Function at 0x100190ed
Capabilities:
Create thread
Set current directory
Terminate process

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ecx, 0x4d462991
cmp ecx, 0xfe379ffd
jle 0x10019163
cmp ecx, 0x39b5725d
jle 0x100192c6
cmp ecx, 0x5a210862
jg 0x1001937b
cmp ecx, 0x44d43668
jle 0x10019557
cmp ecx, 0x551c548e
jg 0x10019886
cmp ecx, 0x4d92dc26
jle 0x10019e5b
cmp ecx, 0x4d92dc27
je 0x10019f48
cmp ecx, 0x4de1b09a
jne 0x100190f9
cmp word [esp + 0xe], 0
mov ecx, 0x1732d11e
je 0x100190f9
jmp 0x1001a73f
cmp ecx, 0xba0b8dc6
jg 0x10019224
cmp ecx, 0xa06f9860
jle 0x10019410
cmp ecx, 0xaab64df2
jle 0x1001959a
cmp ecx, 0xb230ef89
jg 0x10019901
cmp ecx, 0xac94e8f7
jle 0x10019ead
cmp ecx, 0xac94e8f8
je 0x10019f3e
cmp ecx, 0xad6ac421
jne 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xb9fc4e2c
mov edx, eax
and edx, 0x4603b1d3
or edx, ecx
xor edx, 0x4603b1d2
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e48], 0xa
setl ah
setge al
and cl, al
or al, dl
and ah, dl
or ah, cl
mov dl, ah
xor dl, al
mov ecx, 0x8fc4e86a
mov ebx, 0x3f1757d2
mov esi, 0x8fc4e86a
test ah, ah
jne 0x1001a342
mov esi, 0x3f1757d2
jmp 0x1001a342
cmp ecx, 0xd9b8f95a
jg 0x1001945d
cmp ecx, 0xc22c3053
jle 0x10019633
cmp ecx, 0xcc01a15b
jg 0x1001998b
cmp ecx, 0xc6b6de11
jg 0x10019f23
cmp ecx, 0xc22c3054
je 0x10019f95
cmp ecx, 0xc5b13b72
jne 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete cl
setne ah
cmp dword [0x10098e48], 0xa
setl dl
setge al
and cl, al
or al, ah
and dl, ah
or dl, cl
mov ecx, eax
xor cl, dl
mov ebx, 0xac05e1b7
mov ecx, 0xc6b6de12
jne 0x1001a8c1
mov ebx, 0xc6b6de12
jmp 0x1001a8c1
cmp ecx, 0x1ecd581e
jg 0x100194a3
cmp ecx, 0xa672488
jg 0x1001966d
cmp ecx, 0x2cdb8c4
jg 0x100199b9
cmp ecx, 0xfe379ffe
je 0x10019ff7
cmp ecx, 0xfe6fe934
je 0x1001a052
cmp ecx, 0x1ce2ab5
jne 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x5e10d028
mov edx, eax
and edx, 0xa1ef2fd7
or edx, ecx
xor edx, 0xa1ef2fd6
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e48], 0xa
setl ah
setge al
and cl, al
or al, dl
and ah, dl
or ah, cl
mov edx, eax
xor dl, ah
mov ecx, 0x25ed9fc7
mov ebx, 0xaa07c910
mov esi, 0x25ed9fc7
test ah, ah
jne 0x1001a342
mov esi, 0xaa07c910
jmp 0x1001a342
cmp ecx, 0x657dd646
jg 0x100196fb
cmp ecx, 0x6012cdbc
jg 0x10019a3f
cmp ecx, 0x5a210863
je 0x1001a096
cmp ecx, 0x5d63f613
je 0x1001a107
cmp ecx, 0x5dc1b2e3
jne 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete cl
setne dl
cmp dword [0x10098e48], 0xa
setl ah
setge al
or al, dl
xor ah, cl
mov edx, eax
xor dl, ah
mov ecx, 0x6ed68610
mov ebx, 0xda01b9b2
mov esi, 0x6ed68610
test ah, ah
jne 0x1001a342
mov esi, 0xda01b9b2
jmp 0x1001a342
cmp ecx, 0x8fc4e869
jg 0x10019730
cmp ecx, 0x869fc0e6
jg 0x10019ae7
cmp ecx, 0x80af15dc
je 0x1001a113
cmp ecx, 0x81caebc2
je 0x1001a11d
cmp ecx, 0x82f85e0b
jne 0x100190f9
test edi, edi
setne byte [esp + 2]
mov ecx, 0xa814ea53
jmp 0x100190f9
cmp ecx, 0xe29fca2a
jg 0x100197d8
cmp ecx, 0xdddf35e8
jg 0x10019b70
cmp ecx, 0xd9b8f95b
je 0x1001a1a0
cmp ecx, 0xda01b9b2
je 0x1001a203
cmp ecx, 0xdceda7ff
jne 0x100190f9
mov ecx, 0xac94e8f8
jmp 0x100190f9
cmp ecx, 0x27652cef
jg 0x1001984c
cmp ecx, 0x2214cf2c
jg 0x10019baa
cmp ecx, 0x1ecd581f
je 0x1001a228
cmp ecx, 0x1f9d4ae1
je 0x1001a23d
cmp ecx, 0x2174e14f
jne 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xe93ade09
mov edx, eax
and edx, 0x16c521f6
or edx, ecx
xor edx, 0x16c521f7
and eax, 0xfffffffe
or eax, edx
xor eax, 0xcbd72e9
xor eax, 0xf3428d16
sete cl
setne dl
cmp dword [0x10098e48], 0xa
setge ah
setl dh
mov al, dh
xor al, dl
and al, dh
and ah, cl
and dh, dl
or dh, ah
mov dl, al
xor dl, dh
mov ebx, 0x5525f679
mov ecx, 0xa64ee02e
mov esi, 0x5525f679
test dh, dh
jne 0x1001a679
mov esi, 0xa64ee02e
jmp 0x1001a679
cmp ecx, 0x3fa51f37
jg 0x10019c44
cmp ecx, 0x39b5725e
je 0x1001a299
cmp ecx, 0x3f1757d2
je 0x1001a2f6
cmp ecx, 0x3f71d633
jne 0x100190f9
mov eax, dword [0x10098b90]
mov dword [esp + 0x24], eax
mov ecx, 0x2214cf2d
jmp 0x100190f9
cmp ecx, 0xa814ea52
jg 0x10019c8d
cmp ecx, 0xa06f9861
je 0x1001a300
cmp ecx, 0xa64ee02e
je 0x1001a351
cmp ecx, 0xa7969779
jne 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x4a5b77af
and eax, 0xb5a48850
or eax, edx
xor eax, 0x4a5b77ae
or eax, ecx
xor eax, 0xffffffff
setne cl
sete dl
cmp dword [0x10098e48], 0xa
setl al
setge ah
and dl, ah
and al, cl
or al, dl
or ah, cl
mov dl, ah
xor dl, al
mov ebx, 0x322ae3c9
mov ecx, 0xd0c3c22c
mov esi, 0x322ae3c9
test ah, ah
jne 0x10019e3d
mov esi, 0xd0c3c22c
jmp 0x10019e3d
cmp ecx, 0xbc7cd4db
jg 0x10019cc5
cmp ecx, 0xba0b8dc7
je 0x1001a35b
cmp ecx, 0xbb22def8
je 0x1001a3bb
cmp ecx, 0xbbc85559
jne 0x100190f9
mov ecx, 0xba0b8dc7
jmp 0x100190f9
cmp ecx, 0x1236e9f5
jg 0x10019cee
cmp ecx, 0xa672489
je 0x1001a41c
cmp ecx, 0xc629771
je 0x1001a483
cmp ecx, 0x110a0fc0
jne 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete cl
setne ah
cmp dword [0x10098e48], 0xa
setge ch
setl dl
mov al, dl
xor al, ah
and al, dl
and ch, cl
and dl, ah
or dl, ch
mov ecx, eax
xor cl, dl
mov ecx, 0xfe379ffe
mov ebx, 0xfe379ffe
jne 0x1001a9d4
mov ebx, 0xe29fca2b
jmp 0x1001a9d4
cmp ecx, 0x76cbdb58
jg 0x10019d1c
cmp ecx, 0x657dd647
je 0x1001a48d
cmp ecx, 0x6ed68610
je 0x1001a4b3
cmp ecx, 0x75ba9861
je 0x1001a2ec
jmp 0x100190f9
cmp ecx, 0x9773da9c
jg 0x10019d4a
cmp ecx, 0x8fc4e86a
je 0x1001a4bd
cmp ecx, 0x8fc5659a
je 0x1001a505
cmp ecx, 0x914ceffe
jne 0x100190f9
push 0x10098b34
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xf30d2998
mov edx, eax
and edx, 0xcf2d667
or edx, ecx
xor edx, 0xcf2d666
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e48], 0xa
setl ah
setge al
or al, dl
xor ah, cl
mov edx, eax
xor dl, ah
mov ecx, 0xd60b3b01
mov ebx, 0xa002e1b6
mov esi, 0xd60b3b01
test ah, ah
jne 0x1001a342
mov esi, 0xa002e1b6
jmp 0x1001a342
cmp ecx, 0xf5af23a4
jg 0x10019d87
cmp ecx, 0xe29fca2b
je 0x1001a520
cmp ecx, 0xefbb9e72
je 0x1001a52a
cmp ecx, 0xf02e55a9
jne 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
setne cl
cmp dword [0x10098e48], 0xa
setge dl
mov eax, edx
xor al, cl
or dl, cl
mov ecx, edx
xor cl, al
mov ebx, 0x8fc5659a
mov ecx, 0xdddf35e9
jne 0x1001a1f9
mov ebx, 0xdddf35e9
jmp 0x1001a1f9
cmp ecx, 0x36888ffe
jg 0x10019db5
cmp ecx, 0x27652cf0
je 0x1001a597
cmp ecx, 0x299ff0ed
je 0x1001a5a1
cmp ecx, 0x322ae3c9
jne 0x100190f9
mov ecx, 0xa7969779
jmp 0x100190f9
cmp ecx, 0x551c548f
je 0x1001a5af
cmp ecx, 0x5525f679
je 0x1001a603
cmp ecx, 0x587d8dcd
jne 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
cmp eax, 0xffffffff
sete cl
cmp dword [0x10098e48], 0xa
setl dl
mov eax, edx
xor al, cl
or dl, cl
xor dl, 1
or dl, al
mov ecx, edx
xor cl, al
mov ebx, 0x322ae3c9
mov ecx, 0xa7969779
jne 0x1001a1f9
mov ebx, 0xa7969779
jmp 0x1001a1f9
cmp ecx, 0xb230ef8a
je 0x1001a688
cmp ecx, 0xb48feb5b
je 0x1001a692
cmp ecx, 0xb7beb542
jne 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x426e6908
mov edx, eax
and edx, 0xbd9196f7
or edx, ecx
xor edx, 0xbd9196f6
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete cl
setne ah
cmp dword [0x10098e48], 0xa
setl dl
setge al
and cl, al
or al, ah
and dl, ah
or dl, cl
mov ecx, eax
xor cl, dl
mov ebx, 0x3f1757d2
mov ecx, 0xad6ac421
jne 0x1001a8c1
mov ebx, 0xad6ac421
jmp 0x1001a8c1
cmp ecx, 0xcc01a15c
je 0x1001a69c
cmp ecx, 0xd0c3c22c
je 0x10019e51
cmp ecx, 0xd60b3b01
jne 0x100190f9
mov ecx, 0x1f9d4ae1
jmp 0x100190f9
cmp ecx, 0x2cdb8c5
je 0x1001a6a6
cmp ecx, 0x3a9e9f8
je 0x1001a6d5
cmp ecx, 0xa013eda
jne 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x9825d920
mov edx, eax
and edx, 0x67da26df
or edx, ecx
xor edx, 0x67da26de
and eax, 0xfffffffe
or eax, edx
xor eax, 0x34005ab7
cmp eax, 0xcbffa548
sete al
cmp dword [0x10098e48], 0xa
setl ah
xor al, ah
mov edx, 0xc12a6f0e
mov ecx, 0xf5af23a5
mov esi, 0xc12a6f0e
jne 0x1001a717
mov esi, 0xf5af23a5
jmp 0x1001a717
cmp ecx, 0x6012cdbd
je 0x1001a72d
cmp ecx, 0x60fa9e34
je 0x1001a749
cmp ecx, 0x64eb9191
jne 0x100190f9
mov dword [0x10098b38], 1
push 0x10098b34
push dword [0x10098b50]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xd858fa87
mov edx, eax
and edx, 0x27a70578
or edx, ecx
xor edx, 0x27a70579
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
setne cl
sete dl
cmp dword [0x10098e48], 0xa
setge ah
setl al
xor al, dl
or ah, cl
mov dl, ah
xor dl, al
mov ebx, 0x434082de
mov ecx, 0x5dc1b2e3
mov esi, 0x434082de
test ah, ah
jne 0x10019e3d
mov esi, 0x5dc1b2e3
jmp 0x10019e3d
cmp ecx, 0x869fc0e7
je 0x10019e47
cmp ecx, 0x8e93d5dc
je 0x1001a753
cmp ecx, 0x8f816e72
jne 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x2711f2e1
mov edx, eax
and edx, 0xd8ee0d1e
or edx, ecx
xor edx, 0xd8ee0d1f
and eax, 0xfffffffe
or eax, edx
xor eax, 0xa6f45d6d
cmp eax, 0x590ba292
setne cl
cmp dword [0x10098e48], 0xa
setge dl
mov eax, edx
or al, cl
xor dl, cl
mov ecx, eax
xor cl, dl
mov ebx, 0xda01b9b2
mov ecx, 0x9e3ac439
jne 0x1001a8c1
mov ebx, 0x9e3ac439
jmp 0x1001a8c1
cmp ecx, 0xdddf35e9
je 0x1001a7c2
cmp ecx, 0xdfdb75d3
je 0x10019e47
cmp ecx, 0xe0db70f3
jne 0x100190f9
mov dword [esp + 0x18], ebp
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x1c], eax
mov ecx, 0x3fa51f38
jmp 0x100190f9
cmp ecx, 0x2214cf2d
je 0x1001a828
cmp ecx, 0x22bfbd33
je 0x10019e51
cmp ecx, 0x25ed9fc7
jne 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xbe6e59c9
mov edx, eax
and edx, 0x4191a636
or edx, ecx
xor edx, 0x4191a637
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
setne cl
sete dl
cmp dword [0x10098e48], 0xa
setl al
setge ah
and dl, ah
and al, cl
or al, dl
or ah, cl
mov dl, ah
xor dl, al
mov edi, 0xaa07c910
mov ecx, 0xcc01a15c
mov esi, 0xaa07c910
test ah, ah
jne 0x10019c32
mov esi, 0xcc01a15c
test al, al
cmovne edi, esi
test dl, dl
cmovne ecx, edi
xor edi, edi
inc edi
jmp 0x100190f9
cmp ecx, 0x3fa51f38
je 0x1001a855
cmp ecx, 0x417cfd4e
je 0x1001a86c
cmp ecx, 0x434082de
jne 0x100190f9
mov dword [0x10098b38], 1
push 0x10098b34
push dword [0x10098b50]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ecx, 0x64eb9191
jmp 0x100190f9
cmp ecx, 0xa814ea53
je 0x1001a8d0
cmp ecx, 0xaa07c910
je 0x1001a8ea
cmp ecx, 0xaa33ef7b
jne 0x100190f9
mov dword [0x10098b38], 4
mov ecx, 0xb230ef8a
jmp 0x100190f9
cmp ecx, 0xbc7cd4dc
je 0x1001a8f7
cmp ecx, 0xbef44071
je 0x1001a901
cmp ecx, 0xc12a6f0e
je 0x1001a8e0
jmp 0x100190f9
cmp ecx, 0x1236e9f6
je 0x1001a969
cmp ecx, 0x1732d11e
je 0x1001a983
cmp ecx, 0x1b3318a7
jne 0x100190f9
mov ecx, 0xb7beb542
jmp 0x100190f9
cmp ecx, 0x76cbdb59
je 0x1001a9e3
cmp ecx, 0x7753bec6
je 0x1001a9ed
cmp ecx, 0x7bc31c2e
jne 0x100190f9
mov ecx, 0xa672489
jmp 0x100190f9
cmp ecx, 0x9773da9d
je 0x1001a9f7
cmp ecx, 0x9e3ac439
je 0x1001aa01
cmp ecx, 0xa002e1b6
jne 0x100190f9
push 0x10098b34
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ecx, 0x914ceffe
jmp 0x100190f9
cmp ecx, 0xf5af23a5
je 0x1001aa61
cmp ecx, 0xf67ad869
je 0x1001aa6b
cmp ecx, 0xf7c060cf
jne 0x100190f9
mov ecx, 0xdceda7ff
jmp 0x100190f9
cmp ecx, 0x36888fff
je 0x1001aa78
cmp ecx, 0x3795bfb4
je 0x1001aa82
cmp ecx, 0x395cafed
jne 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x8a8ea2ff
mov edx, eax
and edx, 0x75715d00
or edx, ecx
xor edx, 0x75715d01
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
setne cl
sete dl
cmp dword [0x10098e48], 0xa
setl al
setge ah
and dl, ah
and al, cl
or al, dl
or ah, cl
mov dl, ah
xor dl, al
mov ebx, 0x75ba9861
mov ecx, 0x36888fff
mov esi, 0x75ba9861
test ah, ah
jne 0x10019e3d
mov esi, 0x36888fff
test al, al
cmovne ebx, esi
jmp 0x1001a67e
mov ecx, 0xe0db70f3
jmp 0x100190f9
mov ecx, 0xf7c060cf
jmp 0x100190f9
cmp ecx, 0x4d462991
jne 0x1001aa8c
push dword [0x10098b98]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x10098b34], 0x20
mov dword [0x10098b38], 2
mov dword [0x10098b3c], 0x85
xorps xmm0, xmm0
movups xmmword [0x10098b40], xmm0
mov eax, dword [esp + 0x40]
mov dword [esp + 0x14], eax
mov ecx, 0x2cdb8c5
jmp 0x100190f9
cmp ecx, 0xaab64df3
jne 0x1001aa99
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete cl
setne ah
cmp dword [0x10098e48], 0xa
setge al
setl dl
and ah, dl
and al, cl
or al, ah
mov ah, dl
xor ah, cl
or dl, cl
xor dl, 1
or dl, ah
mov ah, dl
xor ah, al
mov ebx, 0x60fa9e34
mov ecx, 0x1ecd581f
mov esi, 0x60fa9e34
test dl, dl
jne 0x1001a191
mov esi, 0x1ecd581f
jmp 0x1001a191
cmp ecx, 0xc7b5fa4d
jne 0x1001aaa7
cmp byte [esp], 0
mov ecx, 0x76cbdb59
jne 0x100190f9
mov ecx, 0x82f85e0b
jmp 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
and ecx, 1
sete ah
cmp dword [0x10098e48], 0xa
setge dh
setl dl
mov al, dh
xor dh, cl
and cl, dl
and al, ah
or al, cl
or dl, ah
xor dl, 1
or dl, dh
mov ecx, edx
xor cl, al
mov ebx, 0x1ce2ab5
mov ecx, 0x8e93d5dc
jne 0x1001a1f9
mov ebx, 0x8e93d5dc
jmp 0x1001a1f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x50c6350c
and eax, 0xaf39caf3
or eax, edx
xor eax, 0x50c6350d
or eax, ecx
xor eax, 0xffffffff
setne cl
sete ah
cmp dword [0x10098e48], 0xa
setl al
setge dl
and ah, dl
and al, cl
or al, ah
or dl, cl
mov ecx, edx
xor cl, al
mov ebx, 0x7bc31c2e
mov ecx, 0xa672489
jne 0x1001a1f9
mov ebx, 0xa672489
jmp 0x1001a1f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
and eax, 1
sete cl
cmp dword [0x10098e48], 0xa
setl dl
setge ch
and ch, cl
and al, dl
or al, ch
mov ch, dl
xor ch, cl
or dl, cl
xor dl, 1
or dl, ch
mov dh, dl
xor dh, al
mov ebx, 0xe29fca2b
mov ecx, 0x1b3318a7
mov esi, 0xe29fca2b
test dl, dl
jne 0x1001a043
mov esi, 0x1b3318a7
test al, al
cmovne ebx, esi
test dh, dh
cmovne ecx, ebx
jmp 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax - 1]
imul ecx, eax
and ecx, 1
sete ah
cmp dword [0x10098e48], 0xa
setl dl
setge al
and ah, al
or al, cl
and dl, cl
or dl, ah
mov ecx, eax
xor cl, dl
mov ebx, 0xbc7cd4dc
mov ecx, 0xdfdb75d3
jne 0x1001a8c1
mov ebx, 0xdfdb75d3
jmp 0x1001a8c1
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x44145fbd
and eax, 0xbbeba042
or eax, edx
xor eax, 0xbbeba043
xor ecx, eax
test ecx, eax
setne al
sete cl
cmp dword [0x10098e48], 0xa
setl dl
setge ah
and ah, cl
and al, dl
or al, ah
mov ah, dl
xor ah, cl
or dl, cl
xor dl, 1
or dl, ah
mov ah, dl
xor ah, al
mov ebx, 0x9773da9d
mov ecx, 0x110a0fc0
mov esi, 0x9773da9d
test dl, dl
jne 0x1001a191
mov esi, 0x110a0fc0
jmp 0x1001a191
mov ecx, 0xbef44071
xor edi, edi
jmp 0x100190f9
mov ecx, 0x587d8dcd
jmp 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0x128c1ad8
mov edx, eax
and edx, 0xed73e527
or edx, ecx
xor edx, 0xed73e526
and eax, 0xfffffffe
or eax, edx
xor eax, 0x7633f6a0
xor eax, 0x89cc095f
sete cl
setne ah
cmp dword [0x10098e48], 0xa
setge al
setl dl
and ah, dl
and al, cl
or al, ah
mov ah, dl
xor ah, cl
or dl, cl
xor dl, 1
or dl, ah
mov ah, dl
xor ah, al
mov ebx, 0xbc7cd4dc
mov ecx, 0xfe6fe934
mov esi, 0xbc7cd4dc
test dl, dl
jne 0x1001a191
mov esi, 0xfe6fe934
test al, al
cmovne ebx, esi
test ah, ah
cmovne ecx, ebx
jmp 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x19252a15
and eax, 0xe6dad5ea
or eax, edx
xor eax, 0x19252a14
or eax, ecx
xor eax, 0xffffffff
setne cl
sete ah
cmp dword [0x10098e48], 0xa
setl al
setge dl
and ah, dl
and al, cl
or al, ah
or dl, cl
mov ecx, edx
xor cl, al
mov ebx, 0xbbc85559
mov ecx, 0xba0b8dc7
jne 0x1001a1f9
mov ebx, 0xba0b8dc7
test dl, dl
cmovne ecx, ebx
jmp 0x1001a9d9
mov dword [0x10098b38], 1
push 0x10098b34
push dword [0x10098b50]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov ecx, 0x9e3ac439
jmp 0x100190f9
cmp byte [esp + 3], 0
mov ecx, 0x3f71d633
jne 0x100190f9
jmp 0x1001a84b
push 0x10098b34
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_SetServiceStatus]
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete ah
cmp dword [0x10098e48], 0xa
setl dl
setge al
and ah, al
or al, cl
and dl, cl
or dl, ah
mov ah, al
xor ah, dl
mov ebx, 0xbb22def8
mov ecx, 0x44d43669
test ah, 1
jne 0x1001a28a
mov ebx, 0x44d43669
test dl, dl
cmove ecx, ebx
test al, 1
cmovne ecx, ebx
jmp 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete ah
cmp dword [0x10098e48], 0xa
setl dl
xor ah, dl
mov al, ah
xor al, 1
and dl, al
mov ecx, 0x2174e14f
test ah, ah
jne 0x1001a2d9
mov ecx, 0x75ba9861
xor al, dl
test dl, dl
jne 0x1001a2e4
mov ecx, 0x75ba9861
test al, al
jne 0x100190f9
mov ecx, 0x2174e14f
jmp 0x100190f9
mov ecx, 0xad6ac421
jmp 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
not ecx
or ecx, 0xfffffffe
cmp ecx, 0xffffffff
setne cl
cmp dword [0x10098e48], 0xa
setge ah
mov al, ah
or al, cl
xor ah, cl
mov edx, eax
xor dl, ah
mov ecx, 0xa013eda
mov ebx, 0xf5af23a5
mov esi, 0xa013eda
test ah, ah
jne 0x1001a342
mov esi, 0xf5af23a5
test al, al
cmovne esi, ebx
test dl, dl
cmovne ecx, esi
jmp 0x100190f9
mov ecx, 0x5525f679
jmp 0x100190f9
mov eax, dword [esp + 0x40]
mov eax, dword [eax + ebp*4]
movzx eax, word [eax]
mov dword [esp + 0x20], eax
mov eax, dword [0x10098e44]
lea ecx, [eax - 1]
imul ecx, eax
test cl, 1
sete dl
cmp dword [0x10098e48], 0xa
setl ah
setge al
and dl, al
or al, cl
and ah, cl
or ah, dl
mov dl, ah
xor dl, al
mov ecx, 0x7753bec6
mov ebx, 0xbbc85559
mov esi, 0x7753bec6
test ah, ah
jne 0x1001a3ab
mov esi, 0xbbc85559
test al, 1
cmovne esi, ebx
test dl, 1
cmovne ecx, esi
jmp 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete cl
setne dl
cmp dword [0x10098e48], 0xa
setge ah
setl dh
mov al, dh
xor al, dl
and al, dh
and ah, cl
and dh, dl
or dh, ah
mov dl, dh
xor dl, al
mov ebx, 0x914ceffe
mov ecx, 0xa002e1b6
mov esi, 0x914ceffe
test dh, dh
jne 0x1001a679
mov esi, 0xa002e1b6
jmp 0x1001a679
mov eax, dword [0x10098b50]
mov dword [esp + 8], eax
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xfffffffe
and eax, 1
or eax, edx
not eax
or eax, ecx
xor eax, 0xffffffff
sete cl
setne ah
cmp dword [0x10098e48], 0xa
setge ch
setl dl
mov al, dl
xor al, ah
and al, dl
and ch, cl
and dl, ah
or dl, ch
mov ecx, eax
xor cl, dl
mov ecx, 0x5a210863
mov ebx, 0x5a210863
jne 0x1001a9d4
mov ebx, 0x7bc31c2e
jmp 0x1001a9d4
mov ecx, 0x299ff0ed
jmp 0x100190f9
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 4
push 8
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [esp + 0x10], eax
test eax, eax
setne byte [esp + 3]
mov ecx, 0x551c548f
jmp 0x100190f9
mov ecx, 0xc5b13b72
jmp 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete ah
cmp dword [0x10098e48], 0xa
setge dh
setl dl
mov al, dl
xor al, cl
and al, dl
and dh, ah
and dl, cl
or dl, dh
mov ecx, eax
xor cl, dl
mov ecx, 0x1f9d4ae1
mov ebx, 0x1f9d4ae1
jne 0x1001a9d4
mov ebx, 0xbb22def8
jmp 0x1001a9d4
mov eax, dword [esp + 4]
mov eax, dword [esp + 4]
mov eax, dword [esp + 4]
mov ebp, dword [esp + 4]
inc ebp
mov ecx, 0xdddf35e9
jmp 0x100190f9
mov ecx, 0xfe379ffe
jmp 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x76e4cdf0
and eax, 0x891b320f
or eax, edx
xor eax, 0x76e4cdf1
or eax, ecx
xor eax, 0xffffffff
sete cl
setne dl
cmp dword [0x10098e48], 0xa
setge ah
setl dh
mov al, dh
xor al, dl
and al, dh
and ah, cl
and dh, dl
or dh, ah
mov dl, al
xor dl, dh
mov ebx, 0xc22c3054
mov ecx, 0x9773da9d
mov esi, 0xc22c3054
test dh, dh
jne 0x1001a679
mov esi, 0x9773da9d
jmp 0x1001a679
mov ecx, 0x22bfbd33
jmp 0x100190f9
mov dword [esp + 4], ebp
mov ecx, 0xf02e55a9
jmp 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
test cl, 1
sete ah
cmp dword [0x10098e48], 0xa
setl al
setge dh
and dh, ah
mov dl, al
and dl, cl
or dl, dh
mov ecx, eax
xor cl, ah
or al, ah
xor al, 1
or al, cl
mov ecx, eax
xor cl, dl
mov ebx, 0x60fa9e34
mov ecx, 0xaab64df3
jne 0x1001a5f4
mov ebx, 0xaab64df3
test al, al
cmovne ecx, ebx
test dl, dl
cmove ecx, ebx
jmp 0x100190f9
mov eax, dword [esp + 0x40]
mov eax, dword [eax + ebp*4]
movzx eax, word [eax + 2]
mov word [esp + 0xe], ax
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
and ecx, 0xac1c70
mov edx, eax
and edx, 0xff53e38f
or edx, ecx
xor edx, 0xff53e38e
and eax, 0xfffffffe
or eax, edx
xor eax, 0xffffffff
sete cl
setne al
cmp dword [0x10098e48], 0xa
setl ah
xor al, ah
mov dl, ah
xor dl, cl
or ah, cl
xor ah, 1
or ah, dl
mov edx, eax
xor dl, ah
mov esi, 0xa64ee02e
mov ebx, 0x395cafed
mov ecx, 0xa64ee02e
test ah, ah
jne 0x1001a679
mov ecx, 0x395cafed
test al, al
cmovne ecx, esi
test dl, dl
cmovne ecx, ebx
jmp 0x100190f9
mov ecx, 0x4d92dc27
jmp 0x100190f9
mov ecx, 0xa06f9861
jmp 0x100190f9
mov ecx, 0x8e93d5dc
jmp 0x100190f9
mov eax, dword [esp + 0x14]
push 0
push 0x10017f30
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegisterServiceCtrlHandlerExW]
mov dword [0x10098b50], eax
mov ecx, 0x8f816e72
test eax, eax
je 0x100190f9
mov ecx, 0xaa33ef7b
jmp 0x100190f9
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete al
cmp dword [0x10098e48], 0xa
setl ah
xor al, ah
mov edx, 0x417cfd4e
mov ecx, 0x3795bfb4
mov esi, 0x417cfd4e
jne 0x1001a717
mov esi, 0x3795bfb4
mov ebx, eax
not bl
test bl, ah
cmovne ecx, esi
cmovne ecx, edx
test al, al
cmovne ecx, edx
jmp 0x100190f9
mov eax, dword [esp + 0x20]
mov ecx, 0x39b5725e
cmp eax, 0x73
je 0x100190f9
mov ecx, 0xc629771
jmp 0x100190f9
mov ecx, 0xaab64df3
jmp 0x100190f9
cmp dword [esp + 0x3c], 2
setae byte [esp]
mov eax, dword [0x10098e44]
lea ecx, [eax + 1]
imul ecx, eax
mov eax, ecx
not eax
mov edx, eax
and edx, 0xfffffffe
and ecx, 1
or ecx, edx
xor eax, ecx
test eax, ecx
sete cl
setne dl
cmp dword [0x10098e48], 0xa
setl ah
setge al
and cl, al
or al, dl
and ah, dl
or ah, cl
mov edx, eax
xor dl, ah
mov ecx, 0x3a9e9f8
mov edi, 0x1ce2ab5
mov esi, 0x3a9e9f8
test ah, ah
jne 0x1001a7b0
mov esi, 0x1ce2ab5
test al, al
cmovne esi, edi
test dl, dl
cmovne ecx, esi
xor edi, edi
inc edi
jmp 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x367fc555
and eax, 0xc9803aaa
or eax, edx
xor eax, 0x367fc554
or eax, ecx
cmp eax, 0xffffffff
sete dl
cmp dword [0x10098e48], 0xa
setl al
xor dl, al
mov ecx, 0x869fc0e7
mov ebx, 0x869fc0e7
jne 0x1001a80b
mov ebx, 0x8fc5659a
mov ah, dl
not ah
test ah, al
cmovne ebx, ecx
test dl, dl
cmove ecx, ebx
test ah, al
mov ebp, dword [esp + 4]
cmove ecx, ebx
inc ebp
jmp 0x100190f9
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
xor eax, eax
push eax
push eax
push ecx
push 0x10016289
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xb48feb5b
jmp 0x100190f9
mov eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x1c]
setl byte [esp + 1]
mov ecx, 0x1236e9f6
jmp 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xeeed28c
and eax, 0xf1112d73
or eax, edx
xor eax, 0xeeed28d
or eax, ecx
xor eax, 0xffffffff
sete cl
setne ah
cmp dword [0x10098e48], 0xa
setl dl
setge al
or al, ah
xor dl, cl
mov ecx, eax
xor cl, dl
mov ebx, 0x3795bfb4
mov ecx, 0xc7b5fa4d
jne 0x1001a8c1
mov ebx, 0xc7b5fa4d
test dl, dl
cmove ecx, ebx
test al, al
cmovne ecx, ebx
jmp 0x100190f9
cmp byte [esp + 2], 0
mov ecx, 0x657dd647
jne 0x100190f9
mov ecx, 0xefbb9e72
jmp 0x100190f9
xor edi, edi
inc edi
mov ecx, 0x25ed9fc7
jmp 0x100190f9
mov ecx, 0xfe6fe934
jmp 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0xe46d4369
and eax, 0x1b92bc96
or eax, edx
xor eax, 0x1b92bc97
xor ecx, eax
test ecx, eax
setne cl
cmp dword [0x10098e48], 0xa
setge ah
mov al, cl
xor al, ah
or ah, cl
mov dl, ah
xor dl, al
mov edi, 0x5d63f613
mov ecx, 0x80af15dc
mov esi, 0x5d63f613
test ah, ah
jne 0x1001a958
mov esi, 0x80af15dc
test al, al
cmovne edi, esi
test dl, dl
cmovne ecx, edi
xor edi, edi
jmp 0x100190f9
cmp byte [esp + 1], 0
mov ecx, 0xd9b8f95b
jne 0x100190f9
mov ecx, 0x27652cf0
jmp 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x3681ffe3
and eax, 0xc97e001c
or eax, edx
xor eax, 0xc97e001d
xor ecx, eax
test ecx, eax
sete dl
cmp dword [0x10098e48], 0xa
setl al
xor dl, al
mov ecx, edx
xor cl, 1
and al, cl
xor cl, al
mov ebx, 0x5d63f613
mov ecx, 0xbef44071
jne 0x1001a9d4
mov ebx, 0xbef44071
test dl, dl
cmove ecx, ebx
test al, al
cmove ecx, ebx
jmp 0x100190f9
mov ecx, 0xf67ad869
jmp 0x100190f9
mov ecx, 0x6012cdbd
jmp 0x100190f9
mov ecx, 0xc22c3054
jmp 0x100190f9
mov ecx, dword [0x10098e44]
lea eax, [ecx + 1]
imul eax, ecx
mov ecx, eax
not ecx
mov edx, ecx
and edx, 0x798eee38
and eax, 0x867111c7
or eax, edx
xor eax, 0x867111c6
xor ecx, eax
test ecx, eax
sete dl
cmp dword [0x10098e48], 0xa
setl al
xor dl, al
mov ecx, 0x64eb9191
mov ebx, 0x64eb9191
jne 0x1001aa49
mov ebx, 0x434082de
mov ah, dl
not ah
test ah, al
cmovne ebx, ecx
test dl, dl
cmove ecx, ebx
test ah, al
cmove ecx, ebx
jmp 0x100190f9
mov ecx, 0xa013eda
jmp 0x100190f9
mov ecx, 0x81caebc2
xor ebp, ebp
inc ebp
jmp 0x100190f9
mov ecx, 0x4de1b09a
jmp 0x100190f9
mov ecx, 0x417cfd4e
jmp 0x100190f9
cmp ecx, 0x44d43669
je 0x1001aabb
jmp 0x100190f9
cmp ecx, 0xac05e1b7
jne 0x100190f9
jmp 0x1001aab3
cmp ecx, 0xc6b6de12
jne 0x100190f9
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret 8