Function at 0x1001bed4
Capabilities:
Check os version
Get common file path
Get disk information
Modify service

Disassembly:
mov eax, 0x10087172
call fcn.10086838
sub esp, 0x144
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x34], ecx
je 0x1001ca5d
mov dword [ebp - 0x10], 0x8a062b00
mov dword [ebp + 0x10], 0xfdb69689
mov dword [ebp - 0x14], 0xee56e31b
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
neg eax
push 1
pop edi
push 0
pop ebx
jne 0x1001bf3b
mov ecx, ebx
cmp dword [ebp + 0x10], ebx
je 0x1001bf3d
mov ecx, edi
mov eax, dword [ebp - 0x10]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x10]
push 2
setg dl
xor ecx, ecx
cmp edx, eax
pop esi
setle cl
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x14], ebx
jmp 0x1001bfec
mov dword [ebp + 0x10], 0xffffffff
mov dword [ebp + 0x10], ebx
jmp 0x1001bf7c
mov eax, dword [ebp + 0x10]
mov dword [ebp + eax*4 - 0x100], 0x2549
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], esi
jl 0x1001bf6b
mov dword [ebp - 0x10], 0xffffffe4
jmp 0x1001bfc1
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001bfb5
push ebx
push ebx
push ebx
push 0x1ab
push 0x14b7
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
mov eax, dword [ebp - 0x100]
mov dword [ebp + 0x10], eax
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x1001bf8a
mov dword [ebp - 0x10], ebx
jmp 0x1001bfe4
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001bfe1
push ebx
push 0x5e2
push ebx
call dword [sym.imp.GDI32.dll_GetBitmapBits]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x1001bfcb
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffe2
jg 0x1001bf5f
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0xbc]
mov dword [ebp - 0x14], 0x9e71b35d
push esi
call fcn.1001855e
mov dword [ebp - 4], ebx
mov dword [ebp + 0x10], ebx
jmp 0x1001c027
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xbc]
mov dword [eax + ecx*4], 0x8d81
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], esi
jl 0x1001c014
cmp dword [ebp - 0x10], ebx
je 0x1001c05c
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov edx, edi
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setl cl
cmp ecx, dword [ebp - 0x10]
mov ecx, edi
jne 0x1001c05e
mov ecx, ebx
xor eax, eax
cmp ecx, 0x1ef9
setge al
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
jmp 0x1001c1d9
mov dword [ebp - 0x1c], 0xaa5d732a
lea ecx, [ebp - 0xc8]
mov dword [ebp - 0x18], ebx
push 4
call fcn.1001855e
mov dword [ebp + 0x10], ebx
jmp 0x1001c0a3
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xc8]
mov dword [eax + ecx*4], 0x93c5815d
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 4
jl 0x1001c090
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x14]
je 0x1001c0cc
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], ebx
je 0x1001c0cc
mov eax, dword [ebp - 0x1c]
neg eax
mov dword [ebp - 0x18], eax
jmp 0x1001c1cb
mov dword [ebp - 0x20], edi
mov dword [ebp + 0x10], 0xfffffff8
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001c0f7
push 0x1fc2
push 0x135f
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], edi
jg 0x1001c1cb
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0x24], eax
mov dword [ebp + 0x10], 0xa323
xor edx, edx
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov ecx, dword [ebp - 0xbc]
setne dl
xor eax, eax
imul edx, dword [ecx + esi*4]
neg edx
cmp edx, dword [ecx + edi*4]
setl al
imul eax, eax, 0xbdb8
test eax, eax
jne 0x1001c159
cmp dword [ebp - 0x20], ebx
jne 0x1001c159
xor edi, edi
mov eax, ebx
inc edi
jmp 0x1001c15e
xor edi, edi
inc edi
mov eax, edi
mov dword [ebp - 0x18], eax
mov ecx, edi
mov eax, dword [ebp - 0x1c]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sub ecx, eax
sub ecx, dword [ebp - 0x1c]
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov ecx, dword [ebp - 0x24]
setl dl
sub edx, dword [ebp - 0x20]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 0xc], eax
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001c1bc
push ebx
push ebx
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1001c10c
push 2
pop esi
lea ecx, [ebp - 0xc8]
call fcn.10018df6
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], esi
jg 0x1001c074
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xbc]
call fcn.10018df6
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x10], 0xfffffff7
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001c214
push 0x1e11
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffee
jle 0x1001c2bc
push 0xa
pop ecx
mov dword [ebp + 0x10], 0x1f665683
mov dword [ebp - 0x18], 0x729694d2
mov dword [ebp + 0x10], ecx
jmp 0x1001c2a9
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x20], 0x1f6f
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], ebx
jmp 0x1001c2a1
mov dword [ebp - 0x18], 0xfffffff6
mov dword [ebp - 0x24], 0xf7c8b166
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], 0xffffffff
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp - 0x1c]
neg eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x14]
jge 0x1001c296
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
neg eax
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], ecx
jl 0x1001c249
dec dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xffffffe5
jg 0x1001c237
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jg 0x1001c224
movdqa xmm0, xmmword [0x10007fd0]
lea eax, [ebp - 0x10c]
mov dword [ebp + 0x10], 0x55595070
lea ecx, [ebp - 0x98]
push dword [ebp + 0x10]
movdqu xmmword [ebp - 0x11c], xmm0
push eax
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x98], ebx
push eax
push ebx
mov dword [ebp - 0x94], ebx
mov dword [ebp - 0x90], ebx
call fcn.10019c6b
mov dword [ebp - 4], edi
push 8
pop eax
mov dword [ebp - 0xd8], eax
mov dword [ebp - 0xd4], eax
mov dword [ebp - 0xd0], eax
mov dword [ebp - 0xcc], eax
mov dword [ebp - 0x18], 0x4d0c653d
mov dword [ebp - 0xd0], edi
mov dword [ebp + 0x10], ebx
jmp 0x1001c389
push dword [ebp + 0x10]
movdqa xmm0, xmmword [0x10008070]
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x13c]
mov dword [ebp - 0x8c], ebx
push eax
push ebx
lea ecx, [ebp - 0x8c]
mov dword [ebp - 0x88], ebx
movdqu xmmword [ebp - 0x13c], xmm0
mov dword [ebp - 0x84], ebx
call fcn.10019c6b
mov dword [ebp - 0x2c], 0xfffffff8
lea ecx, [ebp - 0x8c]
dec dword [ebp - 0x18]
call fcn.10018df6
dec dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xffffffea
jg 0x1001c332
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x98]
call fcn.10018df6
push 3
lea ecx, [ebp - 0x4c]
call fcn.1001855e
mov dword [ebp - 4], esi
lea eax, [ebp - 0x11c]
push dword [ebp + 0x10]
movdqa xmm0, xmmword [0x10008020]
lea ecx, [ebp - 0x70]
push eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x14], 0x5020f89b
push eax
mov dword [ebp - 0x1c], 0xa5ea964a
push ebx
movdqu xmmword [ebp - 0x12c], xmm0
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call fcn.10019c6b
mov dword [ebp + 0x10], ebx
jmp 0x1001c401
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x4c]
mov dword [eax + ecx*4], 0xdc85f70a
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 3
jl 0x1001c3f1
mov dword [ebp + 0x10], ebx
jmp 0x1001c41a
mov eax, dword [ebp + 0x10]
mov dword [ebp + eax*4 - 0x40], 0xbdfadf62
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], esi
jl 0x1001c40c
mov dword [ebp - 0x14], ebx
jmp 0x1001c55a
mov dword [ebp + 0x10], edi
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp + 0x10], esi
cmp dword [ebp + 0x10], ebx
jl 0x1001c54a
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x18], ebx
jmp 0x1001c460
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0xf8], 0xb56fe18
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1001c44f
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp + 0x10]
cmp dword [ecx + edx*4], eax
je 0x1001c47c
inc dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
sub edx, eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x4c]
mov dword [eax + ecx*4], edx
xor ecx, ecx
mov eax, dword [ebp - 0x20]
cmp edx, eax
mov eax, dword [ebp - 0x24]
setg cl
xor edx, edx
mov dword [ebp - 0x20], ecx
mov esi, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x20]
mov dword [eax + 4], esi
mov eax, dword [ebp - 0x10]
cmp eax, ecx
setl dl
cmp esi, edx
jne 0x1001c4fb
mov esi, dword [ebp + 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x40]
imul edx, eax, 0xffff
mov eax, dword [ebp - 0x40]
sub edx, eax
mov eax, dword [ebp - 0x4c]
inc edx
cmp edx, dword [eax + esi*4]
setle cl
cmp ecx, 0xfffffffb
jb 0x1001c4ec
mov edx, ebx
cmp dword [ebp - 0xf8], ebx
je 0x1001c4ee
mov edx, edi
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x4c]
cmp edx, dword [eax + ecx*4]
mov eax, edi
jne 0x1001c4fd
mov eax, ebx
xor ecx, ecx
cmp eax, 0xee1d
mov eax, dword [ebp - 0x40]
setle cl
sub ecx, 0x406c
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
sete cl
sub ecx, dword [ebp + 0x10]
je 0x1001c533
mov eax, dword [ebp - 0x70]
dec dword [eax + 8]
jmp 0x1001c53b
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jne 0x1001c547
dec dword [ebp + 0x10]
push 2
pop esi
jns 0x1001c443
push 2
pop esi
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x4c]
mov dword [eax + ecx*4], 0x44f8a3d3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x1001c427
lea ecx, [ebp - 0x70]
call fcn.10018df6
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10018df6
push edi
lea ecx, [ebp - 0x64]
call fcn.1001855e
mov dword [ebp - 4], 3
mov dword [ebp - 0x2c], ebx
mov dword [ebp + 0x10], 0x8a0c
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x30], 0x26cefc6e
mov dword [ebp + 0x10], ebx
jmp 0x1001c5ae
mov eax, dword [ebp + 0x10]
mov dword [ebp + eax*4 - 0x80], 0x40d7f825
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 4
jl 0x1001c5a0
mov dword [ebp + 0x10], ebx
jmp 0x1001c5c9
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x64]
mov dword [eax + ecx*4], 6
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], edi
jl 0x1001c5b9
mov eax, dword [ebp - 0x64]
mov dword [eax], ebx
mov dword [ebp + 0x10], edi
lea ecx, [ebp - 0xa4]
mov dword [ebp + 0x10], 0xffffffff
mov dword [ebp - 0x38], 0x8670fc24
mov dword [ebp + 0x10], 0x8e487928
push 3
call fcn.1001855e
push 3
mov dword [ebp - 0x1c], 0xdd5d57d3
mov dword [ebp + 0x10], ebx
pop edx
jmp 0x1001c61a
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xa4]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], edx
jl 0x1001c607
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x80], ebx
jne 0x1001c747
mov dword [ebp + 0x10], edx
cmp dword [ebp + 0x10], ebx
jl 0x1001c72c
mov eax, dword [ebp - 0x64]
xor ecx, ecx
mov dword [ebp - 0x30], 0x2c593c86
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], 0x69035a60
mov eax, dword [eax]
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x18], 0xf484
mov edx, dword [ebp + eax*4 - 0x80]
mov eax, dword [ebp + 0x10]
cmp eax, 0xfffffff6
setne cl
xor eax, eax
cmp edx, ecx
setge al
xor ecx, ecx
cmp eax, 0x41a9c213
setle cl
xor eax, eax
test ecx, ecx
setg al
sub eax, 0x257e
je 0x1001c6bb
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x20], ebx
jmp 0x1001c6b3
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x80], edi
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x1001c6a9
jmp 0x1001c6cc
mov dword [ebp - 0x24], 0xfffc
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp + 0x10]
mov dword [ebp + eax*4 - 0x80], edi
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
mov dword [ebp + eax*4 - 0x80], ecx
dec dword [ebp - 0x18]
test ecx, ecx
je 0x1001c701
mov eax, dword [ebp - 0x1c]
imul eax, eax, 0x70aa
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x1001c6f6
mov ecx, edi
cmp dword [ebp - 0x14], ebx
jne 0x1001c6f8
mov ecx, ebx
mov eax, dword [ebp - 0xa4]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov edx, dword [ebp - 0x1c]
sub edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
cmp edx, eax
setl cl
mov dword [ebp - 0x30], ecx
dec dword [ebp + 0x10]
jns 0x1001c63a
lea ecx, [ebp - 0xa4]
call fcn.10018df6
mov eax, dword [ebp - 0x64]
inc dword [eax]
cmp dword [eax], 3
jle 0x1001c5d3
jmp 0x1001c752
lea ecx, [ebp - 0xa4]
call fcn.10018df6
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001c768
push 0x1ec6
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x64]
call fcn.10018df6
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x20], 4
mov dword [ebp - 0x10], 0xb9737e0d
mov dword [ebp - 0x38], 6
mov dword [ebp - 0x30], 0x8ad88ca0
mov dword [ebp - 0x14], 0x13
jmp 0x1001c90c
push esi
lea ecx, [ebp - 0xb0]
call fcn.1001855e
mov dword [ebp + 0x10], 0xffffffff
mov dword [ebp - 0x2c], ebx
mov dword [ebp + 0x10], ebx
jmp 0x1001c7cd
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xb0]
mov dword [eax + ecx*4], edi
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], esi
jl 0x1001c7be
mov ecx, dword [ebp - 0xb0]
mov dword [ebp - 0x18], ecx
cmp dword [ecx + 4], ebx
je 0x1001c884
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x1c], 0xfff9
mov eax, dword [ebp - 0x1c]
cmp dword [edx + 4], eax
setl cl
xor edx, edx
mov dword [ebp + 0x10], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp eax, ecx
mov eax, dword [ebp - 0x14]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
setg cl
neg ecx
mov dword [ebp - 0x2c], ecx
xor ecx, ecx
cmp eax, dword [ebp + 0x10]
setge cl
xor eax, eax
cmp dword [ebp - 0x2c], ecx
setge al
cmp eax, dword [ebp - 0x1c]
je 0x1001c837
mov eax, edi
cmp dword [ebp - 0x20], ebx
jne 0x1001c839
mov eax, ebx
cmp eax, dword [ebp - 0x14]
jne 0x1001c848
mov eax, dword [ebp - 0x18]
mov edx, edi
cmp dword [eax + 4], ebx
jne 0x1001c84a
mov edx, ebx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1001c87d
mov dword [ebp - 0x10], ebx
jmp 0x1001c875
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001c872
push ebx
push ebx
call dword [sym.imp.USER32.dll_LoadMenuW]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edi
jle 0x1001c861
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edi
jle 0x1001c85c
jmp 0x1001c8e3
mov dword [ebp - 0x1c], 0xf68e
mov dword [ebp - 0x20], 0xd
cmp dword [ebp - 0x20], 5
jle 0x1001c8b9
cmp dword [ebp - 0x38], ebx
jne 0x1001c8b6
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001c8ad
push ebx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 5
jg 0x1001c898
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x30]
mov dword [ebp + 0x10], eax
mov edx, dword [ebp + 0x10]
sub edx, dword [ecx + 4]
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp edx, eax
setne cl
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x14], ebx
je 0x1001c8dd
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001c8fe
push 0x1f38
push ebx
push 0x1419
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea ecx, [ebp - 0xb0]
call fcn.10018df6
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffd
jne 0x1001c7a3
push dword [ebp + 0x10]
movdqa xmm0, xmmword [0x10008060]
lea eax, [ebp - 0x13c]
push eax
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x58], ebx
push eax
push ebx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x54], ebx
movdqu xmmword [ebp - 0x14c], xmm0
mov dword [ebp - 0x50], ebx
call fcn.10019c6b
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], ebx
jl 0x1001c96f
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001c96a
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
dec dword [ebp - 0x14]
jns 0x1001c95b
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x58]
push 0xfffffffffffffffe
pop ecx
cmp ecx, eax
sbb eax, eax
inc eax
sub eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x14]
sub ecx, eax
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [esi + 4]
setge dl
sub ecx, eax
mov eax, dword [ebp - 0x58]
mov dword [ebp + 0x10], edx
xor edx, edx
cmp ecx, dword [eax + 8]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
setg dl
add eax, edx
xor edx, edx
imul ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
xor ecx, ecx
imul edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x58]
add edx, dword [esi + 4]
cmp edx, 0xfff7
setne cl
sub ecx, dword [eax]
neg ecx
sbb ecx, ecx
add ecx, 0xffff2a06
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x58]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0x10], 0xb64b6930
mov dword [ebp + 0x10], 0x668dacb3
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x10], eax
call fcn.10018df6
mov ecx, dword [ebp + 8]
mov edx, edi
cmp dword [ecx], ebx
jne 0x1001ca18
mov edx, ebx
mov eax, dword [ebp - 0x34]
mov esi, dword [ebp - 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 4]
add eax, edx
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov eax, dword [edx]
sub eax, 0x780eec29
je 0x1001ca39
mov eax, dword [esi]
cmp dword [eax], ebx
jne 0x1001ca3b
mov edi, ebx
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
mov eax, dword [ecx]
mov eax, dword [ecx]
cmp dword [edx], ebx
jne 0x1001ca4a
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
imul ecx, ecx
mov dword [eax], ecx
jmp 0x1001cceb
xor esi, esi
xor edx, edx
inc esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x10], 0x4ee7d21
mov dword [ebp - 0x34], 0xef9a8551
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
push 2
setge dl
pop edi
cmp edx, dword [ebp - 0x10]
je 0x1001cb0a
push esi
lea ecx, [ebp - 0xf0]
call fcn.1001855e
mov dword [ebp + 0x10], esi
xor ebx, ebx
mov dword [ebp + 0x10], 0xde0980db
mov dword [ebp + 0x10], 0x1d102278
mov dword [ebp + 0x10], ebx
jmp 0x1001cacf
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xf0]
mov dword [eax + ecx*4], 0xcc2f
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], esi
jl 0x1001cabc
mov dword [ebp + 0x10], ebx
cmp dword [ebp + 0x10], ebx
jl 0x1001caff
mov dword [ebp - 0x10], ebx
jmp 0x1001caf5
mov dword [ebp - 0x34], 0xa9864ba8
mov dword [ebp - 0x28], 5
inc dword [ebp - 0x28]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
jle 0x1001cae1
dec dword [ebp + 0x10]
jns 0x1001cadc
lea ecx, [ebp - 0xf0]
jmp 0x1001cb8c
push edi
lea ecx, [ebp - 0x10c]
call fcn.1001855e
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x14], 0x16e2
mov dword [ebp - 0x18], ebx
jmp 0x1001cb3c
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10c]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x1001cb2d
dec dword [ebp - 0x14]
mov ecx, esi
mov eax, dword [ebp - 0x10]
neg eax
sbb eax, eax
xor edx, edx
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
sub ecx, eax
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x10]
setne dl
imul eax, edx
add eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x20]
jle 0x1001cb80
mov eax, dword [ebp + 0x10]
mov eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x10c]
inc dword [ebp - 0x20]
call fcn.10018df6
mov dword [ebp - 0x10], 0x16
jmp 0x1001cbb4
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001cbb1
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x17
jle 0x1001cb9a
mov dword [ebp + 0x10], 0x648261f9
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001cbd6
push 0x1a1
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001cbfc
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x129c
push 0x81f
push 0x15be
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001cc78
mov dword [ebp + 0x10], 0xfffffff8
mov dword [ebp + 0x10], 0xffffffff
mov dword [ebp + 0x10], 0xa3062a4b
mov dword [ebp - 0x18], ebx
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001cc3a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndPage]
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 0x18]
mov dword [ebp + 0x10], 7
imul ecx, dword [ebp - 0x18], 0x67f6
mov eax, dword [ebp + 0x10]
push ebx
cmp eax, ecx
setne dl
sub edx, dword [ebp - 0x18]
neg edx
sbb edx, edx
inc edx
mov dword [ebp - 0x18], edx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
push edi
lea ecx, [ebp - 0xe4]
call fcn.1001855e
mov dword [ebp - 0x18], 0xfffffff7
mov dword [ebp + 0x10], 0xe838
mov dword [ebp + 0x10], ebx
jmp 0x1001ccaa
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0xe4]
mov dword [eax + ecx*4], 0x1713
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], edi
jl 0x1001cc97
mov dword [ebp - 0x18], esi
cmp dword [ebp - 0x18], ebx
jl 0x1001cce0
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x1001ccdb
push 0x6c0
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
dec dword [ebp - 0x18]
jns 0x1001ccb7
lea ecx, [ebp - 0xe4]
call fcn.10018df6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret