Function at 0x10032263
Capabilities:
Create thread
Delete file
Encrypt data using speck
Get common file path
Modify service

Disassembly:
mov eax, 0x10068755
call fcn.10067850
sub esp, 0x1c4
push ebx
push esi
mov dword [ebp - 0x20], 9
mov esi, ecx
mov dword [ebp - 0x24], 0x7375
xor ebx, ebx
cmp dword [ebp - 0x24], 0x75bd
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x48], dl
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x34], esi
jle 0x10032301
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov esi, ecx
mov dword [ebp - 0x40], ebx
xor esi, eax
xor esi, edi
mov eax, esi
mov ecx, 0x1060e778
or eax, ebx
cdq
push edx
push eax
call fcn.10021179
inc ebx
cmp ebx, 0x50f1
jl 0x100322be
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x28], ecx
push 0
pop ebx
cmp ecx, 0x302c
jl 0x100322b5
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x6ab9
jl 0x100322b0
inc edi
cmp edi, 0x2cdd
jl 0x100322ab
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x717d
jge 0x1003231c
mov edx, 0x100083e4
mov ecx, 0x1060e778
call fcn.10023bd7
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x1003235e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1b4], 0xc64a6847
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1003234d
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10032388
push 0x50b
push 0x1445
push 0x1c95
push 0x118a
push ebx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 4
jge 0x10032439
mov dword [ebp - 0x24], 0x2b6b
cmp dword [ebp - 0x24], 0x2e35
jle 0x1003240b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov esi, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x28], 0x227e
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x1cc]
or eax, edi
cdq
push edx
push eax
call fcn.1000a30e
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100323d8
mov eax, dword [eax]
push eax
call fcn.1005137c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x1cc]
call fcn.10021997
inc edi
cmp edi, 0x43c6
jl 0x100323bc
dec esi
dec dword [ebp - 0x28]
jne 0x100323ba
mov esi, dword [ebp - 0x2c]
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x6b29
jl 0x100323b0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1b4], 9
cmp dword [ebp - 0x24], 0x2ae1
jge 0x1003242d
push 0x100083f4
call fcn.1005137c
pop ecx
or dword [ebp - 4], 0xffffffff
inc dword [ebp - 0x20]
jmp 0x1003238b
mov dword [ebp - 0x38], 0x61f9c28a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10032452
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnionRect]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10032463
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
push 0xfffffffffffffff6
xor esi, esi
lea ecx, [ebp - 0xe0]
pop edi
inc esi
mov dword [ebp - 0x20], edi
push esi
call fcn.100213ce
mov dword [ebp - 0x18], ebx
jmp 0x1003248c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1003247d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xe0]
mov dword [eax], ecx
mov dword [ebp - 0x20], ebx
jmp 0x100324ae
mov dword [ebp - 0x28], 0xfffffffd
inc dword [ebp - 0x28]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x30
jl 0x100324a1
lea ecx, [ebp - 0xe0]
call fcn.100214a3
mov dword [ebp - 0x18], 0x39beb064
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x28], 9
mov dword [ebp - 0x38], 5
mov dword [ebp - 0x24], 0xf6b4
mov dword [ebp - 0x40], 0x4dcd7820
mov dword [ebp - 0x1c], ebx
jmp 0x10032508
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x18c], 0x3e90
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100324f7
mov dword [ebp - 0x1c], ebx
jmp 0x10032524
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd4], 0x4122e7df
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10032513
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003253a
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x18]
je 0x1003258c
mov dword [ebp - 0x38], 7
mov dword [ebp - 0x40], 0x811ffbe6
mov dword [ebp - 0x18], ebx
jmp 0x10032584
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x10032575
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x18c], 0xfff7
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10032564
dec dword [ebp - 0x28]
mov dword [ebp - 0x40], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x10032555
jmp 0x100325eb
mov dword [ebp - 0x20], 0x85a1ec8f
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xd0]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x20], ebx
jne 0x100325b0
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
je 0x100325d6
mov ecx, esi
cmp dword [ebp - 0xd0], ebx
jne 0x100325d8
mov ecx, ebx
xor eax, eax
cmp ecx, 0xc0ed
setle al
neg eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x40], esi
mov edi, dword [0x1006d87c]
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], 0xbac04ee7
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], 0xb
jmp 0x10032619
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffec
je 0x10032607
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10032634
push esi
push 0x10d3
call dword [sym.imp.USER32.dll_EnableWindow]
mov dword [ebp - 0x18], 6
xor ecx, ecx
mov dword [ebp - 0x20], 0x829ed890
inc ecx
mov dword [ebp - 0x1c], ecx
mov eax, 0x38c8a251
mov dword [ebp - 0x130], eax
xor edx, edx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
cmp eax, ecx
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp + 8]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x814a
setle cl
sub eax, ecx
mov dword [esi], ebx
sub eax, dword [ebp - 0x1c]
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
cmp eax, 0xa6f
jne 0x1003278f
push 1
lea ecx, [ebp - 0xc0]
call fcn.100213ce
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
jmp 0x100326d7
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x8c], 0xcadd6352
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100326c6
mov dword [ebp - 0x1c], ebx
jmp 0x100326f1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xc0]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100326e1
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x10032716
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10032711
push edx
call dword [sym.imp.USER32.dll_ShowCursor]
xor edx, edx
inc edx
dec dword [ebp - 0x1c]
jns 0x100326fe
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
je 0x1003273b
mov eax, dword [ebp - 0x20]
xor ecx, ecx
test eax, eax
setns cl
cmp ecx, 0xffffffff
mov ecx, edx
jne 0x1003273d
mov ecx, ebx
mov eax, dword [ebp - 0xc0]
cmp ecx, dword [eax]
jne 0x1003274a
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x8c]
mov ecx, 0x63ab
mov eax, dword [ebp - 0xc0]
sub ecx, dword [eax]
mov edx, dword [eax]
mov eax, dword [ebp - 0x20]
add eax, ecx
xor ecx, ecx
cmp eax, edx
setg cl
xor eax, eax
cmp ecx, edx
lea ecx, [ebp - 0xc0]
sete al
sub eax, 0xfff8
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x12c], eax
call fcn.100214a3
jmp 0x100327a8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100327a8
push 0xa4a
push 0x1b65
call dword [sym.imp.USER32.dll_SetParent]
cmp byte [ebp - 0x48], 0
je 0x10032996
xor eax, eax
inc eax
cmp edi, eax
jne 0x10032996
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10008e50]
lea ecx, [ebp - 0x88]
mov dword [ebp - 0x20], 0xd9ed
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x174]
mov dword [ebp - 0x18], 0xffffffff
push eax
push ebx
mov dword [esi + 8], 4
movdqu xmmword [ebp - 0x174], xmm0
mov dword [ebp - 0x88], ebx
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x80], ebx
call fcn.1002462b
mov edi, dword [ebp - 0x88]
xor edx, edx
mov dword [ebp - 0x2c], 0x44d99649
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x30], 8
mov dword [ebp - 0x4c], 0xb7dc
mov dword [ebp - 0x28], 0x7dfe98d7
mov dword [ebp - 0x3c], 2
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
setne dl
mov eax, dword [ebp - 0x1c]
mov dword [edi + 4], edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x2c], 1
mov eax, dword [ebp - 0x2c]
add eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0x4555
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
neg eax
cmp eax, 3
jae 0x1003291a
mov dword [ebp - 0x30], 0xec8f
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x20]
setne cl
sub esi, ecx
neg esi
sbb esi, esi
xor edx, edx
inc esi
cmp esi, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 4
setl al
sub eax, dword [ebp - 0x28]
je 0x100328f0
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x88]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ecx + 8]
sub ecx, eax
cmp ecx, dword [ebp - 0x30]
jl 0x10032910
cmp dword [ebp - 0x28], ebx
je 0x10032910
xor eax, eax
inc eax
jmp 0x10032912
mov eax, ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
jmp 0x10032928
mov dword [ebp - 0x34], 0x7820
mov dword [ebp - 0x34], 0x7b11082e
mov ecx, dword [ebp - 0x3c]
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x4c]
setg dl
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0xed6c
setle al
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x88]
mov ecx, dword [edi + 4]
cmp dword [eax], ecx
jle 0x1003296b
test ecx, ecx
jne 0x1003296b
mov edx, ebx
jmp 0x1003296e
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x88]
setge cl
mov dword [eax + 0xc], ecx
lea ecx, [ebp - 0x88]
call fcn.100214a3
mov edi, dword [ebp - 0x40]
mov dword [esi + 0xc], 0x1006d87c
push 3
lea ecx, [ebp - 0x150]
call fcn.100213ce
mov dword [ebp - 0x1c], ebx
jmp 0x100329b7
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x150]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100329a8
mov dword [ebp - 0x1c], ebx
jmp 0x100329d3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x120], 0xfffffff8
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100329c2
mov dword [ebp - 0x114], 2
cmp dword [ebp - 0x114], ebx
jl 0x10032a08
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10032a00
push ebx
push 0x20ba
call dword [sym.imp.GDI32.dll_SetLayout]
dec dword [ebp - 0x114]
jns 0x100329eb
lea ecx, [ebp - 0x150]
call fcn.100214a3
mov esi, dword [ebp - 0x44]
cmp esi, edi
jge 0x1003356c
mov dword [ebp - 0x24], ebx
lea ecx, [ebp - 0x110]
mov edi, 0x1006d880
mov dword [ebp - 0x1c], 0x26c312fb
mov dword [ebp - 0x20], 0x6d9918c6
push 4
mov dword [ebp - 0x34], edi
call fcn.100213ce
push 4
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x10032a5c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x110]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10032a4c
mov dword [ebp - 0x18], ebx
jmp 0x10032a77
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1a4], 0x98d4
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10032a66
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp eax, 0x3fc2
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x1c]
sub edx, 0x3ee67684
jne 0x10032aa5
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0xfffffffe
setne al
add eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jne 0x10032ade
cmp dword [ebp - 0x1c], ebx
jne 0x10032ade
mov edx, ebx
jmp 0x10032ae1
xor edx, edx
inc edx
xor ecx, ecx
mov dword [ebp - 0x24], 0xf2c2
mov eax, dword [ebp - 0x20]
cmp edx, eax
setl cl
neg ecx
cmp dword [ebp - 0x24], ecx
jl 0x10032b12
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10032c3d
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
jmp 0x10032c3d
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x3c], 0x73dd6028
mov dword [ebp - 0x38], 0xaab159bb
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffef
jne 0x10032c3d
xor edi, edi
mov dword [ebp - 0x2c], 0x203fca5e
mov dword [ebp - 0x20], ebx
jmp 0x10032c21
mov dword [ebp - 0x30], 0x93506f8a
mov dword [ebp - 0x4c], 0xe8591f28
mov dword [ebp - 0x28], 0x6c484d54
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 4
mov ecx, ebx
cmp dword [ebp - 0x18], ebx
je 0x10032b77
lea ecx, [edi + 1]
shl ecx, 2
sub ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
cmp edx, eax
setge cl
add ecx, 0x22bbcae3
cmp ecx, dword [ebp - 0x18]
jl 0x10032bad
lea ecx, [edi + 1]
cmp dword [ebp - 0x30], ebx
jne 0x10032baf
mov ecx, ebx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp eax, 0x8d46
setg cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x4c]
sub ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setl dl
xor ecx, ecx
cmp edx, eax
setg cl
imul ecx, dword [ebp - 0x4c]
add ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], ecx
xor ecx, ecx
cmp eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
cmp ecx, 0xc6e1
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x19c]
mov dword [ebp - 0x28], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jle 0x10032b45
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffef
je 0x10032b36
mov edi, 0x1006d880
lea ecx, [ebp - 0x110]
call fcn.100214a3
test esi, esi
jle 0x10033042
push 4
pop esi
push esi
lea ecx, [ebp - 0x78]
call fcn.100213ce
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], 0xf3d47941
mov dword [ebp - 0x24], ebx
jmp 0x10032c82
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], 0xe48d327c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], esi
jl 0x10032c72
mov dword [ebp - 0x1c], 3
cmp dword [ebp - 0x1c], ebx
jl 0x10032e83
mov dword [ebp - 0x3c], 0xa53ebff7
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x78]
cmp dword [eax + edx*4], 0x2782
sete cl
imul eax, ecx, 0x4ba8
mov ecx, dword [ebp - 0x1c]
sub eax, 0x5725d367
neg eax
sbb eax, eax
xor edx, edx
inc eax
add ecx, eax
mov eax, dword [ebp - 0x78]
cmp ecx, dword [eax + esi*4]
mov eax, dword [ebp - 0x20]
setl dl
add eax, edx
imul eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x78]
neg eax
sbb eax, eax
inc eax
imul eax, dword [ecx + edi*4]
dec eax
je 0x10032d00
mov dword [ecx + 0xc], 1
jmp 0x10032e5d
mov dword [ebp - 0x28], 0x3312a7fa
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x2c], 0xd257
push 4
call fcn.100213ce
mov dword [ebp - 0x18], ebx
jmp 0x10032d31
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x180], 0xb95c1f4a
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032d20
mov dword [ebp - 0x18], ebx
jmp 0x10032d4f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10032d3c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x78]
mov dword [eax + 4], ecx
mov dword [ebp - 0x20], ebx
jmp 0x10032e48
mov dword [ebp - 0x18], 0x4d8d955a
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x78]
mov dword [eax + ecx*4], ebx
mov dword [ebp - 0x18], 0xfffffff7
cmp dword [ebp - 0x18], 7
jle 0x10032e45
mov edi, dword [ebp - 0x78]
mov dword [ebp - 0x38], 0xffff
mov dword [ebp - 0x4c], 0x1efae07d
mov dword [ebp - 0x24], ebx
jmp 0x10032daa
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x138], ebx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x10032d9d
mov ecx, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x180], edx
mov eax, dword [ebp - 0x28]
cmp dword [edi + 8], eax
setge cl
xor eax, eax
cmp ecx, 5
setl al
xor edx, edx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x18], 0x6bda
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setle dl
mov dword [ebp - 0x28], edx
xor edx, edx
mov ecx, dword [ebp - 0x28]
cmp ecx, 0xffffffff
mov eax, dword [ebp - 0x104]
mov esi, dword [ebp - 0x1c]
sete dl
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x78]
cmp dword [eax + esi*4], edx
setg cl
cmp ecx, 0xaac01277
sbb ecx, ecx
xor eax, eax
neg ecx
cmp ecx, 0x4c7c
setge al
mov dword [ebp - 0x138], eax
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 7
jg 0x10032d8a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 8
jl 0x10032d66
lea ecx, [ebp - 0x104]
call fcn.100214a3
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10032e77
push 0xd1e
push 0x1c73
push ebx
call dword [sym.imp.GDI32.dll_OffsetRgn]
dec dword [ebp - 0x1c]
jns 0x10032c97
mov edi, dword [ebp - 0x34]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10032e92
call dword [sym.imp.USER32.dll_GetCapture]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.100214a3
mov esi, dword [edi]
lea ecx, [ebp - 0xec]
push 1
call fcn.100213ce
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x10032ec8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0x1928c176
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x10032eb5
mov dword [ebp - 0x18], ebx
jmp 0x10032ee3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x194], 0x3b0c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032ed2
mov eax, dword [ebp - 0xec]
lea ecx, [ebp - 0xec]
mov dword [eax], ebx
call fcn.100214a3
mov edx, dword [edi + 4]
mov dword [ebp - 0x18], 8
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], 0x1b
jle 0x10032f87
xor ecx, ecx
inc ecx
mov dword [ebp - 0x20], 0x5a9c4c8d
mov dword [ebp - 0x3c], 0xfffffffa
mov dword [ebp - 0x3c], 0x15d7249a
mov dword [ebp - 0x38], 0xb963ab1
mov dword [ebp - 0x24], ebx
jmp 0x10032f41
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x7c], 0x4074dd03
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ecx
jl 0x10032f33
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jg 0x10032f7e
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x7c]
mov eax, dword [ebp - 0x20]
sub ecx, dword [ebp + eax*4 - 0x7c]
sub ecx, dword [ebp - 0x3c]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10032f4e
xor ecx, ecx
inc ecx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1b
jg 0x10032f12
add edi, 8
test edx, edx
jne 0x10032f91
add edi, 8
mov dword [ebp - 0x18], ebx
jmp 0x10032fa7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10032f96
mov dword [ebp - 0x18], ebx
jmp 0x10032fbf
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x158], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10032fb2
mov dword [ebp - 0x9c], ebx
jmp 0x10033012
mov dword [ebp - 0x2c], 0xd8cb
xor edx, edx
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xa0]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0x2c]
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
sub eax, edx
mov dword [ebp - 0x154], eax
dec dword [ebp - 0x9c]
cmp dword [ebp - 0x9c], 0xffffffe6
jge 0x10032fcd
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10033034
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
add edi, esi
dec dword [ebp - 0x44]
mov dword [ebp - 0x34], edi
jne 0x10032c50
mov dword [ebp - 0x6c], 8
xor edx, edx
mov dword [ebp - 0x68], 8
inc edx
mov dword [ebp - 0x64], 8
mov dword [ebp - 0x60], 8
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x24], ebx
jmp 0x1003307e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x50], 0x48261f9c
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10033070
mov dword [ebp - 0x68], ebx
cmp dword [ebp - 0x68], ebx
jl 0x10033145
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x34], ebx
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x50], ebx
je 0x100330a9
mov eax, dword [ebp - 0x68]
cmp dword [ebp + eax*4 - 0x50], ebx
mov eax, edx
jne 0x100330ab
mov eax, ebx
add eax, 0xfffffff7
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x68]
mov ecx, dword [ebp + eax*4 - 0x50]
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
jle 0x100330fb
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jg 0x100330e7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100330dc
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x100330cc
xor edx, edx
inc edx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10033139
push edx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObjectEx]
jmp 0x10033139
mov dword [ebp - 0x34], 0xfffffff9
mov dword [ebp - 0x38], 0x9034e105
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x50], ecx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x50], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x64]
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x68]
imul eax, eax, 0xf
mov dword [ebp - 0x38], eax
dec dword [ebp - 0x68]
push 1
pop edx
jns 0x1003308f
dec dword [ebp - 0x3c]
mov esi, dword [edi]
mov dword [ebp - 0x30], 0x5b57fd54
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], ebx
jmp 0x10033167
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x54], 0xb1c2a2c7
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x10033159
mov dword [ebp - 0x30], ebx
jmp 0x100331d5
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10033183
call dword [sym.imp.USER32.dll_GetMessageTime]
mov dword [ebp - 0x20], ebx
jmp 0x100331cd
mov dword [ebp - 0x44], 0xfa5fef9d
mov dword [ebp - 0x44], ebx
cmp dword [ebp - 0x44], ebx
jl 0x100331c1
mov dword [ebp - 0x24], 0x4d1878ab
mov dword [ebp - 0x24], ebx
jmp 0x100331b7
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100331b4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], ebx
jle 0x100331a3
dec dword [ebp - 0x44]
jns 0x10033197
mov eax, dword [ebp - 0x20]
cmp dword [ebp + eax*4 - 0x54], ebx
jne 0x100331d2
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x10033188
dec dword [ebp - 0x30]
cmp dword [ebp - 0x30], 0xffffffe2
jle 0x10033171
push 2
lea ecx, [ebp - 0xf8]
call fcn.100213ce
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xcc]
mov dword [ebp - 0x44], 0xa23fe5e8
mov dword [ebp - 0x28], 0x3ac46ddc
push 1
call fcn.100213ce
mov byte [ebp - 4], 6
mov dword [ebp - 0x20], 0xfffffff9
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], 0xab59a67e
mov dword [ebp - 0x1c], ebx
jmp 0x10033237
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0x2c21
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10033224
xor edx, edx
mov dword [ebp - 0x1c], ebx
inc edx
cmp dword [ebp - 0x1c], 3
jge 0x10033258
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x98], edx
inc dword [ebp - 0x1c]
jmp 0x10033243
mov dword [ebp - 0x1c], ebx
jmp 0x10033270
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xcc]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x1003325d
mov dword [ebp - 0x98], edx
cmp dword [ebp - 0x98], ebx
jl 0x100332eb
jmp 0x10033288
xor edx, edx
inc edx
mov dword [ebp - 0x34], 0xffffffff
lea ecx, [ebp - 0x144]
mov dword [ebp - 0x34], 0x3d2d672a
push edx
call fcn.100213ce
xor edx, edx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x24], ebx
inc edx
jmp 0x100332c0
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x144]
mov dword [eax + ecx*4], 0x4dfbd6c3
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jl 0x100332ad
inc dword [ebp - 0x34]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100332d8
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [ebp - 0x144]
call fcn.100214a3
dec dword [ebp - 0x98]
jns 0x10033285
mov eax, dword [ebp - 0x90]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
sub eax, 0xebe66343
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [eax]
xor eax, eax
cmp ecx, 0x6dbd8d46
setl al
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setl dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x44], ecx
mov eax, dword [ebp - 0x44]
sub eax, dword [ebp - 0x98]
neg eax
sbb eax, eax
or ecx, 0xffffffff
inc eax
sub ecx, eax
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0xcc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0xf8]
cmp ecx, dword [eax + 4]
jge 0x10033372
cmp dword [ebp - 0x38], ebx
je 0x10033372
xor eax, eax
inc eax
jmp 0x10033374
mov eax, ebx
xor ecx, ecx
cmp eax, 0x177c83be
setne cl
xor eax, eax
cmp ecx, 0xd22
lea ecx, [ebp - 0xcc]
setge al
mov dword [ebp - 0x20], eax
imul eax, dword [ebp - 0x20], 0xffff
mov dword [ebp - 0x34], eax
call fcn.100214a3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.100214a3
mov eax, dword [edi + 4]
mov dword [ebp - 0x30], 6
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x18], ebx
jmp 0x100333d3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x164], 0x20624039
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100333c2
push 2
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x100333ef
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x5c], 0xfffffff6
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100333e1
mov dword [ebp - 0x58], edx
cmp dword [ebp - 0x58], ebx
jl 0x10033485
push 0xfffffffffffffff6
pop esi
mov dword [ebp - 0x20], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x24], 0xbd004dde
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x164]
test eax, eax
setne cl
imul eax, ecx, 0x76df
cmp esi, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp + eax*4 - 0x164]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
jmp 0x10033478
mov dword [ebp - 0x38], 0xfff6
mov dword [ebp - 0x24], edx
cmp dword [ebp - 0x24], ebx
jl 0x10033463
mov dword [ebp - 0x30], 1
dec dword [ebp - 0x24]
jns 0x10033457
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x30], ebx
jl 0x10033475
cmp dword [ebp - 0x38], ebx
jne 0x10033475
dec dword [ebp - 0x30]
jns 0x1003346b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x10033448
dec dword [ebp - 0x58]
jns 0x10033403
mov esi, dword [ebp - 0x2c]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003349f
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
cmp dword [ebp - 0x34], 0
jne 0x1003356c
cmp byte [ebp - 0x48], 0
je 0x100334be
cmp dword [ebp - 0x40], 1
jne 0x100334be
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [edi + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [edi + 0xc]
push esi
mov dword [ebp - 0x38], eax
call fcn.1004fcdf
pop ecx
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0xb4]
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa8], ebx
push eax
push esi
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
call fcn.10033c83
mov eax, dword [ebp - 0x2c]
mov esi, ebx
mov ecx, dword [ebp - 0xb4]
test eax, eax
jle 0x10033554
mov eax, esi
and eax, 0x80000001
jns 0x1003351c
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x54]
add eax, esi
add eax, dword [ebp - 0x54]
imul eax, dword [ebp - 0x38]
jmp 0x10033531
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x2c]
cmp word [ecx + edx*2], bx
jne 0x1003352e
xor eax, eax
inc eax
mov word [ecx + edx*2], ax
mov al, byte [edx + edi + 0x10]
mov edx, dword [ebp - 0x40]
mov byte [esi + edx], al
inc esi
mov eax, dword [ebp - 0x2c]
cmp esi, eax
jl 0x1003350e
mov esi, dword [ebp + 8]
mov dword [esi], eax
mov eax, dword [ebp - 0x40]
mov dword [esi + 4], eax
test ecx, ecx
je 0x1003356f
push ecx
call fcn.10051549
pop ecx
jmp 0x1003356f
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret