Function at 0x1001a788
Capabilities:
Check os version
Get common file path
Get disk information
Modify service
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10087142
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1a0
push ebx
push esi
push edi
mov dword [esp + 0x8c], edx
mov dword [esp + 0x44], ecx
mov dword [esp + 0x20], 0x8a062b00
mov dword [esp + 0x10], 0xfdb69689
mov dword [esp + 0x14], 0xee56e31b
mov eax, dword [esp + 0x20]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
neg eax
push 1
pop esi
push 0
pop ebx
jne 0x1001a809
mov ecx, ebx
cmp dword [esp + 0x10], ebx
je 0x1001a80b
mov ecx, esi
mov eax, dword [esp + 0x20]
xor edx, edx
mov edi, dword [sym.imp.USER32.dll_GetDC]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x14], ecx
mov dword [esp + 0x14], ebx
jmp 0x1001a8d0
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x1c], ebx
jmp 0x1001a855
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x15c], 0x2549
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001a842
mov dword [esp + 0x20], 0xffffffe4
jmp 0x1001a89e
mov byte [esp + 0x27], bl
cmp byte [esp + 0x27], 0
je 0x1001a88f
push ebx
push ebx
push ebx
push 0x1ab
push 0x14b7
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov eax, dword [esp + 0x15c]
mov dword [esp + 0x10], eax
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jle 0x1001a866
mov dword [esp + 0x20], ebx
jmp 0x1001a8c6
mov byte [esp + 0x27], bl
cmp byte [esp + 0x27], 0
je 0x1001a8c2
push ebx
push 0x5e2
push ebx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jle 0x1001a8aa
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe2
jg 0x1001a834
push esi
lea ecx, [esp + 0x60]
call fcn.1001855e
mov dword [esp + 0x1b4], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x28], 0x8a0c
mov dword [esp + 0x20], esi
mov dword [esp + 0x38], 0x26cefc6e
mov dword [esp + 0x18], ebx
jmp 0x1001a91d
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xa4], 0x40d7f825
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001a90a
mov dword [esp + 0x18], ebx
jmp 0x1001a93d
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x5c]
mov dword [eax + ecx*4], 6
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jl 0x1001a92a
mov eax, dword [esp + 0x5c]
mov dword [eax], ebx
mov dword [esp + 0x14], esi
lea ecx, [esp + 0xb4]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x3c], 0x8670fc24
mov dword [esp + 0x28], 0x8e487928
push 3
call fcn.1001855e
push 3
mov dword [esp + 0x30], 0xdd5d57d3
mov dword [esp + 0x20], ebx
pop edx
jmp 0x1001a99a
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xb4]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001a984
mov eax, dword [esp + 0x5c]
mov eax, dword [eax]
cmp dword [esp + eax*4 + 0xa4], ebx
jne 0x1001ab02
mov dword [esp + 0x14], edx
cmp dword [esp + 0x14], ebx
jl 0x1001aae5
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x38], 0x2c593c86
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x1c], 0x69035a60
mov eax, dword [eax]
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 0xfffffff8
mov dword [esp + 0x28], esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x10], 0xf484
mov edx, dword [esp + eax*4 + 0xa4]
mov eax, dword [esp + 0x14]
cmp eax, 0xfffffff6
setne cl
xor eax, eax
cmp edx, ecx
setge al
xor ecx, ecx
cmp eax, 0x41a9c213
setle cl
xor eax, eax
test ecx, ecx
setg al
sub eax, 0x257e
je 0x1001aa57
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], ebx
jmp 0x1001aa4e
mov eax, dword [esp + 0x18]
mov dword [esp + eax*4 + 0xa4], esi
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 4
jl 0x1001aa3f
jmp 0x1001aa6e
mov dword [esp + 0x18], 0xfffc
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0xa4], esi
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x5c]
mov eax, dword [eax]
mov dword [esp + eax*4 + 0xa4], ecx
dec dword [esp + 0x10]
test ecx, ecx
je 0x1001aab0
mov eax, dword [esp + 0x2c]
imul eax, eax, 0x70aa
mov dword [esp + 0xa8], eax
test eax, eax
je 0x1001aaa4
mov ecx, esi
cmp dword [esp + 0x1c], ebx
jne 0x1001aaa6
mov ecx, ebx
mov eax, dword [esp + 0xb4]
mov dword [eax + 4], ecx
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x38]
mov eax, dword [esp + 0x3c]
mov edx, dword [esp + 0x2c]
sub edx, dword [esp + 0x30]
mov eax, dword [esp + 0x20]
cmp edx, eax
setl cl
mov dword [esp + 0x38], ecx
dec dword [esp + 0x14]
jns 0x1001a9c1
lea ecx, [esp + 0xb4]
call fcn.10018df6
mov eax, dword [esp + 0x5c]
inc dword [eax]
cmp dword [eax], 3
jle 0x1001a949
jmp 0x1001ab0e
lea ecx, [esp + 0xb4]
call fcn.10018df6
mov byte [esp + 0x27], bl
cmp byte [esp + 0x27], 0
je 0x1001ab26
push 0x1ec6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
or dword [esp + 0x1b4], 0xffffffff
lea ecx, [esp + 0x5c]
call fcn.10018df6
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x2c], 4
mov dword [esp + 0x20], 0xb9737e0d
mov dword [esp + 0x38], 6
mov dword [esp + 0x28], 0x8ad88ca0
mov dword [esp + 0x18], 0x13
jmp 0x1001ad0a
push 2
lea ecx, [esp + 0x10c]
call fcn.1001855e
mov dword [esp + 0x10], 0xffffffff
mov dword [esp + 0x30], ebx
mov dword [esp + 0x1c], ebx
jmp 0x1001ab9e
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x108]
mov dword [eax + ecx*4], esi
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001ab8c
mov esi, dword [esp + 0x108]
cmp dword [esi + 4], ebx
je 0x1001ac71
xor ecx, ecx
mov dword [esp + 0x14], 0xfff9
mov eax, dword [esp + 0x14]
cmp dword [esi + 4], eax
setl cl
xor edx, edx
mov dword [esp + 0x30], ecx
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setg cl
neg ecx
mov dword [esp + 0x3c], ecx
xor ecx, ecx
cmp eax, dword [esp + 0x30]
setge cl
xor eax, eax
cmp dword [esp + 0x3c], ecx
setge al
cmp eax, dword [esp + 0x14]
je 0x1001ac14
cmp dword [esp + 0x2c], ebx
je 0x1001ac14
xor eax, eax
inc eax
jmp 0x1001ac16
mov eax, ebx
cmp eax, dword [esp + 0x18]
jne 0x1001ac28
cmp dword [esi + 4], ebx
je 0x1001ac28
xor esi, esi
inc esi
mov edx, esi
jmp 0x1001ac2d
xor esi, esi
mov edx, ebx
inc esi
mov eax, dword [esp + 0x18]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], ebx
jmp 0x1001ac69
mov dword [esp + 0x20], ebx
jmp 0x1001ac5f
mov byte [esp + 0x27], bl
cmp byte [esp + 0x27], 0
je 0x1001ac5b
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], esi
jle 0x1001ac48
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jle 0x1001ac42
jmp 0x1001acdd
mov dword [esp + 0x1c], 0xf68e
mov dword [esp + 0x2c], 0xd
jmp 0x1001ac9f
cmp dword [esp + 0x38], ebx
jne 0x1001aca6
mov byte [esp + 0x27], bl
cmp byte [esp + 0x27], 0
je 0x1001ac9b
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
dec dword [esp + 0x2c]
cmp dword [esp + 0x2c], 5
jg 0x1001ac83
mov eax, dword [esp + 0x1c]
xor ecx, ecx
mov eax, dword [esp + 0x28]
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x10]
sub edx, dword [esi + 4]
mov eax, dword [esp + 0x1c]
cmp edx, eax
setne cl
mov dword [esp + 0x30], ecx
cmp dword [esp + 0x18], ebx
je 0x1001acd2
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
xor esi, esi
mov dword [esp + 0x20], eax
inc esi
mov byte [esp + 0x27], bl
cmp byte [esp + 0x27], 0
je 0x1001acfa
push 0x1f38
push ebx
push 0x1419
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [esp + 0x108]
call fcn.10018df6
dec dword [esp + 0x18]
cmp dword [esp + 0x18], 0xfffffffd
jne 0x1001ab6c
mov dword [esp + 0x1c], ebx
jmp 0x1001ad2b
mov eax, dword [esp + 0x1c]
mov dword [esp + eax*4 + 0x34], 0xffffffff
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], esi
jl 0x1001ad1b
push dword [esp + 0x44]
movdqa xmm0, xmmword [0x10008060]
lea eax, [esp + 0x17c]
push eax
lea eax, [esp + 0x170]
mov dword [esp + 0x70], ebx
push eax
push ebx
lea ecx, [esp + 0x78]
mov dword [esp + 0x7c], ebx
movdqu xmmword [esp + 0x178], xmm0
mov dword [esp + 0x80], ebx
call fcn.10019c6b
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], 3
cmp dword [esp + 0x14], ebx
jl 0x1001ad9c
mov byte [esp + 0x27], bl
cmp byte [esp + 0x27], 0
je 0x1001ad96
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
dec dword [esp + 0x14]
jns 0x1001ad85
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x68]
push 0xfffffffffffffffe
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
sub ecx, eax
mov eax, dword [esp + 0x1c]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 4]
setge dl
sub ecx, eax
mov eax, dword [esp + 0x68]
mov dword [esp + 0x28], edx
xor edx, edx
cmp ecx, dword [eax + 8]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x28]
setg dl
add eax, edx
xor edx, edx
imul ecx, eax
mov eax, dword [esp + 0x1c]
cmp ecx, eax
setle dl
xor ecx, ecx
imul edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x68]
add edx, dword [esi + 4]
cmp edx, 0xfff7
setne cl
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
add ecx, 0xffff2a06
neg ecx
sbb ecx, ecx
inc ecx
mov dword [esp + 0x14], ecx
lea ecx, [esp + 0x68]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], 0xb64b6930
mov dword [esp + 0x10], 0x668dacb3
mov eax, dword [esp + 0x10]
mov dword [esp + 0x28], eax
call fcn.10018df6
mov dword [esp + 0x34], 0xfffffff8
cmp dword [esp + 0x34], 0xfffffff9
jle 0x1001b02f
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov byte [esp + 0x26], bl
xor edx, edx
mov dword [esp + 0x14], 1
mov dword [esp + 0x20], 0x4ee7d21
mov dword [esp + 0x28], 0xef9a8551
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
cmp ecx, eax
setge dl
cmp edx, dword [esp + 0x20]
je 0x1001af3d
push 1
lea ecx, [esp + 0x140]
call fcn.1001855e
xor edx, edx
inc edx
mov dword [esp + 0x28], edx
mov dword [esp + 0x28], 0xde0980db
mov dword [esp + 0x28], 0x1d102278
mov dword [esp + 0x1c], ebx
jmp 0x1001aef7
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x13c]
mov dword [eax + ecx*4], 0xcc2f
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edx
jl 0x1001aee1
mov dword [esp + 0x14], ebx
cmp dword [esp + 0x14], ebx
jl 0x1001af31
mov dword [esp + 0x20], ebx
jmp 0x1001af25
mov dword [esp + 0x28], 0xa9864ba8
mov dword [esp + 0x10], 5
inc dword [esp + 0x10]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], ebx
jle 0x1001af0d
dec dword [esp + 0x14]
jns 0x1001af07
lea ecx, [esp + 0x13c]
jmp 0x1001afdd
push 2
lea ecx, [esp + 0x14c]
call fcn.1001855e
xor edx, edx
inc edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x2c], 0x16e2
mov dword [esp + 0x1c], ebx
jmp 0x1001af7a
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x148]
mov dword [eax + ecx*4], edx
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001af68
dec dword [esp + 0x2c]
mov ecx, edx
mov eax, dword [esp + 0x20]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
sub ecx, eax
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setne dl
imul eax, edx
add eax, dword [esp + 0x18]
cmp eax, dword [esp + 0x10]
jle 0x1001afce
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x28]
lea ecx, [esp + 0x148]
inc dword [esp + 0x10]
call fcn.10018df6
mov dword [esp + 0x20], 0x16
jmp 0x1001b005
mov byte [esp + 0x27], bl
cmp byte [esp + 0x27], 0
je 0x1001b001
push ebx
call esi
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0x17
jle 0x1001afec
cmp byte [esp + 0x26], 0
je 0x1001b020
push ebx
call esi
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
inc dword [esp + 0x34]
cmp dword [esp + 0x34], 0xfffffff9
jg 0x1001ae69
xor esi, esi
lea ecx, [esp + 0xfc]
inc esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], 0x9e71b35d
push 2
call fcn.1001855e
mov dword [esp + 0x1b4], esi
mov dword [esp + 0x1c], ebx
jmp 0x1001b06f
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xfc]
mov dword [eax + ecx*4], 0x8d81
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 2
jl 0x1001b059
cmp dword [esp + 0x20], ebx
je 0x1001b0b1
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov eax, dword [esp + 0x20]
mov edx, esi
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
cmp edx, eax
setl cl
cmp ecx, dword [esp + 0x20]
mov ecx, esi
jne 0x1001b0b3
mov ecx, ebx
xor eax, eax
cmp ecx, 0x1ef9
setge al
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 2
jle 0x1001b27f
mov dword [esp + 0x18], 0xaa5d732a
lea ecx, [esp + 0xe4]
mov dword [esp + 0x10], ebx
push 4
call fcn.1001855e
mov dword [esp + 0x1c], ebx
jmp 0x1001b107
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0xe4]
mov dword [eax + ecx*4], 0x93c5815d
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], 4
jl 0x1001b0f1
dec dword [esp + 0x18]
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x14]
je 0x1001b139
mov eax, dword [esp + 0x14]
mov dword [esp + 0x14], eax
cmp dword [esp + 0x14], ebx
je 0x1001b139
mov eax, dword [esp + 0x18]
neg eax
mov dword [esp + 0x10], eax
jmp 0x1001b25e
mov dword [esp + 0x2c], esi
mov dword [esp + 0x1c], 0xfffffff8
mov byte [esp + 0x26], bl
cmp byte [esp + 0x26], 0
je 0x1001b168
push 0x1fc2
push 0x135f
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [esp + 0x18], ebx
cmp dword [esp + 0x18], esi
jg 0x1001b25e
mov eax, dword [esp + 0xe4]
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], 0xa323
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x18]
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov ecx, dword [esp + 0xfc]
setne dl
xor eax, eax
imul edx, dword [ecx + esi*4]
neg edx
cmp edx, dword [ecx + edi*4]
setl al
imul eax, eax, 0xbdb8
test eax, eax
jne 0x1001b1d8
cmp dword [esp + 0x2c], ebx
jne 0x1001b1d8
xor esi, esi
mov eax, ebx
inc esi
jmp 0x1001b1dd
xor esi, esi
inc esi
mov eax, esi
mov dword [esp + 0x10], eax
mov ecx, esi
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
sub ecx, eax
sub ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp ecx, eax
mov ecx, dword [esp + 0x30]
setl dl
sub edx, dword [esp + 0x2c]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov dword [ecx + 0xc], eax
mov byte [esp + 0x26], bl
cmp byte [esp + 0x26], 0
je 0x1001b250
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x1001b181
lea ecx, [esp + 0xe4]
call fcn.10018df6
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 2
jg 0x1001b0d1
mov edi, dword [sym.imp.USER32.dll_GetDC]
or dword [esp + 0x1b4], 0xffffffff
lea ecx, [esp + 0xfc]
call fcn.10018df6
push 2
lea ecx, [esp + 0x134]
call fcn.1001855e
mov dword [esp + 0x10], 0xfffffff7
mov dword [esp + 0x28], 0xe838
mov dword [esp + 0x10], ebx
jmp 0x1001b2cd
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x130]
mov dword [eax + ecx*4], 0x1713
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001b2b7
mov dword [esp + 0x10], esi
cmp dword [esp + 0x10], ebx
jl 0x1001b306
mov byte [esp + 0x26], bl
cmp byte [esp + 0x26], 0
je 0x1001b300
push 0x6c0
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
dec dword [esp + 0x10]
jns 0x1001b2de
lea ecx, [esp + 0x130]
call fcn.10018df6
mov dword [esp + 0x28], 0x648261f9
mov byte [esp + 0x26], bl
cmp byte [esp + 0x26], 0
je 0x1001b331
push 0x1a1
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov byte [esp + 0x26], bl
cmp byte [esp + 0x26], 0
je 0x1001b359
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x129c
push 0x81f
push 0x15be
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [esp + 0x20], esi
lea ecx, [esp + 0xc0]
push 3
call fcn.1001855e
mov dword [esp + 0x1b4], 2
mov dword [esp + 0x1c], 0xfffffff8
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x28], 0xa3062a4b
mov dword [esp + 0x10], ebx
mov byte [esp + 0x26], bl
cmp byte [esp + 0x26], 0
je 0x1001b3ad
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov eax, dword [esp + 0x10]
xor edx, edx
mov eax, dword [esp + 0x10]
mov dword [esp + 0x1c], 7
imul ecx, dword [esp + 0x10], 0x67f6
mov eax, dword [esp + 0x1c]
push 4
cmp eax, ecx
lea ecx, [esp + 0x78]
setne dl
sub edx, dword [esp + 0x14]
neg edx
sbb edx, edx
inc edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x14], 0x9ea4087b
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], 0x94643cdf
call fcn.1001855e
mov dword [esp + 0x10], 0x7f59ec13
mov dword [esp + 0x10], ebx
jmp 0x1001b41d
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x74]
mov dword [eax + ecx*4], 0xfffd
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x1001b40a
mov eax, dword [esp + 0x18]
push 3
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
pop edx
jmp 0x1001b4f6
mov dword [esp + 0x1c], 0x7071658a
mov dword [esp + 0x28], 0x42c3b03c
mov dword [esp + 0x14], ebx
jmp 0x1001b4e8
mov dword [esp + 0x2c], 0x51da622a
mov dword [esp + 0x2c], edx
cmp dword [esp + 0x2c], ebx
jl 0x1001b48e
mov dword [esp + 0x10], 6
mov dword [esp + 0x10], edx
cmp dword [esp + 0x10], ebx
jl 0x1001b488
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x74]
cmp dword [eax + ecx*4], ebx
jne 0x1001b488
dec dword [esp + 0x10]
jns 0x1001b475
dec dword [esp + 0x2c]
jns 0x1001b463
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
cmp dword [eax + ecx*4], ebx
jne 0x1001b4c4
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x74]
mov eax, dword [eax + ecx*4]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], ebx
jne 0x1001b4c4
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x74]
mov eax, dword [eax + ecx*4]
inc eax
mov dword [esp + 0x28], eax
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edx
jle 0x1001b451
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edx
jle 0x1001b438
lea ecx, [esp + 0x74]
call fcn.10018df6
mov dword [esp + 0x14], 0xffffffff
lea ecx, [esp + 0xf0]
push 2
call fcn.1001855e
mov dword [esp + 0x28], 0xd9e2a8d3
mov dword [esp + 0x28], 0xfffffffb
mov dword [esp + 0x28], esi
mov dword [esp + 0x28], 0xc383c67e
mov dword [esp + 0x28], 5
mov dword [esp + 0x28], 0x710dd013
mov dword [esp + 0x10], ebx
jmp 0x1001b567
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xf0]
mov dword [eax + ecx*4], 0xae77ab39
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001b551
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp eax, esi
setl cl
mov dword [esp + 0x14], ecx
cmp dword [esp + 0x14], ebx
mov byte [esp + 0x26], bl
je 0x1001b59a
cmp byte [esp + 0x26], 0
je 0x1001b5be
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
jmp 0x1001b5be
cmp byte [esp + 0x26], 0
je 0x1001b5be
push 0x826
push ebx
push ebx
push 0x1367
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call edi
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov dword [esp + 0x14], esi
cmp dword [esp + 0x14], ebx
jl 0x1001b60a
mov dword [esp + 0x1c], 7
mov dword [esp + 0x10], ebx
jmp 0x1001b5e5
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x164], ebx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001b5d6
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xf0]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [esp + 0x1c]
dec dword [esp + 0x14]
jns 0x1001b5c8
lea ecx, [esp + 0xf0]
call fcn.10018df6
push 3
mov dword [esp + 0x14], ebx
pop edi
jmp 0x1001b635
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc0]
mov dword [eax + ecx*4], 0xd3cd3624
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001b61f
mov dword [esp + 0x20], ebx
jmp 0x1001b840
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], 0x60477862
mov dword [esp + 0x28], 0x8974b66
mov dword [esp + 0x28], ebx
mov dword [esp + 0x28], 0xa065c2dd
mov dword [esp + 0x28], 0x5c0de450
mov dword [esp + 0x28], 0xf4df
mov dword [esp + 0x1c], 0xd978
mov dword [esp + 0x28], 0xbe26b5cf
mov dword [esp + 0x10], ebx
jmp 0x1001b69a
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x40], 0xfffffffc
inc dword [esp + 0x10]
cmp dword [esp + 0x10], esi
jl 0x1001b68a
mov dword [esp + 0x10], 7
jmp 0x1001b6d0
mov dword [esp + 0x28], esi
mov byte [esp + 0x26], bl
cmp byte [esp + 0x26], 0
je 0x1001b6c8
push esi
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov eax, dword [esp + 0x28]
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffff2
jge 0x1001b6aa
inc dword [esp + 0x1c]
mov dword [esp + 0x94], 0xffff
mov dword [esp + 0x98], 0xffff
mov dword [esp + 0x9c], 0xffff
mov dword [esp + 0xa0], 0xffff
cmp dword [esp + 0x14], ebx
jne 0x1001b84b
mov dword [esp + 0x14], ebx
jmp 0x1001b832
mov dword [esp + 0x18], 0xcaad901
xor edx, edx
mov ecx, dword [esp + 0x20]
add ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setge dl
sub edx, 0x81d534a2
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setge cl
cmp ecx, dword [esp + 0x20]
jl 0x1001b755
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0xc0]
mov dword [eax], ebx
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x9c], esi
jne 0x1001b76f
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
xor edx, edx
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
add eax, 0x4644688d
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x98]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x9c]
cmp ecx, eax
mov eax, dword [esp + 0x20]
setl dl
imul eax, edx
sub eax, 0x227283a3
je 0x1001b7c4
mov eax, dword [esp + 0xc0]
cmp dword [eax], ebx
mov eax, esi
jne 0x1001b7c6
mov eax, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x18], ebx
jmp 0x1001b828
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], ebx
jl 0x1001b824
mov dword [esp + 0x1c], 0xb46f9f1
mov dword [esp + 0x1c], ebx
jmp 0x1001b818
mov dword [esp + 0x2c], 0xcf05746a
mov dword [esp + 0x2c], ebx
jmp 0x1001b809
mov eax, dword [esp + 0x2c]
mov dword [esp + eax*4 + 0x94], 0xfff8
inc dword [esp + 0x2c]
cmp dword [esp + 0x2c], 4
jl 0x1001b7f6
mov eax, dword [esp + 0x1c]
inc dword [esp + 0x1c]
cmp dword [esp + 0x1c], edi
jle 0x1001b7e8
dec dword [esp + 0x10]
jns 0x1001b7da
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x1001b7d0
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x1001b71a
inc dword [esp + 0x20]
cmp dword [esp + 0x20], 0xa
jl 0x1001b644
or dword [esp + 0x1b4], 0xffffffff
lea ecx, [esp + 0xc0]
call fcn.10018df6
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x3c], 0xfffffff7
mov byte [esp + 0x26], bl
cmp byte [esp + 0x26], 0
je 0x1001b886
push 0x1e11
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], 0xffffffee
jle 0x1001b956
push 0xa
pop ecx
mov dword [esp + 0x14], 0x1f665683
mov dword [esp + 0x10], 0x729694d2
mov dword [esp + 0x14], ecx
jmp 0x1001b93c
mov dword [esp + 0x18], ebx
mov dword [esp + 0x30], 0x1f6f
mov dword [esp + 0x28], ebx
mov dword [esp + 0x18], ebx
jmp 0x1001b932
mov dword [esp + 0x10], 0xfffffff6
mov dword [esp + 0x28], 0xf7c8b166
mov eax, dword [esp + 0x14]
mov dword [esp + 0x10], 0xffffffff
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x14]
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x20]
neg eax
sbb eax, eax
inc eax
sub eax, dword [esp + 0x3c]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x18]
jge 0x1001b924
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
neg eax
mov dword [esp + 0x28], eax
inc dword [esp + 0x18]
cmp dword [esp + 0x18], ecx
jl 0x1001b8c7
dec dword [esp + 0x14]
cmp dword [esp + 0x14], 0xffffffe5
jg 0x1001b8b1
dec dword [esp + 0x20]
cmp dword [esp + 0x20], 0xffffffee
jg 0x1001b898
push dword [esp + 0x40]
movdqa xmm0, xmmword [0x10007fd0]
lea eax, [esp + 0x19c]
push eax
lea eax, [esp + 0x190]
mov dword [esp + 0x98], 0xfffffff7
push eax
mov dword [esp + 0x1c], 0x55595070
lea ecx, [esp + 0xd8]
push ebx
movdqu xmmword [esp + 0x198], xmm0
mov dword [esp + 0xdc], ebx
mov dword [esp + 0xe0], ebx
mov dword [esp + 0xe4], ebx
call fcn.10019c6b
mov dword [esp + 0x1b4], edi
push 8
pop eax
mov dword [esp + 0x120], eax
mov dword [esp + 0x124], eax
mov dword [esp + 0x128], eax
mov dword [esp + 0x12c], eax
mov dword [esp + 0x1c], 0x4d0c653d
mov dword [esp + 0x128], esi
mov dword [esp + 0x10], ebx
jmp 0x1001ba4e
push dword [esp + 0x40]
movdqa xmm0, xmmword [0x10008070]
lea eax, [esp + 0x18c]
push eax
lea eax, [esp + 0x180]
mov dword [esp + 0xe0], ebx
push eax
push ebx
lea ecx, [esp + 0xe8]
mov dword [esp + 0xec], ebx
movdqu xmmword [esp + 0x188], xmm0
mov dword [esp + 0xf0], ebx
call fcn.10019c6b
mov dword [esp + 0x28], 0xfffffff8
lea ecx, [esp + 0xd8]
dec dword [esp + 0x1c]
call fcn.10018df6
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffea
jg 0x1001b9eb
or dword [esp + 0x1b4], 0xffffffff
lea ecx, [esp + 0xcc]
call fcn.10018df6
push edi
lea ecx, [esp + 0x118]
call fcn.1001855e
mov dword [esp + 0x14], 0xfffffffc
mov dword [esp + 0x10], 0x51d77f17
mov dword [esp + 0x10], ebx
jmp 0x1001baa2
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x114]
mov dword [eax + ecx*4], 0x313dd33a
inc dword [esp + 0x10]
cmp dword [esp + 0x10], edi
jl 0x1001ba8c
push 2
mov dword [esp + 0x18], ebx
pop edi
jmp 0x1001bb7d
mov dword [esp + 0x1c], 0xffffffff
mov dword [esp + 0x10], ebx
mov dword [esp + 0x28], esi
mov dword [esp + 0x1c], edi
cmp dword [esp + 0x1c], ebx
jl 0x1001bb79
mov dword [esp + 0x18], 0xfb5a5efa
mov dword [esp + 0x18], ebx
jmp 0x1001baf6
mov byte [esp + 0x26], bl
cmp byte [esp + 0x26], 0
je 0x1001baf2
push ebx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], edi
jle 0x1001bae0
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x1c]
xor eax, eax
add ecx, 0x4c9a615c
imul ecx, dword [esp + 0x18]
cmp ecx, 0x7363
setg al
xor ecx, ecx
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x114]
mov eax, dword [esp + 0x10]
cmp eax, dword [edx + esi*4]
setne cl
xor edx, edx
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
cmp ecx, eax
mov eax, dword [esp + 0x18]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esp + 0x14]
setle cl
mov dword [esp + 0x28], ecx
xor ecx, ecx
cmp dword [esp + 0x28], eax
setle cl
mov dword [esp + 0x28], ecx
dec dword [esp + 0x1c]
jns 0x1001bad2
xor esi, esi
inc esi
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x1001bab4
lea ecx, [esp + 0x114]
call fcn.10018df6
push 3
lea ecx, [esp + 0x54]
call fcn.1001855e
mov dword [esp + 0x1b4], 4
lea eax, [esp + 0x1a8]
push dword [esp + 0x40]
movdqa xmm0, xmmword [0x10008020]
lea ecx, [esp + 0x84]
push eax
lea eax, [esp + 0x1a0]
mov dword [esp + 0x1c], 0x5020f89b
push eax
mov dword [esp + 0x38], 0xa5ea964a
push ebx
movdqu xmmword [esp + 0x1a8], xmm0
mov dword [esp + 0x90], ebx
mov dword [esp + 0x94], ebx
mov dword [esp + 0x98], ebx
call fcn.10019c6b
mov dword [esp + 0x14], ebx
jmp 0x1001bc19
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
mov dword [eax + ecx*4], 0xdc85f70a
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jl 0x1001bc06
mov dword [esp + 0x14], ebx
jmp 0x1001bc36
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x48], 0xbdfadf62
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jl 0x1001bc26
mov dword [esp + 0x14], ebx
jmp 0x1001bdae
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x18], edi
cmp dword [esp + 0x18], ebx
jl 0x1001bd9b
mov edi, dword [esp + 0x50]
mov dword [esp + 0x1c], 6
mov dword [esp + 0x10], ebx
jmp 0x1001bc84
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x154], 0xb56fe18
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1001bc71
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x50]
mov eax, dword [esp + 0x18]
cmp dword [ecx + edx*4], eax
je 0x1001bca8
inc dword [esp + 0x2c]
mov eax, dword [esp + 0x48]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
sub edx, eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x50]
mov dword [eax + ecx*4], edx
xor ecx, ecx
mov eax, dword [esp + 0x1c]
cmp edx, eax
setg cl
xor edx, edx
mov dword [esp + 0x1c], ecx
mov esi, dword [esp + 0x48]
mov ecx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
cmp eax, ecx
mov dword [edi + 4], esi
setl dl
cmp esi, edx
jne 0x1001bd42
mov esi, dword [esp + 0x18]
xor ecx, ecx
mov eax, dword [esp + 0x48]
imul edx, eax, 0xffff
mov eax, dword [esp + 0x48]
sub edx, eax
mov eax, dword [esp + 0x50]
inc edx
cmp edx, dword [eax + esi*4]
setle cl
cmp ecx, 0xfffffffb
jb 0x1001bd2c
cmp dword [esp + 0x154], ebx
jne 0x1001bd2c
xor esi, esi
mov edx, ebx
inc esi
jmp 0x1001bd31
xor esi, esi
inc esi
mov edx, esi
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x50]
cmp edx, dword [eax + ecx*4]
je 0x1001bd42
mov eax, esi
jmp 0x1001bd47
xor esi, esi
mov eax, ebx
inc esi
xor ecx, ecx
cmp eax, 0xee1d
mov eax, dword [esp + 0x48]
setle cl
sub ecx, 0x406c
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [esp + 0x18]
je 0x1001bd84
mov eax, dword [esp + 0x80]
dec dword [eax + 8]
jmp 0x1001bd8e
mov dword [esp + 0x28], ebx
cmp dword [esp + 0x28], ebx
jne 0x1001bd98
dec dword [esp + 0x18]
jns 0x1001bc63
push 2
pop edi
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x50]
mov dword [eax + ecx*4], 0x44f8a3d3
inc dword [esp + 0x14]
cmp dword [esp + 0x14], edi
jle 0x1001bc45
lea ecx, [esp + 0x80]
call fcn.10018df6
or dword [esp + 0x1b4], 0xffffffff
lea ecx, [esp + 0x50]
call fcn.10018df6
push 0xf3e
lea eax, [esp + 0x94]
push eax
push ebx
push 0x5df0
push 0x5544
push 0x37a3
push 0x15c1
push 0x7349
push 0x2e68
push 0x6d5b
push 0x2a78
call fcn.1001d543
mov eax, dword [esp + 0xb8]
mov ecx, 0x3e8
cdq
add esp, 0x2c
idiv ecx
mov ecx, dword [esp + 0x44]
mov edi, edx
mov esi, eax
call fcn.1001a716
mov ecx, dword [esp + 0x1ac]
add eax, esi
add eax, edi
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret