Function at 0x10002f70
Capabilities:
Create thread
Resume thread

Disassembly:
sub esp, 0x10
cmp dword [esp + 0x14], 0
mov dword [esp], 0
jle 0x10003308
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_OpenProcess]
push esi
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x24]
mov eax, dword [eax + ecx*4]
mov cl, byte [eax]
cmp cl, 0x2d
je 0x10002faf
cmp cl, 0x2f
jne 0x100032f2
push 4
lea esi, [eax + 1]
push str.pid:
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x10002fef
add esi, 4
cmp byte [esi], al
je 0x100032f2
mov edx, 0x10027f28
mov eax, esi
sub edx, esi
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10002fe0
jmp 0x100032f2
push 4
push str.sid:
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x10003026
add esi, 4
cmp byte [esi], al
je 0x100032f2
mov edx, 0x10027fc0
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10003017
jmp 0x100032f2
push 4
push str.uid:
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x1000305f
add esi, 4
cmp byte [esi], al
je 0x100032f2
mov edx, 0x10027ea8
mov eax, esi
sub edx, esi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10003050
jmp 0x100032f2
push 4
push str.mac:
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x10003096
add esi, 4
cmp byte [esi], al
je 0x100032f2
mov edx, 0x10027fa8
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10003087
jmp 0x100032f2
push 4
push str.noqq
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x100030b9
mov dword [0x10027fb8], 1
jmp 0x100032f2
push 4
push str.ref:
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x100030f0
add esi, 4
cmp byte [esi], al
je 0x100032f2
mov edx, 0x10029108
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100030e1
jmp 0x100032f2
push 3
push 0x100214f8
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x10003127
add esi, 3
cmp byte [esi], al
je 0x100032f2
mov edx, 0x10028108
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x10003118
jmp 0x100032f2
push 3
push 0x100214fc
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x10003159
add esi, 3
cmp byte [esi], al
je 0x100032f2
push esi
call fcn.1000b5b4
add esp, 4
mov dword [0x10028104], eax
jmp 0x100032f2
push 4
push str.win:
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x1000318b
add esi, 4
cmp byte [esi], al
je 0x100032f2
push esi
call fcn.1000b5b4
add esp, 4
mov dword [0x10029908], eax
jmp 0x100032f2
push 4
push str.url:
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x100031c2
add esi, 4
cmp byte [esi], al
je 0x100032f2
mov edx, 0x10028908
mov eax, esi
sub edx, esi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100031b3
jmp 0x100032f2
push 5
push str.xada:
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x100032ab
add esi, 0xa
cmp byte [esi], al
je 0x100032f2
mov edx, 0x10028908
mov eax, esi
sub edx, esi
mov edi, edi
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x100031f0
mov eax, 0x10028908
xor ecx, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10003204
sub eax, esi
je 0x1000325e
nop
mov al, byte [ecx + 0x10028908]
cmp al, 0x33
jne 0x10003223
mov byte [ecx + 0x10028908], 0x3d
jmp 0x10003248
cmp al, 0x3d
jne 0x10003230
mov byte [ecx + 0x10028908], 0x33
jmp 0x10003248
cmp al, 0x32
jne 0x1000323d
mov byte [ecx + 0x10028908], 0x35
jmp 0x10003248
cmp al, 0x35
jne 0x10003248
mov byte [ecx + 0x10028908], 0x32
mov eax, 0x10028908
inc ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10003251
sub eax, esi
cmp ecx, eax
jb 0x10003210
mov eax, 0x10028908
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10003266
sub eax, edx
lea edx, [esp + 0x14]
push edx
call fcn.10002c80
add esp, 4
mov edx, 0x10028908
mov cl, byte [eax]
mov byte [edx], cl
inc eax
inc edx
test cl, cl
jne 0x10003281
call ebx
push eax
push 0
push 0x1fffff
call ebp
mov esi, eax
push 0x40
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100032f2
push 6
push str.delay:
push esi
call fcn.1001aacb
add esp, 0xc
test eax, eax
jne 0x100032f2
add esi, 6
cmp byte [esi], al
je 0x100032f2
push esi
call fcn.1000b5b4
add esp, 4
lea ecx, [esp + 0x18]
push ecx
push 0
push eax
push 0x10002e10
push 0
push 0
mov dword [0x10027fbc], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0xc]
inc eax
cmp eax, dword [esp + 0x20]
mov dword [esp + 0xc], eax
jl 0x10002f94
pop esi
pop ebp
pop ebx
add esp, 0x10
ret