Function at 0x10028455
Capabilities:
Query service status

Disassembly:
mov eax, 0x1006ea41
call fcn.1006de10
sub esp, 0x144
push ebx
mov eax, 0xcea5d6c0
mov byte [ebp - 0x4c], dl
mov dword [ebp - 0x64], eax
push esi
mov dword [ebp - 0x60], eax
xor esi, esi
mov dword [ebp - 0x5c], eax
inc esi
push edi
or edi, 0xffffffff
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x58], 5
cmp dword [ebp - 0x58], 0xffffffe2
jge 0x100284f1
mov dword [ebp - 0x24], esi
xor edx, edx
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x58]
cmp eax, ecx
setne dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x58]
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x58]
cmp eax, 0x2568
jne 0x100284ca
mov eax, esi
cmp dword [ebp - 0x24], ebx
jne 0x100284cc
mov eax, ebx
cmp dword [ebp - 0x5c], eax
je 0x10028537
mov dword [ebp - 0x2c], 0xfffffffd
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x100284ec
push ebx
push 0x1381
call dword [sym.imp.GDI32.dll_SetLayout]
cmp dword [ebp - 0x2c], ebx
je 0x10028557
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x20]
dec eax
add ecx, eax
mov dword [ebp - 0x24], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x24]
cmp eax, 0xc1e0
mov eax, dword [ebp - 0x58]
setl cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
neg eax
je 0x1002856d
mov dword [ebp - 0x2c], 0x3747c914
mov dword [ebp - 0x2c], edi
jmp 0x10028577
mov dword [ebp - 0x2c], ebx
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x58]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10028557
push ebx
push 0x22c8
call dword [sym.imp.USER32.dll_RemovePropA]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10028565
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
dec dword [ebp - 0x58]
jmp 0x10028497
mov dword [ebp - 0x24], 0x49c4b05e
inc dword [ebp - 0x24]
mov dword [ebp - 0x24], 7
mov dword [ebp - 0x2c], 0x8f2ba167
mov dword [ebp - 0x30], ebx
jmp 0x10028598
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x68], 0xd2e8
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x1002858a
mov dword [ebp - 0x30], ebx
jmp 0x100285b3
mov eax, dword [ebp - 0x30]
mov dword [ebp + eax*4 - 0x88], 0xab61b583
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], esi
jl 0x100285a2
mov eax, dword [ebp - 0x68]
xor ecx, ecx
mov dword [ebp - 0x24], esi
mov eax, dword [ebp - 0x68]
cmp ecx, eax
mov eax, dword [ebp - 0x88]
sbb ecx, ecx
xor edx, edx
neg ecx
imul ecx, eax
mov eax, dword [ebp - 0x24]
inc ecx
cmp eax, ecx
mov eax, dword [ebp - 0x68]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, 0x9fa8
jne 0x100285f9
mov eax, ebx
cmp dword [ebp - 0x88], ebx
je 0x100285fb
mov eax, esi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0x76820624
mov dword [ebp - 0x40], 4
mov dword [ebp - 0x20], ebx
jmp 0x10028625
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028622
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0x19
jle 0x10028611
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [0x1007460c]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x38], 0xfffffff6
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x18], ebx
jmp 0x10028656
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x74], 0xec75
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10028648
mov dword [ebp - 0x18], ebx
jmp 0x10028672
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x8c], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10028661
mov dword [ebp - 0x18], ebx
jmp 0x10028689
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x124], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002867c
mov eax, dword [ebp - 0x6c]
mov dword [ebp - 0x8c], eax
test eax, eax
je 0x100286c4
mov eax, dword [ebp - 0x74]
cmp dword [ebp - 0x6c], ebx
je 0x100286c1
mov eax, dword [ebp - 0x6c]
mov ecx, 0xa7b7e80d
cmp ecx, eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x6c]
jg 0x100286c1
cmp dword [ebp - 0x6c], ebx
je 0x100286c1
mov eax, dword [ebp - 0x8c]
mov eax, dword [ebp - 0x6c]
cmp dword [ebp - 0x70], esi
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xa5f27a41
sete cl
sub ecx, dword [ebp - 0x70]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0x7209c399
je 0x100286f6
mov eax, ebx
cmp dword [ebp - 0x24], ebx
je 0x100286f8
mov eax, esi
add eax, 0x8e3bf118
jne 0x10028706
mov eax, ebx
cmp dword [ebp - 0x6c], ebx
je 0x10028708
mov eax, esi
cmp byte [ebp - 0x4c], 0
mov edx, dword [ebp + 8]
mov dword [ebp - 0x120], eax
mov dword [edx], ebx
mov dword [edx + 4], ebx
mov dword [edx + 8], ebx
mov dword [edx + 0xc], ebx
je 0x1002891b
cmp dword [ebp - 0x54], esi
jne 0x1002891b
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x28], ebx
jmp 0x10028750
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x1b
jge 0x10028741
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028769
push ebx
call dword [sym.imp.USER32.dll_DestroyCursor]
mov edx, dword [ebp + 8]
push 3
pop edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x30], 0x31fb
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x20], 6
mov dword [edx + 8], 4
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add eax, 0xfffff751
add eax, ecx
je 0x100287c7
mov dword [ebp - 0x24], 0xffffffff
inc dword [ebp - 0x24]
jmp 0x10028914
push dword [ebp + 8]
lea eax, [ebp - 0x140]
mov dword [ebp - 0x9c], ebx
push eax
lea eax, [ebp - 0x150]
mov dword [ebp - 0x98], ebx
push eax
xorps xmm0, xmm0
mov dword [ebp - 0x94], ebx
push ebx
lea ecx, [ebp - 0x9c]
movdqu xmmword [ebp - 0x150], xmm0
call fcn.10027760
mov dword [ebp - 0x18], ebx
jmp 0x100288eb
mov dword [ebp - 0x38], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x10028826
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x138], 7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10028815
mov dword [ebp - 0x30], ebx
jmp 0x100288df
mov dword [ebp - 0x1c], 0x50169ff9
xor edx, edx
mov dword [ebp - 0x24], 0xfffffff8
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
cmp ecx, eax
setne dl
imul edx, dword [ebp - 0x38]
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], edx
xor edx, edx
cmp dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], ebx
je 0x100288a6
mov eax, dword [ebp - 0x9c]
cmp dword [eax + 4], ebx
jne 0x100288e8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100288dc
push ebx
push ebx
push 0x255a
push ebx
push 0x23f4
push ebx
push ebx
push 0x16f0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x100288dc
mov dword [ebp - 0x24], 0xfffd
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x1c]
sub eax, 0x7183
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x9c]
mov eax, dword [eax + ecx*4]
mov dword [ebp - 0x138], eax
inc dword [ebp - 0x30]
cmp dword [ebp - 0x30], edi
jle 0x10028834
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x10028809
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028906
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
lea ecx, [ebp - 0x9c]
call fcn.10023630
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x1007460c
mov ecx, dword [ebp - 0x3c]
cmp ecx, dword [ebp - 0x54]
jge 0x100293eb
mov dword [ebp - 0x28], 0x13b91020
mov edi, 0x10074610
mov dword [ebp - 0x28], ebx
cmp dword [ebp - 0x28], 0x13
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], edi
jg 0x10028965
cmp dword [ebp - 0x28], ebx
jne 0x10028962
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028959
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_HeapFree]
inc dword [ebp - 0x28]
cmp dword [ebp - 0x28], 0x13
jle 0x10028942
mov ecx, dword [ebp - 0x3c]
mov eax, ebx
mov dword [ebp - 0x2c], ebx
cmp eax, ecx
jge 0x10028d26
mov dword [ebp - 0x28], 0x73838a1f
lea ecx, [ebp - 0x130]
mov dword [ebp - 0x34], 0x849f845
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x34], 0xb3b7bede
mov dword [ebp - 0x34], 0xfc3938dd
mov dword [ebp - 0x34], 0x6310fe
mov dword [ebp - 0x34], 7
push 2
call fcn.100235ae
push 3
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x100289c5
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x11c], 0xfffffffb
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100289b4
mov dword [ebp - 0x18], ebx
jmp 0x100289e2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x130]
mov dword [eax + ecx*4], 9
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x100289cf
mov dword [ebp - 0x18], ebx
jmp 0x100289fe
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x104], 0x50f82bae
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100289ed
mov dword [ebp - 0x28], 2
cmp dword [ebp - 0x28], ebx
jl 0x10028a28
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + eax*4 - 0x11c]
mov eax, dword [ebp - 0x28]
mov dword [ebp + eax*4 - 0x11c], ecx
dec dword [ebp - 0x28]
jns 0x10028a0f
inc dword [ebp - 0x104]
lea ecx, [ebp - 0x130]
call fcn.10023630
mov eax, dword [edi]
mov dword [ebp - 0x28], 0xaa61
mov dword [ebp - 0x30], 0x168aa2d3
mov dword [ebp - 0x20], 0xdb6b7be2
mov dword [ebp - 0x24], 0xffff
mov dword [ebp - 0x34], 0x23830ae7
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x24], ebx
je 0x10028a99
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x3d06ce12
setne al
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x30], esi
je 0x10028acd
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028aee
push 0xd28
call dword [sym.imp.USER32.dll_GetDC]
jmp 0x10028aee
mov dword [ebp - 0x1c], ebx
jmp 0x10028ae3
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x90], 0xfffd
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10028ad2
inc dword [ebp - 0x90]
add edi, dword [ebp - 0x40]
mov dword [ebp - 0x24], 0x93905c80
mov dword [ebp - 0x34], 0xf506e60b
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x1c], ebx
jmp 0x10028b1b
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x140], 0x4aa41a80
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10028b0a
mov eax, dword [ebp - 0x24]
dec eax
je 0x10028b33
mov dword [ebp - 0x24], 0xe5f36f6d
inc dword [ebp - 0x24]
jmp 0x10028ba6
mov dword [ebp - 0x1c], 0xbb00868b
mov dword [ebp - 0x28], 0x37c5b151
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x28], ebx
mov edx, dword [ebp - 0x28]
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
xor edx, edx
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, 0x822cb3a3
setne cl
cmp eax, ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
sbb edx, edx
neg edx
add eax, edx
add ecx, eax
mov dword [ebp - 0x13c], ecx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028ba6
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
mov eax, dword [edi]
mov dword [ebp - 0x18], 2
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x12
jmp 0x10028bef
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x1c], ebx
jmp 0x10028be6
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028be3
push ebx
push ebx
push 0x180
push 0x16a4
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0x13
jle 0x10028bc7
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffe8
je 0x10028bbb
mov dword [ebp - 0x24], 0x640c
cmp dword [ebp - 0x24], 0x6581
jle 0x10028c32
mov edi, ebx
mov esi, ebx
mov eax, esi
mov ecx, 0x10616598
and eax, edi
cdq
push edx
push eax
call fcn.10023499
inc esi
cmp esi, 0x5e47
jl 0x10028c09
inc edi
cmp edi, 0x588e
jl 0x10028c07
mov edi, dword [ebp - 0x30]
xor esi, esi
inc esi
mov dword [ebp - 0x18], ebx
jmp 0x10028c4c
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028c49
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x19
jle 0x10028c37
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x6167
jge 0x10028c6d
mov edx, 0x10007edc
mov ecx, 0x10616598
call fcn.10026d57
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x40]
add edi, eax
mov dword [ebp - 0x34], 7
mov dword [ebp - 0x34], 0x4ffb871c
mov dword [ebp - 0x34], 0xfffffff6
mov dword [ebp - 0x34], 0xfffffffd
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], ebx
inc dword [ebp - 0x24]
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xfffffffd
je 0x10028cda
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028cb4
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028cce
push 0x16e1
push 0x1539
push ebx
call dword [sym.imp.GDI32.dll_PtInRegion]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffffd
jne 0x10028ca4
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x28], 0
jne 0x10028ce3
lea edi, [edi + eax*2]
add edi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x3c]
inc eax
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x2c], eax
jmp 0x1002896a
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0xac]
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x24], 0xfffffff8
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x2c], 0xf0e4f200
push 3
call fcn.100235ae
push 2
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0xb8]
mov dword [ebp - 0x48], esi
push eax
call fcn.100235ae
mov byte [ebp - 4], 3
mov dword [ebp - 0x34], 0x9f010208
mov dword [ebp - 0x2c], 0x227af464
mov dword [ebp - 0x2c], 0xfffffffc
mov dword [ebp - 0x18], ebx
jmp 0x10028d8b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x44], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10028d7d
mov dword [ebp - 0x18], ebx
jmp 0x10028da4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xac]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10028d95
mov dword [ebp - 0x18], ebx
jmp 0x10028dc2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xb8]
mov dword [eax + ecx*4], 0xc160ec25
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10028daf
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], ebx
jl 0x10028fb2
mov dword [ebp - 0x20], 0x46df37d4
mov dword [ebp - 0xc8], 0xb659baaa
mov dword [ebp - 0xc4], 0xb659baaa
mov dword [ebp - 0xc0], 0xb659baaa
mov dword [ebp - 0xbc], 0xb659baaa
mov dword [ebp - 0x28], 0xfc6a3f0b
mov dword [ebp - 0x50], 0x7b53
cmp dword [ebp - 0x50], 0x7ddc
jle 0x10028e68
mov esi, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, edi
mov ebx, esi
mov esi, dword [ebp - 0x1c]
sar ebx, cl
mov eax, esi
mov ecx, 0x10616598
xor eax, ebx
cdq
push edx
push eax
call fcn.10023499
inc esi
cmp esi, 0x7faa
jl 0x10028e2d
mov esi, dword [ebp - 0x2c]
inc edi
push 0
pop ebx
cmp edi, 0x98b
jl 0x10028e21
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x66d7
jl 0x10028e1f
mov edi, dword [ebp - 0x30]
xor esi, esi
inc esi
push esi
lea ecx, [ebp - 0xd4]
call fcn.100235ae
mov byte [ebp - 4], 5
cmp dword [ebp - 0x50], 0x7b0e
jge 0x10028eb7
mov edx, 0x10007f28
mov ecx, 0x10616598
call fcn.10026d57
jmp 0x10028eb7
mov dword [ebp - 4], 4
mov dword [ebp - 0x1c], ebx
jmp 0x10028ed6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xd4]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10028ec3
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], ebx
jl 0x10028f2e
mov dword [ebp - 0x2c], 0xfffffffe
mov dword [ebp - 0x2c], 0x9646b8d9
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x4c59cdc3
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x44], ecx
dec dword [ebp - 0x20]
jns 0x10028ee3
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xb8]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x28]
inc dword [ecx + 4]
neg eax
sbb eax, eax
neg eax
cmp eax, dword [ebp - 0x20]
jg 0x10028f5a
mov eax, ebx
cmp dword [ebp - 0x44], ebx
je 0x10028f5c
mov eax, esi
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0xc8]
mov eax, dword [ebp - 0x48]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0x44]
mov eax, dword [ebp - 0xd4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xac]
mov dword [eax], ecx
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0xd4]
mov byte [ebp - 4], 3
call fcn.10023630
dec dword [ebp - 0x18]
jmp 0x10028dcb
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffee
jge 0x100290c9
mov edi, dword [ebp - 0xac]
mov dword [ebp - 0x28], 0xbc5de30
mov dword [ebp - 0x20], 0x72ee8ff
cmp dword [ebp - 0x28], ebx
je 0x10028ffa
mov dword [ebp - 0x18], ebx
jmp 0x10028ff2
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10028fef
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xfffffff0
jne 0x10028fdd
jmp 0x10029062
mov dword [ebp - 0x38], 0x46fedea8
mov eax, 0xaab93b57
mov ecx, dword [ebp - 0x28]
sub ecx, 0x385fae11
neg ecx
sbb ecx, ecx
inc ecx
sub eax, ecx
jne 0x1002904e
mov eax, dword [ebp - 0x3c]
xor ecx, ecx
mov eax, dword [ebp - 0x38]
cmp eax, 0x5251bb39
setne cl
sub ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xac]
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
mov ecx, ebx
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x44]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x1c], eax
jl 0x10029050
mov ecx, esi
mov eax, dword [ebp - 0xb8]
sub ecx, dword [eax + 4]
mov eax, dword [ebp - 0x38]
imul eax, ecx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x28], esi
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x20]
jl 0x1002907a
mov edx, esi
cmp dword [ebp - 0x20], ebx
jne 0x1002907c
mov edx, ebx
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x44]
add eax, edx
xor edx, edx
add ecx, eax
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setle dl
sub edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x20]
mov dword [edi + 4], edx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x3c]
sub edx, eax
mov eax, dword [ebp - 0x24]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setle cl
mov dword [ebp - 0x2c], ecx
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jl 0x10028fc5
mov edi, dword [ebp - 0x30]
lea ecx, [ebp - 0xb8]
call fcn.10023630
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xac]
call fcn.10023630
mov edi, dword [edi]
mov dword [ebp - 0x2c], 0xf73838a
mov dword [ebp - 0x1c], 0x64a53aa9
mov dword [ebp - 0x34], 0xe124
mov dword [ebp - 0x48], 0xfffffffd
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], edi
cmp dword [ebp - 0x1c], ebx
je 0x1002913e
mov dword [ebp - 0x38], 0xaef6
xor edx, edx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, esi
setg al
mov dword [ebp - 0x48], eax
jmp 0x1002914f
mov dword [ebp - 0x2c], 0x65786371
mov eax, dword [ebp - 0x2c]
imul eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0xf8]
add dword [ebp - 0x30], eax
push 3
call fcn.100235ae
mov dword [ebp - 4], 7
lea ecx, [ebp - 0xe0]
mov dword [ebp - 0x20], 5
mov dword [ebp - 0x2c], 0xa9565e08
mov dword [ebp - 0x38], 0xc902dafb
push esi
call fcn.100235ae
mov dword [ebp - 0x34], 0xfffffff7
mov dword [ebp - 0x50], 0xffffffff
push 3
mov dword [ebp - 0x48], ebx
mov dword [ebp - 0x18], ebx
pop edx
jmp 0x100291b6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xf8]
mov dword [eax + ecx*4], 0x3342eb90
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edx
jl 0x100291a3
mov dword [ebp - 0x18], ebx
jmp 0x100291d3
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xe0]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x100291c0
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x1002922c
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x2c], 0xc7516a20
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x2c], 0x4cb8
mov dword [ebp - 0x1c], ebx
jmp 0x10029219
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x110], 0x2eac4530
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10029208
inc dword [ebp - 0x108]
inc dword [ebp - 0x2c]
dec dword [ebp - 0x20]
jns 0x100291e4
mov ecx, dword [ebp - 0xf8]
cmp dword [ecx + 4], ebx
jne 0x1002923a
mov eax, dword [ebp - 0x34]
xor eax, eax
cmp dword [ecx + 4], ebx
setne al
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
sub eax, 0xfffffff6
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x38], eax
jl 0x10029268
mov edx, esi
cmp dword [ebp - 0x50], ebx
jne 0x1002926a
mov edx, ebx
mov eax, dword [ebp - 0x48]
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x38], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x50]
mov eax, dword [ebp - 0xe0]
cmp dword [eax], esi
sete cl
add ecx, 4
mov dword [eax], ecx
lea ecx, [ebp - 0xe0]
call fcn.10023630
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xf8]
call fcn.10023630
mov ecx, dword [ebp - 0x30]
mov eax, dword [ecx]
mov dword [ebp - 0x3c], 0x9fdf99ff
mov dword [ebp - 0x3c], 0xffffffee
cmp dword [ebp - 0x3c], 0xfffffff0
mov dword [ebp - 0x48], eax
jl 0x1002931c
push 2
lea ecx, [ebp - 0xec]
call fcn.100235ae
mov dword [ebp - 0x34], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x100292f1
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0xec]
mov dword [eax + ecx*4], 0x444696a4
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100292de
mov eax, dword [ebp - 0xec]
lea ecx, [ebp - 0xec]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
call fcn.10023630
inc dword [ebp - 0x3c]
cmp dword [ebp - 0x3c], 0xfffffff0
jge 0x100292c5
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x40]
add ecx, edx
test eax, eax
jne 0x100293eb
cmp byte [ebp - 0x4c], al
je 0x1002933f
cmp dword [ebp - 0x54], esi
jne 0x1002933f
lea eax, [edi + edx*4]
mov edx, dword [ebp + 8]
add dword [edx + 8], eax
mov edx, dword [ebp - 0x40]
mov eax, dword [ecx]
add ecx, edx
mov dword [ebp - 0x34], eax
push edi
mov eax, dword [ecx]
add ecx, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x30], ecx
call fcn.1005217c
pop ecx
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x80]
lea eax, [ebp - 0xa0]
mov dword [ebp - 0xa0], ebx
push eax
push edi
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
call fcn.1002c946
mov eax, dword [ebp - 0x24]
mov edi, ebx
mov ecx, dword [ebp - 0x80]
test eax, eax
jle 0x100293ca
mov eax, edi
and eax, 0x80000001
jns 0x10029393
dec eax
or eax, 0xfffffffe
inc eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x34]
add eax, edi
add eax, dword [ebp - 0x34]
imul eax, dword [ebp - 0x48]
jmp 0x100293a8
lea eax, [edx + 1]
cdq
idiv dword [ebp - 0x24]
cmp word [ecx + edx*2], bx
jne 0x100293a5
mov eax, dword [ebp - 0x30]
mov word [ecx + edx*2], si
mov al, byte [edx + eax]
mov edx, dword [ebp - 0x2c]
mov byte [edi + edx], al
inc edi
mov eax, dword [ebp - 0x24]
cmp edi, eax
jl 0x10029385
mov edi, dword [ebp + 8]
mov dword [edi], eax
mov eax, dword [ebp - 0x2c]
mov dword [edi + 4], eax
test ecx, ecx
je 0x100293ee
push ecx
call fcn.10056f97
pop ecx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
jmp 0x100293ee
mov edi, dword [ebp + 8]
mov dword [ebp - 0x40], 0xaa61
mov dword [ebp - 0x1c], 0x168aa2d3
mov dword [ebp + 8], 0xdb6b7be2
mov dword [ebp - 0x34], 0xffff
mov dword [ebp - 0x48], 0x23830ae7
mov dword [ebp - 0x48], esi
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp + 8]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x34], ebx
je 0x10029449
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x40]
neg ecx
sbb ecx, ecx
xor eax, eax
inc ecx
cmp ecx, 0x3d06ce12
setne al
mov dword [ebp + 8], eax
cmp dword [ebp - 0x1c], esi
je 0x1002947d
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x1002949e
push 0xd28
call dword [sym.imp.USER32.dll_GetDC]
jmp 0x1002949e
mov dword [ebp + 8], ebx
jmp 0x10029493
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x84], 0xfffd
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
jl 0x10029482
inc dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret