Function at 0x10016433
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
push edi
mov edi, ecx
mov dword [ebp - 0x28], edx
xor ebx, ebx
cmp dword [edi + 0x10], ebx
jne 0x1001644e
xor al, al
jmp 0x1001684d
push esi
push 3
pop esi
mov dword [ebp - 0xc], 0xfffffffc
push 1
mov dword [ebp - 0x2c], 0xfffffff7
mov dword [ebp - 0xc], ebx
pop edx
jmp 0x10016472
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], edx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10016468
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1001648c
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
xor edx, edx
inc edx
mov dword [ebp - 0xc], ebx
jmp 0x100164a2
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + eax*4 - 0x4c]
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], ecx
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jle 0x10016491
mov eax, dword [ebp - 0x28]
mov dword [eax], ebx
mov dword [ebp - 0x10], edx
mov dword [ebp - 8], 0x7d2703d9
mov dword [ebp - 0x14], 0x9ecf4a41
mov dword [ebp - 0x2c], 0xd6b3bfa3
mov dword [ebp - 0x24], 0xfffffffd
mov dword [ebp - 0xc], 0xf145ba13
mov dword [ebp - 8], ebx
jmp 0x100164e6
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x34], 0x86fd5d70
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x100164d8
mov dword [ebp - 8], ebx
jmp 0x100164fb
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18], ebx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x100164f1
mov dword [ebp - 8], ebx
jmp 0x1001650f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x20], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], edx
jl 0x10016505
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10016539
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1c07
push 0x9ae
push 0x26f4
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x20]
inc dword [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], 0xe58b
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x14]
jge 0x100165b9
mov dword [ebp - 0x24], 0x2c752785
mov dword [ebp - 0xc], ebx
jmp 0x10016586
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x40], 0x12535b5b
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10016578
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x38]
dec ecx
neg ecx
sbb ecx, ecx
inc ecx
sub ecx, eax
je 0x100165a8
cmp dword [ebp - 0x38], ebx
je 0x100165a8
cmp dword [ebp - 8], ebx
jne 0x100165ab
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x30], eax
jmp 0x10016666
mov dword [ebp - 0x10], 0x5a6edb5b
mov dword [ebp - 0xc], ebx
cmp dword [ebp - 0xc], ebx
jl 0x10016666
mov dword [ebp - 0x2c], 0xfffffff9
xor ecx, ecx
mov dword [ebp - 0x24], 6
mov dword [ebp - 0x2c], 0xc3d3
mov eax, dword [ebp - 0x2c]
cmp eax, 0x9e48
setne cl
sub ecx, dword [ebp - 0x10]
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, 0x2197
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
setge bl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0xc]
setl dl
xor ecx, ecx
cmp edx, ebx
mov esi, dword [ebp + eax*4 - 0x18]
mov eax, dword [ebp - 0xc]
setg cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0x453d
mov eax, dword [ebp - 0xc]
setg cl
xor edx, edx
cmp esi, ecx
setg dl
xor ebx, ebx
mov dword [ebp + eax*4 - 0x18], edx
mov dword [ebp - 0x14], ebx
cmp dword [ebp - 0x14], ebx
jl 0x1001665d
cmp dword [ebp - 0x10], ebx
jne 0x1001665d
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10016658
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
dec dword [ebp - 0x14]
jns 0x10016644
dec dword [ebp - 0xc]
jns 0x100165cc
cmp dword [edi + 0x14], 0x10
jb 0x10016670
mov ecx, dword [edi]
jmp 0x10016672
mov ecx, edi
or esi, 0xffffffff
cmp dword [edi + 0x14], 0x10
mov dword [ebp - 0x1c], ecx
jb 0x10016682
mov edx, dword [edi]
jmp 0x10016684
mov edx, edi
mov eax, dword [edi + 0x10]
add eax, edx
cmp ecx, eax
je 0x10016785
push ebx
call fcn.10017cb4
mov eax, dword [ebp - 0x1c]
pop ecx
mov al, byte [eax]
cmp al, 0x30
jl 0x10016739
cmp al, 0x39
jg 0x10016739
mov dword [ebp - 0xc], 0xe19d
xor ecx, ecx
mov dword [ebp - 0x24], 0xe9646b8d
inc ecx
mov dword [ebp - 0x2c], 0xcb972524
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ebx
jmp 0x100166da
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x58], ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x100166d0
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0xc], 0x310c
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], ebx
jne 0x100166fe
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 2]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0x50], eax
mov byte [ebp - 2], bl
call fcn.10016192
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.10017afa
mov ecx, dword [ebp - 0x1c]
add esp, 0xc
inc ecx
jmp 0x10016675
mov dword [ebp - 0x2c], 0x42eb
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10016756
push ebx
push 0x5215
call fcn.1001d83f
pop ecx
pop ecx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001676c
push 0x4055
push ebx
call fcn.10016891
pop ecx
pop ecx
lea eax, [ebp - 0x28]
push eax
push 0x46ff
push ebx
call fcn.100168c5
add esp, 0xc
xor al, al
jmp 0x1001684c
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x60], esi
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0xc], ebx
jmp 0x1001681d
mov dword [ebp - 0x10], 0xfffffffd
mov dword [ebp - 0x10], 0xe
cmp dword [ebp - 0x10], 0x14
je 0x1001681a
push 3
pop esi
mov dword [ebp - 0x14], 0x3e63e315
mov dword [ebp - 0x14], ebx
jmp 0x100167e6
mov dword [ebp - 8], 0x79e672ca
mov dword [ebp - 8], esi
cmp dword [ebp - 8], ebx
jl 0x100167e3
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x100167de
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
dec dword [ebp - 8]
jns 0x100167ce
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x100167bf
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10016811
push ebx
push 0xfc3
push 0x21af
push ebx
push 0x1cb7
push 0x20b4
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x14
jne 0x100167b3
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xf
je 0x1001679c
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x1001684a
push 0xb2b
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov al, 1
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret