Function at 0x1008e2e0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2eb0
call fcn.101f99e0
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2e24], ecx
mov dword [ebp - 0x2df4], eax
mov dword [ebp - 0x2dec], 0
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp - 0x2e20], ebx
push esi
mov esi, dword [ebp + 8]
push edi
cmp ecx, 0x400
jg 0x1008e37e
je 0x1008e368
cmp ecx, 0x100
je 0x1008e352
cmp ecx, 0x200
jne 0x1008e39c
mov dword [ebp - 0x2de4], 0x32
mov dword [ebp - 0x2de0], 0x1a
jmp 0x1008e3b4
mov dword [ebp - 0x2de4], 0x32
mov dword [ebp - 0x2de0], 0x10
jmp 0x1008e3b4
mov dword [ebp - 0x2de4], 0x32
mov dword [ebp - 0x2de0], 2
jmp 0x1008e3b4
cmp ecx, 0x800
jne 0x1008e39c
mov dword [ebp - 0x2de4], 0x32
mov dword [ebp - 0x2de0], 6
jmp 0x1008e3b4
mov eax, dword [ebp - 0x2e14]
mov dword [ebp - 0x2de4], eax
mov eax, dword [ebp - 0x2e14]
mov dword [ebp - 0x2de0], eax
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x414]
push 0x10204524
push esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, 0x5c
mov dword [ebp - 0x630], 0xffffffff
mov word [ebp - 0x634], ax
lea ecx, [ebp - 0xc94]
lea eax, [ebp - 0x414]
mov dword [ebp - 0x62c], 0
push eax
call fcn.10024810
test eax, eax
je 0x10090611
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x2e10], 0
mov dword [ebp - 0x2e0c], 0
mov dword [ebp - 0x2e08], 0
jmp 0x1008e440
cmp dword [ebp - 0x62c], 0
je 0x1008e6c1
mov eax, dword [ebp - 0xc94]
shr eax, 4
and eax, 1
je 0x1008e489
cmp word [ebp - 0xc68], 0x2e
jne 0x1008e489
mov cx, word [ebp - 0xc66]
test cx, cx
je 0x1009055c
cmp cx, 0x2e
jne 0x1008e489
cmp word [ebp - 0xc64], 0
je 0x1009055c
test eax, eax
je 0x1008e6c1
lea eax, [ebp - 0x2dc8]
push eax
lea ecx, [ebp - 0xc94]
call fcn.10024c60
mov edi, dword [ebp - 0x2dc8]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1008e4bf
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x1008e4d2
call eax
jmp 0x1008e4d8
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x2df8], eax
test esi, esi
je 0x1008e4e5
push esi
call ebx
mov eax, dword [ebp - 0x2dc8]
mov esi, dword [eax - 0xc]
cmp esi, 1
jg 0x1008e504
add eax, 0xfffffff0
push eax
call fcn.10002a60
add esp, 4
lea esi, [eax + 0x10]
jmp 0x1008e55c
mov ecx, dword [eax - 0x10]
test ecx, ecx
je 0x1008e514
mov eax, dword [ecx]
call dword [eax + 0x10]
test eax, eax
jne 0x1008e520
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x10]
mov edi, dword [ebp - 0x2dc8]
mov ecx, eax
mov edx, dword [eax]
add edi, 0xfffffffe
push 2
push 1
lea edi, [edi + esi*2]
call dword [edx]
test eax, eax
je 0x1009064c
push 2
lea esi, [eax + 0x10]
xor eax, eax
mov dword [esi - 0xc], 1
push edi
push 2
push esi
mov word [esi + 2], ax
call fcn.10004510
add esp, 0x10
mov ecx, 0x10202944
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1008e589
test dx, dx
je 0x1008e585
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1008e589
add eax, 4
add ecx, 4
test dx, dx
jne 0x1008e563
xor edi, edi
jmp 0x1008e58e
sbb edi, edi
or edi, 1
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1008e5a6
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
je 0x1008e654
mov eax, dword [ebp - 0x2dc8]
mov edi, 0x10202944
sub edi, eax
mov dword [ebp - 0x2dfc], 0x10202944
push 1
push 0x10202944
mov ebx, dword [eax - 0xc]
sar edi, 1
mov dword [ebp - 0x2d9c], ebx
call fcn.101e6fd0
mov ecx, dword [ebp - 0x2dc8]
add ebx, eax
mov esi, 1
mov dword [ebp - 0x2da0], eax
add esp, 8
mov edx, dword [ecx - 8]
sub esi, dword [ecx - 4]
sub edx, ebx
or esi, edx
jge 0x1008e610
push ebx
lea ecx, [ebp - 0x2dc8]
call fcn.10003310
mov ecx, dword [ebp - 0x2dc8]
mov edx, dword [ebp - 0x2d9c]
cmp edi, edx
ja 0x1008e623
lea eax, [ecx + edi*2]
mov dword [ebp - 0x2dfc], eax
mov eax, dword [ebp - 0x2da0]
add eax, eax
push eax
push dword [ebp - 0x2dfc]
push eax
lea eax, [ecx + edx*2]
push eax
call fcn.10004510
mov eax, dword [ebp - 0x2dc8]
add esp, 0x10
xor ecx, ecx
mov dword [eax - 0xc], ebx
mov eax, dword [ebp - 0x2dc8]
mov word [eax + ebx*2], cx
cmp dword [ebp + 0xc], 0
jle 0x1008e6b6
mov eax, dword [ebp - 0x2df8]
cmp eax, 0xffffffff
je 0x1008e6b6
test eax, 0x400
jne 0x1008e6b6
mov esi, dword [ebp - 0x2e0c]
cmp dword [ebp - 0x2e08], esi
je 0x1008e6a3
mov eax, dword [ebp - 0x2dc8]
add eax, 0xfffffff0
push eax
call fcn.10002a60
add eax, 0x10
add esp, 4
mov dword [esi], eax
add dword [ebp - 0x2e0c], 4
mov edx, dword [ebp - 0x2dc8]
jmp 0x10090544
lea eax, [ebp - 0x2dc8]
push eax
push esi
lea ecx, [ebp - 0x2e10]
call fcn.100048e0
mov edx, dword [ebp - 0x2dc8]
jmp 0x10090544
lea eax, [ebp - 0x2dc4]
push eax
lea ecx, [ebp - 0xc94]
call fcn.10024c60
mov eax, dword [ebp - 0x2dc4]
push ecx
add eax, 0xfffffff0
mov esi, esp
push eax
call fcn.10002a60
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.101b08f0
add esp, 4
test al, al
jne 0x1009053e
push dword [ebp - 0x2dc4]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov ebx, eax
push ebx
mov dword [ebp - 0x2d9c], ebx
call sub.msvcrt.dll__wcslwr
add esp, 4
lea ecx, [ebp - 0x2e5c]
push ebx
call fcn.10002490
mov esi, dword [0x1025ad18]
mov ebx, esi
mov eax, dword [ebp - 0x2e5c]
mov dword [ebp - 0x2db8], esi
mov edi, dword [esi + 4]
cmp byte [edi + 0xd], 0
jne 0x1008e78c
mov edx, dword [edi + 0x10]
mov ecx, eax
mov si, word [edx]
cmp si, word [ecx]
jne 0x1008e76e
test si, si
je 0x1008e76a
mov si, word [edx + 2]
cmp si, word [ecx + 2]
jne 0x1008e76e
add edx, 4
add ecx, 4
test si, si
jne 0x1008e748
xor ecx, ecx
jmp 0x1008e773
sbb ecx, ecx
or ecx, 1
test ecx, ecx
jns 0x1008e77c
mov edi, dword [edi + 8]
jmp 0x1008e780
mov ebx, edi
mov edi, dword [edi]
cmp byte [edi + 0xd], 0
je 0x1008e743
mov esi, dword [ebp - 0x2db8]
cmp ebx, esi
je 0x1008e7ca
mov edx, dword [ebx + 0x10]
mov ecx, eax
mov si, word [ecx]
cmp si, word [edx]
jne 0x1008e7bb
test si, si
je 0x1008e7b7
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x1008e7bb
add ecx, 4
add edx, 4
test si, si
jne 0x1008e795
xor ecx, ecx
jmp 0x1008e7c0
sbb ecx, ecx
or ecx, 1
mov esi, dword [ebp - 0x2db8]
test ecx, ecx
jns 0x1008e7cc
mov ebx, esi
lea edx, [eax - 0x10]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008e7e4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp ebx, esi
je 0x1009053e
push 0x10202940
lea ecx, [ebp - 0x2e00]
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0x2de8]
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0x2da4]
call fcn.10002490
push 0x10202940
lea ecx, [ebp - 0x2df0]
call fcn.10002490
cmp dword [ebp - 0x62c], 0
je 0x1008e84f
mov ebx, dword [ebp - 0xc74]
mov dword [ebp - 0x2db8], ebx
mov ebx, dword [ebp - 0xc78]
mov dword [ebp - 0x2dd0], ebx
jmp 0x1008e863
mov dword [ebp - 0x2db8], 0
mov dword [ebp - 0x2dd0], 0
push 0x1074
lea eax, [ebp - 0x2d98]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push str..url
push dword [ebp - 0x2d9c]
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x2dcc], eax
lea eax, [ebp - 0xc94]
push eax
lea eax, [ebp - 0x2e58]
push eax
call fcn.10090660
mov edi, dword [ebp - 0x2e58]
lea eax, [edi - 0x10]
push eax
mov dword [ebp - 0x2dfc], eax
call fcn.10002a60
add esp, 0xc
lea esi, [eax + 0x10]
push 0x10257bc0
mov dword [ebp - 0x2d9c], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x2d9c]
mov ecx, 0x10257bb8
push eax
lea eax, [ebp - 0x2e54]
push eax
call fcn.1005e9c0
mov eax, dword [ebp - 0x2e54]
cmp eax, dword [0x10257bb8]
je 0x1008e958
mov edx, dword [eax + 0x10]
mov ecx, esi
nop
mov bx, word [ecx]
cmp bx, word [edx]
jne 0x1008e926
test bx, bx
je 0x1008e922
mov bx, word [ecx + 2]
cmp bx, word [edx + 2]
jne 0x1008e926
add ecx, 4
add edx, 4
test bx, bx
jne 0x1008e900
xor ecx, ecx
jmp 0x1008e92b
sbb ecx, ecx
or ecx, 1
test ecx, ecx
js 0x1008e958
lea ebx, [eax + 0x18]
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x10257bc0
call eax
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1008e97e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1008e97e
mov eax, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
push 0x10257bc0
call eax
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1008e97c
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor ebx, ebx
test ebx, ebx
jne 0x1008ed5a
cmp dword [ebp - 0x2dcc], ebx
je 0x1008e9e9
push ebx
lea eax, [ebp - 0x2d98]
push eax
push dword [ebp - 0x2dc4]
call fcn.100dc090
push dword [ebp - 0x2dc4]
lea eax, [ebp - 0x2e78]
push eax
call fcn.10090990
add esp, 0x14
lea ecx, [ebp - 0x2df0]
push eax
call fcn.10002790
mov edx, dword [ebp - 0x2e78]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008eae0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1008eae0
lea eax, [ebp - 0x2da4]
push eax
lea eax, [ebp - 0x2de8]
push eax
push dword [ebp - 0x2dc4]
call fcn.10090d40
mov esi, dword [ebp - 0x2de8]
add esp, 8
mov ebx, esp
lea eax, [esi - 0x10]
push eax
mov dword [ebp - 0x2d9c], eax
call fcn.10002a60
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.101b08f0
add esp, 4
test al, al
jne 0x1008ecc6
mov eax, dword [ebp - 0x2da4]
push ecx
add eax, 0xfffffff0
mov ebx, esp
push eax
call fcn.10002a60
add esp, 4
add eax, 0x10
mov dword [ebx], eax
call fcn.101b08f0
add esp, 4
test al, al
jne 0x1008ecc6
lea ecx, [ebp - 0x2da4]
call fcn.1000a1f0
mov ecx, eax
call fcn.1000a160
lea eax, [ebp - 0x2da4]
push eax
call fcn.10092220
add esp, 4
lea eax, [ebp - 0x2de8]
lea ecx, [ebp - 0x2e00]
push eax
call fcn.10002790
push esi
call fcn.100de510
mov dword [ebp - 0x2db8], eax
lea eax, [ebp - 0x2d98]
push 0
push eax
push esi
mov dword [ebp - 0x2dd0], edx
call fcn.100dc090
add esp, 0x10
lea eax, [ebp - 0x2e50]
mov ecx, 0x1025b480
push 1
push esi
push eax
call fcn.10002ad0
push eax
lea ecx, [ebp - 0x2de8]
call fcn.10002790
lea ecx, [ebp - 0x2e50]
call fcn.10007e10
lea ecx, [ebp - 0x1d24]
call fcn.1008e160
lea eax, [ebp - 0x2e00]
push eax
lea ecx, [ebp - 0x1d24]
call fcn.10002790
lea eax, [ebp - 0x2de8]
push eax
lea ecx, [ebp - 0x1d20]
call fcn.10002790
lea eax, [ebp - 0x2da4]
push eax
lea ecx, [ebp - 0x1d1c]
call fcn.10002790
lea eax, [ebp - 0x2df0]
push eax
lea ecx, [ebp - 0x1d18]
call fcn.10002790
push 0x1074
lea eax, [ebp - 0x2d98]
push eax
lea eax, [ebp - 0x1d14]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x2dd0]
lea edx, [edi - 0x10]
mov ebx, dword [ebp - 0x2db8]
push edx
mov dword [ebp - 0xc9c], ebx
mov dword [ebp - 0xc98], eax
call fcn.10002a60
add esp, 0x10
add eax, 0x10
mov dword [ebp - 0x2e04], eax
push 0x10257bc0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea eax, [ebp - 0x2e04]
mov ecx, 0x10257bb8
push eax
lea eax, [ebp - 0x2e4c]
push eax
call fcn.1005e9c0
mov esi, dword [ebp - 0x2e4c]
cmp esi, dword [0x10257bb8]
je 0x1008ebe1
mov ecx, dword [esi + 0x10]
mov eax, dword [ebp - 0x2e04]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1008ebd8
test dx, dx
je 0x1008ebd4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1008ebd8
add eax, 4
add ecx, 4
test dx, dx
jne 0x1008ebb2
xor eax, eax
jmp 0x1008ebdd
sbb eax, eax
or eax, 1
test eax, eax
jns 0x1008ec27
lea eax, [ebp - 0x2e04]
mov ecx, 0x10257bb8
mov dword [ebp - 0x2d9c], eax
lea eax, [ebp - 0x2dd5]
push eax
lea eax, [ebp - 0x2d9c]
push eax
push 0x1020c858
call fcn.1008d8b0
push eax
add eax, 0x10
mov ecx, 0x10257bb8
push eax
push esi
lea eax, [ebp - 0x2e48]
push eax
call fcn.1008dc10
mov esi, dword [ebp - 0x2e48]
lea eax, [ebp - 0x1d24]
push eax
lea ecx, [esi + 0x18]
call fcn.10002790
lea eax, [ebp - 0x1d20]
push eax
lea ecx, [esi + 0x1c]
call fcn.10002790
lea eax, [ebp - 0x1d1c]
push eax
lea ecx, [esi + 0x20]
call fcn.10002790
lea eax, [ebp - 0x1d18]
push eax
lea ecx, [esi + 0x24]
call fcn.10002790
push 0x1074
lea eax, [ebp - 0x1d14]
push eax
lea eax, [esi + 0x28]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp - 0x2dd0]
add esp, 0xc
mov dword [esi + 0x10a0], ebx
mov dword [esi + 0x10a4], eax
push 0x10257bc0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [ebp - 0x2e04]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008ecb6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea ecx, [ebp - 0x1d24]
call fcn.1008e270
jmp 0x1008ee54
mov edx, dword [ebp - 0x2dfc]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008ece1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2df0]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008ecff
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2da4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008ed1d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2d9c]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008ed38
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2e00]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1009053e
mov ecx, dword [edx]
push edx
jmp 0x10090539
mov eax, dword [ebx + 4]
push ecx
sub eax, 0x10
mov esi, esp
push eax
call fcn.10002a60
add esp, 4
add eax, 0x10
mov dword [esi], eax
call fcn.101b08f0
add esp, 4
test al, al
je 0x1008ede2
mov edx, dword [ebp - 0x2dfc]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008ed98
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2df0]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008edb6
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2da4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008edd4
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2de8]
add edx, 0xfffffff0
jmp 0x1008ed23
push 0x1074
lea eax, [ebx + 0x10]
push eax
lea eax, [ebp - 0x2d98]
push eax
call sub.msvcrt.dll_memcpy
add esp, 0xc
lea eax, [ebx + 4]
lea ecx, [ebp - 0x2de8]
push eax
call fcn.10002790
push ebx
lea ecx, [ebp - 0x2e00]
call fcn.10002790
lea eax, [ebx + 8]
push eax
lea ecx, [ebp - 0x2da4]
call fcn.10002790
lea eax, [ebx + 0xc]
push eax
lea ecx, [ebp - 0x2df0]
call fcn.10002790
cmp dword [ebp - 0x2dcc], 0
jne 0x1008ee54
mov eax, dword [ebx + 0x1088]
mov dword [ebp - 0x2db8], eax
mov eax, dword [ebx + 0x108c]
mov dword [ebp - 0x2dd0], eax
mov ebx, dword [ebp - 0x2dc4]
xor eax, eax
mov dword [ebp - 0x5b0], eax
mov dword [ebp - 0x5ac], eax
mov dword [ebp - 0x5a8], eax
mov dword [ebp - 0x5a4], eax
mov dword [ebp - 0x5a0], eax
mov dword [ebp - 0x59c], eax
mov dword [ebp - 0x598], eax
mov dword [ebp - 0x594], eax
mov dword [ebp - 0x590], eax
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1008eea8
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x1b
call fcn.10003680
add esp, 4
test eax, eax
je 0x1008eec4
lea ecx, [ebp - 0x5b0]
push ecx
push 0
push ebx
call eax
jmp 0x1008eed4
lea eax, [ebp - 0x5b0]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test esi, esi
je 0x1008eedf
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea eax, [ebp - 0x2e80]
push eax
lea eax, [ebp - 0x59c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x58c]
push eax
lea eax, [ebp - 0x2e80]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x2df8], eax
movzx eax, word [ebp - 0x582]
push eax
movzx eax, word [ebp - 0x584]
push eax
movzx eax, word [ebp - 0x586]
push eax
movzx eax, word [ebp - 0x58a]
push eax
movzx eax, word [ebp - 0x58c]
push eax
lea eax, [ebp - 0x2df8]
push str._4hd_02hd_02hd_02hd_02hd
push eax
call fcn.10002cb0
add esp, 0x1c
lea eax, [ebp - 0x2e44]
lea ecx, [ebp - 0xc94]
push eax
call fcn.10024bf0
push dword [eax]
lea eax, [ebp - 0x45c]
push eax
call fcn.100987c0
mov edx, dword [ebp - 0x2e44]
add esp, 8
add edx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008ef99
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ebx, dword [ebp - 0x2dcc]
test ebx, ebx
je 0x1008efb8
or dword [ebp - 0x2dec], 1
lea eax, [ebp - 0x48c]
push dword [ebp - 0x2df0]
jmp 0x1008efcb
or dword [ebp - 0x2dec], 2
lea eax, [ebp - 0x42c]
push dword [ebp - 0x2de8]
push eax
call fcn.100987c0
add esp, 8
lea ecx, [ebp - 0x444]
push eax
call fcn.10032870
mov eax, dword [ebp - 0x2dec]
test al, 2
je 0x1008f004
and eax, 0xfffffffd
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x2dec], eax
call fcn.10005250
mov eax, dword [ebp - 0x2dec]
test al, 1
je 0x1008f01c
and eax, 0xfffffffe
lea ecx, [ebp - 0x48c]
mov dword [ebp - 0x2dec], eax
call fcn.10005250
mov ecx, edi
mov dword [ebp - 0x41c], 0
xor eax, eax
mov dword [ebp - 0x418], 7
mov word [ebp - 0x42c], ax
lea edx, [ecx + 2]
mov edi, edi
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1008f040
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x42c]
call fcn.100070c0
cmp dword [ebp - 0x430], 8
lea eax, [ebp - 0x444]
jb 0x1008f071
mov eax, dword [ebp - 0x444]
push dword [ebp - 0x434]
lea ecx, [ebp - 0x42c]
push eax
call fcn.10006d70
mov edx, eax
mov ecx, dword [edx]
mov eax, dword [edx + 0x14]
mov dword [ebp - 0x5c8], ecx
mov ecx, dword [edx + 4]
mov dword [ebp - 0x5c4], ecx
mov ecx, dword [edx + 8]
mov dword [ebp - 0x5c0], ecx
mov ecx, dword [edx + 0xc]
mov dword [ebp - 0x5b4], eax
xor eax, eax
mov dword [ebp - 0x5bc], ecx
mov ecx, dword [edx + 0x10]
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 7
mov word [edx], ax
lea eax, [ebp - 0x5c8]
push eax
push dword [ebp - 0x2e24]
lea eax, [ebp - 0x57c]
mov dword [ebp - 0x5b8], ecx
push eax
call fcn.10091ab0
add esp, 0xc
lea ecx, [ebp - 0x5c8]
call fcn.10005250
lea ecx, [ebp - 0x42c]
call fcn.10005250
lea eax, [ebp - 0x2544]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.100987c0
lea eax, [ebp - 0x2b5c]
push eax
lea eax, [ebp - 0x4bc]
push eax
call fcn.100987c0
lea eax, [ebp - 0x274c]
push eax
lea eax, [ebp - 0x4d4]
push eax
call fcn.100987c0
lea eax, [ebp - 0x2d64]
push eax
lea eax, [ebp - 0x4ec]
push eax
call fcn.100987c0
lea eax, [ebp - 0x233c]
push eax
lea eax, [ebp - 0x504]
push eax
call fcn.100987c0
lea eax, [ebp - 0x2954]
push eax
lea eax, [ebp - 0x51c]
push eax
call fcn.100987c0
lea eax, [ebp - 0x2134]
push eax
lea eax, [ebp - 0x534]
push eax
call fcn.100987c0
lea eax, [ebp - 0x1f2c]
push eax
lea eax, [ebp - 0x54c]
push eax
call fcn.100987c0
add esp, 0x40
lea eax, [ebp - 0x564]
push dword [ebp - 0x2da4]
push eax
call fcn.100987c0
push dword [ebp - 0x2df8]
lea eax, [ebp - 0x474]
push eax
call fcn.100987c0
mov edi, dword [ebp - 0x2e00]
add esp, 0x10
test ebx, ebx
je 0x1008f311
lea eax, [ebp - 0x2e64]
mov ecx, 0x1025be20
push eax
call fcn.1007f0b0
cmp dword [ebp - 0x460], 8
mov eax, dword [eax]
mov dword [ebp - 0x2d9c], eax
lea eax, [ebp - 0x474]
mov dword [ebp - 0x2dcc], eax
jb 0x1008f209
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x2dcc], eax
cmp dword [ebp - 0x430], 8
lea ebx, [ebp - 0x444]
jb 0x1008f21e
mov ebx, dword [ebp - 0x444]
cmp dword [ebp - 0x448], 8
lea esi, [ebp - 0x45c]
jb 0x1008f233
mov esi, dword [ebp - 0x45c]
lea eax, [ebp - 0x2e3c]
push eax
call fcn.10091530
push dword [eax]
lea eax, [ebp - 0x42c]
push dword [ebp - 0x2d9c]
push dword [ebp - 0x2dcc]
push dword [ebp - 0x2de0]
push ebx
push dword [ebp - 0x2dd0]
mov ebx, dword [ebp - 0x2de4]
push dword [ebp - 0x2db8]
push esi
push ebx
push ebx
push str._type_:_d__rule_group_id_:__d___file_name_:__s__t_t_t_t_t_t_t_t_t_t___file_size_:_I64d_t_t_t_t_t_t_t_t_t_t___lnk_url_:__s__t_t_t_t_t_t_t_t_t_t___lnk_from_:_d_t_t_t_t_t_t_t_t_t_t___exts_:__key_:_lw___value_:__s___key_:_sys_clonetag___value_:__s___key_:_process_name___value_:__s__
push eax
call fcn.10098240
push eax
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x5f8]
push eax
call fcn.1007aca0
mov ecx, dword [ebp - 0x2df4]
add esp, 0x40
push eax
call fcn.1001d7b0
mov ecx, dword [ebp - 0x2df4]
push eax
add eax, 0x10
push eax
push 0
lea eax, [ebp - 0x2eb0]
push eax
call fcn.1001f180
lea ecx, [ebp - 0x5f8]
call fcn.1007c210
lea ecx, [ebp - 0x42c]
call fcn.10005250
mov edx, dword [ebp - 0x2e64]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1008f2ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2e3c]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1009024e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1009024e
mov eax, dword [ebp - 0x2da4]
cmp dword [eax - 0xc], 0
jl 0x1008f391
push 0x102053b4
push eax
call sub.msvcrt.dll_wcsstr
add esp, 8
test eax, eax
je 0x1008f391
mov ecx, dword [ebp - 0x2da4]
sub eax, ecx
sar eax, 1
cmp eax, 1
jne 0x1008f391
cmp dword [ecx - 0xc], 0
jl 0x1008f391
push 0x10202944
push ecx
call sub.msvcrt.dll_wcsstr
mov ecx, dword [ebp - 0x2da4]
add esp, 8
test eax, eax
je 0x1008f365
sub eax, ecx
sar eax, 1
cmp eax, 2
je 0x1008f38a
cmp dword [ecx - 0xc], 0
jl 0x1008f391
push 0x102054a0
push ecx
call sub.msvcrt.dll_wcsstr
add esp, 8
test eax, eax
je 0x1008f391
sub eax, dword [ebp - 0x2da4]
sar eax, 1
cmp eax, 2
jne 0x1008f391
mov esi, 1
jmp 0x1008f393
xor esi, esi
push 0x10202940
lea ecx, [ebp - 0x42c]
call fcn.10020470
call fcn.10093440
mov ecx, eax
call fcn.10093bf0
test eax, eax
je 0x1008f563
test esi, esi
je 0x1008f563
push 0x10202944
push 0x102054a0
lea ecx, [ebp - 0x2da4]
call fcn.10003450
lea eax, [ebp - 0x2e18]
mov dword [ebp - 0x2e18], 0
push eax
push ecx
lea eax, [ebp - 0x2da4]
mov ecx, esp
push eax
call fcn.1001b810
call fcn.10093440
mov ecx, eax
call fcn.10093610
mov dword [ebp - 0x2da8], eax
test eax, eax
je 0x1008f563
lea ecx, [ebp - 0x2d9c]
mov dword [ebp - 0x2d9c], 0
push ecx
push dword [ebp - 0x2e18]
push eax
call fcn.101b9280
mov ebx, eax
add esp, 0xc
mov dword [ebp - 0x2dcc], ebx
test ebx, ebx
je 0x1008f555
mov ecx, ebx
lea eax, [ebp - 0xd94]
mov dword [ebp - 0xd98], eax
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1008f450
sub ecx, edx
lea esi, [ecx + 1]
mov dword [ebp - 0x2da0], esi
cmp esi, 0x80
jle 0x1008f477
push 2
push esi
call sub.msvcrt.dll_calloc
add esp, 8
jmp 0x1008f47d
lea eax, [ebp - 0xd94]
push esi
push eax
push esi
push ebx
push 0
push 3
mov dword [ebp - 0xd98], eax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor ebx, ebx
test eax, eax
sete bl
test eax, eax
jne 0x1008f4fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1008f4fa
mov ebx, dword [ebp - 0x2dcc]
push 0
push 0
push esi
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, eax
lea eax, [ebp - 0xd94]
push 0x80
push eax
lea eax, [ebp - 0xd98]
push esi
push eax
call fcn.1002dbb0
add esp, 0x10
push esi
push dword [ebp - 0xd98]
push dword [ebp - 0x2da0]
push ebx
push 0
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, eax
neg ebx
sbb ebx, ebx
inc ebx
test ebx, ebx
jne 0x1009062d
push dword [ebp - 0xd98]
lea eax, [ebp - 0x48c]
push eax
call fcn.100987c0
add esp, 8
lea ecx, [ebp - 0x42c]
push eax
call fcn.1002bd90
lea ecx, [ebp - 0x48c]
call fcn.10005250
mov eax, dword [ebp - 0xd98]
lea ecx, [ebp - 0xd94]
cmp eax, ecx
je 0x1008f547
push eax
call sub.msvcrt.dll_free
add esp, 4
push dword [ebp - 0x2dcc]
call sub.msvcrt.dll_free
add esp, 4
push dword [ebp - 0x2da8]
call sub.msvcrt.dll_void___cdecl_operator_delete___void__
add esp, 4
sub esp, 0x18
lea eax, [ebp - 0x444]
mov ecx, esp
push eax
call fcn.10005170
call fcn.10091690
add esp, 0x18
test al, al
je 0x1008fae9
lea eax, [ebp - 0x48c]
push eax
call fcn.10090b80
add esp, 4
lea eax, [ebp - 0x48c]
cmp dword [ebp - 0x478], 8
jb 0x1008f5a8
mov eax, dword [ebp - 0x48c]
push eax
lea eax, [ebp - 0x5e0]
push eax
call fcn.100987c0
add esp, 8
lea ecx, [ebp - 0x48c]
push eax
call fcn.1002bd90
lea ecx, [ebp - 0x5e0]
call fcn.10005250
cmp dword [ebp - 0x41c], 0
je 0x1008f876
lea eax, [ebp - 0x2e34]
push eax
call fcn.10091530
add esp, 4
mov ecx, 0x1025be20
mov eax, dword [eax]
mov dword [ebp - 0x2dd4], eax
lea eax, [ebp - 0x2e38]
push eax
call fcn.1007f0b0
cmp dword [ebp - 0x418], 8
mov eax, dword [eax]
mov dword [ebp - 0x2dac], eax
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x2dcc], eax
jb 0x1008f62d
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x2dcc], eax
cmp dword [ebp - 0x460], 8
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x2ddc], ecx
jb 0x1008f64e
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x2ddc], eax
cmp dword [ebp - 0x478], 8
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x2db4], eax
jb 0x1008f66f
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x2db4], eax
cmp dword [ebp - 0x550], 8
lea ecx, [ebp - 0x564]
mov dword [ebp - 0x2dc0], ecx
jb 0x1008f690
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x2dc0], eax
cmp dword [ebp - 0x538], 8
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x2dbc], eax
jb 0x1008f6b1
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x2dbc], eax
cmp dword [ebp - 0x520], 8
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x2db0], ecx
jb 0x1008f6d2
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x2db0], eax
cmp dword [ebp - 0x508], 8
lea eax, [ebp - 0x51c]
mov dword [ebp - 0x2da8], eax
jb 0x1008f6f3
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x2da8], eax
cmp dword [ebp - 0x4f0], 8
lea ecx, [ebp - 0x504]
mov dword [ebp - 0x2da0], ecx
jb 0x1008f714
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2da0], eax
cmp dword [ebp - 0x4d8], 8
lea eax, [ebp - 0x4ec]
mov dword [ebp - 0x2d9c], eax
jb 0x1008f735
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x2d9c], eax
cmp dword [ebp - 0x4c0], 8
lea ebx, [ebp - 0x4d4]
jb 0x1008f74a
mov ebx, dword [ebp - 0x4d4]
cmp dword [ebp - 0x4a8], 8
lea esi, [ebp - 0x4bc]
jb 0x1008f75f
mov esi, dword [ebp - 0x4bc]
cmp dword [ebp - 0x490], 8
lea edx, [ebp - 0x4a4]
jb 0x1008f774
mov edx, dword [ebp - 0x4a4]
cmp dword [ebp - 0x430], 8
lea ecx, [ebp - 0x444]
jb 0x1008f789
mov ecx, dword [ebp - 0x444]
cmp dword [ebp - 0x448], 8
lea eax, [ebp - 0x45c]
jb 0x1008f79e
mov eax, dword [ebp - 0x45c]
push dword [ebp - 0x2dd4]
push dword [ebp - 0x2dac]
push dword [ebp - 0x2dcc]
push dword [ebp - 0x2ddc]
push dword [ebp - 0x2db4]
push dword [ebp - 0x2dc0]
push dword [ebp - 0x2de0]
push dword [ebp - 0x2dbc]
push dword [ebp - 0x2db0]
push dword [ebp - 0x2da8]
push dword [ebp - 0x2da0]
push dword [ebp - 0x2d9c]
push dword [ebp - 0x2dd0]
push dword [ebp - 0x2db8]
push ebx
mov ebx, dword [ebp - 0x2de4]
push esi
push edx
push ecx
push eax
push ebx
push ebx
lea eax, [ebp - 0x5e0]
push str._type_:_d__rule_group_id_:__d___file_name_:__s___file_path_:__s___company_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_desc_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_version_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_size_:_I64d_t_t_t_t_t_t_t_t_t_t_t_t___internal_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___legal_cprt_:__s__t_t_t_t_t_t_t_t_t_t_t_t___original_file_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___product_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___product_version_:__s__t_t_t_t_t_t_t_t_t_t_t_t___lnk_from_:_d_t_t_t_t_t_t_t_t_t_t_t_t___lnk_arg_:__s__t_t_t_t_t_t_t_t_t_t_t_t___exts_:__key_:_hmpg___value_:__s___key_:_lw___value_:__s___key_:_u_html___value_:__s___key_:_sys_clonetag___value_:__s___key_:_process_name___value_:__s__
push eax
call fcn.10098240
push eax
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.1007aca0
mov ecx, dword [ebp - 0x2df4]
add esp, 0x68
push eax
lea eax, [ebp - 0x2ea8]
push eax
call fcn.1008dfb0
lea ecx, [ebp - 0x628]
call fcn.1007c210
lea ecx, [ebp - 0x5e0]
call fcn.10005250
lea ecx, [ebp - 0x2e38]
call fcn.10007e10
lea ecx, [ebp - 0x2e34]
call fcn.10007e10
lea ecx, [ebp - 0x48c]
call fcn.10005250
jmp 0x10090243
lea eax, [ebp - 0x2e68]
push eax
call fcn.10091530
add esp, 4
mov ecx, 0x1025be20
mov eax, dword [eax]
mov dword [ebp - 0x2dac], eax
lea eax, [ebp - 0x2e60]
push eax
call fcn.1007f0b0
cmp dword [ebp - 0x460], 8
lea ecx, [ebp - 0x474]
mov dword [ebp - 0x2d9c], ecx
mov eax, dword [eax]
mov dword [ebp - 0x2dd4], eax
jb 0x1008f8c7
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x2d9c], eax
cmp dword [ebp - 0x478], 8
lea eax, [ebp - 0x48c]
mov dword [ebp - 0x2da0], eax
jb 0x1008f8e8
mov eax, dword [ebp - 0x48c]
mov dword [ebp - 0x2da0], eax
cmp dword [ebp - 0x550], 8
lea ecx, [ebp - 0x564]
mov dword [ebp - 0x2da8], ecx
jb 0x1008f909
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x2da8], eax
cmp dword [ebp - 0x538], 8
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x2db0], eax
jb 0x1008f92a
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x2db0], eax
cmp dword [ebp - 0x520], 8
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x2dbc], ecx
jb 0x1008f94b
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x2dbc], eax
cmp dword [ebp - 0x508], 8
lea eax, [ebp - 0x51c]
mov dword [ebp - 0x2dc0], eax
jb 0x1008f96c
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x2dc0], eax
cmp dword [ebp - 0x4f0], 8
lea ecx, [ebp - 0x504]
mov dword [ebp - 0x2db4], ecx
jb 0x1008f98d
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2db4], eax
cmp dword [ebp - 0x4d8], 8
lea eax, [ebp - 0x4ec]
mov dword [ebp - 0x2ddc], eax
jb 0x1008f9ae
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x2ddc], eax
cmp dword [ebp - 0x4c0], 8
lea ebx, [ebp - 0x4d4]
jb 0x1008f9c3
mov ebx, dword [ebp - 0x4d4]
cmp dword [ebp - 0x4a8], 8
lea esi, [ebp - 0x4bc]
jb 0x1008f9d8
mov esi, dword [ebp - 0x4bc]
cmp dword [ebp - 0x490], 8
lea edx, [ebp - 0x4a4]
jb 0x1008f9ed
mov edx, dword [ebp - 0x4a4]
cmp dword [ebp - 0x430], 8
lea ecx, [ebp - 0x444]
jb 0x1008fa02
mov ecx, dword [ebp - 0x444]
cmp dword [ebp - 0x448], 8
lea eax, [ebp - 0x45c]
jb 0x1008fa17
mov eax, dword [ebp - 0x45c]
push dword [ebp - 0x2dac]
push dword [ebp - 0x2dd4]
push dword [ebp - 0x2d9c]
push dword [ebp - 0x2da0]
push dword [ebp - 0x2da8]
push dword [ebp - 0x2de0]
push dword [ebp - 0x2db0]
push dword [ebp - 0x2dbc]
push dword [ebp - 0x2dc0]
push dword [ebp - 0x2db4]
push dword [ebp - 0x2ddc]
push dword [ebp - 0x2dd0]
push dword [ebp - 0x2db8]
push ebx
push esi
push edx
push ecx
push eax
mov eax, dword [ebp - 0x2de4]
push eax
push eax
lea eax, [ebp - 0x5e0]
push str._type_:_d__rule_group_id_:__d___file_name_:__s___file_path_:__s___company_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_desc_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_version_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_size_:_I64d_t_t_t_t_t_t_t_t_t_t_t_t___internal_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___legal_cprt_:__s__t_t_t_t_t_t_t_t_t_t_t_t___original_file_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___product_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___product_version_:__s__t_t_t_t_t_t_t_t_t_t_t_t___lnk_from_:_d_t_t_t_t_t_t_t_t_t_t_t_t___lnk_arg_:__s__t_t_t_t_t_t_t_t_t_t_t_t___exts_:__key_:_hmpg___value_:__s___key_:_lw___value_:__s___key_:_sys_clonetag___value_:__s___key_:_process_name___value_:__s__
push eax
call fcn.10098240
push eax
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.1007aca0
mov ecx, dword [ebp - 0x2df4]
add esp, 0x64
push eax
lea eax, [ebp - 0x2ea0]
push eax
call fcn.1008dfb0
lea ecx, [ebp - 0x628]
call fcn.1007c210
lea ecx, [ebp - 0x5e0]
call fcn.10005250
lea ecx, [ebp - 0x2e60]
call fcn.10007e10
lea ecx, [ebp - 0x2e68]
call fcn.10007e10
lea ecx, [ebp - 0x48c]
call fcn.10005250
jmp 0x10090243
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push str..url
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
neg eax
sbb eax, eax
inc eax
cmp dword [ebp - 0x41c], 0
je 0x1008fd71
lea eax, [ebp - 0x2e40]
push eax
call fcn.10091530
add esp, 4
mov ecx, 0x1025be20
mov eax, dword [eax]
mov dword [ebp - 0x2dac], eax
lea eax, [ebp - 0x2e6c]
push eax
call fcn.1007f0b0
cmp dword [ebp - 0x418], 8
lea ecx, [ebp - 0x42c]
mov dword [ebp - 0x2d9c], ecx
mov eax, dword [eax]
mov dword [ebp - 0x2dd4], eax
jb 0x1008fb5f
mov eax, dword [ebp - 0x42c]
mov dword [ebp - 0x2d9c], eax
cmp dword [ebp - 0x460], 8
lea eax, [ebp - 0x474]
mov dword [ebp - 0x2da0], eax
jb 0x1008fb80
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x2da0], eax
cmp dword [ebp - 0x550], 8
lea ecx, [ebp - 0x564]
mov dword [ebp - 0x2da8], ecx
jb 0x1008fba1
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x2da8], eax
cmp dword [ebp - 0x538], 8
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x2db0], eax
jb 0x1008fbc2
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x2db0], eax
cmp dword [ebp - 0x520], 8
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x2dbc], ecx
jb 0x1008fbe3
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x2dbc], eax
cmp dword [ebp - 0x508], 8
lea eax, [ebp - 0x51c]
mov dword [ebp - 0x2dc0], eax
jb 0x1008fc04
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x2dc0], eax
cmp dword [ebp - 0x4f0], 8
lea ecx, [ebp - 0x504]
mov dword [ebp - 0x2db4], ecx
jb 0x1008fc25
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2db4], eax
cmp dword [ebp - 0x4d8], 8
lea eax, [ebp - 0x4ec]
mov dword [ebp - 0x2ddc], eax
jb 0x1008fc46
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x2ddc], eax
cmp dword [ebp - 0x4c0], 8
lea ebx, [ebp - 0x4d4]
jb 0x1008fc5b
mov ebx, dword [ebp - 0x4d4]
cmp dword [ebp - 0x4a8], 8
lea esi, [ebp - 0x4bc]
jb 0x1008fc70
mov esi, dword [ebp - 0x4bc]
cmp dword [ebp - 0x490], 8
lea edx, [ebp - 0x4a4]
jb 0x1008fc85
mov edx, dword [ebp - 0x4a4]
cmp dword [ebp - 0x430], 8
lea ecx, [ebp - 0x444]
jb 0x1008fc9a
mov ecx, dword [ebp - 0x444]
cmp dword [ebp - 0x448], 8
lea eax, [ebp - 0x45c]
jb 0x1008fcaf
mov eax, dword [ebp - 0x45c]
push dword [ebp - 0x2dac]
push dword [ebp - 0x2dd4]
push dword [ebp - 0x2d9c]
push dword [ebp - 0x2da0]
push dword [ebp - 0x2da8]
push dword [ebp - 0x2de0]
push dword [ebp - 0x2db0]
push dword [ebp - 0x2dbc]
push dword [ebp - 0x2dc0]
push dword [ebp - 0x2db4]
push dword [ebp - 0x2ddc]
push dword [ebp - 0x2dd0]
push dword [ebp - 0x2db8]
push ebx
mov ebx, dword [ebp - 0x2de4]
push esi
push edx
push ecx
push eax
push ebx
push ebx
lea eax, [ebp - 0x5e0]
push str._type_:_d__rule_group_id_:__d___file_name_:__s___file_path_:__s___company_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_desc_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_version_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_size_:_I64d_t_t_t_t_t_t_t_t_t_t_t_t___internal_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___legal_cprt_:__s__t_t_t_t_t_t_t_t_t_t_t_t___original_file_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___product_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___product_version_:__s__t_t_t_t_t_t_t_t_t_t_t_t___lnk_from_:_d_t_t_t_t_t_t_t_t_t_t_t_t___lnk_arg_:__s__t_t_t_t_t_t_t_t_t_t_t_t___exts_:__key_:_lw___value_:__s___key_:_u_html___value_:__s___key_:_sys_clonetag___value_:__s___key_:_process_name___value_:__s__
push eax
call fcn.10098240
push eax
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.1007aca0
mov ecx, dword [ebp - 0x2df4]
add esp, 0x64
push eax
lea eax, [ebp - 0x2e98]
push eax
call fcn.1008dfb0
lea ecx, [ebp - 0x628]
call fcn.1007c210
lea ecx, [ebp - 0x5e0]
call fcn.10005250
lea ecx, [ebp - 0x2e6c]
call fcn.10007e10
lea ecx, [ebp - 0x2e40]
jmp 0x1009023e
test eax, eax
je 0x10090007
lea eax, [ebp - 0x2e1c]
push edi
push eax
call fcn.10090990
lea eax, [ebp - 0x2e74]
push eax
call fcn.10091530
add esp, 0xc
mov ecx, 0x1025be20
mov eax, dword [eax]
mov dword [ebp - 0x2dac], eax
lea eax, [ebp - 0x2e70]
push eax
call fcn.1007f0b0
push dword [ebp - 0x2e1c]
mov eax, dword [eax]
mov dword [ebp - 0x2dd4], eax
lea eax, [ebp - 0x48c]
push eax
call fcn.100987c0
add esp, 8
mov dword [ebp - 0x2d9c], eax
cmp dword [eax + 0x14], 8
jb 0x1008fddf
mov eax, dword [eax]
mov dword [ebp - 0x2d9c], eax
cmp dword [ebp - 0x460], 8
lea eax, [ebp - 0x474]
mov dword [ebp - 0x2da0], eax
jb 0x1008fe00
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x2da0], eax
cmp dword [ebp - 0x550], 8
lea ecx, [ebp - 0x564]
mov dword [ebp - 0x2da8], ecx
jb 0x1008fe21
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x2da8], eax
cmp dword [ebp - 0x538], 8
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x2db0], eax
jb 0x1008fe42
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x2db0], eax
cmp dword [ebp - 0x520], 8
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x2dbc], ecx
jb 0x1008fe63
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x2dbc], eax
cmp dword [ebp - 0x508], 8
lea eax, [ebp - 0x51c]
mov dword [ebp - 0x2dc0], eax
jb 0x1008fe84
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x2dc0], eax
cmp dword [ebp - 0x4f0], 8
lea ecx, [ebp - 0x504]
mov dword [ebp - 0x2db4], ecx
jb 0x1008fea5
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2db4], eax
cmp dword [ebp - 0x4d8], 8
lea eax, [ebp - 0x4ec]
mov dword [ebp - 0x2ddc], eax
jb 0x1008fec6
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x2ddc], eax
cmp dword [ebp - 0x4c0], 8
lea ebx, [ebp - 0x4d4]
jb 0x1008fedb
mov ebx, dword [ebp - 0x4d4]
cmp dword [ebp - 0x4a8], 8
lea esi, [ebp - 0x4bc]
jb 0x1008fef0
mov esi, dword [ebp - 0x4bc]
cmp dword [ebp - 0x490], 8
lea edx, [ebp - 0x4a4]
jb 0x1008ff05
mov edx, dword [ebp - 0x4a4]
cmp dword [ebp - 0x430], 8
lea ecx, [ebp - 0x444]
jb 0x1008ff1a
mov ecx, dword [ebp - 0x444]
cmp dword [ebp - 0x448], 8
lea eax, [ebp - 0x45c]
jb 0x1008ff2f
mov eax, dword [ebp - 0x45c]
push dword [ebp - 0x2dac]
push dword [ebp - 0x2dd4]
push dword [ebp - 0x2d9c]
push dword [ebp - 0x2da0]
push dword [ebp - 0x2da8]
push dword [ebp - 0x2de0]
push dword [ebp - 0x2db0]
push dword [ebp - 0x2dbc]
push dword [ebp - 0x2dc0]
push dword [ebp - 0x2db4]
push dword [ebp - 0x2ddc]
push dword [ebp - 0x2dd0]
push dword [ebp - 0x2db8]
push ebx
mov ebx, dword [ebp - 0x2de4]
push esi
push edx
push ecx
push eax
push ebx
push ebx
lea eax, [ebp - 0x5e0]
push str._type_:_d__rule_group_id_:__d___file_name_:__s___file_path_:__s___company_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_desc_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_version_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_size_:_I64d_t_t_t_t_t_t_t_t_t_t_t_t___internal_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___legal_cprt_:__s__t_t_t_t_t_t_t_t_t_t_t_t___original_file_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___product_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___product_version_:__s__t_t_t_t_t_t_t_t_t_t_t_t___lnk_from_:_d_t_t_t_t_t_t_t_t_t_t_t_t___lnk_arg_:__s__t_t_t_t_t_t_t_t_t_t_t_t___exts_:__key_:_lw___value_:__s___key_:_dest_url___value_:__s___key_:_sys_clonetag___value_:__s___key_:_process_name___value_:__s__
push eax
call fcn.10098240
push eax
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.1007aca0
mov ecx, dword [ebp - 0x2df4]
add esp, 0x64
push eax
lea eax, [ebp - 0x2e88]
push eax
call fcn.1008dfb0
lea ecx, [ebp - 0x628]
call fcn.1007c210
lea ecx, [ebp - 0x5e0]
call fcn.10005250
lea ecx, [ebp - 0x48c]
call fcn.10005250
lea ecx, [ebp - 0x2e70]
call fcn.10007e10
lea ecx, [ebp - 0x2e74]
call fcn.10007e10
lea ecx, [ebp - 0x2e1c]
jmp 0x1009023e
lea eax, [ebp - 0x2e2c]
push eax
call fcn.10091530
add esp, 4
mov ecx, 0x1025be20
mov eax, dword [eax]
mov dword [ebp - 0x2dac], eax
lea eax, [ebp - 0x2e28]
push eax
call fcn.1007f0b0
cmp dword [ebp - 0x460], 8
mov eax, dword [eax]
mov dword [ebp - 0x2dd4], eax
lea eax, [ebp - 0x474]
mov dword [ebp - 0x2d9c], eax
jb 0x10090058
mov eax, dword [ebp - 0x474]
mov dword [ebp - 0x2d9c], eax
cmp dword [ebp - 0x550], 8
lea ecx, [ebp - 0x564]
mov dword [ebp - 0x2da0], ecx
jb 0x10090079
mov eax, dword [ebp - 0x564]
mov dword [ebp - 0x2da0], eax
cmp dword [ebp - 0x538], 8
lea eax, [ebp - 0x54c]
mov dword [ebp - 0x2da8], eax
jb 0x1009009a
mov eax, dword [ebp - 0x54c]
mov dword [ebp - 0x2da8], eax
cmp dword [ebp - 0x520], 8
lea ecx, [ebp - 0x534]
mov dword [ebp - 0x2db0], ecx
jb 0x100900bb
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x2db0], eax
cmp dword [ebp - 0x508], 8
lea eax, [ebp - 0x51c]
mov dword [ebp - 0x2dbc], eax
jb 0x100900dc
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x2dbc], eax
cmp dword [ebp - 0x4f0], 8
lea ecx, [ebp - 0x504]
mov dword [ebp - 0x2dc0], ecx
jb 0x100900fd
mov eax, dword [ebp - 0x504]
mov dword [ebp - 0x2dc0], eax
cmp dword [ebp - 0x4d8], 8
lea eax, [ebp - 0x4ec]
mov dword [ebp - 0x2db4], eax
jb 0x1009011e
mov eax, dword [ebp - 0x4ec]
mov dword [ebp - 0x2db4], eax
cmp dword [ebp - 0x4c0], 8
lea ebx, [ebp - 0x4d4]
jb 0x10090133
mov ebx, dword [ebp - 0x4d4]
cmp dword [ebp - 0x4a8], 8
lea esi, [ebp - 0x4bc]
jb 0x10090148
mov esi, dword [ebp - 0x4bc]
cmp dword [ebp - 0x490], 8
lea edx, [ebp - 0x4a4]
jb 0x1009015d
mov edx, dword [ebp - 0x4a4]
cmp dword [ebp - 0x430], 8
lea ecx, [ebp - 0x444]
jb 0x10090172
mov ecx, dword [ebp - 0x444]
cmp dword [ebp - 0x448], 8
lea eax, [ebp - 0x45c]
jb 0x10090187
mov eax, dword [ebp - 0x45c]
push dword [ebp - 0x2dac]
push dword [ebp - 0x2dd4]
push dword [ebp - 0x2d9c]
push dword [ebp - 0x2da0]
push dword [ebp - 0x2de0]
push dword [ebp - 0x2da8]
push dword [ebp - 0x2db0]
push dword [ebp - 0x2dbc]
push dword [ebp - 0x2dc0]
push dword [ebp - 0x2db4]
push dword [ebp - 0x2dd0]
push dword [ebp - 0x2db8]
push ebx
push esi
push edx
push ecx
push eax
mov eax, dword [ebp - 0x2de4]
push eax
push eax
lea eax, [ebp - 0x5e0]
push str._type_:_d__rule_group_id_:__d___file_name_:__s___file_path_:__s___company_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_desc_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_version_:__s__t_t_t_t_t_t_t_t_t_t_t_t___file_size_:_I64d_t_t_t_t_t_t_t_t_t_t_t_t___internal_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___legal_cprt_:__s__t_t_t_t_t_t_t_t_t_t_t_t___original_file_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___product_name_:__s__t_t_t_t_t_t_t_t_t_t_t_t___product_version_:__s__t_t_t_t_t_t_t_t_t_t_t_t___lnk_from_:_d_t_t_t_t_t_t_t_t_t_t_t_t___lnk_arg_:__s__t_t_t_t_t_t_t_t_t_t_t_t___exts_:__key_:_lw___value_:__s___key_:_sys_clonetag___value_:__s___key_:_process_name___value_:__s__
push eax
call fcn.10098240
push eax
lea eax, [ebp - 0x57c]
push eax
lea eax, [ebp - 0x628]
push eax
call fcn.1007aca0
mov ecx, dword [ebp - 0x2df4]
add esp, 0x60
push eax
lea eax, [ebp - 0x2e90]
push eax
call fcn.1008dfb0
lea ecx, [ebp - 0x628]
call fcn.1007c210
lea ecx, [ebp - 0x5e0]
call fcn.10005250
lea ecx, [ebp - 0x2e28]
call fcn.10007e10
lea ecx, [ebp - 0x2e2c]
call fcn.10007e10
lea ecx, [ebp - 0x42c]
call fcn.10005250
push str.lnk_path
lea ecx, [ebp - 0x42c]
call fcn.10020470
mov eax, dword [ebp - 0x2dc4]
mov ebx, dword [ebp - 0x2e20]
mov ecx, ebx
mov dword [ebp - 0x2d9c], eax
lea eax, [ebp - 0x57c]
push eax
call fcn.10079970
mov esi, eax
cmp esi, dword [ebx]
je 0x1009029a
lea eax, [esi + 0x10]
mov ecx, ebx
push eax
lea eax, [ebp - 0x57c]
push eax
call fcn.1000c300
test al, al
je 0x100902da
lea eax, [ebp - 0x57c]
mov ecx, ebx
mov dword [ebp - 0x2dac], eax
lea eax, [ebp - 0x2dd5]
push eax
lea eax, [ebp - 0x2dac]
push eax
push 0x1020c858
call fcn.10076830
push eax
add eax, 0x10
mov ecx, ebx
push eax
push esi
lea eax, [ebp - 0x2e30]
push eax
call fcn.100787f0
mov esi, dword [ebp - 0x2e30]
lea eax, [esi + 0x28]
mov esi, dword [eax]
mov dword [ebp - 0x2dd4], eax
mov dword [ebp - 0x2dac], esi
mov ebx, dword [esi + 4]
cmp byte [ebx + 0xd], 0
jne 0x10090347
jmp 0x10090300
cmp dword [ebp - 0x418], 8
lea edx, [ebp - 0x42c]
jb 0x10090315
mov edx, dword [ebp - 0x42c]
cmp dword [ebx + 0x24], 8
lea ecx, [ebx + 0x10]
jb 0x10090321
mov ecx, dword [ebx + 0x10]
push dword [ebp - 0x41c]
push edx
push dword [ebx + 0x20]
push ecx
call fcn.1001fdf0
add esp, 0x10
test eax, eax
jns 0x1009033d
mov ebx, dword [ebx + 8]
jmp 0x10090341
mov esi, ebx
mov ebx, dword [ebx]
cmp byte [ebx + 0xd], 0
je 0x10090300
cmp esi, dword [ebp - 0x2dac]
je 0x10090387
cmp dword [esi + 0x24], 8
lea edx, [esi + 0x10]
jb 0x1009035b
mov edx, dword [esi + 0x10]
cmp dword [ebp - 0x418], 8
lea ecx, [ebp - 0x42c]
jb 0x10090370
mov ecx, dword [ebp - 0x42c]
push dword [esi + 0x20]
push edx
push dword [ebp - 0x41c]
push ecx
call fcn.1001fdf0
add esp, 0x10
test eax, eax
jns 0x100903cf
mov ecx, dword [ebp - 0x2dd4]
lea eax, [ebp - 0x42c]
mov dword [ebp - 0x2dac], eax
lea eax, [ebp - 0x2dd5]
push eax
lea eax, [ebp - 0x2dac]
push eax
push 0x1020c858
call fcn.10076560
mov ecx, dword [ebp - 0x2dd4]
push eax
add eax, 0x10
push eax
push esi
lea eax, [ebp - 0x2e14]
push eax
call fcn.1005eca0
mov esi, dword [ebp - 0x2e14]
mov ebx, dword [ebp - 0x2d9c]
mov ecx, ebx
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100903e0
sub ecx, edx
sar ecx, 1
push ecx
push ebx
lea ecx, [esi + 0x28]
call fcn.100070c0
lea ecx, [ebp - 0x42c]
call fcn.10005250
lea ecx, [ebp - 0x474]
call fcn.10005250
lea ecx, [ebp - 0x564]
call fcn.10005250
lea ecx, [ebp - 0x54c]
call fcn.10005250
lea ecx, [ebp - 0x534]
call fcn.10005250
lea ecx, [ebp - 0x51c]
call fcn.10005250
lea ecx, [ebp - 0x504]
call fcn.10005250
lea ecx, [ebp - 0x4ec]
call fcn.10005250
lea ecx, [ebp - 0x4d4]
call fcn.10005250
lea ecx, [ebp - 0x4bc]
call fcn.10005250
lea ecx, [ebp - 0x4a4]
call fcn.10005250
lea ecx, [ebp - 0x57c]
call fcn.1000c070
lea ecx, [ebp - 0x444]
call fcn.10005250
lea ecx, [ebp - 0x45c]
call fcn.10005250
mov edx, dword [ebp - 0x2df8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100904b1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2dfc]
or eax, 0xffffffff
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100904cc
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2df0]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100904ea
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2da4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10090508
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2de8]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10090526
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
add edi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [edi + 0xc], eax
dec eax
test eax, eax
jg 0x1009053e
mov ecx, dword [edi]
push edi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x2dc4]
or eax, 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1009055c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edi, dword [ebp - 0x630]
cmp edi, 0xffffffff
je 0x100905cb
cmp dword [ebp - 0x62c], 0
je 0x100905cb
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10090586
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x18
call fcn.10003680
add esp, 4
test eax, eax
je 0x100905a0
lea ecx, [ebp - 0xc94]
push ecx
push edi
call eax
jmp 0x100905ae
lea eax, [ebp - 0xc94]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, eax
test esi, esi
je 0x100905bd
push esi
call ebx
mov dword [ebp - 0x62c], edi
test edi, edi
jne 0x1008e440
mov esi, dword [ebp - 0x2e10]
cmp esi, dword [ebp - 0x2e0c]
je 0x10090606
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp - 0x2e20]
dec edi
push ebx
push dword [ebp - 0x2df4]
push dword [ebp - 0x2e24]
push edi
push dword [esi]
call fcn.1008e2e0
add esi, 4
add esp, 0x14
cmp esi, dword [ebp - 0x2e0c]
jne 0x100905e3
lea ecx, [ebp - 0x2e10]
call fcn.1002a3c0
lea ecx, [ebp - 0xc94]
call fcn.10023f90
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push 0x80
lea eax, [ebp - 0xd94]
push eax
push dword [ebp - 0xd98]
call fcn.10007cf0
add esp, 0xc
call sub.KERNEL32.dll_GetLastError
call fcn.10003970
int3