Function at 0x100172da
Capabilities:
Query service status
Start service

Disassembly:
mov eax, 0x1006a1ba
call fcn.100699bc
sub esp, 0x144
push ebx
mov dword [ebp - 0x24], 0xdd03
xor eax, eax
mov dword [ebp - 0x2c], 0x66d210ec
inc eax
push esi
mov dword [ebp - 0x10], eax
xor ebx, ebx
push edi
mov dword [ebp - 0x30], 0x8531d14c
mov dword [ebp - 0x1c], ebx
push 4
pop edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x28], 0x39ee491
mov dword [ebp - 0x20], 0x54ab1007
mov dword [ebp - 0x34], 0x86565ea9
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0xa0], ecx
mov dword [ebp - 0x14], ebx
jmp 0x10017347
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x68], 0xad5befa1
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10017339
mov eax, dword [ebp - 0x28]
dec dword [ebp - 0x28]
add eax, dword [ebp - 0x10]
jne 0x10017385
mov ecx, dword [ebp - 0x68]
xor edx, edx
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov eax, dword [ebp - 0x2c]
setge dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x38], ecx
imul eax, dword [ebp - 0x38], 0xfffd
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push 7
pop esi
cmp dword [ebp - 0x38], ebx
je 0x10017480
mov dword [ebp - 0x28], 0xc8ff05c8
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x30], 0xd7787123
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x100173d9
push ebx
push 0xaa6
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 0x10], 8
cmp dword [ebp - 0x10], 0x1c
jle 0x100174e8
mov edi, 0xffff
mov dword [ebp - 0x2c], 0xa061
mov dword [ebp - 0x38], 0x3a798be
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x68], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x28], ebx
jne 0x10017449
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x68]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x24]
dec eax
neg eax
sbb eax, eax
neg eax
imul eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x28]
jg 0x10017449
mov edx, ebx
jmp 0x1001744e
xor eax, eax
lea edx, [eax + 1]
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
inc ecx
cmp esi, ecx
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x24]
cmp edi, eax
sbb eax, eax
neg eax
mov dword [ebp - 0x38], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x1c
jg 0x100173ef
jmp 0x100174e8
mov dword [ebp - 0x3c], 0x7363
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x3c], 0xffffffff
mov dword [ebp - 0x3c], 0x6e2414c3
push edi
call fcn.1001565b
mov dword [ebp - 0x3c], 8
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x3c], 0x8e342ba5
mov dword [ebp - 0x1c], 0x5796d0a3
mov dword [ebp - 0x14], ebx
jmp 0x100174d5
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x110]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jl 0x100174c2
dec dword [ebp - 0x1c]
lea ecx, [ebp - 0x110]
call fcn.100156dd
push 0xfffffffffffffffa
pop eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], 0x73838a1f
mov dword [ebp - 0x14], 0x53aa9ac7
mov dword [ebp - 0x3c], 0xfffffff9
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x30], 0x7b4bc66
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x34], 0x5fba2522
mov dword [ebp - 0x14], ebx
xor ebx, ebx
inc ebx
jmp 0x1001753b
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x60], 0xbfc3938d
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x1001752d
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x30]
sub ecx, eax
mov eax, dword [ebp - 0x14]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, 0xa38d
setne dl
sub edx, eax
xor eax, eax
cmp edx, 9
setle al
xor ecx, ecx
cmp eax, dword [ebp - 0x34]
jle 0x1001757c
mov eax, ecx
cmp dword [ebp - 0x24], ecx
je 0x1001757e
mov eax, ebx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
neg eax
je 0x100175a8
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ecx
jl 0x100175d7
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], 0
je 0x100175a1
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
xor ecx, ecx
dec dword [ebp - 0x24]
jns 0x10017590
jmp 0x100175d7
mov dword [ebp - 0x14], ecx
jmp 0x100175ba
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x120], ebx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100175ad
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], ecx
jl 0x100175d7
mov dword [ebp - 0x11c], 0x4b81230b
dec dword [ebp - 0x14]
jns 0x100175c8
mov dword [ebp - 0x24], 0x102d149f
mov dword [ebp - 0x20], 0x2c29a3df
mov dword [ebp - 0x2c], 0xb26d5d64
mov dword [ebp - 0x34], 0xfffffffe
mov dword [ebp - 0x1c], 0xb5a40a7b
mov dword [ebp - 0x14], ecx
jmp 0x1001760d
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x40], 0xf1124f01
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jl 0x100175ff
mov edi, dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ecx
jl 0x100176a0
xor edx, edx
inc edx
mov dword [ebp - 0x14], ecx
jmp 0x10017638
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x4c], edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x1001762e
mov dword [ebp - 0x4c], ecx
cmp dword [ebp - 0x4c], ecx
jg 0x1001769b
mov dword [ebp - 0x14], 0x9c9fb37b
mov dword [ebp - 0x14], ecx
jmp 0x1001768b
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], 0
je 0x1001766d
push 0xc96
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
xor ecx, ecx
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], 0
je 0x10017688
push ecx
push 0x16a8
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_SetTimer]
xor ecx, ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jle 0x10017651
inc dword [ebp - 0x4c]
cmp dword [ebp - 0x4c], ecx
jle 0x10017645
xor edx, edx
inc edx
dec dword [ebp - 0x20]
jns 0x10017629
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], ecx
jg 0x100177a9
xor ebx, ebx
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], ecx
jg 0x10017737
xor esi, esi
mov dword [ebp - 0x30], 0xba5fc026
xor edx, edx
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, 0x589afca8
setne cl
sub ecx, dword [ebp + eax*4 - 0x40]
cmp ecx, 0x2cae
jne 0x10017718
cmp dword [ebp - 0x10], esi
jne 0x1001771f
mov edx, esi
cmp dword [ebp - 0x34], esi
je 0x10017722
lea edx, [ebx + 1]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x30], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jle 0x100176bf
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x40]
neg eax
jne 0x10017745
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x40]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x40]
cmp eax, 0xfffffffa
mov eax, dword [ebp - 0x1c]
setg dl
xor ecx, ecx
cmp eax, edx
setge cl
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x40]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x40]
mov dword [ebp - 0x34], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x100176ae
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 7
pop esi
mov dword [ebp - 0x3c], 0xd46758e3
mov dword [ebp - 0x10], 0x25b3b9da
mov dword [ebp - 0x14], 0xeb969161
mov dword [ebp - 0x20], 0xfffffffa
mov dword [ebp - 0x1c], 0x9be67e78
mov dword [ebp - 0x14], ecx
xor ecx, ecx
inc ecx
jmp 0x100177e2
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], 0xff82ff40
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x100177d4
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0xffffffff
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x10]
jge 0x1001780a
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x20], ecx
jmp 0x100178d6
mov dword [ebp - 0x30], 0xfffffffe
mov dword [ebp - 0x1c], 0xd8607f47
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], 0
je 0x1001785e
push 0x609
push 0x192c
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
xor ecx, ecx
mov dword [ebp - 0x10], ecx
jmp 0x100178ce
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
jmp 0x100178bf
mov eax, dword [ebp - 0x20]
push 0
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x30]
sub eax, 0xa9843657
neg eax
sbb eax, eax
inc eax
pop eax
setns al
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, esi
setne cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x48]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], edx
mov eax, dword [ebp - 0x20]
cmp edx, eax
setne cl
mov dword [ebp - 0x1c], ecx
inc dword [ebp - 0x14]
xor ecx, ecx
cmp dword [ebp - 0x14], ecx
jle 0x1001786b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jle 0x10017863
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x1001782f
mov dword [ebp - 0x28], 0x4392
lea ecx, [ebp - 0xc0]
push 2
call fcn.1001565b
and dword [ebp - 4], 0
lea ecx, [ebp - 0x134]
push 4
pop eax
mov dword [ebp - 0x78], eax
xor esi, esi
mov dword [ebp - 0x74], eax
inc esi
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x30], 0xffffffff
push esi
call fcn.1001565b
xor edx, edx
mov dword [ebp - 0x3c], 0xa3c3d214
mov dword [ebp - 0x10], edx
jmp 0x10017939
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc0]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001792a
mov dword [ebp - 0x10], edx
jmp 0x10017957
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x134]
mov dword [eax + ecx*4], 2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017944
mov dword [ebp - 0x78], edx
cmp dword [ebp - 0x78], esi
jg 0x100179d6
mov edi, dword [ebp - 0xc0]
mov dword [ebp - 0x1c], 0x40e11a79
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x10017993
push 0x667
push edx
push edx
call ebx
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
xor edx, edx
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x78]
xor eax, eax
cmp dword [edi + 4], edx
mov edx, dword [ebp - 0xc0]
sete al
xor ecx, ecx
push 0
add eax, dword [edx]
cmp eax, 1
setl cl
inc ecx
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp dword [edx + esi*4], ecx
pop edx
sete al
mov dword [ebp - 0x1c], eax
xor eax, eax
inc dword [ebp - 0x78]
inc eax
cmp dword [ebp - 0x78], eax
jle 0x1001796a
mov edi, dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0x134]
call fcn.100156dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc0]
call fcn.100156dd
push 2
pop esi
mov dword [ebp - 0x1c], esi
xor edx, edx
mov dword [ebp - 0x14], 0xfffffff6
mov dword [ebp - 0x30], 0xf0244c3f
mov dword [ebp - 0x14], edx
jmp 0x10017a67
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], 0x677b568b
mov dword [ebp - 0x1c], edx
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x10017a2c
call ebx
push eax
call dword [sym.imp.USER32.dll_SetCapture]
xor edx, edx
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
inc ecx
cmp dword [ebp - 0x14], edx
je 0x10017a4c
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x2c], eax
mov eax, ecx
jg 0x10017a4e
mov eax, edx
cmp eax, dword [ebp - 0x14]
jl 0x10017a58
cmp dword [ebp - 0x1c], edx
jne 0x10017a5a
mov ecx, edx
xor eax, eax
cmp ecx, esi
setge al
mov dword [ebp - 0x30], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 5
jle 0x10017a0b
xor ecx, ecx
mov dword [ebp - 0x44], 3
inc ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], edx
jmp 0x10017a90
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xb4], 5
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ecx
jl 0x10017a7f
mov dword [ebp - 0x10], edx
jmp 0x10017aa7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0xc8], ecx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017a9a
mov dword [ebp - 0x28], 0xe53d
mov dword [ebp - 0x14], 0xaed6b657
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
jne 0x10017ade
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
sub eax, 0x3d27
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x10017b11
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor ecx, ecx
xor edx, edx
inc ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0xb4], edx
je 0x10017e7a
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], 0xeb71
mov dword [ebp - 0x1c], ecx
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x34], edx
push 3
call fcn.1001565b
xor esi, esi
mov dword [ebp - 0x30], 0x891ba802
mov dword [ebp - 0x24], esi
jmp 0x10017b73
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 3
jl 0x10017b60
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], 0x141e
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x34]
imul ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xf8]
mov dword [eax], ecx
lea ecx, [ebp - 0xf8]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x30], eax
call fcn.100156dd
xor eax, eax
mov dword [ebp - 0x14], 0x5e48d327
inc eax
mov dword [ebp - 0x30], 0xb8f5f499
mov dword [ebp - 0x1c], 0x30cc2fdc
lea ecx, [ebp - 0xec]
push eax
call fcn.1001565b
xor edx, edx
inc edx
mov dword [ebp - 4], edx
mov dword [ebp - 0x34], 0xca3691f6
mov dword [ebp - 0x14], esi
jmp 0x10017c04
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x10017bf1
mov dword [ebp - 0x14], esi
cmp dword [ebp - 0x14], 0xffffffe5
jg 0x10017d12
xor ebx, ebx
inc ebx
push 3
lea ecx, [ebp - 0xd4]
call fcn.1001565b
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x1c], ebx
push 2
call fcn.1001565b
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x10017c54
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10017c41
mov dword [ebp - 0x10], edx
jmp 0x10017c6c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x150], ebx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10017c5f
mov dword [ebp - 0x10], edx
jmp 0x10017c8a
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0xade0980d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10017c77
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x30], edx
je 0x10017cd0
mov eax, dword [ebp - 0xec]
mov edx, dword [eax]
mov eax, dword [ebp - 0xd4]
mov esi, dword [eax + 8]
mov eax, dword [ebp - 0x34]
cmp ebx, eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, edx
setne cl
add ecx, esi
jne 0x10017cc4
test edx, edx
jne 0x10017cc4
xor eax, eax
jmp 0x10017cc6
mov eax, ebx
cmp eax, esi
jle 0x10017cd0
mov eax, dword [ebp - 0x148]
mov eax, dword [ebp - 0xe0]
lea ecx, [ebp - 0xe0]
dec dword [eax]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
call fcn.100156dd
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], bl
call fcn.100156dd
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe5
jle 0x10017c19
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xec]
call fcn.100156dd
xor ecx, ecx
mov dword [ebp - 0x14], esi
inc ecx
jmp 0x10017d3a
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x124], 0xfffffffc
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x10017d29
push 0x714c
push esi
push 0x1ba2
call fcn.1001b648
lea eax, [ebp - 0x44]
push eax
push esi
call fcn.1001a588
add esp, 0x14
xor ecx, ecx
mov eax, 0xffff
xor edx, edx
mov dword [ebp - 0x2c], eax
inc edx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x34], 0x8e60d743
push 2
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x10], ecx
pop esi
jmp 0x10017d8c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x54], 0xfffffff7
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017d7e
mov dword [ebp - 0x10], ecx
jmp 0x10017da7
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x118], 0x2da3c3d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10017d96
mov dword [ebp - 0x10], ecx
jmp 0x10017dbe
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x140], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10017db1
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], cl
je 0x10017ded
push 0x1ca2
push ecx
push ecx
push 0x18ac
push 0x4df
push ecx
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
xor edx, edx
inc edx
mov eax, dword [ebp - 0x50]
xor ecx, ecx
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
test eax, eax
mov dword [ebp - 0x118], eax
sets cl
mov dword [ebp - 0x1c], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x54]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0x34]
cmp eax, edx
mov eax, dword [ebp - 0x50]
setle cl
xor ebx, ebx
cmp ecx, eax
mov ecx, dword [ebp - 0x54]
mov eax, dword [ebp - 0x54]
setle bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x54]
setl dl
xor ecx, ecx
cmp edx, ebx
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
setge cl
sub ecx, eax
add ecx, 2
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x1c], ecx
mov ecx, 0xfff9
mov eax, dword [ebp - 0x50]
sub ecx, eax
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
add edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x140], ecx
jmp 0x10017e8d
push 0x6f81
push 0x7b6b
push edx
call fcn.1001a5b8
add esp, 0xc
xor ecx, ecx
mov dword [ebp - 0x24], ecx
jmp 0x1001829a
mov dword [ebp - 0x30], 0xfffffff8
lea ecx, [ebp - 0xb0]
mov dword [ebp - 0x28], 0x14b733c6
push 3
call fcn.1001565b
xor eax, eax
mov dword [ebp - 4], 3
inc eax
mov dword [ebp - 0x14], 0
push eax
lea ecx, [ebp - 0x104]
call fcn.1001565b
xor edx, edx
mov dword [ebp - 0x10], edx
jmp 0x10017ee9
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], 0x9c1464f1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10017ed6
xor eax, eax
mov dword [ebp - 0x10], edx
inc eax
cmp dword [ebp - 0x10], eax
jge 0x10017f1b
xor ebx, ebx
inc ebx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x104]
mov dword [eax + ecx*4], 0xbd10caad
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jl 0x10017efd
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov esi, dword [ebp - 0xb0]
mov eax, dword [esi + 4]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], edx
je 0x10017f46
mov ecx, dword [ebp - 0xb0]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ecx + 8]
jg 0x10017f46
cmp dword [ebp - 0x28], edx
je 0x10017f46
xor eax, eax
lea ecx, [eax + 1]
jmp 0x10017f48
mov ecx, edx
mov edx, dword [ebp - 0xb0]
mov eax, dword [edx + 8]
imul eax, ecx
test eax, eax
jne 0x10017f61
cmp dword [esi + 4], eax
jne 0x10017f61
xor ecx, ecx
jmp 0x10017f66
xor eax, eax
lea ecx, [eax + 1]
cmp dword [ebp - 0x28], 0xfffffffd
sbb eax, eax
neg eax
cmp eax, ecx
je 0x10017f78
cmp dword [ebp - 0x14], 0
je 0x10017f83
cmp dword [ebp - 0x28], 0
je 0x10017f83
xor eax, eax
inc eax
jmp 0x10017f85
xor eax, eax
mov dword [edx + 8], eax
xor ecx, ecx
mov eax, dword [ebp - 0x104]
inc ecx
push 8
mov dword [eax], ecx
mov eax, dword [ebp - 0x28]
imul eax, dword [edx + 8]
mov edx, dword [edx + 8]
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
inc eax
add eax, edx
cmp eax, 0xfffc
sbb eax, eax
neg eax
cmp ecx, eax
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, edx
setl cl
xor eax, eax
cmp edx, ecx
setge al
mov dword [esi + 4], eax
test eax, eax
je 0x10017ffc
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x10017fe8
push 0xc96
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x10018011
push 0
call dword [sym.imp.USER32.dll_CharNextW]
jmp 0x10018011
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10018011
push eax
push eax
call ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
lea ecx, [ebp - 0x104]
call fcn.100156dd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb0]
call fcn.100156dd
xor ecx, ecx
mov dword [ebp - 0x28], ecx
jmp 0x1001827e
mov dword [ebp - 0x44], ecx
jmp 0x10018271
cmp dword [ebp - 0x30], ecx
jne 0x1001827b
xor edx, edx
inc edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x58], 0xcd50997
mov dword [ebp - 0x1c], 0xea2a
mov dword [ebp - 0x14], 0x65653d42
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x34], 0xea1b1489
mov dword [ebp - 0x5c], 0xfe54
mov dword [ebp - 0x3c], 0xc33490c
mov dword [ebp - 0x38], ecx
jmp 0x10018096
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0x98], 0xb055cc25
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 4
jl 0x10018085
mov eax, dword [ebp - 0x2c]
dec dword [ebp - 0x2c]
test eax, eax
je 0x10018142
mov eax, dword [ebp - 0x94]
xor ecx, ecx
cmp eax, 0xfeae
setg cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x98]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x34], 0
je 0x100180f9
cmp dword [ebp - 0x2c], 0
je 0x100180f9
xor eax, eax
lea edx, [eax + 1]
jmp 0x100180fb
xor edx, edx
mov eax, dword [ebp - 0x98]
xor ecx, ecx
cmp eax, edx
setge cl
xor edx, edx
inc edx
cmp edx, ecx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x98]
jg 0x1001811f
cmp dword [ebp - 0x20], 0
jne 0x10018121
xor edx, edx
mov eax, dword [ebp - 0x58]
xor ecx, ecx
cmp edx, eax
sete cl
add ecx, dword [ebp - 0x10]
je 0x10018140
xor eax, eax
inc eax
xor ecx, ecx
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x1c]
jmp 0x10018148
xor ecx, ecx
mov dword [ebp - 0x98], ecx
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x10]
je 0x10018171
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], 0
je 0x1001820d
push ecx
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
xor ecx, ecx
jmp 0x1001820d
xor ecx, ecx
mov dword [ebp - 0x58], 0xeae26468
mov eax, dword [ebp - 0x20]
cmp eax, 0x32215f8f
mov edx, dword [ebp - 0x5c]
mov eax, dword [ebp - 0x58]
setl cl
xor ebx, ebx
cmp ecx, 0x98ef
setl bl
xor ecx, ecx
sub edx, 0x4f3ac16b
cmp edx, eax
setg cl
lea eax, [ecx + 1]
xor ecx, ecx
add eax, ebx
cmp eax, 0x9a81
setg cl
cmp ecx, dword [ebp - 0x3c]
je 0x10018216
xor ecx, ecx
xor edx, edx
mov dword [ebp - 0x38], ecx
inc edx
jmp 0x100181d2
mov eax, dword [ebp - 0x38]
mov dword [ebp + eax*4 - 0xa4], 0xfff6
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], edx
jl 0x100181c1
mov dword [ebp - 0x10], ecx
jmp 0x10018201
mov dword [ebp - 0x3c], 0x3e09e13a
mov dword [ebp - 0x5c], 0xb817bb5c
cmp dword [ebp - 0xa4], ecx
je 0x100181f9
mov eax, edx
cmp dword [ebp - 0x3c], ecx
jne 0x100181fb
mov eax, ecx
mov dword [ebp - 0x5c], eax
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff0
jne 0x100181dc
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x20], 0xfffffffc
jmp 0x1001825e
xor ecx, ecx
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], cl
je 0x10018207
mov ebx, dword [sym.imp.USER32.dll_GetDesktopWindow]
push ecx
push 0x47a
push ecx
call ebx
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
jmp 0x1001816a
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ecx
jl 0x1001825b
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x98], ecx
jne 0x1001825b
dec dword [ebp - 0x14]
jns 0x1001824a
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff8
jl 0x1001823e
mov dword [ebp - 0xc8], 0xfffffffd
inc dword [ebp - 0x44]
cmp dword [ebp - 0x44], 0x34
jl 0x1001803d
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x15
jl 0x10018035
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc8], eax
dec dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xffffffe5
je 0x10017e97
mov eax, 0x66fe7d8a
xor edx, edx
mov dword [ebp - 0x88], eax
inc edx
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x28], ecx
jmp 0x100182d4
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x128], 5
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], edx
jl 0x100182c3
mov dword [ebp - 0x80], ecx
jmp 0x10018302
mov dword [ebp - 0x3c], 0xfffffffa
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], 0
je 0x100182fa
push ecx
call ebx
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
xor ecx, ecx
cmp dword [ebp - 0x3c], ecx
jne 0x10018307
inc dword [ebp - 0x80]
cmp dword [ebp - 0x80], ecx
jle 0x100182de
mov eax, dword [ebp - 0x9c]
mov ecx, 0x3e8
cdq
idiv ecx
mov ecx, dword [ebp - 0xa0]
mov esi, edx
mov edi, eax
call fcn.10017268
mov ecx, dword [ebp - 0xc]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret