Function at 0x1002667e
Capabilities:
Get file attributes
Terminate process

Disassembly:
mov eax, 0x1005bb54
call fcn.1005a768
sub esp, 0xcc
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x38], edi
cmp byte [edi], 0x50
jne 0x10026efa
cmp byte [edi + 1], 0x4b
jne 0x10026efa
xor esi, esi
lea ecx, [ebp - 0x88]
inc esi
push esi
call fcn.10001c9a
xor ebx, ebx
lea ecx, [ebp - 0x5c]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 0x83c7730f
mov dword [ebp - 0x30], 0x8b5131d8
mov dword [ebp - 0x2c], 0xa5223fa3
mov dword [ebp - 0x24], 0xffffffff
push 2
call fcn.10001c9a
mov dword [ebp - 0x20], 0x3413f087
mov dword [ebp - 0x14], ebx
jmp 0x10026704
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x88]
mov dword [eax + ecx*4], 0xec2e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100266f1
mov dword [ebp - 0x14], ebx
jmp 0x1002671e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x5c]
mov dword [eax + ecx*4], 0xe7b79f6a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002670e
mov dword [ebp - 0x1c], ebx
jmp 0x1002673b
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10026738
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10026729
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
dec dword [ebp - 0x20]
cmp ecx, eax
mov eax, esi
cmove eax, ebx
cmp eax, dword [ebp - 0x1c]
jl 0x10026776
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], ebx
je 0x10026766
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x5c]
push 0xfffffffffffffffa
pop ecx
mov dword [eax + 4], ecx
mov eax, ebx
cmp dword [ebp - 0x20], ecx
je 0x10026778
mov eax, esi
add eax, 0xffff
jne 0x10026786
mov eax, ebx
cmp dword [ebp - 0x2c], ebx
je 0x10026788
mov eax, esi
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x5c], ebx
je 0x100267a2
push dword [ebp - 0x5c]
call fcn.10042747
pop ecx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x54], ebx
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x88], ebx
je 0x100267c9
push dword [ebp - 0x88]
call fcn.10042747
pop ecx
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
mov bl, byte [edi + 2]
lea ecx, [ebp - 0x50]
mov bh, byte [edi + 3]
mov dword [ebp - 0x24], 0x2db58e46
mov dword [ebp - 0x30], 0x7ad95e17
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x1c], 0xbe4438b
mov dword [ebp - 0x18], 0x985a9576
mov dword [ebp - 0x24], 0xfffffff8
push 4
call fcn.10001c9a
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x20], 0x815898f
push 2
call fcn.10001c9a
xor edx, edx
mov dword [ebp - 0x30], 0xffffffff
push 4
mov dword [ebp - 0x14], edx
pop esi
jmp 0x10026834
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x50]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10026824
mov dword [ebp - 0x14], edx
jmp 0x1002684a
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1002683e
inc dword [ebp - 0x20]
xor ecx, ecx
mov esi, dword [ebp - 0x50]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub edx, dword [esi + 0xc]
cmp edx, eax
mov eax, 0xb5cf0adc
setne cl
cmp eax, ecx
sbb eax, eax
inc eax
cmp dword [esi + 0xc], eax
jg 0x10026878
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x50]
mov eax, dword [ebp - 0x24]
cmp dword [ecx + 8], eax
je 0x10026899
cmp dword [ebp - 0x2c], 0
jne 0x10026899
xor eax, eax
jmp 0x1002689c
xor eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x24], eax
jg 0x100268b1
cmp dword [ebp - 0x18], 0
jne 0x100268b1
xor edx, edx
jmp 0x100268b4
xor edx, edx
inc edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x70]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x20]
cmp edx, eax
push dword [ebp - 0x70]
setg cl
xor edx, edx
cmp esi, ecx
mov esi, dword [ebp - 0x50]
setg dl
xor eax, eax
cmp edx, dword [esi]
setge al
mov dword [ebp - 0x1c], eax
call fcn.10042747
or dword [ebp - 4], 0xffffffff
xor edx, edx
push esi
mov dword [ebp - 0x70], edx
mov dword [ebp - 0x6c], edx
mov dword [ebp - 0x68], edx
call fcn.10042747
xor eax, eax
movzx esi, bl
mov dword [ebp - 0x50], eax
add esi, 4
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], 2
mov byte [ebp - 0xd], al
pop ecx
pop ecx
cmp byte [ebp - 0xd], al
je 0x1002692b
push 0x1f63
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], al
je 0x10026940
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov dword [ebp - 0x18], 3
lea eax, [esi + edi]
mov dword [ebp - 0x24], 0x9fb37b04
mov dword [ebp - 0x2c], 0x672d714f
mov dword [ebp - 0x28], 0xf9c32812
mov dword [ebp - 0x24], 0x89afca86
mov dword [ebp - 0x28], 0xb1e5de2c
mov dword [ebp - 0x24], 0x8663
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
sub edx, 7
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setne cl
imul eax, dword [ebp - 0x2c], 0x26d
sub ecx, eax
add ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ecx
jne 0x100269d1
mov dword [ebp - 0x24], 0xd238
mov ecx, 0xfffc
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp eax, ecx
setle dl
sub edx, 0x487a49b9
xor ecx, ecx
mov dword [ebp - 0x24], edx
jmp 0x100269f3
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 0xb8ffd020
mov dword [ebp - 0x24], 0xf890
cmp dword [ebp - 0x24], ecx
je 0x100269ee
xor eax, eax
inc eax
jmp 0x100269f0
mov eax, ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
add esi, 0x18
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x18], ecx
jmp 0x10026a19
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xcc], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10026a08
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], ecx
jl 0x10026a59
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x10026a3d
push ecx
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
xor ecx, ecx
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x10026a54
push 0xfa9
push ecx
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
xor ecx, ecx
dec dword [ebp - 0x1c]
jns 0x10026a2b
mov dword [ebp - 0x1c], ecx
jmp 0x10026a6d
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0xcc], ecx
jne 0x10026a73
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jle 0x10026a5e
movzx eax, bh
add esi, eax
mov eax, dword [ebp - 0x30]
mov ecx, dword [eax + 0x14]
mov edx, dword [eax]
call fcn.10026672
mov dword [ebp - 0x2c], eax
xor ebx, ebx
mov eax, 0x70ad6f2e
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x28], 0x152c58fb
mov dword [ebp - 0x28], 0x748afa2f
mov dword [ebp - 0x24], 0xc6ef
mov dword [ebp - 0x18], ebx
jmp 0x10026ad9
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xd8], 0x62ee6d05
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10026ac8
dec dword [ebp - 0x24]
lea eax, [esi + edi]
xor edi, edi
mov dword [ebp - 0x20], 0xce125d16
inc edi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 0xf9150fae
mov dword [ebp - 0x20], ebx
jmp 0x10026b0b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x34], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jl 0x10026b01
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x10026bd2
mov dword [ebp - 0x1c], 0x891f782a
mov dword [ebp - 0x28], 0x8d72a67f
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x10026b8a
mov eax, dword [ebp - 0x1c]
cmp dword [ebp + eax*4 - 0x34], ebx
je 0x10026b7d
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x34]
cmp dword [ebp - 0x18], eax
jne 0x10026b4e
mov eax, ebx
cmp dword [ebp - 0x18], ebx
je 0x10026b50
mov eax, edi
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], ebx
je 0x10026b5d
cmp dword [ebp - 0x14], ebx
jne 0x10026b68
mov eax, dword [ebp - 0x1c]
mov ecx, ebx
cmp dword [ebp + eax*4 - 0x34], ebx
je 0x10026b6a
mov ecx, edi
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x34]
sub ecx, eax
mov eax, edi
cmp ecx, 0x3927
jle 0x10026b7f
mov eax, ebx
imul eax, eax, 0xe
mov dword [ebp - 0x14], eax
dec dword [ebp - 0x1c]
jns 0x10026b32
mov dword [ebp - 0x14], ebx
jmp 0x10026bc4
mov dword [ebp - 0x1c], ebx
jmp 0x10026bb3
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10026bb0
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10026bab
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
dec dword [ebp - 0x18]
jns 0x10026b9c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10026b94
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x34], ebx
jne 0x10026bc9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10026b8f
dec dword [ebp - 0x20]
jns 0x10026b1c
mov dword [ebp - 0x14], ebx
jmp 0x10026be2
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], ebx
jne 0x10026be8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0x11
je 0x10026bd7
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x44]
mov esi, dword [ebp - 0x2c]
push 3
mov dword [eax], esi
mov dword [ebp - 0x18], 0xfffffff6
call fcn.10001c9a
mov dword [ebp - 4], 2
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x20], ebx
jmp 0x10026c24
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
mov dword [eax + ecx*4], 0xc69aed23
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10026c14
dec dword [ebp - 0x18]
jne 0x10026cf2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov dword [eax + 8], ecx
test ecx, ecx
jne 0x10026cf2
push 2
pop edi
push edi
lea ecx, [ebp - 0xa0]
call fcn.10001c9a
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x10026c6d
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x64], 0xe01afec1
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10026c5f
mov dword [ebp - 0x1c], ebx
jmp 0x10026c8a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xa0]
mov dword [eax + ecx*4], 0x4b79a97a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jl 0x10026c77
mov eax, dword [ebp - 0x44]
mov ecx, 0x295a5277
xor ebx, ebx
mov dword [eax], ecx
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x44]
cmp eax, dword [ecx + 4]
mov ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x44]
setne bl
xor edx, edx
cmp dword [eax], ecx
mov eax, dword [ebp - 0x64]
setge dl
xor ecx, ecx
cmp edx, ebx
setge cl
add eax, ecx
mov ecx, dword [ebp - 0xa0]
push ecx
mov dword [ecx + 4], eax
mov dword [ebp - 0x28], eax
call fcn.10042747
xor edx, edx
pop ecx
mov dword [ebp - 0xa0], edx
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], edx
jmp 0x10026d8a
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0xda72
mov dword [ebp - 0x28], 0x30477ae2
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x20], ebx
je 0x10026d0e
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x44]
mov eax, dword [esi + 8]
mov edx, dword [esi + 8]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x20]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
sub ecx, dword [ebp - 0x18]
cmp edx, ecx
setne al
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setle bl
xor edx, edx
cmp ebx, eax
mov dword [esi + 8], ebx
mov eax, dword [ebp - 0x20]
setl dl
mov esi, dword [ebp - 0x2c]
xor ecx, ecx
cmp edx, eax
setle cl
xor edx, edx
cmp ecx, edi
setle dl
xor ecx, ecx
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setne cl
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
sub eax, 0x628e
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x44]
call fcn.10042747
pop ecx
mov ecx, dword [ebp - 0x30]
xor edx, edx
shr esi, 2
mov edi, edx
inc esi
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x40], edx
mov eax, dword [ecx]
mov dword [ebp - 0xc0], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0xbc], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0xb8], eax
mov eax, dword [ecx + 0xc]
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0xb4], eax
je 0x10026f44
mov ebx, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x24]
sub ebx, ecx
mov dword [ebp - 0x14], 0x5596960f
mov dword [ebp - 0x18], edx
jmp 0x10026dfc
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x94], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10026deb
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], 2
jg 0x10026e82
push 4
lea ecx, [ebp - 0x7c]
call fcn.10001c9a
xor edx, edx
mov dword [ebp - 0x18], edx
jmp 0x10026e2c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x7c]
mov dword [eax + ecx*4], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10026e1c
mov esi, dword [ebp - 0x7c]
mov dword [esi + 4], edx
mov byte [ebp - 0xd], dl
cmp byte [ebp - 0xd], 0
je 0x10026e56
push edx
push edx
push 0x25f9
push 0x18d9
push edx
call dword [sym.imp.USER32.dll_InsertMenuA]
xor edx, edx
inc dword [esi + 4]
cmp dword [esi + 4], 2
jle 0x10026e38
push dword [ebp - 0x7c]
call fcn.10042747
xor edx, edx
mov dword [ebp - 0x7c], edx
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x74], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
pop ecx
jle 0x10026e0b
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x14], eax
jg 0x10026e93
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jne 0x10026ea1
mov eax, dword [ebp - 0x94]
cmp dword [ebp - 0x94], edx
je 0x10026eae
cmp dword [ebp - 0x14], edx
jne 0x10026eb4
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x14]
mov edx, edi
mov eax, dword [ebp - 0x14]
and edx, 3
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x90]
mov ecx, dword [ecx]
mov edx, dword [ebp + edx*4 - 0xc0]
mov dword [ebp - 0x14], 1
call fcn.10026672
mov ecx, dword [ebp - 0x24]
push 0
pop edx
mov dword [ebx + ecx], eax
add ecx, 4
inc edi
mov dword [ebp - 0x24], ecx
cmp edi, esi
jb 0x10026ddf
jmp 0x10026f44
mov eax, 0x48d327cb
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], eax
mov dword [ebp - 0xa8], eax
mov dword [ebp - 0xa4], eax
mov dword [ebp - 0x38], 0xfffffffc
mov dword [ebp - 0x38], 0xfffffffa
mov dword [ebp - 0x30], 0xedad
dec dword [ebp - 0x30]
mov byte [ebp - 0xd], 0
cmp byte [ebp - 0xd], 0
je 0x10026f3f
call dword [sym.imp.USER32.dll_EndMenu]
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret