Function at 0x1002bb29
Capabilities:
Create process on windows
Delete file
Enumerate pe sections
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002bb82
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x160], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x14c], eax
mov eax, dword [ebp - 0x154]
mov dword [ebp - 0x17c], eax
mov eax, dword [ebp - 0x17c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14c]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [ecx + 0x34], eax
jmp 0x1002cad1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x168], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x38], 0xa66fe7d8
mov dword [ebp - 0x40], 0
jmp 0x1002bbb1
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 2
jge 0x1002bbc7
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x184], 6
jmp 0x1002bbaa
mov dword [ebp - 0x38], 1
jmp 0x1002bbd7
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x1002bd15
mov dword [ebp - 0x34], 0xfffffffd
mov eax, dword [ebp - 0x38]
cmp dword [ebp + eax*4 - 0x184], 0
je 0x1002bbfa
jmp 0x1002bd15
mov dword [ebp - 0x34], 1
jmp 0x1002bc0a
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1002bd10
mov dword [ebp - 0x74], 0
jmp 0x1002bc24
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 4
jge 0x1002bc3a
mov eax, dword [ebp - 0x74]
mov dword [ebp + eax*4 - 0x1b4], 0xfffffff8
jmp 0x1002bc1d
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x1b4], 1
jmp 0x1002bc68
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x1b4]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x1b4], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x1b4], 0
jl 0x1002bd0b
mov dword [ebp - 0x4c], 0xd2ab60e7
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x184], 3
mov dword [ebp - 0x4c], 0xffffffe2
jmp 0x1002bca1
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe5
jl 0x1002bd06
mov dword [ebp - 0x88], 0x84217059
mov dword [ebp - 0x88], 1
jmp 0x1002bcca
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0
jl 0x1002bce6
mov byte [ebp - 0x1d], 0
push 0
lea eax, [ebp - 0x1d]
push eax
call fcn.100298a9
pop ecx
pop ecx
jmp 0x1002bcbd
mov byte [ebp - 0x2b], 0
movzx eax, byte [ebp - 0x2b]
test eax, eax
je 0x1002bd04
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1002bc9a
jmp 0x1002bc4d
jmp 0x1002bc03
jmp 0x1002bbd0
mov eax, dword [ebp - 0x44]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc4], eax
mov dword [ebp - 0x54], 0
jmp 0x1002bd31
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1002bd47
mov eax, dword [ebp - 0x54]
mov dword [ebp + eax*4 - 0x140], 0xac204e2d
jmp 0x1002bd2a
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x140], 0
jmp 0x1002bd75
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x140]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x140], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x140], 0x13
jle 0x1002bde4
mov dword [ebp - 0x7c], 0
jmp 0x1002bd95
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 3
jge 0x1002bdab
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x23c], 0x97f0a290
jmp 0x1002bd8e
mov byte [ebp - 0x23], 0
movzx eax, byte [ebp - 0x23]
test eax, eax
je 0x1002bdc5
push 1
push 0x66b2
call fcn.1002458a
pop ecx
pop ecx
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 0
mov eax, dword [ebp + eax - 0x140]
mov dword [ebp + ecx - 0x23c], eax
jmp 0x1002bd5a
mov byte [ebp - 0x2a], 0
movzx eax, byte [ebp - 0x2a]
test eax, eax
je 0x1002bdf8
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 0x3c], 0x33a4
mov dword [ebp - 0x1d8], 0xffffffff
mov dword [ebp - 0x1f4], 0xeda58528
mov dword [ebp - 0x1bc], 0x52aa0a5d
mov dword [ebp - 0x1c0], 0x7e813a3d
mov dword [ebp - 0x1c8], 0x63782845
mov dword [ebp - 0x5c], 0
jmp 0x1002be41
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x1002be57
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x1f8], 0x2e65251c
jmp 0x1002be3a
cmp dword [ebp - 0x3c], 0
je 0x1002bf64
mov dword [ebp - 0x84], 0
jmp 0x1002be7a
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jge 0x1002be96
mov eax, dword [ebp - 0x84]
mov dword [ebp + eax*4 - 0x264], 0xffffffff
jmp 0x1002be6d
mov dword [ebp - 0x3c], 7
jmp 0x1002bea6
mov eax, dword [ebp - 0x3c]
dec eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff5
jge 0x1002bf62
mov dword [ebp - 0x64], 0x8c9f3690
mov dword [ebp - 0x20c], 3
mov dword [ebp - 0x214], 0xfffffff6
mov dword [ebp - 0x230], 1
mov dword [ebp - 0x22c], 1
mov dword [ebp - 0x228], 1
mov dword [ebp - 0x224], 1
mov dword [ebp - 0x64], 0
jmp 0x1002bf03
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jg 0x1002bf5d
mov dword [ebp - 0x208], 0xfffffffe
mov dword [ebp - 0x204], 0xfffffffe
mov dword [ebp - 0x200], 0xfffffffe
mov dword [ebp - 0x1fc], 0xfffffffe
mov dword [ebp - 0x150], 0xf1fc
push 0x61a7
push 0x7589
lea eax, [ebp - 0x150]
push eax
push 0x1c2
push 0
call fcn.10025a4a
add esp, 0x14
jmp 0x1002befc
jmp 0x1002be9f
jmp 0x1002bf7e
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x1002bf7e
push 0x70bf
push 0
call fcn.1002b858
pop ecx
pop ecx
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
movzx ecx, word [ecx + 0x14]
lea eax, [eax + ecx + 0x18]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x78], 1
mov dword [ebp - 0x10], 0
jmp 0x1002bfaa
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x1002bfc0
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x24c], 0xffffffff
jmp 0x1002bfa3
mov dword [ebp - 0x10], 0
jmp 0x1002bfd0
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jge 0x1002bfe6
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x258], 0
jmp 0x1002bfc9
mov dword [ebp - 0x78], 0
jmp 0x1002bff6
mov eax, dword [ebp - 0x78]
dec eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0xffffffe2
jge 0x1002c0c9
mov dword [ebp - 0x80], 0x33843046
mov dword [ebp - 0x6c], 0
jmp 0x1002c017
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x1002c02d
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x19c], 0xffffffff
jmp 0x1002c010
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x19c], 0
jmp 0x1002c05b
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x19c]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x19c], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x19c], 3
jg 0x1002c086
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x19c]
cmp dword [ebp + eax*4 - 0x24c], 0
je 0x1002c084
jmp 0x1002c086
jmp 0x1002c040
mov dword [ebp - 0x80], 0xc
jmp 0x1002c096
mov eax, dword [ebp - 0x80]
dec eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0xc
jl 0x1002c0c4
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x1002c0c2
push 0x5c7
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1002c08f
jmp 0x1002bfef
and dword [ebp - 0x8c], 0
jmp 0x1002c0e8
mov eax, dword [ebp - 0x8c]
inc eax
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x14]
add eax, 0x28
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
movzx eax, word [eax + 6]
cmp dword [ebp - 0x8c], eax
jge 0x1002cad1
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x10], 0
jne 0x1002c2d2
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov eax, 0x469ad59e
test eax, eax
je 0x1002c1d5
mov dword [ebp - 0x48], 0
jmp 0x1002c137
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 1
jge 0x1002c14a
mov eax, dword [ebp - 0x48]
mov dword [ebp + eax*4 - 0x30], 0xa0029bf3
jmp 0x1002c130
mov dword [ebp - 4], 0
jmp 0x1002c15a
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x1002c1b6
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x220], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
mov dword [ebp - 0x1c4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1dc], eax
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x30]
mov dword [ebp - 0x1cc], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x30]
mov dword [ebp - 0x1e0], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + eax - 0x30]
mov dword [ebp + ecx*4 - 0x30], eax
jmp 0x1002c153
mov byte [ebp - 0x20], 0
movzx eax, byte [ebp - 0x20]
test eax, eax
je 0x1002c1d0
push 0x85d
push 0
call fcn.1002b887
pop ecx
pop ecx
jmp 0x1002c292
mov dword [ebp - 0x50], 0
jmp 0x1002c1e5
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 1
jge 0x1002c1fb
mov eax, dword [ebp - 0x50]
mov dword [ebp + eax*4 - 0x1b8], 3
jmp 0x1002c1de
mov dword [ebp - 4], 0
jmp 0x1002c20b
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jg 0x1002c26d
mov dword [ebp - 0x58], 8
mov byte [ebp - 0x22], 0
push 0
push 0x34e0
lea eax, [ebp - 0x22]
push eax
push 0x79ad
push 0xcec
call fcn.1002cc7d
add esp, 0x14
mov dword [ebp - 0x58], 0
jmp 0x1002c249
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0
jg 0x1002c26b
mov byte [ebp - 0x1f], 0
movzx eax, byte [ebp - 0x1f]
test eax, eax
je 0x1002c269
push 0
push 0x50e3
call fcn.10028ad7
pop ecx
pop ecx
jmp 0x1002c242
jmp 0x1002c204
mov byte [ebp - 0x2c], 0
movzx eax, byte [ebp - 0x2c]
test eax, eax
je 0x1002c292
push 0x51a5
push 0x5315
push 0x2bbb
push 0
call fcn.1002cc18
add esp, 0x10
mov byte [ebp - 0x21], 0
lea eax, [ebp - 0x21]
push eax
push 0
call fcn.100298eb
pop ecx
pop ecx
push dword [ebp - 0x15c]
push 0x22e6
push dword [ebp - 0xc4]
lea eax, [ebp - 0x98]
push eax
push 0
push 0x1df4
push dword [ebp - 0x14]
call fcn.100268fb
add esp, 0x1c
jmp 0x1002c0d2
mov dword [ebp - 0x18], 0x7e2799ac
mov dword [ebp - 0xe8], 0
mov dword [ebp - 0xd8], 0xfffffffe
mov dword [ebp - 8], 0
jmp 0x1002c2fd
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x1002c313
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x9c], 0x92657cf7
jmp 0x1002c2f6
mov dword [ebp - 8], 0
jmp 0x1002c323
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 1
jge 0x1002c339
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x108], 0xfff9
jmp 0x1002c31c
mov dword [ebp - 0x18], 0
jmp 0x1002c349
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 6
jl 0x1002c72d
mov dword [ebp - 0x1c], 0xfd4914d2
mov dword [ebp - 0x68], 0xfff8
mov dword [ebp - 0xc], 0
jmp 0x1002c371
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 4
jge 0x1002c387
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x274], 0x71fda660
jmp 0x1002c36a
mov dword [ebp - 0xc], 0
jmp 0x1002c397
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x1002c3ad
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x18c], 0x8c4b0538
jmp 0x1002c390
cmp dword [ebp - 0x1c], 0
je 0x1002c3b8
jmp 0x1002c72d
cmp dword [ebp - 0x1c], 0x9ac196a1
jne 0x1002c567
mov dword [ebp - 0x94], 0xcf04b064
mov eax, dword [ebp - 0x94]
mov dword [ebp - 0x1e8], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], eax
je 0x1002c3ef
mov dword [ebp - 0x118], 1
jmp 0x1002c3f6
and dword [ebp - 0x118], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x118], eax
je 0x1002c40d
mov dword [ebp - 0xb8], 1
jmp 0x1002c414
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0xb8], eax
jg 0x1002c42e
mov dword [ebp - 0x134], 1
jmp 0x1002c435
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
sub eax, dword [ebp - 0x94]
cmp dword [ebp - 0x1c], eax
jl 0x1002c452
mov dword [ebp - 0x138], 1
jmp 0x1002c459
and dword [ebp - 0x138], 0
cmp dword [ebp - 0x138], 0xfffffffe
jbe 0x1002c46e
mov dword [ebp - 0xc0], 1
jmp 0x1002c475
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x68]
cmp dword [ebp - 0xc0], eax
jg 0x1002c48c
mov dword [ebp - 0x100], 1
jmp 0x1002c493
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x100], eax
je 0x1002c4af
xor eax, eax
inc eax
je 0x1002c4af
mov dword [ebp - 0xc8], 1
jmp 0x1002c4b6
and dword [ebp - 0xc8], 0
cmp dword [ebp - 0xc8], 0x5f9c7104
jg 0x1002c4ce
mov dword [ebp - 0x158], 1
jmp 0x1002c4d5
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1f0], eax
mov eax, 0xde6eab3a
cmp eax, 0xd5ec7e01
jb 0x1002c4f6
mov dword [ebp - 0x120], 1
jmp 0x1002c4fd
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x120]
add eax, 0xe4b9
cmp eax, 0xffff
ja 0x1002c521
cmp dword [ebp - 0xe8], 0
jne 0x1002c521
and dword [ebp - 0x144], 0
jmp 0x1002c52b
mov dword [ebp - 0x144], 1
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x1e4], eax
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x68], eax
jl 0x1002c548
mov dword [ebp - 0xd0], 1
jmp 0x1002c54f
and dword [ebp - 0xd0], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xd0]
mov dword [ebp + eax - 0x9c], ecx
jmp 0x1002c728
mov dword [ebp - 0x60], 0
jmp 0x1002c577
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1002c58d
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x1a4], 0xfffffff8
jmp 0x1002c570
mov eax, dword [ebp - 0xd8]
mov dword [ebp - 0x218], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
inc eax
mov dword [ebp - 0x130], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x130]
mov dword [ebp + eax - 0x108], ecx
mov eax, dword [ebp - 0xd8]
add eax, dword [ebp - 0x130]
jne 0x1002c5da
mov dword [ebp - 0xe0], 1
jmp 0x1002c5e1
and dword [ebp - 0xe0], 0
cmp dword [ebp - 0xe0], 6
ja 0x1002c5f6
mov dword [ebp - 0x110], 1
jmp 0x1002c5fd
and dword [ebp - 0x110], 0
push 2
pop eax
sub eax, dword [ebp - 0x110]
add eax, 0x7dbc1552
jne 0x1002c61f
cmp dword [ebp - 0xe8], 0
jne 0x1002c61f
and dword [ebp - 0x128], 0
jmp 0x1002c629
mov dword [ebp - 0x128], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x18c]
cmp dword [ebp - 0x128], eax
jg 0x1002c64a
mov dword [ebp - 0xf0], 1
jmp 0x1002c651
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x68]
imul eax, dword [ebp - 0xf0]
test eax, eax
jne 0x1002c678
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x9c], 0
jne 0x1002c678
and dword [ebp - 0xb0], 0
jmp 0x1002c682
mov dword [ebp - 0xb0], 1
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x9c]
cmp dword [ebp - 0xb0], eax
jne 0x1002c6a3
mov dword [ebp - 0xf8], 1
jmp 0x1002c6aa
and dword [ebp - 0xf8], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x1a4]
cmp dword [ebp - 0xf8], eax
jg 0x1002c6cb
mov dword [ebp - 0xb4], 1
jmp 0x1002c6d2
and dword [ebp - 0xb4], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0xb4]
test eax, eax
jne 0x1002c700
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x1a4], 0
jne 0x1002c700
and dword [ebp - 0xbc], 0
jmp 0x1002c70a
mov dword [ebp - 0xbc], 1
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0xbc]
mov dword [ebp + eax - 0x18c], ecx
cmp dword [ebp - 0x18], 0
je 0x1002c728
jmp 0x1002c342
jmp 0x1002c342
push 4
push 0x1000
mov eax, dword [ebp - 0x14]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc4]
add ecx, dword [eax + 0xc]
push ecx
push 0xa50b
push 0xba53
call fcn.100239d6
pop ecx
pop ecx
call eax
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x14]
push dword [eax + 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x168]
add ecx, dword [eax + 0x14]
push ecx
push dword [ebp - 0x98]
call fcn.10023b8b
add esp, 0xc
mov dword [ebp - 0x178], 0xa5d6c05b
mov dword [ebp - 0x174], 0xa5d6c05b
mov dword [ebp - 0x170], 0xa5d6c05b
mov dword [ebp - 0x16c], 0xa5d6c05b
mov dword [ebp - 0x28], 0x7eede0b4
mov dword [ebp - 0x1ec], 0xfffffffa
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x148], 0xa061fa4
mov dword [ebp - 0x28], 3
jmp 0x1002c7de
mov eax, dword [ebp - 0x28]
dec eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jl 0x1002caac
mov dword [ebp - 0xac], 0xd3c891c5
mov dword [ebp - 0xa8], 0xd3c891c5
mov dword [ebp - 0xa4], 0xd3c891c5
mov dword [ebp - 0xa0], 0xd3c891c5
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0xac], 0
jmp 0x1002c83e
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xac]
inc eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0xac], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xac], 3
jg 0x1002caa7
mov dword [ebp - 0x90], 0x12530a9b
mov dword [ebp - 0xcc], 0x914a
mov dword [ebp - 0x70], 0
jmp 0x1002c876
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x1002c88c
mov eax, dword [ebp - 0x70]
mov dword [ebp + eax*4 - 0x1d4], 0xbb9a2f72
jmp 0x1002c86f
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xac]
mov dword [ebp - 0x90], eax
mov dword [ebp - 0xcc], 1
cmp dword [ebp - 0xcc], 0
jne 0x1002c8c1
cmp dword [ebp - 0x28], 0
jne 0x1002c8c1
and dword [ebp - 0xd4], 0
jmp 0x1002c8cb
mov dword [ebp - 0xd4], 1
cmp dword [ebp - 0xd4], 0xffffffff
je 0x1002c8e0
mov dword [ebp - 0xdc], 1
jmp 0x1002c8e7
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0xdc]
sub eax, dword [ebp - 0x90]
imul eax, eax, 0xd975
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x178]
jle 0x1002c914
mov dword [ebp - 0xe4], 1
jmp 0x1002c91b
and dword [ebp - 0xe4], 0
cmp dword [ebp - 0xe4], 1
jge 0x1002c930
mov dword [ebp - 0xec], 1
jmp 0x1002c937
and dword [ebp - 0xec], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xac]
cmp dword [ebp - 0xec], eax
jle 0x1002c958
mov dword [ebp - 0xf4], 1
jmp 0x1002c95f
and dword [ebp - 0xf4], 0
cmp dword [ebp - 0xf4], 0xd12f
je 0x1002c977
mov dword [ebp - 0xfc], 1
jmp 0x1002c97e
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x90]
cmp dword [ebp - 0xfc], eax
jle 0x1002c998
mov dword [ebp - 0x104], 1
jmp 0x1002c99f
and dword [ebp - 0x104], 0
cmp dword [ebp - 0x104], 0x8f57
jle 0x1002c9b7
mov dword [ebp - 0x10c], 1
jmp 0x1002c9be
and dword [ebp - 0x10c], 0
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xac]
mov ecx, dword [ebp - 0x10c]
sub ecx, 0x112e4b5
cmp dword [ebp + eax*4 - 0x178], ecx
jge 0x1002c9ec
mov dword [ebp - 0x164], 1
jmp 0x1002c9f3
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x210], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0xac], 7
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x114], eax
imul eax, dword [ebp - 0x114], 3
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x178]
je 0x1002ca34
mov dword [ebp - 0x11c], 1
jmp 0x1002ca3b
and dword [ebp - 0x11c], 0
imul eax, dword [ebp - 0x11c], 0x2024
sub eax, 0x97eedf66
mov dword [ebp - 0x124], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x124]
mov dword [ebp + eax - 0x1d4], ecx
cmp dword [ebp - 0x124], 0
je 0x1002ca8f
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0xac]
cmp dword [ebp + eax*4 - 0x178], 0
je 0x1002ca8f
mov dword [ebp - 0x12c], 1
jmp 0x1002ca96
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x12c]
mov dword [ebp - 0x148], eax
jmp 0x1002c823
jmp 0x1002c7d7
push 0x7a7d
push 0x38dc
push 0
call fcn.10026894
add esp, 0xc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x98]
mov dword [eax + 8], ecx
jmp 0x1002c0d2
mov esp, ebp
pop ebp
ret