Function at 0x10006330
Capabilities:
Check for time delay via gettickcount
Check if file exists
Get common file path
Get thread local storage value
Query environment variable
Set thread local storage value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10119297
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1f20
call fcn.100db8c0
mov eax, dword [0x1016f070]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x1017651c], 0
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov dword [ebp - 0x1e30], esi
je 0x100064b9
push ecx
mov ecx, 0x1017651c
call fcn.100bf860
mov eax, dword [0x1017651c]
cmp byte [eax + 0x54], 0
je 0x100064b9
cmp dword [eax + 0x58], 4
jb 0x100064b9
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b18], 0
mov dword [ebp - 0x1b14], 0
mov dword [ebp - 0x1b18], 0
mov dword [ebp - 0x1b14], 7
mov word [ebp - 0x1b28], ax
mov dword [ebp - 4], eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x100063f9
mov ecx, dword [esi]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x10006403
mov eax, dword [edi]
push ecx
push eax
lea eax, [ebp - 0x1b28]
push str.JumpToProtectMainPage_link___s__path___s
push eax
call fcn.100c0730
add esp, 0x10
lea eax, [ebp - 0x1b28]
mov ecx, 0x1017651c
push 0x24c
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp byte [ebp - 0x1e25], 0
je 0x10006455
lea eax, [ebp - 0x1b28]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1b14]
cmp edx, 8
jb 0x1000649c
mov ecx, dword [ebp - 0x1b28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006492
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c1a
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b18], 0
mov dword [ebp - 0x1b14], 7
mov word [ebp - 0x1b28], ax
xor eax, eax
mov dword [ebp - 0x1a4c], 0
mov dword [ebp - 0x1a48], 0
mov dword [ebp - 0x1a4c], 0
mov dword [ebp - 0x1a48], 7
mov word [ebp - 0x1a5c], ax
mov dword [ebp - 4], 1
mov byte [ebp - 0x1a5d], al
lea eax, [ebp - 0x1a5d]
push eax
lea eax, [ebp - 0x1a5c]
push eax
push ecx
call fcn.10017a10
cmp dword [0x1017651c], 0
mov dword [ebp - 0x1a2c], eax
je 0x1000664d
push ecx
mov ecx, 0x1017651c
call fcn.100bf860
mov ecx, dword [0x1017651c]
cmp byte [ecx + 0x54], 0
je 0x1000664d
cmp dword [ecx + 0x58], 4
jb 0x1000664d
mov al, byte [ecx + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b30], 0
mov dword [ebp - 0x1b2c], 0
mov dword [ebp - 0x1b30], 0
mov dword [ebp - 0x1b2c], 7
mov word [ebp - 0x1b40], ax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1a5c]
cmp dword [ebp - 0x1a48], 8
cmovae eax, dword [ebp - 0x1a5c]
push eax
push dword [ebp - 0x1a2c]
lea eax, [ebp - 0x1b40]
push str.GetProtectMainPage_dwErr__0x_X_protectMainPage___s
push eax
call fcn.100c0730
add esp, 0x10
lea eax, [ebp - 0x1b40]
mov ecx, 0x1017651c
push 0x253
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp byte [ebp - 0x1e25], 0
je 0x100065ec
lea eax, [ebp - 0x1b40]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1b2c]
cmp edx, 8
jb 0x10006630
mov ecx, dword [ebp - 0x1b40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006626
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c1f
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b30], 0
mov dword [ebp - 0x1b2c], 7
mov word [ebp - 0x1b40], ax
xor eax, eax
mov dword [ebp - 0x1a34], 0
mov dword [ebp - 0x1a30], 0
mov byte [ebp - 0x1e26], 0
mov dword [ebp - 0x1a34], 0
mov dword [ebp - 0x1a30], 7
mov word [ebp - 0x1a44], ax
mov byte [ebp - 4], 3
lea edx, [ebp - 0x1e26]
lea ecx, [ebp - 0x1a44]
call fcn.10010550
test al, al
je 0x100066ab
cmp dword [ebp - 0x1a34], 0
jne 0x100067a7
push 0x800
lea eax, [ebp - 0x1228]
push 0
push eax
call fcn.100f2c30
add esp, 0xc
lea eax, [ebp - 0x1e26]
lea ecx, [ebp - 0x1228]
push eax
call fcn.100303f0
add esp, 4
test al, al
je 0x100067a7
xor eax, eax
mov dword [ebp - 0x1e54], 0
lea ecx, [ebp - 0x1228]
mov dword [ebp - 0x1e50], 0
mov dword [ebp - 0x1e54], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x1e50], 7
mov word [ebp - 0x1e64], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006720
sub ecx, edx
lea eax, [ebp - 0x1228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1e64]
call fcn.10004bf0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a44]
call fcn.10004b90
movups xmm0, xmmword [ebp - 0x1e64]
xor eax, eax
mov word [ebp - 0x1e64], ax
movups xmmword [ebp - 0x1a44], xmm0
movq xmm0, qword [ebp - 0x1e54]
movq qword [ebp - 0x1a34], xmm0
mov dword [ebp - 0x1e54], 0
mov dword [ebp - 0x1e50], 7
mov byte [ebp - 4], 3
mov dword [ebp - 0x1e54], eax
mov dword [ebp - 0x1e50], 7
mov word [ebp - 0x1e64], ax
mov eax, dword [0x1017651c]
test eax, eax
je 0x100068e9
push ecx
mov ecx, 0x1017651c
call fcn.100bf860
mov eax, dword [0x1017651c]
cmp byte [eax + 0x54], 0
je 0x100068e9
cmp dword [eax + 0x58], 4
jb 0x100068e9
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b48], 0
mov dword [ebp - 0x1b44], 0
mov dword [ebp - 0x1b48], 0
mov dword [ebp - 0x1b44], 7
mov word [ebp - 0x1b58], ax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1a44]
cmp dword [ebp - 0x1a30], 8
movzx eax, byte [ebp - 0x1e26]
cmovae ecx, dword [ebp - 0x1a44]
push eax
push ecx
lea eax, [ebp - 0x1b58]
push str.GetProtectMainPage_Other_Browser_protectMainPage___s__isLocked___d
push eax
call fcn.100c0730
add esp, 0x10
lea eax, [ebp - 0x1b58]
mov ecx, 0x1017651c
push 0x261
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp byte [ebp - 0x1e25], 0
je 0x10006883
lea eax, [ebp - 0x1b58]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b44]
cmp edx, 8
jb 0x100068c7
mov ecx, dword [ebp - 0x1b58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100068bd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c24
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b48], 0
mov word [ebp - 0x1b58], ax
mov eax, dword [0x1017651c]
mov dword [ebp - 0x1b44], 7
cmp dword [ebp - 0x1a4c], 0
jne 0x10006aec
cmp byte [ebp - 0x1e26], 0
jne 0x10006aec
test eax, eax
je 0x10006a1c
push ecx
mov ecx, 0x1017651c
call fcn.100bf860
mov eax, dword [0x1017651c]
cmp byte [eax + 0x54], 0
je 0x10006a1c
cmp dword [eax + 0x58], 4
jb 0x10006a1c
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b60], 0
mov dword [ebp - 0x1b5c], 0
mov dword [ebp - 0x1b60], 0
mov dword [ebp - 0x1b5c], 7
mov word [ebp - 0x1b70], ax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1b70]
push 0x1a
push str.GetProtectMainPage
call fcn.10004bf0
push 0x266
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1b70]
mov ecx, 0x1017651c
push eax
push 4
call fcn.100c0290
cmp byte [ebp - 0x1e25], 0
je 0x100069bb
lea eax, [ebp - 0x1b70]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b5c]
cmp edx, 8
jb 0x100069ff
mov ecx, dword [ebp - 0x1b70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100069f5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c29
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b60], 0
mov dword [ebp - 0x1b5c], 7
mov word [ebp - 0x1b70], ax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1a30]
cmp edx, 8
jb 0x10006a60
mov ecx, dword [ebp - 0x1a44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006a56
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c2e
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1a34], 0
mov dword [ebp - 0x1a30], 7
mov word [ebp - 0x1a44], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1a48]
cmp edx, 8
jb 0x10006ac4
mov ecx, dword [ebp - 0x1a5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006aba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c33
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1a4c], 0
mov word [ebp - 0x1a5c], ax
mov eax, dword [ebp - 0x1a2c]
mov dword [ebp - 0x1a48], 7
jmp 0x10008bfc
lea ecx, [ebp - 0x1ab0]
call fcn.10095040
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1ab0]
cmp dword [ebp - 0x1a9c], 8
push str.explorer.exe
cmovae eax, dword [ebp - 0x1ab0]
push eax
call fcn.100f5c64
add esp, 8
test eax, eax
je 0x10006d7b
call fcn.100094b0
test al, al
jne 0x10006d7b
cmp dword [0x1017651c], 0
je 0x10006c50
push ecx
mov ecx, 0x1017651c
call fcn.100bf860
mov eax, dword [0x1017651c]
cmp byte [eax + 0x54], 0
je 0x10006c50
cmp dword [eax + 0x58], 4
jb 0x10006c50
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b78], 0
mov dword [ebp - 0x1b74], 0
mov dword [ebp - 0x1b78], 0
mov dword [ebp - 0x1b74], 7
mov word [ebp - 0x1b88], ax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1b88]
push 0x17
push str.other_desk_close_swtich
call fcn.10004bf0
push 0x270
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1b88]
mov ecx, 0x1017651c
push eax
push 4
call fcn.100c0290
cmp byte [ebp - 0x1e25], 0
je 0x10006bef
lea eax, [ebp - 0x1b88]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1b74]
cmp edx, 8
jb 0x10006c33
mov ecx, dword [ebp - 0x1b88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006c29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c38
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b78], 0
mov dword [ebp - 0x1b74], 7
mov word [ebp - 0x1b88], ax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1a9c]
cmp edx, 8
jb 0x10006c94
mov ecx, dword [ebp - 0x1ab0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006c8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c3d
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1aa0], 0
mov dword [ebp - 0x1a9c], 7
mov word [ebp - 0x1ab0], ax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1a30]
cmp edx, 8
jb 0x10006cf5
mov ecx, dword [ebp - 0x1a44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006ceb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c42
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1a34], 0
mov dword [ebp - 0x1a30], 7
mov word [ebp - 0x1a44], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1a48]
cmp edx, 8
jb 0x10006d59
mov ecx, dword [ebp - 0x1a5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006d4f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c47
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1a4c], 0
mov dword [ebp - 0x1a48], 7
mov word [ebp - 0x1a5c], ax
jmp 0x10008bf9
push 0x11
xor eax, eax
mov dword [ebp - 0x1e8c], 0
mov dword [ebp - 0x1e88], 0
lea ecx, [ebp - 0x1e9c]
push str.2345RTProtect.exe
mov dword [ebp - 0x1e8c], 0
mov dword [ebp - 0x1e88], 7
mov word [ebp - 0x1e9c], ax
call fcn.10004bf0
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1e9c]
call fcn.10093fc0
test al, al
sete al
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1e88]
cmp edx, 8
jb 0x10006e22
mov ecx, dword [ebp - 0x1e9c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006e12
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c4c
push edx
push ecx
call fcn.100da665
mov al, byte [ebp - 0x1e25]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x1e8c], 0
mov dword [ebp - 0x1e88], 7
mov word [ebp - 0x1e9c], cx
test al, al
je 0x1000703b
mov dword [ebp - 0x1e74], ecx
xor eax, eax
mov dword [ebp - 0x1e70], ecx
push 0x11
mov dword [ebp - 0x1e74], ecx
lea ecx, [ebp - 0x1e84]
push str.2345RTProtect.exe
mov dword [ebp - 0x1e70], 7
mov word [ebp - 0x1e84], ax
call fcn.10004bf0
mov byte [ebp - 4], 0xa
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
jne 0x10006e9a
mov byte [ebp - 0x1e25], 0
jmp 0x10006eac
push eax
lea ecx, [ebp - 0x1e84]
call fcn.10008c60
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1e70]
cmp edx, 8
jb 0x10006ef0
mov ecx, dword [ebp - 0x1e84]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006ee6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c51
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1e74], 0
mov dword [ebp - 0x1e70], 7
mov word [ebp - 0x1e84], ax
cmp byte [ebp - 0x1e25], al
jne 0x1000703b
cmp dword [0x1017651c], eax
je 0x10006c50
push ecx
mov ecx, 0x1017651c
call fcn.100bf860
mov eax, dword [0x1017651c]
cmp byte [eax + 0x54], 0
je 0x10006c50
cmp dword [eax + 0x58], 4
jb 0x10006c50
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b90], 0
mov dword [ebp - 0x1b8c], 0
mov dword [ebp - 0x1b90], 0
mov dword [ebp - 0x1b8c], 7
mov word [ebp - 0x1ba0], ax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1ba0]
push 0xd
push str.not_found_rtp
call fcn.10004bf0
push 0x293
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1ba0]
mov ecx, 0x1017651c
push eax
push 4
call fcn.100c0290
cmp byte [ebp - 0x1e25], 0
je 0x10006fd5
lea eax, [ebp - 0x1ba0]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1b8c]
cmp edx, 8
jb 0x10007019
mov ecx, dword [ebp - 0x1ba0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000700f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c56
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b90], 0
mov dword [ebp - 0x1b8c], 7
mov word [ebp - 0x1ba0], ax
jmp 0x10006c50
xor eax, eax
mov dword [ebp - 0x1b00], 0
mov dword [ebp - 0x1afc], 0
mov dword [ebp - 0x1b00], 0
mov dword [ebp - 0x1afc], 7
mov word [ebp - 0x1b10], ax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1e4c]
push 0xa
mov dword [ebp - 0x1e3c], eax
mov dword [ebp - 0x1e38], eax
push str.2345PCSafe
mov dword [ebp - 0x1e3c], eax
mov dword [ebp - 0x1e38], 7
mov word [ebp - 0x1e4c], ax
call fcn.10004bf0
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x1e4c]
cmp dword [ebp - 0x1e38], 8
lea ecx, [ebp - 0x1b10]
push dword [ebp - 0x1e3c]
cmovae eax, dword [ebp - 0x1e4c]
push eax
call fcn.10004bf0
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x1e38]
cmp edx, 8
jb 0x10007113
mov ecx, dword [ebp - 0x1e4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10007109
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10008c3d
push edx
push ecx
call fcn.100da665
add esp, 8
xor eax, eax
mov dword [ebp - 0x1e3c], 0
lea ecx, [ebp - 0x1b10]
mov dword [ebp - 0x1e38], 7
mov word [ebp - 0x1e4c], ax
call fcn.1003c110
test al, al
je 0x10007287
push str.2345SafeTray.exe
lea ecx, [ebp - 0x1eb4]
call fcn.10004b20
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1eb4]
call fcn.10093fc0
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1eb4]
call fcn.10004b90
cmp byte [ebp - 0x1e25], 0
jne 0x10007287
push str.2345SafeTray.exe
lea ecx, [ebp - 0x1ecc]
call fcn.10004b20
mov byte [ebp - 4], 0x10
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
jne 0x100071b0
mov byte [ebp - 0x1e25], 0
jmp 0x100071c2
push eax
lea ecx, [ebp - 0x1ecc]
call fcn.10008c60
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1ecc]
call fcn.10004b90
cmp byte [ebp - 0x1e25], 0
jne 0x10007287
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x10007282
xor eax, eax
mov dword [ebp - 0x1c34], 0
mov dword [ebp - 0x1c30], 0
mov dword [ebp - 0x1c34], 0
mov dword [ebp - 0x1c30], 7
mov word [ebp - 0x1c44], ax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c44]
push 0xe
push str.not_found_tray
call fcn.10004bf0
push 0x2a0
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1c44]
mov ecx, 0x1017651c
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x10007273
lea eax, [ebp - 0x1c44]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1c44]
call fcn.10004b90
jmp 0x10008bba
cmp dword [ebp - 0x1a34], 0
je 0x100073c6
mov edx, str.__r_t_n
lea ecx, [ebp - 0x1a44]
call fcn.10091890
mov edx, str.__r_t_n
lea ecx, [ebp - 0x1a44]
call fcn.10091920
lea ecx, [ebp - 0x1a44]
call fcn.10091a50
cmp dword [ebp - 0x1a30], 8
lea eax, [ebp - 0x1a44]
push 5
cmovae eax, dword [ebp - 0x1a44]
push str.http:
push eax
call fcn.100f90db
add esp, 0xc
test eax, eax
je 0x100073c6
cmp dword [ebp - 0x1a30], 8
lea eax, [ebp - 0x1a44]
push 6
cmovae eax, dword [ebp - 0x1a44]
push str.https:
push eax
call fcn.100f90db
add esp, 0xc
test eax, eax
je 0x100073c6
cmp dword [ebp - 0x1a30], 8
lea eax, [ebp - 0x1a44]
push 0xb
cmovae eax, dword [ebp - 0x1a44]
push str.about:blank
push eax
call fcn.100f90db
add esp, 0xc
test eax, eax
je 0x100073c6
cmp dword [ebp - 0x1a30], 8
lea eax, [ebp - 0x1a44]
push 0xa
cmovae eax, dword [ebp - 0x1a44]
push str.about:tabs
push eax
call fcn.100f90db
add esp, 0xc
test eax, eax
je 0x100073c6
push str.http:__
lea ecx, [ebp - 0x1e24]
call fcn.10004b20
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x1a44]
cmp dword [ebp - 0x1a30], 8
lea ecx, [ebp - 0x1e24]
push dword [ebp - 0x1a34]
cmovae eax, dword [ebp - 0x1a44]
push eax
call fcn.1000c770
lea eax, [ebp - 0x1e24]
push eax
lea ecx, [ebp - 0x1a44]
call fcn.1000c360
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1e24]
call fcn.10004b90
mov eax, dword [0x10175edc]
test eax, eax
je 0x100074bd
mov esi, dword [0x10175edc]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movsd xmm0, qword [0x10150138]
sub eax, esi
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x101501a0]
andps xmm1, xmmword [0x101501b0]
comisd xmm0, xmm1
jb 0x100074b7
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x100074b2
xor eax, eax
mov dword [ebp - 0x1c4c], 0
mov dword [ebp - 0x1c48], 0
mov dword [ebp - 0x1c4c], 0
mov dword [ebp - 0x1c48], 7
mov word [ebp - 0x1c5c], ax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1c5c]
push 0x1c
push str.JumpToProtectMainPage
call fcn.10004bf0
push 0x2ba
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1c5c]
mov ecx, 0x1017651c
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x100074a3
lea eax, [ebp - 0x1c5c]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1c5c]
call fcn.10004b90
jmp 0x10008bba
mov esi, dword [ebp - 0x1e30]
call fcn.1000bc40
test al, al
jne 0x100074d3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x10175edc
xchg dword [ecx], eax
push 1
push 0x10175e88
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x100074e9
call fcn.1001b9e0
lea eax, [ebp - 0x1a5c]
push eax
call fcn.1001c180
test al, al
je 0x1000754a
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1d1c]
push eax
call fcn.10015860
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x1d0c]
test ecx, ecx
je 0x1000753b
cmp dword [ebp - 0x1d08], 8
lea eax, [ebp - 0x1d1c]
push ecx
cmovae eax, dword [ebp - 0x1d1c]
lea ecx, [ebp - 0x1a5c]
push eax
call fcn.1000c770
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1d1c]
call fcn.10004b90
xor eax, eax
mov dword [ebp - 0x1a68], 0
mov dword [ebp - 0x1a64], 0
mov dword [ebp - 0x1a68], 0
mov dword [ebp - 0x1a64], 7
mov word [ebp - 0x1a78], ax
mov byte [ebp - 4], 0x17
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x10007589
mov eax, dword [edi]
lea ecx, [ebp - 0x1a78]
push ecx
push eax
call fcn.100168c0
push dword [0x10173e70]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 4
mov ecx, 0x1017651c
mov dword [ebp - 0x1e30], eax
call fcn.100c0250
mov dword [ebp - 0x1e34], eax
test eax, eax
je 0x1000767a
xor eax, eax
mov dword [ebp - 0x1c64], 0
mov dword [ebp - 0x1c60], 0
mov dword [ebp - 0x1c64], 0
mov dword [ebp - 0x1c60], 7
mov word [ebp - 0x1c74], ax
mov byte [ebp - 4], 0x18
cmp dword [esi + 0x14], 8
jb 0x100075ff
mov esi, dword [esi]
cmp dword [ebp - 0x1a64], 8
lea eax, [ebp - 0x1a78]
push esi
cmovae eax, dword [ebp - 0x1a78]
push eax
push dword [ebp - 0x1e30]
lea eax, [ebp - 0x1c74]
push str.pAction___p_targetFileName___s_currentPath___s
push eax
call fcn.100c0730
add esp, 0x14
lea eax, [ebp - 0x1c74]
mov ecx, 0x1017651c
push 0x2d2
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp dword [ebp - 0x1e34], 1
jbe 0x1000766b
lea eax, [ebp - 0x1c74]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1c74]
call fcn.10004b90
push 0
push dword [0x10173e70]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [ebp - 0x1a4c], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
jne 0x10007777
cmp dword [ebp - 0x1a64], 8
lea eax, [ebp - 0x1a78]
push 0x1014450c
cmovae eax, dword [ebp - 0x1a78]
push eax
call esi
test eax, eax
je 0x10007777
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x10007763
xor eax, eax
mov dword [ebp - 0x1c1c], 0
mov dword [ebp - 0x1c18], 0
mov dword [ebp - 0x1c1c], 0
mov dword [ebp - 0x1c18], 7
mov word [ebp - 0x1c2c], ax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1c2c]
push 0x26
push str.GetProtectMainPage_fail_and_path_is_ie
call fcn.10004bf0
push 0x2d8
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1c2c]
mov ecx, 0x1017651c
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x10007754
lea eax, [ebp - 0x1c2c]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1c2c]
call fcn.10004b90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.10004b90
jmp 0x10008bba
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x10007781
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100077af
cmp dword [ebp - 0x1a64], 8
lea eax, [ebp - 0x1a78]
cmovae eax, dword [ebp - 0x1a78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10007ae8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1e2c], esp
push edi
call fcn.1000c440
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ae0]
call fcn.100059f0
add esp, 0x18
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x1ad0], 0
jne 0x10007908
cmp dword [ebp - 0x1a68], 0
jbe 0x10007ad9
sub esp, 0x18
lea eax, [ebp - 0x1a78]
mov ecx, esp
mov dword [ebp - 0x1e2c], esp
push eax
call fcn.1000c440
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1f14]
call fcn.100059f0
add esp, 0x18
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1ae0]
push eax
call fcn.1000c390
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1f14]
call fcn.10004b90
cmp dword [ebp - 0x1ad0], 0
jbe 0x10007ad9
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x100079c3
xor eax, eax
mov dword [ebp - 0x1c04], 0
mov dword [ebp - 0x1c00], 0
mov dword [ebp - 0x1c04], 0
mov dword [ebp - 0x1c00], 7
mov word [ebp - 0x1c14], ax
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x1ae0]
cmp dword [ebp - 0x1acc], 8
cmovae eax, dword [ebp - 0x1ae0]
push eax
lea eax, [ebp - 0x1c14]
push str.targetFileName_guid_file_path___ws
push eax
call fcn.100c0730
add esp, 0xc
lea eax, [ebp - 0x1c14]
mov ecx, 0x1017651c
push 0x2e9
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x100078f9
lea eax, [ebp - 0x1c14]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1c14]
jmp 0x100079be
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x100079c3
xor eax, eax
mov dword [ebp - 0x1bec], 0
mov dword [ebp - 0x1be8], 0
mov dword [ebp - 0x1bec], 0
mov dword [ebp - 0x1be8], 7
mov word [ebp - 0x1bfc], ax
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x1ae0]
cmp dword [ebp - 0x1acc], 8
cmovae eax, dword [ebp - 0x1ae0]
push eax
lea eax, [ebp - 0x1bfc]
push str.linkName_guid_file_path___ws
push eax
call fcn.100c0730
add esp, 0xc
lea eax, [ebp - 0x1bfc]
mov ecx, 0x1017651c
push 0x2ef
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x100079b4
lea eax, [ebp - 0x1bfc]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1bfc]
call fcn.10004b90
cmp dword [ebp - 0x1ad0], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
jbe 0x10007ad9
cmp dword [ebp - 0x1acc], 8
lea eax, [ebp - 0x1ae0]
push 0x1014450c
cmovae eax, dword [ebp - 0x1ae0]
push eax
call esi
test eax, eax
jne 0x10007a3a
cmp dword [ebp - 0x1acc], 8
lea eax, [ebp - 0x1ae0]
push str._shdocvw.dll
cmovae eax, dword [ebp - 0x1ae0]
push eax
call esi
test eax, eax
jne 0x10007a3a
cmp dword [ebp - 0x1acc], 8
lea eax, [ebp - 0x1ae0]
push str.ieframe.dll
cmovae eax, dword [ebp - 0x1ae0]
push eax
call esi
test eax, eax
je 0x10007ad9
lea eax, [ebp - 0x1f2c]
push eax
call fcn.100197d0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1a5c]
push ecx
push eax
call fcn.10017d20
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1f2c]
call fcn.10004b90
cmp byte [ebp - 0x1e25], 0
je 0x10007ad9
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ae0]
call fcn.10004b90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.10004b90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1b10]
call fcn.10004b90
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1ab0]
call fcn.10004b90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1a44]
call fcn.10004b90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a5c]
call fcn.10004b90
xor eax, eax
jmp 0x10008bfc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ae0]
call fcn.10004b90
cmp dword [ebp - 0x1e30], 1
jne 0x10007b99
cmp dword [ebp - 0x1a64], 8
lea eax, [ebp - 0x1a78]
push str.2345explorer.exe
cmovae eax, dword [ebp - 0x1a78]
push eax
call esi
test eax, eax
je 0x10007b6e
push 0x10143c14
lea ecx, [ebp - 0x1efc]
call fcn.10004b20
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x1efc]
push eax
lea eax, [ebp - 0x1a78]
push eax
call fcn.10017d20
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1efc]
call fcn.10004b90
cmp byte [ebp - 0x1e25], 0
je 0x10007b99
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.10004b90
jmp 0x10007a93
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1a78]
push eax
call fcn.10017d20
test al, al
je 0x10007b99
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.10004b90
jmp 0x10007a93
push edi
lea ecx, [ebp - 0x1ac8]
call fcn.1000c440
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x1ac8]
cmp dword [ebp - 0x1ab4], 8
cmovae eax, dword [ebp - 0x1ac8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10007ca9
push 0x800
push eax
lea eax, [ebp - 0x1a28]
push eax
call fcn.100f2c30
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x1a28]
add esp, 0xc
push 1
push 0x10
push eax
push 0
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10007caf
cmp dword [ebp - 0x1ab4], 8
lea ecx, [ebp - 0x1a28]
lea eax, [ebp - 0x1ac8]
cmovae eax, dword [ebp - 0x1ac8]
push ecx
push eax
call edi
test eax, eax
je 0x10007caf
cmp dword [ebp - 0x1ab4], 8
lea eax, [ebp - 0x1ac8]
cmovae eax, dword [ebp - 0x1ac8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
test edi, edi
je 0x10007ca9
push 0x800
lea eax, [ebp - 0xa28]
push 0
push eax
call fcn.100f2c30
add esp, 0xc
lea eax, [ebp - 0xa28]
push 1
push 0x19
push eax
push 0
call esi
push edi
lea eax, [ebp - 0xa28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0xa28]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007c87
sub ecx, edx
lea eax, [ebp - 0xa28]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1ac8]
call fcn.10004bf0
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x10143c14
lea ecx, [ebp - 0x1a90]
call fcn.10004b20
mov byte [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x1ae8], 0
mov dword [ebp - 0x1ae4], 0
mov dword [ebp - 0x1ae8], 0
mov dword [ebp - 0x1ae4], 7
mov word [ebp - 0x1af8], ax
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x1ac8]
cmp dword [ebp - 0x1ab4], 8
lea ecx, [ebp - 0x1ee4]
cmovae eax, dword [ebp - 0x1ac8]
push eax
call fcn.10004b20
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x1af8]
push eax
lea eax, [ebp - 0x1a90]
push eax
lea eax, [ebp - 0x1ee4]
push eax
call fcn.1001b2a0
mov esi, eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1ee4]
call fcn.10004b90
test esi, esi
jne 0x10008b04
cmp dword [ebp - 0x1ae8], esi
jne 0x10007e6c
cmp dword [ebp - 0x1a7c], 8
lea eax, [ebp - 0x1a90]
push 0x1014450c
cmovae eax, dword [ebp - 0x1a90]
push eax
call edi
test eax, eax
je 0x10007e6c
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x10007e14
lea ecx, [ebp - 0x1dc4]
call fcn.10004b70
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x1a90]
cmp dword [ebp - 0x1a7c], 8
lea eax, [ebp - 0x1dc4]
cmovae ecx, dword [ebp - 0x1a90]
push ecx
push 0x10144658
push eax
call fcn.100c0730
add esp, 0xc
lea eax, [ebp - 0x1dc4]
mov ecx, 0x1017651c
push 0x331
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x10007e05
lea eax, [ebp - 0x1dc4]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1dc4]
call fcn.10004b90
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1a90]
push eax
call fcn.10017d20
test al, al
je 0x10007e6c
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1af8]
call fcn.10004b90
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1a90]
call fcn.10004b90
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ac8]
call fcn.10004b90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.10004b90
jmp 0x10007a93
cmp byte [ebp - 0x1e26], 0
je 0x10008618
xorps xmm0, xmm0
lea ecx, [ebp - 0x1a98]
movlpd qword [ebp - 0x1a98], xmm0
call fcn.1000d910
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0x1a44]
push eax
lea ecx, [ebp - 0x1a5c]
call fcn.1000c360
mov dword [ebp - 0x1bcc], 0
mov dword [ebp - 0x1bc8], 0
mov dword [ebp - 0x1bc4], 0
mov dword [ebp - 0x1bc0], 0
mov dword [ebp - 0x1bbc], 0
mov byte [ebp - 4], 0x2d
xor eax, eax
mov dword [ebp - 0x1ba8], 0
mov dword [ebp - 0x1ba4], 0
mov dword [ebp - 0x1ba8], 0
mov dword [ebp - 0x1ba4], 7
mov word [ebp - 0x1bb8], ax
mov byte [ebp - 4], 0x2f
sub esp, 0x18
lea eax, [ebp - 0x1a90]
mov dword [ebp - 0x1e2c], esp
mov ecx, esp
push eax
call fcn.1000c440
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x1bcc]
push eax
mov byte [ebp - 4], 0x2f
call fcn.10010110
test al, al
je 0x1000859f
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x10008002
lea ecx, [ebp - 0x1ddc]
call fcn.10004b70
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x1af8]
cmp dword [ebp - 0x1ae4], 8
lea eax, [ebp - 0x1a90]
cmovae ecx, dword [ebp - 0x1af8]
cmp dword [ebp - 0x1a7c], 8
mov dword [ebp - 0x1e34], ecx
cmovae eax, dword [ebp - 0x1a90]
mov dword [ebp - 0x1e6c], eax
lea eax, [ebp - 0x1e34]
push eax
lea eax, [ebp - 0x1e6c]
push eax
push 0x10144678
lea eax, [ebp - 0x1ddc]
push eax
call fcn.1000ce00
push 0x340
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1ddc]
mov ecx, 0x1017651c
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x10007ff3
lea eax, [ebp - 0x1ddc]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1ddc]
call fcn.10004b90
lea eax, [ebp - 0x1af8]
push eax
lea eax, [ebp - 0x1a90]
push eax
call fcn.10010a80
test al, al
je 0x1000859f
lea eax, [ebp - 0x1a5c]
push eax
call fcn.1001c180
test al, al
je 0x10008085
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1a90]
push eax
lea eax, [ebp - 0x1d04]
push eax
call fcn.10015410
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x1cf4]
test ecx, ecx
je 0x10008076
cmp dword [ebp - 0x1cf0], 8
lea eax, [ebp - 0x1d04]
push ecx
cmovae eax, dword [ebp - 0x1d04]
lea ecx, [ebp - 0x1a5c]
push eax
call fcn.1000c770
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1d04]
call fcn.10004b90
lea eax, [ebp - 0x1a5c]
push eax
lea ecx, [ebp - 0x1be4]
call fcn.1000c440
mov byte [ebp - 4], 0x33
mov ecx, 0x1017651c
push 4
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x1000813c
lea ecx, [ebp - 0x1df4]
call fcn.10004b70
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x1af8]
push dword [ebp - 0x1bc8]
cmp dword [ebp - 0x1ae4], 8
lea eax, [ebp - 0x1df4]
push dword [ebp - 0x1bcc]
cmovae ecx, dword [ebp - 0x1af8]
push ecx
push 0x101446c8
push eax
call fcn.100c0730
add esp, 0x14
lea eax, [ebp - 0x1df4]
mov ecx, 0x1017651c
push 0x34f
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x1000812d
lea eax, [ebp - 0x1df4]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1df4]
call fcn.10004b90
cmp dword [ebp - 0x1bc8], 1
jne 0x10008231
lea eax, [ebp - 0x1bb8]
push eax
lea eax, [ebp - 0x1bc4]
push eax
lea eax, [ebp - 0x1be4]
push eax
lea eax, [ebp - 0x1cd4]
push eax
call fcn.1000f640
mov byte [ebp - 4], 0x35
cmp dword [ebp - 0x1cc4], 0
je 0x10008222
lea eax, [ebp - 0x1cd4]
push eax
lea ecx, [ebp - 0x1be4]
call fcn.1000c360
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x10008222
lea ecx, [ebp - 0x1e0c]
call fcn.10004b70
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x1cd4]
cmp dword [ebp - 0x1cc0], 8
lea eax, [ebp - 0x1e0c]
cmovae ecx, dword [ebp - 0x1cd4]
push ecx
push 0x10144748
push eax
call fcn.100c0730
add esp, 0xc
lea eax, [ebp - 0x1e0c]
mov ecx, 0x1017651c
push 0x358
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x10008213
lea eax, [ebp - 0x1e0c]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x1e0c]
call fcn.10004b90
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1cd4]
call fcn.10004b90
cmp dword [ebp - 0x1bcc], 1
jne 0x10008330
sub esp, 0x18
lea eax, [ebp - 0x1be4]
mov ecx, esp
mov dword [ebp - 0x1e2c], esp
push eax
call fcn.1000c440
mov byte [ebp - 4], 0x37
lea eax, [ebp - 0x1cbc]
push eax
mov byte [ebp - 4], 0x33
call fcn.1000f090
mov byte [ebp - 4], 0x38
cmp dword [ebp - 0x1cac], 0
je 0x10008321
lea eax, [ebp - 0x1cbc]
push eax
lea ecx, [ebp - 0x1be4]
call fcn.1000c360
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x10008321
lea ecx, [ebp - 0x1d34]
call fcn.10004b70
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x1cbc]
cmp dword [ebp - 0x1ca8], 8
lea eax, [ebp - 0x1d34]
cmovae ecx, dword [ebp - 0x1cbc]
push ecx
push 0x10144788
push eax
call fcn.100c0730
add esp, 0xc
lea eax, [ebp - 0x1d34]
mov ecx, 0x1017651c
push 0x363
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x10008312
lea eax, [ebp - 0x1d34]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x1d34]
call fcn.10004b90
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1cbc]
call fcn.10004b90
lea edx, [ebp - 0x1a90]
lea ecx, [ebp - 0x1cec]
call fcn.10010ee0
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0x1be4]
cmp dword [ebp - 0x1cdc], 0
push eax
je 0x1000846d
lea eax, [ebp - 0x1cec]
push eax
call fcn.10017d20
test al, al
je 0x10008581
sub esp, 0x18
lea eax, [ebp - 0x1a90]
mov ecx, esp
mov dword [ebp - 0x1e2c], esp
push eax
call fcn.1000c440
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x1a98]
call fcn.1000e530
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1cec]
call fcn.10004b90
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1be4]
call fcn.10004b90
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x1bb8]
call fcn.10004b90
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1bc4]
call fcn.1000c570
mov byte [ebp - 4], 0x3e
mov eax, dword [0x10175f04]
test eax, eax
je 0x100083ec
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10175f04]
sub dword [0x10173e74], 1
jne 0x10008406
call fcn.100274d0
mov ecx, eax
call fcn.100277e0
mov eax, dword [0x10175f04]
test eax, eax
je 0x10008411
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x1a98]
mov dword [ebp - 0x1e2c], eax
mov byte [ebp - 4], 0x28
mov ecx, eax
call fcn.100119f0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1af8]
call fcn.10004b90
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1a90]
call fcn.10004b90
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ac8]
call fcn.10004b90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.10004b90
jmp 0x10007a93
lea eax, [ebp - 0x1a90]
push eax
call fcn.10017d20
test al, al
je 0x10008581
sub esp, 0x18
lea eax, [ebp - 0x1a90]
mov ecx, esp
mov dword [ebp - 0x1e2c], esp
push eax
call fcn.1000c440
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x1a98]
call fcn.1000e530
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1cec]
call fcn.10004b90
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1be4]
call fcn.10004b90
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x1bb8]
call fcn.10004b90
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1bc4]
call fcn.1000c570
mov byte [ebp - 4], 0x44
mov eax, dword [0x10175f04]
test eax, eax
je 0x10008500
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10175f04]
sub dword [0x10173e74], 1
jne 0x1000851a
call fcn.100274d0
mov ecx, eax
call fcn.100277e0
mov eax, dword [0x10175f04]
test eax, eax
je 0x10008525
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x1a98]
mov dword [ebp - 0x1e2c], eax
mov byte [ebp - 4], 0x28
mov ecx, eax
call fcn.100119f0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1af8]
call fcn.10004b90
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1a90]
call fcn.10004b90
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ac8]
call fcn.10004b90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.10004b90
jmp 0x10007a93
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1cec]
call fcn.10004b90
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1be4]
call fcn.10004b90
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x1bb8]
call fcn.10004b90
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1bc4]
call fcn.1000c570
mov byte [ebp - 4], 0x49
mov eax, dword [0x10175f04]
test eax, eax
je 0x100085d6
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10175f04]
sub dword [0x10173e74], 1
jne 0x100085f0
call fcn.100274d0
mov ecx, eax
call fcn.100277e0
mov eax, dword [0x10175f04]
test eax, eax
je 0x100085fb
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x1a98]
mov dword [ebp - 0x1e2c], eax
mov byte [ebp - 4], 0x28
mov ecx, eax
call fcn.100119f0
jmp 0x10008692
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x10008692
lea ecx, [ebp - 0x1d4c]
call fcn.10004b70
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x1d4c]
push 0x1b
push str.Other_Browser_Home
call fcn.10004bf0
push 0x37e
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1d4c]
mov ecx, 0x1017651c
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x10008683
lea eax, [ebp - 0x1d4c]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1d4c]
call fcn.10004b90
xor eax, eax
mov dword [ebp - 0x1c94], 0
mov dword [ebp - 0x1c90], 0
mov dword [ebp - 0x1c94], 0
mov dword [ebp - 0x1c90], 7
mov word [ebp - 0x1ca4], ax
mov byte [ebp - 4], 0x4c
mov dword [ebp - 0x1c7c], eax
mov dword [ebp - 0x1c78], eax
mov dword [ebp - 0x1c7c], eax
mov dword [ebp - 0x1c78], 7
mov word [ebp - 0x1c8c], ax
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1a2c]
mov dword [ebp - 0x1a2c], eax
call fcn.1001a620
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1a2c]
call fcn.1001a850
lea eax, [ebp - 0x1a90]
push eax
lea ecx, [ebp - 0x1a2c]
call fcn.1001aac0
test al, al
je 0x10008a30
lea eax, [ebp - 0x1c8c]
push eax
lea eax, [ebp - 0x1ca4]
push eax
push ecx
lea eax, [ebp - 0x1af8]
push eax
lea ecx, [ebp - 0x1a2c]
call fcn.1001aa00
test al, al
je 0x10008a30
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x100087e6
lea ecx, [ebp - 0x1d64]
call fcn.10004b70
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x1a90]
cmp dword [ebp - 0x1a7c], 8
lea eax, [ebp - 0x1d64]
cmovae ecx, dword [ebp - 0x1a90]
push ecx
push 0x10144804
push eax
call fcn.100c0730
add esp, 0xc
lea eax, [ebp - 0x1d64]
mov ecx, 0x1017651c
push 0x389
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x100087d7
lea eax, [ebp - 0x1d64]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1d64]
call fcn.10004b90
cmp dword [ebp - 0x1a68], 0
jne 0x10008892
cmp dword [ebp - 0x1a7c], 8
lea eax, [ebp - 0x1a90]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x1a90]
push eax
call esi
test eax, eax
je 0x10008828
lea eax, [ebp - 0x1a90]
push eax
lea ecx, [ebp - 0x1a78]
call fcn.1000c360
jmp 0x10008892
push 0x20a
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.100f2c30
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push str._ProgramFiles_Internet_Exploreriexplore.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x228]
push eax
call esi
test eax, eax
je 0x10008892
lea ecx, [ebp - 0x228]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008870
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1a78]
call fcn.10004bf0
cmp dword [ebp - 0x1a64], 8
lea eax, [ebp - 0x1a78]
push str.2345explorer.exe
cmovae eax, dword [ebp - 0x1a78]
push eax
call edi
test eax, eax
je 0x100088e8
lea eax, [ebp - 0x1af8]
push eax
lea ecx, [ebp - 0x1a5c]
call fcn.1000c360
push 1
push 0x1014487c
lea ecx, [ebp - 0x1a5c]
call fcn.1000c770
push 0xb
push 0x10144880
lea ecx, [ebp - 0x1a5c]
call fcn.1000c770
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x100089a7
lea ecx, [ebp - 0x1d7c]
call fcn.10004b70
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x1a5c]
cmp dword [ebp - 0x1a48], 8
lea eax, [ebp - 0x1a78]
cmovae ecx, dword [ebp - 0x1a5c]
cmp dword [ebp - 0x1a64], 8
mov dword [ebp - 0x1e68], ecx
cmovae eax, dword [ebp - 0x1a78]
mov dword [ebp - 0x1e2c], eax
lea eax, [ebp - 0x1e68]
push eax
lea eax, [ebp - 0x1e2c]
push eax
push 0x10144898
lea eax, [ebp - 0x1d7c]
push eax
call fcn.1000ce00
push 0x3a3
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1d7c]
mov ecx, 0x1017651c
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x10008998
lea eax, [ebp - 0x1d7c]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1d7c]
call fcn.10004b90
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1a78]
push eax
call fcn.10017d20
test al, al
je 0x10008acc
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1a2c]
call fcn.1001a690
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x1c8c]
call fcn.10004b90
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1ca4]
call fcn.10004b90
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1af8]
call fcn.10004b90
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1a90]
call fcn.10004b90
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ac8]
call fcn.10004b90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.10004b90
jmp 0x10007a93
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov edi, eax
test edi, edi
je 0x10008acc
lea ecx, [ebp - 0x1d94]
call fcn.10004b70
mov byte [ebp - 4], 0x52
lea esi, [ebp - 0x1ac8]
cmp dword [ebp - 0x1ab4], 8
cmovae esi, dword [ebp - 0x1ac8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
lea eax, [ebp - 0x1d94]
push str.RCBlackShortCut_Analyze_Fail___x_lnk___s
push eax
call fcn.100c0730
add esp, 0x10
lea eax, [ebp - 0x1d94]
mov ecx, 0x1017651c
push 0x3ab
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100c0290
cmp edi, 1
jbe 0x10008abd
lea eax, [ebp - 0x1d94]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1d94]
call fcn.10004b90
mov eax, dword [ebp - 0x1a2c]
test eax, eax
je 0x10008ada
mov byte [eax + 4], 0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1a2c]
call fcn.1001a690
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x1c8c]
call fcn.10004b90
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1ca4]
jmp 0x10008b79
push 4
mov ecx, 0x1017651c
call fcn.100c0250
mov esi, eax
test esi, esi
je 0x10008b7e
lea ecx, [ebp - 0x1dac]
call fcn.10004b70
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x1dac]
push 0x1b
push str.GetShortCutTargetCmdEx_Fail
call fcn.10004bf0
push 0x3b1
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1dac]
mov ecx, 0x1017651c
push eax
push 4
call fcn.100c0290
cmp esi, 1
jbe 0x10008b6f
lea eax, [ebp - 0x1dac]
mov ecx, 0x1017651c
push eax
call fcn.100c05b0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1dac]
call fcn.10004b90
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1af8]
call fcn.10004b90
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1a90]
call fcn.10004b90
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ac8]
call fcn.10004b90
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.10004b90
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1b10]
call fcn.10004b90
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1ab0]
call fcn.10004b90
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1a44]
call fcn.10004b90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a5c]
call fcn.10004b90
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100da624
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
call fcn.100f5ab9
int3