Function at 0x1001509d
Capabilities:
Get common file path
Query environment variable
Query service status

Disassembly:
mov eax, 0x100699c0
call fcn.10068cf8
mov eax, 0x60cc
call fcn.10064bd0
push ebx
push esi
push edi
push 3
pop ebx
mov dword [ebp - 0x40], ecx
lea ecx, [ebp - 0x6c0]
mov dword [ebp - 0x1c], 0xffffffff
push ebx
mov byte [ebp - 0x61], dl
call fcn.1000f19e
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x100150ea
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x6c0]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jl 0x100150d7
mov edi, dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
mov ebx, dword [sym.imp.USER32.dll_GetDC]
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], edx
jl 0x10015134
mov byte [ebp - 0x31], dl
cmp byte [ebp - 0x31], 0
je 0x1001512f
push edx
call esi
push eax
call ebx
push eax
push 0
push 0x152d
call edi
xor edx, edx
dec dword [ebp - 0x1c]
jns 0x10015114
lea ecx, [ebp - 0x6c0]
call fcn.1000fd6e
mov dword [ebp - 0x1c], 0xffffffff
lea ecx, [ebp - 0x610]
push 3
call fcn.1000f19e
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x1001516d
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x610]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x1001515a
mov dword [ebp - 0x1c], 0xfffffff6
mov dword [ebp - 0x1c], 2
cmp dword [ebp - 0x1c], edx
jl 0x100151a6
mov byte [ebp - 0x31], dl
cmp byte [ebp - 0x31], 0
je 0x100151a1
push edx
call esi
push eax
call ebx
push eax
push 0
push 0x152d
call edi
xor edx, edx
dec dword [ebp - 0x1c]
jns 0x10015186
lea ecx, [ebp - 0x610]
call fcn.1000fd6e
push 2
lea ecx, [ebp - 0x530]
call fcn.1000f19e
mov dword [ebp - 0x24], 0x504cd453
xor edx, edx
xor esi, esi
mov dword [ebp - 0x4c], 0x73eb905d
mov dword [ebp - 0x1c], edx
inc esi
cmp dword [ebp - 0x1c], 2
jge 0x100151eb
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x530]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x1c]
jmp 0x100151d4
mov dword [ebp - 0x24], edx
jmp 0x100151ff
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x530]
mov dword [eax + ecx*4], esi
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 2
jl 0x100151f0
mov byte [ebp - 0x31], dl
cmp byte [ebp - 0x31], dl
je 0x10015213
call dword [sym.imp.KERNEL32.dll_GetACP]
lea ecx, [ebp - 0x530]
call fcn.1000fd6e
mov dword [ebp - 0x24], 5
xor ecx, ecx
mov dword [ebp - 0x10], 0xfffffffa
mov dword [ebp - 0x24], ecx
jmp 0x1001530a
xor edx, edx
mov dword [ebp - 0x14], 0xb9737e0d
mov dword [ebp - 0x1c], ecx
inc edx
jmp 0x10015252
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x1c0], ecx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10015245
mov eax, dword [ebp - 0x1c0]
lea ecx, [ebp - 0x554]
push edx
call fcn.1000f19e
xor edx, edx
xor esi, esi
mov dword [ebp - 0x1c], edx
inc esi
jmp 0x10015282
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x554]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10015273
mov dword [ebp - 0x14], 0xfffffff7
jmp 0x100152b1
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x1c0], edx
jne 0x100152ae
mov eax, dword [ebp - 0x554]
cmp dword [eax], edx
jne 0x100152ae
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], edx
jle 0x10015290
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xfffffffb
mov dword [ebp - 0x10], edx
jle 0x100152a9
jmp 0x100152d3
mov dword [ebp - 0x14], edx
jmp 0x100152ca
mov dword [ebp - 0x60], edx
inc dword [ebp - 0x60]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xd
je 0x100152c1
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
jle 0x100152bc
lea ecx, [ebp - 0x554]
call fcn.1000fd6e
xor ecx, ecx
mov dword [ebp - 0x10], ecx
jmp 0x10015301
mov byte [ebp - 0x31], cl
cmp byte [ebp - 0x31], 0
je 0x100152fe
push ecx
push ecx
call dword [sym.imp.USER32.dll_CopyRect]
xor ecx, ecx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffff9
jge 0x100152eb
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x1b
jne 0x10015236
mov dword [ebp - 0x20], 0xffffffff
lea ecx, [ebp - 0x634]
push 2
call fcn.1000f19e
xor edx, edx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], edx
jmp 0x10015345
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x634]
mov dword [eax + ecx*4], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10015336
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], edx
jl 0x1001536f
mov byte [ebp - 0x31], dl
cmp byte [ebp - 0x31], 0
je 0x1001536a
push 0x13d2
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edx, edx
dec dword [ebp - 0x28]
jns 0x10015353
lea ecx, [ebp - 0x634]
call fcn.1000fd6e
push 3
lea ecx, [ebp - 0x7a4]
call fcn.1000f19e
and dword [ebp - 4], 0
lea ecx, [ebp - 0x704]
push 2
call fcn.1000f19e
xor edx, edx
mov dword [ebp - 0x28], 0xffffffff
mov dword [ebp - 0x1c], edx
jmp 0x100153b9
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x704]
mov dword [eax + ecx*4], 5
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x100153a6
mov dword [ebp - 0x28], esi
cmp dword [ebp - 0x28], edx
jl 0x100153e5
mov byte [ebp - 0x31], dl
cmp byte [ebp - 0x31], 0
je 0x100153e0
push edx
push 0x23ee
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor edx, edx
dec dword [ebp - 0x28]
jns 0x100153c7
lea ecx, [ebp - 0x704]
call fcn.1000fd6e
push 3
mov dword [ebp - 0x1c], 0
pop edx
jmp 0x1001540f
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x7a4]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x100153fc
movdqa xmm0, xmmword [0x10008080]
lea ecx, [ebp - 0x7d8]
push ecx
lea eax, [ebp - 0x7c8]
push eax
push ecx
lea ecx, [ebp - 0x14c]
movdqu xmmword [ebp - 0x7d8], xmm0
call fcn.1002267b
mov dword [ebp - 0x20], 0xffffffff
xor edx, edx
mov dword [ebp - 0x60], 0x196e86ff
mov dword [ebp - 0x1c], edx
jmp 0x10015460
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x98], edx
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 2
jl 0x10015453
mov dword [ebp - 0x94], edx
cmp dword [ebp - 0x94], 3
jg 0x100156a8
jmp 0x1001547d
xor edx, edx
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x2c], 0x6fc75dfc
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x14c]
cmp dword [eax + ecx*4], edx
je 0x1001553b
mov dword [ebp - 0x24], 0xf0ed1ad6
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x24], edx
jne 0x100154f4
mov ecx, dword [ebp - 0x94]
xor edx, edx
mov eax, dword [ebp - 0x14c]
cmp dword [eax + ecx*4], 0xfffffffb
setg dl
add edx, 0x71c097bc
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x14c]
mov eax, dword [ebp - 0x24]
cmp eax, dword [ecx + edx*4]
jle 0x100154f4
xor eax, eax
jmp 0x100154f6
mov eax, esi
mov edx, dword [ebp - 0x60]
imul edx, eax
mov eax, dword [ebp - 0x14c]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, dword [eax + 8]
setge cl
cmp ecx, dword [ebp - 0x24]
jge 0x10015518
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x60]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x94]
mov edx, dword [ebp - 0x94]
mov ecx, dword [ebp - 0x14c]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
jmp 0x1001568f
mov dword [ebp - 0x10], 0xfe3d2f55
mov dword [ebp - 0x3c], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xfffffffa
jge 0x1001568f
push 3
pop esi
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x30], 0xe38b13f4
mov dword [ebp - 0x14], edx
jmp 0x10015676
push 4
mov dword [ebp - 0x1c], edx
pop ecx
jmp 0x1001558a
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x6dc], 0xfffffff6
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x10015579
inc dword [ebp - 0x24]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14c]
cmp dword [eax + ecx*4], edx
je 0x1001561b
mov dword [ebp - 0x28], 0xffffffff
xor edx, edx
mov dword [ebp - 0x30], 0xcec8167b
mov eax, dword [ebp - 0x94]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14c]
push 3
cmp dword [eax + ecx*4], 0xbad9
setge dl
mov dword [ebp - 0x30], edx
xor edx, edx
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x6d4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14c]
mov dword [eax + ecx*4], esi
mov eax, dword [ebp - 0x10]
sub esi, eax
sub esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
cmp esi, eax
mov eax, dword [ebp - 0x10]
setne dl
xor ecx, ecx
cmp edx, eax
pop esi
setne cl
mov dword [ebp - 0x30], ecx
jmp 0x10015671
cmp dword [ebp - 0x30], edx
jne 0x1001567f
mov dword [ebp - 0x20], esi
cmp dword [ebp - 0x20], edx
jl 0x10015673
push 4
pop edi
mov ecx, dword [ebp - 0x94]
mov eax, dword [ebp - 0x14c]
mov edx, dword [eax + ecx*4]
mov eax, dword [ebp - 0x2c]
neg edx
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setge cl
cmp ecx, edi
sbb edx, edx
inc edx
imul edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*4 - 0x6dc]
mov eax, dword [ebp - 0x20]
sub ecx, edx
mov dword [ebp + eax*4 - 0x6dc], ecx
dec dword [ebp - 0x20]
jns 0x1001562b
xor edx, edx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jle 0x10015571
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffa
jl 0x1001555b
xor esi, esi
inc esi
inc dword [ebp - 0x94]
cmp dword [ebp - 0x94], 3
jle 0x1001547b
mov edi, dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
lea ecx, [ebp - 0x14c]
call fcn.1000fd6e
movdqa xmm0, xmmword [0x10008070]
lea ecx, [ebp - 0x7f8]
push ecx
lea eax, [ebp - 0x7e8]
mov dword [ebp - 0x20], 0xfffffff6
push eax
mov dword [ebp - 0x10], 0x73ff82ff
push ecx
mov dword [ebp - 0x14], 0x244c
lea ecx, [ebp - 0x584]
mov dword [ebp - 0x20], 0xa52b4b5a
movdqu xmmword [ebp - 0x7f8], xmm0
call fcn.1002267b
xor ecx, ecx
mov byte [ebp - 4], 1
push 3
mov dword [ebp - 0x1c], ecx
pop edx
jmp 0x10015718
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x134], 0x951e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10015707
cmp dword [ebp - 0x130], ecx
jne 0x1001576c
cmp dword [ebp - 0x14], ecx
je 0x10015730
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x134]
xor edx, edx
mov eax, dword [ebp - 0x12c]
cmp eax, ecx
mov ecx, dword [ebp - 0x14]
setge dl
lea eax, [edx + 0x1eca6c84]
imul ecx, eax
sub ecx, dword [ebp - 0x134]
mov eax, dword [ebp - 0x130]
neg ecx
sbb ecx, ecx
inc ecx
add eax, ecx
jne 0x1001576a
xor ecx, ecx
mov edx, ecx
jmp 0x1001576f
xor ecx, ecx
xor edx, edx
inc edx
mov dword [ebp - 0x10], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x134]
setle cl
mov edx, dword [ebp - 0x134]
sub esi, ecx
sub esi, eax
xor ecx, ecx
mov eax, dword [ebp - 0x130]
imul edx, esi
cmp edx, eax
setne cl
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x14], 0
jmp 0x100158cb
push 2
lea ecx, [ebp - 0x56c]
call fcn.1000f19e
mov dword [ebp - 0x60], 1
xor edx, edx
mov dword [ebp - 0x60], 6
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], edx
jmp 0x100157e6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x56c]
mov dword [eax + ecx*4], 0x3728
inc dword [ebp - 0x1c]
push 2
pop ecx
cmp dword [ebp - 0x1c], ecx
jl 0x100157d3
mov dword [ebp - 0x20], edx
jmp 0x10015828
mov eax, dword [ebp - 0x14]
cmp dword [ebp + eax*4 - 0x134], edx
jne 0x1001582d
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], edx
jl 0x10015825
mov ecx, dword [ebp - 0x584]
mov dword [ebp - 0x2c], 3
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x10]
mov dword [ecx + 8], eax
dec dword [ebp - 0x10]
jns 0x1001580d
push 2
pop ecx
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], ecx
jle 0x100157f3
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], edx
jl 0x100158bd
mov esi, dword [ebp - 0x584]
mov eax, dword [ebp - 0x56c]
mov dword [ebp - 0x24], 0x4707
cmp dword [eax], edx
jne 0x10015856
mov eax, dword [ebp - 0x134]
mov dword [ebp - 0x60], 0xe9f81a77
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], edx
je 0x1001586b
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
setle dl
cmp edx, dword [ebp - 0x14]
jle 0x1001588b
xor edx, edx
cmp dword [ebp - 0x24], edx
jne 0x1001588d
mov eax, edx
jmp 0x10015890
xor edx, edx
xor eax, eax
inc eax
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [esi + 8], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], 1
mov byte [ebp - 0x31], dl
cmp byte [ebp - 0x31], 0
je 0x100158b8
push edx
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
xor edx, edx
dec dword [ebp - 0x10]
jns 0x1001583f
lea ecx, [ebp - 0x56c]
call fcn.1000fd6e
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jle 0x100157ae
lea ecx, [ebp - 0x584]
mov byte [ebp - 4], 0
call fcn.1000fd6e
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], 0
jl 0x10015c29
push 1
lea ecx, [ebp - 0x628]
call fcn.1000f19e
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x1001591c
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x628]
mov dword [eax + ecx*4], 0xea7
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10015909
mov byte [ebp - 0x31], dl
cmp byte [ebp - 0x31], dl
je 0x10015947
push 0x1a70
push 0x21de
push 0x3e9
push 0x1527
push edx
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
xor edx, edx
mov byte [ebp - 0x31], dl
cmp byte [ebp - 0x31], 0
je 0x10015957
push edx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x628]
call fcn.1000fd6e
mov dword [ebp - 0x24], 0x5b57fd54
mov dword [ebp - 0x24], 0
jmp 0x100159bc
push 1
lea ecx, [ebp - 0x2c0]
call fcn.1000f19e
xor edx, edx
mov dword [ebp - 0x1c], edx
jmp 0x10015999
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c0]
mov dword [eax + ecx*4], 0xc7c8a6b9
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10015986
lea ecx, [ebp - 0x2c0]
cmp dword [ebp - 0x24], edx
jne 0x100159c4
mov eax, dword [ebp - 0x2c0]
cmp dword [eax], edx
jne 0x100159c4
call fcn.1000fd6e
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0x16
jle 0x10015972
jmp 0x100159c9
call fcn.1000fd6e
push 3
pop esi
mov byte [ebp - 0x15], 0
lea ecx, [ebp - 0x59c]
push esi
call fcn.1000f19e
mov byte [ebp - 4], 2
mov eax, 0xec46bc22
mov dword [ebp - 0x2e4], eax
xor edx, edx
mov dword [ebp - 0x2e0], eax
mov dword [ebp - 0x2dc], eax
mov dword [ebp - 0x2d8], eax
mov dword [ebp - 0x1c], edx
jmp 0x10015a17
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x59c]
mov dword [eax + ecx*4], 0x313dd33a
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10015a04
mov esi, dword [ebp - 0x59c]
mov dword [esi + 4], edx
mov dword [ebp - 0x10], 0xd97a888a
mov dword [ebp - 0x10], 0x14
jmp 0x10015a55
mov byte [ebp - 0x31], dl
cmp byte [ebp - 0x31], 0
je 0x10015a52
push edx
push 0xa61
push edx
push 0x141d
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor edx, edx
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xfffffffc
je 0x10015a35
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0xd
je 0x10015b70
push 2
lea ecx, [ebp - 0x38c]
call fcn.1000f19e
push 2
mov dword [ebp - 0x60], 0x3ac25417
pop edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x1c], 0
jmp 0x10015a9e
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x38c]
mov dword [eax + ecx*4], 0x77045b3
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10015a8b
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x2d8]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp ecx, eax
mov eax, dword [ebp - 0x38c]
setne dl
xor ecx, ecx
mov eax, dword [eax]
sub eax, edx
cmp eax, 0x6fa4
setle cl
mov dword [ebp - 0x60], ecx
mov eax, dword [ebp - 0x60]
sub eax, dword [esi + 4]
cmp eax, 0x413053bf
je 0x10015ae3
mov eax, dword [ebp - 0x2e0]
mov eax, dword [ebp - 0x10]
xor ecx, ecx
test eax, eax
sets cl
cmp ecx, dword [ebp - 0x2d8]
jg 0x10015b00
xor eax, eax
cmp dword [esi + 4], eax
jne 0x10015b00
mov ecx, eax
jmp 0x10015b03
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x10]
add eax, ecx
xor ecx, ecx
cmp eax, 0x57bc7756
setg cl
xor eax, eax
test ecx, ecx
setg al
xor edx, edx
cmp eax, 0x3535
mov eax, dword [ebp - 0x10]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
add ecx, dword [ebp - 0x10]
cmp ecx, 0xb739032
jne 0x10015b43
cmp dword [ebp - 0x10], 0
je 0x10015b43
xor edx, edx
inc edx
jmp 0x10015b45
xor edx, edx
mov eax, dword [ebp - 0x38c]
xor ecx, ecx
cmp edx, dword [eax + 4]
setle cl
mov dword [ebp - 0x2c], ecx
lea ecx, [ebp - 0x38c]
call fcn.1000fd6e
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xd
jne 0x10015a68
xor edx, edx
inc dword [esi + 4]
cmp dword [esi + 4], 0x14
jle 0x10015a25
lea ecx, [ebp - 0x59c]
mov byte [ebp - 4], dl
call fcn.1000fd6e
cmp byte [ebp - 0x15], 0
je 0x10015c20
mov dword [ebp - 0x4c], 0xdb58e469
xor ecx, ecx
mov dword [ebp - 0x4c], 0x7ad95e17
xor edx, edx
mov dword [ebp - 0x60], 0xfffffffe
inc edx
mov dword [ebp - 0x1c], ecx
jmp 0x10015bc5
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x668], 0xbf390197
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], edx
jl 0x10015bb4
inc dword [ebp - 0x60]
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], cl
je 0x10015c0c
push 0xfcf
push 0x3a
push 0x1d9b
push 0x481
push 0x25c0
push 0x18e4
push 0x248c
push 0x257e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
call dword [sym.imp.GDI32.dll_Arc]
xor ecx, ecx
push ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call ebx
push eax
push 0
push 0x152d
call edi
dec dword [ebp - 0x20]
jns 0x100158f5
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x7a4]
call fcn.1000fd6e
xor ecx, ecx
mov dword [ebp - 0x4c], 0x7f825e7a
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], cl
je 0x10015c58
push 0xa53
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
mov byte [ebp - 0x15], cl
cmp byte [ebp - 0x15], 0
je 0x10015c6c
push ecx
push ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor ecx, ecx
mov dword [ebp - 0x24], 0x8d327cb3
mov dword [ebp - 0x4c], 0xc3707822
push 4
pop edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x4c], 0xe3edfa83
mov dword [ebp - 0x20], 0x5d36
push 3
mov dword [ebp - 0x4c], 0x1b76e1ee
mov dword [ebp - 0x1c], ecx
pop esi
jmp 0x10015cb1
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x860], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10015ca0
mov dword [ebp - 0x2c], 0x15ee
cmp dword [ebp - 0x2c], 0x1307
jge 0x10015d6a
movsd xmm0, qword [0x10008000]
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.100509d4
fadd qword [0x10007fe8]
push 0x106baae8
push 0x106baaf0
push 0x100079a0
fmul qword [0x10007fe0]
fstp qword [ebp - 0x50]
call fcn.1004fe8b
add esp, 0x14
test eax, eax
je 0x10015d68
mov ecx, dword [0x106baaf0]
mov eax, ecx
mov edx, dword [0x106baaf4]
or eax, edx
je 0x10015d62
mov edi, dword [0x106baae8]
mov eax, edi
mov ebx, dword [0x106baaec]
or eax, ebx
je 0x10015d62
cmp ecx, edi
jne 0x10015dc7
cmp edx, ebx
jne 0x10015dc9
push 0x100079ac
call fcn.100507b6
pop ecx
push 0x106baae8
push 0x106baaf0
push 0x100079a0
call fcn.1004fe8b
add esp, 0xc
test eax, eax
jne 0x10015d08
push 3
pop esi
push 4
pop edi
xor ecx, ecx
mov ebx, dword [sym.imp.KERNEL32.dll_VirtualQuery]
cmp dword [ebp - 0x24], ecx
je 0x10015eef
push 2
lea ecx, [ebp - 0x720]
call fcn.1000f19e
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x640]
or edi, 0xffffffff
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x4c], edi
mov dword [ebp - 0x4c], 0x1cb4e76a
mov dword [ebp - 0x4c], 0xde0980db
push esi
call fcn.1000f19e
xor edx, edx
mov dword [ebp - 0x60], 0x41ce3cb5
mov dword [ebp - 0x14], edx
jmp 0x10015e7b
cmp edx, ebx
jl 0x10015df0
jg 0x10015dd1
cmp ecx, edi
jbe 0x10015df0
mov eax, ecx
mov esi, edx
mov ecx, edi
mov dword [0x106baae8], eax
mov edx, ebx
mov dword [0x106baaf0], ecx
mov dword [0x106baaf4], edx
mov dword [0x106baaec], esi
add ecx, 1
adc edx, 0
call fcn.1006924f
mulsd xmm0, qword [ebp - 0x50]
push ecx
push ecx
movsd qword [esp], xmm0
call fcn.10051070
mov edx, dword [0x106baaf4]
pop ecx
pop ecx
mov ecx, dword [0x106baaf0]
fstp qword [ebp - 0x48]
call fcn.1006924f
movsd xmm1, qword [ebp - 0x48]
subsd xmm1, xmm0
subsd xmm1, qword [0x10007fe8]
cvttsd2si eax, xmm1
cdq
add eax, dword [0x106baaf0]
adc edx, dword [0x106baaf4]
cmp edx, dword [0x106baaec]
jl 0x10015d3c
jg 0x10015e5e
cmp eax, dword [0x106baae8]
jb 0x10015d3c
push 0x100079b8
jmp 0x10015d41
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x720]
mov dword [eax + ecx*4], 0xe7d214c4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x10015e68
mov dword [ebp - 0x14], edx
jmp 0x10015e99
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x640]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10015e86
mov dword [ebp - 0x24], edx
jmp 0x10015ec8
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x10015ec5
push 0x1e2b
push 0x786
push edx
push 0x4cd
push edx
call dword [sym.imp.USER32.dll_GetMenuStringW]
xor edx, edx
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
jge 0x10015ea3
inc dword [ebp - 0x60]
lea ecx, [ebp - 0x640]
call fcn.1000fd6e
lea ecx, [ebp - 0x720]
mov dword [ebp - 4], edi
call fcn.1000fd6e
jmp 0x10016050
mov dword [ebp - 0x2c], 0x23dd
mov dword [ebp - 0x14], ecx
jmp 0x10015f2e
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x1c], ecx
jmp 0x10015f25
mov dword [ebp - 0x20], ecx
jmp 0x10015f1d
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x860], 0x2e26595a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x10015f0c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 6
jg 0x10015f07
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffeb
jg 0x10015efb
mov byte [ebp - 0x15], cl
mov dword [ebp - 0x2c], 0x18e8
cmp dword [ebp - 0x2c], 0x135f
jge 0x10016041
lea eax, [ebp - 0x128]
mov dword [ebp - 0x9c], ecx
push eax
lea eax, [ebp - 0x9c]
mov dword [ebp - 0x128], ecx
push eax
push 0x100079c4
call fcn.1004fe8b
mov eax, dword [ebp - 0x9c]
add esp, 0xc
xor ecx, ecx
inc eax
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1004b53a
xor edx, edx
mov esi, eax
pop ecx
mov ecx, dword [ebp - 0x9c]
inc edx
mov eax, edx
cmp ecx, edx
jl 0x10015fab
and dword [esi + eax*4], 0
inc eax
mov ecx, dword [ebp - 0x9c]
cmp eax, ecx
jle 0x10015f9c
xor eax, eax
mov edi, eax
cmp dword [ebp - 0x128], eax
jle 0x1001601b
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1b0], eax
mov dword [ebp - 0xf0], eax
lea eax, [ebp - 0xf0]
push eax
lea eax, [ebp - 0x1b0]
push eax
lea eax, [ebp - 0x1e0]
push eax
push 0x100079cc
call fcn.1004fe8b
mov ecx, dword [ebp - 0x1e0]
add esp, 0x10
mov eax, dword [ebp - 0xf0]
sub dword [esi + ecx*4], eax
mov ecx, dword [ebp - 0x1b0]
mov eax, dword [ebp - 0xf0]
push 0
add dword [esi + ecx*4], eax
inc edi
pop eax
cmp edi, dword [ebp - 0x128]
jl 0x10015fb7
mov ecx, dword [ebp - 0x9c]
mov edx, eax
xor eax, eax
inc eax
cmp ecx, eax
jl 0x10016032
cmp dword [esi + eax*4], 0
jle 0x1001602d
add edx, dword [esi + eax*4]
inc eax
cmp eax, ecx
jle 0x10016024
push edx
push 0x10007888
call fcn.1005018c
pop ecx
pop ecx
xor ecx, ecx
cmp byte [ebp - 0x15], 0
je 0x10016050
push 0x1a74
push ecx
push ecx
call ebx
mov edi, 0x7f825e7a
xor eax, eax
mov dword [ebp - 0x4c], edi
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], al
je 0x10016071
push 0xa53
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor eax, eax
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
je 0x10016083
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov dword [ebp - 0x2c], 0x1abd
mov esi, 0x1000785c
cmp dword [ebp - 0x2c], 0x1165
jge 0x1001615b
lea eax, [ebp - 0x1c4]
push eax
push esi
call fcn.1004fe8b
lea eax, [ebp - 0x1cc]
push eax
push esi
call fcn.1004fe8b
mov ecx, dword [ebp - 0x1cc]
add esp, 0x10
mov eax, dword [ebp - 0x1c4]
xor esi, esi
add eax, eax
movd xmm1, ecx
cvtdq2pd xmm1, xmm1
movsd qword [ebp - 0x50], xmm1
test eax, eax
jle 0x1001613b
lea eax, [ebp - 0x1a4]
push eax
push 0x1000785c
call fcn.1004fe8b
mov eax, dword [ebp - 0x1a4]
pop ecx
pop ecx
cmp eax, 1
jne 0x10016109
push 0x10007884
call fcn.100507b6
mov eax, dword [ebp - 0x1a4]
pop ecx
movd xmm1, eax
dec eax
cvtdq2pd xmm1, xmm1
inc esi
movd xmm0, eax
mulsd xmm1, qword [ebp - 0x50]
mov eax, dword [ebp - 0x1c4]
cvtdq2pd xmm0, xmm0
add eax, eax
divsd xmm1, xmm0
movsd qword [ebp - 0x50], xmm1
cmp esi, eax
jl 0x100160da
mov ecx, dword [ebp - 0x1cc]
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
push ecx
push ecx
subsd xmm1, xmm0
movsd qword [esp], xmm1
push 0x100079d8
call fcn.1005018c
add esp, 0xc
push 1
lea ecx, [ebp - 0x650]
call fcn.1000f19e
xor edx, edx
mov dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x1c], edx
jmp 0x10016186
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x650]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 1
jl 0x10016176
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], edx
jl 0x100161b8
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x100161b3
push edx
push edx
push 0x2c3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor edx, edx
dec dword [ebp - 0x20]
jns 0x10016194
mov dword [ebp - 0x20], 0x11
jmp 0x100161db
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x100161d8
push 0xa35
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor edx, edx
dec dword [ebp - 0x20]
cmp dword [ebp - 0x20], 0xffffffe8
jne 0x100161c1
lea ecx, [ebp - 0x650]
call fcn.1000fd6e
mov eax, dword [0x1007068c]
xor edx, edx
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x10], 0xcec79e67
mov dword [ebp - 0x28], 0xf592
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x30], 0x40a16501
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
imul eax, dword [ebp - 0x24]
cmp eax, 0x2d2c87a7
jle 0x1001622d
cmp dword [ebp - 0x10], edx
je 0x1001622d
xor ecx, ecx
inc ecx
jmp 0x1001622f
mov ecx, edx
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x30]
cmp dword [ebp - 0x28], eax
jne 0x10016292
cmp dword [ebp - 0x10], edx
je 0x10016292
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x1001625b
push edx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
xor edx, edx
push 3
pop esi
mov dword [ebp - 0x24], 0x8d327cb3
mov dword [ebp - 0x4c], 0xc3707822
push 4
pop eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x4c], 0xe3edfa83
mov dword [ebp - 0x20], 0x5d36
mov dword [ebp - 0x4c], 0x1b76e1ee
mov dword [ebp - 0x1c], edx
jmp 0x1001634a
push 3
mov dword [ebp - 0x1c], edx
pop esi
jmp 0x100162ab
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x164], 2
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x1001629a
mov dword [ebp - 0x10], edx
jmp 0x100162c4
mov eax, dword [ebp - 0x10]
cmp dword [ebp + eax*4 - 0x164], edx
jne 0x100162ca
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x100162b5
cmp dword [ebp - 0x164], edx
je 0x100162d8
mov eax, dword [ebp - 0x15c]
mov eax, dword [ebp - 0x164]
xor ecx, ecx
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x24]
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x30]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x160]
mov eax, dword [ebp - 0x164]
mov eax, dword [ebp - 0x24]
cmp eax, 0x9191
mov eax, dword [ebp - 0x10]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x15c]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
add ecx, 6
xor edx, edx
mov dword [ebp - 0x24], ecx
jmp 0x1001625e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x878], 0xfffffffb
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], esi
jl 0x10016339
cmp dword [ebp - 0x24], edx
je 0x10016431
push 2
lea ecx, [ebp - 0x664]
call fcn.1000f19e
push 4
pop eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x780]
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x4c], 0x1cb4e76a
mov dword [ebp - 0x4c], 0xde0980db
push esi
call fcn.1000f19e
xor ebx, ebx
mov dword [ebp - 0x30], 0x41ce3cb5
mov dword [ebp - 0x14], ebx
jmp 0x100163c2
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x664]
mov dword [eax + ecx*4], 0xe7d214c4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100163af
mov dword [ebp - 0x14], ebx
jmp 0x100163e0
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x780]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x100163cd
mov dword [ebp - 0x24], ebx
jmp 0x1001640c
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], bl
je 0x10016409
push 0x1e2b
push 0x786
push ebx
push 0x4cd
push ebx
call dword [sym.imp.USER32.dll_GetMenuStringW]
inc dword [ebp - 0x24]
cmp dword [ebp - 0x24], 0xf
jge 0x100163ea
inc dword [ebp - 0x30]
lea ecx, [ebp - 0x780]
call fcn.1000fd6e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x664]
call fcn.1000fd6e
jmp 0x1001648a
mov dword [ebp - 0x2c], 0x23dd
mov dword [ebp - 0x14], edx
jmp 0x10016470
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x1c], edx
jmp 0x10016467
mov dword [ebp - 0x20], edx
jmp 0x1001645f
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x878], 0x2e26595a
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], esi
jl 0x1001644e
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 6
jg 0x10016449
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xffffffeb
jg 0x1001643d
mov byte [ebp - 0x15], dl
cmp byte [ebp - 0x15], 0
je 0x10016488
push 0x1a74
push edx
push edx
call ebx
xor ebx, ebx
mov dword [ebp - 0x10], 0xeaa32b1c
lea ecx, [ebp - 0x220]
push 1
call fcn.1000f19e
xor edx, edx
mov dword [ebp - 0x2c], 0xfffffffa
inc edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x3c], 0xfffffff7
mov dword [ebp - 0x14], ebx
jmp 0x100164ca
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x220]
mov dword [eax + ecx*4], 0xe81d534a
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edx
jl 0x100164b7
mov dword [ebp - 0x14], ebx
jmp 0x100164e5
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x400], 4
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x100164d4
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x10]
jge 0x100164fc
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov eax, dword [ebp - 0x10]
test eax, eax
mov eax, dword [ebp - 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, dword [ebp - 0x10]
jl 0x1001651b
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], ebx
je 0x10016526