Function at 0x10040d20
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100ae933
mov eax, dword fs:[0]
push eax
sub esp, 0x6b0
mov eax, dword [0x100db688]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push 0x2a
push esi
mov dword [ebp - 0x698], eax
mov dword [ebp - 0x694], esi
call fcn.1008238e
add esp, 8
test eax, eax
je 0x10040d77
add eax, 2
mov dword [ebp - 0x694], eax
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x1004282a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x67c], eax
push str.ExpRunTrayIconDll
lea ecx, [ebp - 0x67c]
mov dword [ebp - 4], 0
call fcn.100075c0
test al, al
jne 0x10040dc3
push 0x11
push str.ExpRunTrayIconDll
lea ecx, [ebp - 0x67c]
call fcn.10007260
mov dword [ebp - 4], 1
mov dword [ebp - method.LdsCommon::CMyLdsLogger.virtual_0], vtable.LdsCommon::CMyLdsLogger.0
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x10042834
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x6b8], eax
mov byte [ebp - 4], 2
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x1004283e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x6b4], eax
mov byte [ebp - 4], 3
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x10042848
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x6b0], eax
mov byte [ebp - 4], 4
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x10042852
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x6ac], eax
lea eax, [ebp - 0x67c]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp - 0x6b8]
call fcn.100074b0
lea ecx, [ebp - 0x6b0]
call fcn.100131e0
push 3
push 0x100ba2d4
lea ecx, [ebp - 0x6b4]
call fcn.10007260
mov edx, dword [ebp - 0x67c]
or edi, 0xffffffff
mov byte [ebp - 4], 7
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10040eb3
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
push 0x208
lea eax, [ebp - 0x4ac]
push 0
push eax
call fcn.10081e40
add esp, 0xc
lea eax, [ebp - 0x4ac]
push 0x104
push eax
push dword [0x100ded8c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x4ac]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x1004285c
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x6a4], eax
lea eax, [ebp - 0x4ac]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x6a4]
call fcn.100075c0
test al, al
jne 0x10040f52
lea ecx, [ebp - 0x4ac]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10040f30
sub ecx, edx
lea eax, [ebp - 0x4ac]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x6a4]
call fcn.10007260
mov byte [ebp - 4], 9
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x10042866
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x69c], eax
push 0x100ba538
lea ecx, [ebp - 0x69c]
mov byte [ebp - 4], 0xa
call fcn.100075c0
test al, al
jne 0x10040f9f
push 1
push 0x100ba538
lea ecx, [ebp - 0x69c]
call fcn.10007260
mov byte [ebp - 4], 0xb
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x10042870
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x6a0], eax
push 0x100ba53c
lea eax, [ebp - 0x6a4]
mov byte [ebp - 4], 0xc
push eax
lea eax, [ebp - 0x6a8]
push eax
call fcn.10009ed0
lea eax, [ebp - 0x67c]
mov byte [ebp - 4], 0xd
push eax
lea eax, [ebp - 0x4c4]
mov dword [ebp - 0x67c], 0
push eax
mov dword [ebp - 0x4c4], 0x360033
mov dword [ebp - 0x4c0], 0x740030
mov dword [ebp - 0x4bc], 0x610072
mov dword [ebp - 0x4b8], 0x2e0079
mov dword [ebp - 0x4b4], 0x780065
mov dword [ebp - 0x4b0], 0x65
call fcn.1002d520
mov esi, eax
mov dword [ebp - 0x67c], 0
lea eax, [ebp - 0x67c]
mov dword [ebp - 0x4d8], 0x360033
push eax
lea eax, [ebp - 0x4d8]
mov dword [ebp - 0x4d4], 0x730030
push eax
mov dword [ebp - 0x4d0], 0x2e0064
mov dword [ebp - 0x4cc], 0x780065
mov dword [ebp - 0x4c8], 0x65
call fcn.1002d520
add esp, 0x1c
test esi, esi
jne 0x1004109b
test eax, eax
je 0x1004127d
mov ecx, dword [ebp - 0x698]
mov ecx, dword [ecx + 0x38]
test ecx, ecx
je 0x1004127d
call fcn.1003fe10
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.100906ed
add esp, 4
call fcn.100906cc
cdq
mov ecx, 0x64
idiv ecx
cmp edx, esi
jl 0x1004127d
mov esi, dword [ebp - 0x698]
cmp dword [esi + 0x38], 0
je 0x100411e9
call fcn.100609e0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x100411e9
mov ecx, dword [esi + 0x38]
call fcn.10023eb0
push 0x56
push str.d:jenkins.jenkinsworkspacepop_popex_poppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 0x688], eax
mov dword [ebp - 0x4cc], 0
mov dword [ebp - 0x4c8], 0xf
mov byte [ebp - 0x4dc], 0
call fcn.1000bdb0
push 3
push 0x100b3af0
lea ecx, [ebp - 0x4c4]
mov byte [ebp - 4], 0x13
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4b0], 0xf
mov byte [ebp - 0x4c4], 0
call fcn.1000bdb0
mov byte [ebp - 4], 0x14
call fcn.100609e0
mov edi, eax
lea ecx, [ebp - 0x574]
push 0xf2
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x4c4]
push eax
call fcn.100090e0
mov esi, eax
push str.taskid:_d_no_rand_trayicon
push esi
mov byte [ebp - 4], 0x15
call fcn.10008960
add esp, 8
mov ecx, esi
push dword [ebp - 0x688]
call fcn.10010b30
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x574]
call fcn.10009fa0
lea ecx, [ebp - 0x4c4]
call fcn.10006b60
lea ecx, [ebp - 0x4dc]
mov byte [ebp - 4], 0xd
call fcn.10006b60
or edi, 0xffffffff
lea eax, [ebp - 0x688]
push 1
push eax
call fcn.1005cc90
add esp, 8
mov ecx, 0x100b8c78
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10041227
test dx, dx
je 0x10041223
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10041227
add eax, 4
add ecx, 4
test dx, dx
jne 0x10041201
xor esi, esi
jmp 0x1004122c
sbb esi, esi
or esi, 1
mov edx, dword [ebp - 0x688]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10041249
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x4ac]
test esi, esi
jne 0x1004125a
push str.rundll.exe
jmp 0x1004125f
push str.WpNotifyApp.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 7
push str._hdnone
lea ecx, [ebp - 0x69c]
call fcn.10011b10
jmp 0x10041552
lea eax, [ebp - 0x690]
push 1
push eax
call fcn.1005c1d0
lea eax, [ebp - 0x688]
mov byte [ebp - 4], 0xe
push eax
lea eax, [ebp - 0x6a0]
mov dword [ebp - 0x688], 0
push eax
lea eax, [ebp - 0x6a4]
push eax
push str.rd_notify
push dword [ebp - 0x690]
call fcn.1000a630
mov eax, dword [ebp - 0x698]
add esp, 0x1c
cmp dword [eax + 0x38], 0
je 0x1004142f
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x1004287a
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x67c], eax
mov eax, dword [ebp - 0x698]
push dword [ebp - 0x6a0]
mov byte [ebp - 4], 0xf
mov ecx, dword [eax + 0x38]
call fcn.10023eb0
push eax
lea eax, [ebp - 0x67c]
push str.taskid:_d_strRundllTmpFileLink:_s
push eax
call fcn.10006f50
add esp, 0x10
call fcn.100609e0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov esi, dword [ebp - 0x67c]
movzx eax, al
sub eax, 1
jne 0x10041414
push 0x56
push str.d:jenkins.jenkinsworkspacepop_popex_poppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x4dc]
mov dword [ebp - 0x4cc], 0
mov dword [ebp - 0x4c8], 0xf
mov byte [ebp - 0x4dc], 0
call fcn.1000bdb0
push 3
push 0x100b3af0
lea ecx, [ebp - 0x4c4]
mov byte [ebp - 4], 0x10
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4b0], 0xf
mov byte [ebp - 0x4c4], 0
call fcn.1000bdb0
mov byte [ebp - 4], 0x11
call fcn.100609e0
mov dword [ebp - 0x680], eax
lea ecx, [ebp - 0x574]
push 0xbb
lea eax, [ebp - 0x4dc]
push eax
lea eax, [ebp - 0x4c4]
push eax
call fcn.100090e0
mov edi, eax
test esi, esi
mov byte [ebp - 4], 0x12
mov ecx, 0x100b39f4
cmovne ecx, esi
push ecx
push edi
call fcn.10008960
mov ecx, dword [ebp - 0x680]
add esp, 8
mov eax, dword [ecx]
push edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x574]
call fcn.10009fa0
lea ecx, [ebp - 0x4c4]
call fcn.10006b60
lea ecx, [ebp - 0x4dc]
call fcn.10006b60
or edi, 0xffffffff
mov byte [ebp - 4], 0xe
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1004142f
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x67c]
push 1
push eax
call fcn.1005cc90
add esp, 8
mov ecx, 0x100b8c78
mov eax, dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004146d
test dx, dx
je 0x10041469
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004146d
add eax, 4
add ecx, 4
test dx, dx
jne 0x10041447
xor esi, esi
jmp 0x10041472
sbb esi, esi
or esi, 1
mov edx, dword [ebp - 0x67c]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004148f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x4ac]
test esi, esi
jne 0x100414a0
push str.rundll.exe
jmp 0x100414a5
push str.WpNotifyApp.exe
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
push 0
push dword [ebp - 0x6a0]
lea eax, [ebp - 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x10041514
mov esi, dword [ebp - 0x6a0]
lea ecx, [ebp - 0x4ac]
mov eax, ecx
mov edx, 0x104
sub esi, eax
nop word [eax + eax]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x100414fe
movzx eax, word [ecx + esi]
test ax, ax
je 0x100414fe
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x100414e0
test edx, edx
lea eax, [ecx - 2]
push 5
cmovne eax, ecx
xor ecx, ecx
push str._hdok
mov word [eax], cx
jmp 0x10041526
lea ecx, [ebp - 0x6a0]
call fcn.100131e0
push 7
push str._hdfail
lea ecx, [ebp - 0x69c]
call fcn.10011b10
mov edx, dword [ebp - 0x690]
mov eax, edi
mov byte [ebp - 4], 0xd
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10041552
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x4ac]
push eax
call fcn.10049a60
add esp, 4
test eax, eax
jne 0x1004158f
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x6bc]
push str.fail_check_sign_s
push eax
call fcn.10040d10
add esp, 0xc
mov dword [ebp - 0x680], 0
jmp 0x1004274c
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x10042884
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x690], eax
push dword [ebp - 0x694]
lea eax, [ebp - 0x690]
mov byte [ebp - 4], 0x16
push str.RunTrayIcon
push dword [ebp - 0x6a8]
push str.__dll__s____entry_s__s
push eax
call fcn.10006f50
lea eax, [ebp - 0x688]
push 1
push eax
call fcn.1005cc90
add esp, 0x1c
mov ecx, 0x100b8c78
mov eax, dword [eax]
nop dword [eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10041616
test dx, dx
je 0x10041612
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10041616
add eax, 4
add ecx, 4
test dx, dx
jne 0x100415f0
xor esi, esi
jmp 0x1004161b
sbb esi, esi
or esi, 1
mov edx, dword [ebp - 0x688]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10041638
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test esi, esi
je 0x100416d9
lea ecx, [ebp - 0x544]
call fcn.10032670
mov eax, dword [ebp - 0x690]
push str.cmd_line
mov byte [ebp - 4], 0x17
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
lea ecx, [ebp - 0x544]
call fcn.10033000
push 0
lea ecx, [ebp - 0x544]
call fcn.100438f0
push eax
lea ecx, [ebp - 0x678]
call fcn.1000f930
push dword [ebp - 0x678]
lea eax, [ebp - 0x4ac]
mov byte [ebp - 4], 0x18
push eax
lea eax, [ebp - 0x690]
push str.__s____param_s
push eax
call fcn.10006f50
mov eax, dword [ebp - 0x678]
lea ecx, [ebp - 0x674]
add esp, 0x10
cmp eax, ecx
je 0x100416c8
push eax
call fcn.10088bae
add esp, 4
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 0x16
call fcn.10032800
jmp 0x1004172c
mov eax, dword [ebp - 0x690]
add eax, 0xfffffff0
push eax
call fcn.10006d00
lea esi, [eax + 0x10]
mov dword [ebp - 0x684], esi
push esi
lea eax, [ebp - 0x4ac]
mov byte [ebp - 4], 0x19
push eax
lea eax, [ebp - 0x690]
push str.__s___s
push eax
call fcn.10006f50
add esp, 0x14
mov byte [ebp - 4], 0x16
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1004172c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x698]
mov dword [ebp - 0x67c], 0
mov ecx, dword [eax + 0x38]
call fcn.10023eb0
mov dword [ebp - 0x688], eax
lea eax, [ebp - 0x688]
push eax
call fcn.10028570
mov ecx, eax
call fcn.10024700
mov esi, dword [ebp - 0x690]
cmp dword [esi - 4], 1
jle 0x1004177d
push dword [esi - 0xc]
lea ecx, [ebp - 0x690]
call fcn.10006ed0
mov esi, dword [ebp - 0x690]
xorps xmm0, xmm0
mov dword [ebp - 0x680], 0
xor eax, eax
movlpd qword [ebp - 0x7c], xmm0
mov word [ebp - 0x3e], ax
mov eax, 1
movlpd qword [ebp - 0x74], xmm0
movlpd qword [ebp - 0x6c], xmm0
movlpd qword [ebp - 0x64], xmm0
movlpd qword [ebp - 0x5c], xmm0
movlpd qword [ebp - 0x4e], xmm0
movlpd qword [ebp - 0x46], xmm0
movups xmmword [ebp - 0x4d4], xmm0
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 0x81
mov word [ebp - 0x50], ax
call fcn.100139a0
mov dword [ebp - 0x688], eax
test eax, eax
je 0x10041862
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
jne 0x10041802
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10041856
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10041856
lea ecx, [ebp - 0x4d4]
push ecx
lea ecx, [ebp - 0x80]
push ecx
push 0
push 0
push 0
push esi
push 0
push 0
push dword [ebp - 0x688]
call eax
test eax, eax
je 0x10041856
push dword [ebp - 0x4d0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4d4]
mov dword [ebp - 0x67c], eax
mov dword [ebp - 0x680], 1
push dword [ebp - 0x688]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [esi - 8]
push esi
call fcn.100887e2
add esp, 8
test eax, eax
js 0x10042820
cmp eax, dword [esi - 8]
jg 0x10042820
xor ecx, ecx
mov dword [esi - 0xc], eax
mov word [esi + eax*2], cx
mov eax, dword [ebp - 0x680]
test eax, eax
je 0x100418d0
cmp dword [ebp - 0x67c], ecx
je 0x10041e20
mov eax, dword [ebp - 0x698]
mov ecx, dword [eax + 0x38]
call fcn.10023eb0
push dword [ebp - 0x67c]
mov dword [ebp - 0x688], eax
lea eax, [ebp - 0x688]
push eax
call fcn.10028570
mov ecx, eax
call fcn.100248c0
jmp 0x10041e1a
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x1004288e
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x67c], eax
push dword [ebp - 0x694]
lea eax, [ebp - 0x67c]
mov byte [ebp - 4], 0x1a
push str.RunTrayIcon
push dword [ebp - 0x6a8]
push str.__dll__s____entry_s__s
push eax
call fcn.10006f50
lea eax, [ebp - 0x4c8]
push 1
push eax
call fcn.1005cc90
add esp, 0x1c
mov dword [ebp - 0x688], eax
mov ecx, dword [eax]
mov byte [ebp - 4], 0x1b
mov ecx, dword [ecx - 0x10]
test ecx, ecx
je 0x10041946
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, eax
test ecx, ecx
jne 0x1004195e
call fcn.10007040
mov ecx, eax
mov edx, dword [eax]
mov eax, dword [edx + 0x10]
call eax
mov ecx, eax
test ecx, ecx
je 0x10042898
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x680], eax
push str.home
lea ecx, [ebp - 0x680]
mov byte [ebp - 4], 0x1c
call fcn.100075c0
test al, al
jne 0x10041996
push str.home
lea ecx, [ebp - 0x680]
call fcn.10040bb0
mov eax, dword [ebp - 0x680]
mov byte [ebp - 4], 0x1b
test eax, eax
je 0x100428a2
mov ecx, dword [ebp - 0x688]
mov edx, eax
mov ecx, dword [ecx]
mov si, word [ecx]
cmp si, word [edx]
mov esi, dword [ebp - 0x690]
jne 0x100419f9
cmp word [ecx], 0
je 0x100419ed
mov si, word [ecx + 2]
cmp si, word [edx + 2]
mov word [ebp - 0x692], si
mov esi, dword [ebp - 0x690]
jne 0x100419f9
add ecx, 4
add edx, 4
cmp word [ebp - 0x692], 0
jne 0x100419b2
mov dword [ebp - 0x688], 0
jmp 0x10041a04
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x688], ecx
lea edx, [eax - 0x10]
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10041a1b
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4c8]
mov eax, edi
mov byte [ebp - 4], 0x1a
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10041a3c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x688], 0
je 0x10041ad9
lea ecx, [ebp - 0x544]
call fcn.10032670
mov eax, dword [ebp - 0x67c]
push str.cmd_line
mov byte [ebp - 4], 0x1d
mov ecx, dword [eax - 0xc]
lea ecx, [ecx*2 + 2]
push ecx
push eax
lea ecx, [ebp - 0x544]
call fcn.10033000
push 0
lea ecx, [ebp - 0x544]
call fcn.100438f0
push eax
lea ecx, [ebp - 0x678]
call fcn.1000f930
push dword [ebp - 0x678]
lea eax, [ebp - 0x67c]
mov byte [ebp - 4], 0x1e
push str.__param_s
push eax
call fcn.10006f50
mov eax, dword [ebp - 0x678]
lea ecx, [ebp - 0x674]
add esp, 0xc
cmp eax, ecx
je 0x10041aca
push eax
call fcn.10088bae
add esp, 4
lea ecx, [ebp - 0x544]
mov byte [ebp - 4], 0x1a
call fcn.10032800
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x100428ac
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x694], eax
mov edi, dword [ebp - 0x67c]
push edi
mov byte [ebp - 4], 0x1f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x694]
push str.LastError:_d__cmd_s
push eax
call fcn.10006f50
add esp, 0x10
call fcn.100609e0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10041c08
push 0x56
push str.d:jenkins.jenkinsworkspacepop_popex_poppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], al
call fcn.1000bdb0
push 3
push 0x100b3af0
lea ecx, [ebp - 0x4c4]
mov byte [ebp - 4], 0x20
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4b0], 0xf
mov byte [ebp - 0x4c4], 0
call fcn.1000bdb0
mov byte [ebp - 4], 0x21
call fcn.100609e0
mov dword [ebp - 0x4c8], eax
lea ecx, [ebp - 0x574]
push 0x171
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4c4]
push eax
call fcn.100090e0
mov dword [ebp - 0x688], eax
mov ecx, dword [ebp - 0x694]
mov edx, 0x100b39f4
test ecx, ecx
mov byte [ebp - 4], 0x22
cmovne edx, ecx
push edx
push eax
call fcn.10008960
mov ecx, dword [ebp - 0x4c8]
add esp, 8
mov eax, dword [ecx]
push dword [ebp - 0x688]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x574]
call fcn.10009fa0
lea ecx, [ebp - 0x4c4]
call fcn.10006b60
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x1f
call fcn.10006b60
xorps xmm0, xmm0
mov dword [ebp - 0x60], 0
lea eax, [ebp - 0x4ac]
movlpd qword [ebp - 0x58], xmm0
push 0
movlpd qword [ebp - 0x50], xmm0
movlpd qword [ebp - 0x48], xmm0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x78], 0x3c
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x74], 0x1140
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x5c], 5
mov dword [ebp - 0x6c], 0x100b91d8
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
mov dword [ebp - 0x680], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push eax
mov dword [ebp - 0x684], eax
lea eax, [ebp - 0x694]
push str.ShellExecuteEx_api__errcode_lu__hRet_d
push eax
call fcn.10006f50
add esp, 0x10
call fcn.100609e0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov edi, dword [ebp - 0x694]
movzx eax, al
sub eax, 1
jne 0x10041d82
push 0x56
push str.d:jenkins.jenkinsworkspacepop_popex_poppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4b0], 0xf
mov byte [ebp - 0x4c4], 0
call fcn.1000bdb0
push 3
push 0x100b3af0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x23
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.1000bdb0
mov byte [ebp - 4], 0x24
call fcn.100609e0
mov dword [ebp - 0x4c8], eax
lea ecx, [ebp - 0x574]
push 0x186
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100090e0
mov dword [ebp - 0x688], eax
test edi, edi
mov byte [ebp - 4], 0x25
mov ecx, 0x100b39f4
cmovne ecx, edi
push ecx
push eax
call fcn.10008960
mov ecx, dword [ebp - 0x4c8]
add esp, 8
mov eax, dword [ecx]
push dword [ebp - 0x688]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x574]
call fcn.10009fa0
lea ecx, [ebp - 0x2c]
call fcn.10006b60
lea ecx, [ebp - 0x4c4]
mov byte [ebp - 4], 0x1f
call fcn.10006b60
push dword [ebp - 0x680]
lea eax, [ebp - 0x6bc]
push dword [ebp - 0x684]
push str.ShellExecuteEx_api__errcode_lu__hRet_d
push eax
call fcn.10040d10
add esp, 0x10
cmp dword [ebp - 0x680], 0
je 0x10041ddb
cmp dword [ebp - 0x40], 0
je 0x10041ddb
mov eax, dword [ebp - 0x698]
mov ecx, dword [eax + 0x38]
call fcn.10023eb0
push dword [ebp - 0x40]
mov dword [ebp - 0x684], eax
lea eax, [ebp - 0x684]
push eax
call fcn.10028570
mov ecx, eax
call fcn.100248c0
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0x1a
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10041df9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x67c]
mov eax, edi
mov byte [ebp - 4], 0x16
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10041e1a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x680]
test eax, eax
jne 0x10042595
push 0x208
push eax
lea eax, [ebp - 0x2a4]
push eax
call fcn.10081e40
add esp, 0xc
lea eax, [ebp - 0x2a4]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x2a4]
push eax
call edi
lea eax, [ebp - 0x2a4]
push eax
call edi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x9c]
push eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x9c], 0x70006c
push eax
mov dword [ebp - 0x98], 0x5c0069
mov dword [ebp - 0x94], 0x700048
mov dword [ebp - 0x90], 0x760053
mov dword [ebp - 0x8c], 0x2e0063
mov dword [ebp - 0x88], 0x6c0064
mov dword [ebp - 0x84], 0x6c
call edi
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10041f31
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x70006c
push eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2c], 0x5c0069
push eax
mov dword [ebp - 0x28], 0x700057
mov dword [ebp - 0x24], 0x760053
mov dword [ebp - 0x20], 0x2e0063
mov dword [ebp - 0x1c], 0x6c0064
mov dword [ebp - 0x18], 0x6c
call edi
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10041f9a
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x70006c
push eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2c], 0x5c0069
push eax
mov dword [ebp - 0x28], 0x6d0054
mov dword [ebp - 0x24], 0x760053
mov dword [ebp - 0x20], 0x2e0063
mov dword [ebp - 0x1c], 0x6c0064
mov dword [ebp - 0x18], 0x6c
call edi
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10042003
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x70006c
push eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x2c], 0x5c0069
push eax
mov dword [ebp - 0x28], 0x6d0043
mov dword [ebp - 0x24], 0x760053
mov dword [ebp - 0x20], 0x2e0063
mov dword [ebp - 0x1c], 0x6c0064
mov dword [ebp - 0x18], 0x6c
call edi
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10042080
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor eax, eax
mov dword [ebp - 0x38], 0x70006c
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x34], 0x5c0069
push eax
mov dword [ebp - 0x30], 0x59004d
mov dword [ebp - 0x2c], 0x6f004e
mov dword [ebp - 0x28], 0x650076
mov dword [ebp - 0x24], 0x53006c
mov dword [ebp - 0x20], 0x630076
mov dword [ebp - 0x1c], 0x64002e
mov dword [ebp - 0x18], 0x6c006c
call edi
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100420f0
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x34]
mov dword [ebp - 0x34], 0x70006c
push eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x30], 0x5c0069
push eax
mov dword [ebp - 0x2c], 0x610048
mov dword [ebp - 0x28], 0x6f006c
mov dword [ebp - 0x24], 0x760053
mov dword [ebp - 0x20], 0x2e0063
mov dword [ebp - 0x1c], 0x6c0064
mov dword [ebp - 0x18], 0x6c
call edi
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1004216d
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor eax, eax
mov dword [ebp - 0x38], 0x70006c
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x34], 0x5c0069
push eax
mov dword [ebp - 0x30], 0x780059
mov dword [ebp - 0x2c], 0x470068
mov dword [ebp - 0x28], 0x6d0061
mov dword [ebp - 0x24], 0x530065
mov dword [ebp - 0x20], 0x630076
mov dword [ebp - 0x1c], 0x64002e
mov dword [ebp - 0x18], 0x6c006c
call edi
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100421f1
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
xor eax, eax
mov dword [ebp - 0x3c], 0x70006c
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2a4]
mov dword [ebp - 0x38], 0x5c0069
push eax
mov dword [ebp - 0x34], 0x65004c
mov dword [ebp - 0x30], 0x6f0079
mov dword [ebp - 0x2c], 0x470075
mov dword [ebp - 0x28], 0x6d0061
mov dword [ebp - 0x24], 0x530065
mov dword [ebp - 0x20], 0x630076
mov dword [ebp - 0x1c], 0x64002e
mov dword [ebp - 0x18], 0x6c006c
call edi
call fcn.10007040
mov ecx, eax
test ecx, ecx
je 0x100428b6
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x688], eax
lea eax, [ebp - 0x2a4]
mov byte [ebp - 4], 0x26
push eax
lea eax, [ebp - 0x528]
mov dword [ebp - 0x528], 0x64004c
push eax
lea eax, [ebp - 0x688]
mov dword [ebp - 0x524], 0x5f0073
push eax
mov dword [ebp - 0x520], 0x610043
mov dword [ebp - 0x51c], 0x6c006c
mov dword [ebp - 0x518], 0x75004c
mov dword [ebp - 0x514], 0x610064
mov dword [ebp - 0x510], 0x680073
mov dword [ebp - 0x50c], 0x530069
mov dword [ebp - 0x508], 0x720065
mov dword [ebp - 0x504], 0x690076
mov dword [ebp - 0x500], 0x650063
mov dword [ebp - 0x4fc], 0x780045
mov dword [ebp - 0x4f8], 0x730020
mov dword [ebp - 0x4f4], 0x53007a
mov dword [ebp - 0x4f0], 0x630076
mov dword [ebp - 0x4ec], 0x610050
mov dword [ebp - 0x4e8], 0x680074
mov dword [ebp - 0x4e4], 0x25003d
mov dword [ebp - 0x4e0], 0x73
call fcn.10006f50
add esp, 0xc
call fcn.100609e0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov edi, dword [ebp - 0x688]
movzx eax, al
sub eax, 1
jne 0x100423de
push 0x56
push str.d:jenkins.jenkinsworkspacepop_popex_poppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 0x4b4], 0
mov dword [ebp - 0x4b0], 0xf
mov byte [ebp - 0x4c4], 0
call fcn.1000bdb0
push 3
push 0x100b3af0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x27
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.1000bdb0
mov byte [ebp - 4], 0x28
call fcn.100609e0
mov dword [ebp - 0x684], eax
lea ecx, [ebp - 0x60c]
push 0x1ea
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100090e0
mov dword [ebp - 0x4c8], eax
test edi, edi
mov byte [ebp - 4], 0x29
mov ecx, 0x100b39f4
cmovne ecx, edi
push ecx
push eax
call fcn.10008960
mov ecx, dword [ebp - 0x684]
add esp, 8
mov eax, dword [ecx]
push dword [ebp - 0x4c8]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x60c]
call fcn.10009fa0
lea ecx, [ebp - 0x2c]
call fcn.10006b60
lea ecx, [ebp - 0x4c4]
mov byte [ebp - 4], 0x26
call fcn.10006b60
lea eax, [ebp - 0x2a4]
push eax
call fcn.10049a60
add esp, 4
test eax, eax
jne 0x1004241e
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0x16
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004240f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 0x680], 0
jmp 0x10042731
lea eax, [ebp - 0x2a4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x4c8], eax
mov dword [ebp - 0x67c], 0
test eax, eax
jne 0x10042449
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10042495
push str.CLSE
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x684], eax
test eax, eax
jne 0x1004246c
push 0x490
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10042495
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp - 0x67c]
push eax
push str.processid
push esi
lea eax, [ebp - 0x4ac]
push eax
push str.createprocess
call dword [ebp - 0x684]
mov eax, dword [ebp - 0x67c]
xor ecx, ecx
push eax
push dword [ebp - 0x4c8]
test eax, eax
mov dword [ebp - 0x7c], 0x64004c
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x78], 0x5f0073
push eax
lea eax, [ebp - 0x6bc]
mov dword [ebp - 0x74], 0x610043
setne cl
mov dword [ebp - 0x70], 0x6c006c
push eax
mov dword [ebp - 0x680], ecx
mov dword [ebp - 0x6c], 0x75004c
mov dword [ebp - 0x68], 0x610064
mov dword [ebp - 0x64], 0x680073
mov dword [ebp - 0x60], 0x530069
mov dword [ebp - 0x5c], 0x720065
mov dword [ebp - 0x58], 0x690076
mov dword [ebp - 0x54], 0x650063
mov dword [ebp - 0x50], 0x780045
mov dword [ebp - 0x4c], 0x250028
mov dword [ebp - 0x48], 0x290070
mov dword [ebp - 0x44], 0x25003d
mov dword [ebp - 0x40], 0x75
call fcn.10040d10
add esp, 0x10
cmp dword [ebp - 0x680], 0
je 0x10042571
cmp dword [ebp - 0x67c], 0
je 0x10042571
mov eax, dword [ebp - 0x698]
mov ecx, dword [eax + 0x38]
call fcn.10023eb0
push dword [ebp - 0x67c]
mov dword [ebp - 0x684], eax
lea eax, [ebp - 0x684]
push eax
call fcn.10028570
mov ecx, eax
call fcn.100248f0
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0x16
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004258f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x680]
test eax, eax
mov ecx, str._exfail
mov edx, str._exok
cmove edx, ecx
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x684], eax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100425b0
sub ecx, dword [ebp - 0x684]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x69c]
call fcn.10011b10
mov byte [ebp - 0x691], 0
lea eax, [ebp - 0x4cc]
mov byte [ebp - 4], 0x2a
push eax
call fcn.100451f5
lea eax, [ebp - 0x4cc]
mov dword [ebp - 0x68c], eax
lea eax, [ebp - 0x691]
mov dword [ebp - 0x688], eax
lea eax, [ebp - 0x68c]
push eax
push 0x1000d4e0
push 0x100deb14
call fcn.1004549a
add esp, 0x10
test eax, eax
je 0x100427fc
lea eax, [ebp - 0x4cc]
mov byte [ebp - 4], 0x2c
push eax
call fcn.1004522f
mov eax, dword [0x100deb10]
add esp, 4
mov byte [ebp - 4], 0x16
mov ecx, dword [eax]
push 1
push 0
push dword [ebp - 0x69c]
push 0x100b3ec8
push eax
call dword [ecx]
call fcn.100609e0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10042731
push 0x56
push str.d:jenkins.jenkinsworkspacepop_popex_poppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x4c4]
mov dword [ebp - 0x4b4], eax
mov dword [ebp - 0x4b0], 0xf
mov byte [ebp - 0x4c4], al
call fcn.1000bdb0
push 3
push 0x100b3af0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0x2f
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
call fcn.1000bdb0
mov byte [ebp - 4], 0x30
call fcn.100609e0
mov dword [ebp - 0x684], eax
lea ecx, [ebp - 0x60c]
push 0x206
lea eax, [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.100090e0
mov edi, eax
push str.Start_by_rundll._bSuccess
push edi
mov byte [ebp - 4], 0x31
call fcn.10008960
add esp, 8
mov ecx, edi
push dword [ebp - 0x680]
call fcn.10010b30
mov ecx, dword [ebp - 0x684]
push edi
mov eax, dword [ecx]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x60c]
call fcn.10009fa0
lea ecx, [ebp - 0x2c]
call fcn.10006b60
lea ecx, [ebp - 0x4c4]
call fcn.10006b60
or edi, 0xffffffff
mov byte [ebp - 4], 0xd
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1004274c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6a8]
mov eax, edi
mov byte [ebp - 4], 0xc
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004276d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x6a0]
mov eax, edi
mov byte [ebp - 4], 0xb
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004278e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x69c]
mov eax, edi
mov byte [ebp - 4], 9
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100427af
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x6a4]
mov byte [ebp - 4], 7
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x100427ce
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x6bc]
call fcn.10040b00
mov eax, dword [ebp - 0x680]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061c7c
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x4cc]
mov byte [ebp - 4], 0x2d
push eax
call fcn.10045250
add esp, 4
mov byte [ebp - 4], 0x2b
test al, al
je 0x100428d6
jmp 0x100428c0
push 0x80070057
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
push 0x80004005
call fcn.10006cd0
sub esp, 8
lea eax, [ebp - 0x4cc]
mov ecx, esp
push eax
call fcn.10007950
call fcn.10008920
call fcn.100454b2
int3