac], 0
jmp 0x100328a5
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0x7fae
jge 0x10032954
and dword [ebp - 0xb4], 0
jmp 0x100328cb
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x6049
jge 0x1003294f
mov eax, dword [ebp - 0x9c]
cdq
idiv dword [ebp - 0xa4]
mov ecx, dword [ebp - 0xac]
imul ecx, dword [ebp - 0xb4]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a8], edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0x550], eax
push dword [ebp - 0x3a8]
push dword [ebp - 0x3ac]
lea ecx, [ebp - 0x62c]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x380], eax
mov ecx, dword [ebp - 0x380]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x62c]
call fcn.100252df
jmp 0x100328be
jmp 0x10032898
jmp 0x10032872
jmp 0x1003284c
mov dword [ebp - 0x4bc], 0x1ff2
cmp dword [ebp - 0x188], 0x7559
jge 0x10032980
push dword [ebp - 0x410]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x38c], 0x17b722ba
mov dword [ebp - 0xbc], 0
jmp 0x100329a3
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 2
jge 0x100329bf
mov eax, dword [ebp - 0xbc]
mov dword [ebp + eax*4 - 0x594], 1
jmp 0x10032996
push 0x28db
push 0x3664
push 1
push 1
push 0x605e
push 0x4bc9
push 0x3dbf
push 1
call fcn.1002c5e2
add esp, 0x20
mov dword [ebp - 0xc4], 1
jmp 0x100329ff
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x1a
jle 0x10032ac6
mov dword [ebp - 0x530], 0xfffffffa
mov dword [ebp - 0x4c4], 0
push 3
lea ecx, [ebp - 0x4f8]
call fcn.100254f9
mov byte [ebp - 4], 0xa
push 0x7779
lea eax, [ebp - 0x4f8]
push eax
push 1
push 0x53a1
push 1
push 0x2bc2
push 0x7b48
lea eax, [ebp - 0x500]
push eax
push 0x27cf
push 0
call fcn.1002d5d5
add esp, 0x28
push 0xf47
push 0x7d31
push 0x54c
push 1
lea eax, [ebp - 0x38c]
push eax
push 0x6799
push 1
push 0x7b7c
push 0x5400
call fcn.1002e97f
add esp, 0x24
push 0x1634
push 1
push 0x5f98
push 1
push 0x1923
call fcn.1002eb74
add esp, 0x14
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x4f8]
call fcn.1002557b
jmp 0x100329f2
cmp dword [0x1009a014], 0
je 0x10032ae4
mov ecx, dword [ebp - 0x190]
call fcn.100253eb
push eax
call dword [0x1009a014]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x40c], 0xa8f93905
push 0x2eb2
lea eax, [ebp - 0x40c]
push eax
push 0
push 0x1412
push 0x35ae
call fcn.1004978c
add esp, 0x14
push 0x50bd
push 0
push 1
push 0x2425
call fcn.1002e52e
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push 0x3bcb
push 0x33c7
push 1
lea eax, [ebp - 0x198]
push eax
push 1
push 0x1009a010
push 0x7136
push 0x1009a0a0
call fcn.1002cc7e
add esp, 0x24
mov dword [ebp - 0x18], 0x1c5534bf
mov dword [ebp - 0x20], 0xfffffff8
mov dword [ebp - 0x30], 0x7d6c5051
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x4cc], eax
cmp dword [ebp - 0x18], 0xd5be
jg 0x10032b87
mov dword [ebp - 0x1a0], 1
jmp 0x10032b8e
and dword [ebp - 0x1a0], 0
cmp dword [ebp - 0x1a0], 0x7f191253
jg 0x10032ba6
mov dword [ebp - 0x1a8], 1
jmp 0x10032bad
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x18]
jne 0x10032bc7
mov dword [ebp - 0x1b0], 1
jmp 0x10032bce
and dword [ebp - 0x1b0], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x1b0], eax
jne 0x10032be5
mov dword [ebp - 0x1b8], 1
jmp 0x10032bec
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1b8]
jge 0x10032c03
mov dword [ebp - 0x1c0], 1
jmp 0x10032c0a
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c0]
cmp eax, 0xab19
jne 0x10032c26
mov dword [ebp - 0x1c8], 1
jmp 0x10032c2d
and dword [ebp - 0x1c8], 0
mov eax, dword [ebp - 0x1c8]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10032c4b
cmp dword [ebp - 0x20], 0
jne 0x10032c4b
and dword [ebp - 0x398], 0
jmp 0x10032c55
mov dword [ebp - 0x398], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x18], 0x53b1dab5
je 0x10032c79
cmp dword [ebp - 0x20], 0
je 0x10032c79
mov dword [ebp - 0x1d0], 1
jmp 0x10032c80
and dword [ebp - 0x1d0], 0
cmp dword [ebp - 0x1d0], 1
jl 0x10032c95
mov dword [ebp - 0x1d8], 1
jmp 0x10032c9c
and dword [ebp - 0x1d8], 0
imul eax, dword [ebp - 0x1d8], 3
cmp eax, 0x6193fe69
jg 0x10032cb6
mov dword [ebp - 0x1e0], 1
jmp 0x10032cbd
and dword [ebp - 0x1e0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1e0], eax
jg 0x10032cd4
mov dword [ebp - 0x1e8], 1
jmp 0x10032cdb
and dword [ebp - 0x1e8], 0
imul eax, dword [ebp - 0x1e8], 0xede0
test eax, eax
jne 0x10032cf5
mov dword [ebp - 0x1f0], 1
jmp 0x10032cfc
and dword [ebp - 0x1f0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x1f0], eax
jg 0x10032f58
mov dword [ebp - 0x1f8], 0x55f7
mov dword [ebp - 0x300], 0x10009490
cmp dword [ebp - 0x1f8], 0x585b
jle 0x10032ddf
and dword [ebp - 0xcc], 0
jmp 0x10032d45
mov eax, dword [ebp - 0xcc]
inc eax
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 0x5a3
jge 0x10032ddf
and dword [ebp - 0xd4], 0
jmp 0x10032d6b
mov eax, dword [ebp - 0xd4]
inc eax
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0x5a2d
jge 0x10032dda
mov eax, dword [ebp - 0xcc]
sub eax, dword [ebp - 0xd4]
cdq
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x4d4], eax
push dword [ebp - 0x3b4]
push dword [ebp - 0x3b8]
lea ecx, [ebp - 0x5cc]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x3fc], eax
mov ecx, dword [ebp - 0x3fc]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x5cc]
call fcn.100252df
jmp 0x10032d5e
jmp 0x10032d38
push 2
lea ecx, [ebp - 0x2e8]
call fcn.100254f9
mov byte [ebp - 4], 0xb
cmp dword [ebp - 0x1f8], 0x534a
jge 0x10032e08
push dword [ebp - 0x300]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x210], 0x91f32afc
lea eax, [ebp - 0x510]
push eax
push 0x1238
push 0x1834
push 0x5d1f
push 0x6bce
push 0
lea eax, [ebp - 0x2e8]
push eax
push 1
push 1
call fcn.10048edc
add esp, 0x24
push 1
lea ecx, [ebp - 0x2e8]
call fcn.10025597
cmp dword [eax], 0
je 0x10032e93
push 1
lea ecx, [ebp - 0x2e8]
call fcn.10025597
mov esi, dword [eax]
push 1
lea ecx, [ebp - 0x2e8]
call fcn.10025597
mov eax, dword [eax]
lea eax, [esi + eax - 0x2bfe]
test eax, eax
je 0x10032e93
mov dword [ebp - 0x200], 1
jmp 0x10032e9a
and dword [ebp - 0x200], 0
cmp dword [ebp - 0x200], 0xb0b7edd2
jge 0x10032eb2
mov dword [ebp - 0x208], 1
jmp 0x10032eb9
and dword [ebp - 0x208], 0
push 1
lea ecx, [ebp - 0x2e8]
call fcn.10025597
mov eax, dword [eax]
mov dword [ebp - 0x218], eax
mov eax, dword [ebp - 0x208]
mov dword [ebp - 0x210], eax
mov eax, dword [ebp - 0x210]
sub eax, 0x6a9bebb6
cmp dword [ebp - 0x218], eax
jne 0x10032ef9
mov dword [ebp - 0x220], 1
jmp 0x10032f00
and dword [ebp - 0x220], 0
cmp dword [ebp - 0x220], 0xba10
jl 0x10032f18
mov dword [ebp - 0x228], 1
jmp 0x10032f1f
and dword [ebp - 0x228], 0
cmp dword [ebp - 0x228], 0xfffffff9
jl 0x10032f34
mov dword [ebp - 0x230], 1
jmp 0x10032f3b
and dword [ebp - 0x230], 0
mov eax, dword [ebp - 0x230]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x2e8]
call fcn.1002557b
jmp 0x10033275
mov dword [ebp - 0x2dc], 0x64dbb9a2
mov dword [ebp - 0x2d8], 0x64dbb9a2
mov dword [ebp - 0x2d4], 0x64dbb9a2
mov dword [ebp - 0x2d0], 0x64dbb9a2
mov dword [ebp - 0x30], 0
jmp 0x10032f90
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffe7
je 0x10033275
mov dword [ebp - 0x258], 1
mov dword [ebp - 0x18], 0xffffffe4
jmp 0x10032fb4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2d
jge 0x10033270
mov dword [ebp - 0x44], 0xd77974d3
push 2
lea ecx, [ebp - 0x480]
call fcn.100254f9
mov byte [ebp - 4], 0xc
mov dword [ebp - 0xdc], 0
jmp 0x10032fef
mov eax, dword [ebp - 0xdc]
inc eax
mov dword [ebp - 0xdc], eax
cmp dword [ebp - 0xdc], 2
jge 0x10033011
push dword [ebp - 0xdc]
lea ecx, [ebp - 0x480]
call fcn.10025597
mov dword [eax], 0x871239b7
jmp 0x10032fe2
mov dword [ebp - 0x20], 0
jmp 0x10033021
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
jg 0x1003321f
mov eax, dword [ebp - 0x20]
push 4
pop ecx
imul ecx, ecx, 3
mov ecx, dword [ebp + ecx - 0x2dc]
cmp dword [ebp + eax*4 - 0x2dc], ecx
jg 0x10033054
push 0xfffffffffffffff8
pop eax
test eax, eax
jne 0x10033054
and dword [ebp - 0x238], 0
jmp 0x1003305e
mov dword [ebp - 0x238], 1
cmp dword [ebp - 0x238], 0xcc5119b5
je 0x10033076
mov dword [ebp - 0x158], 1
jmp 0x1003307d
and dword [ebp - 0x158], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x2dc]
cmp dword [ebp - 0x158], eax
jne 0x1003309d
mov dword [ebp - 0x240], 1
jmp 0x100330a4
and dword [ebp - 0x240], 0
cmp dword [ebp - 0x240], 0xfffffffb
jge 0x100330b9
mov dword [ebp - 0x248], 1
jmp 0x100330c0
and dword [ebp - 0x248], 0
mov eax, dword [ebp - 0x258]
cmp dword [ebp - 0x248], eax
jg 0x100330da
mov dword [ebp - 0x250], 1
jmp 0x100330e1
and dword [ebp - 0x250], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2dc]
cmp dword [ebp - 0x250], eax
jne 0x100330ff
mov dword [ebp - 0x260], 1
jmp 0x10033106
and dword [ebp - 0x260], 0
mov eax, dword [ebp - 0x258]
cmp eax, dword [ebp - 0x260]
jl 0x10033124
xor eax, eax
je 0x10033124
mov dword [ebp - 0x268], 1
jmp 0x1003312b
and dword [ebp - 0x268], 0
cmp dword [ebp - 0x268], 0xfffffffc
jle 0x1003314d
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x2dc], 0
je 0x1003314d
mov dword [ebp - 0x270], 1
jmp 0x10033154
and dword [ebp - 0x270], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x270], eax
jg 0x1003316b
mov dword [ebp - 0x278], 1
jmp 0x10033172
and dword [ebp - 0x278], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x278], eax
jg 0x10033189
mov dword [ebp - 0x280], 1
jmp 0x10033190
and dword [ebp - 0x280], 0
cmp dword [ebp - 0x280], 0xaa8c97d7
jae 0x100331a8
mov dword [ebp - 0x288], 1
jmp 0x100331af
and dword [ebp - 0x288], 0
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x288]
jge 0x100331c6
mov dword [ebp - 0x290], 1
jmp 0x100331cd
and dword [ebp - 0x290], 0
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x2dc]
add eax, dword [ebp - 0x290]
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x2dc]
jl 0x100331f8
mov dword [ebp - 0x298], 1
jmp 0x100331ff
and dword [ebp - 0x298], 0
mov esi, dword [ebp - 0x298]
add esi, 0x61f8
push 1
lea ecx, [ebp - 0x480]
call fcn.10025597
mov dword [eax], esi
jmp 0x1003301a
mov dword [ebp - 0x44], 0
jmp 0x1003322f
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 8
je 0x1003325c
push 0x48ee
push 0x5071
push 0x3aab
push 1
push 1
push 0x7b51
push 0x5634
call fcn.1002d1ea
add esp, 0x1c
jmp 0x10033228
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x480]
call fcn.1002557b
jmp 0x10032fad
jmp 0x10032f89
mov eax, dword [ebp - 0x2a0]
mov ecx, dword [ebp - 0x4c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x45c]
call fcn.1002538c
jmp 0x100335d6
mov byte [ebp - 0x39], 0
push 1
lea eax, [ebp - 0x39]
push eax
push 0x7638
push 0x2a07
push 0
call fcn.1002a48f
add esp, 0x14
jmp 0x100335d6
lea eax, [ebp + 8]
mov dword [ebp - 0x308], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x318], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x310], eax
mov eax, dword [ebp - 0x308]
movzx eax, byte [eax]
test eax, eax
je 0x100335d0
mov eax, dword [ebp - 0x310]
mov dword [ebp - 0x320], eax
mov eax, dword [ebp - 0x318]
mov dword [ebp - 0x330], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x2a8], 0x37cb
mov dword [ebp - 0x338], 0x100094f4
cmp dword [ebp - 0x2a8], 0x38b7
jle 0x10033451
and dword [ebp - 0xe4], 0
jmp 0x1003334f
mov eax, dword [ebp - 0xe4]
inc eax
mov dword [ebp - 0xe4], eax
cmp dword [ebp - 0xe4], 0xafb
jge 0x10033451
and dword [ebp - 0xec], 0
jmp 0x10033375
mov eax, dword [ebp - 0xec]
inc eax
mov dword [ebp - 0xec], eax
cmp dword [ebp - 0xec], 0x5042
jge 0x1003344c
and dword [ebp - 0xf4], 0
jmp 0x1003339b
mov eax, dword [ebp - 0xf4]
inc eax
mov dword [ebp - 0xf4], eax
cmp dword [ebp - 0xf4], 0x43fa
jge 0x10033447
and dword [ebp - 0xfc], 0
jmp 0x100333c1
mov eax, dword [ebp - 0xfc]
inc eax
mov dword [ebp - 0xfc], eax
cmp dword [ebp - 0xfc], 0x3c17
jge 0x10033442
mov eax, dword [ebp - 0xe4]
imul eax, dword [ebp - 0xec]
add eax, dword [ebp - 0xf4]
mov ecx, dword [ebp - 0xfc]
sar eax, cl
cdq
mov dword [ebp - 0x3c4], eax
mov dword [ebp - 0x3c0], edx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x4dc], eax
push dword [ebp - 0x3c0]
push dword [ebp - 0x3c4]
lea ecx, [ebp - 0x5e4]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x328], eax
mov ecx, dword [ebp - 0x328]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x5e4]
call fcn.100252df
jmp 0x100333b4
jmp 0x1003338e
jmp 0x10033368
jmp 0x10033342
mov eax, dword [ebp - 0x330]
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x2a8], 0x35db
jge 0x10033475
push dword [ebp - 0x338]
call fcn.1008287d
pop ecx
mov dword [ebp - 0x2b0], 0x5c8c
mov dword [ebp - 0x350], 0x10009528
cmp dword [ebp - 0x2b0], 0x6009
jle 0x10033580
and dword [ebp - 0x104], 0
jmp 0x100334af
mov eax, dword [ebp - 0x104]
inc eax
mov dword [ebp - 0x104], eax
cmp dword [ebp - 0x104], 0x1e2d
jge 0x10033580
and dword [ebp - 0x10c], 0
jmp 0x100334d5
mov eax, dword [ebp - 0x10c]
inc eax
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0x6daa
jge 0x1003357b
and dword [ebp - 0x114], 0
jmp 0x100334fb
mov eax, dword [ebp - 0x114]
inc eax
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xdf3
jge 0x10033576
mov eax, dword [ebp - 0x104]
cdq
idiv dword [ebp - 0x10c]
or edx, dword [ebp - 0x114]
mov eax, edx
cdq
mov dword [ebp - 0x3d0], eax
mov dword [ebp - 0x3cc], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x518], eax
push dword [ebp - 0x3cc]
push dword [ebp - 0x3d0]
lea ecx, [ebp - 0x614]
call fcn.1001147b
pop ecx
pop ecx
mov dword [ebp - 0x340], eax
mov ecx, dword [ebp - 0x340]
call fcn.100252e9
push eax
call fcn.1008287d
pop ecx
lea ecx, [ebp - 0x614]
call fcn.100252df
jmp 0x100334ee
jmp 0x100334c8
jmp 0x100334a2
mov eax, dword [ebp - 0x54]
mov dword [eax], 0
jmp 0x10033596
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x54]
mov dword [ecx], eax
mov eax, dword [ebp - 0x54]
cmp dword [eax], 4
jge 0x100335b6
mov eax, dword [ebp - 0x54]
push dword [eax]
mov ecx, dword [ebp - 0x348]
call fcn.10025597
mov dword [eax], 1
jmp 0x1003358b
cmp dword [ebp - 0x2b0], 0x5a4e
jge 0x100335ce
push dword [ebp - 0x350]
call fcn.1008287d
pop ecx
jmp 0x100335d6
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret