Function at 0x1003ef8b
Capabilities:
Contain obfuscated stackstrings
Create directory
Query environment variable
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006a7c4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x310
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x60], 0
jmp 0x1003efca
mov eax, dword [ebp - 0x60]
inc eax
mov dword [ebp - 0x60], eax
cmp dword [ebp - 0x60], 2
jge 0x1003efe0
mov eax, dword [ebp - 0x60]
mov dword [ebp + eax*4 - 0x94], 0xe00fe1ca
jmp 0x1003efc3
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov ecx, dword [ebp + ecx - 0x94]
cmp ecx, dword [ebp + eax - 0x94]
jg 0x1003f008
mov dword [ebp - 0xe4], 1
jmp 0x1003f00f
and dword [ebp - 0xe4], 0
cmp dword [ebp - 0xe4], 1
jg 0x1003f024
mov dword [ebp - 0x180], 1
jmp 0x1003f02b
and dword [ebp - 0x180], 0
cmp dword [ebp - 0x180], 1
jne 0x1003f040
mov dword [ebp - 0x120], 1
jmp 0x1003f047
and dword [ebp - 0x120], 0
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94], 0
jne 0x1003f063
mov dword [ebp - 0x184], 1
jmp 0x1003f06a
and dword [ebp - 0x184], 0
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x94]
cmp dword [ebp - 0x184], eax
je 0x1003f08b
mov dword [ebp - 0x18c], 1
jmp 0x1003f092
and dword [ebp - 0x18c], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x94]
cmp dword [ebp - 0x18c], eax
jge 0x1003f0b3
mov dword [ebp - 0xa8], 1
jmp 0x1003f0ba
and dword [ebp - 0xa8], 0
mov eax, dword [ebp - 0xa8]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
cmp dword [ebp - 0x120], eax
jle 0x1003f0ef
mov byte [ebp - 0x31], 0
movzx eax, byte [ebp - 0x31]
test eax, eax
je 0x1003f0ea
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x1003f19d
push 2
lea ecx, [ebp - 0x270]
call fcn.1000c137
and dword [ebp - 4], 0
mov dword [ebp - 0x58], 0
jmp 0x1003f110
mov eax, dword [ebp - 0x58]
inc eax
mov dword [ebp - 0x58], eax
cmp dword [ebp - 0x58], 2
jge 0x1003f12c
push dword [ebp - 0x58]
lea ecx, [ebp - 0x270]
call fcn.1000c1d5
mov dword [eax], 0xfdbd
jmp 0x1003f109
push 1
lea ecx, [ebp - 0x270]
call fcn.1000c1d5
cmp dword [eax], 0
je 0x1003f15a
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x94], 0
je 0x1003f15a
mov dword [ebp - 0xb0], 1
jmp 0x1003f161
and dword [ebp - 0xb0], 0
cmp dword [ebp - 0xb0], 1
jl 0x1003f176
mov dword [ebp - 0x15c], 1
jmp 0x1003f17d
and dword [ebp - 0x15c], 0
mov eax, 0xb060
sub eax, dword [ebp - 0x15c]
mov dword [ebp - 0x88], eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x270]
call fcn.1000c1b9
mov byte [ebp - 0x35], 0
movzx eax, byte [ebp - 0x35]
test eax, eax
je 0x1003f1b4
push 0xcfa
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov dword [ebp - 0x188], 0xfa860b4f
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x5c], 1
mov dword [ebp - 0x80], 1
mov dword [ebp - 0x1a8], 0xffffffff
mov dword [ebp - 0x2e4], 0x43c4ab2
mov dword [ebp - 0x2dc], 7
mov dword [ebp - 0x30], 0xd085c9e5
mov dword [ebp - 0x178], 0xc4f27d27
mov dword [ebp - 0x2b4], 0x50315362
mov dword [ebp - 0x2ec], 0
mov dword [ebp - 0x264], 0x20452a26
mov dword [ebp - 0x260], 0x20452a26
mov dword [ebp - 0x25c], 0x20452a26
mov dword [ebp - 0x258], 0x20452a26
lea ecx, [ebp - 0x75]
call fcn.1000c1e4
push eax
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x264]
push eax
lea ecx, [ebp - 0x318]
call fcn.1000c1e7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1e4]
call fcn.1000c193
mov dword [ebp - 4], 1
mov dword [ebp - 0x290], 0xfffffffc
mov dword [ebp - 0x298], 0xd66c4a87
mov dword [ebp - 0xb8], 0xffffffff
mov dword [ebp - 0x7c], 4
mov dword [ebp - 0x1d4], 0xffffffff
mov dword [ebp - 0x1b0], 0
mov dword [ebp - 0x100], 0
mov eax, dword [ebp - 0xb8]
inc eax
mov dword [ebp - 0xb8], eax
mov eax, dword [ebp - 0x1a8]
cmp eax, dword [ebp - 0x80]
jne 0x1003f2de
mov dword [ebp - 0x128], 1
jmp 0x1003f2e5
and dword [ebp - 0x128], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0x128], eax
jg 0x1003f2fc
mov dword [ebp - 0xc0], 1
jmp 0x1003f303
and dword [ebp - 0xc0], 0
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0xc0], eax
jne 0x1003f31a
mov dword [ebp - 0x160], 1
jmp 0x1003f321
and dword [ebp - 0x160], 0
mov eax, dword [ebp - 0x160]
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x80], 0x4ea885c8
jle 0x1003f33f
mov dword [ebp - 0xc8], 1
jmp 0x1003f346
and dword [ebp - 0xc8], 0
mov eax, dword [ebp - 0x7c]
cmp dword [ebp - 0xc8], eax
je 0x1003f35d
mov dword [ebp - 0x1b8], 1
jmp 0x1003f364
and dword [ebp - 0x1b8], 0
push 0
lea ecx, [ebp - 0x1e4]
call fcn.1000c1d5
cmp dword [ebp - 0x30], 0x5879
jg 0x1003f386
mov dword [ebp - 0x130], 1
jmp 0x1003f38d
and dword [ebp - 0x130], 0
cmp dword [ebp - 0x130], 0x3426
jne 0x1003f3a5
mov dword [ebp - 0xd0], 1
jmp 0x1003f3ac
and dword [ebp - 0xd0], 0
mov eax, dword [ebp - 0xd0]
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0x70f3f850
jne 0x1003f3d0
mov dword [ebp - 0xd8], 1
jmp 0x1003f3d7
and dword [ebp - 0xd8], 0
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0xd8], eax
jne 0x1003f3ee
mov dword [ebp - 0x138], 1
jmp 0x1003f3f5
and dword [ebp - 0x138], 0
push 0
lea ecx, [ebp - 0x1e4]
call fcn.1000c1d5
mov ecx, dword [ebp - 0x138]
cmp ecx, dword [eax]
jle 0x1003f418
mov dword [ebp - 0x1cc], 1
jmp 0x1003f41f
and dword [ebp - 0x1cc], 0
mov eax, dword [ebp - 0x74]
mov dword [ebp - 0x2a0], eax
cmp dword [ebp - 0x74], 6
jge 0x1003f43a
mov dword [ebp - 0xe0], 1
jmp 0x1003f441
and dword [ebp - 0xe0], 0
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0x5c], eax
imul eax, dword [ebp - 0x5c], 0xffff
test eax, eax
je 0x1003f5db
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x1b4], 0xffffffff
mov dword [ebp - 0x218], 0x29219798
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x2a8], eax
mov eax, dword [ebp - 0x1d4]
cmp eax, dword [ebp - 0x188]
jl 0x1003f497
mov dword [ebp - 0x168], 1
jmp 0x1003f49e
and dword [ebp - 0x168], 0
mov dword [ebp - 0x5c], 0x28bf2fea
mov eax, dword [ebp - 0x5c]
cmp eax, dword [ebp - 0x168]
jg 0x1003f4bc
mov dword [ebp - 0xe8], 1
jmp 0x1003f4c3
and dword [ebp - 0xe8], 0
mov eax, dword [ebp - 0xe8]
inc eax
cmp eax, 0x5954a437
jle 0x1003f4dd
mov dword [ebp - 0x140], 1
jmp 0x1003f4e4
and dword [ebp - 0x140], 0
mov eax, dword [ebp - 0x3c]
cmp dword [ebp - 0x140], eax
je 0x1003f4fb
mov dword [ebp - 0xf0], 1
jmp 0x1003f502
and dword [ebp - 0xf0], 0
mov eax, dword [ebp - 0x7c]
cmp eax, dword [ebp - 0xf0]
je 0x1003f519
mov dword [ebp - 0xf8], 1
jmp 0x1003f520
and dword [ebp - 0xf8], 0
mov eax, dword [ebp - 0x188]
add eax, dword [ebp - 0xf8]
mov ecx, dword [ebp - 0x3c]
imul ecx, eax
mov eax, 0x149f
sub eax, ecx
add eax, dword [ebp - 0x1b0]
cmp eax, dword [ebp - 0x3c]
jne 0x1003f553
cmp dword [ebp - 0x3c], 0
jne 0x1003f553
and dword [ebp - 0x148], 0
jmp 0x1003f55d
mov dword [ebp - 0x148], 1
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0x100], eax
mov eax, dword [ebp - 0x100]
cmp eax, dword [ebp - 0x3c]
je 0x1003f589
cmp dword [ebp - 0x1b4], 0
je 0x1003f589
mov dword [ebp - 0x170], 1
jmp 0x1003f590
and dword [ebp - 0x170], 0
mov eax, dword [ebp - 0x170]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x30], 0
jmp 0x1003f5ac
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 3
jg 0x1003f5d6
push dword [ebp - 0x30]
lea ecx, [ebp - 0x1e4]
call fcn.1000c1d5
mov esi, eax
push dword [ebp - 0x30]
lea ecx, [ebp - 0x1e4]
call fcn.1000c1d5
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1003f5a5
jmp 0x1003f668
push 2
lea ecx, [ebp - 0x2cc]
call fcn.1000c137
mov byte [ebp - 4], 2
mov dword [ebp - 0x24], 0
jmp 0x1003f5fc
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 2
jge 0x1003f618
push dword [ebp - 0x24]
lea ecx, [ebp - 0x2cc]
call fcn.1000c1d5
mov dword [eax], 0xfffffff8
jmp 0x1003f5f5
mov dword [ebp - 0x24], 0
jmp 0x1003f628
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 1
jge 0x1003f63e
mov eax, dword [ebp - 0x24]
mov dword [ebp + eax*4 - 0x108], 0x9e20
jmp 0x1003f621
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x108]
dec eax
push 4
pop ecx
imul ecx, ecx, 0
mov dword [ebp + ecx - 0x108], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2cc]
call fcn.1000c1b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1e4]
call fcn.1000c1b9
mov dword [ebp - 0x250], 1
mov dword [ebp - 0x24c], 1
mov dword [ebp - 0x248], 1
mov dword [ebp - 0x244], 1
lea ecx, [ebp - 0x6d]
call fcn.1000c1e4
push eax
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x250]
push eax
lea ecx, [ebp - 0x310]
call fcn.1000c1e7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x1f4]
call fcn.1000c193
mov dword [ebp - 4], 3
mov dword [ebp - 0x20], 5
push 2
lea ecx, [ebp - 0x1a4]
call fcn.1000c137
mov byte [ebp - 4], 4
mov dword [ebp - 0xcc], 0x69209a48
mov dword [ebp - 0x84], 0x842b
mov dword [ebp - 0x200], 0xc90c63b8
push 1
lea ecx, [ebp - 0x288]
call fcn.1000c137
mov byte [ebp - 4], 5
mov dword [ebp - 0x1c8], 0x96a9cbd
mov dword [ebp - 0x21c], 0x681c37f5
mov dword [ebp - 0x1c], 0
jmp 0x1003f743
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 4
jge 0x1003f759
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x2fc], 0x96e6a373
jmp 0x1003f73c
mov dword [ebp - 0x1c], 0
jmp 0x1003f769
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 2
jge 0x1003f785
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x1a4]
call fcn.1000c1d5
mov dword [eax], 0xdfbc43c
jmp 0x1003f762
mov dword [ebp - 0x1c], 0
jmp 0x1003f795
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
jge 0x1003f7b1
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x288]
call fcn.1000c1d5
mov dword [eax], 2
jmp 0x1003f78e
mov dword [ebp - 0x20], 0
jmp 0x1003f7c1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 4
jge 0x1003f8c6
mov dword [ebp - 0x150], 0x3173
mov dword [ebp - 0x1bc], 0x10008a50
cmp dword [ebp - 0x150], 0x32e5
jle 0x1003f861
and dword [ebp - 0x6c], 0
jmp 0x1003f7f8
mov eax, dword [ebp - 0x6c]
inc eax
mov dword [ebp - 0x6c], eax
cmp dword [ebp - 0x6c], 0x531
jge 0x1003f861
and dword [ebp - 0x50], 0
jmp 0x1003f80e
mov eax, dword [ebp - 0x50]
inc eax
mov dword [ebp - 0x50], eax
cmp dword [ebp - 0x50], 0x6f7
jge 0x1003f85f
and dword [ebp - 0x64], 0
jmp 0x1003f824
mov eax, dword [ebp - 0x64]
inc eax
mov dword [ebp - 0x64], eax
cmp dword [ebp - 0x64], 0x8031
jge 0x1003f85d
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x64]
mov eax, dword [ebp - 0x6c]
shl eax, cl
cdq
mov dword [ebp - 0x1c4], eax
mov dword [ebp - 0x1c0], edx
push dword [ebp - 0x1c0]
push dword [ebp - 0x1c4]
mov ecx, 0x10612038
call fcn.1000c022
jmp 0x1003f81d
jmp 0x1003f807
jmp 0x1003f7f1
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1f4]
call fcn.1000c1d5
mov dword [eax], 0xb50b
mov byte [ebp - 4], 6
cmp dword [ebp - 0x150], 0x3026
jge 0x1003f895
mov edx, dword [ebp - 0x1bc]
mov ecx, 0x10612038
call fcn.1000e0f4
jmp 0x1003f8b1
mov dword [ebp - 4], 5
jmp 0x1003f8c1
jmp 0x1003f7ba
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x2fc], 0
jne 0x1003fa36
cmp dword [ebp - 0x20], 0
je 0x1003f9e2
push 1
lea ecx, [ebp - 0x1a4]
call fcn.1000c1d5
cmp dword [eax], 0
je 0x1003f902
mov dword [ebp - 0x110], 1
jmp 0x1003f909
and dword [ebp - 0x110], 0
mov esi, dword [ebp - 0x20]
push 1
lea ecx, [ebp - 0x1f4]
call fcn.1000c1d5
mov ecx, dword [ebp - 0x110]
add ecx, dword [eax]
cmp ecx, esi
jg 0x1003f937
push 1
lea ecx, [ebp - 0x1a4]
call fcn.1000c1d5
cmp dword [eax], 0
je 0x1003f955
push 1
lea ecx, [ebp - 0x1a4]
call fcn.1000c1d5
cmp dword [eax], 0
je 0x1003f955
mov dword [ebp - 0x158], 1
jmp 0x1003f95c
and dword [ebp - 0x158], 0
mov eax, dword [ebp - 0xcc]
imul eax, dword [ebp - 0x158]
cmp eax, 1
jae 0x1003f97a
mov dword [ebp - 0x118], 1
jmp 0x1003f981
and dword [ebp - 0x118], 0
push 4
pop eax
imul eax, eax, 3
mov ecx, dword [ebp - 0x118]
mov dword [ebp + eax - 0x2fc], ecx
push 1
lea ecx, [ebp - 0x1f4]
call fcn.1000c1d5
mov esi, dword [ebp - 0x84]
push 1
lea ecx, [ebp - 0x1a4]
call fcn.1000c1d5
cmp dword [eax], esi
jg 0x1003f9c4
mov dword [ebp - 0xa0], 1
jmp 0x1003f9cb
and dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xa0]
je 0x1003f9e2
mov dword [ebp - 0xa4], 1
jmp 0x1003f9e9
and dword [ebp - 0xa4], 0
push 1
lea ecx, [ebp - 0x1a4]
call fcn.1000c1d5
mov ecx, dword [ebp - 0xa4]
cmp ecx, dword [eax]
jge 0x1003fa0c
mov dword [ebp - 0xac], 1
jmp 0x1003fa13
and dword [ebp - 0xac], 0
push 2
lea ecx, [ebp - 0x1f4]
call fcn.1000c1d5
mov ecx, dword [ebp - 0xac]
cmp ecx, dword [eax]
je 0x1003fa36
mov dword [ebp - 0xb4], 1
jmp 0x1003fa3d
and dword [ebp - 0xb4], 0
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0x200], eax
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x84]
je 0x1003fa60
mov dword [ebp - 0xbc], 1
jmp 0x1003fa67
and dword [ebp - 0xbc], 0
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xbc], eax
je 0x1003fa7e
mov dword [ebp - 0xc4], 1
jmp 0x1003fa85
and dword [ebp - 0xc4], 0
push 0
lea ecx, [ebp - 0x288]
call fcn.1000c1d5
mov ecx, dword [ebp - 0xc4]
mov dword [eax], ecx
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0xcc]
cmp eax, dword [ebp - 0x84]
jl 0x1003fabe
mov dword [ebp - 0xd4], 1
jmp 0x1003fac5
and dword [ebp - 0xd4], 0
mov eax, dword [ebp - 0xd4]
mov dword [ebp - 0x1c8], eax
mov dword [ebp - 0x21c], 0xe181f51b
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x288]
call fcn.1000c1b9
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1a4]
call fcn.1000c1b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1f4]
call fcn.1000c1b9
movzx eax, byte [0x1061729d]
test eax, eax
je 0x1003fb26
mov esi, 0x10611a4c
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
jmp 0x100402de
push 1
lea ecx, [ebp - 0x198]
call fcn.1000c137
mov dword [ebp - 4], 8
mov dword [ebp - 0x28], 0
jmp 0x1003fb4a
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 3
jge 0x1003fb60
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x308], 0xfffffff6
jmp 0x1003fb43
mov dword [ebp - 0x28], 0
jmp 0x1003fb70
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
jge 0x1003fb8c
push dword [ebp - 0x28]
lea ecx, [ebp - 0x198]
call fcn.1000c1d5
mov dword [eax], 6
jmp 0x1003fb69
push 0
lea ecx, [ebp - 0x198]
call fcn.1000c1d5
and dword [eax], 0
jmp 0x1003fbc2
push 0
lea ecx, [ebp - 0x198]
call fcn.1000c1d5
mov dword [ebp - 0xdc], eax
mov eax, dword [ebp - 0xdc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xdc]
mov dword [ecx], eax
push 0
lea ecx, [ebp - 0x198]
call fcn.1000c1d5
cmp dword [eax], 2
jg 0x1003fbf1
push 0
lea ecx, [ebp - 0x198]
call fcn.1000c1d5
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x308], 0
je 0x1003fbef
jmp 0x1003fbf1
jmp 0x1003fb9e
push 0
lea ecx, [ebp - 0x198]
call fcn.1000c1d5
mov dword [eax], 0xfffffff7
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x198]
call fcn.1000c1b9
mov dword [ebp - 0x2b0], 0x10611a4c
mov dword [ebp - 0x2b8], 0x10611a50
mov byte [0x1061729d], 1
xor eax, eax
inc eax
imul eax, eax, 0x148
add eax, 0x106117a8
mov dword [ebp - 0x16c], eax
xor eax, eax
inc eax
imul eax, eax, 0x1c
add eax, 0x106117a8
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x18], 0x8a1f9496
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x23c], 0xfffffffd
mov dword [ebp - 0x238], 0xfffffffd
mov dword [ebp - 0x234], 0xfffffffd
mov dword [ebp - 0x230], 0xfffffffd
lea ecx, [ebp - 0x76]
call fcn.1000c1e4
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x23c]
push eax
lea ecx, [ebp - 0x320]
call fcn.1000c1e7
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x228]
call fcn.1000c193
mov dword [ebp - 4], 9
mov dword [ebp - 0x104], 3
cmp dword [ebp - 0x18], 0
je 0x1003fe22
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x18], 0
jne 0x1003fcee
mov dword [ebp - 0x98], 1
jmp 0x1003fcf5
and dword [ebp - 0x98], 0
push 2
lea ecx, [ebp - 0x228]
call fcn.1000c1d5
mov ecx, dword [ebp - 0x98]
mov dword [eax], ecx
push 2
lea ecx, [ebp - 0x228]
call fcn.1000c1d5
cmp dword [eax], 0
je 0x1003fd2b
mov eax, 0x6bc6
test eax, eax
je 0x1003fd2b
cmp dword [ebp - 0x18], 0
jne 0x1003fd3a
cmp dword [ebp - 0x18], 0
jne 0x1003fd3a
and dword [ebp - 0xec], 0
jmp 0x1003fd44
mov dword [ebp - 0xec], 1
imul eax, dword [ebp - 0xec], 0xfc65
cmp eax, dword [ebp - 0x18]
jg 0x1003fd6e
push 2
lea ecx, [ebp - 0x228]
call fcn.1000c1d5
cmp dword [eax], 0
jne 0x1003fd6e
and dword [ebp - 0xf4], 0
jmp 0x1003fd78
mov dword [ebp - 0xf4], 1
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0xf4], eax
jle 0x1003fd8f
mov dword [ebp - 0xfc], 1
jmp 0x1003fd96
and dword [ebp - 0xfc], 0
mov eax, dword [ebp - 0xfc]
mov dword [ebp - 0x104], eax
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x104]
jg 0x1003fdb9
mov dword [ebp - 0x1d0], 1
jmp 0x1003fdc0
and dword [ebp - 0x1d0], 0
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2bc], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2e0], eax
cmp dword [ebp - 0x40], 0
je 0x1003fe22
mov dword [ebp - 0x40], 0x17
jmp 0x1003fde8
mov eax, dword [ebp - 0x40]
dec eax
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0xffffffe9
jg 0x1003fe20
mov dword [ebp - 0x18], 0
jmp 0x1003fdfe
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 3
jg 0x1003fe1e
mov byte [ebp - 0x37], 0
movzx eax, byte [ebp - 0x37]
test eax, eax
je 0x1003fe1c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x1003fdf7
jmp 0x1003fde1
jmp 0x1003fe8f
push 2
lea ecx, [ebp - 0x27c]
call fcn.1000c137
mov byte [ebp - 4], 0xa
mov dword [ebp - 0x54], 0
jmp 0x1003fe43
mov eax, dword [ebp - 0x54]
inc eax
mov dword [ebp - 0x54], eax
cmp dword [ebp - 0x54], 2
jge 0x1003fe5c
push dword [ebp - 0x54]
lea ecx, [ebp - 0x27c]
call fcn.1000c1d5
and dword [eax], 0
jmp 0x1003fe3c
push 0
lea ecx, [ebp - 0x27c]
call fcn.1000c1d5
mov dword [ebp - 0x10c], eax
mov eax, dword [ebp - 0x10c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x10c]
mov dword [ecx], eax
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x27c]
call fcn.1000c1b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.1000c1b9
mov eax, dword [ebp - 0x16c]
mov dword [0x10611a4c], eax
mov dword [ebp - 0x14], 0x73bf
mov dword [ebp - 0x44], 0x16de6eab
mov dword [ebp - 0x154], 0x3ca30775
mov dword [ebp - 0x1fc], 0xfffffffd
cmp dword [ebp - 0x14], 0
jne 0x10040039
cmp dword [ebp - 0x14], 0
jne 0x10040039
cmp dword [ebp - 0x14], 1
jne 0x1003fef1
mov dword [ebp - 0x114], 1
jmp 0x1003fef8
and dword [ebp - 0x114], 0
mov eax, dword [ebp - 0x114]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
cmp eax, dword [ebp - 0x14]
jl 0x1003ff15
mov dword [ebp - 0x11c], 1
jmp 0x1003ff1c
and dword [ebp - 0x11c], 0
mov eax, dword [ebp - 0x11c]
add eax, 0x11b55e97
imul eax, eax, 0x74b6
cmp eax, dword [ebp - 0x14]
jl 0x1003ff41
cmp dword [ebp - 0x44], 0
jne 0x1003ff41
and dword [ebp - 0x124], 0
jmp 0x1003ff4b
mov dword [ebp - 0x124], 1
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x124]
imul eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x14]
jg 0x1003ff6d
mov dword [ebp - 0x12c], 1
jmp 0x1003ff74
and dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x12c]
jle 0x1003ff91
cmp dword [ebp - 0x14], 0
je 0x1003ff91
mov dword [ebp - 0x134], 1
jmp 0x1003ff98
and dword [ebp - 0x134], 0
cmp dword [ebp - 0x134], 0xfffffff8
je 0x1003ffad
mov dword [ebp - 0x1f8], 1
jmp 0x1003ffb4
and dword [ebp - 0x1f8], 0
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2e8], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28c], eax
cmp dword [ebp - 0x14], 1
jl 0x1003ffde
cmp dword [ebp - 0x44], 0
je 0x1003ffde
mov dword [ebp - 0x13c], 1
jmp 0x1003ffe5
and dword [ebp - 0x13c], 0
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x13c], eax
jl 0x10040002
cmp dword [ebp - 0x44], 0
je 0x10040002
mov dword [ebp - 0x144], 1
jmp 0x10040009
and dword [ebp - 0x144], 0
mov eax, dword [ebp - 0x154]
cmp dword [ebp - 0x144], eax
jg 0x10040023
mov dword [ebp - 0x14c], 1
jmp 0x1004002a
and dword [ebp - 0x14c], 0
mov eax, dword [ebp - 0x14c]
mov dword [ebp - 0x154], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c0], eax
cmp dword [ebp - 0x14], 0
je 0x1004005a
cmp dword [ebp - 0x14], 0
je 0x1004005a
mov dword [ebp - 0x1d8], 1
jmp 0x10040061
and dword [ebp - 0x1d8], 0
cmp dword [ebp - 0x14], 0
je 0x10040082
mov eax, 0x19ac4e69
test eax, eax
je 0x10040082
cmp dword [ebp - 0x14], 0
je 0x10040082
mov dword [ebp - 0x164], 1
jmp 0x10040089
and dword [ebp - 0x164], 0
mov eax, dword [ebp - 0x164]
mov dword [ebp - 0x1fc], eax
mov byte [ebp - 0x36], 0
movzx eax, byte [ebp - 0x36]
test eax, eax
je 0x100400b8
push 0
push 0x14bb
push 0x227
push 0x1517
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
mov eax, dword [ebp - 0x8c]
mov dword [0x10611a50], eax
mov dword [ebp - 0x4c], 0x9f9b3198
mov dword [ebp - 0x4c], 0xfffffff6
jmp 0x100400da
mov eax, dword [ebp - 0x4c]
dec eax
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0xffffffe5
jg 0x100400fc
mov byte [ebp - 0x34], 0
movzx eax, byte [ebp - 0x34]
test eax, eax
je 0x100400f2
call dword [sym.imp.USER32.dll_ReleaseCapture]
cmp dword [ebp - 0x4c], 0
je 0x100400fa
jmp 0x100400d3
jmp 0x100400d3
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
imul ecx, ecx, 0
mov edx, dword [ebp - 0x8c]
mov edx, dword [edx + eax]
mov eax, dword [ebp - 0x16c]
mov ecx, dword [eax + ecx]
call fcn.1003ef4a
mov dword [ebp - 0x204], eax
mov dword [ebp - 0x68], 0xffffffff
mov byte [ebp - 0x32], 0
movzx eax, byte [ebp - 0x32]
test eax, eax
je 0x10040142
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 0x68], 6
jmp 0x10040152
mov eax, dword [ebp - 0x68]
dec eax
mov dword [ebp - 0x68], eax
cmp dword [ebp - 0x68], 0xfffffff2
je 0x1004016f
mov dword [ebp - 0x1e8], 2
cmp dword [ebp - 0x1e8], 0
je 0x1004016d
jmp 0x1004016f
jmp 0x1004014b
push dword [ebp - 0x8c]
mov edx, 0x106119d4
mov ecx, dword [ebp - 0x204]
call fcn.1003ef56
pop ecx
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x174], 0x63785551
mov dword [ebp - 0x214], 0xfffffffd
mov dword [ebp - 0x210], 0xfffffffd
mov dword [ebp - 0x20c], 0xfffffffd
mov dword [ebp - 0x208], 0xfffffffd
mov dword [ebp - 0x48], 4
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x294], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2d0], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x29c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2d4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2a4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2d8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2ac], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x174], eax
cmp dword [ebp - 0x174], 0
jne 0x10040230
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x214], 0
jne 0x10040230
and dword [ebp - 0x17c], 0
jmp 0x1004023a
mov dword [ebp - 0x17c], 1
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x17c]
jne 0x10040261
push 4
pop eax
shl eax, 0
cmp dword [ebp + eax - 0x214], 0
je 0x10040261
mov dword [ebp - 0x1ac], 1
jmp 0x10040268
and dword [ebp - 0x1ac], 0
push 4
pop eax
imul eax, eax, 0
push 4
pop ecx
shl ecx, 1
mov ecx, dword [ebp + ecx - 0x214]
cmp ecx, dword [ebp + eax - 0x214]
jge 0x1004028f
mov dword [ebp - 0x9c], 1
jmp 0x10040296
and dword [ebp - 0x9c], 0
mov eax, dword [ebp - 0x9c]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x48], 3
jmp 0x100402af
mov eax, dword [ebp - 0x48]
dec eax
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
jl 0x100402d0
mov byte [ebp - 0x33], 0
movzx eax, byte [ebp - 0x33]
test eax, eax
je 0x100402ce
push 0
push 0x10dd
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x100402a8
mov esi, 0x10611a4c
mov edi, dword [ebp + 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret