Function at 0x10042cbe
Capabilities:
Create thread
Enumerate gui resources
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10084263
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push esi
push edi
push 1
lea ecx, [ebp - 0x94]
call fcn.10027b4a
and dword [ebp - 4], 0
mov dword [ebp - 0x30], 2
mov dword [ebp - 0x88], 1
mov dword [ebp - 0x28], 0xa3f1540e
mov dword [ebp - 0x14], 0
jmp 0x10042d17
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 1
jge 0x10042d33
push dword [ebp - 0x14]
lea ecx, [ebp - 0x94]
call fcn.10027bb7
mov dword [eax], 0xfff7
jmp 0x10042d10
mov dword [ebp - 0x14], 0
jmp 0x10042d43
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 3
jge 0x10042d59
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x184], 0x1cd43096
jmp 0x10042d3c
push 0
lea ecx, [ebp - 0x94]
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x30], eax
mov esi, dword [ebp - 0x30]
push 0
lea ecx, [ebp - 0x94]
call fcn.10027bb7
mov edi, eax
push 0
lea ecx, [ebp - 0x94]
call fcn.10027bb7
mov ecx, dword [edi]
imul ecx, dword [eax]
sub esi, ecx
push 4
pop eax
shl eax, 0
imul esi, dword [ebp + eax - 0x184]
push 0
lea ecx, [ebp - 0x94]
call fcn.10027bb7
cmp esi, dword [eax]
jle 0x10042dc2
mov dword [ebp - 0x164], 1
jmp 0x10042dc9
and dword [ebp - 0x164], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x184]
add eax, dword [ebp - 0x164]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
push 4
pop ecx
shl ecx, 0
imul eax, dword [ebp + ecx - 0x184]
test eax, eax
jbe 0x10042e06
mov dword [ebp - 0x188], 1
jmp 0x10042e0d
and dword [ebp - 0x188], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x184]
cmp dword [ebp - 0x30], eax
jl 0x10042e2b
mov dword [ebp - 0x168], 1
jmp 0x10042e32
and dword [ebp - 0x168], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x184]
cmp dword [ebp - 0x168], eax
jl 0x10042e53
mov dword [ebp - 0xa4], 1
jmp 0x10042e5a
and dword [ebp - 0xa4], 0
cmp dword [ebp - 0xa4], 0x8df0442e
jbe 0x10042e72
mov dword [ebp - 0x11c], 1
jmp 0x10042e79
and dword [ebp - 0x11c], 0
push 0
lea ecx, [ebp - 0x94]
call fcn.10027bb7
mov eax, dword [eax]
imul eax, dword [ebp - 0x11c]
cmp eax, 0xfffffffa
jg 0x10042ea0
mov dword [ebp - 0xac], 1
jmp 0x10042ea7
and dword [ebp - 0xac], 0
mov eax, dword [ebp - 0xac]
mov dword [ebp - 0x28], eax
push 0
lea ecx, [ebp - 0x94]
call fcn.10027bb7
cmp dword [eax], 0
jne 0x10042ed1
cmp dword [ebp - 0x28], 0
jne 0x10042ed1
and dword [ebp - 0x1b8], 0
jmp 0x10042edb
mov dword [ebp - 0x1b8], 1
cmp dword [ebp - 0x28], 0xd3061741
jg 0x10042ef0
mov dword [ebp - 0x124], 1
jmp 0x10042ef7
and dword [ebp - 0x124], 0
push 0
lea ecx, [ebp - 0x94]
call fcn.10027bb7
mov ecx, dword [ebp - 0x124]
imul ecx, dword [eax]
cmp ecx, 4
jl 0x10042f1e
mov dword [ebp - 0x1c0], 1
jmp 0x10042f25
and dword [ebp - 0x1c0], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x218], eax
push 0
lea ecx, [ebp - 0x94]
call fcn.10027bb7
cmp dword [eax], 0
jne 0x10042f61
push 0
lea ecx, [ebp - 0x94]
call fcn.10027bb7
cmp dword [eax], 0
jne 0x10042f61
cmp dword [ebp - 0x28], 0
jne 0x10042f61
and dword [ebp - 0x1c8], 0
jmp 0x10042f6b
mov dword [ebp - 0x1c8], 1
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x200], eax
mov esi, dword [ebp - 0x28]
push 0
lea ecx, [ebp - 0x94]
call fcn.10027bb7
cmp esi, dword [eax]
jl 0x10042f97
mov dword [ebp - 0x194], 1
jmp 0x10042f9e
and dword [ebp - 0x194], 0
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x184], 0
jne 0x10042fc1
push 3
pop eax
test eax, eax
je 0x10042fc1
mov dword [ebp - 0xb4], 1
jmp 0x10042fc8
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x30], eax
jle 0x10042fee
mov eax, 0x270b
test eax, eax
je 0x10042fee
mov dword [ebp - 0x12c], 1
jmp 0x10042ff5
and dword [ebp - 0x12c], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x184]
cmp eax, dword [ebp - 0x12c]
je 0x10043015
mov dword [ebp - 0xbc], 1
jmp 0x1004301c
and dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0xbc]
neg eax
mov dword [ebp - 0x88], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.10027bb2
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004367f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1b4], eax
mov dword [ebp - 0x10], 0x96dd1e1e
mov dword [ebp - 0x19c], 7
mov dword [ebp - 0x5c], 0
jmp 0x1004306f
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 1
jge 0x10043085
mov eax, dword [ebp - 0x5c]
mov dword [ebp + eax*4 - 0x84], 1
jmp 0x10043068
mov dword [ebp - 0x10], 0
jmp 0x10043095
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jl 0x100431d3
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x38], 0
jmp 0x100430b6
mov eax, dword [ebp - 0x38]
dec eax
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jl 0x100431ce
mov dword [ebp - 0x98], 0x38367457
mov dword [ebp - 0x144], 0x98963ec5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1f4], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1b0], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1b0]
mov dword [ebp + eax*4 - 0x84], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x84]
sub eax, dword [ebp - 0x98]
neg eax
cmp eax, dword [ebp - 0x38]
jne 0x10043119
mov dword [ebp - 0x134], 1
jmp 0x10043120
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x134]
sub eax, dword [ebp - 0x38]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 1
jge 0x10043144
mov dword [ebp - 0xc4], 1
jmp 0x1004314b
and dword [ebp - 0xc4], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xc4]
cmp eax, 0x32a8
jle 0x10043167
mov dword [ebp - 0x13c], 1
jmp 0x1004316e
and dword [ebp - 0x13c], 0
cmp dword [ebp - 0x13c], 0x1e2d
jl 0x10043186
mov dword [ebp - 0x198], 1
jmp 0x1004318d
and dword [ebp - 0x198], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x208], eax
cmp dword [ebp - 0x38], 0xfffffffd
je 0x100431ab
mov dword [ebp - 0xcc], 1
jmp 0x100431b2
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x144], eax
cmp dword [ebp - 0x10], 0
je 0x100431c9
jmp 0x100430af
jmp 0x100430af
jmp 0x1004308e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1f8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1fc], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jl 0x100431f9
mov dword [ebp - 0xd4], 1
jmp 0x10043200
and dword [ebp - 0xd4], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x84]
cmp dword [ebp - 0xd4], eax
jg 0x10043221
mov dword [ebp - 0x1bc], 1
jmp 0x10043228
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x158], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x158]
mov dword [ebp + eax - 0x84], ecx
mov eax, dword [ebp - 0x158]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10043271
mov dword [ebp - 0x160], 1
jmp 0x10043278
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x19c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x220], 0x58382bdb
mov dword [ebp - 0x64], 0
jmp 0x100432b7
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x100432cd
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x22c], 0xfffffffa
jmp 0x100432b0
mov byte [ebp - 0x22], 0
movzx eax, byte [ebp - 0x22]
test eax, eax
je 0x100432ec
push 0
push 0
push 0xb60
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x7c], 2
jmp 0x100432fc
mov eax, dword [ebp - 0x7c]
dec eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 0
jl 0x1004346d
mov dword [ebp - 0x6c], 7
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x10043326
push 0x1f76
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x6c], 2
jmp 0x10043336
mov eax, dword [ebp - 0x6c]
dec eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0
jl 0x10043468
mov dword [ebp - 0x54], 0xc23afc37
mov dword [ebp - 0x54], 0
jmp 0x10043357
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jg 0x10043463
mov dword [ebp - 0x74], 0xb6d0374c
mov byte [ebp - 0x1e], 0
movzx eax, byte [ebp - 0x1e]
test eax, eax
je 0x10043381
push 0
push 0xf0b
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 0x74], 2
jmp 0x10043391
mov eax, dword [ebp - 0x74]
dec eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 0
jl 0x1004345e
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], 0
jmp 0x100433b2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jg 0x100433d3
mov byte [ebp - 0x1f], 0
movzx eax, byte [ebp - 0x1f]
test eax, eax
je 0x100433d1
push 0x149
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
jmp 0x100433ab
mov dword [ebp - 0x1c], 2
jmp 0x100433e3
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x10043459
mov dword [ebp - 0x4c], 0xcc48b164
mov dword [ebp - 0x1d8], 0xe75d
mov dword [ebp - 0x1d4], 0xe75d
mov dword [ebp - 0x1d0], 0xe75d
mov dword [ebp - 0x1cc], 0xe75d
mov dword [ebp - 0x4c], 0
jmp 0x10043428
mov eax, dword [ebp - 0x4c]
inc eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 3
jge 0x1004343e
mov eax, dword [ebp - 0x4c]
mov dword [ebp + eax*4 - 0x22c], 0x2c9ebf49
jmp 0x10043421
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x1d8]
inc eax
push 4
pop ecx
shl ecx, 1
mov dword [ebp + ecx - 0x1d8], eax
jmp 0x100433dc
jmp 0x1004338a
jmp 0x10043350
jmp 0x1004332f
jmp 0x100432f5
mov dword [ebp - 0x48], 0xf8067e30
mov dword [ebp - 0xe0], 0
push 3
lea ecx, [ebp - 0x1e4]
call fcn.10027b4a
mov dword [ebp - 4], 1
mov dword [ebp - 0x58], 0
jmp 0x100434a2
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 3
jge 0x100434be
push dword [ebp - 0x58]
lea ecx, [ebp - 0x1e4]
call fcn.10027bb7
mov dword [eax], 0x60d2f38d
jmp 0x1004349b
mov byte [ebp - 0x21], 0
movzx eax, byte [ebp - 0x21]
test eax, eax
je 0x100434d2
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x48], eax
jne 0x100434e6
mov dword [ebp - 0x128], 1
jmp 0x100434ed
and dword [ebp - 0x128], 0
mov dword [ebp - 0xe0], 0x9ec4279c
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x128], eax
jl 0x10043511
mov dword [ebp - 0xf0], 1
jmp 0x10043518
and dword [ebp - 0xf0], 0
cmp dword [ebp - 0x48], 1
jle 0x1004352a
mov dword [ebp - 0xe8], 1
jmp 0x10043531
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0xe8]
add eax, 4
cmp dword [ebp - 0x48], eax
jle 0x1004354b
mov dword [ebp - 0x148], 1
jmp 0x10043552
and dword [ebp - 0x148], 0
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x148], eax
jle 0x10043569
mov dword [ebp - 0x130], 1
jmp 0x10043570
and dword [ebp - 0x130], 0
mov eax, dword [ebp - 0xf0]
cmp eax, dword [ebp - 0x130]
je 0x1004358a
mov dword [ebp - 0xf8], 1
jmp 0x10043591
and dword [ebp - 0xf8], 0
mov esi, dword [ebp - 0xf8]
sub esi, dword [ebp - 0x48]
push 2
lea ecx, [ebp - 0x1e4]
call fcn.10027bb7
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e4]
call fcn.10027bb2
mov eax, dword [ebp - 0x1b4]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x1c4]
mov dword [ebp - 0x9c], eax
mov eax, dword [ebp - 0x50]
cmp dword [eax], 0
je 0x10043617
mov eax, dword [ebp - 0x50]
mov esi, dword [eax]
push 1
mov ecx, dword [ebp - 0x9c]
call fcn.10027bb7
mov dword [eax], esi
mov eax, dword [ebp - 0x50]
mov esi, dword [eax]
push 0
mov ecx, dword [ebp - 0x9c]
call fcn.10027bb7
cmp esi, dword [eax]
jg 0x10043617
mov dword [ebp - 0x100], 1
jmp 0x1004361e
and dword [ebp - 0x100], 0
cmp dword [ebp - 0x100], 0xfe04
jle 0x10043636
mov dword [ebp - 0x138], 1
jmp 0x1004363d
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
add eax, dword [ebp - 0x138]
je 0x1004365e
mov eax, dword [ebp - 0x50]
cmp dword [eax], 0
je 0x1004365e
mov dword [ebp - 0x108], 1
jmp 0x10043665
and dword [ebp - 0x108], 0
push 0
mov ecx, dword [ebp - 0x1ac]
call fcn.10027bb7
mov ecx, dword [ebp - 0x108]
mov dword [eax], ecx
jmp 0x10043c3b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18c], eax
push 1
lea ecx, [ebp - 0x214]
call fcn.10027b4a
mov dword [ebp - 4], 2
mov dword [ebp - 0x60], 0
jmp 0x100436ac
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 1
jge 0x100436c5
push dword [ebp - 0x60]
lea ecx, [ebp - 0x214]
call fcn.10027bb7
and dword [eax], 0
jmp 0x100436a5
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x100436db
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov byte [ebp - 0x20], 0
movzx eax, byte [ebp - 0x20]
test eax, eax
je 0x100436f3
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x214]
call fcn.10027bb2
mov dword [ebp - 0x18], 0xa48bbca6
mov dword [ebp - 0x18], 3
jmp 0x10043719
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x16
je 0x1004391e
push 1
lea ecx, [ebp - 0x178]
call fcn.10027b4a
mov dword [ebp - 4], 3
mov dword [ebp - 0x40], 0xf6085e07
mov dword [ebp - 0x190], 0x9031ea06
mov dword [ebp - 0x68], 0
jmp 0x10043758
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 1
jge 0x10043774
push dword [ebp - 0x68]
lea ecx, [ebp - 0x178]
call fcn.10027bb7
mov dword [eax], 0x82f80c34
jmp 0x10043751
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x40], eax
je 0x10043788
mov dword [ebp - 0x15c], 1
jmp 0x1004378f
and dword [ebp - 0x15c], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x15c], eax
jl 0x100437b7
push 0
lea ecx, [ebp - 0x178]
call fcn.10027bb7
mov ecx, dword [ebp - 0x40]
cmp dword [eax], ecx
jge 0x100437b7
and dword [ebp - 0x110], 0
jmp 0x100437c1
mov dword [ebp - 0x110], 1
push 0
lea ecx, [ebp - 0x178]
call fcn.10027bb7
mov ecx, dword [ebp - 0x110]
sub ecx, 0x2d7a
cmp dword [eax], ecx
jle 0x100437ed
cmp dword [ebp - 0x40], 0
jne 0x100437ed
and dword [ebp - 0x140], 0
jmp 0x100437f7
mov dword [ebp - 0x140], 1
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x140], eax
jle 0x1004380e
mov dword [ebp - 0x118], 1
jmp 0x10043815
and dword [ebp - 0x118], 0
cmp dword [ebp - 0x118], 0
je 0x1004383c
push 0
lea ecx, [ebp - 0x178]
call fcn.10027bb7
cmp dword [eax], 0
je 0x1004383c
mov dword [ebp - 0x16c], 1
jmp 0x10043843
and dword [ebp - 0x16c], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x16c], eax
jg 0x1004385a
mov dword [ebp - 0x120], 1
jmp 0x10043861
and dword [ebp - 0x120], 0
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x120], eax
jge 0x10043878
mov dword [ebp - 0xd8], 1
jmp 0x1004387f
and dword [ebp - 0xd8], 0
imul eax, dword [ebp - 0xd8], 0x13bf
cmp eax, dword [ebp - 0x18]
je 0x1004389a
mov dword [ebp - 0xdc], 1
jmp 0x100438a1
and dword [ebp - 0xdc], 0
cmp dword [ebp - 0xdc], 0x6b37990
jl 0x100438bc
cmp dword [ebp - 0x18], 0
jne 0x100438bc
and dword [ebp - 0xe4], 0
jmp 0x100438c6
mov dword [ebp - 0xe4], 1
push 0
lea ecx, [ebp - 0x178]
call fcn.10027bb7
mov ecx, dword [ebp - 0xe4]
mov dword [eax], ecx
cmp dword [ebp - 0x18], 0
je 0x100438f5
push 0
lea ecx, [ebp - 0x178]
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
jmp 0x1004390a
push 0
lea ecx, [ebp - 0x178]
call fcn.10027bb7
mov eax, dword [eax]
mov dword [ebp - 0x190], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x178]
call fcn.10027bb2
jmp 0x10043712
mov byte [ebp - 0x39], 0
movzx eax, byte [ebp - 0x39]
test eax, eax
je 0x10043942
push 0
push 0x184d
push 0
push 0
push 0x20f5
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x18c]
mov dword [ebp - 0x1a0], eax
mov eax, dword [ebp - 0x1a0]
movzx eax, byte [eax]
test eax, eax
je 0x10043af0
push 2
lea ecx, [ebp - 0x154]
call fcn.10027b4a
mov dword [ebp - 4], 4
mov dword [ebp - 0x78], 0xffffffff
mov dword [ebp - 0x70], 0
jmp 0x1004398a
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 2
jge 0x100439a6
push dword [ebp - 0x70]
lea ecx, [ebp - 0x154]
call fcn.10027bb7
mov dword [eax], 3
jmp 0x10043983
push 1
lea ecx, [ebp - 0x154]
call fcn.10027bb7
and dword [eax], 0
jmp 0x100439dc
push 1
lea ecx, [ebp - 0x154]
call fcn.10027bb7
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0xec]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0xec]
mov dword [ecx], eax
push 1
lea ecx, [ebp - 0x154]
call fcn.10027bb7
cmp dword [eax], 0xfffffff6
jne 0x10043ad2
mov dword [ebp - 0xf4], 1
mov dword [ebp - 0x1a8], 0x189f42c6
mov eax, 0x4bedcc59
test eax, eax
je 0x10043a4a
mov eax, dword [ebp - 0x78]
cmp dword [ebp - 0xf4], eax
jle 0x10043a26
mov dword [ebp - 0xfc], 1
jmp 0x10043a2d
and dword [ebp - 0xfc], 0
mov esi, dword [ebp - 0xf4]
push 1
lea ecx, [ebp - 0x154]
call fcn.10027bb7
add esi, dword [eax]
cmp esi, dword [ebp - 0xfc]
jl 0x10043a59
cmp dword [ebp - 0x78], 0
jne 0x10043a59
and dword [ebp - 0x104], 0
jmp 0x10043a63
mov dword [ebp - 0x104], 1
mov esi, dword [ebp - 0x78]
imul esi, dword [ebp - 0x104]
push 1
lea ecx, [ebp - 0x154]
call fcn.10027bb7
cmp esi, dword [eax]
jne 0x10043a8d
cmp dword [ebp - 0x78], 0
jne 0x10043a8d
and dword [ebp - 0x10c], 0
jmp 0x10043a97
mov dword [ebp - 0x10c], 1
push 1
lea ecx, [ebp - 0x154]
call fcn.10027bb7
mov ecx, dword [ebp - 0x10c]
cmp ecx, dword [eax]
jge 0x10043aba
mov dword [ebp - 0x114], 1
jmp 0x10043ac1
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x1a8], eax
jmp 0x100439b8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x154]
call fcn.10027bb2
push 0x104c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x44], 0xf8067e30
mov dword [ebp - 0xa0], 0
push 3
lea ecx, [ebp - 0x1f0]
call fcn.10027b4a
mov dword [ebp - 4], 5
mov dword [ebp - 0x80], 0
jmp 0x10043b25
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 3
jge 0x10043b41
push dword [ebp - 0x80]
lea ecx, [ebp - 0x1f0]
call fcn.10027bb7
mov dword [eax], 0x60d2f38d
jmp 0x10043b1e
mov byte [ebp - 0x1d], 0
movzx eax, byte [ebp - 0x1d]
test eax, eax
je 0x10043b55
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0x44], eax
jne 0x10043b69
mov dword [ebp - 0xa8], 1
jmp 0x10043b70
and dword [ebp - 0xa8], 0
mov dword [ebp - 0xa0], 0x9ec4279c
mov eax, dword [ebp - 0xa0]
cmp dword [ebp - 0xa8], eax
jl 0x10043b94
mov dword [ebp - 0xc0], 1
jmp 0x10043b9b
and dword [ebp - 0xc0], 0
cmp dword [ebp - 0x44], 1
jle 0x10043bad
mov dword [ebp - 0xb0], 1
jmp 0x10043bb4
and dword [ebp - 0xb0], 0
mov eax, dword [ebp - 0xb0]
add eax, 4
cmp dword [ebp - 0x44], eax
jle 0x10043bce
mov dword [ebp - 0xb8], 1
jmp 0x10043bd5
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x44]
cmp dword [ebp - 0xb8], eax
jle 0x10043bec
mov dword [ebp - 0xc8], 1
jmp 0x10043bf3
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0xc0]
cmp eax, dword [ebp - 0xc8]
je 0x10043c0d
mov dword [ebp - 0xd0], 1
jmp 0x10043c14
and dword [ebp - 0xd0], 0
mov esi, dword [ebp - 0xd0]
sub esi, dword [ebp - 0x44]
push 2
lea ecx, [ebp - 0x1f0]
call fcn.10027bb7
mov dword [eax], esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f0]
call fcn.10027bb2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret