Function at 0x10001ae5
Capabilities:
Modify service
Query or enumerate registry key

Disassembly:
mov eax, 0x1005653d
call fcn.10055fd8
sub esp, 0x218
push ebx
mov dword [ebp - 0x8c], ecx
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x20], ebx
inc ecx
mov dword [ebp - 0xc8], edx
push esi
mov dword [ebp - 0x18], ecx
push edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x174], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x10001b31
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x88], 0xbe1d925b
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10001b20
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x84], eax
push 2
mov dword [ebp - 0x18], eax
pop edx
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], ebx
jl 0x10001c31
mov dword [ebp - 0x2c], 0x54d8142
mov dword [ebp - 0x1c], ebx
jmp 0x10001b6f
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1c0], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10001b5e
mov dword [ebp - 0x20], ebx
jmp 0x10001c1c
mov dword [ebp - 0x30], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x24], 0x4ea14c55
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x80]
mov eax, dword [ebp - 0x30]
imul edx, eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x88]
cmp edx, eax
setne cl
mov dword [ebp - 0x1c0], ecx
mov eax, dword [ebp - 0x24]
add eax, ecx
je 0x10001bc9
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x20]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0x88]
mov eax, dword [ebp - 0x24]
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setl dl
cmp dword [ebp + eax*4 - 0x88], edx
jne 0x10001bf2
cmp dword [ebp - 0x80], ebx
jne 0x10001bf2
mov edx, ebx
jmp 0x10001bf5
xor edx, edx
inc edx
mov eax, dword [ebp - 0x84]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x2c]
push 2
setg cl
add ecx, 0xfffff9a9
neg ecx
pop edx
sbb ecx, ecx
inc ecx
imul eax, ecx
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jle 0x10001b7d
dec dword [ebp - 0x18]
jns 0x10001b52
xor ecx, ecx
inc ecx
mov dword [ebp - 0x24], 0x2dafbbd
mov dword [ebp - 0x20], ebx
jmp 0x10001c4e
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x154], 0xfffffffd
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10001c3d
mov dword [ebp - 0x20], ebx
jmp 0x10001c65
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xb0], ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10001c58
mov dword [ebp - 0x20], ebx
jmp 0x10001c80
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x20c], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10001c6f
mov dword [ebp - 0xac], ebx
cmp dword [ebp - 0xac], ebx
jl 0x10001d42
mov dword [ebp - 0x1c], 0xed23b618
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], 0x4129b857
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], ebx
jl 0x10001d36
mov dword [ebp - 0x2c], 0x9565e08c
mov dword [ebp - 0x30], 5
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xfffffff6
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10001cea
push 0x2508
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
mov dword [ebp - 0x2c], ebx
cmp dword [ebp - 0x2c], ebx
jl 0x10001d2e
mov dword [ebp - 0x30], 0xfffffff9
mov dword [ebp - 0x30], 0xb4ef66b1
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x30], 0xfffffffa
mov dword [ebp - 0x30], 0x9bdd7770
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10001d26
push ebx
push 0xb9a
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
dec dword [ebp - 0x24]
dec dword [ebp - 0x2c]
jns 0x10001cf2
dec dword [ebp - 0x1c]
jns 0x10001cb8
xor ecx, ecx
inc ecx
dec dword [ebp - 0xac]
jns 0x10001c98
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x10001d5f
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 0x6c], 0x5a401
mov dword [ebp - 0x68], 0x3d10f02
mov dword [ebp - 0x64], 0x43e060e
mov dword [ebp - 0x60], 0xe023d
mov byte [ebp - 0x5c], 0x28
mov dword [ebp - 0x24], 0x7188
cmp dword [ebp - 0x24], 0x7497
jle 0x10001db5
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x1006f978
cdq
push edx
push eax
call fcn.100032ed
inc edi
cmp edi, 0x7117
jl 0x10001d93
inc esi
cmp esi, 0x6237
jl 0x10001d91
mov dword [ebp - 0x18], 0x3e34b64b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x715f
jge 0x10001df5
mov edx, str.rntdkqSiHAtywqu_nljig_idlpafo_fctnrhfb_fqvmcyx_arrbu_mekqesmfc_diknvaui_dmhb_lkp
mov ecx, 0x1006f978
call fcn.1000548e
jmp 0x10001df5
or dword [ebp - 4], 0xffffffff
xor ecx, ecx
mov dword [ebp - 0x1c], ebx
inc ecx
mov dword [ebp - 0x2c], 3
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], 0x84addbfd
mov dword [ebp - 0x20], ebx
jmp 0x10001e22
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xe0], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 3
jl 0x10001e15
mov dword [ebp - 0x20], ebx
jmp 0x10001e3b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x70], 0x6603fa8b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10001e2d
mov dword [ebp - 0x20], ebx
jmp 0x10001e56
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x184], 0x9a9257de
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10001e45
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x10001e7c
mov edx, ebx
cmp dword [ebp - 0xdc], ebx
je 0x10001e7e
mov edx, ecx
mov eax, dword [ebp - 0x18]
sub edx, eax
imul eax, edx, 5
test eax, eax
jne 0x10001e91
mov edx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10001e93
mov edx, ecx
xor eax, eax
cmp edx, 0xfffffffb
setne al
cmp eax, dword [ebp - 0x18]
jne 0x10001ea7
cmp dword [ebp - 0x1c], ebx
jne 0x10001ea7
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, 0x3ca30775
setne dl
sub edx, 0x7f44fb66
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, 0x2600bf09
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0xabc1
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
cmp edx, 0xfffffff6
mov dword [ebp - 0x70], edx
setne cl
xor eax, eax
sub ecx, dword [ebp - 0x18]
cmp ecx, 0x8485bdf6
setne al
imul eax, dword [ebp - 0x1c]
imul eax, eax, 0xbc15
mov dword [ebp - 0x184], eax
test eax, eax
jne 0x10001f36
cmp dword [ebp - 0x24], ebx
jne 0x10001f36
mov ecx, ebx
jmp 0x10001f39
xor ecx, ecx
inc ecx
xor eax, eax
test ecx, ecx
sets al
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x18], ebx
je 0x10001f4b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x17c]
xor edx, edx
mov eax, dword [ebp - 0xe0]
mov dword [ebp - 0xe0], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x184]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x70]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
add eax, edx
imul eax, eax, 3
push 0x6c
mov dword [ebp - 0x2c], eax
pop eax
mov word [ebp - 0x11a], ax
mov dword [ebp - 0x1c], 0xddc85f70
mov dword [ebp - 0x1c], ebx
jmp 0x10001fad
mov dword [ebp - 0x24], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 7
je 0x10001f9d
mov dword [ebp - 0x30], 0x1de5
cmp dword [ebp - 0x30], 0x215b
jle 0x10001ff1
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov edi, esi
mov esi, 0x9f4
mov eax, edi
mov ecx, 0x1006f978
cdq
push edx
push eax
call fcn.100032ed
dec edi
dec esi
jne 0x10001fcf
mov esi, dword [ebp - 0x24]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x6633
jl 0x10001fc8
mov byte [ebp - 0x25], bl
mov dword [ebp - 4], 2
cmp dword [ebp - 0x30], 0x1ca4
jge 0x10002013
mov edx, str.bep_bqzkdbq_dnsyxfkn_qksyid
mov ecx, 0x1006f978
call fcn.1000548e
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0x599e
cmp dword [ebp - 0x24], 0x5cc3
jle 0x1000208d
mov eax, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov esi, ebx
lea ecx, [esi + edi]
shl eax, cl
lea ecx, [ebp - 0x200]
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000204d
mov eax, dword [eax]
push eax
call fcn.1003cd2f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x200]
call fcn.10003730
mov eax, dword [ebp - 0x2c]
inc esi
cmp esi, 0x1a38
jl 0x10002030
inc edi
cmp edi, 0x2087
jl 0x1000202e
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x5673
jl 0x1000202c
push 0x160e
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp byte [ebp - 0x25], 0
je 0x100020a0
push 0x25ee
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp dword [ebp - 0x24], 0x57f2
jge 0x100020b4
push str.mlq_vyw_mzdmmfd_jkg_qefbjt_gwuavcg_hrvngjg
call fcn.1003cd2f
pop ecx
or dword [ebp - 4], 0xffffffff
mov edi, ebx
push 2
pop esi
mov dword [ebp - 0x24], esi
cmp esi, 0x11
jae 0x100024f6
mov dword [ebp - 0x18], 0x490c4d8e
mov dword [ebp - 0x30], 0x71c097bc
mov dword [ebp - 0x1c], ebx
jmp 0x10002112
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x9c], 0xfffffff9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10002101
xor ecx, ecx
inc ecx
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], ebx
jl 0x1000216f
mov eax, dword [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp + eax*4 - 0x9c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x98]
mov eax, dword [ebp - 0x9c]
mov eax, dword [ebp - 0x30]
cmp eax, 0x11c15747
mov eax, dword [ebp - 0x30]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x18]
setne cl
mov dword [ebp + eax*4 - 0x9c], ecx
dec dword [ebp - 0x18]
jns 0x10002123
xor ecx, ecx
inc ecx
movzx eax, byte [ebp - 0x6c]
lea eax, [eax*2 + 2]
cmp esi, eax
jne 0x100021ca
movzx edx, byte [ebp + esi - 0x6c]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x24], 0xbe187950
mov dword [ebp - 0x1c], ebx
lea edi, [edx + 1]
jmp 0x100021a2
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1d8], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10002195
mov dword [ebp - 0x2c], ecx
cmp dword [ebp - 0x2c], ebx
jl 0x100021c2
mov dword [ebp - 0x24], 0xfffffffb
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x2c]
jns 0x100021b0
dec esi
add esi, edx
jmp 0x100024ee
mov dword [ebp - 0x1c], 0x3ae35568
mov dword [ebp - 0x18], ebx
jmp 0x100021e7
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x158], 0x8d0d3f7b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ecx
jl 0x100021d6
mov dword [ebp - 0x18], ebx
jmp 0x10002202
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x150], 0xce456251
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x100021f1
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x1c], 0xffffffee
jg 0x10002241
push 0xfffffffffffffff6
pop eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x30], ecx
dec dword [ebp - 0x148]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xffffffee
jle 0x10002214
movzx edx, byte [ebp + esi - 0x6b]
mov eax, esi
sub eax, edi
push 2
movzx eax, byte [ebp + eax - 0x6e]
movzx eax, word [ebp + eax*2 - 0x11c]
mov ecx, eax
and eax, edx
or ecx, edx
sub ecx, eax
movzx eax, byte [ebp + esi - 0x6c]
mov word [ebp + eax*2 - 0x11c], cx
mov dword [ebp - 0x1c], 0x4c23
pop ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0xb07d0d1d
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x18], 0x589d
mov dword [ebp - 0x2c], 0xe65dd4d1
mov dword [ebp - 0x20], 0x705be734
push 3
mov dword [ebp - 0x2c], 0xd0f12afb
mov dword [ebp - 0x20], ebx
pop edx
jmp 0x100022b5
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x40], 0x2ae7b79f
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x100022a7
mov dword [ebp - 0x20], ebx
jmp 0x100022d0
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xf4], 0xffffffff
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x100022bf
mov dword [ebp - 0x20], ebx
jmp 0x100022e7
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xc4], edx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 1
jl 0x100022da
cmp dword [ebp - 0x3c], ebx
je 0x10002355
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov ecx, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
add ecx, eax
mov eax, dword [ebp - 0x3c]
cmp ecx, eax
setl dl
mov dword [ebp - 0x2c], edx
xor edx, edx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
mov eax, dword [ebp - 0x3c]
setge dl
xor ecx, ecx
add edx, 0xfffffffa
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x30], ecx
mov ecx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x2c]
cmp eax, ecx
setne dl
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x30]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [ebp - 0x38]
jne 0x10002355
xor eax, eax
inc eax
jmp 0x10002357
mov eax, ebx
sub dword [ebp - 0x3c], eax
xor edx, edx
mov eax, dword [ebp - 0x3c]
cmp eax, 0x366e523
sete dl
xor ecx, ecx
mov dword [ebp - 0xf4], edx
mov eax, dword [ebp - 0x18]
cmp edx, eax
setge cl
xor edx, edx
mov dword [ebp - 0x2c], ecx
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
setge dl
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x20], 2
jg 0x100024ec
mov dword [ebp - 0x18], 0x77d8
cmp dword [ebp - 0x18], 0x7b91
jle 0x10002400
mov edi, ebx
mov esi, ebx
mov eax, ebx
mov dword [ebp - 0x1c], 0x467b
mov dword [ebp - 0x2c], eax
and eax, edi
mov ecx, 0x1006f978
cdq
push edx
push eax
call fcn.100032ed
mov eax, dword [ebp - 0x2c]
add eax, esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
jne 0x100023cf
inc esi
cmp esi, 0x4b7
jl 0x100023c3
inc edi
cmp edi, 0x3180
jl 0x100023c1
mov esi, dword [ebp - 0x24]
mov dword [ebp - 4], 6
cmp dword [ebp - 0x18], 0x7406
jge 0x1000241f
mov edx, str.zmx_orucdzp_ura_xtbqk_fuxpbs_mgvbjaly_gsnqvqi_xthnzq_ibpsvwp_dhimkdd_zva_qko
mov ecx, 0x1006f978
call fcn.1000548e
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x1000245e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x144], 6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x1000244d
mov eax, dword [ebp - 0x20]
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0x40]
test eax, eax
mov eax, dword [ebp - 0x20]
setne bl
mov eax, dword [ebp + eax*4 - 0x40]
mov dword [ebp - 0xf4], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp + eax*4 - 0x40]
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x144], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x40]
lea eax, [edx + 1]
xor edx, edx
cmp eax, ecx
mov ecx, 0xab1a6906
setl dl
xor eax, eax
cmp ebx, edx
setge al
cmp ecx, eax
sbb ecx, ecx
neg ecx
xor ebx, ebx
mov dword [ebp - 0xc4], ecx
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x40], ecx
mov dword [ebp - 0x18], ebx
jmp 0x100024de
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], bl
je 0x100024db
push ebx
push ebx
push 0x2488
call dword [sym.imp.ADVAPI32.dll_CopySid]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0x1f
jne 0x100024c6
inc dword [ebp - 0x20]
jmp 0x100023a5
mov edi, ebx
add esi, 2
jmp 0x100020bd
mov dword [ebp - 0x1c], ebx
jmp 0x10002508
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xd4], ebx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x100024fb
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10002528
push ebx
push 0x1e99
push 0x1c20
call dword [sym.imp.GDI32.dll_CreatePen]
mov dword [ebp - 0xcc], ebx
jmp 0x100025bc
mov dword [ebp - 0x1c], ebx
jmp 0x10002546
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x7c], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10002538
mov dword [ebp - 0x78], 0xfffffff8
jmp 0x100025a9
mov dword [ebp - 0x18], ebx
jmp 0x1000256b
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x1d0], 5
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000255a
mov dword [ebp - 0x18], ebx
jmp 0x10002584
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x34], 0x810d21df
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10002576
mov dword [ebp - 0x34], ebx
jmp 0x100025a0
mov eax, dword [ebp - 0x34]
mov dword [ebp + eax*4 - 0x1d0], 8
inc dword [ebp - 0x34]
cmp dword [ebp - 0x34], 4
jl 0x1000258f
dec dword [ebp - 0x78]
cmp dword [ebp - 0x78], 0xfffffff6
jg 0x10002555
mov dword [ebp - 0x7c], 0x327439cb
inc dword [ebp - 0xcc]
cmp dword [ebp - 0xcc], 0x13
jge 0x10002533
xor eax, eax
mov dword [ebp - 0x15c], 7
mov word [ebp - 0x10e], ax
lea ecx, [ebp - 0x170]
mov word [ebp - 0x170], ax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x160], ebx
call fcn.1000381c
mov dword [ebp - 4], 8
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x20], 0x1fe0
cmp dword [ebp - 0x20], 0x231e
jle 0x10002697
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x2c], ebx
cdq
idiv edi
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp - 0x30], edx
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x224]
and eax, edx
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002650
mov eax, dword [eax]
push eax
call fcn.1003cd2f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x224]
call fcn.10003730
mov edx, dword [ebp - 0x30]
inc esi
cmp esi, 0x77fd
jl 0x10002630
inc edi
cmp edi, 0x19be
jl 0x1000262e
mov edi, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x2c], edi
cmp edi, 0x5d56
jl 0x10002623
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x764
jl 0x1000261e
mov dword [ebp - 0x18], 0x1a
jmp 0x100026d1
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], 0x12
jmp 0x100026c8
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x100026c5
push 0xe95
push ebx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
dec dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 0xfffffff5
jg 0x100026b0
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffff
jne 0x100026a0
cmp dword [ebp - 0x20], 0x1ec1
jge 0x100026eb
push str.fpxizorpk_anknn_iawd_hgjcdn_trwkht_qxm_mwbzmldih_hxedwyuy
call fcn.1003cd2f
pop ecx
mov dword [ebp - 4], 8
lea edi, [ebp - 0x11c]
xor eax, eax
xor ecx, ecx
stosd dword es:[edi], eax
inc ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x18], 0x7e2799ac
mov dword [ebp - 0x24], 0xc9cc1417
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x24], 0x89a69576
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xed1e12aa
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xab06c0e2
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xca1a1f05
mov dword [ebp - 0x24], 0xfffffffb
mov dword [ebp - 0x24], 0xe74a6e8f
mov dword [ebp - 0x24], 0x74a71a6e
mov dword [ebp - 0x1c], ebx
jmp 0x1000276e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x90], 0x80bfe737
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1000275d
mov dword [ebp - 0x18], ebx
jmp 0x100027e0
mov dword [ebp - 0x24], 0xfffffffc
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x24], 0xb101aae4
mov dword [ebp - 0x24], 0x4b64b5c6
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0xefa5f9c7
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x24], 0x45dcefbd
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
jmp 0x100027c8
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1e8], 0xd2edc755
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 4
jl 0x100027b7
mov eax, dword [ebp - 0x1e0]
mov dword [ebp - 0x24], eax
dec dword [ebp - 0x90]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xa
jle 0x10002778
push dword [ebp - 0xc8]
lea ecx, [ebp - 0x1b4]
call fcn.10003402
mov byte [ebp - 4], 0xb
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0xfffffff8
mov dword [ebp - 0x30], 0xcc2
cmp dword [ebp - 0x30], 0x1023
jle 0x10002869
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x13b9
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, ebx
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x24], ebx
mov eax, esi
cdq
idiv ecx
mov eax, edi
mov ecx, edx
shl eax, cl
mov ecx, 0x1006f978
cdq
push edx
push eax
call fcn.100032ed
mov ecx, dword [ebp - 0x24]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x5803
jl 0x10002830
inc esi
cmp esi, 0x2ec9
jl 0x1000282b
inc edi
cmp edi, 0x45e0
jl 0x10002829
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x1000288a
push ebx
push 0xfdb
push ebx
push ebx
push 0x1464
push 0x48d
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov byte [ebp - 4], 0xc
cmp dword [ebp - 0x30], 0x99e
jge 0x100028c4
mov edx, str.tjl_dsblrhstx_gtnmt_pajsopbu_wrtjk_lbacuftgq_biyzr_zahpioxeh_hmmujkprj_sighdg_xafalpm_ggfbc_oovypjuda
mov ecx, 0x1006f978
call fcn.1000548e
jmp 0x100028c4
mov dword [ebp - 4], 0xb
mov dword [ebp - 0x20], ebx
jmp 0x10002986
mov dword [ebp - 0x2c], 0xfffffffb
mov dword [ebp - 0x24], 4
mov dword [ebp - 0x24], 0xccaea0a9
mov dword [ebp - 0x1c], ebx
jmp 0x100028fe
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x94], 0xa14c5530
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x100028ed
mov eax, dword [ebp - 0x20]
xor edx, edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp ecx, eax
setg dl
cmp edx, 0xffff
jne 0x10002922
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov eax, dword [ebp - 0x18]
cmp eax, 0x8664
mov eax, dword [ebp - 0x18]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x94], eax
test eax, eax
je 0x10002960
cmp dword [ebp - 0x18], ebx
je 0x10002960
xor ecx, ecx
inc ecx
jmp 0x10002962
mov ecx, ebx
mov eax, dword [ebp - 0x20]
imul eax, ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x18], ebx
jmp 0x1000297d
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x94], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x10002970
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xfffffffc
jne 0x100028d3
push 0x5c
pop eax
push 2
mov dword [ebp - 0x48], 0xfa02d700
mov ecx, ebx
mov byte [ebp - 0x44], 0xc4
mov word [ebp - 0x4c], ax
pop esi
cmp esi, 2
jne 0x100029b3
push 3
pop ecx
push ecx
pop esi
jmp 0x100029dc
movzx edx, byte [ebp + esi - 0x47]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x4a]
movzx ecx, word [ebp + eax*2 - 0x4c]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x48]
add ecx, edx
mov word [ebp + eax*2 - 0x4c], cx
mov ecx, ebx
add esi, 2
cmp esi, 5
jb 0x100029a7
xor eax, eax
mov dword [ebp - 0xf8], 7
mov word [ebp - 0x4a], ax
lea ecx, [ebp - 0x10c]
mov word [ebp - 0x10c], ax
lea eax, [ebp - 0x4c]
push eax
mov dword [ebp - 0xfc], ebx
call fcn.1000381c
mov byte [ebp - 4], 0xe
xor ecx, ecx
mov dword [ebp - 0x18], 0x3e34b64b
inc ecx
mov dword [ebp - 0x1c], ebx
push 3
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x30], 0x84addbfd
mov dword [ebp - 0x20], ebx
jmp 0x10002a43
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0xec], ebx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], edx
jl 0x10002a36
mov dword [ebp - 0x20], ebx
jmp 0x10002a5b
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x74], 0x6603fa8b
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jl 0x10002a4d
mov dword [ebp - 0x20], ebx
jmp 0x10002a76
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x13c], 0x9a9257de
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 4
jl 0x10002a65
mov eax, dword [ebp - 0x18]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x18]
cmp dword [ebp - 0x18], eax
je 0x10002a9c
mov edx, ebx
cmp dword [ebp - 0xe8], ebx
je 0x10002a9e
mov edx, ecx
mov eax, dword [ebp - 0x18]
sub edx, eax
imul eax, edx, 5
test eax, eax
jne 0x10002ab1
mov edx, ebx
cmp dword [ebp - 0x1c], ebx
je 0x10002ab3
mov edx, ecx
xor eax, eax
cmp edx, 0xfffffffb
setne al
cmp eax, dword [ebp - 0x18]
jne 0x10002ac7
cmp dword [ebp - 0x1c], ebx
jne 0x10002ac7
mov ecx, ebx
mov eax, dword [ebp - 0x1c]
xor edx, edx
cmp ecx, 0x3ca30775
setne dl
sub edx, 0x7f44fb66
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
sub edx, eax
mov eax, dword [ebp - 0x18]
cmp edx, 0x2600bf09
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ecx, ecx
cmp eax, edx
setl cl
mov dword [ebp - 0x2c], ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0xabc1
neg edx
sbb edx, edx
inc edx
sub edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x1c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
cmp edx, 0xfffffff6
mov dword [ebp - 0x74], edx
setne cl
xor eax, eax
sub ecx, dword [ebp - 0x18]
cmp ecx, 0x8485bdf6
setne al
imul eax, dword [ebp - 0x1c]
imul eax, eax, 0xbc15
mov dword [ebp - 0x13c], eax
test eax, eax
jne 0x10002b56
cmp dword [ebp - 0x24], ebx
jne 0x10002b56
mov ecx, ebx
jmp 0x10002b59
xor ecx, ecx
inc ecx
xor eax, eax
test ecx, ecx
sets al
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x18], ebx
je 0x10002b6b
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x134]
xor edx, edx
mov eax, dword [ebp - 0xec]
mov dword [ebp - 0xec], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x13c]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x74]
mov eax, dword [ebp - 0x18]
cmp ecx, eax
mov eax, dword [ebp - 0x30]
setge dl
mov dword [ebp - 0x4c], ebx
add eax, edx
imul eax, eax, 3
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x18], 0xf89b546
mov dword [ebp - 0x1c], 0x7da7
cmp dword [ebp - 0x1c], 0x7df1
jle 0x10002c21
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov esi, ebx
mov dword [ebp - 0x30], ebx
mov edx, esi
mov dword [ebp - 0x18], ebx
xor edx, edi
mov edi, ebx
mov dword [ebp - 0x24], edx
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1006f978
or eax, edx
cdq
push edx
push eax
call fcn.100032ed
mov edx, dword [ebp - 0x24]
inc esi
cmp esi, 0x980
jl 0x10002bd9
inc edi
cmp edi, 0x5992
jl 0x10002bd7
mov esi, dword [ebp - 0x30]
mov edi, dword [ebp - 0x2c]
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x3753
jl 0x10002bcb
inc edi
mov dword [ebp - 0x2c], edi
cmp edi, 0x12bd
jl 0x10002bc6
mov dword [ebp - 0x24], 1
mov byte [ebp - 4], 0xf
cmp dword [ebp - 0x1c], 0x7bc4
jge 0x10002c62
mov edx, str.yhrskfx_ttzxhv_wtiexy_gikdx
mov ecx, 0x1006f978
call fcn.1000548e
jmp 0x10002c62
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x2c], ebx
jmp 0x10002c7f
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xa8], 0x85f70ad6
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 3
jl 0x10002c6e
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], ebx
jl 0x10002d40
mov dword [ebp - 0x1c], 0xfb770a77
mov eax, dword [ebp - 0x18]
cmp dword [ebp + eax*4 - 0xa8], ebx
jne 0x10002d40
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], ebx
jl 0x10002d37
mov eax, dword [ebp - 0x18]
xor edx, edx
mov ecx, dword [ebp + eax*4 - 0xa8]
mov eax, dword [ebp - 0x1c]
add ecx, 0x10005
cmp eax, ecx
mov eax, dword [ebp - 0x18]
setge dl
xor ecx, ecx
mov eax, dword [ebp + eax*4 - 0xa8]
cmp edx, eax
mov eax, dword [ebp - 0x18]
setg cl
xor edx, edx
mov eax, dword [ebp + eax*4 - 0xa8]
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setne dl
xor ebx, ebx
mov eax, dword [ebp + eax*4 - 0xa8]
cmp eax, edx
mov eax, dword [ebp - 0x18]
setl bl
xor ecx, ecx
add ebx, 3
mov eax, dword [ebp + eax*4 - 0xa8]
cmp ebx, eax
setne cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + eax*4 - 0xa8]
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0xa8], ecx
dec dword [ebp - 0x1c]
jns 0x10002cb8
xor ebx, ebx
dec dword [ebp - 0x18]
jns 0x10002c95
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10002d61
push 0x85e
push ebx
push 0x2041
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
mov dword [ebp - 0x18], 0x7da7
cmp dword [ebp - 0x18], 0x811b
jle 0x10002dc7
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x2c], 0x6e3d
mov dword [ebp - 0x30], eax
mov esi, eax
mov dword [ebp - 0x24], 0x665b
mov edi, ebx
mov eax, esi
mov ecx, 0x1006f978
and eax, edi
cdq
push edx
push eax
call fcn.100032ed
inc edi
cmp edi, 0xb3d
jl 0x10002d8b
inc esi
dec dword [ebp - 0x24]
jne 0x10002d89
mov eax, dword [ebp - 0x30]
mov esi, dword [ebp - 0x1c]
add eax, esi
dec dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
jne 0x10002d80
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x7650
jl 0x10002d74
push 0x5f
pop eax
push 2
mov dword [ebp - 0x54], 0xee031500
mov ecx, ebx
mov word [ebp - 0x50], 0xd070
mov word [ebp - 0x58], ax
pop esi
cmp esi, 2
jne 0x10002dec
push 4
pop ecx
push ecx
pop esi
jmp 0x10002e15
movzx edx, byte [ebp + esi - 0x53]
mov eax, esi
sub eax, ecx
movzx eax, byte [ebp + eax - 0x56]
movzx ecx, word [ebp + eax*2 - 0x58]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [ebp + esi - 0x54]
add ecx, edx
mov word [ebp + eax*2 - 0x58], cx
mov ecx, ebx
add esi, 2
cmp esi, 6
jb 0x10002de0
xor eax, eax
mov byte [ebp - 4], 0x11
cmp dword [ebp - 0x18], 0x7be9
mov word [ebp - 0x56], ax
jge 0x10002e5d
mov edx, str.qipjm_vajgbvkhs_smrh_gzbvgyvw_kzugq_poxfm_bpblk_gaj_xgxli_fhedfffj_zhfhcdda
mov ecx, 0x1006f978
call fcn.1000548e
jmp 0x10002e5d
mov dword [ebp - 4], 0xe
mov dword [ebp - 0x18], 0x5c68ec0a
mov dword [ebp - 0x2c], ebx
jmp 0x10002e81
mov eax, dword [ebp - 0x2c]
mov dword [ebp + eax*4 - 0xc0], 0xfffffffb
inc dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], 4
jl 0x10002e70
mov dword [ebp - 0x18], ebx
jmp 0x10002edb
mov dword [ebp - 0x24], 0xffffffff
mov byte [ebp - 0x25], bl
cmp byte [ebp - 0x25], 0
je 0x10002eb9
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1396
push 0x10c7
push 0x1b6c
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
cmp dword [ebp - 0x24], ebx
jne 0x10002ecf
cmp dword [ebp - 0xb4], ebx
jne 0x10002ecf
xor eax, eax
inc eax
mov dword [ebp - 0xbc], eax
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xffffffff
jle 0x10002e8c
cmp dword [ebp - 0xb4], ebx
jne 0x10002eef
mov eax, dword [ebp - 0xb4]
mov eax, dword [ebp - 0xb4]
xor ecx, ecx
mov eax, dword [ebp - 0xb8]
test eax, eax
mov eax, dword [ebp - 0x18]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xb4]
setle dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x81320f2d
mov dword [ebp - 0x188], 7
sbb ecx, ecx
mov dword [ebp - 0x18c], ebx
neg ecx
xor eax, eax
neg ecx
cmp ecx, 0x3d59
lea ecx, [ebp - 0x19c]
setne al
mov dword [ebp - 0xb8], eax
xor eax, eax
mov word [ebp - 0x19c], ax
lea eax, [ebp - 0x58]
push eax
call fcn.1000381c
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x58], ebx
push dword [ebp - 0xfc]
cmp dword [ebp - 0xf8], 8
lea eax, [ebp - 0x10c]
push ebx
cmovae eax, dword [ebp - 0x10c]
lea ecx, [ebp - 0x1b4]
push eax
call fcn.10003b98
cmp eax, 0xffffffff
je 0x10002faf
push 0xffffffffffffffff
push ebx
lea ecx, [ebp - 0x19c]
push ecx
push 1
push eax
lea ecx, [ebp - 0x1b4]
call fcn.100038a4
jmp 0x10002f69
mov ecx, dword [ebp - 0x8c]
lea eax, [ebp - 0x1b4]
push eax
lea edx, [ebp - 0x170]
call fcn.10005665
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x19c]
call fcn.10003c3b
push ebx
push 1
lea ecx, [ebp - 0x10c]
call fcn.10003c3b
push ebx
push 1
lea ecx, [ebp - 0x1b4]
call fcn.10003c3b
push ebx
push 1
lea ecx, [ebp - 0x170]
call fcn.10003c3b
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x8c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret