Function at 0x1000a612
Capabilities:
Create directory
Encode data using xor
Query environment variable
Query service status
Start service

Disassembly:
mov eax, 0x10069a0b
call fcn.10069538
sub esp, 0x1ec
push ebx
push esi
xor ebx, ebx
mov byte [ebp - 0x38], dl
push edi
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1000a646
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x5c], 0xe00fe1ca
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000a638
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x58]
setne dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x34], ecx
mov ecx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x5c]
cmp ecx, eax
setle dl
xor eax, eax
cmp edx, 1
setle al
cmp eax, dword [ebp - 0x34]
jle 0x1000a697
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1000a6f6
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x1000a6f6
push 2
lea ecx, [ebp - 0xe0]
call fcn.1000c137
mov dword [ebp - 0x14], ebx
jmp 0x1000a6bc
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0xfdbd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000a6a9
mov eax, dword [ebp - 0xe0]
cmp dword [eax + 4], ebx
je 0x1000a6d7
cmp dword [ebp - 0x5c], ebx
je 0x1000a6d7
xor eax, eax
inc eax
jmp 0x1000a6d9
mov eax, ebx
xor ecx, ecx
cmp eax, 1
mov eax, 0xb060
setge cl
sub eax, ecx
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x34], eax
call fcn.1000c1b9
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], bl
je 0x1000a709
push 0xcfa
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009020]
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x40], 0xfa860b4f
xor eax, eax
inc eax
mov dword [ebp - 0xac], ebx
mov dword [ebp - 0x28], eax
or edi, 0xffffffff
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x16c]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x24], 0x43c4ab2
push eax
mov dword [ebp - 0x24], 7
lea eax, [ebp - 0x17c]
mov dword [ebp - 0x14], 0xd085c9e5
push eax
mov dword [ebp - 0x20], 0xc4f27d27
mov dword [ebp - 0x24], 0x50315362
mov dword [ebp - 0x24], ebx
push ebx
movdqu xmmword [ebp - 0x17c], xmm0
mov dword [ebp - 0xa8], ebx
mov dword [ebp - 0xa4], ebx
call fcn.1000e6e7
mov dword [ebp - 4], ebx
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], 0xd66c4a87
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x2c], ebx
inc dword [ebp - 0x20]
mov ecx, dword [ebp - 0x30]
sub ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x14]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
cmp eax, 0x5879
setle cl
sub ecx, 0x3426
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp eax, 6
setl cl
mov dword [ebp - 0x20], ecx
imul eax, dword [ebp - 0x20], 0xffff
test eax, eax
je 0x1000a8c3
mov dword [ebp - 0x14], ebx
xor edx, edx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], 0x29219798
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], 0x28bf2fea
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
inc ecx
cmp ecx, 0x5954a437
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, 0x149f
setne dl
add edx, dword [ebp - 0x40]
imul edx, dword [ebp - 0x14]
sub eax, edx
add eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x14]
jne 0x1000a882
cmp dword [ebp - 0x14], ebx
jne 0x1000a882
mov eax, ebx
jmp 0x1000a885
xor eax, eax
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x2c], eax
je 0x1000a89a
cmp dword [ebp - 0x30], ebx
je 0x1000a89a
xor eax, eax
inc eax
jmp 0x1000a89c
mov eax, ebx
push 3
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], ebx
pop esi
jmp 0x1000a8bc
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xac]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1000a8a7
jmp 0x1000a91a
push 2
lea ecx, [ebp - 0x158]
call fcn.1000c137
mov dword [ebp - 0x14], ebx
jmp 0x1000a8e8
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x158]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000a8d5
xor ecx, ecx
mov dword [ebp - 0x14], ebx
inc ecx
jmp 0x1000a904
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], 0x9e20
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1000a8f6
dec dword [ebp - 0x60]
lea ecx, [ebp - 0x158]
call fcn.1000c1b9
push 3
pop esi
lea ecx, [ebp - 0xac]
mov dword [ebp - 4], edi
call fcn.1000c1b9
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009010]
lea eax, [ebp - 0x19c]
push eax
lea eax, [ebp - 0x1ac]
mov dword [ebp - 0x6c], ebx
push eax
push ebx
lea ecx, [ebp - 0x6c]
mov dword [ebp - 0x68], ebx
movdqu xmmword [ebp - 0x1ac], xmm0
mov dword [ebp - 0x64], ebx
call fcn.1000e6e7
mov dword [ebp - 4], 1
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x28], 5
push 2
call fcn.1000c137
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x2c], 0x69209a48
mov dword [ebp - 0x34], 0x842b
mov dword [ebp - 0x24], 0xc90c63b8
push 1
call fcn.1000c137
mov dword [ebp - 0x24], 0x96a9cbd
push 4
mov dword [ebp - 0x24], 0x681c37f5
mov dword [ebp - 0x18], ebx
pop edi
jmp 0x1000a9c3
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x19c], 0x96e6a373
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1000a9b2
mov dword [ebp - 0x18], ebx
jmp 0x1000a9e0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0xdfbc43c
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000a9cd
xor edx, edx
mov dword [ebp - 0x18], ebx
inc edx
jmp 0x1000aa01
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000a9ee
mov dword [ebp - 0x28], ebx
jmp 0x1000aa1b
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x6c]
mov dword [eax + ecx*4], 0xb50b
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edi
jl 0x1000aa0b
cmp dword [ebp - 0x190], ebx
jne 0x1000aa92
cmp dword [ebp - 0x28], ebx
je 0x1000aa7a
mov edi, dword [ebp - 0xbc]
xor ecx, ecx
mov eax, dword [ebp - 0x6c]
cmp dword [edi + 4], ebx
setne cl
add ecx, dword [eax + 4]
cmp ecx, dword [ebp - 0x28]
jg 0x1000aa4b
cmp dword [edi + 4], ebx
je 0x1000aa52
mov ecx, edx
cmp dword [edi + 4], ebx
jne 0x1000aa54
mov ecx, ebx
mov eax, dword [ebp - 0x2c]
imul eax, ecx
cmp eax, edx
sbb eax, eax
xor ecx, ecx
neg eax
mov dword [ebp - 0x190], eax
mov eax, dword [ebp - 0x34]
cmp dword [edi + 4], eax
mov edi, edx
mov eax, dword [ebp - 0x28]
setle cl
add eax, ecx
jne 0x1000aa7c
mov edi, ebx
mov eax, dword [ebp - 0xbc]
xor ecx, ecx
cmp edi, dword [eax + 4]
mov eax, dword [ebp - 0x6c]
setl cl
cmp ecx, dword [eax + 8]
jne 0x1000aa94
mov edx, ebx
mov dword [ebp - 0x24], edx
xor edx, edx
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x28]
cmp eax, ecx
mov eax, dword [ebp - 0x28]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x104]
setne cl
mov dword [eax], ecx
xor ecx, ecx
mov dword [ebp - 0x28], 1
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x34]
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x24], 0xe181f51b
call fcn.1000c1b9
lea ecx, [ebp - 0xbc]
call fcn.1000c1b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.1000c1b9
mov eax, dword [0x100705fc]
lea ecx, [ebp - 0x84]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
push 1
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
call fcn.1000c137
mov dword [ebp - 4], esi
mov dword [ebp - 0x2c], 0x46bd
cmp dword [ebp - 0x2c], 0x4721
jle 0x1000ab74
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov esi, ebx
mov ebx, dword [ebp - 0x20]
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10612038
xor eax, ebx
cdq
push edx
push eax
call fcn.1000c022
inc esi
cmp esi, 0x1ded
jl 0x1000ab39
inc edi
push 0
pop ebx
cmp edi, 0x4267
jl 0x1000ab34
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x3bf2
jl 0x1000ab32
push 3
pop esi
mov byte [ebp - 4], 4
cmp dword [ebp - 0x2c], 0x461c
jge 0x1000ab90
mov edx, 0x10007730
mov ecx, 0x10612038
call fcn.1000e0f4
push 4
pop edi
xor edx, edx
mov dword [ebp - 0x14], ebx
inc edx
jmp 0x1000abd0
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1b8], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000abbf
mov dword [ebp - 0x14], ebx
jmp 0x1000abed
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x84]
mov dword [eax + ecx*4], 6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1000abda
mov eax, dword [ebp - 0x84]
mov dword [eax], ebx
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x1b8], ebx
mov eax, dword [ebp - 0x84]
jne 0x1000ac12
inc dword [eax]
cmp dword [eax], 2
jle 0x1000abfa
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x84]
mov dword [eax], 0xfffffff7
call fcn.1000c1b9
cmp byte [ebp - 0x38], 0
mov ecx, dword [ebp - 0x34]
je 0x1000ac42
cmp ecx, 1
jne 0x1000ac42
mov eax, dword [ebp + 8]
mov dword [eax + 8], edi
mov dword [eax + 0xc], 0x100705fc
cmp dword [ebp - 0x44], ecx
jge 0x1000b7e7
push dword [ebp + 8]
movdqa xmm0, xmmword [0x10009060]
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x18c]
mov dword [ebp - 0x28], 0x8a1f9496
push eax
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x90]
push ebx
movdqu xmmword [ebp - 0x18c], xmm0
mov dword [ebp - 0x90], ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x88], ebx
call fcn.1000e6e7
mov dword [ebp - 4], 6
mov dword [ebp - 0x2c], esi
cmp dword [ebp - 0x28], ebx
je 0x1000ad3d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x90]
neg eax
sbb eax, eax
inc eax
mov dword [ecx + 8], eax
je 0x1000acc9
cmp dword [ebp - 0x28], ebx
jne 0x1000acd2
cmp dword [ebp - 0x28], ebx
jne 0x1000acd2
mov eax, ebx
jmp 0x1000acd5
xor eax, eax
inc eax
imul eax, eax, 0xfc65
cmp eax, dword [ebp - 0x28]
jg 0x1000ace9
cmp dword [ecx + 8], ebx
jne 0x1000ace9
mov edx, ebx
jmp 0x1000acec
xor edx, edx
inc edx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x14], ebx
je 0x1000ad3d
mov dword [ebp - 0x14], 0x17
jmp 0x1000ad35
mov dword [ebp - 0x28], ebx
jmp 0x1000ad2d
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000ad2a
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], esi
jle 0x1000ad18
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe9
jle 0x1000ad13
jmp 0x1000ad77
push 2
lea ecx, [ebp - 0x11c]
call fcn.1000c137
mov dword [ebp - 0x14], ebx
jmp 0x1000ad5e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x11c]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000ad4f
mov eax, dword [ebp - 0x11c]
lea ecx, [ebp - 0x11c]
dec dword [eax]
call fcn.1000c1b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.1000c1b9
mov dword [ebp - 0x18], 0x73bf
mov edi, 0x10070600
mov dword [ebp - 0x14], 0x16de6eab
mov dword [ebp - 0x40], 0x3ca30775
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x18], ebx
jne 0x1000ae41
mov eax, dword [ebp - 0x18]
dec eax
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
imul eax, edx, 0x74b6
sub eax, 0x3a3254a6
cmp eax, dword [ebp - 0x18]
jl 0x1000ade5
cmp dword [ebp - 0x14], ebx
jne 0x1000ade5
mov eax, ebx
jmp 0x1000ade8
xor eax, eax
inc eax
mov edx, dword [ebp - 0x18]
xor ecx, ecx
imul edx, dword [ebp - 0x18]
imul edx, eax
add edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setle cl
cmp dword [ebp - 0x18], ecx
jle 0x1000ae07
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
inc edx
cmp dword [ebp - 0x18], edx
jl 0x1000ae1c
mov eax, edx
cmp dword [ebp - 0x14], ebx
jne 0x1000ae1e
mov eax, ebx
cmp eax, dword [ebp - 0x18]
jl 0x1000ae2b
mov dword [ebp - 0x2c], edx
cmp dword [ebp - 0x14], ebx
jne 0x1000ae2e
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x40]
xor ecx, ecx
cmp dword [ebp - 0x2c], eax
setle cl
mov dword [ebp - 0x40], ecx
mov eax, dword [ebp - 0x18]
jmp 0x1000ae44
xor edx, edx
inc edx
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
je 0x1000ae51
mov eax, dword [ebp - 0x18]
jmp 0x1000ae53
mov edx, ebx
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000ae75
push ebx
push 0x14bb
push 0x227
push 0x1517
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
cmp dword [ebp - 0x44], 0
mov dword [ebp - 0x30], ebx
jle 0x1000b518
push 4
lea ecx, [ebp - 0xf8]
call fcn.1000c137
mov dword [ebp - 4], 7
push 4
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x1000aeb5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xf8]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000aea5
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], esi
jg 0x1000b0be
mov eax, dword [ebp - 0xf8]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 0x15af
cmp dword [ebp - 0x24], 0x88b
jge 0x1000afc9
push 0x10613174
push 0x10613170
push 0x100077cc
call fcn.10050d4b
mov ecx, dword [0x10613170]
add esp, 0xc
mov dword [ebp - 0x24], ebx
test ecx, ecx
jle 0x1000af2f
mov esi, dword [ebp - 0x24]
mov ebx, 0x106132f0
push ebx
push 0x100077d4
call fcn.10050d4b
pop ecx
pop ecx
mov ecx, dword [0x10613170]
inc esi
add ebx, 0x65
cmp esi, ecx
jl 0x1000af0f
push 3
xor ebx, ebx
pop esi
mov byte [ebp - 0x19], 1
test ecx, ecx
jle 0x1000afa2
mov esi, dword [0x10613174]
and esi, 0x80000001
jns 0x1000af4a
dec esi
or esi, 0xfffffffe
inc esi
mov dword [ebp - 0x2c], ecx
mov edx, 0x106132f0
mov cl, byte [ebp - 0x19]
test esi, esi
jne 0x1000af5e
test cl, cl
sete cl
cmp dword [0x10613174], 0
mov eax, ebx
jle 0x1000af91
test cl, cl
je 0x1000af79
cmp byte [eax + edx], 0x2d
je 0x1000af83
mov byte [eax + edx], 0x57
jmp 0x1000af83
cmp byte [eax + edx], 0x2d
je 0x1000af83
mov byte [eax + edx], 0x42
test cl, cl
sete cl
inc eax
cmp eax, dword [0x10613174]
jl 0x1000af69
add edx, 0x65
dec dword [ebp - 0x2c]
jne 0x1000af55
mov ecx, dword [0x10613170]
push 3
pop esi
mov dword [ebp - 0x24], ebx
test ecx, ecx
jle 0x1000afc9
mov esi, dword [ebp - 0x24]
mov ebx, 0x106132f0
push ebx
call fcn.10051126
inc esi
add ebx, 0x65
pop ecx
cmp esi, dword [0x10613170]
jl 0x1000afb1
push 3
xor ebx, ebx
pop esi
push esi
lea ecx, [ebp - 0x128]
call fcn.1000c137
push 2
mov dword [ebp - 0x2c], 0xf6dae1d
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x1000aff5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xc4], 0xd033
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000afe4
mov dword [ebp - 0x18], ebx
jmp 0x1000b012
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x128]
mov dword [eax + ecx*4], 0x104353ea
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000afff
mov dword [ebp - 0x18], ebx
jmp 0x1000b02d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x16c], 0xe2fd17ba
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x1000b01c
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
inc ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x3c]
xor eax, eax
cmp dword [edx + 4], ecx
setne al
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0xc0]
jne 0x1000b063
mov edx, ebx
cmp dword [ebp - 0xc0], ebx
je 0x1000b065
mov edx, ecx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setne dl
xor ecx, ecx
cmp edx, eax
setg cl
add ecx, dword [ebp - 0x14]
imul eax, ecx, 0xffff
xor ecx, ecx
cmp eax, 0x7222
setg cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x128]
mov eax, dword [ebp - 0x2c]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x16c], eax
call fcn.1000c1b9
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1000aecf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.1000c1b9
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x110]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x24], 0xb2c2
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x3c], eax
call fcn.1000c137
mov dword [ebp - 0x14], ebx
jmp 0x1000b101
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c8], 0xa2768935
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000b0f0
mov dword [ebp - 0x14], ebx
jmp 0x1000b11e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b10b
mov eax, dword [ebp - 0x110]
lea ecx, [ebp - 0x110]
dec dword [eax + 4]
call fcn.1000c1b9
add dword [ebp - 0x28], edi
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x14], ebx
jmp 0x1000b154
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], 0x93b4e1a3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1000b146
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b16b
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x14], 2
cmp dword [ebp - 0x14], ebx
jl 0x1000b2ac
mov dword [ebp - 0x18], 0x9609c3fb
lea ecx, [ebp - 0x14c]
mov dword [ebp - 0x2c], 0x3c3fa3c
push esi
call fcn.1000c137
mov dword [ebp - 0x18], ebx
jmp 0x1000b1ad
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], 0x464f6128
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1000b19a
mov dword [ebp - 0x18], ebx
jmp 0x1000b279
xor ecx, ecx
mov dword [ebp - 0x2c], 0xffffffff
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x40], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1000b1dc
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x164], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b1cf
cmp dword [ebp - 0x18], ebx
je 0x1000b1e9
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov ecx, 0x846c
setle dl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
sub ecx, eax
mov dword [ebp - 0x15c], eax
mov eax, dword [ebp - 0x54]
add eax, ecx
cmp eax, dword [ebp - 0x18]
jl 0x1000b21c
mov eax, dword [ebp - 0x164]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
mov eax, dword [ebp + eax*4 - 0x54]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
sub edx, dword [ebp + eax*4 - 0x54]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], 0x56218477
inc dword [ebp - 0x40]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jle 0x1000b1ba
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp + eax*4 - 0x54]
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x54], ecx
lea ecx, [ebp - 0x14c]
call fcn.1000c1b9
dec dword [ebp - 0x14]
jns 0x1000b17b
mov eax, dword [ebp - 0x28]
lea ecx, [ebp - 0x134]
push esi
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
call fcn.1000c137
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x20], ebx
jmp 0x1000b2db
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1000b2cc
mov dword [ebp - 0x14], ebx
jmp 0x1000b322
mov dword [ebp - 0x20], 0x772304b2
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b2ff
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov dword [ebp - 0x20], ebx
jmp 0x1000b319
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b316
push ebx
push 0xf
call dword [sym.imp.GDI32.dll_SetBkColor]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x1000b304
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x1000b2e5
lea ecx, [ebp - 0x134]
call fcn.1000c1b9
mov edi, dword [ebp - 0x28]
add edi, 4
cmp dword [ebp - 0x24], 0
mov dword [ebp - 0x28], edi
jne 0x1000b348
add edi, 8
mov dword [ebp - 0x28], edi
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 2
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x8b94be3d
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1000b37b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1e8], 0x9b55
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000b36a
mov dword [ebp - 0x14], ebx
jmp 0x1000b397
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0xd4], 0x32fe2236
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x1000b386
mov dword [ebp - 0xcc], ebx
cmp dword [ebp - 0xcc], esi
jg 0x1000b502
mov dword [ebp - 0x18], 0x17be1879
mov dword [ebp - 0x24], 0xad94e8fe
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x7b30498
mov dword [ebp - 0x24], 0xff8cd3be
mov dword [ebp - 0x20], ebx
jmp 0x1000b3e4
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1d8], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000b3d3
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x1000b4ed
mov dword [ebp - 0x14], 0xbd4dfbd6
lea ecx, [ebp - 0x140]
mov dword [ebp - 0x24], 0xc7b7f609
push 4
call fcn.1000c137
push 2
lea ecx, [ebp - 0xec]
mov dword [ebp - 4], 8
call fcn.1000c137
push 4
mov dword [ebp - 0x14], ebx
pop edi
jmp 0x1000b440
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x140]
mov dword [eax + ecx*4], 0xce34aafb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x1000b42d
mov dword [ebp - 0x14], ebx
jmp 0x1000b45d
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xc321a078
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1000b44a
mov dword [ebp - 0x14], ebx
jmp 0x1000b47d
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b47a
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1000b468
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], ebx
jl 0x1000b4c7
mov dword [ebp - 0x20], 0x6652d0da
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xf79facd4
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], esi
jg 0x1000b4c2
mov eax, dword [ebp - 0xec]
inc dword [eax + 4]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xccbb24ad
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jle 0x1000b4ad
dec dword [ebp - 0x14]
jns 0x1000b48a
lea ecx, [ebp - 0xec]
call fcn.1000c1b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x140]
call fcn.1000c1b9
dec dword [ebp - 0x18]
jns 0x1000b3f6
xor ecx, ecx
inc ecx
inc dword [ebp - 0xcc]
cmp dword [ebp - 0xcc], esi
jle 0x1000b3af
mov edi, dword [ebp - 0x28]
add edi, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x30], eax
cmp eax, dword [ebp - 0x44]
jl 0x1000ae82
mov dword [ebp - 0x14], 0x9f9b3198
mov dword [ebp - 0x14], 0xfffffff6
jmp 0x1000b53d
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b537
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [ebp - 0x14]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe5
jle 0x1000b528
mov edi, dword [edi]
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b55d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x20], 6
jmp 0x1000b575
mov dword [ebp - 0x24], 2
cmp dword [ebp - 0x24], ebx
jne 0x1000b57b
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff2
jne 0x1000b566
push 4
pop eax
add dword [ebp - 0x28], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x30], 0x63785551
push 0xfffffffffffffffd
pop ecx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x9c], ecx
mov dword [ebp - 0x98], ecx
mov dword [ebp - 0x94], ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], ebx
jne 0x1000b5d5
cmp dword [ebp - 0x9c], ebx
jne 0x1000b5d5
mov eax, ebx
jmp 0x1000b5d8
xor eax, eax
inc eax
cmp dword [ebp - 0x14], eax
jne 0x1000b5e3
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 0x98]
xor edx, edx
mov eax, dword [ebp - 0xa0]
cmp ecx, eax
setl dl
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], ebx
jl 0x1000b61b
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1000b616
push ebx
push 0x10dd
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
dec dword [ebp - 0x20]
jns 0x1000b601
mov edx, dword [ebp - 0x28]
xor ecx, ecx
inc ecx
mov eax, dword [edx]
mov dword [ebp - 0x14], 0xfffffffc
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x20], ebx
jmp 0x1000b640
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x48], 0xfffffffa
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x1000b632
mov dword [ebp - 0x48], 0xfffffffe
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
ja 0x1000b665
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x14]
jmp 0x1000b66f
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x24], eax
add edx, 4
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x30], 7
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], 9
mov dword [ebp - 0x30], 0x9822cb3a
mov dword [ebp - 0x24], 0x3e38693
mov dword [ebp - 0x2c], 0x233
mov dword [ebp - 0x2c], 0x7a94
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x20], ebx
jmp 0x1000b6bd
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x1f8], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1000b6b0
mov esi, ecx
cmp dword [ebp - 0x14], ebx
jne 0x1000b6cc
mov esi, ebx
mov eax, dword [ebp - 0x44]
inc dword [ebp - 0x44]
test eax, eax
jne 0x1000b709
cmp dword [ebp - 0x14], ebx
je 0x1000b6e0
cmp dword [ebp - 0x30], ebx
jbe 0x1000b6e2
mov ecx, ebx
mov eax, dword [ebp - 0x18]
imul eax, ecx
xor ecx, ecx
dec eax
mov dword [ebp - 0x30], eax
mov edx, dword [ebp - 0x24]
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x2c]
jge 0x1000b706
mov ecx, ebx
jmp 0x1000b709
xor ecx, ecx
inc ecx
xor eax, eax
cmp esi, ecx
setl al
xor edx, edx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
setl dl
sub edx, dword [ebp - 0x2c]
cmp dword [ebp - 0x3c], 0
mov dword [ebp - 0x18], edx
jne 0x1000b7e7
cmp byte [ebp - 0x38], 0
je 0x1000b745
cmp dword [ebp - 0x34], 1
jne 0x1000b745
mov ecx, dword [ebp + 8]
lea eax, [edi + 0x10]
add dword [ecx + 8], eax
mov eax, dword [ebp - 0x28]
push edi
mov ecx, dword [eax]
mov dword [ebp - 0x24], ecx
mov ecx, dword [eax + 4]
add eax, 8
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x28], eax
call fcn.1004c47f
pop ecx
mov dword [ebp - 0x30], eax
lea ecx, [ebp - 0x78]
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], ebx
push eax
push edi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
call fcn.1000c6a5
mov ecx, dword [ebp - 0x78]
mov esi, ebx
test edi, edi
jle 0x1000b7cf
mov eax, esi
and eax, 0x80000001
jns 0x1000b799
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x24]
add eax, esi
add eax, dword [ebp - 0x24]
imul eax, dword [ebp - 0x3c]
jmp 0x1000b7ae
lea eax, [edx + 1]
cdq
idiv edi
cmp word [ecx + edx*2], bx
jne 0x1000b7ab
xor eax, eax
inc eax
mov word [ecx + edx*2], ax
mov eax, dword [ebp - 0x28]
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x30]
mov byte [esi + edx], al
inc esi
cmp esi, edi
jl 0x1000b78b
mov esi, dword [ebp + 8]
mov eax, dword [ebp - 0x30]
mov dword [esi], edi
mov dword [esi + 4], eax
test ecx, ecx
je 0x1000b7ea
push ecx
call fcn.100510d7
pop ecx
jmp 0x1000b7ea
mov esi, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret