Function at 0x10014b00
Capabilities:
Check if file exists
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081f97
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x100ae254]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x248], eax
push dword [eax]
push str.CComputerZLockHelper_enter_app_s
call fcn.10007df0
mov ecx, dword [ebp - 0x248]
push dword [ecx + 8]
call fcn.1002a320
mov ecx, dword [ebp - 0x248]
push dword [ecx + 0x10]
push dword [ecx + 0xc]
push eax
lea eax, [ebp - 0x250]
push eax
call fcn.10029f70
add esp, 0x1c
mov dword [ebp - 4], 0
push dword [ebp - 0x250]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10014bb6
push dword [ebp - 0x250]
push str.CComputerZLockHelper_rootdir_s_is_not_exist
call fcn.10007df0
add esp, 8
mov dword [ebp - 4], 0xffffffff
or eax, 0xffffffff
mov edx, dword [ebp - 0x250]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jmp 0x100156a2
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10058a20
mov edi, dword [ebp - 0x248]
mov eax, dword [edi + 0x58]
sub eax, 0x10
push eax
call fcn.10007d80
add esp, 0x10
lea esi, [eax + 0x10]
mov dword [ebp - 0x25c], esi
mov byte [ebp - 4], 3
cmp dword [0x100ad038], 0
je 0x10014ce5
push str.GetNativeSystemInfo
push 0x10089d20
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10014cdb
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x23c]
push ecx
movups xmmword [ebp - 0x23c], xmm0
movups xmmword [ebp - 0x22c], xmm0
call eax
mov ax, word [ebp - 0x23c]
cmp ax, 9
je 0x10014cd1
cmp ax, 6
je 0x10014cd1
cmp ax, 0xc
je 0x10014cd1
push str.IsWow64Process2
push 0x10089fbc
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x254], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x10014cc2
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x10014cc2
mov edi, dword [ebp - 0x248]
xor eax, eax
mov ecx, 0xaa64
cmp word [ebp - 0x254], cx
sete al
mov dword [0x100af990], eax
jmp 0x10014cdb
mov edi, dword [ebp - 0x248]
xor eax, eax
mov dword [0x100af990], eax
jmp 0x10014cdb
mov dword [0x100af990], 1
mov dword [0x100ad038], 0
xor eax, eax
cmp dword [0x100af990], eax
setne al
push dword [edi + eax*4 + 0x50]
lea eax, [eax*4 + 0x50]
push dword [ebp - 0x250]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
or edi, 0xffffffff
test eax, eax
je 0x10014dff
cmp dword [0x100ad03c], 0
je 0x10014df2
push str.ntdll.dll
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x254], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x24c], eax
test eax, eax
je 0x10014de8
push str.RtlGetNtVersionNumbers
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10014dae
lea ecx, [ebp - 0x244]
push ecx
lea ecx, [ebp - 0x240]
push ecx
lea ecx, [ebp - 0x258]
push ecx
call eax
movzx eax, word [ebp - 0x244]
mov dword [ebp - 0x244], eax
mov dword [ebp - 0x254], 1
push dword [ebp - 0x24c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x254], 0
je 0x10014de8
mov eax, dword [ebp - 0x258]
cmp eax, 6
jne 0x10014dd9
cmp dword [ebp - 0x240], 4
je 0x10014dde
jmp 0x10014de8
cmp eax, 0xa
jb 0x10014de8
mov dword [0x100af994], 1
mov dword [0x100ad03c], 0
cmp dword [0x100af994], 0
jne 0x10014fc8
mov eax, dword [ebp - 0x248]
lea ecx, [esi - 0x10]
mov dword [ebp - 0x240], ecx
mov edx, dword [eax + 0x4c]
lea eax, [edx - 0x10]
mov dword [ebp - 0x24c], eax
cmp eax, ecx
je 0x10014e80
cmp dword [ecx + 0xc], 0
lea esi, [ecx + 0xc]
jl 0x10014e6b
mov eax, dword [eax]
cmp eax, dword [ecx]
jne 0x10014e6b
push dword [ebp - 0x24c]
call fcn.10007d80
add esp, 4
mov dword [ebp - 0x24c], eax
mov ecx, edi
lock xadd dword [esi], ecx
dec ecx
test ecx, ecx
jg 0x10014e60
mov esi, dword [ebp - 0x240]
push esi
mov ecx, dword [esi]
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [ebp - 0x24c]
lea esi, [eax + 0x10]
mov dword [ebp - 0x25c], esi
jmp 0x10014e80
push dword [edx - 0xc]
lea ecx, [ebp - 0x25c]
push edx
call fcn.10010000
mov esi, dword [ebp - 0x25c]
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.10058a20
add esp, 0xc
cmp dword [0x100ad038], 0
je 0x10014f8c
push str.GetNativeSystemInfo
push 0x10089d20
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10014f82
xorps xmm0, xmm0
mov dword [ebp - 0x21c], 0
lea ecx, [ebp - 0x23c]
push ecx
movups xmmword [ebp - 0x23c], xmm0
movups xmmword [ebp - 0x22c], xmm0
call eax
mov ax, word [ebp - 0x23c]
cmp ax, 9
je 0x10014f78
cmp ax, 6
je 0x10014f78
cmp ax, 0xc
je 0x10014f78
push str.IsWow64Process2
push 0x10089fbc
mov dword [ebp - 0x24c], 0
mov dword [ebp - 0x240], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x258], eax
test eax, eax
je 0x10014f6f
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 0x258]
test eax, eax
je 0x10014f6f
xor eax, eax
mov ecx, 0xaa64
cmp word [ebp - 0x240], cx
sete al
mov dword [0x100af990], eax
jmp 0x10014f82
xor eax, eax
mov dword [0x100af990], eax
jmp 0x10014f82
mov dword [0x100af990], 1
mov dword [0x100ad038], 0
mov ecx, dword [ebp - 0x248]
xor eax, eax
cmp dword [0x100af990], eax
setne al
push dword [ecx + eax*4 + 0x44]
lea eax, [eax*4 + 0x44]
push dword [ebp - 0x250]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push str.CComputerZLockHelper_use_old_drive
call fcn.10007df0
add esp, 4
lea eax, [ebp - 0x218]
push eax
push esi
push str.drive_name___s__szDrivePath___s_
call fcn.10007df0
add esp, 0xc
cmp dword [esi - 0xc], 0
jne 0x10015010
push str.CComputerZLockHelper_drivename_empty
call fcn.10007df0
add esp, 4
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001500b
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1001568a
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0
push eax
push esi
call fcn.10015c60
add esp, 8
test eax, eax
js 0x100150a8
cmp dword [ebp - 0x240], 0
je 0x100150a8
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0
push eax
push esi
call fcn.10015b70
add esp, 8
test eax, eax
js 0x100150a8
cmp dword [ebp - 0x240], 0
je 0x100150a8
lea eax, [ebp - 0x234]
push eax
push esi
call fcn.100159c0
add esp, 8
test eax, eax
js 0x100150a8
cmp dword [ebp - 0x230], 4
jne 0x100150a8
push str.CComputerZLockHelper_drive_ok
call fcn.10007df0
add esp, 4
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100150a3
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1001568a
call fcn.10008b70
mov ecx, eax
test ecx, ecx
je 0x100156de
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x244]
push str.drv_start
call fcn.10007a50
test al, al
jne 0x100150f1
push 9
push str.drv_start
lea ecx, [ebp - 0x244]
call fcn.10010000
mov byte [ebp - 4], 9
mov ecx, dword [0x100af99c]
test ecx, ecx
jne 0x1001515b
push 0x100ad060
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100af99c], 0
jne 0x1001514a
push 0xc
call fcn.10051708
add esp, 4
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0xa
test eax, eax
je 0x10015134
mov ecx, eax
call fcn.10022e00
jmp 0x10015136
xor eax, eax
mov byte [ebp - 4], 9
xor edx, edx
lea ecx, [ebp - 0x24c]
lock or dword [ecx], edx
mov dword [0x100af99c], eax
push 0x100ad060
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100af99c]
push 0
push dword [ebp - 0x248]
lea eax, [ebp - 0x244]
push eax
call fcn.10023550
mov byte [ebp - 4], 3
mov eax, edi
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10015190
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10015229
lea eax, [ebp - 0x218]
push eax
push str.CComputerZLockHelper_drivepath_s_is_not_fail
call fcn.10007df0
add esp, 8
lea ecx, [ebp - 0x240]
push str.drv_other
call fcn.10003d20
mov byte [ebp - 4], 0xc
lea eax, [ebp - 0x240]
push 0
push dword [ebp - 0x248]
push eax
call fcn.10008a30
mov ecx, eax
call fcn.10023550
mov byte [ebp - 4], 3
mov eax, edi
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10015209
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10015224
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1001568a
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0
push eax
push esi
call fcn.10015c60
add esp, 8
test eax, eax
js 0x10015254
cmp dword [ebp - 0x240], 0
jne 0x10015423
call fcn.10008b70
mov ecx, eax
test ecx, ecx
je 0x100156e8
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 0x10
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x244]
call fcn.10007a50
test al, al
jne 0x100152b8
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10015296
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x244]
call fcn.10010000
mov byte [ebp - 4], 0x11
mov edi, dword [ebp - 0x244]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100152d8
mov dword [ebp - 0x254], eax
jmp 0x1001537f
mov ecx, dword [0x100af9c0]
test ecx, ecx
jne 0x1001533e
push 0x100ad084
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100af9c0], 0
jne 0x1001532d
push 4
call fcn.10051708
add esp, 4
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0x12
test eax, eax
je 0x10015317
mov ecx, eax
call fcn.10013b80
jmp 0x10015319
xor eax, eax
mov byte [ebp - 4], 0x11
xor edx, edx
lea ecx, [ebp - 0x24c]
lock or dword [ecx], edx
mov dword [0x100af9c0], eax
push 0x100ad084
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100af9c0]
push edi
call fcn.10013c80
test eax, eax
jne 0x10015361
push str.check_sign_fail
call fcn.10007df0
add esp, 4
mov dword [ebp - 0x254], 0
jmp 0x1001537f
push 0
push 0
push edi
push 1
push esi
push esi
call fcn.10015a90
xor ecx, ecx
add esp, 0x18
test eax, eax
setns cl
mov dword [ebp - 0x254], ecx
mov byte [ebp - 4], 3
lea edx, [edi - 0x10]
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001539d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp - 0x254], 0
jne 0x10015423
push str.CComputerZLockHelper_install_fail
call fcn.10007df0
add esp, 4
lea ecx, [ebp - 0x240]
push str.drv_fails
call fcn.10003d20
mov byte [ebp - 4], 0x14
lea eax, [ebp - 0x240]
push 0
push dword [ebp - 0x248]
push eax
call fcn.10008a30
mov ecx, eax
call fcn.10023550
mov byte [ebp - 4], 3
mov eax, edi
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10015403
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001541e
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1001568a
lea eax, [ebp - 0x240]
mov dword [ebp - 0x240], 0
push eax
push esi
call fcn.10015b70
add esp, 8
test eax, eax
js 0x1001544e
cmp dword [ebp - 0x240], 0
jne 0x100154da
push 0
push esi
call fcn.10015860
add esp, 8
test eax, eax
jns 0x100154da
push str.CComputerZLockHelper_Enable_fail
call fcn.10007df0
add esp, 4
lea ecx, [ebp - 0x240]
push str.drv_fails
call fcn.10003d20
mov byte [ebp - 4], 0x18
lea eax, [ebp - 0x240]
push 0
push dword [ebp - 0x248]
push eax
call fcn.10008a30
mov ecx, eax
call fcn.10023550
mov byte [ebp - 4], 3
mov eax, edi
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100154ba
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100154d5
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1001568a
lea eax, [ebp - 0x234]
push eax
push esi
call fcn.100159c0
add esp, 8
test eax, eax
js 0x100154fb
cmp dword [ebp - 0x230], 4
je 0x10015587
push 0
push esi
call fcn.10015d40
add esp, 8
test eax, eax
jns 0x10015587
push str.CComputerZLockHelper_StartPlusWaiting_fail
call fcn.10007df0
add esp, 4
lea ecx, [ebp - 0x240]
push str.drv_fails
call fcn.10003d20
mov byte [ebp - 4], 0x1c
lea eax, [ebp - 0x240]
push 0
push dword [ebp - 0x248]
push eax
call fcn.10008a30
mov ecx, eax
call fcn.10023550
mov byte [ebp - 4], 3
mov eax, edi
mov edx, dword [ebp - 0x240]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10015567
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10015582
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x1001568a
call fcn.10008b70
mov ecx, eax
test ecx, ecx
je 0x100156f2
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x244], eax
mov byte [ebp - 4], 0x20
lea ecx, [ebp - 0x244]
push str.drv_succ
call fcn.10007a50
test al, al
jne 0x100155d0
push 8
push str.drv_succ
lea ecx, [ebp - 0x244]
call fcn.10010000
mov byte [ebp - 4], 0x21
mov ecx, dword [0x100af99c]
test ecx, ecx
jne 0x1001563a
push 0x100ad060
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x100af99c], 0
jne 0x10015629
push 0xc
call fcn.10051708
add esp, 4
mov dword [ebp - 0x24c], eax
mov byte [ebp - 4], 0x22
test eax, eax
je 0x10015613
mov ecx, eax
call fcn.10022e00
jmp 0x10015615
xor eax, eax
mov byte [ebp - 4], 0x21
xor edx, edx
lea ecx, [ebp - 0x24c]
lock or dword [ecx], edx
mov dword [0x100af99c], eax
push 0x100ad060
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [0x100af99c]
push 0
push dword [ebp - 0x248]
lea eax, [ebp - 0x244]
push eax
call fcn.10023550
mov byte [ebp - 4], 3
mov eax, edi
mov edx, dword [ebp - 0x244]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1001566f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x1001568a
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x250]
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], edi
dec edi
test edi, edi
jg 0x100156ac
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x248]
push dword [eax]
push str.CComputerZLockHelper_end_app_s
call fcn.10007df0
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10051ab7
mov esp, ebp
pop ebp
ret 4
push 0x80004005
call fcn.10007a30
push 0x80004005
call fcn.10007a30
push 0x80004005
call fcn.10007a30
int3