Function at 0x10028cf2
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007b895
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x374
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028d2b
push 0xfd2
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1002a58e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x274], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x274]
add ecx, dword [eax]
mov dword [ebp - 0x248], ecx
push 2
lea ecx, [ebp - 0x68]
call fcn.10016a6e
and dword [ebp - 4], 0
mov dword [ebp - 0x54], 0x12f3ccd2
push 3
lea ecx, [ebp - 0x2c0]
call fcn.10016a6e
mov byte [ebp - 4], 1
mov dword [ebp - 0x27c], 0xa889
mov dword [ebp - 0x20], 0
jmp 0x10028d96
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 1
jge 0x10028da9
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2c], 0x261f
jmp 0x10028d8f
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x20]
push eax
push 1
call fcn.10028452
add esp, 0xc
push 1
lea eax, [ebp - 0x2c0]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.100284c0
add esp, 0xc
mov dword [ebp - 0x20], 0
jmp 0x10028de0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 2
jge 0x10028df6
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x2fc], 1
jmp 0x10028dd9
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
and dword [eax], 0
jmp 0x10028e26
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x128]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
cmp dword [eax], 0
jl 0x10029138
mov dword [ebp - 0x50], 2
mov dword [ebp - 0x98], 0xa0122d80
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x2c], 0x12df
jl 0x10028e6c
mov dword [ebp - 0xd4], 1
jmp 0x10028e73
and dword [ebp - 0xd4], 0
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x2c]
add esi, 0x46b8d963
neg esi
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov eax, dword [eax]
add esi, dword [ebp + eax*4 - 0x2c]
cmp esi, 0xfffffffe
je 0x10028eac
mov dword [ebp - 0x1e8], 1
jmp 0x10028eb3
and dword [ebp - 0x1e8], 0
mov eax, dword [ebp - 0x1e8]
add eax, 0xfff9
neg eax
mov ecx, dword [ebp - 0xd4]
sub ecx, eax
cmp ecx, dword [ebp - 0x54]
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov eax, dword [eax]
mov esi, dword [ebp + eax*4 - 0x2c]
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
cmp esi, dword [eax]
jge 0x10028ef5
mov dword [ebp - 0x1e0], 1
jmp 0x10028efc
and dword [ebp - 0x1e0], 0
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp dword [ebp - 0x1e0], eax
jge 0x10028f20
mov dword [ebp - 0xd0], 1
jmp 0x10028f27
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xd0]
neg eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], 0xffffffe2
jmp 0x10028f42
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 0xffffffed
jne 0x10029133
mov dword [ebp - 0x6c], 0xffffffff
mov dword [ebp - 0x204], 3
mov dword [ebp - 0x50], 0
jmp 0x10028f6d
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0
jg 0x1002912e
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x2c]
mov dword [ebp - 0x98], eax
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp dword [ebp - 0x98], eax
jl 0x10029019
push 1
lea ecx, [ebp - 0x2c0]
call fcn.10016adb
mov dword [eax], 1
cmp dword [ebp - 0x6c], 1
jg 0x10028fdd
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x2c], 0
je 0x10028fdd
mov dword [ebp - 0x26c], 1
jmp 0x10028fe4
and dword [ebp - 0x26c], 0
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x340], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x98]
mov dword [ebp - 0x2f0], eax
imul eax, dword [ebp - 0x6c], 0xa4ef
test eax, eax
jne 0x10029019
and dword [ebp - 0x164], 0
jmp 0x10029023
mov dword [ebp - 0x164], 1
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x164], eax
jl 0x1002903a
mov dword [ebp - 0xdc], 1
jmp 0x10029041
and dword [ebp - 0xdc], 0
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov ecx, dword [ebp - 0xdc]
cmp ecx, dword [eax]
jg 0x10029061
mov dword [ebp - 0xa8], 1
jmp 0x10029068
and dword [ebp - 0xa8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xa8]
mov dword [ebp + eax - 0x2fc], ecx
mov esi, dword [ebp - 0xa8]
sub esi, dword [ebp - 0x6c]
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov eax, dword [eax]
cmp esi, dword [ebp + eax*4 - 0x2c]
je 0x100290a2
mov dword [ebp - 0x1ac], 1
jmp 0x100290a9
and dword [ebp - 0x1ac], 0
mov eax, dword [ebp - 0x1ac]
sub eax, dword [ebp - 0x6c]
add eax, 0x31e836d9
imul eax, eax, 9
cmp eax, 0x3d5ab883
jle 0x100290cd
mov dword [ebp - 0xe4], 1
jmp 0x100290d4
and dword [ebp - 0xe4], 0
mov eax, dword [ebp - 0x50]
cmp dword [ebp - 0xe4], eax
jl 0x100290eb
mov dword [ebp - 0x16c], 1
jmp 0x100290f2
and dword [ebp - 0x16c], 0
push 1
lea ecx, [ebp - 0x68]
call fcn.10016adb
mov eax, dword [eax]
mov eax, dword [ebp + eax*4 - 0x2c]
cmp dword [ebp - 0x16c], eax
jle 0x10029116
mov dword [ebp - 0xec], 1
jmp 0x1002911d
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x204], eax
jmp 0x10028f66
jmp 0x10028f3b
jmp 0x10028e05
lea eax, [ebp - 0x68]
push eax
push 0
lea eax, [ebp - 0x27c]
push eax
call fcn.1002ae91
add esp, 0xc
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x2c0]
call fcn.10016ad6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10016ad6
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x94], eax
mov dword [ebp - 0x18], 0xeb0647dc
mov dword [ebp - 0x12c], 0x526954eb
cmp dword [ebp - 0x18], 0xfffffffa
jge 0x100295fa
mov dword [ebp - 0x2b4], 0x7ee3
mov dword [ebp - 0x2b0], 0x7ee3
mov dword [ebp - 0x2ac], 0x7ee3
mov dword [ebp - 0x2a8], 0x7ee3
lea ecx, [ebp - 0xb9]
call fcn.10008943
push eax
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0x2b4]
push eax
lea ecx, [ebp - 0x380]
call fcn.10016aea
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x294]
call fcn.10016ab0
mov dword [ebp - 4], 2
mov dword [ebp - 0x7c], 0
jmp 0x10029205
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 1
jge 0x1002921b
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x134], 2
jmp 0x100291fe
mov dword [ebp - 0x18], 0
jmp 0x1002922b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xc
jg 0x100295e9
mov dword [ebp - 0x9c], 0x4a90
push 4
lea ecx, [ebp - 0x200]
call fcn.10016a6e
mov byte [ebp - 4], 3
lea eax, [ebp - 0x200]
push eax
lea eax, [ebp - 0x310]
push eax
push 0
call fcn.10028527
add esp, 0xc
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x284], eax
push 3
lea ecx, [ebp - 0x294]
call fcn.10016adb
mov eax, dword [eax]
mov dword [ebp - 0x24c], eax
mov eax, dword [ebp - 0x9c]
dec eax
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x284]
cmp eax, dword [ebp - 0x24c]
jne 0x100292b0
mov dword [ebp - 0x1ec], 1
jmp 0x100292b7
and dword [ebp - 0x1ec], 0
mov esi, dword [ebp - 0x18]
push 0
lea ecx, [ebp - 0x200]
call fcn.10016adb
cmp esi, dword [eax]
jne 0x100292d9
xor eax, eax
inc eax
jne 0x100292d9
and dword [ebp - 0xf4], 0
jmp 0x100292e3
mov dword [ebp - 0xf4], 1
mov eax, dword [ebp - 0x1ec]
cmp eax, dword [ebp - 0xf4]
jge 0x100292fd
mov dword [ebp - 0x174], 1
jmp 0x10029304
and dword [ebp - 0x174], 0
push 0
lea ecx, [ebp - 0x200]
call fcn.10016adb
mov ecx, dword [ebp - 0x174]
cmp ecx, dword [eax]
jl 0x10029327
mov dword [ebp - 0xfc], 1
jmp 0x1002932e
and dword [ebp - 0xfc], 0
cmp dword [ebp - 0xfc], 0xd3a18e41
jae 0x10029346
mov dword [ebp - 0x210], 1
jmp 0x1002934d
and dword [ebp - 0x210], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x318], eax
push 3
lea ecx, [ebp - 0x294]
call fcn.10016adb
cmp dword [eax], 0xca77
jge 0x10029377
mov dword [ebp - 0x1b4], 1
jmp 0x1002937e
and dword [ebp - 0x1b4], 0
push 3
lea ecx, [ebp - 0x200]
call fcn.10016adb
mov ecx, dword [ebp - 0x1b4]
cmp ecx, dword [eax]
jg 0x100293a1
mov dword [ebp - 0x104], 1
jmp 0x100293a8
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 3
jb 0x100293bd
mov dword [ebp - 0x17c], 1
jmp 0x100293c4
and dword [ebp - 0x17c], 0
cmp dword [ebp - 0x17c], 0xffffffff
jle 0x100293d9
mov dword [ebp - 0x10c], 1
jmp 0x100293e0
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
sub eax, dword [ebp - 0x18]
je 0x1002940a
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x10029405
push 0
push 0x525e
call fcn.10028721
pop ecx
pop ecx
jmp 0x100295d5
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x114], 3
mov byte [ebp - 0x3c], 0
movzx eax, byte [ebp - 0x3c]
test eax, eax
je 0x1002943e
push 0x3358
push 0x1735
push 1
call fcn.10028527
add esp, 0xc
push 2
lea ecx, [ebp - 0x200]
call fcn.10016adb
mov ecx, dword [ebp - 0x88]
cmp dword [eax], ecx
jl 0x100294af
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x320], eax
mov esi, dword [ebp - 0x88]
push 0
lea ecx, [ebp - 0x200]
call fcn.10016adb
cmp esi, dword [eax]
jne 0x10029484
mov dword [ebp - 0x1d4], 1
jmp 0x1002948b
and dword [ebp - 0x1d4], 0
mov eax, dword [ebp - 0x1d4]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0x4d0c
jg 0x100294af
mov dword [ebp - 0x184], 1
jmp 0x100294b6
and dword [ebp - 0x184], 0
mov esi, dword [ebp - 0x18]
push 3
lea ecx, [ebp - 0x294]
call fcn.10016adb
mov ecx, dword [ebp - 0x184]
sub ecx, dword [eax]
cmp esi, ecx
jge 0x100294de
mov dword [ebp - 0x11c], 1
jmp 0x100294e5
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x11c], eax
jl 0x100294ff
mov dword [ebp - 0x1bc], 1
jmp 0x10029506
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1bc]
jge 0x1002951d
mov dword [ebp - 0x124], 1
jmp 0x10029524
and dword [ebp - 0x124], 0
cmp dword [ebp - 0x124], 0x595
jle 0x1002953c
mov dword [ebp - 0x18c], 1
jmp 0x10029543
and dword [ebp - 0x18c], 0
imul eax, dword [ebp - 0x18c], 0x5a1e
add eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x18]
mov dword [ebp - 0x12c], eax
mov esi, dword [ebp - 0x12c]
push 3
lea ecx, [ebp - 0x294]
call fcn.10016adb
cmp esi, dword [eax]
jge 0x1002957c
mov dword [ebp - 0x264], 1
jmp 0x10029583
and dword [ebp - 0x264], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x134]
mov dword [ebp - 0x328], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x330], eax
cmp dword [ebp - 0x18], 0
je 0x100295bb
push 9
pop eax
test eax, eax
je 0x100295bb
mov dword [ebp - 0x1e4], 1
jmp 0x100295c2
and dword [ebp - 0x1e4], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1e4]
mov dword [ebp + eax - 0x134], ecx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x200]
call fcn.10016ad6
jmp 0x10029224
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x294]
call fcn.10016ad6
jmp 0x1002961a
mov byte [ebp - 0x3a], 0
movzx eax, byte [ebp - 0x3a]
test eax, eax
je 0x1002961a
push 0x25c3
push 0x6da7
push 0
call fcn.10028c04
add esp, 0xc
and dword [ebp - 0xc4], 0
jmp 0x1002963e
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
mov eax, dword [ebp - 0x94]
inc eax
inc eax
mov dword [ebp - 0x94], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
cmp dword [ebp - 0xc4], eax
jae 0x1002a085
mov dword [ebp - 0x24], 0x58d3
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x100], 0
mov dword [ebp - 0x218], 1
mov dword [ebp - 0x1a4], 0xffffffff
mov dword [ebp - 0x228], 7
lea eax, [ebp - 0x48]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push 0x74a0
push 0x5489
call fcn.1002858e
add esp, 0x14
mov dword [ebp - 0x48], 0xb
jmp 0x100296b9
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0x13
jne 0x10029b4e
mov dword [ebp - 0x14], 0
jmp 0x100296d3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x100296e9
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2a0], 0
jmp 0x100296cc
mov dword [ebp - 0x14], 0
jmp 0x100296f9
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002970f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1f4], 0x2da3c3d
jmp 0x100296f2
mov dword [ebp - 0x14], 0
jmp 0x1002971f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10029735
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xc0], 0x442e119
jmp 0x10029718
mov dword [ebp - 0x24], 0
jmp 0x10029745
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jg 0x10029b49
mov dword [ebp - 0xb0], 0xadf6
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x220], 0xf82244f8
mov dword [ebp - 0xb0], 1
cmp dword [ebp - 0xb0], 0
jne 0x1002978f
mov eax, 0x58905b8b
test eax, eax
jne 0x1002978f
and dword [ebp - 0x19c], 0
jmp 0x10029799
mov dword [ebp - 0x19c], 1
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x2a0]
mov dword [ebp - 0x194], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x194]
mov dword [ebp + eax*4 - 0x2a0], ecx
mov eax, dword [ebp - 0x100]
cmp dword [ebp - 0x194], eax
jg 0x100297d3
mov dword [ebp - 0x13c], 1
jmp 0x100297da
and dword [ebp - 0x13c], 0
cmp dword [ebp - 0x13c], 0xfff8
jae 0x100297f2
mov dword [ebp - 0x1c4], 1
jmp 0x100297f9
and dword [ebp - 0x1c4], 0
imul eax, dword [ebp - 0x1c4], 0xcd43
mov dword [ebp - 0x144], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x144]
mov dword [ebp + eax - 0x1f4], ecx
mov eax, dword [ebp - 0x144]
sub eax, dword [ebp - 0x30]
push 4
pop ecx
imul ecx, ecx, 0
imul eax, dword [ebp + ecx - 0xc0]
cmp dword [ebp - 0x19c], eax
jne 0x10029847
mov dword [ebp - 0x14c], 1
jmp 0x1002984e
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
sub eax, 0x72e636de
cmp eax, dword [ebp - 0x218]
jne 0x1002986d
mov dword [ebp - 0x1dc], 1
jmp 0x10029874
and dword [ebp - 0x1dc], 0
cmp dword [ebp - 0x1dc], 0
je 0x10029a0c
mov dword [ebp - 0xe0], 1
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x278], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x30], eax
jg 0x100298b6
mov dword [ebp - 0x254], 1
jmp 0x100298bd
and dword [ebp - 0x254], 0
mov dword [ebp - 0x154], 0xffffffff
mov eax, dword [ebp - 0x154]
imul eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0xb0]
cmp dword [ebp - 0x1a4], eax
jl 0x100298f7
mov dword [ebp - 0x15c], 1
jmp 0x100298fe
and dword [ebp - 0x15c], 0
cmp dword [ebp - 0x15c], 0xce6
jne 0x10029916
mov dword [ebp - 0x1cc], 1
jmp 0x1002991d
and dword [ebp - 0x1cc], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xc0]
cmp dword [ebp - 0x1cc], eax
jle 0x10029941
cmp dword [ebp - 0x30], 0
jne 0x10029941
and dword [ebp - 0xcc], 0
jmp 0x1002994b
mov dword [ebp - 0xcc], 1
cmp dword [ebp - 0xcc], 0
jb 0x10029960
mov dword [ebp - 0xd8], 1
jmp 0x10029967
and dword [ebp - 0xd8], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x220]
imul ecx, dword [ebp - 0xd8]
cmp dword [ebp + eax - 0x1f4], ecx
jle 0x1002998f
mov dword [ebp - 0xe8], 1
jmp 0x10029996
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xe8], eax
jl 0x100299b0
mov dword [ebp - 0xf0], 1
jmp 0x100299b7
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0xf0]
cmp eax, 0x615
je 0x100299d4
mov dword [ebp - 0xf8], 1
jmp 0x100299db
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x278], eax
mov byte [ebp - 0x3e], 0
movzx eax, byte [ebp - 0x3e]
test eax, eax
je 0x10029a07
push 0x65b3
push 1
push 0x6a5e
call fcn.10028639
add esp, 0xc
jmp 0x10029b44
mov dword [ebp - 0x30], 0
jmp 0x10029a1c
mov eax, dword [ebp - 0x30]
dec eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xfffffff4
jle 0x10029b44
mov dword [ebp - 0x4c], 0xffffffff
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x2a0], 0x47e5f8f0
jl 0x10029b03
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x100]
cmp dword [ebp + eax - 0x1f4], ecx
jg 0x10029a64
mov dword [ebp - 0xb8], 1
jmp 0x10029a6b
and dword [ebp - 0xb8], 0
cmp dword [ebp - 0x48], 0x57cf
jle 0x10029a80
mov dword [ebp - 0x108], 1
jmp 0x10029a87
and dword [ebp - 0x108], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1f4]
cmp dword [ebp - 0x108], eax
je 0x10029aa8
mov dword [ebp - 0x110], 1
jmp 0x10029aaf
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x2a0]
cmp dword [ebp - 0x110], eax
jne 0x10029acd
mov dword [ebp - 0x118], 1
jmp 0x10029ad4
and dword [ebp - 0x118], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xb8]
mov dword [ebp + eax - 0xc0], ecx
mov eax, dword [ebp - 0xb8]
imul eax, dword [ebp - 0x118]
inc eax
cmp eax, dword [ebp - 0x4c]
jle 0x10029b03
and dword [ebp - 0x120], 0
jmp 0x10029b0d
mov dword [ebp - 0x120], 1
mov eax, dword [ebp - 0x120]
mov dword [ebp - 0x228], eax
mov dword [ebp - 0x4c], 0
jmp 0x10029b29
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 2
jge 0x10029b3f
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x1f4], 0x92edcddc
jmp 0x10029b22
jmp 0x10029a15
jmp 0x1002973e
jmp 0x100296b2
mov dword [ebp - 0x74], 4
mov dword [ebp - 0x338], 0x1865425a
mov dword [ebp - 0x2d0], 0xd416db6
mov dword [ebp - 0x344], 0x7af5af8b
mov dword [ebp - 0x31c], 0xffffffff
mov dword [ebp - 0x2dc], 0
mov dword [ebp - 0x33c], 0xfffffff6
mov dword [ebp - 0x2e4], 0xffffffff
mov dword [ebp - 0x324], 0x715cc48b
mov dword [ebp - 0x2ec], 0xbf495e3b
mov dword [ebp - 0x34c], 0x9f58382b
mov dword [ebp - 0x2f4], 0x29b3a00d
mov dword [ebp - 0x32c], 0xfffffffe
mov dword [ebp - 0x268], 0x1de9829c
mov dword [ebp - 0x84], 0
jmp 0x10029bf0
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 1
jge 0x10029c0c
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x300], 0xf8d9a2b8
jmp 0x10029be3
mov dword [ebp - 0x74], 8
jmp 0x10029c1c
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0xfffffff4
jne 0x10029ccb
push 2
lea ecx, [ebp - 0x260]
call fcn.10016a6e
mov dword [ebp - 4], 4
push 0x38d2
lea eax, [ebp - 0x260]
push eax
push 1
lea eax, [ebp - 0x304]
push eax
push 0x72be
call fcn.10028677
add esp, 0x14
push 0
lea ecx, [ebp - 0x260]
call fcn.10016adb
and dword [eax], 0
jmp 0x10029c92
push 0
lea ecx, [ebp - 0x260]
call fcn.10016adb
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp - 0xc8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc8]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x260]
call fcn.10016adb
cmp dword [eax], 0x1d
jl 0x10029cb7
mov byte [ebp - 0x40], 0
push 1
lea eax, [ebp - 0x40]
push eax
call fcn.10028721
pop ecx
pop ecx
jmp 0x10029c6e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x260]
call fcn.10016ad6
jmp 0x10029c15
push 0x3f9b
lea eax, [ebp - 0x268]
push eax
push 0x655d
push 0
push 0xce5
call fcn.1002b956
add esp, 0x14
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x238], 0xfffffff6
mov dword [ebp - 0x270], 1
mov dword [ebp - 0x38], 0
jmp 0x10029d16
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 2
jge 0x10029d2c
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xa4], 0xa3367f5e
jmp 0x10029d0f
mov dword [ebp - 0x38], 0
jmp 0x10029d3c
mov eax, dword [ebp - 0x38]
inc eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 4
jge 0x10029d52
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x36c], 0x95a9796
jmp 0x10029d35
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xa4]
sub ecx, 8
cmp dword [ebp + eax - 0xa4], ecx
jle 0x10029d96
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4], 0
je 0x10029d96
mov eax, 0xbb101eb6
test eax, eax
je 0x10029d96
mov dword [ebp - 0x130], 1
jmp 0x10029d9d
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x130], eax
jg 0x10029db4
mov dword [ebp - 0x138], 1
jmp 0x10029dbb
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x138]
neg eax
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0xa4]
cmp eax, 0x813c27f3
jb 0x10029de3
mov dword [ebp - 0x140], 1
jmp 0x10029dea
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x140], eax
jge 0x10029e01
mov dword [ebp - 0x148], 1
jmp 0x10029e08
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x148]
add eax, 8
cmp eax, dword [ebp - 0x44]
je 0x10029e1c
cmp dword [ebp - 0x44], 0
je 0x10029e22
cmp dword [ebp - 0x44], 0
jne 0x10029e3b
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4], 0
jne 0x10029e3b
and dword [ebp - 0x230], 0
jmp 0x10029e45
mov dword [ebp - 0x230], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x36c]
dec eax
mov dword [ebp - 0x288], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x288]
mov dword [ebp + eax - 0x36c], ecx
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0xa4]
mov dword [ebp - 0x308], eax
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0xa4], 0x7a7bf748
mov eax, 0x7a7bf748
test eax, eax
jne 0x10029eb2
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0xa4], 0
jne 0x10029eb2
and dword [ebp - 0x150], 0
jmp 0x10029ebc
mov dword [ebp - 0x150], 1
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x150]
cmp eax, dword [ebp - 0x238]
jl 0x10029ed9
mov dword [ebp - 0x158], 1
jmp 0x10029ee0
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x270], eax
mov eax, dword [ebp - 0x94]
movzx eax, word [eax]
sar eax, 0xc
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x80], 0x73838a1f
mov dword [ebp - 0x90], 0
jmp 0x10029f1e
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 3
jge 0x10029f3a
mov eax, dword [ebp - 0x90]
mov dword [ebp + eax*4 - 0x378], 3
jmp 0x10029f11
mov dword [ebp - 0x80], 0
jmp 0x10029f4a
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 2
jg 0x10029ff5
mov dword [ebp - 0x8c], 0
jmp 0x10029f6d
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 1
jge 0x10029f86
mov eax, dword [ebp - 0x8c]
mov dword [ebp + eax*4 - 0x70], 0xc3099cf
jmp 0x10029f60
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x70], 0
jmp 0x10029fab
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x70], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x70], 2
jg 0x10029ff0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x70]
cmp dword [ebp + eax*4 - 0x378], 0
je 0x10029fce
jmp 0x10029ff0
mov byte [ebp - 0x3b], 0
movzx eax, byte [ebp - 0x3b]
test eax, eax
je 0x10029fee
push 1
push 0x276e
push 0xc27
call fcn.1002879c
add esp, 0xc
jmp 0x10029f96
jmp 0x10029f43
mov byte [ebp - 0x3f], 0
movzx eax, byte [ebp - 0x3f]
test eax, eax
je 0x1002a01b
push 0xee7
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x94]
movzx eax, word [eax]
and eax, 0xfff
mov dword [ebp - 0x250], eax
mov eax, dword [ebp - 0x240]
mov dword [ebp - 0x280], eax
cmp dword [ebp - 0x280], 3
je 0x1002a048
jmp 0x1002a080
mov eax, dword [ebp - 0x248]
add eax, dword [ebp - 0x250]
mov dword [ebp - 0x208], eax
lea eax, [ebp - 0x208]
push eax
push 0x307c
push 1
push 0x3dac
push 0x50dd
push dword [ebp - 0x20c]
call fcn.10028835
add esp, 0x18
jmp 0x10029623
mov dword [ebp - 0x10], 0x6dee
mov dword [ebp - 0x5c], 0x7a88ff76
mov dword [ebp - 0x1a8], 0
push 4
lea ecx, [ebp - 0x2cc]
call fcn.10016a6e
mov dword [ebp - 4], 5
mov dword [ebp - 0x1b0], 0xfffffff6
mov dword [ebp - 0x244], 0x7f559297
mov dword [ebp - 0x28], 0
jmp 0x1002a0d5
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1002a0e8
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x1c], 0
jmp 0x1002a0ce
mov dword [ebp - 0x28], 0
jmp 0x1002a0f8
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x1002a10e
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x35c], 0xfffffffc
jmp 0x1002a0f1
lea eax, [ebp - 0x28]
push eax
push 0
lea eax, [ebp - 0x2cc]
push eax
call fcn.1002b75c
add esp, 0xc
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x1c], 0
jmp 0x1002a148
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x1c], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0xffffffec
jne 0x1002a314
mov dword [ebp - 0xac], 0xadacd7d3
mov dword [ebp - 0x190], 0x869b7d6b
mov dword [ebp - 0x22c], 0xffffffff
mov dword [ebp - 0x21c], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
mov dword [ebp - 0x30c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x334], eax
cmp dword [ebp - 0xac], 0x75cb
jle 0x1002a1bc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
jne 0x1002a1bc
and dword [ebp - 0x160], 0
jmp 0x1002a1c6
mov dword [ebp - 0x160], 1
cmp dword [ebp - 0x160], 0xfffffffd
jg 0x1002a1db
mov dword [ebp - 0x214], 1
jmp 0x1002a1e2
and dword [ebp - 0x214], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x314], eax
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x348], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
mov dword [ebp - 0x2d4], eax
mov eax, 0xeec299e8
sub eax, 0xdc1b6eab
cmp dword [ebp - 0x10], eax
jl 0x1002a222
mov dword [ebp - 0x168], 1
jmp 0x1002a229
and dword [ebp - 0x168], 0
cmp dword [ebp - 0x168], 0xf81320f2
jae 0x1002a241
mov dword [ebp - 0x170], 1
jmp 0x1002a248
and dword [ebp - 0x170], 0
cmp dword [ebp - 0x170], 0xffffffff
jne 0x1002a25d
mov dword [ebp - 0x178], 1
jmp 0x1002a264
and dword [ebp - 0x178], 0
cmp dword [ebp - 0x178], 0xf7c629c4
jb 0x1002a27c
mov dword [ebp - 0x180], 1
jmp 0x1002a283
and dword [ebp - 0x180], 0
cmp dword [ebp - 0x180], 0x4c6a
jle 0x1002a29b
mov dword [ebp - 0x188], 1
jmp 0x1002a2a2
and dword [ebp - 0x188], 0
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x190], eax
mov dword [ebp - 0x10], 8
jmp 0x1002a2be
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x32
jle 0x1002a30f
mov dword [ebp - 0x224], 0xfffffffd
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0xac]
push eax
push 0
lea eax, [ebp - 0x190]
push eax
push 0x77eb
push 0x7d6c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x22c]
push eax
call fcn.1002f46c
add esp, 0x28
jmp 0x1002a2b7
jmp 0x1002a133
mov dword [ebp - 0x5c], 0
jmp 0x1002a324
mov eax, dword [ebp - 0x5c]
dec eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 0xffffffec
jg 0x1002a56d
mov dword [ebp - 0x34], 0xec499e98
mov dword [ebp - 0xb4], 0xfffffff9
mov dword [ebp - 0x10], 3
jmp 0x1002a34f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x2c
jge 0x1002a38a
mov dword [ebp - 0x78], 0xf3bec767
mov dword [ebp - 0x78], 0
jmp 0x1002a36c
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x19
jg 0x1002a388
mov byte [ebp - 0x3d], 0
movzx eax, byte [ebp - 0x3d]
test eax, eax
je 0x1002a386
push 1
call fcn.10028be5
pop ecx
jmp 0x1002a365
jmp 0x1002a348
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x1c], 0
jne 0x1002a3a9
mov eax, 0xfffc
test eax, eax
jne 0x1002a3a9
and dword [ebp - 0x198], 0
jmp 0x1002a3b3
mov dword [ebp - 0x198], 1
mov eax, dword [ebp - 0x198]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
je 0x1002a483
cmp dword [ebp - 0x34], 0
je 0x1002a3de
cmp dword [ebp - 0x34], 0
je 0x1002a3de
mov dword [ebp - 0x1a0], 1
jmp 0x1002a3e5
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1a0], eax
jl 0x1002a3fc
mov dword [ebp - 0x234], 1
jmp 0x1002a403
and dword [ebp - 0x234], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x1a8], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x1a8], eax
jg 0x1002a42c
cmp dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x34]
add eax, 7
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x35c]
jg 0x1002a44d
mov dword [ebp - 0x23c], 1
jmp 0x1002a454
and dword [ebp - 0x23c], 0
push 1
lea ecx, [ebp - 0x2cc]
call fcn.10016adb
mov dword [eax], 0xfffffff9
mov dword [ebp - 0x1b0], 0xfffffff9
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1c]
cmp eax, dword [ebp - 0x1b0]
jl 0x1002a48a
cmp dword [ebp - 0x244], 0
cmp dword [ebp - 0x34], 0
jl 0x1002a49c
mov dword [ebp - 0x1b8], 1
jmp 0x1002a4a3
and dword [ebp - 0x1b8], 0
mov eax, dword [ebp - 0x1b8]
sub eax, 0x3ee28c35
jne 0x1002a4c5
cmp dword [ebp - 0x34], 0
jne 0x1002a4c5
cmp dword [ebp - 0x5c], 0
jne 0x1002a4c5
and dword [ebp - 0x1c0], 0
jmp 0x1002a4cf
mov dword [ebp - 0x1c0], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x1c0]
sub ecx, dword [ebp - 0xb4]
cmp dword [ebp + eax - 0x1c], ecx
jg 0x1002a4f3
mov dword [ebp - 0x1c8], 1
jmp 0x1002a4fa
and dword [ebp - 0x1c8], 0
cmp dword [ebp - 0x1c8], 0x4e46196c
jge 0x1002a512
mov dword [ebp - 0x1d0], 1
jmp 0x1002a519
and dword [ebp - 0x1d0], 0
cmp dword [ebp - 0x1d0], 0xce765620
jne 0x1002a53b
push 0xfffffffffffffffa
pop eax
test eax, eax
jne 0x1002a53b
cmp dword [ebp - 0x34], 0
jne 0x1002a53b
and dword [ebp - 0x1d8], 0
jmp 0x1002a545
mov dword [ebp - 0x1d8], 1
mov eax, dword [ebp - 0xb4]
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x35c]
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0xb4], 0xd465c301
jmp 0x1002a31d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2cc]
call fcn.10016ad6
mov eax, dword [ebp - 0x58]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
add ecx, dword [eax + 4]
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret