Function at 0x10019fc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e1bc3
mov eax, dword fs:[0]
push eax
sub esp, 0xc20
mov eax, dword [0x10104008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xbf8], ecx
mov eax, dword [ebp + 0x14]
mov ecx, 0x101080e9
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0xc04], esi
mov dword [ebp - 0xc10], eax
call fcn.100de193
mov eax, dword [ebp - 0xbf8]
cmp dword [eax + 4], 0
je 0x1001a1d6
mov byte [edi], 0
lea ecx, [ebp - 0x7c0]
mov eax, dword [eax + 4]
add eax, 0x24
mov dword [ebp - 0xc00], eax
call fcn.10006990
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov ecx, dword [ebp - 0xc00]
mov dword [ebp - 0xc08], eax
lea eax, [ebp - 0x7c0]
push eax
push dword [ebp + 8]
call fcn.10007f00
test al, al
jne 0x1001a1dd
cmp dword [0x101063a0], 0
je 0x1001a12d
push 0
mov ecx, 0x101063a0
call fcn.10034e30
mov eax, dword [0x101063a0]
cmp byte [eax + 0x54], 0
je 0x1001a12d
cmp dword [eax + 0x58], 2
jb 0x1001a12d
mov al, byte [eax + 0x5c]
mov byte [ebp - 0xbf1], al
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
push 0x13
push str.can_not_find_record
call fcn.10004bc0
push 0x280
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
push 2
call fcn.100357b0
cmp byte [ebp - 0xbf1], 0
je 0x1001a11e
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004b60
call edi
sub eax, dword [ebp - 0xc08]
cmp eax, 0x1388
jbe 0x1001a1d6
push 3
mov ecx, 0x101063a0
call fcn.10035760
mov esi, eax
test esi, esi
je 0x1001a1cb
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x28]
push 0x1b
push str.rebuild_quarantine_database
call fcn.10004bc0
push 0x284
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
push 3
call fcn.100357b0
cmp esi, 1
jbe 0x1001a1bc
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10004b60
mov ecx, dword [ebp - 0xc00]
call fcn.10006fa0
xor al, al
jmp 0x1001afca
mov eax, dword [ebp - 0xc14]
movups xmm0, xmmword [ebp - 0x5a8]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
movups xmmword [eax], xmm0
xor eax, eax
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 7
mov word [ebp - 0x4c], ax
mov dword [ebp - 4], 2
mov ecx, dword [esi + 0x10]
test ecx, ecx
je 0x1001a230
lea eax, [ebp - 0x4c]
cmp eax, esi
je 0x1001a25f
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x1001a255
mov eax, dword [esi]
jmp 0x1001a255
lea ecx, [ebp - 0x7bc]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001a240
sub ecx, edx
lea eax, [ebp - 0x7bc]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x4c]
call fcn.10004bc0
xor eax, eax
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 7
mov word [ebp - 0x94], ax
mov byte [ebp - 4], 3
lea edx, [ebp - 0x94]
lea ecx, [ebp - 0x4c]
call fcn.10027870
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0xf4]
call fcn.100269d0
mov byte [ebp - 4], 4
lea edx, [ebp - 0x4c]
lea ecx, [ebp - 0xdc]
call fcn.100267f0
mov byte [ebp - 4], 5
xorps xmm0, xmm0
lea ecx, [ebp - 0x64]
mov edi, 1
movups xmmword [ebp - 0x64], xmm0
call fcn.1001e790
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x1001a2eb
cmp dword [ebp - 0x58], 0
jne 0x1001a2eb
lea ecx, [ebp - 0x58]
push ecx
call eax
lea ecx, [ebp - 0x4c]
call fcn.10026340
test al, al
je 0x1001a3f3
nop dword [eax + eax]
cmp edi, 0x100
jae 0x1001a3ed
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xdc]
cmp dword [ebp - 0xc8], 8
lea eax, [ebp - 0xf4]
cmovae ecx, dword [ebp - 0xdc]
cmp dword [ebp - 0xe0], 8
push ecx
cmovae eax, dword [ebp - 0xf4]
push edi
push eax
lea eax, [ebp - 0x28]
push str._s__d__s
push eax
call fcn.10027670
lea eax, [ebp - 0x28]
inc edi
push eax
lea edx, [ebp - 0x94]
lea ecx, [ebp - 0xc2c]
call fcn.10029960
add esp, 0x18
mov esi, eax
mov byte [ebp - 4], 8
lea eax, [ebp - 0x4c]
cmp eax, esi
je 0x1001a3bc
mov ecx, eax
call fcn.10004b60
movups xmm0, xmmword [esi]
xor eax, eax
movups xmmword [ebp - 0x4c], xmm0
movq xmm0, qword [esi + 0x10]
movq qword [ebp - 0x3c], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0xc2c]
call fcn.10004b60
mov eax, dword [ebp - 0x30]
mov byte [eax], 1
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.10004b60
lea ecx, [ebp - 0x4c]
call fcn.10026340
test al, al
jne 0x1001a300
mov esi, dword [ebp - 0xc04]
lea eax, [ebp - 0x4c]
cmp esi, eax
je 0x1001a40d
cmp dword [ebp - 0x38], 8
mov ecx, esi
push dword [ebp - 0x3c]
cmovae eax, dword [ebp - 0x4c]
push eax
call fcn.10004bc0
lea edx, [ebp - 0x7bc]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x1001a416
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x7bc]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.10004bc0
xor eax, eax
mov dword [ebp - 0x18], 0
lea ecx, [ebp - 0x598]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001a460
sub ecx, edx
lea eax, [ebp - 0x598]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.10004bc0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x28]
call fcn.10026340
mov byte [ebp - 0xbf1], al
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.10004b60
cmp byte [ebp - 0xbf1], 0
jne 0x1001a54c
push 2
mov ecx, 0x101063a0
call fcn.10035760
mov esi, eax
test esi, esi
je 0x1001a52f
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x28]
push 0x1d
push str.RestoreQuarantineFile_failed_
call fcn.10004bc0
push 0x2ab
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
push 2
call fcn.100357b0
cmp esi, 1
jbe 0x1001a523
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.10004b60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc00]
push 1
push eax
call fcn.10007aa0
mov byte [ebp - 0xbf1], 0
jmp 0x1001af7c
lea ecx, [ebp - 0x94]
call fcn.100265d0
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x1001a563
push dword [ebp - 0x58]
call eax
lea ecx, [ebp - 0xac]
call fcn.1002b950
mov byte [ebp - 4], 0xb
mov edx, 0x100ef164
lea ecx, [ebp - 0xac]
call fcn.10027220
mov edx, 0x100ef164
lea ecx, [ebp - 0xac]
call fcn.10027290
xor eax, eax
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 7
mov word [ebp - 0x7c], ax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xac]
mov eax, dword [ebp - 0xbf8]
cmp dword [ebp - 0x98], 8
cmovae ecx, dword [ebp - 0xac]
mov eax, dword [eax + 4]
add eax, 0x40
cmp dword [eax + 0x14], 8
jb 0x1001a5e0
mov eax, dword [eax]
push ecx
push eax
lea eax, [ebp - 0x7c]
push 0x100ef17c
push eax
call fcn.10027670
add esp, 0x10
lea eax, [ebp - 0x598]
xor esi, esi
xor edi, edi
mov dword [ebp - 0xc04], esi
push esi
push eax
call fcn.10004520
mov dword [ebp - 0xc08], eax
test eax, eax
je 0x1001a638
mov edx, dword [eax]
mov ecx, eax
mov edx, dword [edx + 0xc]
call edx
mov ecx, dword [ebp - 0xc08]
mov edi, eax
mov edx, dword [ecx]
mov edx, dword [edx + 4]
call edx
mov dword [ebp - 0x5b0], eax
mov dword [ebp - 0x5ac], edx
cmp dword [ebp - 0x68], 8
lea eax, [ebp - 0x7c]
mov byte [ebp - 0xbf1], 1
cmovae eax, dword [ebp - 0x7c]
push eax
call fcn.10004860
mov dword [ebp - 0xc0c], eax
test eax, eax
je 0x1001a66b
mov edx, dword [eax]
mov ecx, eax
mov edx, dword [edx + 0x10]
call edx
mov esi, eax
mov dword [ebp - 0xc04], eax
test edi, edi
jne 0x1001a7b4
push 2
mov ecx, 0x101063a0
call fcn.10035760
mov dword [ebp - 0x30], eax
test eax, eax
je 0x1001a6ee
xor eax, eax
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x28]
push 0x18
push str.Open_source_file_failed_
call fcn.10004bc0
push 0x2cf
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
push 2
call fcn.100357b0
cmp dword [ebp - 0x30], 1
jbe 0x1001a6e2
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.10004b60
push 4
mov ecx, 0x101063a0
call fcn.10035760
mov dword [ebp - 0x30], eax
test eax, eax
je 0x1001a775
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x28]
push 0x2a
push str.Remove_database_because_source_file_missed
call fcn.10004bc0
push 0x2d0
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
push 4
call fcn.100357b0
cmp dword [ebp - 0x30], 1
jbe 0x1001a769
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.10004b60
lea eax, [ebp - 0x598]
mov byte [ebp - 0xbf1], 0
push eax
lea ecx, [ebp - 0x28]
call fcn.10004af0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x28]
call fcn.10033330
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.10004b60
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc00]
push 1
push eax
call fcn.10007aa0
test esi, esi
jne 0x1001a83e
push 2
mov ecx, 0x101063a0
call fcn.10035760
mov dword [ebp - 0x30], eax
test eax, eax
je 0x1001a837
xor eax, eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x28]
push 0x18
push str.Create_temp_file_failed_
call fcn.10004bc0
push 0x2da
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
push 2
call fcn.100357b0
cmp dword [ebp - 0x30], 1
jbe 0x1001a82b
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x28]
call fcn.10004b60
mov byte [ebp - 0xbf1], 0
lea eax, [ebp - 0x598]
push eax
lea ecx, [ebp - 0x28]
call fcn.10004af0
mov byte [ebp - 4], 0x11
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xc4]
call fcn.100267f0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x28]
call fcn.10004b60
cmp dword [ebp - 0xb0], 8
lea ecx, [ebp - 0xc4]
mov edx, dword [ebp - 0xb4]
cmovae ecx, dword [ebp - 0xc4]
push 3
push 0x100ef690
call fcn.1000ae70
add esp, 8
mov ecx, 1
test eax, eax
mov eax, 0
cmove eax, ecx
mov dword [ebp - 0x30], eax
test esi, esi
je 0x1001ac20
test edi, edi
je 0x1001ac20
xorps xmm0, xmm0
lea ecx, [ebp - 0x54]
movlpd qword [ebp - 0x54], xmm0
call fcn.10002a00
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x54]
call fcn.10002b80
cmp dword [ebp - 0x30], 1
jne 0x1001aa36
push 0x10105ef0
push 0x100000
mov dword [ebp - 0x34], 0
call fcn.100dcf2b
mov ecx, eax
add esp, 8
mov dword [ebp - 0x2c], ecx
test ecx, ecx
jne 0x1001a916
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x54]
call fcn.10002ae0
mov byte [ebp - 0xbf1], 0
jmp 0x1001af52
mov eax, dword [edi]
lea edx, [ebp - 0x34]
push edx
push 0x100000
push ecx
mov eax, dword [eax + 4]
mov ecx, edi
call eax
test eax, eax
jne 0x1001aa2e
mov esi, dword [ebp - 0x34]
test esi, esi
je 0x1001aa2e
mov eax, dword [ebp - 0xbf8]
mov eax, dword [eax + 4]
cmp byte [eax], 0
jne 0x1001a9a2
mov ecx, dword [ebp - 0x50]
mov edx, dword [ebp - 0x2c]
push esi
mov ecx, dword [ecx]
call fcn.10025c30
mov ecx, dword [ebp - 0xc04]
lea edx, [ebp - 0x30]
add esp, 4
mov eax, dword [ecx]
push edx
push esi
push dword [ebp - 0x2c]
call dword [eax]
cmp dword [ebp - 0x30], esi
jne 0x1001a993
mov eax, dword [edi]
lea ecx, [ebp - 0x34]
push ecx
push 0x100000
push dword [ebp - 0x2c]
mov eax, dword [eax + 4]
mov ecx, edi
call eax
test eax, eax
je 0x1001a931
push dword [ebp - 0x2c]
jmp 0x1001ac0c
push dword [ebp - 0x2c]
mov byte [ebp - 0xbf1], 0
jmp 0x1001ac0c
push 5
mov ecx, 0x101063a0
mov byte [ebp - 0xbf1], 0
call fcn.10035760
mov esi, eax
test esi, esi
je 0x1001aa2e
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x15
lea ecx, [ebp - 0x28]
push 8
push 0x100ef698
call fcn.10004bc0
push 0x2fe
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
push 5
call fcn.100357b0
cmp esi, 1
jbe 0x1001aa22
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x28]
call fcn.10004b60
push dword [ebp - 0x2c]
jmp 0x1001ac0c
mov eax, dword [edi]
mov ecx, edi
mov eax, dword [eax]
call eax
mov dword [ebp - 0xbf8], eax
inc eax
push 0x10105ef0
push eax
mov dword [ebp - 0x2c], eax
call fcn.100dcf2b
add esp, 8
mov dword [ebp - 0x34], eax
test eax, eax
jne 0x1001aaf2
push 2
mov ecx, 0x101063a0
call fcn.10035760
mov esi, eax
test esi, esi
je 0x1001aae6
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x28]
push 0x19
push str.Failed_to_Allocate_buffer
call fcn.10004bc0
push 0x317
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
push 2
call fcn.100357b0
cmp esi, 1
jbe 0x1001aada
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x28]
call fcn.10004b60
mov byte [ebp - 0xbf1], 0
jmp 0x1001ac14
push dword [ebp - 0x2c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, dword [edi]
lea ecx, [ebp - 0x2c]
add esp, 0xc
mov dword [ebp - 0x2c], 0
push ecx
push dword [ebp - 0xbf8]
mov ecx, edi
push dword [ebp - 0x34]
call dword [eax + 4]
mov eax, dword [ebp - 0xbf8]
cmp eax, dword [ebp - 0x2c]
jne 0x1001ac02
push dword [ebp - 0x30]
lea ecx, [ebp - 0xbf8]
mov dword [ebp - 0xbf8], 0
push ecx
push eax
push dword [ebp - 0x34]
lea ecx, [ebp - 0x54]
call fcn.10002d80
mov edi, eax
test edi, edi
je 0x1001ab7d
mov edx, dword [esi]
lea eax, [ebp - 0x30]
mov esi, dword [ebp - 0xbf8]
mov ecx, dword [ebp - 0xc04]
push eax
push esi
push edi
call dword [edx]
push edi
lea ecx, [ebp - 0x54]
call fcn.10003750
cmp dword [ebp - 0x30], esi
je 0x1001ac09
jmp 0x1001ac02
push 2
mov ecx, 0x101063a0
call fcn.10035760
mov esi, eax
test esi, esi
je 0x1001ac02
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x28]
push 0x18
push str.Failed_to_DecompressData
call fcn.10004bc0
push 0x331
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
push 2
call fcn.100357b0
cmp esi, 1
jbe 0x1001abf6
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x28]
call fcn.10004b60
mov byte [ebp - 0xbf1], 0
push dword [ebp - 0x34]
call fcn.100dcb71
add esp, 4
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x54]
call fcn.10002ae0
mov esi, dword [ebp - 0xc08]
test esi, esi
je 0x1001ac3a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x14]
mov esi, dword [ebp - 0xc0c]
test esi, esi
je 0x1001ac54
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 0x14]
mov eax, dword [ebp - 0x5c]
test eax, eax
je 0x1001ac67
cmp dword [ebp - 0x58], 0
jne 0x1001ac67
lea ecx, [ebp - 0x58]
push ecx
call eax
cmp byte [ebp - 0xbf1], 0
je 0x1001af3e
push 0x10
mov dword [ebp - 0x2c], 0
call fcn.100dcb76
mov esi, eax
add esp, 4
mov dword [ebp - 0xc0c], esi
mov byte [ebp - 4], 0x18
mov ecx, esi
call fcn.10004e40
mov byte [ebp - 4], 0x19
push 4
call fcn.100dcb76
add esp, 4
mov dword [ebp - 0xc08], eax
mov byte [ebp - 4], 0x1a
mov dword [eax], 0
mov dword [eax], 0
mov byte [ebp - 4], 0x19
mov dword [esi + 8], eax
mov byte [ebp - 4], 0x1b
mov dword [esi + 0xc], 0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
call fcn.10015950
mov byte [ebp - 4], 0x1d
lea eax, [ebp - 0x4c]
mov esi, dword [ebp - 0xc10]
lea ecx, [ebp - 0x2c]
push esi
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.10014d90
test al, al
jne 0x1001adbe
push 2
mov ecx, 0x101063a0
call fcn.10035760
mov dword [ebp - 0xc0c], eax
test eax, eax
je 0x1001adb2
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x1e
lea edi, [ebp - 0x4c]
cmp dword [ebp - 0x38], 8
lea esi, [ebp - 0x7c]
cmovae edi, dword [ebp - 0x4c]
cmp dword [ebp - 0x68], 8
cmovae esi, dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push esi
push eax
lea eax, [ebp - 0x28]
push str.Restore_file_failed_with__d__s___s__
push eax
call fcn.10035c70
add esp, 0x14
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push 0x350
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
push eax
push 2
call fcn.100357b0
cmp dword [ebp - 0xc0c], 1
jbe 0x1001ada6
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x28]
call fcn.10004b60
mov byte [ebp - 0xbf1], 0
jmp 0x1001af32
cmp byte [ebp + 0xc], 0
je 0x1001afe7
push 0x84
lea eax, [ebp - 0x178]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x178]
call fcn.10016480
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xbf0]
call fcn.100161f0
cmp dword [ebp - 0x38], 8
lea esi, [ebp - 0x4c]
lea ecx, [ebp - 0xbe8]
mov edx, 0x104
cmovae esi, dword [ebp - 0x4c]
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1001ae32
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001ae32
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001ae12
jmp 0x1001ae36
test edx, edx
jne 0x1001ae39
sub ecx, 2
mov edi, dword [ebp - 0xc14]
lea esi, [ebp - 0x598]
xor eax, eax
mov edx, 0x104
mov word [ecx], ax
lea ecx, [ebp - 0x9d0]
mov eax, ecx
movups xmm0, xmmword [edi]
sub esi, eax
movups xmmword [ebp - 0x9e0], xmm0
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1001ae83
movzx eax, word [esi + ecx]
test ax, ax
je 0x1001ae83
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001ae63
jmp 0x1001ae87
test edx, edx
jne 0x1001ae8a
sub ecx, 2
xor eax, eax
mov word [ecx], ax
lea eax, [ebp - 0xc2c]
push eax
mov ecx, edi
call fcn.10006420
mov byte [ebp - 4], 0x20
cmp dword [eax + 0x14], 8
jb 0x1001aea9
mov eax, dword [eax]
lea ecx, [ebp - 0xbf0]
push ecx
push eax
lea ecx, [ebp - 0x178]
call fcn.10017490
mov byte [ebp - 4], 0x1f
lea ecx, [ebp - 0xc2c]
call fcn.10004b60
lea ecx, [ebp - 0x178]
call fcn.10017060
mov ecx, dword [ebp - 0xc00]
push 0
push dword [ebp + 8]
call fcn.10007aa0
mov byte [ebp - 0xbf1], al
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x178]
call fcn.10016560
mov esi, dword [ebp - 0xc10]
mov al, byte [ebp - 0xbf1]
test al, al
jne 0x1001af32
mov eax, dword [esi]
mov ecx, 0xc
cmp eax, 1
cmove eax, ecx
mov dword [esi], eax
mov eax, dword [esi + 4]
cmp eax, 1
cmove eax, ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 8]
cmp eax, 1
cmove eax, ecx
mov dword [esi + 8], eax
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x2c]
call fcn.10014bc0
lea ecx, [ebp - 0x7c]
call fcn.10033330
mov eax, dword [ebp - 0x60]
test eax, eax
je 0x1001af52
push dword [ebp - 0x58]
call eax
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0xc4]
call fcn.10004b60
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x7c]
call fcn.10004b60
mov byte [ebp - 4], 6
lea ecx, [ebp - 0xac]
call fcn.10004b60
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x64]
call fcn.1001e950
mov byte [ebp - 4], 4
lea ecx, [ebp - 0xdc]
call fcn.10004b60
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xf4]
call fcn.10004b60
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x94]
call fcn.10004b60
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10004b60
mov al, byte [ebp - 0xbf1]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100dcb60
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp - 0x598]
push eax
lea ecx, [ebp - 0x28]
call fcn.10004af0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x28]
call fcn.10033330
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x28]
call fcn.10004b60
lea eax, [ebp - 0x598]
push eax
lea ecx, [ebp - 0x28]
call fcn.10004af0
mov byte [ebp - 4], 0x22
lea ecx, [ebp - 0x28]
call fcn.10026340
mov byte [ebp - 0xbf9], al
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x28]
call fcn.10004b60
cmp byte [ebp - 0xbf9], 0
jne 0x1001af01
push 4
mov ecx, 0x101063a0
call fcn.10035760
mov esi, eax
test esi, esi
je 0x1001b0da
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x598]
push eax
lea eax, [ebp - 0x28]
push str.RestoreQuarantineFile_file___s
push eax
call fcn.10035c70
add esp, 0xc
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push 0x36e
push str.RC::RCTrojaneOperator::RestoreImpl
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotect_virusscan_srcgdoperate_rctrojaneoperator.cpp
push eax
push 4
call fcn.100357b0
cmp esi, 1
jbe 0x1001b0ce
lea eax, [ebp - 0x28]
mov ecx, 0x101063a0
push eax
call fcn.10035ae0
mov byte [ebp - 4], 0x1d
lea ecx, [ebp - 0x28]
call fcn.10004b60
mov ecx, dword [ebp - 0xc00]
push 1
push dword [ebp + 8]
call fcn.10007aa0
mov esi, dword [ebp - 0xc10]
mov byte [ebp - 0xbf1], al
jmp 0x1001af07