Function at 0x1000c1e0
Capabilities:
Check if file exists
Create service
Modify service
Persist via windows service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10060d51
mov eax, dword fs:[0]
push eax
sub esp, 0x728
mov eax, dword [0x10071290]
xor eax, esp
mov dword [esp + 0x720], eax
push ebx
push esi
push edi
mov eax, dword [0x10071290]
xor eax, esp
push eax
lea eax, [esp + 0x738]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x94], ebx
mov dword [esp + 0xb0], eax
mov dword [esp + 0xac], ebx
mov word [esp + 0x9c], cx
mov dword [esp + 0xb4], 0x2001f
mov dword [esp + 0x740], ebx
push 0x34
xor edx, edx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
call fcn.10001790
lea edi, [esp + 0x14]
lea esi, [esp + 0x94]
mov byte [esp + 0x740], 1
call fcn.100038d0
mov byte [esp + 0x740], bl
cmp dword [esp + 0x2c], 8
jb 0x1000c2ae
mov eax, dword [esp + 0x18]
push eax
call fcn.10043fe0
add esp, 4
lea ecx, [esp + 0x50]
push ecx
call fcn.10004760
mov byte [esp + 0x740], 2
push 0xd
xor edx, edx
push str.FileZhuoYisvc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
call fcn.10001790
lea eax, [esp + 0x50]
push eax
lea ecx, [esp + 0x98]
push ecx
mov byte [esp + 0x748], 3
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], 1
call fcn.10004330
test al, al
je 0x1000c350
mov esi, dword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
sub esi, ecx
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x1000c335
call fcn.10044148
mov ecx, dword [esp + 0x5c]
mov eax, dword [ecx + 0x14]
push 0x1006db58
mov edi, 0xe
call fcn.100063b0
mov byte [esp + 0x33], 1
test eax, eax
je 0x1000c354
mov byte [esp + 0x33], bl
mov dword [esp + 0x740], 2
cmp dword [esp + 0x2c], 8
jb 0x1000c373
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10043fe0
add esp, 4
cmp byte [esp + 0x33], bl
jne 0x1000c483
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x5c]
mov ebx, eax
cmp edi, eax
jbe 0x1000c398
call fcn.10044148
mov eax, dword [esp + 0x60]
mov edi, dword [esp + 0x5c]
mov esi, dword [esp + 0x50]
cmp edi, eax
jbe 0x1000c3a5
call fcn.10044148
mov edx, dword [esp + 0x50]
push ebx
push esi
push edi
push edx
lea ebx, [esp + 0x80]
lea esi, [esp + 0x60]
call fcn.10005100
push 0xe
xor eax, eax
push 0x1006db58
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.10001790
lea ecx, [esp + 0x14]
push ecx
mov ebx, esi
mov byte [esp + 0x744], 4
call fcn.100049a0
mov byte [esp + 0x740], 2
cmp dword [esp + 0x2c], 8
jb 0x1000c414
mov edx, dword [esp + 0x18]
push edx
call fcn.10043fe0
add esp, 4
push 0xd
xor eax, eax
push str.FileZhuoYisvc
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], ax
call fcn.10001790
lea ecx, [esp + 0x50]
push ecx
lea ebx, [esp + 0x18]
lea edi, [esp + 0x98]
mov byte [esp + 0x744], 5
call fcn.10003f60
test al, al
sete bl
mov byte [esp + 0x740], 2
cmp dword [esp + 0x2c], 8
jb 0x1000c479
mov edx, dword [esp + 0x18]
push edx
call fcn.10043fe0
add esp, 4
test bl, bl
jne 0x1000d041
xor ebx, ebx
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [esp + 0x70], esi
cmp esi, ebx
jne 0x1000c4de
mov eax, dword [esp + 0x5c]
cmp eax, ebx
je 0x1000c4c0
mov ecx, dword [esp + 0x70]
mov edi, dword [esp + 0x60]
push ecx
call fcn.10005820
mov edx, dword [esp + 0x60]
add esp, 4
push edx
call fcn.10043fe0
add esp, 4
mov eax, dword [esp + 0x50]
push eax
mov dword [esp + 0x60], ebx
mov dword [esp + 0x64], ebx
mov dword [esp + 0x68], ebx
call fcn.10043fe0
add esp, 4
jmp 0x1000d04a
push 0x206
lea edx, [esp + 0x11a]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x120], cx
call fcn.10049a70
add esp, 0xc
push str._SystemRoot_System32_svchost.exe__k
lea eax, [esp + 0x118]
push 0x104
push eax
call fcn.10045875
add esp, 0xc
push str.FileZhuoYisvc
lea ecx, [esp + 0x118]
push 0x104
push ecx
call fcn.100458e4
add esp, 0xc
push 0xf01ff
push 0x1006db58
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [esp + 0x68], eax
cmp eax, ebx
jne 0x1000c59e
push ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x128]
push edx
push 1
push 2
push 0x20
push 0xf01ff
push 0x1006db58
push 0x1006db58
push esi
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [esp + 0x68], eax
cmp eax, ebx
jne 0x1000c588
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1000d041
lea ecx, [esp + 0x6c]
push ecx
push 1
push eax
mov dword [esp + 0x78], 0x1006dbc4
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2W]
mov eax, 7
xor edx, edx
mov dword [esp + 0xec], eax
mov dword [esp + 0xe8], ebx
mov word [esp + 0xd8], dx
xor ecx, ecx
mov dword [esp + 0xf0], ebx
mov dword [esp + 0x10c], eax
mov dword [esp + 0x108], ebx
mov word [esp + 0xf8], cx
mov dword [esp + 0x110], 0x2001f
mov byte [esp + 0x740], al
push 0x5e
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall32B5ECE7_CF30_4d36_883E_640D6FBD0DE2_is1
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], dx
call fcn.10001790
mov ebx, 0x20019
lea edi, [esp + 0x14]
lea esi, [esp + 0xf0]
mov byte [esp + 0x740], 8
call fcn.10003990
mov ebx, 7
mov byte [esp + 0x740], bl
cmp dword [esp + 0x2c], 8
jb 0x1000c646
mov eax, dword [esp + 0x18]
push eax
call fcn.10043fe0
add esp, 4
xor ecx, ecx
push 0xf
mov word [esp + 0x1c], cx
push str.InstallLocation
lea ecx, [esp + 0x1c]
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], 0
call fcn.10001790
lea edx, [esp + 0xd4]
push edx
lea esi, [esp + 0x18]
lea ebx, [esp + 0xf4]
mov byte [esp + 0x744], 9
call fcn.10004070
test al, al
sete bl
mov byte [esp + 0x740], 7
cmp dword [esp + 0x2c], 8
jb 0x1000c6aa
mov eax, dword [esp + 0x18]
push eax
call fcn.10043fe0
add esp, 4
xor edi, edi
xor ecx, ecx
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
mov word [esp + 0x18], cx
test bl, bl
je 0x1000c739
push 0x206
lea eax, [esp + 0x52a]
xor edx, edx
push edi
push eax
mov word [esp + 0x530], dx
call fcn.10049a70
mov edx, dword [0x100738dc]
add esp, 0xc
push 0x104
lea ecx, [esp + 0x528]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [esp + 0x524]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [esp + 0x524]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000c715
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x528]
push ecx
lea ecx, [esp + 0xdc]
call fcn.10001790
call fcn.100065b0
mov edx, str.FileZhuoYiHost64.dll
test al, al
jne 0x1000c74c
mov edx, 0x1006dce4
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x1000c751
sub eax, esi
sar eax, 1
push eax
push edx
lea esi, [esp + 0xdc]
call fcn.10005f80
mov eax, dword [esp + 0xd8]
mov ebx, 8
cmp dword [esp + 0xec], ebx
jae 0x1000c78a
lea eax, [esp + 0xd8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1000c7c6
lea esi, [esp + 0xf0]
call fcn.10003a40
cmp dword [esp + 0xec], ebx
jb 0x1000c7ba
mov edx, dword [esp + 0xd8]
push edx
call fcn.10043fe0
add esp, 4
mov dword [esp + 0xe8], edi
jmp 0x1000d02c
push 0x206
xor ebx, ebx
lea edx, [esp + 0x322]
xor ecx, ecx
push ebx
push edx
mov word [esp + 0x328], cx
call fcn.10049a70
add esp, 0xc
push str.SYSTEMCurrentControlSetServices_
lea eax, [esp + 0x320]
push 0x104
push eax
call fcn.10045875
add esp, 0xc
push 0x1006db58
lea ecx, [esp + 0x320]
push 0x104
push ecx
call fcn.100458e4
add esp, 0xc
lea edx, [esp + 0x31c]
push edx
lea ecx, [esp + 0x18]
call fcn.10001740
lea edi, [esp + 0x14]
lea esi, [esp + 0x94]
mov byte [esp + 0x740], 0xa
call fcn.100038d0
mov esi, 8
cmp dword [esp + 0x2c], esi
jb 0x1000c85d
mov eax, dword [esp + 0x18]
push eax
call fcn.10043fe0
add esp, 4
xor ecx, ecx
mov dword [esp + 0x10], ebx
mov dword [esp + 0xd0], 7
mov dword [esp + 0xcc], ebx
mov word [esp + 0xbc], cx
push str.DelayedAutoStart
lea ecx, [esp + 0x18]
mov byte [esp + 0x744], 0xb
call fcn.10001740
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x18]
lea eax, [esp + 0x98]
call fcn.10004010
test al, al
je 0x1000c8b7
cmp dword [esp + 0x10], 1
jne 0x1000c8b7
xor bl, bl
jmp 0x1000c8b9
mov bl, 1
lea ecx, [esp + 0x14]
call fcn.10001c50
test bl, bl
je 0x1000c8ef
push str.DelayedAutoStart
lea ecx, [esp + 0x18]
call fcn.10001740
push 1
lea ecx, [esp + 0x18]
lea eax, [esp + 0x98]
call fcn.10003b10
lea ecx, [esp + 0x14]
call fcn.10001c50
push str.DeleteFlag
lea ecx, [esp + 0x18]
call fcn.10001740
lea ecx, [esp + 0x14]
lea eax, [esp + 0x94]
call fcn.10003ac0
test al, al
sete bl
cmp dword [esp + 0x2c], esi
jb 0x1000c925
mov eax, dword [esp + 0x18]
push eax
call fcn.10043fe0
add esp, 4
test bl, bl
je 0x1000c950
push str.DeleteFlag
lea ecx, [esp + 0x18]
call fcn.10001740
lea eax, [esp + 0x14]
lea ecx, [esp + 0x94]
call fcn.10004520
lea ecx, [esp + 0x14]
call fcn.10001c50
push str.Group
lea ecx, [esp + 0x18]
call fcn.10001740
lea ecx, [esp + 0x14]
lea eax, [esp + 0x94]
call fcn.10003ac0
test al, al
sete bl
cmp dword [esp + 0x2c], esi
jb 0x1000c986
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10043fe0
add esp, 4
test bl, bl
je 0x1000c9b1
push str.Group
lea ecx, [esp + 0x18]
call fcn.10001740
lea eax, [esp + 0x14]
lea ecx, [esp + 0x94]
call fcn.10004520
lea ecx, [esp + 0x14]
call fcn.10001c50
lea esi, [esp + 0xb8]
call fcn.100060b0
push str.Description
lea ecx, [esp + 0x18]
call fcn.10001740
mov edx, esi
mov byte [esp + 0x740], 0xc
push edx
lea esi, [esp + 0x18]
lea ebx, [esp + 0x98]
mov dword [esp + 0x14], 4
call fcn.10004070
test al, al
je 0x1000ca17
mov eax, dword [esp + 0xcc]
push 0x1006dbc4
mov edi, 8
lea ecx, [esp + 0xbc]
call fcn.100063b0
test eax, eax
jne 0x1000ca17
xor bl, bl
jmp 0x1000ca19
mov bl, 1
lea ecx, [esp + 0x14]
mov dword [esp + 0x740], 0xb
call fcn.10001c50
test bl, bl
je 0x1000ca83
push 0x1006dbc4
lea ecx, [esp + 0x38]
call fcn.10001740
push str.Description
lea ecx, [esp + 0x18]
mov byte [esp + 0x744], 0xd
call fcn.10001740
lea eax, [esp + 0x34]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x94]
call fcn.10003b50
lea ecx, [esp + 0x14]
call fcn.10001c50
lea ecx, [esp + 0x34]
mov byte [esp + 0x740], 0xb
call fcn.10001c50
lea esi, [esp + 0xb8]
call fcn.100060b0
push str.DisplayName
lea ecx, [esp + 0x38]
call fcn.10001740
mov eax, esi
mov byte [esp + 0x740], 0xe
push eax
lea esi, [esp + 0x38]
lea ebx, [esp + 0x98]
mov dword [esp + 0x14], 8
call fcn.10004070
test al, al
je 0x1000cae9
mov eax, dword [esp + 0xcc]
push 0x1006db58
mov edi, 0xe
lea ecx, [esp + 0xbc]
call fcn.100063b0
test eax, eax
jne 0x1000cae9
xor bl, bl
jmp 0x1000caeb
mov bl, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x740], 0xb
call fcn.10001c50
test bl, bl
je 0x1000cb55
push 0x1006db58
lea ecx, [esp + 0x18]
call fcn.10001740
push str.DisplayName
lea ecx, [esp + 0x38]
mov byte [esp + 0x744], 0xf
call fcn.10001740
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x94]
call fcn.10003b50
lea ecx, [esp + 0x34]
call fcn.10001c50
lea ecx, [esp + 0x14]
mov byte [esp + 0x740], 0xb
call fcn.10001c50
push str.ErrorControl
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], 0
call fcn.10001740
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10004010
test al, al
je 0x1000cb8f
cmp dword [esp + 0x10], 1
jne 0x1000cb8f
xor bl, bl
jmp 0x1000cb91
mov bl, 1
lea ecx, [esp + 0x34]
call fcn.10001c50
test bl, bl
je 0x1000cbc7
push str.ErrorControl
lea ecx, [esp + 0x38]
call fcn.10001740
push 1
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10003b10
lea ecx, [esp + 0x34]
call fcn.10001c50
lea esi, [esp + 0xb8]
call fcn.100060b0
push str.ImagePath
lea ecx, [esp + 0x38]
call fcn.10001740
mov edx, esi
mov byte [esp + 0x740], 0x10
push edx
lea esi, [esp + 0x38]
lea ebx, [esp + 0x98]
mov dword [esp + 0x14], 0x20
call fcn.100041d0
test al, al
je 0x1000cc46
lea eax, [esp + 0x114]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000cc12
sub eax, edx
sar eax, 1
lea ecx, [esp + 0x114]
push ecx
mov edi, eax
mov eax, dword [esp + 0xd0]
lea ecx, [esp + 0xbc]
call fcn.100063b0
test eax, eax
jne 0x1000cc46
xor bl, bl
jmp 0x1000cc48
mov bl, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x740], 0xb
call fcn.10001c50
test bl, bl
je 0x1000ccb5
lea edx, [esp + 0x114]
push edx
lea ecx, [esp + 0x18]
call fcn.10001740
push str.ImagePath
lea ecx, [esp + 0x38]
mov byte [esp + 0x744], 0x11
call fcn.10001740
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x94]
call fcn.10003ba0
lea ecx, [esp + 0x34]
call fcn.10001c50
lea ecx, [esp + 0x14]
mov byte [esp + 0x740], 0xb
call fcn.10001c50
lea esi, [esp + 0xb8]
call fcn.100060b0
push str.ObjectName
lea ecx, [esp + 0x38]
call fcn.10001740
mov eax, esi
mov byte [esp + 0x740], 0x12
push eax
lea esi, [esp + 0x38]
lea ebx, [esp + 0x98]
mov dword [esp + 0x14], 0x40
call fcn.10004070
test al, al
je 0x1000cd1b
mov eax, dword [esp + 0xcc]
push str.LocalSystem
mov edi, 0xb
lea ecx, [esp + 0xbc]
call fcn.100063b0
test eax, eax
jne 0x1000cd1b
xor bl, bl
jmp 0x1000cd1d
mov bl, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x740], 0xb
call fcn.10001c50
test bl, bl
je 0x1000cd87
push str.LocalSystem
lea ecx, [esp + 0x18]
call fcn.10001740
push str.ObjectName
lea ecx, [esp + 0x38]
mov byte [esp + 0x744], 0x13
call fcn.10001740
lea eax, [esp + 0x14]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x94]
call fcn.10003b50
lea ecx, [esp + 0x34]
call fcn.10001c50
lea ecx, [esp + 0x14]
mov byte [esp + 0x740], 0xb
call fcn.10001c50
xor esi, esi
push str.Start
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], esi
call fcn.10001740
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10004010
test al, al
je 0x1000cdbf
cmp dword [esp + 0x10], 2
jne 0x1000cdbf
xor bl, bl
jmp 0x1000cdc1
mov bl, 1
lea ecx, [esp + 0x34]
call fcn.10001c50
test bl, bl
je 0x1000cdf7
push str.Start
lea ecx, [esp + 0x38]
call fcn.10001740
push 2
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10003b10
lea ecx, [esp + 0x34]
call fcn.10001c50
push str.Type
lea ecx, [esp + 0x38]
mov dword [esp + 0x14], esi
call fcn.10001740
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10004010
test al, al
je 0x1000ce2d
cmp dword [esp + 0x10], 0x20
jne 0x1000ce2d
xor bl, bl
jmp 0x1000ce2f
mov bl, 1
lea ecx, [esp + 0x34]
call fcn.10001c50
test bl, bl
je 0x1000ce65
push str.Type
lea ecx, [esp + 0x38]
call fcn.10001740
push 0x20
lea ecx, [esp + 0x38]
lea eax, [esp + 0x98]
call fcn.10003b10
lea ecx, [esp + 0x34]
call fcn.10001c50
push str.Parameters
lea eax, [esp + 0x320]
push 0x104
push eax
call fcn.100458e4
add esp, 0xc
lea ecx, [esp + 0x31c]
push ecx
lea ecx, [esp + 0x18]
call fcn.10001740
lea edi, [esp + 0x14]
lea esi, [esp + 0x94]
mov byte [esp + 0x740], 0x14
call fcn.100038d0
mov byte [esp + 0x740], 0xb
cmp dword [esp + 0x2c], 8
jb 0x1000cec4
mov edx, dword [esp + 0x18]
push edx
call fcn.10043fe0
add esp, 4
push str.ServiceDll
lea ecx, [esp + 0x38]
call fcn.10001740
lea eax, [esp + 0xb8]
mov byte [esp + 0x740], 0x15
push eax
lea esi, [esp + 0x38]
lea ebx, [esp + 0x98]
mov dword [esp + 0x14], 0x200
call fcn.100041d0
test al, al
je 0x1000cf19
lea eax, [esp + 0xd4]
lea ecx, [esp + 0xb8]
call fcn.10006420
test al, al
jne 0x1000cf19
xor bl, bl
jmp 0x1000cf1b
mov bl, 1
lea ecx, [esp + 0x34]
mov dword [esp + 0x740], 0xb
call fcn.10001c50
test bl, bl
je 0x1000cf61
push str.ServiceDll
lea ecx, [esp + 0x38]
call fcn.10001740
lea eax, [esp + 0xd4]
lea ecx, [esp + 0x34]
lea edx, [esp + 0x94]
call fcn.10003ba0
lea ecx, [esp + 0x34]
call fcn.10001c50
mov esi, dword [esp + 0x68]
xor eax, eax
lea ecx, [esp + 0x78]
push ecx
xor ebx, ebx
push esi
mov dword [esp + 0x80], ebx
mov dword [esp + 0x84], eax
mov dword [esp + 0x88], eax
mov dword [esp + 0x8c], eax
mov dword [esp + 0x90], eax
mov dword [esp + 0x94], eax
mov dword [esp + 0x98], eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [esp + 0x7c], 4
je 0x1000cfb6
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
mov edx, dword [esp + 0x70]
push edx
call esi
mov edi, 8
cmp dword [esp + 0xd0], edi
jb 0x1000cfe4
mov eax, dword [esp + 0xbc]
push eax
call fcn.10043fe0
add esp, 4
xor ecx, ecx
lea esi, [esp + 0xf0]
mov dword [esp + 0xd0], 7
mov dword [esp + 0xcc], ebx
mov word [esp + 0xbc], cx
call fcn.10003a40
cmp dword [esp + 0xec], edi
jb 0x1000d025
mov edx, dword [esp + 0xd8]
push edx
call fcn.10043fe0
add esp, 4
mov dword [esp + 0xe8], ebx
xor eax, eax
mov word [esp + 0xd8], ax
mov dword [esp + 0xec], 7
lea esi, [esp + 0x50]
call fcn.100047c0
lea esi, [esp + 0x94]
call fcn.10003a40
mov ecx, dword [esp + 0x738]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x720]
xor ecx, esp
call fcn.10043fd1
mov esp, ebp
pop ebp
ret 0x10