Function at 0x10016c30
Capabilities:
Check if file exists
Copy file
Create directory
Create process on windows
Delete file
Get common file path
Move file

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1011013f
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x11d0
call fcn.100cfdd0
mov eax, dword [0x10160068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10166724], 0
mov edi, dword [ebx + 8]
mov esi, dword [ebx + 0xc]
je 0x10016db3
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x10016db3
cmp dword [eax + 0x58], 4
jb 0x10016db3
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x11b5], al
xor eax, eax
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x10a4], 0
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x10a4], 7
mov word [ebp - 0x10b8], ax
mov dword [ebp - 4], eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x10016cf3
mov ecx, dword [esi]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x10016cfd
mov eax, dword [edi]
push ecx
push eax
lea eax, [ebp - 0x10b8]
push 0x1013a5f4
push eax
call fcn.100b5f90
add esp, 0x10
lea eax, [ebp - 0x10b8]
mov ecx, 0x10166724
push 0x26d
push 0x1013a628
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x11b5], 0
je 0x10016d4f
lea eax, [ebp - 0x10b8]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x10a4]
cmp edx, 8
jb 0x10016d96
mov ecx, dword [ebp - 0x10b8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10016d8c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184b4
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x10a4], 7
mov word [ebp - 0x10b8], ax
cmp dword [edi + 0x10], 0
lea eax, [edi + 0x10]
mov dword [ebp - 0x11c0], eax
jne 0x10016dc9
xor al, al
jmp 0x10018494
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x10016dd3
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov dword [ebp - 0x11bc], eax
test eax, eax
jne 0x10016dfa
cmp dword [edi + 0x14], 8
mov eax, edi
mov dword [ebp - 0x11bc], eax
jb 0x10016dfa
mov eax, dword [edi]
mov dword [ebp - 0x11bc], eax
push 0x10138fd0
push eax
call fcn.100ea461
add esp, 8
test eax, eax
je 0x10016e77
push 0x10138fb0
push dword [ebp - 0x11bc]
call fcn.100ea461
add esp, 8
test eax, eax
je 0x10016e77
push 0x10139064
push dword [ebp - 0x11bc]
call fcn.100ea461
add esp, 8
test eax, eax
je 0x10016e77
push 0x1013902c
push dword [ebp - 0x11bc]
call fcn.100ea461
add esp, 8
test eax, eax
je 0x10016e77
push str.360chromeX.exe
push dword [ebp - 0x11bc]
call fcn.100ea461
add esp, 8
test eax, eax
je 0x10016e77
mov dword [ebp - 0x11bc], 0
jmp 0x1001780a
xor eax, eax
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 0
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 7
mov word [ebp - 0x10a0], ax
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x11d8]
push 0xe
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x11c4], eax
push str.2345SafeCenter
mov dword [ebp - 0x11c8], eax
mov dword [ebp - 0x11c4], 7
mov word [ebp - 0x11d8], ax
call fcn.1000b730
mov byte [ebp - 4], 3
lea eax, [ebp - 0x11d8]
cmp dword [ebp - 0x11c4], 8
lea ecx, [ebp - 0x10a0]
push dword [ebp - 0x11c8]
cmovae eax, dword [ebp - 0x11d8]
push eax
call fcn.1000b730
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x11c4]
cmp edx, 8
jb 0x10016f52
mov ecx, dword [ebp - 0x11d8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10016f48
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184b9
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x11c8], 0
mov word [ebp - 0x11d8], ax
lea ecx, [ebp - 0x10a0]
lea eax, [ebp - 0x10d0]
mov dword [ebp - 0x11c4], 7
push eax
call fcn.10033ff0
mov byte [ebp - 4], 4
cmp dword [ebp - 0x10c0], 0
jne 0x10017012
lea eax, [ebp - 0x119c]
push eax
call fcn.10026880
add esp, 4
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x10d0]
push eax
call fcn.1000b290
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x1188]
cmp edx, 8
jb 0x10016ff5
mov ecx, dword [ebp - 0x119c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10016feb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184be
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
push 0x12
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 0
lea ecx, [ebp - 0x119c]
push str.2345SFWebShell.exe
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
call fcn.1000b730
mov byte [ebp - 4], 6
lea eax, [ebp - 0x119c]
push eax
lea edx, [ebp - 0x10d0]
lea ecx, [ebp - 0x10b8]
call fcn.10090a10
add esp, 4
mov dword [ebp - 0x11bc], eax
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x10d0]
cmp ecx, eax
je 0x100170bd
call fcn.1000b6d0
mov eax, dword [ebp - 0x11bc]
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x10d0], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x10c0], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 6
mov edx, dword [ebp - 0x10a4]
cmp edx, 8
jb 0x10017101
mov ecx, dword [ebp - 0x10b8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100170f7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184c3
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x10a4], 7
mov word [ebp - 0x10b8], ax
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x1188]
cmp edx, 8
jb 0x10017162
mov ecx, dword [ebp - 0x119c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10017158
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184c8
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
cmp dword [0x10166724], eax
je 0x100172b3
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x100172b3
cmp dword [eax + 0x58], 4
jb 0x100172b3
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x11b5], al
xor eax, eax
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x10a4], 0
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x10a4], 7
mov word [ebp - 0x10b8], ax
mov byte [ebp - 4], 8
lea eax, [ebp - 0x10d0]
cmp dword [ebp - 0x10bc], 8
cmovae eax, dword [ebp - 0x10d0]
push eax
lea eax, [ebp - 0x10b8]
push str.mid_fpath___ws
push eax
call fcn.100b5f90
add esp, 0xc
lea eax, [ebp - 0x10b8]
mov ecx, 0x10166724
push 0x27f
push 0x1013a628
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x11b5], 0
je 0x10017252
lea eax, [ebp - 0x10b8]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x10a4]
cmp edx, 8
jb 0x10017296
mov ecx, dword [ebp - 0x10b8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1001728c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184cd
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x10a4], 7
mov word [ebp - 0x10b8], ax
push 0x800
lea eax, [ebp - 0x880]
mov byte [ebp - 0x11b5], 0
push 0
push eax
call fcn.100e7700
add esp, 0xc
lea eax, [ebp - 0x1088]
push 0x804
push 0
push eax
call fcn.100e7700
add esp, 0xc
lea eax, [ebp - 0x880]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x880]
push eax
push 0
push 0x101376f0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100173f9
push eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x100173f9
lea eax, [ebp - 0x880]
push eax
lea eax, [ebp - 0x1088]
push 0x402
push eax
call fcn.100ecfef
add esp, 0xc
lea eax, [ebp - 0x80]
push 0x64
push 0
push eax
call fcn.100e7700
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x80]
push str._d.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x880]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp dword [ebp - 0x10bc], 8
lea ecx, [ebp - 0x880]
push 0
lea eax, [ebp - 0x10d0]
cmovae eax, dword [ebp - 0x10d0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100173f9
lea ecx, [ebp - 0x880]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100173d0
sub ecx, edx
lea eax, [ebp - 0x880]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x10d0]
call fcn.1000b730
mov byte [ebp - 0x11b5], 1
lea ecx, [ebp - 0x10d0]
call fcn.10087d70
test al, al
je 0x1001778d
push 0x1013a5f0
lea ecx, [ebp - 0x10b8]
call fcn.1000b340
mov byte [ebp - 4], 9
cmp dword [edi + 0x14], 8
jb 0x10017428
mov edi, dword [edi]
mov eax, dword [ebp - 0x11c0]
lea ecx, [ebp - 0x10b8]
push dword [eax]
push edi
call fcn.1000b9b0
push 1
push 0x1013a6e0
lea ecx, [ebp - 0x10b8]
call fcn.1000b9b0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10017458
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x10b8]
push eax
call fcn.1000b9b0
push 1
push 0x1013a5f0
lea ecx, [ebp - 0x10b8]
call fcn.1000b9b0
cmp dword [ebp - 0x10a4], 8
lea ecx, [ebp - 0x10b8]
push 0
cmovae ecx, dword [ebp - 0x10b8]
lea eax, [ebp - 0x10d0]
cmp dword [ebp - 0x10bc], 8
push 0
cmovae eax, dword [ebp - 0x10d0]
push ecx
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [0x10166724], 0
mov esi, eax
je 0x10017601
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov ecx, dword [0x10166724]
cmp byte [ecx + 0x54], 0
je 0x10017601
cmp dword [ecx + 0x58], 4
jb 0x10017601
mov al, byte [ecx + 0x5c]
mov byte [ebp - 0x11b6], al
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 0
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x10b8]
cmp dword [ebp - 0x10a4], 8
lea eax, [ebp - 0x10d0]
cmovae ecx, dword [ebp - 0x10b8]
cmp dword [ebp - 0x10bc], 8
push ecx
cmovae eax, dword [ebp - 0x10d0]
push eax
lea eax, [ebp - 0x119c]
push str._vz_:N
push eax
call fcn.100b5f90
add esp, 0x10
lea eax, [ebp - 0x119c]
mov ecx, 0x10166724
push 0x2a2
push 0x1013a628
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x11b6], 0
je 0x100175a0
lea eax, [ebp - 0x119c]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x1188]
cmp edx, 8
jb 0x100175e4
mov ecx, dword [ebp - 0x119c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100175da
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184d2
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
cmp byte [ebp - 0x11b5], 0
je 0x100176a4
cmp dword [ebp - 0x10bc], 8
lea eax, [ebp - 0x10d0]
cmovae eax, dword [ebp - 0x10d0]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100176a4
cmp dword [ebp - 0x10bc], 8
lea eax, [ebp - 0x10d0]
push 4
cmovae eax, dword [ebp - 0x10d0]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x1088]
mov dword [ebp - 0x11a0], 0
mov dword [ebp - 0x1198], eax
xorps xmm0, xmm0
mov eax, 0x614
movlpd qword [ebp - 0x118a], xmm0
mov word [ebp - 0x1190], ax
lea eax, [ebp - 0x11a0]
push eax
mov dword [ebp - 0x119c], 3
mov dword [ebp - 0x1194], 0
mov dword [ebp - 0x118e], 1
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp esi, 0x20
seta byte [ebp - 0x11b6]
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x10a4]
cmp edx, 8
jb 0x100176f2
mov ecx, dword [ebp - 0x10b8]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100176e8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184d7
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x10a8], 0
mov dword [ebp - 0x10a4], 7
mov word [ebp - 0x10b8], ax
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x10bc]
cmp edx, 8
jb 0x10017753
mov ecx, dword [ebp - 0x10d0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10017749
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184dc
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x10c0], 0
mov dword [ebp - 0x10bc], 7
mov word [ebp - 0x10d0], ax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10a0]
call fcn.1000b6d0
mov al, byte [ebp - 0x11b6]
jmp 0x10018494
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x10bc]
cmp edx, 8
jb 0x100177d1
mov ecx, dword [ebp - 0x10d0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100177c7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184e1
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x10c0], 0
mov dword [ebp - 0x10bc], 7
mov word [ebp - 0x10d0], ax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10a0]
call fcn.1000b6d0
mov dword [ebp - 0x11bc], 1
xor eax, eax
mov dword [ebp - 0x10dc], 0
mov dword [ebp - 0x10d8], 0
mov dword [ebp - 0x10dc], 0
mov dword [ebp - 0x10d8], 7
mov word [ebp - 0x10ec], ax
mov dword [ebp - 4], 0xe
mov edx, 0x1013a5f0
push edi
lea ecx, [ebp - 0x119c]
call fcn.10011750
add esp, 4
mov byte [ebp - 4], 0xf
mov edx, eax
push 0x1013a70c
lea ecx, [ebp - 0x10a0]
call fcn.10018b30
add esp, 4
mov dword [ebp - 0x11c0], eax
mov byte [ebp - 4], 0x10
lea ecx, [ebp - 0x10ec]
cmp ecx, eax
je 0x100178b8
call fcn.1000b6d0
mov eax, dword [ebp - 0x11c0]
xor ecx, ecx
movups xmm0, xmmword [eax]
movups xmmword [ebp - 0x10ec], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [ebp - 0x10dc], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0xf
mov edx, dword [ebp - 0x108c]
cmp edx, 8
jb 0x100178fc
mov ecx, dword [ebp - 0x10a0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100178f2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184e6
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 7
mov word [ebp - 0x10a0], ax
mov byte [ebp - 4], 0xe
mov edx, dword [ebp - 0x1188]
cmp edx, 8
jb 0x1001795d
mov ecx, dword [ebp - 0x119c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10017953
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184eb
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x118c], 0
mov edx, edi
mov dword [ebp - 0x1188], 7
lea ecx, [ebp - 0x1134]
mov word [ebp - 0x119c], ax
call fcn.100102b0
mov byte [ebp - 4], 0x11
mov ecx, dword [ebp - 0x1124]
test ecx, ecx
je 0x100179c8
cmp dword [ebp - 0x1120], 8
lea eax, [ebp - 0x1134]
push ecx
cmovae eax, dword [ebp - 0x1134]
lea ecx, [ebp - 0x10ec]
push eax
call fcn.1000b9b0
push 1
push 0x10138354
lea ecx, [ebp - 0x10ec]
call fcn.1000b9b0
cmp dword [0x10166724], 0
je 0x10017afd
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x10017afd
cmp dword [eax + 0x58], 4
jb 0x10017afd
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x11b6], al
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 0
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
mov byte [ebp - 4], 0x12
lea eax, [ebp - 0x10ec]
cmp dword [ebp - 0x10d8], 8
cmovae eax, dword [ebp - 0x10ec]
push eax
lea eax, [ebp - 0x119c]
push str.commandLine:__s
push eax
call fcn.100b5f90
add esp, 0xc
lea eax, [ebp - 0x119c]
mov ecx, 0x10166724
push 0x2c7
push 0x1013a628
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x11b6], 0
je 0x10017a9c
lea eax, [ebp - 0x119c]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x11
mov edx, dword [ebp - 0x1188]
cmp edx, 8
jb 0x10017ae0
mov ecx, dword [ebp - 0x119c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10017ad6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184f0
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
push edi
lea ecx, [ebp - 0x111c]
call fcn.1000b3b0
mov byte [ebp - 4], 0x13
lea ecx, [ebp - 0x111c]
call fcn.10086750
cmp dword [ebp - 0x1108], 8
lea ecx, [ebp - 0x111c]
mov edx, dword [ebp - 0x110c]
cmovae ecx, dword [ebp - 0x111c]
push 0x11
push str.2345explorer.exe
push 0
call fcn.10011830
add esp, 0xc
test eax, eax
js 0x10017b7e
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x10017b70
mov edx, 0x10138354
lea ecx, [ebp - 0x10ec]
call fcn.10086590
mov edx, 0x10138354
lea ecx, [ebp - 0x10ec]
call fcn.10086620
jmp 0x10017bc1
cmp dword [esi + 0x14], 8
mov ecx, esi
jb 0x10017b7a
mov ecx, dword [esi]
push eax
push ecx
jmp 0x10017bb6
cmp dword [esi + 0x10], 0
je 0x10017bc1
push 1
push 0x1013a5f0
lea ecx, [ebp - 0x10ec]
call fcn.1000b9b0
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10017ba0
mov eax, dword [esi]
push dword [esi + 0x10]
lea ecx, [ebp - 0x10ec]
push eax
call fcn.1000b9b0
push 1
push 0x1013a5f0
lea ecx, [ebp - 0x10ec]
call fcn.1000b9b0
cmp dword [0x10166724], 0
je 0x10017cf6
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x10017cf6
cmp dword [eax + 0x58], 4
jb 0x10017cf6
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x11b6], al
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 0
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x10ec]
cmp dword [ebp - 0x10d8], 8
cmovae eax, dword [ebp - 0x10ec]
push eax
lea eax, [ebp - 0x119c]
push str.commandLine:__s
push eax
call fcn.100b5f90
add esp, 0xc
lea eax, [ebp - 0x119c]
mov ecx, 0x10166724
push 0x2e1
push 0x1013a628
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x11b6], 0
je 0x10017c95
lea eax, [ebp - 0x119c]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x1188]
cmp edx, 8
jb 0x10017cd9
mov ecx, dword [ebp - 0x119c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10017ccf
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184f5
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
xorps xmm0, xmm0
mov dword [ebp - 0x1180], 0x44
xor eax, eax
movlpd qword [ebp - 0x117c], xmm0
mov word [ebp - 0x113e], ax
mov eax, 1
movlpd qword [ebp - 0x1174], xmm0
movlpd qword [ebp - 0x116c], xmm0
movlpd qword [ebp - 0x1164], xmm0
movlpd qword [ebp - 0x115c], xmm0
movlpd qword [ebp - 0x114e], xmm0
movlpd qword [ebp - 0x1146], xmm0
movups xmmword [ebp - 0x11b4], xmm0
mov dword [ebp - 0x1154], 1
mov word [ebp - 0x1150], ax
mov dword [ebp - 0x11a4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
test eax, eax
je 0x10017d88
lea ecx, [ebp - 0x11a4]
push ecx
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
cmp dword [0x10166724], 0
je 0x10017eb7
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x10017eb7
cmp dword [eax + 0x58], 4
jb 0x10017eb7
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x11b6], al
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 0
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
mov byte [ebp - 4], 0x15
cmp dword [esi + 0x14], 8
jb 0x10017dff
mov esi, dword [esi]
push esi
push dword [ebp - 0x11bc]
lea eax, [ebp - 0x119c]
push 0x1013a738
push eax
call fcn.100b5f90
add esp, 0x10
lea eax, [ebp - 0x119c]
mov ecx, 0x10166724
push 0x2f2
push 0x1013a628
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x11b6], 0
je 0x10017e56
lea eax, [ebp - 0x119c]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x1188]
cmp edx, 8
jb 0x10017e9a
mov ecx, dword [ebp - 0x119c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10017e90
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100184fa
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x118c], 0
mov dword [ebp - 0x1188], 7
mov word [ebp - 0x119c], ax
xor esi, esi
mov dword [ebp - 0x10d4], 0
mov dword [ebp - 0x10d4], esi
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1104]
push edi
call fcn.1000b3b0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1104]
call fcn.10086750
cmp dword [ebp - 0x10f0], 8
lea ecx, [ebp - 0x1104]
mov edx, dword [ebp - 0x10f4]
cmovae ecx, dword [ebp - 0x1104]
push 0xc
push str.iexplore.exe
push esi
call fcn.10011830
add esp, 0xc
test eax, eax
js 0x10018034
call fcn.10023290
lea eax, [ebp - 0x11c0]
push eax
call fcn.10023360
mov byte [ebp - 4], 0x18
lea ecx, [ebp - 0x10d4]
mov dword [ebp - 0x11bc], esi
cmp ecx, eax
je 0x10017f53
mov esi, dword [eax]
mov dword [eax], 0
mov dword [ebp - 0x10d4], esi
mov dword [ebp - 0x11bc], esi
mov byte [ebp - 4], 0x17
mov ecx, dword [ebp - 0x11c0]
test ecx, ecx
je 0x10017f67
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0x11bc]
mov eax, dword [ecx]
mov eax, dword [eax + 4]
call eax
mov ecx, 0x10166724
push 4
test al, al
jne 0x100180d5
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x10018020
xor eax, eax
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 0
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 7
mov word [ebp - 0x10a0], ax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x10a0]
push 0x1e
push str.ShellExecuteLoadWeb:
call fcn.1000b730
push 0x2ff
push 0x1013a628
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea eax, [ebp - 0x10a0]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x10018011
lea eax, [ebp - 0x10a0]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x10a0]
call fcn.1000b6d0
mov ecx, dword [ebp - 0x11bc]
xor esi, esi
mov dword [ebp - 0x10d4], esi
push 1
mov eax, dword [ecx]
call dword [eax]
xor edi, edi
cmp dword [ebp - 0x11a4], 0
je 0x100182d3
push str.RtlCreateProcessParametersEx
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001806e
cmp byte [eax], 0xe9
jne 0x1001806e
push 0x14
push eax
call fcn.1010bc50
add esp, 8
cmp dword [ebp - 0x10d8], 8
lea ecx, [ebp - 0x11b4]
push ecx
lea ecx, [ebp - 0x1180]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10ec]
cmovae eax, dword [ebp - 0x10ec]
push eax
push 0
push dword [ebp - 0x11a4]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
push dword [ebp - 0x11a4]
test eax, eax
setne byte [ebp - 0x11b5]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 0x11b5]
mov dword [ebp - 0x11a4], 0
jmp 0x10018315
call fcn.100b5ab0
mov dword [ebp - 0x11c0], eax
test eax, eax
je 0x1001817a
xor eax, eax
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 0
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 7
mov word [ebp - 0x10a0], ax
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x10a0]
push 0xc
push 0x1013a818
call fcn.1000b730
push 0x304
push 0x1013a628
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea eax, [ebp - 0x10a0]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp dword [ebp - 0x11c0], 1
jbe 0x1001816b
lea eax, [ebp - 0x10a0]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x10a0]
call fcn.1000b6d0
cmp dword [ebp - 0x10d8], 8
lea edx, [ebp - 0x10ec]
cmovae edx, dword [ebp - 0x10ec]
cmp dword [edi + 0x14], 8
jb 0x10018196
mov edi, dword [edi]
mov ecx, dword [ebp - 0x11bc]
push edx
push 1
push 1
mov eax, dword [ecx]
push edi
mov eax, dword [eax + 0xc]
call eax
push 4
mov ecx, 0x10166724
mov edi, eax
call fcn.100b5ab0
mov dword [ebp - 0x11c0], eax
test edi, edi
jne 0x10018262
test eax, eax
je 0x10018036
xor eax, eax
mov dword [ebp - 0x1090], edi
mov dword [ebp - 0x108c], edi
mov dword [ebp - 0x1090], edi
mov dword [ebp - 0x108c], 7
mov word [ebp - 0x10a0], ax
mov byte [ebp - 4], 0x1b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea eax, [ebp - 0x10a0]
push str.isDriverProtectOk___d_err___x
push eax
call fcn.100b5f90
add esp, 0x10
push 0x308
push 0x1013a628
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
lea eax, [ebp - 0x10a0]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp dword [ebp - 0x11c0], 1
jbe 0x1001824e
lea eax, [ebp - 0x10a0]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x10a0]
call fcn.1000b6d0
jmp 0x10018036
test eax, eax
je 0x10018036
xor eax, eax
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 0
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 7
mov word [ebp - 0x10a0], ax
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x10ec]
cmp dword [ebp - 0x10d8], 8
cmovae eax, dword [ebp - 0x10ec]
push eax
push edi
lea eax, [ebp - 0x10a0]
push str.isDriverProtectOk___d_cmd___ws
push eax
call fcn.100b5f90
add esp, 0x10
push 0x30c
jmp 0x10018217
cmp dword [ebp - 0x10d8], 8
lea ecx, [ebp - 0x11b4]
push ecx
lea ecx, [ebp - 0x1180]
push ecx
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10ec]
cmovae eax, dword [ebp - 0x10ec]
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
setne al
mov byte [ebp - 0x11b5], al
test al, al
je 0x1001833c
push dword [ebp - 0x11b4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x11b0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x10018349
push 0x2710
jmp 0x10018342
test edi, edi
je 0x10018349
push 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
cmp dword [0x10166724], 0
je 0x10018420
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x10018420
cmp dword [eax + 0x58], 4
jb 0x10018420
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x11b6], al
xor eax, eax
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 0
mov dword [ebp - 0x1090], 0
mov dword [ebp - 0x108c], 7
mov word [ebp - 0x10a0], ax
mov byte [ebp - 4], 0x1d
movzx eax, byte [ebp - 0x11b5]
push eax
push edi
lea eax, [ebp - 0x10a0]
push str.JumpToProtectMainPage___
push eax
call fcn.100b5f90
add esp, 0x10
lea eax, [ebp - 0x10a0]
mov ecx, 0x10166724
push 0x334
push 0x1013a628
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcremotemonitorclient.cpp
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x11b6], 0
je 0x10018411
lea eax, [ebp - 0x10a0]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x10a0]
call fcn.1000b6d0
test esi, esi
je 0x1001843f
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 8]
mov ecx, esi
xor esi, esi
mov dword [ebp - 0x10d4], esi
test ecx, ecx
je 0x1001843f
mov eax, dword [ecx]
push 1
call dword [eax]
mov byte [ebp - 4], 0x16
lea ecx, [ebp - 0x1104]
call fcn.1000b6d0
mov byte [ebp - 4], 0x13
test esi, esi
je 0x1001845e
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x111c]
call fcn.1000b6d0
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x1134]
call fcn.1000b6d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10ec]
call fcn.1000b6d0
mov al, byte [ebp - 0x11b5]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100ceb24
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret 8
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
int3