Function at 0x100011cc
Capabilities:
Set environment variable
Start service

Disassembly:
mov eax, 0x100620a6
call fcn.10061bc4
sub esp, 0x16c
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x44], edi
cmp byte [edi], 0x50
jne 0x10001e2a
cmp byte [edi + 1], 0x4b
jne 0x10001e2a
mov dword [ebp - 0x1c], 0x8901
mov dword [ebp - 0x28], 0x49c9fb37
mov dword [ebp - 0x2c], 0xfffffff9
mov dword [ebp - 0x1c], 9
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x1c], 0x8d383303
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x2fd2
mov eax, dword [ebp - 0x1c]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x1c]
setne dl
xor esi, esi
xor ebx, ebx
inc esi
cmp edx, esi
setge bl
xor ecx, ecx
sub ebx, 4
cmp eax, ebx
setge cl
cmp ecx, esi
mov ecx, dword [ebp - 0x2c]
sbb eax, eax
neg eax
sub ecx, eax
dec ecx
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, 0xffffffff
jge 0x10001294
cmp dword [ebp - 0x1c], ebx
je 0x10001294
cmp dword [ebp - 0x2c], ebx
je 0x10001294
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], bl
je 0x10001282
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommState]
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], bl
je 0x100012f8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x100012f8
mov dword [ebp - 0x2c], 0x8cd54673
mov dword [ebp - 0x14], 0x279e56e6
mov dword [ebp - 0x34], 0xdf47f28a
mov dword [ebp - 0x3c], 0xca862934
mov dword [ebp - 0x3c], 0x41adf890
cmp dword [ebp - 0x1c], ebx
jne 0x100012e3
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, esi
setl cl
mov dword [ebp - 0x34], ecx
xor ecx, ecx
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp edx, eax
setg cl
mov dword [ebp - 0x3c], ecx
mov ecx, ebx
jmp 0x100012e5
mov ecx, esi
mov eax, dword [ebp - 0x2c]
add eax, ecx
je 0x100012f3
mov eax, esi
cmp dword [ebp - 0x14], ebx
jne 0x100012f5
mov eax, ebx
mov dword [ebp - 0x3c], eax
push esi
lea ecx, [ebp - 0xac]
call fcn.10001ed7
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0xec]
mov dword [ebp - 0x24], 8
mov dword [ebp - 0x24], 0x53d42374
push 2
call fcn.10001ed7
mov dword [ebp - 0x24], 0x7647f1a
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x24], 0xc6548aa
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x10], ebx
jmp 0x1000136b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xac]
mov dword [eax + ecx*4], 0x91a049fe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x10001358
mov dword [ebp - 0x10], ebx
jmp 0x10001388
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0xfffe
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10001375
mov dword [ebp - 0x10], ebx
jmp 0x100013a4
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x174], 0xec0dcee0
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10001393
mov eax, dword [ebp - 0xac]
lea ecx, [ebp - 0xec]
mov dword [eax], 0xffffffea
call fcn.10001f5a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.10001f5a
mov al, byte [edi + 2]
lea ecx, [ebp - 0xa0]
movdqa xmm0, xmmword [str._b_b_b_b_t_t_t_t]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x24], 0xfffffff8
mov byte [ebp - 0x3d], al
lea eax, [ebp - 0x108]
mov dword [ebp - 0x24], 0x62bb2c59
mov dword [ebp - 0x24], 0x2f1e5c8a
push dword [ebp - 0x24]
movdqu xmmword [ebp - 0x118], xmm0
push eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0xa0], ebx
push eax
push ebx
mov dword [ebp - 0x9c], ebx
mov dword [ebp - 0x98], ebx
call fcn.10001fc0
mov dword [ebp - 0x14], ebx
jmp 0x1000143c
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x48], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10001432
mov dword [ebp - 0x10], ebx
jmp 0x100014e8
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xcedb7758
mov dword [ebp - 0x24], 0x78cca699
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x48], ebx
je 0x10001492
mov eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x48]
mov eax, dword [ebp - 0x48]
cmp eax, ecx
mov eax, dword [ebp - 0x10]
setg dl
sub eax, 0xd035
imul eax, edx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x48]
mov ecx, dword [ebp - 0x48]
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x48], ecx
mov dword [ebp - 0x20], ebx
jmp 0x100014e0
mov dword [ebp - 0x14], ebx
jmp 0x100014c4
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x138], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 4
jl 0x100014b3
mov dword [ebp - 0x1c], ebx
jmp 0x100014d8
inc dword [ebp - 0x130]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x100014cf
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ebx
jle 0x100014ae
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x10001449
lea ecx, [ebp - 0xa0]
call fcn.10001f5a
mov al, byte [edi + 3]
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x20], 0xaafbebf0
mov dword [ebp - 0x2c], 0xaaf19195
push esi
mov byte [ebp - 0x15], al
call fcn.10001ed7
mov dword [ebp - 4], 2
mov dword [ebp - 0x14], 6
mov dword [ebp - 0x38], 0xae792f69
mov dword [ebp - 0x24], 0xa6c6106a
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], 0x552b
mov dword [ebp - 0x10], ebx
jmp 0x1000155c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x150], 0x32a2
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000154b
push 7
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x10001576
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x70]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jl 0x1000156a
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edx
je 0x1000183d
push 2
lea ecx, [ebp - 0x58]
call fcn.10001ed7
push 2
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.10001ed7
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x28], 0xfc518f82
push 2
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x10], ebx
pop edx
jmp 0x100015cb
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x58]
mov dword [eax + ecx*4], 0x25260
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100015bb
mov dword [ebp - 0x10], ebx
jmp 0x100015e8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x88]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x100015d5
mov eax, dword [ebp - 0x58]
mov edi, dword [ebp - 0x88]
mov dword [eax], edx
mov dword [ebp - 0x28], 0xdf2e
cmp dword [eax], ebx
je 0x10001619
mov byte [ebp - 0x2d], bl
cmp byte [ebp - 0x2d], 0
je 0x10001630
push 0x632
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x10001630
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x14], ebx
jmp 0x1000162b
mov dword [edi + 4], 0x5e81a7ec
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jle 0x10001621
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp eax, 0xed16
mov eax, dword [ebp - 0x148]
setle cl
xor edx, edx
cmp ecx, esi
setg dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x20], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
imul eax, dword [edi + 4]
cmp eax, 0x94be3d0e
setne cl
cmp esi, ecx
sbb eax, eax
inc eax
cmp eax, 0x24ad
jle 0x1000167a
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x58]
mov dword [edi + 4], 0x9b8db370
push 2
pop edx
dec dword [eax]
jns 0x100015f8
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0x34], ebx
jne 0x1000169e
cmp dword [ebp - 0x2c], ebx
jne 0x1000169e
mov esi, ebx
mov edx, dword [ebp - 0x20]
xor ecx, ecx
mov eax, dword [ebp - 0x70]
mov dword [eax], edx
mov eax, dword [ebp - 0x2c]
cmp eax, edx
setge cl
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], esi
mov ecx, dword [ebp - 0x58]
jne 0x100016c0
cmp dword [ecx + 4], ebx
je 0x100016cb
cmp dword [ecx], ebx
je 0x100016cb
xor esi, esi
inc esi
mov edx, esi
jmp 0x100016d0
xor esi, esi
mov edx, ebx
inc esi
xor eax, eax
cmp edx, dword [ecx]
setl al
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x2c]
cmp ecx, 5
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov dword [edi + 4], ecx
mov eax, dword [ebp - 0x58]
sete dl
xor ecx, ecx
imul edx, dword [eax + 4]
mov eax, dword [ebp - 0x20]
cmp edx, eax
setne cl
cmp ecx, 0x9395830
jne 0x100017c5
mov dword [ebp - 0x10], esi
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setne dl
sub edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x34]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x20]
cmp eax, 0x991a
setle cl
mov dword [edi + 4], ecx
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x70]
mov dword [eax], ecx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
jne 0x1000177b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
setge dl
imul edx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x10]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, 0x10ca
setle cl
xor eax, eax
cmp ecx, 0x253de912
setl al
xor ecx, ecx
imul eax, eax, 0x511e
cmp eax, 0x4b0b
setle cl
mov dword [ebp - 0x38], ecx
jmp 0x10001819
mov dword [ebp - 0x38], 0xffffffff
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x58]
mov dword [eax], ecx
xor ecx, ecx
cmp dword [edi + 4], 0x9072
mov eax, dword [ebp - 0x3c]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x70]
setle dl
xor ecx, ecx
sub edx, 0x5783
cmp edx, dword [eax]
mov eax, dword [ebp - 0x20]
setne cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
cmp dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x88]
setl cl
imul ecx, ecx, 0x1cc4
mov dword [eax], ecx
lea ecx, [ebp - 0x88]
call fcn.10001f5a
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.10001f5a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 7
jne 0x10001587
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x70]
call fcn.10001f5a
movzx edi, byte [ebp - 0x3d]
lea ecx, [ebp - 0xb8]
movzx eax, byte [ebp - 0x15]
push 4
pop esi
add edi, esi
add eax, 0x18
add eax, edi
push 2
mov dword [ebp - 0x2c], eax
call fcn.10001ed7
mov dword [ebp - 0x14], ebx
jmp 0x10001883
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0xbca63185
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10001870
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100018a1
push ebx
push ebx
push 0x1309
push ebx
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov eax, dword [ebp - 0xb8]
lea ecx, [ebp - 0xb8]
mov dword [eax], ebx
call fcn.10001f5a
mov eax, dword [ebp - 0x44]
mov ecx, dword [edi + eax + 0x14]
mov edx, dword [edi + eax]
call fcn.100011c0
push 2
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x34], eax
call fcn.10001ed7
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], 0xba3f
mov dword [ebp - 0x14], ebx
jmp 0x100018eb
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100018df
mov esi, dword [ebp - 0x64]
mov dword [esi], 0xa
xor edx, edx
mov dword [ebp - 0x38], 0xf77722ab
mov dword [ebp - 0x10], ebx
inc edx
cmp dword [ebp - 0x10], 4
jge 0x1000191c
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x128], edx
inc dword [ebp - 0x10]
jmp 0x10001907
mov dword [ebp - 0x10], ebx
jmp 0x1000192f
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x4c], 0xc234ac01
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jl 0x10001921
mov eax, dword [ebp - 0x64]
cmp dword [eax], 0
je 0x10001963
xor ecx, ecx
cmp dword [eax], 0x7631615e
setl cl
xor eax, eax
imul ecx, dword [ebp - 0x128]
cmp ecx, 0x28cae2fe
setl al
cmp eax, dword [ebp - 0x120]
mov eax, edx
jge 0x10001965
mov eax, ebx
mov dword [ebp - 0x4c], eax
xor ecx, ecx
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
cmp dword [esi + 4], eax
setg cl
test ecx, ecx
je 0x10001983
mov eax, dword [ebp - 0x64]
cmp dword [eax], ebx
mov eax, ebx
je 0x10001985
mov eax, edx
imul eax, eax, 0xa4b1
test eax, eax
je 0x10001994
cmp dword [ebp - 0x38], ebx
jne 0x10001996
mov edx, ebx
mov eax, dword [ebp - 0x38]
xor ecx, ecx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0xd09e
setle al
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x64]
dec dword [eax]
cmp dword [eax], 0xfffffff7
jg 0x100018fa
lea ecx, [ebp - 0x64]
call fcn.10001f5a
mov esi, dword [ebp - 0x2c]
add esi, dword [ebp - 0x44]
mov dword [ebp - 0x24], 0x3342eb90
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
mov dword [ebp - 0x38], esi
je 0x100019e9
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100019ff
push ebx
push 0x1882
push ebx
call dword [sym.imp.GDI32.dll_GetMetaFileBitsEx]
mov dword [ebp - 0x20], 0xc7bf
xor edx, edx
inc edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x28], 0x15b01d97
mov dword [ebp - 0x1c], 0x254f8d36
mov dword [ebp - 0x10], 0x7854c3eb
mov dword [ebp - 0x10], ebx
jmp 0x10001a3d
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x144], 9
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10001a2c
mov dword [ebp - 0x10], ebx
jmp 0x10001a59
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x168], 0xffffffff
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 4
jl 0x10001a48
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
cmp eax, edx
push 3
setl cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x14]
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
imul ecx, dword [ebp - 0x28], 0x25e4
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setge dl
xor ecx, ecx
mov dword [ebp - 0x1c], edx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub edx, 3
neg eax
cmp eax, edx
pop edx
setle cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], ebx
jl 0x10001afc
mov dword [ebp - 0x10], ebx
jmp 0x10001af2
mov dword [ebp - 0x14], edx
cmp dword [ebp - 0x14], ebx
jl 0x10001aef
mov dword [ebp - 0x20], ebx
jmp 0x10001ae4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + eax*4 - 0x168]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x144], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jle 0x10001acd
dec dword [ebp - 0x14]
jns 0x10001ac8
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x10001ac0
dec dword [ebp - 0x1c]
jns 0x10001abb
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x34]
push 2
mov dword [eax], ecx
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x1c], 0xfffffff8
call fcn.10001ed7
mov dword [ebp - 4], 4
lea ecx, [ebp - 0xc4]
mov dword [ebp - 0x20], 0x1320f2d6
mov dword [ebp - 0x24], 0xa37d7c86
push 3
call fcn.10001ed7
mov dword [ebp - 0x10], ebx
jmp 0x10001b52
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0x61780eec
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x10001b3f
mov dword [ebp - 0x10], ebx
jmp 0x10001b70
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc4]
mov dword [eax + ecx*4], 0xff444262
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x10001b5d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 7
cmp dword [ebp - 0x1c], ebx
jne 0x10001b92
mov dword [ebp - 0x1c], 0xd0fa5166
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
xor eax, eax
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xd594
jge 0x10001bb1
cmp dword [ebp - 0x20], ebx
je 0x10001bb1
cmp dword [ebp - 0x24], ebx
jne 0x10001bb3
mov eax, ebx
xor ecx, ecx
cmp eax, 0x7d6b5922
mov eax, dword [ebp - 0xc4]
setle cl
mov dword [eax + 4], ecx
mov dword [ebp - 0x20], 0x1a
jmp 0x10001be4
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10001be1
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffff4
jge 0x10001bcf
lea ecx, [ebp - 0xc4]
call fcn.10001f5a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xe0]
call fcn.10001f5a
mov eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x44]
shr eax, 2
inc eax
mov dword [ebp - 0x34], eax
mov eax, dword [edi + edx]
mov dword [ebp - 0xd4], eax
mov eax, dword [edi + edx + 4]
mov dword [ebp - 0xd0], eax
mov eax, dword [edi + edx + 8]
mov dword [ebp - 0xcc], eax
mov eax, dword [edi + edx + 0xc]
xor edi, edi
mov dword [ebp - 0xc8], eax
inc edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], ebx
jmp 0x10001c50
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x158], edi
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10001c43
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edi
jg 0x10001cf9
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x2c], ebx
jl 0x10001cea
mov dword [ebp - 0x20], 0xfffffff7
mov dword [ebp - 0x20], ebx
jmp 0x10001ce0
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], ebx
jmp 0x10001cc4
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], ebx
jmp 0x10001cbc
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], edi
cmp dword [ebp - 0x28], ebx
jl 0x10001cb9
mov dword [ebp - 0x24], ebx
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10001cb4
push ebx
push 0x19da
push ebx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
dec dword [ebp - 0x28]
jns 0x10001c9b
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jle 0x10001c8d
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x10001c81
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10001cdd
push 0x268a
call dword [sym.imp.GDI32.dll_GetStockObject]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edi
jle 0x10001c79
dec dword [ebp - 0x2c]
jns 0x10001c6d
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x10001c62
mov edx, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x34]
mov edi, ebx
test ecx, ecx
je 0x10001ec6
sub edx, esi
mov dword [ebp - 0x44], edx
push 2
lea ecx, [ebp - 0x94]
call fcn.10001ed7
mov dword [ebp - 0x28], 8
mov dword [ebp - 0x3c], 0x37f20bab
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10001d4f
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x94]
mov dword [eax + ecx*4], 0x28ea3888
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10001d3c
mov esi, dword [ebp - 0x94]
mov eax, dword [esi + 4]
mov dword [ebp - 0x28], eax
xor eax, eax
cmp dword [esi], 1
setl al
xor ecx, ecx
cmp eax, dword [esi + 4]
setg cl
xor eax, eax
cmp ecx, 0x94fb
setle al
cmp eax, 0xb6d700d1
mov eax, dword [ebp - 0x28]
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
setl cl
xor edx, edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
cmp dword [esi + 4], 7
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
add ecx, 0x393131ec
cmp ecx, dword [esi + 4]
setle al
cmp eax, dword [ebp - 0x2c]
jle 0x10001dc8
mov eax, dword [ebp - 0x94]
cmp dword [eax], ebx
je 0x10001dc8
mov eax, ebx
jmp 0x10001dcb
xor eax, eax
inc eax
mov dword [ebp - 0x28], eax
xor edx, edx
mov eax, dword [ebp - 0x28]
cmp eax, 0xfbc7
mov eax, dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x94]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
call fcn.10001f5a
mov esi, dword [ebp - 0x38]
mov edx, edi
and edx, 3
mov ecx, dword [esi]
mov edx, dword [ebp + edx*4 - 0xd4]
call fcn.100011c0
mov ecx, dword [ebp - 0x44]
mov dword [ecx + esi], eax
add esi, 4
inc edi
mov dword [ebp - 0x38], esi
cmp edi, dword [ebp - 0x34]
jb 0x10001d0b
jmp 0x10001ec6
push dword [ebp - 0x24]
movdqa xmm0, xmmword [0x10070e60]
lea eax, [ebp - 0xf8]
push eax
xor ebx, ebx
lea eax, [ebp - 0x108]
push eax
push ebx
lea ecx, [ebp - 0x7c]
mov dword [ebp - 0x7c], ebx
movdqu xmmword [ebp - 0x108], xmm0
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
call fcn.10001fc0
mov dword [ebp - 4], 5
lea ecx, [ebp - 0xf8]
mov dword [ebp - 0x24], 7
push 2
call fcn.10001ed7
mov dword [ebp - 0x24], 0x307976b5
mov dword [ebp - 0x24], 0x214c259d
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x34], ebx
jmp 0x10001ea3
mov ecx, dword [ebp - 0x34]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0x801465ee
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 2
jl 0x10001e90
mov eax, dword [ebp - 0x7c]
lea ecx, [ebp - 0xf8]
mov dword [eax], ebx
call fcn.10001f5a
lea ecx, [ebp - 0x7c]
call fcn.10001f5a
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret