Function at 0x1002f44
Capabilities:
Access the windows event log
Get session user name
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x348
mov eax, dword [0x100703c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x310], ecx
mov ecx, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x320], ecx
mov ecx, dword [ebp + 0x14]
push esi
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x31c], ecx
mov ecx, dword [ebp + 0x18]
mov dword [ebp - 0x2ec], eax
mov dword [ebp - 0x2f8], ecx
mov dword [ebp - 0x2f0], edi
mov dword [ebp - 0x2fc], ebx
mov dword [ebp - 0x2f4], ebx
mov dword [ebp - 0x304], ebx
mov dword [ebp - 0x314], 1
mov esi, 0x104
cmp eax, ebx
je 0x1003230
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1002fc0
sub eax, edx
sar eax, 1
cmp eax, 1
jbe 0x1003230
xor eax, eax
mov word [ebp - 0x250], ax
mov eax, dword [ebp - 0x2ec]
cmp word [eax], 0x5c
je 0x1002ffe
push 0x10013e4
push esi
lea eax, [ebp - 0x250]
push eax
call fcn.010024d1
push dword [ebp - 0x2ec]
lea eax, [ebp - 0x250]
push esi
push eax
call fcn.0100255a
xor eax, eax
mov word [ebp - 0x4a], ax
lea eax, [ebp - 0x2fc]
push eax
push 0x80000002
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
cmp dword [ebp - 0x2fc], ebx
jne 0x1003142
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1c
mov dword [edi], eax
call fcn.010023e7
push ebx
push ebx
mov esi, eax
push 0x100
mov dword [ebp - 0x2e8], esi
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
cmp esi, ebx
je 0x10039c7
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1003071
sub eax, edx
sar eax, 1
mov eax, esi
lea edx, [eax + 2]
je 0x10030cc
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1003086
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x100309f
jmp 0x10031d9
push eax
push dword [ebp - 0x2e8]
push dword [ebp - 0x2ec]
push 0x1001300
push edi
push esi
call fcn.010025ef
add esp, 0x18
jmp 0x100312a
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10030cc
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 0x28]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x1003137
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
cmp eax, ebx
je 0x1003115
push eax
push dword [ebp - 0x2e8]
push 0x10012f0
push edi
push esi
call fcn.010025ef
add esp, 0x14
jmp 0x100312a
push dword [ebp - 0x2e8]
push 0x10013dc
push edi
push esi
call fcn.010025ef
add esp, 0x10
push esi
call fcn.01001bd1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x2e8]
jmp 0x10039c1
lea eax, [ebp - 0x2f4]
push eax
push 0xf013f
push ebx
push 0x1001370
push dword [ebp - 0x2fc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x2f4], ebx
jne 0x1003361
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1d
mov dword [edi], eax
call fcn.010023e7
push ebx
push ebx
mov esi, eax
push 0x100
mov dword [ebp - 0x2e8], esi
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
cmp esi, ebx
je 0x10039c7
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10031a1
sub eax, edx
sar eax, 1
mov eax, esi
lea edx, [eax + 2]
je 0x1003221
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10031b6
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x10031cf
sub eax, edx
sar eax, 1
lea edi, [eax + ecx]
lea edi, [edi + edi + 0x28]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x1003137
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
cmp eax, ebx
jne 0x10030ae
push dword [ebp - 0x2e8]
push dword [ebp - 0x2ec]
push 0x1001360
jmp 0x1003109
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1003221
jmp 0x10030d6
lea eax, [ebp - 0x2f4]
push eax
push 0x20119
push ebx
push 0x1001370
mov edi, 0x1007988
push 0x80000002
mov dword [ebp - 0x2ec], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp dword [ebp - 0x2f4], ebx
jne 0x100335b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x2f0]
push 0x1d
mov dword [ecx], eax
call fcn.010023e7
push ebx
push ebx
mov esi, eax
push 0x100
mov dword [ebp - 0x2e8], esi
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
cmp esi, ebx
je 0x10039c7
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x100329b
sub eax, edx
sar eax, 1
mov eax, esi
lea edx, [eax + 2]
je 0x1003323
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10032b0
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, edi
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x10032c5
sub eax, edx
sar eax, 1
lea ebx, [eax + ecx]
lea ebx, [ebx + ebx + 0x28]
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1003137
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
test eax, eax
je 0x1003311
push eax
push dword [ebp - 0x2e8]
push edi
push 0x1001300
push ebx
jmp 0x10030c1
push dword [ebp - 0x2e8]
push edi
push 0x1001360
push ebx
jmp 0x100310a
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1003323
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 0x28]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
cmp esi, ebx
je 0x1003137
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
test eax, eax
jmp 0x10030fb
mov edi, dword [ebp - 0x2f0]
lea eax, [ebp - 0x318]
push eax
lea eax, [ebp - 0x324]
push eax
lea eax, [ebp - 0x328]
push eax
push ebx
push 0x1001344
push dword [ebp - 0x2f4]
mov dword [ebp - 0x318], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1003428
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1a
mov dword [edi], eax
call fcn.010023e7
push ebx
push ebx
mov esi, eax
push 0x100
mov dword [ebp - 0x2e8], esi
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
cmp esi, ebx
je 0x10039c7
cmp dword [ebp - 0x2ec], ebx
je 0x1003414
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10033d7
sub eax, edx
sar eax, 1
je 0x1003414
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10033ec
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x1003405
jmp 0x10031d9
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1003419
jmp 0x10030d6
cmp dword [ebp - 0x324], ebx
je 0x1003a22
push 0x1001334
push dword [ebp - 0x2ec]
mov dword [ebp - 0x308], esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 0x304], eax
cmp eax, ebx
jne 0x10034e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1e
mov dword [edi], eax
call fcn.010023e7
push ebx
push ebx
mov esi, eax
push 0x100
mov dword [ebp - 0x2e8], esi
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
cmp esi, ebx
je 0x10039c7
cmp dword [ebp - 0x2ec], ebx
je 0x10034d3
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x1003496
sub eax, edx
sar eax, 1
je 0x10034d3
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10034ab
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x10034c4
jmp 0x10031d9
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x10034d8
jmp 0x10030d6
push 0x4a
lea eax, [ebp - 0x2e4]
push eax
mov eax, dword [ebp - 0x310]
push dword [eax]
mov ecx, 0x1007ba8
call fcn.0100262b
push 0x1001324
push esi
lea eax, [ebp - 0x250]
push eax
call fcn.010024d1
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x250]
push eax
push 0xc
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10037fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x300], eax
cmp eax, 0x534
je 0x100369e
push 0x20
call fcn.010023e7
push 0
push 0
mov esi, eax
push 0x100
mov dword [ebp - 0x2e8], esi
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
test esi, esi
je 0x10037fe
mov ebx, dword [ebp - 0x2ec]
test ebx, ebx
je 0x1003621
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003581
sub eax, edx
sar eax, 1
je 0x1003621
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100359a
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, ebx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10035af
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
lea esi, [esi + esi + 0x28]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x1003693
xor eax, eax
mov word [edi], ax
cmp dword [ebp - 0x300], eax
je 0x1003602
push dword [ebp - 0x300]
push dword [ebp - 0x2e8]
push ebx
push 0x1001300
push esi
push edi
call fcn.010025ef
add esp, 0x18
jmp 0x1003618
push dword [ebp - 0x2e8]
push ebx
push 0x1001360
push esi
push edi
call fcn.010025ef
add esp, 0x14
push edi
call fcn.01001bd1
push edi
jmp 0x100368d
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003626
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 0x28]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1003693
xor eax, eax
mov word [esi], ax
cmp dword [ebp - 0x300], eax
je 0x1003671
push dword [ebp - 0x300]
push dword [ebp - 0x2e8]
push 0x10012f0
push edi
push esi
call fcn.010025ef
add esp, 0x14
jmp 0x1003686
push dword [ebp - 0x2e8]
push 0x10013dc
push edi
push esi
call fcn.010025ef
add esp, 0x10
push esi
call fcn.01001bd1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x2e8]
jmp 0x10037f8
lea eax, [ebp - 0x308]
push eax
lea eax, [ebp - 0x250]
push eax
push 2
mov dword [ebp - 0x308], esi
call sub.Secur32.dll_GetUserNameExW
test al, al
jne 0x10037fe
push 0x20
call fcn.010023e7
xor edi, edi
push edi
push edi
push 0x100
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
cmp ebx, edi
je 0x10037fe
cmp dword [ebp - 0x2ec], edi
je 0x100378c
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x10036f6
sub eax, edx
sar eax, 1
je 0x100378c
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x100370f
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, di
jne 0x1003728
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
lea esi, [esi + esi + 0x28]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x10037f7
xor eax, eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x100377e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push dword [ebp - 0x2ec]
push 0x1001300
push esi
push edi
call fcn.010025ef
add esp, 0x18
jmp 0x10037ea
push ebx
push dword [ebp - 0x2ec]
push 0x1001360
jmp 0x10037ce
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, di
jne 0x1003791
sub eax, edx
sar eax, 1
lea esi, [eax + eax + 0x28]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x10037f7
xor eax, eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x10037da
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x10012f0
push esi
push edi
call fcn.010025ef
add esp, 0x14
jmp 0x10037ea
push ebx
push 0x10013dc
push esi
push edi
call fcn.010025ef
add esp, 0x10
push edi
call fcn.01001bd1
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x310]
push dword [esi]
lea eax, [ebp - 0x44]
push 0x1001318
push 0x20
push eax
call fcn.010025b4
lea eax, [ebp - 0x2e4]
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x344], eax
mov eax, dword [ebp - 0x320]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x31c]
add esp, 0x10
mov dword [ebp - 0x33c], eax
mov eax, dword [ebp - 0x2f8]
push esi
mov dword [ebp - 0x338], eax
lea eax, [ebp - 0x250]
mov dword [ebp - 0x334], eax
lea eax, [ebp - 0x348]
push eax
push 4
push 6
xor esi, esi
push esi
push 0x80000434
push 2
push 2
push dword [ebp - 0x304]
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
test eax, eax
jne 0x10039ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 0x2f0]
push 0x1f
mov dword [ecx], eax
call fcn.010023e7
push esi
push esi
push 0x100
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
cmp ebx, esi
je 0x10039c7
cmp dword [ebp - 0x2ec], esi
je 0x1003959
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10038cb
sub eax, edx
sar eax, 1
je 0x1003959
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x10038e0
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, dword [ebp - 0x2ec]
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x10038f9
sub eax, edx
sar eax, 1
lea edi, [eax + ecx]
lea edi, [edi + edi + 0x28]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10039c0
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
test eax, eax
je 0x100394b
push eax
push ebx
push dword [ebp - 0x2ec]
push 0x1001300
push edi
push esi
call fcn.010025ef
add esp, 0x18
jmp 0x10039b3
push ebx
push dword [ebp - 0x2ec]
push 0x1001360
jmp 0x1003997
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100395e
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 0x28]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10039c0
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
test eax, eax
je 0x10039a3
push eax
push ebx
push 0x10012f0
push edi
push esi
call fcn.010025ef
add esp, 0x14
jmp 0x10039b3
push ebx
push 0x10013dc
push edi
push esi
call fcn.010025ef
add esp, 0x10
push esi
call fcn.01001bd1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
and dword [ebp - 0x314], 0
cmp dword [ebp - 0x304], 0
je 0x10039e3
push dword [ebp - 0x304]
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
cmp dword [ebp - 0x2f4], 0
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x10039fa
push dword [ebp - 0x2f4]
call esi
cmp dword [ebp - 0x2fc], 0
je 0x1003a0b
push dword [ebp - 0x2fc]
call esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x314]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.01005cd9
leave
ret 0x18
push 0x1a
mov dword [edi], ebx
call fcn.010023e7
push ebx
push ebx
mov esi, eax
push 0x100
mov dword [ebp - 0x2e8], esi
call dword [sym.imp.KERNEL32.dll_SetThreadPreferredUILanguages]
cmp esi, ebx
je 0x10039e3
mov ebx, dword [ebp - 0x2ec]
test ebx, ebx
je 0x1003ae1
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003a57
sub eax, edx
sar eax, 1
je 0x1003ae1
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003a6c
sub eax, edx
sar eax, 1
mov ecx, eax
mov eax, ebx
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1003a81
sub eax, edx
sar eax, 1
lea edi, [eax + ecx]
lea edi, [edi + edi + 0x28]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1003b52
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
test eax, eax
je 0x1003ad3
push eax
push dword [ebp - 0x2e8]
push ebx
push 0x1001300
push edi
push esi
call fcn.010025ef
add esp, 0x18
jmp 0x1003b45
push dword [ebp - 0x2e8]
push ebx
push 0x1001360
jmp 0x1003b24
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1003ae6
sub eax, edx
sar eax, 1
lea edi, [eax + eax + 0x28]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1003b52
xor eax, eax
mov word [esi], ax
mov eax, dword [ebp - 0x2f0]
mov eax, dword [eax]
test eax, eax
je 0x1003b30
push eax
push dword [ebp - 0x2e8]
push 0x10012f0
push edi
push esi
call fcn.010025ef
add esp, 0x14
jmp 0x1003b45
push dword [ebp - 0x2e8]
push 0x10013dc
push edi
push esi
call fcn.010025ef
add esp, 0x10
push esi
call fcn.01001bd1
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push dword [ebp - 0x2e8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x10039e3