Function at 0x10042004
Capabilities:
Create process on windows
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a75e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3bc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10043800
lea eax, [ebp + 0xc]
mov dword [ebp - 0x174], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x21c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x188], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x190], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x224], eax
mov eax, dword [ebp - 0x174]
movzx eax, byte [eax]
test eax, eax
je 0x10043742
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x224]
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0xb8], 0x24a8c6a5
mov dword [ebp - 0x22c], 0
mov byte [ebp - 0x36], 0
movzx eax, byte [ebp - 0x36]
test eax, eax
je 0x100420c8
push 1
push 0x1755
push 1
push 0x4650
push 0x48c2
push 0x56ed
call fcn.100402e9
add esp, 0x18
mov dword [ebp - 0xb8], 0xffffffef
jmp 0x100420e1
mov eax, dword [ebp - 0xb8]
dec eax
mov dword [ebp - 0xb8], eax
cmp dword [ebp - 0xb8], 0xffffffee
jle 0x10042174
mov dword [ebp - 0x98], 0xb1891f78
mov dword [ebp - 0x68], 0
jmp 0x10042108
mov eax, dword [ebp - 0x68]
inc eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 3
jge 0x1004211e
mov eax, dword [ebp - 0x68]
mov dword [ebp + eax*4 - 0x33c], 0xffffffff
jmp 0x10042101
mov dword [ebp - 0x98], 2
jmp 0x10042137
mov eax, dword [ebp - 0x98]
dec eax
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jl 0x1004215d
push 0x606f
push 0x3506
push 1
push 0xe1f
push 1
call fcn.1004051f
add esp, 0x14
jmp 0x1004212a
push 4
pop eax
shl eax, 1
mov eax, dword [ebp + eax - 0x33c]
mov dword [ebp - 0x22c], eax
jmp 0x100420d4
mov eax, dword [0x107fb788]
and eax, 1
jne 0x100421a8
mov eax, dword [0x107fb788]
or eax, 1
mov dword [0x107fb788], eax
and dword [ebp - 4], 0
mov ecx, 0x107fb7d0
call fcn.10044728
push 0x1006ab18
call fcn.100507ac
pop ecx
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
call fcn.1003c464
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x13c], 0x4b64
mov dword [ebp - 0x180], 0x10008db4
cmp dword [ebp - 0x13c], 0x4f1e
jle 0x1004226d
and dword [ebp - 0x70], 0
jmp 0x100421e9
mov eax, dword [ebp - 0x70]
inc eax
mov dword [ebp - 0x70], eax
cmp dword [ebp - 0x70], 0x2518
jge 0x1004226d
and dword [ebp - 0xb0], 0
jmp 0x10042208
mov eax, dword [ebp - 0xb0]
inc eax
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0x78fe
jge 0x10042268
mov eax, dword [ebp - 0x70]
xor eax, dword [ebp - 0xb0]
cdq
mov dword [ebp - 0x1fc], eax
mov dword [ebp - 0x1f8], edx
push dword [ebp - 0x1f8]
push dword [ebp - 0x1fc]
lea ecx, [ebp - 0x3a8]
call fcn.1000cf11
pop ecx
pop ecx
mov dword [ebp - 0x1f0], eax
mov ecx, dword [ebp - 0x1f0]
call fcn.1000af34
push eax
call fcn.100507d6
pop ecx
lea ecx, [ebp - 0x3a8]
call fcn.1000af2a
jmp 0x100421fb
jmp 0x100421e2
push 4
lea ecx, [ebp - 0x2a4]
call fcn.1000b069
mov dword [ebp - 4], 1
lea eax, [ebp - 0x2a8]
push eax
push 0x5e15
push 0
lea eax, [ebp - 0x2a4]
push eax
push 1
push 0x5cbf
call fcn.1003f3ea
add esp, 0x18
push 1
push 1
push 1
lea eax, [ebp - 0x2a4]
push eax
call fcn.100405d5
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2a4]
call fcn.1000b0c5
mov dword [ebp - 4], 2
cmp dword [ebp - 0x13c], 0x4955
jge 0x100422e8
push dword [ebp - 0x180]
call fcn.100507d6
pop ecx
jmp 0x10042304
or dword [ebp - 4], 0xffffffff
jmp 0x1004230e
cmp dword [ebp - 0x8c], 6
jae 0x10042392
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x2ac]
push eax
mov ecx, 0x107fb7d0
call fcn.10037d71
push eax
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x2c8]
push eax
mov ecx, 0x107fb7d0
call fcn.10037d88
mov ecx, eax
call fcn.10037ca7
movzx eax, al
test eax, eax
je 0x10042392
push 1
push 1
call fcn.1003ec5d
pop ecx
pop ecx
mov eax, dword [ebp - 0x54]
mov eax, dword [eax]
mov dword [ebp - 0x1f4], eax
lea eax, [ebp - 0x1f4]
push eax
mov ecx, 0x107fb7d0
call fcn.1004477c
push eax
mov ecx, dword [ebp - 0x12c]
call fcn.100443c4
jmp 0x10043a00
mov dword [ebp - 0x58], 0xd5e48d32
mov dword [ebp - 0x17c], 0
mov dword [ebp - 0x1cc], 0xceef9a85
mov dword [ebp - 0x58], 0
jmp 0x100423bd
mov eax, dword [ebp - 0x58]
dec eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 0xffffffe2
jg 0x100424b6
push 1
lea ecx, [ebp - 0x280]
call fcn.1000b069
mov dword [ebp - 4], 4
push 2
lea ecx, [ebp - 0x28c]
call fcn.1000b069
mov byte [ebp - 4], 5
mov dword [ebp - 0x218], 0
push 1
push 0x43a9
push 0x5fa5
push 0x8f4
lea eax, [ebp - 0x154]
push eax
push 0x426b
push 0x3c8a
lea eax, [ebp - 0x280]
push eax
push 0x43f0
push 0
push 1
push 0x284b
call fcn.1003f65f
add esp, 0x30
push 0xdbc
push 0x1823
push 1
push 0
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x28c]
push eax
push 1
call fcn.10041cf9
add esp, 0x1c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x1cc]
push eax
push 1
push 0x57fa
lea eax, [ebp - 0x17c]
push eax
lea eax, [ebp - 0x218]
push eax
push 1
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x28c]
push eax
call fcn.1003f1a9
add esp, 0x24
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x28c]
call fcn.1000b0c5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x280]
call fcn.1000b0c5
jmp 0x100423b6
lea ecx, [ebp - 0x2c4]
call fcn.10044354
mov dword [ebp - 4], 6
mov dword [ebp - 0x88], 0xffffffff
mov dword [ebp - 0x144], 0xf27
mov dword [ebp - 0x184], 0x10008e28
cmp dword [ebp - 0x144], 0x11dc
jle 0x100425cb
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
and dword [ebp - 0x80], 0
jmp 0x1004251f
mov eax, dword [ebp - 0x80]
inc eax
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x45f5
jge 0x100425cb
and dword [ebp - 0xc0], 0
jmp 0x10042542
mov eax, dword [ebp - 0xc0]
inc eax
mov dword [ebp - 0xc0], eax
cmp dword [ebp - 0xc0], 0x296c
jge 0x100425c6
and dword [ebp - 0x78], 0
jmp 0x1004255b
mov eax, dword [ebp - 0x78]
inc eax
mov dword [ebp - 0x78], eax
cmp dword [ebp - 0x78], 0x11d1
jge 0x100425c1
and dword [ebp - 0xa0], 0
jmp 0x1004257a
mov eax, dword [ebp - 0xa0]
inc eax
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0x5fb5
jge 0x100425bf
mov eax, dword [ebp - 0x78]
xor eax, dword [ebp - 0xa0]
mov ecx, dword [ebp - 0x80]
sub ecx, dword [ebp - 0xc0]
or eax, ecx
cdq
mov dword [ebp - 0x208], eax
mov dword [ebp - 0x204], edx
push dword [ebp - 0x204]
push dword [ebp - 0x208]
mov ecx, 0x106112b8
call fcn.1000af54
jmp 0x1004256d
jmp 0x10042554
jmp 0x10042535
jmp 0x10042518
mov dword [ebp - 0x274], 0xefc07e17
mov dword [ebp - 0x270], 0xefc07e17
mov dword [ebp - 0x26c], 0xefc07e17
mov dword [ebp - 0x268], 0xefc07e17
lea ecx, [ebp - 0xe1]
call fcn.1000b3fc
push eax
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x274]
push eax
lea ecx, [ebp - 0x378]
call fcn.100240a5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2e0]
call fcn.1002407f
mov byte [ebp - 4], 7
mov byte [ebp - 4], 8
cmp dword [ebp - 0x144], 0xbe7
jge 0x1004264c
mov edx, dword [ebp - 0x184]
mov ecx, 0x106112b8
call fcn.1000c9c4
jmp 0x10042668
mov dword [ebp - 4], 7
jmp 0x10042678
mov dword [ebp - 0x88], 0x16
jmp 0x10042691
mov eax, dword [ebp - 0x88]
dec eax
mov dword [ebp - 0x88], eax
cmp dword [ebp - 0x88], 0xfffffffa
je 0x10042723
mov dword [ebp - 0x50], 0xffff
mov esi, dword [ebp - 0x50]
push 0
lea ecx, [ebp - 0x2e0]
call fcn.1000b0e1
mov dword [eax], esi
mov dword [ebp - 0x50], 0
jmp 0x100426c7
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x10
jl 0x1004271e
mov dword [ebp - 0x1d4], 0xc79e672c
mov dword [ebp - 0x1d4], 4
push 1
push 0x2262
push 0x561c
push 1
push 0x1a6d
push 0x7991
push 0x417
push 0x3268
push 0x561b
push 0x7a80
push 1
push 0x5f71
call fcn.100407e1
add esp, 0x30
jmp 0x100426c0
jmp 0x10042684
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x2e0]
call fcn.1000b0c5
mov eax, dword [ebp - 0x8c]
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x1004362d
mov dword [ebp - 0xd8], 0
push 4
lea ecx, [ebp - 0x150]
call fcn.1000b069
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x18c], 5
push 1
lea ecx, [ebp - 0x16c]
call fcn.1000b069
mov byte [ebp - 4], 0xb
push 1
lea ecx, [ebp - 0x238]
call fcn.1000b069
mov byte [ebp - 4], 0xc
mov dword [ebp - 0x140], 0
mov dword [ebp - 0x260], 0x7d3e67b
mov dword [ebp - 0x25c], 0x7d3e67b
mov dword [ebp - 0x258], 0x7d3e67b
mov dword [ebp - 0x254], 0x7d3e67b
lea ecx, [ebp - 0xd9]
call fcn.1000b3fc
push eax
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x370]
call fcn.100240a5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x2f0]
call fcn.1002407f
mov byte [ebp - 4], 0xd
mov dword [ebp - 0x138], 0xc1f20cf6
mov dword [ebp - 0x1dc], 0xffffffff
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x18]
push eax
push 1
push 1
push 0x5769
push 0x62f5
call fcn.1003f4b1
add esp, 0x18
mov dword [ebp - 0x18], 0
jmp 0x1004283e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10042854
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xa8], 0xfffffffd
jmp 0x10042837
mov dword [ebp - 0x18], 0
jmp 0x10042864
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 1
jge 0x10042880
push dword [ebp - 0x18]
lea ecx, [ebp - 0x16c]
call fcn.1000b0e1
mov dword [eax], 0x36a77d77
jmp 0x1004285d
lea eax, [ebp - 0x18]
push eax
push 1
push 0x12e8
lea eax, [ebp - 0x238]
push eax
push 0x3985
push 1
push 0x159b
call fcn.100419b1
add esp, 0x1c
mov dword [ebp - 0x18c], 0xb
mov eax, 0x3202f603
test eax, eax
je 0x100428d7
push 0
lea ecx, [ebp - 0x16c]
call fcn.1000b0e1
cmp dword [eax], 0
je 0x100428d7
mov dword [ebp - 0x200], 1
jmp 0x100428de
and dword [ebp - 0x200], 0
push 3
lea ecx, [ebp - 0x150]
call fcn.1000b0e1
mov esi, dword [ebp - 0xd8]
push 0
lea ecx, [ebp - 0x16c]
call fcn.1000b0e1
imul esi, dword [eax]
mov dword [ebp - 0xd8], esi
cmp dword [ebp - 0xd8], 0xffff
jb 0x1004291f
mov dword [ebp - 0x110], 1
jmp 0x10042926
and dword [ebp - 0x110], 0
cmp dword [ebp - 0x110], 0
jae 0x1004293b
mov dword [ebp - 0x130], 1
jmp 0x10042942
and dword [ebp - 0x130], 0
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x130]
inc ecx
inc ecx
cmp ecx, dword [ebp + eax - 0xa8]
jge 0x10042965
mov dword [ebp - 0xf4], 1
jmp 0x1004296c
and dword [ebp - 0xf4], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0xa8]
add ecx, dword [ebp - 0xf4]
imul ecx, ecx, 0xe3c1
cmp ecx, dword [ebp + eax - 0xa8]
jge 0x100429a0
mov dword [ebp - 0xd4], 1
jmp 0x100429a7
and dword [ebp - 0xd4], 0
push 0
lea ecx, [ebp - 0x16c]
call fcn.1000b0e1
mov ecx, dword [ebp - 0xd4]
mov dword [eax], ecx
cmp dword [ebp - 0xd4], 0x5894
jl 0x100429d4
mov dword [ebp - 0x120], 1
jmp 0x100429db
and dword [ebp - 0x120], 0
cmp dword [ebp - 0x120], 0xd78b
jl 0x100429f3
mov dword [ebp - 0xfc], 1
jmp 0x100429fa
and dword [ebp - 0xfc], 0
mov esi, dword [ebp - 0xfc]
sub esi, dword [ebp - 0x140]
push 3
lea ecx, [ebp - 0x150]
call fcn.1000b0e1
sub esi, dword [eax]
push 1
lea ecx, [ebp - 0x150]
call fcn.1000b0e1
cmp esi, dword [eax]
jne 0x10042a32
mov dword [ebp - 0x104], 1
jmp 0x10042a39
and dword [ebp - 0x104], 0
mov eax, dword [ebp - 0x140]
cmp dword [ebp - 0x104], eax
jle 0x10042a53
mov dword [ebp - 0x194], 1
jmp 0x10042a5a
and dword [ebp - 0x194], 0
push 0
lea ecx, [ebp - 0x238]
call fcn.1000b0e1
mov dword [ebp - 0x128], eax
mov eax, dword [ebp - 0x128]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x128]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x238]
call fcn.1000b0e1
cmp dword [eax], 0xcc99cf48
jb 0x10042a9f
mov dword [ebp - 0xe8], 1
jmp 0x10042aa6
and dword [ebp - 0xe8], 0
push 4
pop eax
imul eax, eax, 0
mov esi, dword [ebp - 0xe8]
sub esi, dword [ebp + eax - 0xa8]
push 3
lea ecx, [ebp - 0x150]
call fcn.1000b0e1
mov eax, dword [eax]
sub eax, esi
jne 0x10042ae7
push 0
lea ecx, [ebp - 0x150]
call fcn.1000b0e1
cmp dword [eax], 0
jne 0x10042ae7
and dword [ebp - 0xc8], 0
jmp 0x10042af1
mov dword [ebp - 0xc8], 1
push 2
lea ecx, [ebp - 0x2f0]
call fcn.1000b0e1
mov ecx, dword [ebp - 0xc8]
mov dword [eax], ecx
cmp dword [ebp - 0xc8], 0
je 0x10042b24
mov eax, 0xb05d0942
test eax, eax
je 0x10042b24
mov dword [ebp - 0x10c], 1
jmp 0x10042b2b
and dword [ebp - 0x10c], 0
mov eax, dword [ebp - 0x10c]
mov dword [ebp - 0x138], eax
cmp dword [ebp - 0x138], 0
jge 0x10042b4c
mov dword [ebp - 0x118], 1
jmp 0x10042b53
and dword [ebp - 0x118], 0
cmp dword [ebp - 0x118], 0x4752e4a6
jne 0x10042b6b
mov dword [ebp - 0xec], 1
jmp 0x10042b72
and dword [ebp - 0xec], 0
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0x1dc], eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x2f0]
call fcn.1000b0c5
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x238]
call fcn.1000b0c5
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x16c]
call fcn.1000b0c5
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x150]
call fcn.1000b0c5
lea eax, [ebp - 0x390]
push eax
call fcn.1003b0af
pop ecx
mov esi, eax
lea edi, [ebp - 0x330]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x330]
lea edi, [ebp - 0x360]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x2d0], 0xffffffff
mov dword [ebp - 0x19c], 0x24d2
cmp dword [ebp - 0x19c], 0x788
jge 0x100431a5
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push eax
push 0x10008410
call fcn.100505bb
pop ecx
pop ecx
and dword [ebp - 0x228], 0
lea eax, [ebp - 0x228]
push eax
push dword [ebp - 0x14]
lea ecx, [ebp - 0x24]
call fcn.100447df
mov byte [ebp - 4], 0xe
and dword [ebp - 0x90], 0
jmp 0x10042c4c
mov eax, dword [ebp - 0x90]
inc eax
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
cmp eax, dword [ebp - 0x14]
jge 0x10042c74
push dword [ebp - 0x90]
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
push eax
push 0x10008410
call fcn.100505bb
pop ecx
pop ecx
jmp 0x10042c3f
lea eax, [ebp - 0x304]
push eax
lea ecx, [ebp - 0x24]
call fcn.10044801
push dword [eax]
lea eax, [ebp - 0x2cc]
push eax
lea ecx, [ebp - 0x24]
call fcn.10037d71
push dword [eax]
call fcn.10044b82
pop ecx
pop ecx
cmp dword [ebp - 0x14], 1
jne 0x10042cb3
push 0x10008eb0
call fcn.100511a9
pop ecx
jmp 0x10043199
mov eax, dword [ebp - 0x14]
dec eax
push eax
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov esi, eax
push 0
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x10042cef
push 0
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
push dword [eax]
push 0x10008eb4
call fcn.100507d6
pop ecx
pop ecx
jmp 0x10043199
cmp dword [ebp - 0x14], 2
jne 0x10042ddc
push 0
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov esi, eax
push 1
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
sub eax, dword [esi]
mov dword [ebp - 0xf0], eax
mov eax, dword [ebp - 0xf0]
and eax, 0x80000001
jns 0x10042d2b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x10042d3c
push 0x10008ebc
call fcn.100511a9
pop ecx
jmp 0x10042d47
push 0x10008ec0
call fcn.100511a9
pop ecx
push 0
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov esi, dword [eax]
shl esi, 1
push 1
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
sub esi, dword [eax]
push esi
push 0x10008ec4
call fcn.100507d6
pop ecx
pop ecx
mov eax, dword [ebp - 0xf0]
and eax, 0x80000001
jns 0x10042d80
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x10042db0
push 0
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov esi, eax
push 1
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
add eax, dword [esi]
cdq
sub eax, edx
sar eax, 1
push eax
push 0x10008ec4
call fcn.100507d6
pop ecx
pop ecx
push 1
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov esi, dword [eax]
shl esi, 1
push 0
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
sub esi, dword [eax]
push esi
push 0x10008ec4
call fcn.100507d6
pop ecx
pop ecx
jmp 0x10043199
cmp dword [ebp - 0x14], 3
jne 0x10042eb7
push 0
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov esi, eax
push 1
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
sub eax, dword [esi]
mov dword [ebp - 0x44], eax
push 1
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov esi, eax
push 2
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
sub eax, dword [esi]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x60]
jne 0x10042e57
push 2
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
add eax, dword [ebp - 0x44]
push eax
push 0
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
sub eax, dword [ebp - 0x44]
push eax
push 0x10008ecc
call fcn.100507d6
add esp, 0xc
jmp 0x10042eb2
mov eax, dword [ebp - 0x60]
shl eax, 1
cmp dword [ebp - 0x44], eax
jne 0x10042e7f
push 0
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
add eax, dword [ebp - 0x60]
push eax
push 0x10008eb4
call fcn.100507d6
pop ecx
pop ecx
jmp 0x10042eb2
mov eax, dword [ebp - 0x44]
shl eax, 1
cmp dword [ebp - 0x60], eax
jne 0x10042ea7
push 1
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
add eax, dword [ebp - 0x44]
push eax
push 0x10008eb4
call fcn.100507d6
pop ecx
pop ecx
jmp 0x10042eb2
push 0x10008ed8
call fcn.100511a9
pop ecx
jmp 0x10043199
cmp dword [ebp - 0x14], 3
jle 0x10043199
and dword [ebp - 0x1a4], 0
lea eax, [ebp - 0x1a4]
push eax
mov eax, dword [ebp - 0x14]
dec eax
push eax
lea ecx, [ebp - 0x34]
call fcn.100447df
mov byte [ebp - 4], 0xf
and dword [ebp - 0x48], 0
jmp 0x10042eed
mov eax, dword [ebp - 0x48]
inc eax
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
dec eax
cmp dword [ebp - 0x48], eax
jge 0x10042f23
push dword [ebp - 0x48]
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov esi, eax
mov eax, dword [ebp - 0x48]
inc eax
push eax
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov edi, dword [eax]
sub edi, dword [esi]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov dword [eax], edi
jmp 0x10042ee6
lea eax, [ebp - 0x2f4]
push eax
lea ecx, [ebp - 0x34]
call fcn.10044801
push dword [eax]
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x34]
call fcn.10037d71
push dword [eax]
call fcn.10044b82
pop ecx
pop ecx
mov eax, dword [ebp - 0x14]
dec eax
dec eax
push eax
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
push 0
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x10042fb7
push 0
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
mov eax, dword [ebp - 0x14]
dec eax
push eax
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
add eax, dword [esi]
push eax
push 0
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
push 0
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
sub eax, dword [esi]
push eax
push 0x10008ecc
call fcn.100507d6
add esp, 0xc
jmp 0x1004318d
push 1
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
push 0
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x1004309a
mov eax, dword [ebp - 0x14]
sub eax, 3
push eax
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
push 0
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x1004309a
push 0
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, dword [eax]
shl esi, 1
mov eax, dword [ebp - 0x14]
dec eax
dec eax
push eax
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
cmp dword [eax], esi
jne 0x1004309a
push 0x10008edc
call fcn.100511a9
pop ecx
and dword [ebp - 0x3c], 0
jmp 0x10043034
mov eax, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
dec eax
cmp dword [ebp - 0x3c], eax
jge 0x10043095
push 0
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov edi, dword [eax]
add edi, dword [esi]
mov eax, dword [ebp - 0x3c]
inc eax
push eax
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
cmp dword [eax], edi
jle 0x10043093
push 0
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
add eax, dword [esi]
push eax
push 0x10007884
call fcn.100507d6
pop ecx
pop ecx
jmp 0x10043095
jmp 0x1004302d
jmp 0x1004318d
mov eax, dword [ebp - 0x14]
sub eax, 3
push eax
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
mov eax, dword [ebp - 0x14]
dec eax
dec eax
push eax
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x10043182
mov eax, dword [ebp - 0x14]
dec eax
dec eax
push eax
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
push 1
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov eax, dword [eax]
cmp eax, dword [esi]
jne 0x10043182
mov eax, dword [ebp - 0x14]
dec eax
dec eax
push eax
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, dword [eax]
shl esi, 1
push 0
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
cmp dword [eax], esi
jne 0x10043182
push 0x10008edc
call fcn.100511a9
pop ecx
and dword [ebp - 0x40], 0
jmp 0x1004311f
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
dec eax
cmp dword [ebp - 0x40], eax
jge 0x10043180
push 1
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov edi, dword [eax]
add edi, dword [esi]
mov eax, dword [ebp - 0x40]
inc eax
push eax
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
cmp dword [eax], edi
jle 0x1004317e
push 1
lea ecx, [ebp - 0x34]
call fcn.1000b0e1
mov esi, eax
push dword [ebp - 0x40]
lea ecx, [ebp - 0x24]
call fcn.1000b0e1
mov eax, dword [eax]
add eax, dword [esi]
push eax
push 0x10007884
call fcn.100507d6
pop ecx
pop ecx
jmp 0x10043180
jmp 0x10043118
jmp 0x1004318d
push 0x10008ed8
call fcn.100511a9
pop ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x34]
call fcn.1000b0c5
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x24]
call fcn.1000b0c5
mov dword [ebp - 0x1ac], 0x2cb13638
mov dword [ebp - 0x2f8], 0x3c69aed2
mov dword [ebp - 0xcc], 0xffffffff
mov dword [ebp - 0xe0], 0x516a205b
mov dword [ebp - 0xd0], 9
mov dword [ebp - 0x1e4], 0xfffffff8
mov dword [ebp - 0x64], 0
jmp 0x100431f1
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 2
jge 0x10043207
mov eax, dword [ebp - 0x64]
mov dword [ebp + eax*4 - 0x300], 0x3126ff23
jmp 0x100431ea
push 0x4261
push 1
push 0x7048
lea eax, [ebp - 0xd0]
push eax
push 1
call fcn.1003f5ec
add esp, 0x14
mov eax, dword [ebp - 0x1e4]
neg eax
jne 0x100432b3
cmp dword [ebp - 0xcc], 0x4df8e3bf
jge 0x10043250
cmp dword [ebp - 0xd0], 0
jne 0x10043250
and dword [ebp - 0xf8], 0
jmp 0x1004325a
mov dword [ebp - 0xf8], 1
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0xf8], eax
je 0x10043274
mov dword [ebp - 0x100], 1
jmp 0x1004327b
and dword [ebp - 0x100], 0
mov eax, dword [ebp - 0xe0]
cmp dword [ebp - 0x100], eax
jle 0x10043295
mov dword [ebp - 0x108], 1
jmp 0x1004329c
and dword [ebp - 0x108], 0
mov eax, dword [ebp - 0xe0]
add eax, dword [ebp - 0x108]
jne 0x100432b3
and dword [ebp - 0x114], 0
jmp 0x100432bd
mov dword [ebp - 0x114], 1
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0xcc], eax
mov eax, dword [ebp - 0xcc]
mov dword [ebp - 0x11c], eax
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x11c]
mov dword [ebp + eax - 0x300], ecx
mov eax, dword [ebp - 0xd0]
add eax, dword [ebp - 0x11c]
mov dword [ebp - 0x1ac], eax
mov eax, dword [ebp - 0x54]
mov ecx, dword [eax]
call fcn.1003c488
mov dword [ebp - 0x1ec], eax
mov dword [ebp - 0x74], 0xffffffff
mov dword [ebp - 0x1b4], 0x4dfbd6c3
mov dword [ebp - 0x6c], 0
jmp 0x1004332b
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 4
jge 0x10043341
mov eax, dword [ebp - 0x6c]
mov dword [ebp + eax*4 - 0x314], 0xf7a73d2d
jmp 0x10043324
mov dword [ebp - 0x74], 0xfffffffb
jmp 0x10043351
mov eax, dword [ebp - 0x74]
inc eax
mov dword [ebp - 0x74], eax
cmp dword [ebp - 0x74], 9
jl 0x100433b3
mov dword [ebp - 0x20c], 0x25260
cmp dword [ebp - 0x20c], 0
jne 0x10043389
push 4
pop eax
imul eax, eax, 0
mov dword [ebp + eax - 0x314], 0xffffffff
or eax, 0xffffffff
jne 0x10043389
and dword [ebp - 0x124], 0
jmp 0x10043393
mov dword [ebp - 0x124], 1
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x1b4], eax
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x314], 0
je 0x100433b1
jmp 0x100433b3
jmp 0x1004334a
push 1
lea eax, [ebp - 0x1ec]
push eax
push 0x5328
lea eax, [ebp - 0x360]
push eax
lea eax, [ebp - 0x2c4]
push eax
lea eax, [ebp - 0x8c]
push eax
push 1
call fcn.10041ac6
add esp, 0x1c
mov dword [ebp - 0x84], 0xffffffff
mov dword [ebp - 0x7c], 0
jmp 0x100433fa
mov eax, dword [ebp - 0x7c]
inc eax
mov dword [ebp - 0x7c], eax
cmp dword [ebp - 0x7c], 4
jge 0x10043410
mov eax, dword [ebp - 0x7c]
mov dword [ebp + eax*4 - 0x324], 0xfffffffb
jmp 0x100433f3
mov dword [ebp - 0x84], 0
jmp 0x10043429
mov eax, dword [ebp - 0x84]
inc eax
mov dword [ebp - 0x84], eax
cmp dword [ebp - 0x84], 3
jg 0x10043496
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x28], 0
jmp 0x10043449
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jg 0x1004346e
push 1
push 1
push 1
call fcn.10041b9f
add esp, 0xc
mov eax, dword [ebp - 0x28]
cmp dword [ebp + eax*4 - 0x324], 0
je 0x1004346c
jmp 0x1004346e
jmp 0x10043442
mov dword [ebp - 0x28], 0
jmp 0x1004347e
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jge 0x10043494
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x324], 0xffffffff
jmp 0x10043477
jmp 0x1004341c
push 1
push 0
push 1
push 0xc98
call fcn.100405d5
add esp, 0x10
cmp dword [ebp - 0x8c], 6
jae 0x1004362d
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x24c], 6
mov dword [ebp - 0x248], 6
mov dword [ebp - 0x244], 6
mov dword [ebp - 0x240], 6
lea ecx, [ebp - 0xda]
call fcn.1000b3fc
push eax
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x368]
call fcn.100240a5
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x354]
call fcn.1002407f
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x4c], 0
jmp 0x1004352e
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe2
jle 0x100435fc
mov dword [ebp - 0x94], 1
mov dword [ebp - 0x1bc], 0xf3d4e677
mov dword [ebp - 0x94], 0xfffffff7
jmp 0x10043565
mov eax, dword [ebp - 0x94]
inc eax
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0xfffffffe
jge 0x100435ec
mov dword [ebp - 0x9c], 1
mov dword [ebp - 0x9c], 0
jmp 0x10043591
mov eax, dword [ebp - 0x9c]
inc eax
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 3
jg 0x100435ca
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x100435c8
push 0x5ce5
push 0x4535
push 1
push 1
push 0x5fe
push 0x756d
push 1
call fcn.10041cf9
add esp, 0x1c
jmp 0x10043584
push 1
push 0x613f
push 1
lea eax, [ebp - 0x1bc]
push eax
push 0x5ad5
call fcn.1003ffeb
add esp, 0x14
jmp 0x10043558
cmp dword [ebp - 0x4c], 0
je 0x100435f7
jmp 0x10043527
jmp 0x10043527
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x354]
call fcn.1000b0c5
lea eax, [ebp - 0x2c4]
push eax
push 0x107fb7d0
push dword [ebp - 0x54]
push 1
push 0x65c8
push 1
push 1
call fcn.10041dfd
add esp, 0x1c
mov dword [ebp - 0x158], 0xd7953644
mov dword [ebp - 0x170], 0x66c619a8
mov dword [ebp - 0x2e4], 0xa4df6f97
mov dword [ebp - 0x220], 0xcc92ea21
mov dword [ebp - 0x1c4], 0xc32b96ce
push 3
lea ecx, [ebp - 0x298]
call fcn.1000b069
mov byte [ebp - 4], 0x11
mov dword [ebp - 0x178], 0x9737e0d1
mov dword [ebp - 0x15c], 1
mov dword [ebp - 0x5c], 0
jmp 0x10043694
mov eax, dword [ebp - 0x5c]
inc eax
mov dword [ebp - 0x5c], eax
cmp dword [ebp - 0x5c], 3
jge 0x100436b0
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x298]
call fcn.1000b0e1
mov dword [eax], 6
jmp 0x1004368d
push 1
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x298]
push eax
push 1
push 0x924
lea eax, [ebp - 0x1c4]
push eax
push 0x53d
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x178]
push eax
push 0
lea eax, [ebp - 0x158]
push eax
call fcn.100407e1
add esp, 0x30
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x298]
call fcn.1000b0c5
lea eax, [ebp - 0x2c4]
push eax
mov ecx, dword [ebp - 0x12c]
call fcn.100443c4
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c4]
call fcn.10037bdc
jmp 0x10043a00
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x198], eax
mov eax, dword [ebp - 0x190]
mov dword [ebp - 0x1a0], eax
mov dword [ebp - 0xa4], 0
jmp 0x10043773
mov eax, dword [ebp - 0xa4]
inc eax
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 3
jge 0x1004378f
mov eax, dword [ebp - 0xa4]
mov dword [ebp + eax*4 - 0x384], 1
jmp 0x10043766
push 1
push 1
push 0
push 0x19a5
call fcn.100405d5
add esp, 0x10
push 1
push 0x7aec
push 0
push 0x2e4
push 0x425b
call fcn.1003ffeb
add esp, 0x14
lea eax, [ebp - 0x3b4]
push eax
call fcn.1003b0af
pop ecx
mov esi, eax
lea edi, [ebp - 0x348]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x198]
mov ecx, dword [eax]
call fcn.1003c443
shl eax, 1
mov ecx, dword [ebp - 0x1a0]
mov edx, dword [ebp - 0x340]
mov eax, dword [edx + eax*4 + 4]
mov dword [ecx], eax
jmp 0x10043a00
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1d0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1b8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0x134], 0x3ed6
mov dword [ebp - 0x1e8], 0x10008ee0
cmp dword [ebp - 0x134], 0x412d
jle 0x1004394d
and dword [ebp - 0xbc], 0
jmp 0x10043855
mov eax, dword [ebp - 0xbc]
inc eax
mov dword [ebp - 0xbc], eax
cmp dword [ebp - 0xbc], 0x71b1
jge 0x1004394d
and dword [ebp - 0xc4], 0
jmp 0x1004387b
mov eax, dword [ebp - 0xc4]
inc eax
mov dword [ebp - 0xc4], eax
cmp dword [ebp - 0xc4], 0x106c
jge 0x10043948
and dword [ebp - 0xac], 0
jmp 0x100438a1
mov eax, dword [ebp - 0xac]
inc eax
mov dword [ebp - 0xac], eax
cmp dword [ebp - 0xac], 0xd85
jge 0x10043943
and dword [ebp - 0xb4], 0
jmp 0x100438c7
mov eax, dword [ebp - 0xb4]
inc eax
mov dword [ebp - 0xb4], eax
cmp dword [ebp - 0xb4], 0x4c8a
jge 0x1004393e
mov ecx, dword [ebp - 0xac]
and ecx, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xbc]
cdq
idiv dword [ebp - 0xc4]
xor edx, ecx
mov eax, edx
cdq
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x210], edx
push dword [ebp - 0x210]
push dword [ebp - 0x214]
lea ecx, [ebp - 0x3cc]
call fcn.1000cf11
pop ecx
pop ecx
mov dword [ebp - 0x1a8], eax
mov ecx, dword [ebp - 0x1a8]
call fcn.1000af34
push eax
call fcn.100507d6
pop ecx
lea ecx, [ebp - 0x3cc]
call fcn.1000af2a
jmp 0x100438ba
jmp 0x10043894
jmp 0x1004386e
jmp 0x10043848
mov eax, dword [ebp - 0x1b0]
movzx eax, byte [eax]
test eax, eax
je 0x1004398e
mov eax, dword [ebp - 0x1b8]
mov dword [ebp - 0x1c0], eax
mov eax, dword [ebp - 0x1c0]
mov dword [ebp - 0x1c8], eax
mov eax, dword [ebp - 0x1c8]
movzx eax, byte [eax]
test eax, eax
je 0x1004398c
push 0x1663
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x100439bb
mov eax, dword [ebp - 0x1d0]
mov dword [ebp - 0x1d8], eax
mov eax, dword [ebp - 0x1d8]
mov dword [ebp - 0x1e0], eax
mov eax, dword [ebp - 0x1e0]
movzx eax, byte [eax]
test eax, eax
je 0x100439bb
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov dword [ebp - 4], 0x12
cmp dword [ebp - 0x134], 0x3b22
jge 0x100439da
push dword [ebp - 0x1e8]
call fcn.100507d6
pop ecx
jmp 0x100439f6
or dword [ebp - 4], 0xffffffff
jmp 0x10043a00
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret