Function at 0x10037ae7
Capabilities:
Create pipe
Delete file
Delete registry value
Enumerate gui resources
Get memory capacity
Query environment variable
Resolve function by parsing pe exports
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10084cdc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x188
push ebx
push esi
push edi
push 0xfffffffffffffff8
mov dword [esp + 0x2c], 0xbc662a2b
xor ebx, ebx
pop esi
mov dword [esp + 0x10], 0x7d50f82b
mov dword [esp + 0x2c], 0x260d
push 4
mov dword [esp + 0x70], ecx
mov dword [esp + 0x28], esi
mov dword [esp + 0x74], edx
mov dword [esp + 0x24], ebx
pop ecx
jmp 0x10037b50
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x150], 0x37400631
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ecx
jl 0x10037b3d
mov dword [esp + 0x20], ebx
jmp 0x10037b68
mov eax, dword [esp + 0x20]
mov dword [esp + eax*4 + 0x78], ecx
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jl 0x10037b5c
cmp dword [esp + 0x158], ebx
jne 0x10037b88
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x15c]
xor edx, edx
inc dword [esp + 0x7c]
mov eax, dword [esp + 0x7c]
mov ecx, dword [esp + 0x28]
imul ecx, eax
mov eax, dword [esp + 0x2c]
push 3
pop edi
push edi
cmp ecx, eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x14]
setg dl
sub eax, edx
neg eax
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, 0xfe6b87c2
lea ecx, [esp + 0x84]
setg dl
cmp eax, edx
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
call fcn.10028d1f
mov dword [esp + 0x19c], ebx
lea ecx, [esp + 0xfc]
mov dword [esp + 0x10], 0xc4e2bf5
mov dword [esp + 0x28], ebx
push edi
call fcn.10028d1f
mov dword [esp + 0x24], 0xfffffff6
push 1
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x24], edi
pop edi
push 3
pop edx
jge 0x10037c35
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x80]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x10037c1d
mov dword [esp + 0x20], ebx
jmp 0x10037c51
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], 0xe8af
inc dword [esp + 0x20]
cmp dword [esp + 0x20], edx
jl 0x10037c3b
mov eax, dword [esp + 0x80]
mov edx, dword [eax]
lea eax, [edx - 0x66e9]
test eax, eax
jne 0x10037c70
mov eax, ebx
test edx, edx
je 0x10037c72
mov eax, edi
imul eax, eax, 0xd54
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0xffffffff
setg al
xor ecx, ecx
imul eax, eax, 0x7412
add eax, edx
cmp eax, esi
setge cl
imul ecx, dword [esp + 0x10]
test ecx, ecx
mov ecx, dword [esp + 0x80]
jne 0x10037cac
mov edx, ebx
cmp dword [ecx], ebx
je 0x10037cae
mov edx, edi
xor eax, eax
cmp edx, dword [ecx + 8]
setl al
mov dword [ecx], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xfc]
inc dword [eax]
mov eax, dword [esp + 0x80]
mov dword [eax], 0x5ab8
imul eax, dword [esp + 0x10], 0x5ab8
test eax, eax
jle 0x10037ce2
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
xor ecx, ecx
mov eax, dword [esp + 0x28]
cmp eax, 0x2370
setg cl
mov dword [esp + 0x24], ecx
lea ecx, [esp + 0xfc]
call fcn.10028da1
or dword [esp + 0x19c], 0xffffffff
lea ecx, [esp + 0x80]
call fcn.10028da1
mov dword [esp + 0x1c], 0x324ec2e0
mov dword [esp + 0x1c], ebx
jmp 0x10037d54
mov dword [esp + 0x2c], 0xfffc
mov ecx, 0xffff
mov dword [esp + 0x24], 0x865425a8
mov dword [esp + 0x2c], 0xe52d
mov eax, dword [esp + 0x2c]
cmp ecx, eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff1
jne 0x10037d26
mov eax, dword [esp + 0x1c]
add eax, 0xb6d0
je 0x10037dc0
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x24], 8
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x10], edi
jle 0x10037d88
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, edi
setle cl
xor edx, edx
add ecx, 0xfffb
cmp ecx, 4
setne dl
sub edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
add edx, 0xb7a64487
cmp edx, eax
setge cl
mov dword [esp + 0x24], ecx
jmp 0x10037df1
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10037df1
push ebx
push 0xfc2
push 0x12bc
push 0x269a
push 0x60a
push 0x16c7
push 0x641
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov dword [esp + 0x38], 0x596960f5
push 0xfffffffffffffff7
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], ebx
pop ecx
jmp 0x10037e15
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x188], ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10037e06
dec dword [esp + 0x18]
mov dword [esp + 0x18], ecx
jmp 0x10037e5b
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10037e3e
push 0x17ce
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10037e57
push 0x17c0
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x29
jge 0x10037e26
push 3
mov dword [esp + 0x14], ebx
pop esi
jmp 0x10037e7b
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x58], 0xfffffffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10037e6b
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0x17c92570
mov dword [esp + 0x10], ebx
jmp 0x10037e9f
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x68], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10037e93
mov dword [esp + 0x20], 9
cmp dword [esp + 0x20], 7
je 0x10037fc2
push esi
lea ecx, [esp + 0xb8]
call fcn.10028d1f
mov dword [esp + 0x28], 0x74a71a6e
mov dword [esp + 0x2c], 0xca307758
mov dword [esp + 0x2c], 0x42d63d2c
mov dword [esp + 0x10], ebx
jmp 0x10037ef5
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10037ee3
mov eax, dword [esp + 0x28]
xor edx, edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov dword [esp + 0x2c], 0xffffffff
imul ecx, dword [esp + 0x2c], 0xe9b8
mov eax, dword [esp + 0xb4]
cmp dword [eax], ecx
mov eax, dword [esp + 0x28]
setle dl
imul eax, edx
test eax, eax
jne 0x10037f52
cmp dword [esp + 0x20], ebx
jne 0x10037f52
mov dword [esp + 0x68], ebx
mov edx, ebx
jmp 0x10037f58
mov dword [esp + 0x68], edi
mov edx, edi
mov eax, dword [esp + 0xb4]
mov ecx, dword [eax + 8]
mov esi, dword [eax]
xor eax, eax
cmp edx, ecx
setl al
xor edx, edx
cmp eax, 0xffffffff
setne dl
add edx, ecx
xor ecx, ecx
imul edx, dword [esp + 0x28]
cmp edx, esi
setg cl
xor eax, eax
cmp ecx, esi
setg al
mov dword [esp + 0x2c], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10037fa4
push 0x1cd7
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0xb4]
call fcn.10028da1
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 7
push 3
pop esi
jne 0x10037eb8
mov byte [esp + 0x43], bl
mov dword [esp + 0x30], 0xe0cf5720
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10037fe7
push ebx
push ebx
push 0x1b1a
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10037fff
push 0x786
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
lea eax, [esp + 0x43]
push eax
push 0xeb3
push 0x505
push ebx
call fcn.1003cdcd
mov dword [esp + 0x38], 0xffffffff
add esp, 0x10
mov dword [esp + 0x2c], 4
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], ebx
jmp 0x10038075
mov dword [esp + 0x24], edi
xor edx, edx
mov dword [esp + 0x2c], ebx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x2c], eax
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
cmp eax, ecx
setl dl
mov dword [esp + 0x2c], edx
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x24], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10038071
call dword [sym.imp.KERNEL32.dll_GetLastError]
inc dword [esp + 0x28]
cmp dword [esp + 0x28], edi
jge 0x10038035
mov dword [esp + 0x38], ebx
jmp 0x10038e0b
push 4
lea ecx, [esp + 0x138]
call fcn.10028d1f
mov dword [esp + 0x10], edi
mov dword [esp + 0x10], ebx
jmp 0x100380b2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x134]
mov dword [eax + ecx*4], 0xff0e
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1003809c
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100380cd
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov dword [esp + 0x10], ebx
jmp 0x100380e9
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100380e5
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jle 0x100380d3
lea ecx, [esp + 0x134]
call fcn.10028da1
mov dword [esp + 0x20], 0x7fa5c62e
mov dword [esp + 0x28], 7
mov dword [esp + 0x28], ebx
jmp 0x1003817e
push edi
lea ecx, [esp + 0xa0]
call fcn.10028d1f
mov dword [esp + 0x10], ebx
jmp 0x1003813a
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x9c]
mov dword [eax + ecx*4], 0x22124f84
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10038124
mov eax, dword [esp + 0x9c]
mov dword [eax], 9
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10038160
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp + 0x9c]
dec dword [eax]
cmp dword [eax], 8
jg 0x1003814d
lea ecx, [esp + 0x9c]
call fcn.10028da1
inc dword [esp + 0x28]
cmp dword [esp + 0x28], 0xa
jl 0x10038111
mov dword [esp + 0x20], ebx
jmp 0x10038dea
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x2c], 0x3817d1dc
mov dword [esp + 0x10], ebx
jmp 0x100381b7
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x14c], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x100381a4
mov dword [esp + 0x1c], ebx
jmp 0x10038240
mov dword [esp + 0x10], esi
mov dword [esp + 0x30], 0x488f4f3
mov dword [esp + 0x10], ebx
jmp 0x10038235
mov dword [esp + 0x24], ebx
xor ecx, ecx
mov dword [esp + 0x34], edi
mov dword [esp + 0x34], 0x998ab545
mov eax, dword [esp + 0x24]
neg eax
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [esp + 0x1c]
add eax, dword [esp + 0x1c]
je 0x10038205
cmp dword [esp + 0x1c], ebx
jne 0x1003823c
jmp 0x10038231
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x28], 0x77cc4247
mov dword [esp + 0x30], 0x795ed7c6
mov eax, dword [esp + 0x24]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x34], eax
dec dword [esp + 0x2c]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1a
je 0x100381d5
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xf
jge 0x100381c3
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], 0xb5cfda6c
mov dword [esp + 0x30], 0xfffffffd
mov dword [esp + 0x18], edi
mov dword [esp + 0x10], ebx
jmp 0x1003827c
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x180], 0xfffffff7
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x10038269
dec dword [esp + 0x18]
mov dword [esp + 0x18], 0xfffffff7
jmp 0x100382c6
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100382a9
push 0x17ce
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100382c2
push 0x17c0
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0x29
jge 0x10038291
mov dword [esp + 0x10], edi
lea ecx, [esp + 0xcc]
push 2
call fcn.10028d1f
push 2
mov dword [esp + 0x14], ebx
pop edx
jmp 0x100382fe
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xcc]
mov dword [eax + ecx*4], 0xa276
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edx
jl 0x100382e8
mov dword [esp + 0x10], ebx
jmp 0x10038342
mov dword [esp + 0x18], 0x25260
mov dword [esp + 0x18], ebx
jmp 0x1003832b
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xcc]
or dword [eax + ecx*4], 0xffffffff
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jl 0x10038318
mov eax, dword [esp + 0xcc]
mov eax, dword [eax]
mov dword [esp + 0x18], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jge 0x1003830a
lea ecx, [esp + 0xcc]
call fcn.10028da1
mov dword [esp + 0x10], ebx
jmp 0x1003836d
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x12c], 0xfb49
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003835a
mov dword [esp + 0x30], 0x4a8c6a53
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10038398
push 0x4ce
push 0x199e
push ebx
call dword [sym.imp.GDI32.dll_PtInRegion]
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100383b5
push 0x2381
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esp + 0x28], ebx
jmp 0x10038b89
mov dword [esp + 0x24], 0xfffffff6
lea ecx, [esp + 0xe4]
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x14], 0x69ad59e5
mov dword [esp + 0x10], 0x2a77b69c
push esi
call fcn.10028d1f
mov dword [esp + 0x19c], edi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x24], 0xc00d4b3b
mov dword [esp + 0x18], ebx
jmp 0x1003841a
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0x84e2bba6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x10038404
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x1c], ebx
je 0x100385f4
push edi
lea ecx, [esp + 0xf4]
call fcn.10028d1f
mov dword [esp + 0x34], 0xfb1af9d6
mov dword [esp + 0x2c], 0x92079655
mov dword [esp + 0x3c], 0xf916744f
mov dword [esp + 0x30], 7
mov dword [esp + 0x10], ebx
jmp 0x1003847b
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf0]
mov dword [eax + ecx*4], 0x8bea1220
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10038465
mov dword [esp + 0x1c], 0x16
jmp 0x100384af
cmp dword [esp + 0x14], ebx
jl 0x100384ab
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xf0]
cmp dword [eax + ecx*4], ebx
jne 0x100384ab
mov eax, dword [esp + 0x14]
dec dword [esp + 0x14]
jns 0x10038491
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
mov dword [esp + 0x14], ebx
jl 0x1003848b
cmp dword [esp + 0x14], 0xffffffea
je 0x100385e6
mov esi, dword [esp + 0xe4]
mov dword [esp + 0x10], 0x884515fd
xor edx, edx
mov dword [esp + 0x18], edi
mov dword [esp + 0x24], 0xec8e12b6
mov ecx, dword [esp + 0x10]
sub ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf0]
cmp ecx, dword [eax]
mov ecx, 0xe6b93388
mov eax, dword [esp + 0x34]
setg dl
add eax, edx
neg eax
cmp ecx, eax
sbb eax, eax
neg eax
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
jne 0x1003851f
mov ecx, ebx
cmp dword [esp + 0x18], ebx
je 0x10038521
mov ecx, edi
mov eax, dword [esp + 0x10]
mov dword [esp + 0x2c], ecx
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x24]
sub eax, 0x6042
neg eax
sbb eax, eax
inc eax
cmp dword [esp + 0x18], eax
je 0x10038559
mov edx, edi
cmp dword [esp + 0x10], ebx
jne 0x1003855b
mov edx, ebx
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
test ecx, ecx
sets al
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0x1839
jg 0x1003857f
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x18]
cmp edx, eax
mov dword [esi + 8], edx
sete cl
cmp ecx, dword [esp + 0x30]
je 0x1003859f
mov eax, dword [esp + 0x18]
imul eax, dword [esp + 0x24], 0x978
xor ecx, ecx
add eax, 0x6fac8ef8
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0x24]
cmp eax, 0xb23f
setge cl
mov dword [esp + 0x18], ecx
mov eax, dword [esp + 0x18]
sub eax, 0x9b20
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffea
jne 0x100384cc
push 3
pop esi
lea ecx, [esp + 0xf0]
call fcn.10028da1
jmp 0x1003861a
mov dword [esp + 0x2c], 0x4e19c781
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0xe4]
mov eax, dword [eax + 8]
mov dword [esp + 0x2c], eax
or dword [esp + 0x19c], 0xffffffff
lea ecx, [esp + 0xe4]
call fcn.10028da1
mov dword [esp + 0x24], edi
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x24], 0x3817d1dc
mov dword [esp + 0x10], ebx
jmp 0x10038658
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x74], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10038648
mov dword [esp + 0x18], ebx
jmp 0x100386e1
mov dword [esp + 0x10], esi
mov dword [esp + 0x30], 0x488f4f3
mov dword [esp + 0x10], ebx
jmp 0x100386d6
mov dword [esp + 0x30], ebx
xor ecx, ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x3c], 0x998ab545
mov eax, dword [esp + 0x30]
neg eax
cmp ecx, eax
sbb eax, eax
neg eax
add eax, dword [esp + 0x18]
add eax, dword [esp + 0x18]
je 0x100386a6
cmp dword [esp + 0x18], ebx
jne 0x100386dd
jmp 0x100386d2
mov dword [esp + 0x30], 0xffffffff
mov dword [esp + 0x2c], 0x77cc4247
mov dword [esp + 0x3c], 0x795ed7c6
mov eax, dword [esp + 0x30]
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], eax
dec dword [esp + 0x24]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x1a
je 0x10038676
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xf
jge 0x10038664
push dword [esp + 0x74]
movdqa xmm0, xmmword [0x1000a570]
lea eax, [esp + 0x184]
push eax
lea eax, [esp + 0x178]
mov dword [esp + 0x98], ebx
push eax
push ebx
lea ecx, [esp + 0xa0]
mov dword [esp + 0xa4], ebx
movdqu xmmword [esp + 0x180], xmm0
mov dword [esp + 0xa8], ebx
call fcn.10029e8e
push 2
pop eax
mov dword [esp + 0x19c], eax
lea ecx, [esp + 0x108]
mov dword [esp + 0x10], 0x7dd68876
mov dword [esp + 0x34], 0xf3d4210e
mov dword [esp + 0x2c], 0x6b471dfd
mov dword [esp + 0x18], edi
push eax
call fcn.10028d1f
mov dword [esp + 0x30], 5
mov dword [esp + 0x3c], 0xfffffff6
mov dword [esp + 0x24], 0xe0c23782
mov dword [esp + 0x14], ebx
jmp 0x10038794
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x64], 0xfffffff7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x10038784
mov dword [esp + 0x14], ebx
jmp 0x100387b3
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x140], 0x74e80031
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100387a0
mov dword [esp + 0x14], ebx
jmp 0x100387d5
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], 0xdfbc43c
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100387bf
mov edx, dword [esp + 0x90]
xor ecx, ecx
mov eax, dword [edx + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
cmp eax, dword [edx + 4]
setle cl
mov dword [esp + 0x34], ecx
xor ecx, ecx
mov eax, dword [esp + 0x140]
mov dword [esp + 0x10], 0xfffffffb
mov eax, dword [esp + 0x10]
cmp eax, 0x3b7c39c9
setle cl
mov dword [esp + 0x64], ecx
cmp dword [esp + 0x140], 0x88d5
jne 0x10038836
cmp dword [esp + 0x64], ebx
jne 0x10038836
mov ecx, ebx
cmp dword [esp + 0x30], ebx
je 0x10038838
mov ecx, edi
mov eax, dword [esp + 0x18]
mov dword [esp + 0x34], eax
mov eax, dword [esp + 0x34]
mov eax, dword [esp + 0x3c]
sub ecx, eax
inc ecx
mov dword [esp + 0x24], ecx
xor ecx, ecx
mov eax, dword [esp + 0x24]
inc dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
cmp ecx, eax
mov eax, dword [esp + 0x108]
sbb ecx, ecx
neg ecx
cmp ecx, dword [eax + 4]
je 0x1003888a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10038896
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x10038896
mov dword [esp + 0x24], 0x3f0a
dec dword [esp + 0x24]
lea ecx, [esp + 0x108]
call fcn.10028da1
or dword [esp + 0x19c], 0xffffffff
lea ecx, [esp + 0x90]
call fcn.10028da1
mov eax, dword [esp + 0x38]
mov eax, dword [esp + eax*4 + 0x58]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + eax*4 + 0x58]
mov eax, dword [esp + 0x58]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + eax*4 + 0x58]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x28]
sub eax, dword [esp + 0x20]
je 0x100388f4
mov eax, dword [esp + 0x38]
mov ecx, edi
cmp dword [esp + eax*4 + 0x58], ebx
jne 0x100388f6
mov ecx, ebx
mov eax, dword [esp + 0x38]
push 2
mov edx, dword [esp + eax*4 + 0x5c]
xor eax, eax
test ecx, ecx
setne al
xor ecx, ecx
cmp eax, edx
setne cl
xor eax, eax
cmp ecx, 0x336d
setge al
xor edx, edx
cmp eax, 0xfffffff6
setle dl
xor ecx, ecx
sub edx, dword [esp + 0x24]
mov eax, dword [esp + 0x24]
cmp edx, eax
setne cl
add ecx, 0xce3d978
cmp esi, ecx
lea ecx, [esp + 0xac]
sbb eax, eax
neg eax
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x28]
mov dword [esp + 0x38], eax
call fcn.10028d1f
mov dword [esp + 0x19c], esi
lea ecx, [esp + 0x120]
mov dword [esp + 0x1c], 5
push edi
call fcn.10028d1f
mov dword [esp + 0x10], 0xa165f5c9
mov dword [esp + 0x14], ebx
jmp 0x10038994
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xa8]
mov dword [eax + ecx*4], 0x6432a276
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x1003897e
mov dword [esp + 0x14], ebx
jmp 0x100389b7
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x120]
mov dword [eax + ecx*4], 0xd0e72ee7
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x100389a1
mov dword [esp + 0x14], ebx
jmp 0x100389d2
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x8c], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x100389c3
mov eax, dword [esp + 0x1c]
xor edx, edx
mov eax, dword [esp + 0xa8]
mov ecx, dword [eax + 4]
cmp ecx, dword [eax]
setg dl
xor eax, eax
cmp ecx, edi
setge al
imul edx, eax
test edx, edx
je 0x10038ad8
cmp dword [esp + 0x28], 2
jle 0x100383be
mov dword [esp + 0x14], 0x3f4f46db
mov dword [esp + 0x1c], 0x1d102278
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x34], 0x9913
mov dword [esp + 0x30], 0xd228
mov dword [esp + 0x30], 0xfffffff7
mov dword [esp + 0x10], ebx
jmp 0x10038bd6
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x44], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x10038bca
mov dword [esp + 0x14], ebx
jmp 0x10038ce2
push edi
lea ecx, [esp + 0xc4]
call fcn.10028d1f
mov dword [esp + 0x10], ebx
jmp 0x10038c0e
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 9
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x10038bf8
dec dword [esp + 0x28]
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x44], ecx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x4c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0xc0]
mov ecx, dword [eax]
xor eax, eax
cmp ecx, edi
setg al
sub eax, 0x633e7a32
cmp eax, ecx
jl 0x10038c75
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
xor edx, edx
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x44]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + eax*4 + 0x44]
mov ecx, dword [esp + 0xc0]
cmp eax, dword [ecx]
setne dl
mov dword [ecx], edx
mov dword [esp + 0x1c], ebx
jmp 0x10038ccb
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10038cc7
push 0xbdd
push 0xe8e
push 0x20ec
call dword [sym.imp.KERNEL32.dll_HeapCreate]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xfffffff9
jl 0x10038ca7
lea ecx, [esp + 0xc0]
call fcn.10028da1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jle 0x10038be5
mov dword [esp + 0x14], 0x15
jmp 0x10038dd3
mov dword [esp + 0x18], 0xe767e792
mov dword [esp + 0x24], 0xffffffff
mov dword [esp + 0x1c], 0x12
jmp 0x10038dc4
mov dword [esp + 0x30], 0x48ec
mov dword [esp + 0x10], 0x8781562e
mov dword [esp + 0x2c], 6
cmp dword [esp + 0x18], ebx
jne 0x10038d87
mov eax, dword [esp + 0x34]
inc dword [esp + 0x34]
test eax, eax
je 0x10038d69
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x24]
jge 0x10038d51
cmp dword [esp + 0x4c], ebx
je 0x10038d55
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x24]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor edx, edx
sub ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x30]
cmp eax, ecx
mov eax, ebx
setne dl
imul edx, dword [esp + 0x10]
test edx, edx
je 0x10038d89
mov eax, edi
mov dword [esp + 0x30], eax
xor ecx, ecx
mov eax, dword [esp + 0x18]
cmp eax, 0xfffffffe
setne cl
imul eax, ecx, 0xff6
mov dword [esp + 0x48], eax
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x30], eax
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x10038dc0
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
dec dword [esp + 0x1c]
cmp dword [esp + 0x1c], 0xffffffff
je 0x10038d17
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 7
jg 0x10038cfa
mov eax, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x58]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jle 0x1003818e
push 0x1ed4
xor dl, dl
mov ecx, 0x68bf
call fcn.100390f1
inc dword [esp + 0x3c]
pop ecx
cmp dword [esp + 0x38], 2
jle 0x10038084
push esi
lea ecx, [esp + 0x118]
call fcn.10028d1f
mov dword [esp + 0x19c], 4
lea ecx, [esp + 0xd8]
mov dword [esp + 0x24], 0xfffffff9
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], ebx
push esi
call fcn.10028d1f
mov dword [esp + 0x1c], 0x48ae
mov dword [esp + 0x18], edi
mov dword [esp + 0x14], ebx
jmp 0x10038e73
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10038e5d
mov dword [esp + 0x14], ebx
jmp 0x10038e91
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xd8]
mov dword [eax + ecx*4], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x10038e7f
mov dword [esp + 0x14], ebx
jmp 0x10038eb0
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x160], 0xffffffff
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10038e9d
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0xd8]
cmp dword [eax + 8], edi
mov eax, dword [esp + 0x20]
setg cl
sub ecx, eax
cmp dword [esp + 0x28], ecx
jl 0x10038ee0
cmp dword [esp + 0x1c], ebx
jne 0x10038ee0
mov eax, dword [esp + 0x20]
xor edx, edx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0xd8]
push 2
sub edi, dword [esi + 4]
imul edi, dword [esi]
mov dword [esp + 0x2c], edi
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x170]
mov eax, dword [esp + 0x118]
inc dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x28], eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x170]
cmp ecx, eax
setg dl
sub edx, dword [esi + 4]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x1c], ebx
pop esi
jmp 0x10039009