Function at 0x1002832f
Capabilities:
Contain obfuscated stackstrings
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008d66d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2e4
push esi
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100295cf
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1e0], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], 0
jmp 0x10028382
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x10028398
mov eax, dword [ebp - 0x58]
mov dword [ebp + eax*4 - 0x178], 8
jmp 0x1002837b
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x178], 0xfffffffd
jmp 0x100283c6
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x178]
inc eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x178], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x178], 0x14
jl 0x10028418
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x6c], 0
jmp 0x100283ed
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10028416
mov byte [ebp - 0x36], 0
push 0x6a06
push 0x64ec
push 0x30aa
lea eax, [ebp - 0x36]
push eax
push 0
call fcn.1002832f
add esp, 0x14
jmp 0x100283e6
jmp 0x100283ab
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1e0]
add ecx, dword [eax]
mov dword [ebp - 0x1c0], ecx
mov dword [ebp - 0x10], 5
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x21c], 0x7017a68f
mov dword [ebp - 0x218], 0x7017a68f
mov dword [ebp - 0x214], 0x7017a68f
mov dword [ebp - 0x210], 0x7017a68f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x294], eax
cmp dword [ebp - 0x10], 0
jne 0x10028574
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x10]
cmp eax, 3
jle 0x10028492
mov dword [ebp - 0x1bc], 1
jmp 0x10028499
and dword [ebp - 0x1bc], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x290], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x10], 0
je 0x100284c3
cmp dword [ebp - 0x10], 0
je 0x100284c3
mov dword [ebp - 0xe0], 1
jmp 0x100284ca
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0xe0], eax
je 0x100284e5
push 0xfffffffffffffffe
pop eax
test eax, eax
jne 0x100284e5
and dword [ebp - 0x154], 0
jmp 0x100284ef
mov dword [ebp - 0x154], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x154], eax
jne 0x10028506
mov dword [ebp - 0x9c], 1
jmp 0x1002850d
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x9c], eax
jne 0x10028524
mov dword [ebp - 0x114], 1
jmp 0x1002852b
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x114]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x10]
cmp eax, 0x44653ffd
je 0x10028553
cmp dword [ebp - 0x20], 0
jne 0x10028553
and dword [ebp - 0xa4], 0
jmp 0x1002855d
mov dword [ebp - 0xa4], 1
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0xa4]
cmp dword [ebp - 0x10], eax
jl 0x10028574
and dword [ebp - 0x130], 0
jmp 0x1002857e
mov dword [ebp - 0x130], 1
cmp dword [ebp - 0x130], 0
jl 0x10028593
mov dword [ebp - 0x1c4], 1
jmp 0x1002859a
and dword [ebp - 0x1c4], 0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
jle 0x100285d0
mov byte [ebp - 0x25], 0
movzx eax, byte [ebp - 0x25]
test eax, eax
je 0x100285cb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x1002888c
push 4
lea ecx, [ebp - 0x184]
call fcn.10016f54
and dword [ebp - 4], 0
mov dword [ebp - 0x1dc], 0xffffffff
mov dword [ebp - 0x60], 0
jmp 0x100285fb
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 4
jge 0x10028617
push dword [ebp - 0x60]
lea ecx, [ebp - 0x184]
call fcn.10016fe2
mov dword [eax], 0x84cb
jmp 0x100285f4
mov dword [ebp - 0x20], 0x1b
jmp 0x10028627
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x34
jne 0x10028851
mov dword [ebp - 0x68], 0
jmp 0x10028641
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x10028657
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x250], 7
jmp 0x1002863a
mov dword [ebp - 0x10], 0
jmp 0x10028667
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x10028832
mov dword [ebp - 0x70], 0xffffffff
mov dword [ebp - 0x1c], 3
jmp 0x10028688
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x100286aa
mov byte [ebp - 0x26], 0
movzx eax, byte [ebp - 0x26]
test eax, eax
je 0x100286a8
push 1
push 0x185a
call fcn.10026aca
pop ecx
pop ecx
jmp 0x10028681
push 2
lea ecx, [ebp - 0x184]
call fcn.10016fe2
cmp dword [eax], 0
je 0x100287e6
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp + eax*4 - 0x21c]
push 2
lea ecx, [ebp - 0x184]
call fcn.10016fe2
cmp esi, dword [eax]
je 0x100286e7
mov dword [ebp - 0xac], 1
jmp 0x100286ee
and dword [ebp - 0xac], 0
push 2
lea ecx, [ebp - 0x184]
call fcn.10016fe2
mov ecx, dword [ebp - 0xac]
imul ecx, dword [eax]
test ecx, ecx
je 0x1002871d
mov eax, 0xb1a7
test eax, eax
je 0x1002871d
mov dword [ebp - 0x1cc], 1
jmp 0x10028724
and dword [ebp - 0x1cc], 0
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x21c]
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0
je 0x10028755
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x250], 0
je 0x10028755
mov dword [ebp - 0x110], 1
jmp 0x1002875c
and dword [ebp - 0x110], 0
mov eax, dword [ebp - 0x110]
neg eax
cmp eax, 0x5b81
jne 0x10028777
mov dword [ebp - 0xb4], 1
jmp 0x1002877e
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xb4], eax
jge 0x10028795
mov dword [ebp - 0x1d4], 1
jmp 0x1002879c
and dword [ebp - 0x1d4], 0
mov dword [ebp - 0x1c], 0x5b60
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2d4], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x250]
mov dword [ebp - 0x27c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x21c]
mov dword [ebp - 0x284], eax
mov eax, 0xae2e
test eax, eax
je 0x100287e6
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x250], 0
mov eax, 0xa349
cmp eax, 0xdd31
je 0x100287fe
mov dword [ebp - 0x150], 1
jmp 0x10028805
and dword [ebp - 0x150], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x21c]
add eax, dword [ebp - 0x150]
jne 0x10028824
push 2
lea ecx, [ebp - 0x184]
call fcn.10016fe2
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x1dc], eax
jmp 0x10028660
mov byte [ebp - 0x28], 0
movzx eax, byte [ebp - 0x28]
test eax, eax
je 0x1002884c
push 1
push 0x7508
call fcn.10026b10
pop ecx
pop ecx
jmp 0x10028620
mov dword [ebp - 0x10], 0
jmp 0x10028861
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
jg 0x1002887d
mov byte [ebp - 0x2a], 0
movzx eax, byte [ebp - 0x2a]
test eax, eax
je 0x1002887b
push 0
call fcn.1002a934
pop ecx
jmp 0x1002885a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x184]
call fcn.10016fdd
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
add eax, 8
mov dword [ebp - 0x50], eax
and dword [ebp - 0x80], 0
jmp 0x100288ac
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
mov eax, dword [ebp - 0x50]
inc eax
inc eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
mov eax, dword [eax + 4]
sub eax, 8
shr eax, 1
cmp dword [ebp - 0x80], eax
jae 0x100291b9
mov dword [ebp - 0x28c], 0
mov dword [ebp - 0x278], 0xfe7d8a87
mov dword [ebp - 0x298], 5
mov dword [ebp - 0x2c0], 0xf1e5c8a5
push 1
lea ecx, [ebp - 0x2a8]
call fcn.10016f54
mov dword [ebp - 4], 1
mov dword [ebp - 0x208], 0x448110cb
mov dword [ebp - 0x18], 0
jmp 0x10028918
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 2
jge 0x1002892e
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2e8], 0x25b3b9da
jmp 0x10028911
mov dword [ebp - 0x18], 0
jmp 0x1002893e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x1002895a
push dword [ebp - 0x18]
lea ecx, [ebp - 0x2a8]
call fcn.10016fe2
mov dword [eax], 0xd1d2a6f9
jmp 0x10028937
mov byte [ebp - 0x2c], 0
push 0x3ac1
push 0x7ad4
push 0
push 0x6f92
lea eax, [ebp - 0x2c]
push eax
call fcn.1002fabb
add esp, 0x14
push 0
lea eax, [ebp - 0x208]
push eax
push 0x7c6c
call fcn.1002cc14
add esp, 0xc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a8]
call fcn.10016fdd
push 1
lea ecx, [ebp - 0x170]
call fcn.10016f54
mov dword [ebp - 4], 2
push 1
lea ecx, [ebp - 0x274]
call fcn.10016f54
mov byte [ebp - 4], 3
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x40], 0
jmp 0x100289dc
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 3
jge 0x100289f2
mov eax, dword [ebp - 0x40]
mov dword [ebp + eax*4 - 0x108], 1
jmp 0x100289d5
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x40]
push eax
push 0x73eb
push 0
push 0x752b
call fcn.10026b44
add esp, 0x14
push 0x2f3e
push 0x3c88
lea eax, [ebp - 0x40]
push eax
push 1
lea eax, [ebp - 0x274]
push eax
call fcn.10026b44
add esp, 0x14
push 0
lea ecx, [ebp - 0x170]
call fcn.10016fe2
and dword [eax], 0
jmp 0x10028a66
push 0
lea ecx, [ebp - 0x170]
call fcn.10016fe2
mov dword [ebp - 0xbc], eax
mov eax, dword [ebp - 0xbc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xbc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x170]
call fcn.10016fe2
cmp dword [eax], 2
jg 0x10028d38
mov dword [ebp - 0x34], 3
mov dword [ebp - 0x74], 3
mov dword [ebp - 0x120], 0xadaa237f
mov dword [ebp - 0x34], 2
jmp 0x10028aa4
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x10028d13
mov dword [ebp - 0x164], 0x65653d42
mov dword [ebp - 0x160], 0x65653d42
mov dword [ebp - 0x15c], 0x65653d42
mov dword [ebp - 0x158], 0x65653d42
mov dword [ebp - 0x1b4], 0xfffffffc
mov esi, dword [ebp - 0x34]
push 0
lea ecx, [ebp - 0x170]
call fcn.10016fe2
mov eax, dword [eax]
mov ecx, dword [ebp + esi*4 - 0x108]
mov dword [ebp + eax*4 - 0x108], ecx
push 4
pop eax
shl eax, 0
mov dword [ebp + eax - 0x164], 2
jmp 0x10028b2e
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x164]
dec eax
push 4
pop ecx
shl ecx, 0
mov dword [ebp + ecx - 0x164], eax
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x164], 0
jl 0x10028d0e
mov dword [ebp - 0x4c], 0x38591b68
mov dword [ebp - 0x4c], 2
jmp 0x10028b59
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jl 0x10028d09
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x44], 0
jmp 0x10028b7a
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 2
jg 0x10028d04
mov dword [ebp - 0x74], 0xfffffff7
mov eax, dword [ebp - 0x34]
cmp dword [ebp + eax*4 - 0x108], 0x8d5f
jle 0x10028ba7
mov dword [ebp - 0xc4], 1
jmp 0x10028bae
and dword [ebp - 0xc4], 0
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x164], 1
jl 0x10028bc9
mov dword [ebp - 0x118], 1
jmp 0x10028bd0
and dword [ebp - 0x118], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x164]
mov eax, dword [ebp + eax*4 - 0x108]
cmp eax, dword [ebp - 0x118]
jge 0x10028bf8
mov dword [ebp - 0x138], 1
jmp 0x10028bff
and dword [ebp - 0x138], 0
mov eax, dword [ebp - 0xc4]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x74]
cmp eax, dword [ebp - 0x138]
jg 0x10028c1f
mov dword [ebp - 0xcc], 1
jmp 0x10028c26
and dword [ebp - 0xcc], 0
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x120], eax
cmp dword [ebp - 0x120], 0xd2ae857b
jne 0x10028c4a
mov dword [ebp - 0xd4], 1
jmp 0x10028c51
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0x44]
imul eax, dword [ebp - 0xd4]
cmp eax, 0x162d
jg 0x10028c6e
mov dword [ebp - 0x148], 1
jmp 0x10028c75
and dword [ebp - 0x148], 0
cmp dword [ebp - 0x148], 0xec0dcee
jne 0x10028c8d
mov dword [ebp - 0xdc], 1
jmp 0x10028c94
and dword [ebp - 0xdc], 0
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp + eax*4 - 0x108]
cmp dword [ebp - 0xdc], eax
jge 0x10028cb2
mov dword [ebp - 0x128], 1
jmp 0x10028cb9
and dword [ebp - 0x128], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x128]
imul ecx, dword [ebp + eax - 0x164]
mov dword [ebp - 0xe4], ecx
push 0
lea ecx, [ebp - 0x274]
call fcn.10016fe2
mov ecx, dword [ebp - 0xe4]
mov dword [eax], ecx
mov eax, dword [ebp - 0xe4]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x44], 0
je 0x10028cff
jmp 0x10028b73
jmp 0x10028b73
jmp 0x10028b52
jmp 0x10028b13
jmp 0x10028a9d
mov byte [ebp - 0x2b], 0
movzx eax, byte [ebp - 0x2b]
test eax, eax
je 0x10028d33
push 0
push 0x1bf5
push 0x3ed
call fcn.10029aa2
add esp, 0xc
jmp 0x10028a42
mov dword [ebp - 0x24], 2
jmp 0x10028d48
mov eax, dword [ebp - 0x24]
dec eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jl 0x10028e17
mov dword [ebp - 0x48], 0xffffffff
mov dword [ebp - 0x194], 0
mov dword [ebp - 0x48], 2
jmp 0x10028d73
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x10028e12
mov dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x108], 0
je 0x10028db3
mov dword [ebp - 0x140], 0xdf15
cmp dword [ebp - 0x140], 0
je 0x10028db3
mov dword [ebp - 0xec], 1
jmp 0x10028dba
and dword [ebp - 0xec], 0
push 0
lea ecx, [ebp - 0x170]
call fcn.10016fe2
mov eax, dword [ebp - 0x24]
cmp dword [ebp + eax*4 - 0x108], 1
jne 0x10028de0
mov dword [ebp - 0x1a0], 1
jmp 0x10028de7
and dword [ebp - 0x1a0], 0
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + eax*4 - 0x108]
add eax, 0x624edec5
mov ecx, dword [ebp - 0xec]
sub ecx, eax
mov dword [ebp - 0x194], ecx
jmp 0x10028d6c
jmp 0x10028d41
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x274]
call fcn.10016fdd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x170]
call fcn.10016fdd
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x94], 0x4bdac842
cmp dword [ebp - 0x14], 0
je 0x10028fee
mov dword [ebp - 0x64], 0
jmp 0x10028e60
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 3
jge 0x10028e76
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x190], 0xfe223643
jmp 0x10028e59
mov dword [ebp - 0x14], 0
jmp 0x10028e86
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jg 0x10028fec
mov dword [ebp - 0x7c], 0xde6f885e
mov dword [ebp - 0x1f8], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x190]
cmp dword [ebp - 0x14], eax
je 0x10028ec5
mov dword [ebp - 0xfc], 1
jmp 0x10028ecc
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0x7c]
push 4
pop ecx
imul ecx, ecx, 0
sub eax, dword [ebp + ecx - 0x190]
jne 0x10028eea
mov dword [ebp - 0xf4], 1
jmp 0x10028ef1
and dword [ebp - 0xf4], 0
mov eax, dword [ebp - 0xfc]
add eax, dword [ebp - 0xf4]
mov dword [ebp - 0x7c], eax
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x7c], eax
jne 0x10028f1e
mov dword [ebp - 0x10c], 1
jmp 0x10028f25
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x94], eax
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x190]
cmp dword [ebp - 0x94], eax
jg 0x10028f52
mov dword [ebp - 0x98], 1
jmp 0x10028f59
and dword [ebp - 0x98], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x98], eax
jge 0x10028f70
mov dword [ebp - 0x1a8], 1
jmp 0x10028f77
and dword [ebp - 0x1a8], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + eax*4 - 0x190]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x190], 0xae9a
jg 0x10028fa3
mov dword [ebp - 0xa0], 1
jmp 0x10028faa
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0xa0]
mov dword [ebp - 0x1f8], eax
mov byte [ebp - 0x27], 0
movzx eax, byte [ebp - 0x27]
test eax, eax
je 0x10028fe7
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x217
push 0x1910
push 0x249b
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x10028e7f
jmp 0x1002900e
mov dword [ebp - 0x1b0], 0xd8ff8cd3
mov dword [ebp - 0x200], 0xcce45d76
mov eax, dword [ebp - 0x1b0]
mov dword [ebp - 0x200], eax
push 0
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x1b8]
push eax
call fcn.1002cb7e
add esp, 0xc
mov dword [ebp - 0x3c], 0xfffffff8
mov dword [ebp - 0xa8], 0xfffffff6
mov dword [ebp - 0x3c], 0xfffffff3
jmp 0x10029044
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0xfffffff7
jle 0x10029066
push 0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0xa8]
push eax
push 0x6eeb
call fcn.1002fbba
add esp, 0x10
jmp 0x1002903d
cmp dword [ebp - 0x3c], 0
je 0x100290a5
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x10029086
push 0
push 0x1167
call fcn.1002bc9d
pop ecx
pop ecx
mov byte [ebp - 0x29], 0
movzx eax, byte [ebp - 0x29]
test eax, eax
je 0x100290a0
push 0x3c55
push 1
call fcn.10026bee
pop ecx
pop ecx
jmp 0x10029134
push 2
lea ecx, [ebp - 0x268]
call fcn.10016f54
mov dword [ebp - 4], 4
push 0x4c81
lea eax, [ebp - 0x268]
push eax
lea eax, [ebp - 0x29c]
push eax
push 0xf43
push 0
push 0xd74
call fcn.1002fa26
add esp, 0x18
push 1
lea eax, [ebp - 0x268]
push eax
push 0x2936
push 0x840
push 0x3962
push 0xa1f
push 0x537a
push 0x62d1
push 0x297e
push 0x7f62
push 0x354
lea eax, [ebp - 0xa8]
push eax
call fcn.10028190
add esp, 0x30
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x268]
call fcn.10016fdd
lea eax, [ebp - 0x50]
push eax
push 0x2b20
push 0x33ba
lea eax, [ebp - 0x1fc]
push eax
push 0x5d65
push 0x9c9
push 0x606a
push 0x647e
push 0x25c
push 0
push 0x500b
call fcn.100296ad
add esp, 0x2c
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x204], eax
cmp dword [ebp - 0x204], 3
je 0x1002918a
jmp 0x100291b4
mov eax, dword [ebp - 0x1c0]
add eax, dword [ebp - 0x1fc]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x1c8]
add eax, dword [ecx]
mov ecx, dword [ebp - 0xb0]
mov dword [ecx], eax
jmp 0x1002889d
mov dword [ebp - 0x54], 0xba33
mov dword [ebp - 0x20c], 0x3bfa32a1
mov dword [ebp - 0x280], 0xfffffff7
mov dword [ebp - 0x2bc], 0xa13b2885
mov dword [ebp - 0xf0], 0xd70512a3
mov dword [ebp - 0x288], 0xffffffff
mov dword [ebp - 0x1d0], 1
mov dword [ebp - 0x1e4], 0xfffffffd
mov dword [ebp - 0x12c], 0xffffffff
mov dword [ebp - 0x1f4], 0xd8bc0d13
mov dword [ebp - 0x1f0], 0xd8bc0d13
mov dword [ebp - 0x1ec], 0xd8bc0d13
mov dword [ebp - 0x1e8], 0xd8bc0d13
mov dword [ebp - 0x244], 0x401dbdae
mov dword [ebp - 0x240], 0x401dbdae
mov dword [ebp - 0x23c], 0x401dbdae
mov dword [ebp - 0x238], 0x401dbdae
lea ecx, [ebp - 0x85]
call fcn.10009273
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x244]
push eax
lea ecx, [ebp - 0x2e0]
call fcn.10016ff1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x25c]
call fcn.10016fb3
mov dword [ebp - 4], 5
mov dword [ebp - 0x14c], 8
mov dword [ebp - 0x84], 2
mov dword [ebp - 0xd0], 0x9ed994ad
or dword [ebp - 0x230], 0xffffffff
or dword [ebp - 0x22c], 0xffffffff
or dword [ebp - 0x228], 0xffffffff
or dword [ebp - 0x224], 0xffffffff
lea ecx, [ebp - 0x75]
call fcn.10009273
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x2f0]
call fcn.10016ff1
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2b8]
call fcn.10016fb3
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x20c]
mov dword [ebp - 0x1d0], eax
mov eax, 0x7e91c178
sub eax, 0xfffffffd
push 4
pop ecx
shl ecx, 1
cmp eax, dword [ebp + ecx - 0x1f4]
jg 0x1002933a
mov dword [ebp - 0xb8], 1
jmp 0x10029341
and dword [ebp - 0xb8], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0xb8], eax
je 0x1002935b
mov dword [ebp - 0xc0], 1
jmp 0x10029362
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0xc0]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
cmp eax, dword [ebp + ecx - 0x1f4]
jg 0x10029384
mov dword [ebp - 0xc8], 1
jmp 0x1002938b
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xd0], eax
cmp dword [ebp - 0xd0], 0
jne 0x100293b2
cmp dword [ebp - 0xf0], 0
jne 0x100293b2
and dword [ebp - 0xd8], 0
jmp 0x100293bc
mov dword [ebp - 0xd8], 1
mov eax, dword [ebp - 0x84]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1e4]
add eax, dword [ebp - 0xd8]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x1d8]
cmp eax, dword [ebp - 0x198]
jg 0x10029401
mov dword [ebp - 0x90], 1
jmp 0x10029408
and dword [ebp - 0x90], 0
mov eax, dword [ebp - 0x90]
sub eax, dword [ebp - 0x14c]
push 4
pop ecx
imul ecx, ecx, 3
sub eax, dword [ebp + ecx - 0x1f4]
jne 0x10029433
push 9
pop eax
test eax, eax
jne 0x10029433
and dword [ebp - 0xe8], 0
jmp 0x1002943d
mov dword [ebp - 0xe8], 1
cmp dword [ebp - 0xe8], 1
ja 0x10029452
mov dword [ebp - 0x19c], 1
jmp 0x10029459
and dword [ebp - 0x19c], 0
mov eax, dword [ebp - 0xf0]
mov dword [ebp - 0x2cc], eax
push 1
lea ecx, [ebp - 0x25c]
call fcn.10016fe2
cmp dword [eax], 0xfffffff8
je 0x10029483
mov dword [ebp - 0xf8], 1
jmp 0x1002948a
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x54]
cmp eax, dword [ebp - 0xf8]
jg 0x100294a1
mov dword [ebp - 0x11c], 1
jmp 0x100294a8
and dword [ebp - 0x11c], 0
mov esi, dword [ebp - 0x11c]
add esi, 7
push 0
lea ecx, [ebp - 0x25c]
call fcn.10016fe2
cmp esi, dword [eax]
je 0x100294ce
mov dword [ebp - 0x124], 1
jmp 0x100294d5
and dword [ebp - 0x124], 0
mov eax, dword [ebp - 0x54]
cmp dword [ebp - 0x124], eax
je 0x100294ec
mov dword [ebp - 0x8c], 1
jmp 0x100294f3
and dword [ebp - 0x8c], 0
push 3
lea ecx, [ebp - 0x2b8]
call fcn.10016fe2
mov ecx, dword [ebp - 0x8c]
mov dword [eax], ecx
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x8c]
sub ecx, dword [ebp + eax - 0x1f4]
imul ecx, dword [ebp - 0x54]
cmp dword [ebp - 0x54], ecx
jl 0x10029530
mov dword [ebp - 0x134], 1
jmp 0x10029537
and dword [ebp - 0x134], 0
mov eax, dword [ebp - 0x12c]
cmp dword [ebp - 0x134], eax
jge 0x10029551
mov dword [ebp - 0x13c], 1
jmp 0x10029558
and dword [ebp - 0x13c], 0
cmp dword [ebp - 0x13c], 0x36bb
jge 0x10029570
mov dword [ebp - 0x144], 1
jmp 0x10029577
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x144]
mov dword [ebp - 0x14c], eax
mov byte [ebp - 0x2d], 0
movzx eax, byte [ebp - 0x2d]
test eax, eax
je 0x10029597
push 0
call fcn.1002bb65
pop ecx
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x2b8]
call fcn.10016fdd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x25c]
call fcn.10016fdd
push 0
lea eax, [ebp - 0x5c]
push eax
push 0xd3c
push 0x6a28
call fcn.1002a98d
add esp, 0x10
jmp 0x100295f9
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1a4], eax
mov eax, dword [ebp - 0x1a4]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x1ac]
movzx eax, byte [eax]
test eax, eax
je 0x100295f9
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret