Function at 0x1001047a
Capabilities:
Modify service

Disassembly:
mov eax, 0x10061b50
call fcn.10061530
sub esp, 0x148
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov dword [ebp - 0x4c], edx
inc ecx
mov dword [ebp - 0x20], 0x11151
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x1c], 0x64d07ddb
imul eax, dword [ebp - 0x20], 0x8f4f
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
dec eax
imul eax, dword [ebp - 0x20]
test eax, eax
jne 0x100104ca
cmp dword [ebp - 0x20], ebx
jne 0x100104ca
mov ecx, ebx
mov edx, dword [ebp - 0x20]
imul edx, ecx
xor ecx, ecx
add edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x20]
imul edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp edx, eax
mov eax, dword [ebp - 0x20]
setge cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x18]
mov dword [ebp - 0x20], ecx
je 0x10010504
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov eax, dword [ebp - 0x18]
cmp eax, ecx
setg dl
xor ecx, ecx
mov dword [ebp - 0x1c], edx
inc ecx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ecx
jg 0x1001069c
mov dword [ebp - 0x14], ebx
jmp 0x10010536
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x30], 2
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10010528
mov dword [ebp - 0x18], ebx
jmp 0x1001054a
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x30], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x10010540
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jg 0x10010694
mov dword [ebp - 0x28], 0xd4416da8
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x28], 0x1e44
cmp dword [ebp - 0x28], 0x217c
jle 0x10010608
mov eax, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov dword [ebp - 0x3c], 0x2c2
mov dword [ebp - 0x44], ecx
add eax, edi
shl eax, cl
lea ecx, [ebp - 0x13c]
cdq
push edx
push eax
call fcn.1000d990
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100105aa
mov eax, dword [eax]
push eax
call fcn.1004c266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x13c]
call fcn.1000e1eb
mov ecx, dword [ebp - 0x44]
mov eax, dword [ebp - 0x14]
dec ecx
dec dword [ebp - 0x3c]
mov dword [ebp - 0x44], ecx
jne 0x1001058e
inc esi
cmp esi, 0x1b11
jl 0x10010582
inc edi
cmp edi, 0x14a1
jl 0x10010580
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x2497
jl 0x1001057e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xaed
push 0x1f1a
push 0x10f9
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
cmp dword [ebp - 0x28], 0x1d62
jge 0x1001061c
push 0x10007958
call fcn.1004c266
pop ecx
or dword [ebp - 4], 0xffffffff
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
test eax, eax
mov eax, dword [ebp - 0x1c]
sets cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0x30]
cmp eax, edx
setl cl
mov dword [ebp - 0x28], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp eax, 0xa7412631
setne cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x30]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
sub edx, 0x67d5b44
mov dword [ebp + eax*4 - 0x30], edx
inc dword [ebp - 0x18]
inc ecx
jmp 0x10010552
inc dword [ebp - 0x20]
jmp 0x1001051a
push ecx
lea ecx, [ebp - 0x74]
call fcn.10015984
push 4
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], 2
call fcn.10015984
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xc0]
mov dword [ebp - 0x20], 0xffffffff
push 3
call fcn.10015984
push 3
lea ecx, [ebp - 0x9c]
mov byte [ebp - 4], 4
call fcn.10015984
mov dword [ebp - 0x18], ebx
jmp 0x100106f4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], 0xf75dcec3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x100106e4
push 3
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10010715
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10010702
mov dword [ebp - 0x18], ebx
jmp 0x10010732
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x9c]
mov dword [eax + ecx*4], 0xb1a25d00
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1001071f
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], ebx
jl 0x100108c7
mov dword [ebp - 0x18], 0x2937a3a1
mov dword [ebp - 0x1c], 0x24061354
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x58]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov dword [ebp - 0x18], 3
cmp dword [ebp - 0x18], ebx
jl 0x100108be
mov edi, dword [ebp - 0x58]
mov dword [ebp - 0x14], 0xfffffff9
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x20]
cmp dword [eax], ebx
mov eax, dword [ebp - 0x58]
setg dl
add ecx, edx
xor edx, edx
cmp ecx, dword [eax + esi*4]
mov eax, dword [ebp - 0x14]
setge dl
mov dword [ebp - 0x1c], edx
xor edx, edx
cmp dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
setge dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [edi + 4]
jg 0x100107ca
cmp dword [ebp - 0x18], ebx
je 0x100107ca
xor ecx, ecx
inc ecx
jmp 0x100107cc
mov ecx, ebx
mov eax, dword [ebp - 0x14]
sub ecx, eax
je 0x1001085e
mov dword [ebp - 0x1c], 0xfffffff8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], 7
xor ecx, ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
test eax, eax
mov eax, 0xe402095d
setns cl
sub ecx, 3
neg ecx
sbb ecx, ecx
add ecx, 0xe11cd726
neg ecx
sbb ecx, ecx
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x20]
sbb edx, edx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], edx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
imul ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x10010841
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
xor edx, edx
mov eax, dword [ebp - 0xc0]
inc edx
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp - 0x18]
cmp eax, edx
setle cl
mov dword [ebp - 0x1c], ecx
jmp 0x1001087d
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x1001087d
push ebx
push 0x266e
push 0x222d
push 0x2276
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax]
add eax, dword [edi + 4]
cmp eax, dword [ebp - 0x14]
jg 0x100108a9
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x100108b5
push 0x121e
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
jmp 0x100108b5
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
mov dword [eax + edx*4], ecx
dec dword [ebp - 0x18]
jns 0x10010773
dec dword [ebp - 0x20]
jns 0x10010743
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x100108e9
push ebx
push ebx
push ebx
push 0x1c2
push 0x4ae
push ebx
push 0x1f09
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
lea ecx, [ebp - 0x9c]
call fcn.10015a06
lea ecx, [ebp - 0xc0]
call fcn.10015a06
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.10015a06
mov dword [ebp - 0x20], 0x3aa9ac70
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x14], 0xb9f9b31
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x1c], 8
mov dword [ebp - 0x1c], 0x54a20a29
mov dword [ebp - 0x1c], 1
push 3
call fcn.10015984
mov byte [ebp - 4], 5
mov dword [ebp - 0x1c], 0x5e15
cmp dword [ebp - 0x1c], 0x60c3
jle 0x1001099b
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x124]
cdq
push edx
push eax
call fcn.1000d990
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10010974
mov eax, dword [eax]
push eax
call fcn.1004c266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x124]
call fcn.1000e1eb
inc edi
cmp edi, 0x1077
jl 0x10010956
inc esi
cmp esi, 0x32ab
jl 0x10010954
mov dword [ebp - 0x14], ebx
jmp 0x100109b3
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100109a0
cmp dword [ebp - 0x1c], 0x5d17
jge 0x100109cd
push 0x100079b8
call fcn.1004c266
pop ecx
push 5
pop esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 0xe
jle 0x10010a21
mov eax, 0xdd8d
mov dword [ebp - 0xfc], eax
mov dword [ebp - 0xf8], eax
mov dword [ebp - 0xf4], eax
mov dword [ebp - 0xf0], eax
mov dword [ebp - 0x1c], 0x23d1bca9
mov dword [ebp - 0x1c], 0x7a98815
mov dword [ebp - 0x1c], 0xbb00868b
mov dword [ebp - 0x1c], 0x989b1ab4
inc dword [ebp - 0x1c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xe
jg 0x100109e1
lea ecx, [ebp - 0xec]
mov byte [ebp - 4], 2
call fcn.10015a06
mov dword [ebp - 0x28], esi
mov eax, 0x2bdb979c
mov dword [ebp - 0x20], ebx
mov edi, 0xffff
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x90], eax
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x88], eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x14], 0x59bb7a14
mov dword [ebp - 0x1c], 0x23b16aac
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x20], edi
jne 0x10010aaa
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x20]
cmp eax, 1
mov eax, dword [ebp - 0x20]
setge cl
add eax, ecx
mov dword [ebp - 0x8c], eax
jne 0x10010a9d
cmp dword [ebp - 0x2c], ebx
jne 0x10010a9d
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jle 0x10010aaa
xor eax, eax
inc eax
jmp 0x10010aac
mov eax, ebx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], ebx
jmp 0x10010aed
mov dword [ebp - 0x1c], 0xfb07d0d1
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0x19583e35
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x1c], 0xfffffff7
dec dword [ebp - 0x1c]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x10010ac4
mov dword [ebp - 0x1c], 0x86485466
mov dword [ebp - 0x14], ebx
jmp 0x10010b0f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x74]
mov dword [eax + ecx*4], 0xb0f7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x10010aff
mov eax, dword [ebp - 0x74]
cmp dword [eax], ebx
je 0x10010b2d
lea ecx, [ebp - 0x5c]
mov dword [ebp - 0x5c], 0xffffffff
call fcn.1000fe9a
jmp 0x10010b9d
mov dword [ebp - 0x18], 0xe3b6
mov dword [ebp - 0x14], 0x95f7626a
mov dword [ebp - 0x20], 0x16
jmp 0x10010b97
mov dword [ebp - 0x40], esi
xor ecx, ecx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, 1
mov eax, dword [ebp - 0x40]
setge cl
imul ecx, eax
mov eax, dword [ebp - 0x18]
imul eax, ecx
sub eax, 7
je 0x10010b7b
mov dword [ebp - 0x1c], 2
dec dword [ebp - 0x28]
jmp 0x10010b94
mov dword [ebp - 0x14], ebx
jmp 0x10010b8e
lea edx, [ebp - 0x74]
lea ecx, [ebp - 0x40]
call fcn.1000ff7b
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffc
jne 0x10010b80
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffeb
jge 0x10010b44
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x74]
call fcn.10015a06
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x10], ebx
jne 0x10010bb8
xor al, al
jmp 0x10011166
push 3
lea ecx, [ebp - 0xe0]
call fcn.10015984
push 3
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 8
call fcn.10015984
mov dword [ebp - 0x14], ebx
jmp 0x10010bed
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10010bde
mov dword [ebp - 0x14], ebx
jmp 0x10010c0b
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xa8]
mov dword [eax + ecx*4], 0xaeef20fe
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10010bf8
mov esi, dword [ebp - 0xa8]
mov dword [esi + 8], 2
mov dword [ebp - 0x14], 0xad4351cd
mov dword [ebp - 0x14], ebx
jmp 0x10010c47
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10010c44
push 0xdc3
push ebx
push 0x24cb
call dword [sym.imp.USER32.dll_GetClassNameW]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x10010c2a
dec dword [esi + 8]
jns 0x10010c1e
mov byte [ebp - 0x21], bl
cmp byte [ebp - 0x21], 0
je 0x10010c62
push ebx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0xa8]
call fcn.10015a06
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.10015a06
mov dword [ebp - 0x1c], 0x2173
cmp dword [ebp - 0x1c], 0x22ba
jle 0x10010cb5
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1060a8b8
cdq
push edx
push eax
call fcn.1000de0e
inc edi
cmp edi, 0x2a8b
jl 0x10010c90
inc esi
cmp esi, 0x6a4a
jl 0x10010c8e
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 4], 9
cmp dword [ebp - 0x1c], 0x2035
mov dword [eax], ebx
jge 0x10010cd9
mov edx, 0x10007a10
mov ecx, 0x1060a8b8
call fcn.1000f7c5
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x14], 0x10
jb 0x10010d0c
mov ecx, dword [eax]
jmp 0x10010d0e
mov ecx, eax
cmp dword [eax + 0x14], 0x10
mov dword [ebp - 0x48], ecx
jb 0x10010d1b
mov edx, dword [eax]
jmp 0x10010d1d
mov edx, eax
mov eax, dword [eax + 0x10]
add eax, edx
cmp ecx, eax
je 0x10011164
mov al, byte [ecx]
cmp al, 0x30
jl 0x1001103a
cmp al, 0x39
jg 0x1001103a
push ebx
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push 0x29a
push eax
call fcn.10012b2d
movdqa xmm0, xmmword [0x1000c530]
lea eax, [ebp - 0xfc]
add esp, 0x10
mov dword [ebp - 0x68], ebx
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x64], ebx
movdqu xmmword [ebp - 0x10c], xmm0
mov dword [ebp - 0x60], ebx
push dword [ebp - 0x5c]
push eax
lea eax, [ebp - 0x10c]
push eax
push ebx
call fcn.10016cce
mov dword [ebp - 4], 0xb
xor eax, eax
mov dword [ebp - 0x18], 0xfffffffb
inc eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x98e64e6d
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x28], 0x566b
cmp dword [ebp - 0x28], 0x569a
jle 0x10010e10
mov eax, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov esi, ebx
add eax, edi
mov dword [ebp - 0x44], ebx
mov ecx, esi
mov dword [ebp - 0x3c], eax
mov edi, eax
sar edi, cl
mov eax, edi
mov ecx, 0x1060a8b8
and eax, ebx
cdq
push edx
push eax
call fcn.1000de0e
inc ebx
cmp ebx, 0x7196
jl 0x10010dcd
mov edi, dword [ebp - 0x1c]
inc esi
mov eax, dword [ebp - 0x14]
push 0
pop ebx
cmp esi, 0x681c
jl 0x10010dbf
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x5c7e
jl 0x10010dbd
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x5905
jl 0x10010db8
mov dword [ebp - 0x3c], 0x1e7b
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x28], 0x5432
jge 0x10010e51
mov edx, 0x10007aa0
mov ecx, 0x1060a8b8
call fcn.1000f7c5
jmp 0x10010e51
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x14], 2
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 3
jg 0x10011022
mov dword [ebp - 0x1c], 0x31d83293
mov dword [ebp - 0xd0], ebx
mov dword [ebp - 0xcc], ebx
mov dword [ebp - 0xc8], ebx
mov dword [ebp - 0xc4], ebx
mov dword [ebp - 0x1c], 0xffffffff
inc dword [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], 3
jg 0x1001101a
mov dword [ebp - 0x2c], 0x9314
lea ecx, [ebp - 0x80]
push 1
call fcn.10015984
mov byte [ebp - 4], 0xe
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x28], 0x577a
cmp dword [ebp - 0x28], 0x5b23
jle 0x10010f25
mov edi, ebx
mov esi, ebx
mov ecx, esi
mov ebx, 0x481
mov dword [ebp - 0x1c], ecx
mov eax, edi
shl eax, cl
mov ecx, 0x1060a8b8
cdq
push edx
push eax
call fcn.1000de0e
mov ecx, dword [ebp - 0x1c]
dec ecx
mov dword [ebp - 0x1c], ecx
dec ebx
jne 0x10010ee3
inc esi
cmp esi, 0x2a8d
jl 0x10010ed9
inc edi
cmp edi, 0xdca
jl 0x10010ed7
push 0xfc1
push 0x176a
push 0x124d
call dword [sym.imp.USER32.dll_SetClassLongA]
mov dword [ebp - 0x20], ebx
jmp 0x10010f3a
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x80]
mov dword [eax + ecx*4], 0x6b903cfc
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x10010f2a
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x28], 0x5680
jge 0x10010f7a
mov edx, 0x10007b00
mov ecx, 0x1060a8b8
call fcn.1000f7c5
jmp 0x10010f7a
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x20], ebx
jmp 0x10011000
mov dword [ebp - 0x28], 0xc9f7
xor edx, edx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc4]
mov eax, dword [ebp - 0x80]
cmp dword [eax], ecx
mov eax, dword [ebp - 0x2c]
setg dl
xor ecx, ecx
imul eax, edx
cmp eax, 7
mov eax, dword [ebp - 0x80]
setne cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
sete cl
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x68]
mov eax, dword [ebp - 0x1c]
add eax, dword [ecx + edx*4]
cmp eax, 1
jne 0x10010fe3
cmp dword [ebp - 0x28], ebx
je 0x10010fe3
xor esi, esi
inc esi
jmp 0x10010fe5
mov esi, ebx
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x68]
mov edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
add edx, esi
cmp edx, eax
setle cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10010f86
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xb
call fcn.10015a06
inc dword [ebp - 0x14]
jmp 0x10010e9f
inc dword [ebp - 0x18]
jmp 0x10010e69
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10015a06
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x38]
inc ecx
jmp 0x10010d0e
mov eax, dword [ebp - 0x4c]
lea ecx, [ebp - 0xb4]
push 3
mov dword [eax], ebx
call fcn.10015984
mov dword [ebp - 4], 0x11
lea edx, [ebp - 0xb4]
mov dword [ebp - 0x14], 0xffffffff
lea ecx, [ebp - 0xd4]
mov dword [ebp - 0x1c], ebx
call fcn.1000ff97
mov dword [ebp - 0x28], 0x20a9
cmp dword [ebp - 0x28], 0x23ff
jle 0x10011111
mov esi, ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x38], ebx
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
cdq
idiv ecx
mov eax, edi
mov ecx, edx
sar eax, cl
lea ecx, [ebp - 0x154]
xor eax, esi
cdq
push edx
push eax
call fcn.1000d990
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100110b3
mov eax, dword [eax]
push eax
call fcn.1004c266
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x154]
call fcn.1000e1eb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x7494
jl 0x10011090
inc eax
mov dword [ebp - 0x38], eax
cmp eax, 0x6d1d
jl 0x1001108b
inc edi
cmp edi, 0x7a26
jl 0x10011086
inc esi
cmp esi, 0x28fd
jl 0x10011084
push ebx
push ebx
push 0x1785
push ebx
push 0x588
push ebx
push 0x2356
push ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp dword [ebp - 0x28], 0x1d1e
jge 0x10011125
push 0x10007b54
call fcn.1004c266
pop ecx
mov dword [ebp - 4], 0x11
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x10011148
mov byte [ebp - 0x31], bl
lea ecx, [ebp - 0x31]
call fcn.100101ac
dec dword [ebp - 0x14]
jns 0x10011138
mov eax, dword [ebp - 0xb4]
lea ecx, [ebp - 0xb4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x14], eax
call fcn.10015a06
jmp 0x10010bb1
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret