Function at 0x1000c650
Capabilities:
Check if file exists
Create service
Modify service
Persist via windows service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10061db1
mov eax, dword fs:[0]
push eax
sub esp, 0x728
mov eax, dword [0x10073290]
xor eax, esp
mov dword [esp + 0x720], eax
push ebx
push esi
push edi
mov eax, dword [0x10073290]
xor eax, esp
push eax
lea eax, [esp + 0x738]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0xb0], eax
mov dword [esp + 0xac], ebx
mov word [esp + 0x9c], cx
mov dword [esp + 0xb4], 0x2001f
mov dword [esp + 0x740], ebx
push 0x34
xor edx, edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
call fcn.100017a0
lea edi, [esp + 0x14]
lea esi, [esp + 0x94]
mov byte [esp + 0x740], 1
call fcn.100038e0
mov byte [esp + 0x740], bl
cmp dword [esp + 0x2c], 8
jb 0x1000c71e
mov eax, dword [esp + 0x18]
push eax
call fcn.10044440
add esp, 4
lea ecx, [esp + 0x50]
push ecx
call fcn.10004770
mov byte [esp + 0x740], 2
push 0xe
xor edx, edx
push str.JXFileEncrysvc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
call fcn.100017a0
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x98]
push ecx
mov byte [esp + 0x748], 3
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 1
call fcn.10004340
test al, al
je 0x1000c7c0
mov esi, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x1000c7a5
call fcn.100445a8
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + 0x14]
push 0x1006fb54
mov edi, 0xf
call fcn.100066c0
mov byte [esp + 0x33], 1
test eax, eax
je 0x1000c7c4
mov byte [esp + 0x33], bl
mov dword [esp + 0x740], 2
cmp dword [esp + 0x2c], 8
jb 0x1000c7e3
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10044440
add esp, 4
cmp byte [esp + 0x33], bl
jne 0x1000c8f3
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x5c]
mov ebx, eax
cmp edi, eax
jbe 0x1000c808
call fcn.100445a8
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x50]
cmp edi, eax
jbe 0x1000c815
call fcn.100445a8
mov edx, dword [esp + 0x50]
push ebx
push esi
push edi
push edx
lea ebx, [esp + 0x80]
lea esi, [esp + 0x60]
call fcn.100050a0
push 0xf
xor eax, eax
push 0x1006fb54
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.100017a0
lea ecx, [esp + 0x14]
push ecx
mov ebx, esi
mov byte [esp + 0x744], 4
call fcn.100049b0
mov byte [esp + 0x740], 2
cmp dword [esp + 0x2c], 8
jb 0x1000c884
mov edx, dword [esp + 0x18]
push edx
call fcn.10044440
add esp, 4
push 0xe
xor eax, eax
push str.JXFileEncrysvc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.100017a0
lea ecx, [esp + 0x50]
push ecx
lea ebx, [esp + 0x18]
lea edi, [esp + 0x98]
mov byte [esp + 0x744], 5
call fcn.10003f70
test al, al
sete bl
mov byte [esp + 0x740], 2
cmp dword [esp + 0x2c], 8
jb 0x1000c8e9
mov edx, dword [esp + 0x18]
push edx
call fcn.10044440
add esp, 4
test bl, bl
jne 0x1000d4b1
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [esp + 0x70], esi
cmp esi, ebx
jne 0x1000c94e
mov eax, dword [esp + 0x5c]
cmp eax, ebx
je 0x1000c930
mov ecx, dword [esp + 0x70]
mov edi, dword [esp + 0x60]
push ecx
call fcn.10005830
mov edx, dword [esp + 0x60]
add esp, 4
push edx
call fcn.10044440
add esp, 4
mov eax, dword [esp + 0x50]
push eax
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
call fcn.10044440
add esp, 4
jmp 0x1000d4ba
push 0x206
lea edx, [esp + 0x11a]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x120], cx
call fcn.10049f90
add esp, 0xc
push str._SystemRoot_System32_svchost.exe__k
lea eax, [esp + 0x118]
push 0x104
push eax
call fcn.10045cd5
add esp, 0xc
push str.JXFileEncrysvc
lea ecx, [esp + 0x118]
push 0x104
push ecx
call fcn.10045d44
add esp, 0xc
push 0xf01ff
push 0x1006fb54
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [esp + 0x68], eax
cmp eax, ebx
jne 0x1000ca0e
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x128]
push edx
push 1
push 2
push 0x20
push 0xf01ff
push 0x1006fb54
push 0x1006fb54
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [esp + 0x68], eax
cmp eax, ebx
jne 0x1000c9f8
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000d4b1
lea ecx, [esp + 0x6c]
push ecx
push 1
push eax
mov dword [esp + 0x78], 0x1006fbc4
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov eax, 7
xor edx, edx
mov dword [esp + 0xec], eax
mov dword [esp + 0xe8], ebx
mov word [esp + 0xd8], dx
xor ecx, ecx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x10c], eax
mov dword [esp + 0x108], ebx
mov word [esp + 0xf8], cx
mov dword [esp + 0x110], 0x2001f
mov byte [esp + 0x740], al
push 0x5e
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall4DADA025_5F63_40f4_B80C_91B7FCAFC30C_is1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
call fcn.100017a0
mov ebx, 0x20019
lea edi, [esp + 0x14]
lea esi, [esp + 0xf0]
mov byte [esp + 0x740], 8
call fcn.100039a0
mov ebx, 7
mov byte [esp + 0x740], bl
cmp dword [esp + 0x2c], 8
jb 0x1000cab6
mov eax, dword [esp + 0x18]
push eax
call fcn.10044440
add esp, 4
xor ecx, ecx
push 0xf
mov word [esp + 0x1c], cx
push str.InstallLocation
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], 0
call fcn.100017a0
lea edx, [esp + 0xd4]
push edx
lea esi, [esp + 0x18]
lea ebx, [esp + 0xf4]
mov byte [esp + 0x744], 9
call fcn.10004080
test al, al
sete bl
mov byte [esp + 0x740], 7
cmp dword [esp + 0x2c], 8
jb 0x1000cb1a
mov eax, dword [esp + 0x18]
push eax
call fcn.10044440
add esp, 4
xor edi, edi
xor ecx, ecx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], cx
test bl, bl
je 0x1000cba9
push 0x206
lea eax, [esp + 0x52a]
xor edx, edx
push edi
push eax
mov word [esp + 0x530], dx
call fcn.10049f90
mov edx, dword [0x100758e0]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x528]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x524]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x524]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000cb85
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x528]
push ecx
lea ecx, [esp + 0xdc]
call fcn.100017a0
call fcn.100068e0
mov edx, str.JXFileEncryHost64.dll
test al, al
jne 0x1000cbbc
mov edx, 0x1006fcf0
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000cbc1
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0xdc]
call fcn.10006180
mov eax, dword [esp + 0xd8]
mov ebx, 8
cmp dword [esp + 0xec], ebx
jae 0x1000cbfa
lea eax, [esp + 0xd8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000cc36
lea esi, [esp + 0xf0]
call fcn.10003a50
cmp dword [esp + 0xec], ebx
jb 0x1000cc2a
mov edx, dword [esp + 0xd8]
push edx
call fcn.10044440
add esp, 4
mov dword [esp + 0xe8], edi
jmp 0x1000d49c
push 0x206
xor ebx, ebx
lea edx, [esp + 0x322]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x328], cx
call fcn.10049f90
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea eax, [esp + 0x320]
push 0x104
push eax
call fcn.10045cd5
add esp, 0xc
push 0x1006fb54
lea ecx, [esp + 0x320]
push 0x104
push ecx
call fcn.10045d44
add esp, 0xc
lea edx, [esp + 0x31c]
push edx
lea ecx, [esp + 0x18]
call fcn.10001750
lea edi, [esp + 0x14]
lea esi, [esp + 0x94]
mov byte [esp + 0x740], 0xa
call fcn.100038e0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x1000cccd
mov eax, dword [esp + 0x18]
push eax
call fcn.10044440
add esp, 4
xor ecx, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xd0], 7
mov dword [esp + 0xcc], ebx
mov word [esp + 0xbc], cx
push str.DelayedAutoStart
lea ecx, [esp + 0x18]
mov byte [esp + 0x744], 0xb
call fcn.10001750
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
lea eax, [esp + 0x98]
call fcn.10004020
test al, al
je 0x1000cd27
cmp dword [esp + 0x10], 1
jne 0x1000cd27
xor bl, bl
jmp 0x1000cd29
mov bl, 1
lea ecx, [esp + 0x14]
call fcn.10001c60
test bl, bl
je 0x1000cd5f
push str.DelayedAutoStart
lea ecx, [esp + 0x18]
call fcn.10001750
push 1
lea ecx, [esp + 0x18]
lea eax, [esp + 0x98]
call fcn.10003b20
lea ecx, [esp + 0x14]
call fcn.10001c60
push str.DeleteFlag
lea ecx, [esp + 0x18]
call fcn.10001750
lea ecx, [esp + 0x14]
lea eax, [esp + 0x94]
call fcn.10003ad0
test al, al
sete bl
cmp dword [esp + 0x2c], esi
jb 0x1000cd95
mov eax, dword [esp + 0x18]
push eax
call fcn.10044440
add esp, 4
test bl, bl
je 0x1000cdc0
push str.DeleteFlag
lea ecx, [esp + 0x18]
call fcn.10001750
lea eax, [esp + 0x14]
lea ecx, [esp + 0x94]
call fcn.10004530
lea ecx, [esp + 0x14]
call fcn.10001c60
push str.Group
lea ecx, [esp + 0x18]
call fcn.10001750
lea ecx, [esp + 0x14]
lea eax, [esp + 0x94]
call fcn.10003ad0
test al, al
sete bl
cmp dword [esp + 0x2c], esi
jb 0x1000cdf6
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10044440
add esp, 4
test bl, bl
je 0x1000ce21
push str.Group
lea ecx, [esp + 0x18]
call fcn.10001750
lea eax, [esp + 0x14]
lea ecx, [esp + 0x94]
call fcn.10004530
lea ecx, [esp + 0x14]
call fcn.10001c60
lea esi, [esp + 0xb8]
call fcn.100062b0
push str.Description
lea ecx, [esp + 0x18]
call fcn.10001750
mov edx, esi
mov byte [esp + 0x740], 0xc
push edx
lea esi, [esp + 0x18]
lea ebx, [esp + 0x98]
mov dword [esp + 0x14], 4
call fcn.10004080
test al, al
je 0x1000ce87
mov eax, dword [esp + 0xcc]
push 0x1006fbc4
mov edi, 0xa
lea ecx, [esp + 0xbc]
call fcn.100066c0
test eax, eax
jne 0x1000ce87
xor bl, bl
jmp 0x1000ce89
mov bl, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x740], 0xb
call fcn.10001c60
test bl, bl
je 0x1000cef3
push 0x1006fbc4
lea ecx, [esp + 0x38]
call fcn.10001750
push str.Description
lea ecx, [esp + 0x18]
mov byte [esp + 0x744], 0xd
call fcn.10001750
lea eax, [esp + 0x34]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
call fcn.10003b60
lea ecx, [esp + 0x14]
call fcn.10001c60
lea ecx, [esp + 0x34]
mov byte [esp + 0x740], 0xb
call fcn.10001c60
lea esi, [esp + 0xb8]
call fcn.100062b0
push str.DisplayName
lea ecx, [esp + 0x38]
call fcn.10001750
mov eax, esi
mov byte [esp + 0x740], 0xe
push eax
lea esi, [esp + 0x38]
lea ebx, [esp + 0x98]
mov dword [esp + 0x14], 8
call fcn.10004080
test al, al
je 0x1000cf59
mov eax, dword [esp + 0xcc]
push 0x1006fb54
mov edi, 0xf
lea ecx, [esp + 0xbc]
call fcn.100066c0
test eax, eax
jne 0x1000cf59
xor bl, bl
jmp 0x1000cf5b
mov bl, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x740], 0xb
call fcn.10001c60
test bl, bl
je 0x1000cfc5
push 0x1006fb54
lea ecx, [esp + 0x18]
call fcn.10001750
push str.DisplayName
lea ecx, [esp + 0x38]
mov byte [esp + 0x744], 0xf
call fcn.10001750
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x94]
call fcn.10003b60
lea ecx, [esp + 0x34]
call fcn.10001c60
lea ecx, [esp + 0x14]
mov byte [esp + 0x740], 0xb
call fcn.10001c60
push str.ErrorControl
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0
call fcn.10001750
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10004020
test al, al
je 0x1000cfff
cmp dword [esp + 0x10], 1
jne 0x1000cfff
xor bl, bl
jmp 0x1000d001
mov bl, 1
lea ecx, [esp + 0x34]
call fcn.10001c60
test bl, bl
je 0x1000d037
push str.ErrorControl
lea ecx, [esp + 0x38]
call fcn.10001750
push 1
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10003b20
lea ecx, [esp + 0x34]
call fcn.10001c60
lea esi, [esp + 0xb8]
call fcn.100062b0
push str.ImagePath
lea ecx, [esp + 0x38]
call fcn.10001750
mov edx, esi
mov byte [esp + 0x740], 0x10
push edx
lea esi, [esp + 0x38]
lea ebx, [esp + 0x98]
mov dword [esp + 0x14], 0x20
call fcn.100041e0
test al, al
je 0x1000d0b6
lea eax, [esp + 0x114]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000d082
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x114]
push ecx
mov edi, eax
mov eax, dword [esp + 0xd0]
lea ecx, [esp + 0xbc]
call fcn.100066c0
test eax, eax
jne 0x1000d0b6
xor bl, bl
jmp 0x1000d0b8
mov bl, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x740], 0xb
call fcn.10001c60
test bl, bl
je 0x1000d125
lea edx, [esp + 0x114]
push edx
lea ecx, [esp + 0x18]
call fcn.10001750
push str.ImagePath
lea ecx, [esp + 0x38]
mov byte [esp + 0x744], 0x11
call fcn.10001750
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x94]
call fcn.10003bb0
lea ecx, [esp + 0x34]
call fcn.10001c60
lea ecx, [esp + 0x14]
mov byte [esp + 0x740], 0xb
call fcn.10001c60
lea esi, [esp + 0xb8]
call fcn.100062b0
push str.ObjectName
lea ecx, [esp + 0x38]
call fcn.10001750
mov eax, esi
mov byte [esp + 0x740], 0x12
push eax
lea esi, [esp + 0x38]
lea ebx, [esp + 0x98]
mov dword [esp + 0x14], 0x40
call fcn.10004080
test al, al
je 0x1000d18b
mov eax, dword [esp + 0xcc]
push str.LocalSystem
mov edi, 0xb
lea ecx, [esp + 0xbc]
call fcn.100066c0
test eax, eax
jne 0x1000d18b
xor bl, bl
jmp 0x1000d18d
mov bl, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x740], 0xb
call fcn.10001c60
test bl, bl
je 0x1000d1f7
push str.LocalSystem
lea ecx, [esp + 0x18]
call fcn.10001750
push str.ObjectName
lea ecx, [esp + 0x38]
mov byte [esp + 0x744], 0x13
call fcn.10001750
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x94]
call fcn.10003b60
lea ecx, [esp + 0x34]
call fcn.10001c60
lea ecx, [esp + 0x14]
mov byte [esp + 0x740], 0xb
call fcn.10001c60
xor esi, esi
push str.Start
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], esi
call fcn.10001750
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10004020
test al, al
je 0x1000d22f
cmp dword [esp + 0x10], 2
jne 0x1000d22f
xor bl, bl
jmp 0x1000d231
mov bl, 1
lea ecx, [esp + 0x34]
call fcn.10001c60
test bl, bl
je 0x1000d267
push str.Start
lea ecx, [esp + 0x38]
call fcn.10001750
push 2
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10003b20
lea ecx, [esp + 0x34]
call fcn.10001c60
push str.Type
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], esi
call fcn.10001750
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10004020
test al, al
je 0x1000d29d
cmp dword [esp + 0x10], 0x20
jne 0x1000d29d
xor bl, bl
jmp 0x1000d29f
mov bl, 1
lea ecx, [esp + 0x34]
call fcn.10001c60
test bl, bl
je 0x1000d2d5
push str.Type
lea ecx, [esp + 0x38]
call fcn.10001750
push 0x20
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10003b20
lea ecx, [esp + 0x34]
call fcn.10001c60
push str.Parameters
lea eax, [esp + 0x320]
push 0x104
push eax
call fcn.10045d44
add esp, 0xc
lea ecx, [esp + 0x31c]
push ecx
lea ecx, [esp + 0x18]
call fcn.10001750
lea edi, [esp + 0x14]
lea esi, [esp + 0x94]
mov byte [esp + 0x740], 0x14
call fcn.100038e0
mov byte [esp + 0x740], 0xb
cmp dword [esp + 0x2c], 8
jb 0x1000d334
mov edx, dword [esp + 0x18]
push edx
call fcn.10044440
add esp, 4
push str.ServiceDll
lea ecx, [esp + 0x38]
call fcn.10001750
lea eax, [esp + 0xb8]
mov byte [esp + 0x740], 0x15
push eax
lea esi, [esp + 0x38]
lea ebx, [esp + 0x98]
mov dword [esp + 0x14], 0x200
call fcn.100041e0
test al, al
je 0x1000d389
lea eax, [esp + 0xd4]
lea ecx, [esp + 0xb8]
call fcn.10006730
test al, al
jne 0x1000d389
xor bl, bl
jmp 0x1000d38b
mov bl, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x740], 0xb
call fcn.10001c60
test bl, bl
je 0x1000d3d1
push str.ServiceDll
lea ecx, [esp + 0x38]
call fcn.10001750
lea eax, [esp + 0xd4]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x94]
call fcn.10003bb0
lea ecx, [esp + 0x34]
call fcn.10001c60
mov esi, dword [esp + 0x68]
xor eax, eax
lea ecx, [esp + 0x78]
push ecx
xor ebx, ebx
push esi
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0x7c], 4
je 0x1000d426
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov edx, dword [esp + 0x70]
push edx
call esi
mov edi, 8
cmp dword [esp + 0xd0], edi
jb 0x1000d454
mov eax, dword [esp + 0xbc]
push eax
call fcn.10044440
add esp, 4
xor ecx, ecx
lea esi, [esp + 0xf0]
mov dword [esp + 0xd0], 7
mov dword [esp + 0xcc], ebx
mov word [esp + 0xbc], cx
call fcn.10003a50
cmp dword [esp + 0xec], edi
jb 0x1000d495
mov edx, dword [esp + 0xd8]
push edx
call fcn.10044440
add esp, 4
mov dword [esp + 0xe8], ebx
xor eax, eax
mov word [esp + 0xd8], ax
mov dword [esp + 0xec], 7
lea esi, [esp + 0x50]
call fcn.100047d0
lea esi, [esp + 0x94]
call fcn.10003a50
mov ecx, dword [esp + 0x738]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x720]
xor ecx, esp
call fcn.10044431
mov esp, ebp
pop ebp
ret 0x10