Function at 0x1000e270
Capabilities:
Check if file exists
Enumerate files on windows
Get common file path
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003a271
mov eax, dword fs:[0]
push eax
sub esp, 0x848
mov eax, dword [0x1004f450]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
xor esi, esi
push 0x206
mov dword [ebp - 0x7fc], ecx
mov dword [ebp - 0x824], eax
lea ecx, [ebp - 0x422]
xor eax, eax
push esi
push ecx
mov dword [ebp - 0x800], edx
mov dword [ebp - 0x810], esi
mov dword [ebp - 0x844], 1
mov dword [ebp - 0x840], 2
mov dword [ebp - 0x81c], esi
mov word [ebp - 0x424], ax
call fcn.1002f900
push 0x206
lea eax, [ebp - 0x21a]
xor edx, edx
push esi
push eax
mov word [ebp - 0x21c], dx
call fcn.1002f900
add esp, 0x18
mov dword [ebp - 0x46c], esi
xor ecx, ecx
push esi
mov edi, 7
mov eax, 0x1003e860
lea esi, [ebp - 0x47c]
mov dword [ebp - 0x468], edi
mov word [ebp - 0x47c], cx
call fcn.10001a60
xor eax, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x488], eax
xor edx, edx
push eax
mov eax, 0x1003e860
lea esi, [ebp - 0x498]
mov dword [ebp - 0x484], edi
mov word [ebp - 0x498], dx
call fcn.10001a60
xor eax, eax
mov byte [ebp - 4], 1
mov word [ebp - 0x4b4], ax
push eax
mov eax, 0x1003e860
lea esi, [ebp - 0x4b4]
mov dword [ebp - 0x4a0], edi
mov dword [ebp - 0x4a4], 0
call fcn.10001a60
xor ecx, ecx
mov byte [ebp - 4], 2
push ecx
mov eax, 0x1003e860
lea esi, [ebp - 0x440]
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x430], 0
mov word [ebp - 0x440], cx
call fcn.10001a60
mov eax, dword [ebp - 0x7fc]
lea edx, [ebp - 0x854]
push edx
push 0
push ebx
push eax
mov byte [ebp - 4], 3
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x1000efe5
xor eax, eax
xor ecx, ecx
mov dword [ebp - 0x448], edi
mov dword [ebp - 0x44c], eax
mov word [ebp - 0x45c], cx
mov byte [ebp - 4], 4
mov dword [ebp - 0x460], eax
or eax, 0xffffffff
lea esi, [ebp - 0x45c]
call fcn.10001b50
mov ecx, dword [ebp - 0x7fc]
mov edx, ebx
lea ebx, [ebp - 0x460]
mov byte [ebp - 4], 5
call fcn.1000ca00
test eax, eax
jne 0x1000e524
mov edx, dword [ebp - 0x460]
mov dword [ebp - 0x828], edx
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x4d8], 7
mov dword [ebp - 0x4dc], esi
mov word [ebp - 0x4ec], cx
lea edx, [ebp - 0x804]
push edx
lea eax, [ebp - 0x854]
push esi
push eax
mov byte [ebp - 4], 6
xor eax, eax
xor ebx, ebx
mov dword [ebp - 0x804], esi
call fcn.1000a930
mov ebx, dword [ebp - 0x804]
mov edi, eax
add esp, 0xc
cmp edi, esi
jne 0x1000e4b0
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x1000e491
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea esi, [ebp - 0x4ec]
call fcn.10001a60
xor esi, esi
cmp ebx, esi
je 0x1000e4c3
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [ebp - 0x804], edi
cmp edi, esi
jne 0x1000ee68
lea ecx, [ebp - 0x4ec]
push ecx
lea ecx, [ebp - 0x83c]
call fcn.10028310
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x83c]
mov edx, dword [ebp - 0x838]
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x80c], ebx
mov dword [ebp - 0x818], esi
cmp eax, edx
je 0x1000e5c8
cmp ecx, esi
jne 0x1000e579
cmp dword [eax + 0x14], 8
jb 0x1000e575
mov edi, dword [eax]
jmp 0x1000e5b0
mov ecx, dword [ebp - 0x7fc]
mov edx, str.DefaultDestDir
lea ebx, [ebp - 0x460]
call fcn.1000ca00
mov dword [ebp - 0x804], eax
test eax, eax
jne 0x1000e555
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x828], eax
jmp 0x1000e440
cmp dword [0x10050488], 1
jle 0x1000ee80
push 0x605
push eax
call fcn.10026b40
add esp, 8
jmp 0x1000ee80
mov edi, eax
jmp 0x1000e5b0
cmp ecx, 1
jne 0x1000e58c
cmp dword [eax + 0x14], 8
jb 0x1000e588
mov ebx, dword [eax]
jmp 0x1000e5b0
mov ebx, eax
jmp 0x1000e5b0
cmp ecx, 2
jne 0x1000e5ab
cmp dword [eax + 0x14], 8
jb 0x1000e5a3
mov esi, dword [eax]
mov dword [ebp - 0x818], esi
xor esi, esi
jmp 0x1000e5b0
mov dword [ebp - 0x818], eax
jmp 0x1000e5b0
cmp ecx, 3
jne 0x1000e5bc
add eax, 0x1c
inc ecx
cmp eax, edx
jne 0x1000e513
mov dword [ebp - 0x808], edi
mov dword [ebp - 0x80c], ebx
mov dword [ebp - 0x7f8], esi
mov dword [ebp - 0x814], esi
push esi
mov eax, 0x1003e860
lea esi, [ebp - 0x47c]
call fcn.10001a60
push 0
mov eax, 0x1003e860
lea esi, [ebp - 0x498]
call fcn.10001a60
push 0
mov eax, 0x1003e860
lea esi, [ebp - 0x440]
call fcn.10001a60
test ebx, ebx
je 0x1000e626
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000e612
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
jmp 0x1000e642
test edi, edi
je 0x1000e64d
mov eax, edi
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000e630
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [ebp - 0x47c]
call fcn.10001a60
cmp dword [ebp - 0x46c], 0
je 0x1000eb7a
cmp dword [ebp - 0x468], 8
mov eax, dword [ebp - 0x47c]
jae 0x1000e66f
lea eax, [ebp - 0x47c]
mov esi, dword [sym.imp.SETUPAPI.dll_SetupGetSourceFileLocationW]
lea edx, [ebp - 0x7f8]
push edx
mov edx, dword [ebp - 0x7fc]
push 0
push 0
lea ecx, [ebp - 0x814]
push ecx
push eax
push 0
push edx
call esi
test eax, eax
je 0x1000eb7a
mov eax, dword [ebp - 0x7f8]
lea ecx, [eax + eax]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1000e714
cmp dword [ebp - 0x468], 8
mov eax, dword [ebp - 0x47c]
jae 0x1000e6c8
lea eax, [ebp - 0x47c]
mov edx, dword [ebp - 0x7f8]
push 0
push edx
mov edx, dword [ebp - 0x7fc]
push ebx
lea ecx, [ebp - 0x814]
push ecx
push eax
push 0
push edx
call esi
test eax, eax
je 0x1000e70d
mov eax, ebx
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000e6f0
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea esi, [ebp - 0x498]
call fcn.10001a60
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [ebp + 0x10], 0
je 0x1000eb7a
cmp dword [ebp - 0x4a4], 0
jne 0x1000e94f
test byte [0x1005223c], 1
jne 0x1000e755
or dword [0x1005223c], 1
mov byte [ebp - 4], 8
call fcn.100278f0
push 0x1003bab0
call fcn.1002a940
add esp, 4
mov byte [ebp - 4], 7
mov eax, dword [0x10052170]
shr eax, 0xa
test al, 1
je 0x1000e8a7
push 0x208
lea ecx, [ebp - 0x21c]
push 0
push ecx
call fcn.1002f900
add esp, 0xc
push 0x208
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1000e896
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push str.DriverStoreFileRepository_
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov eax, dword [ebp - 0x824]
add eax, 0xf0
cmp dword [eax + 0x14], 8
jb 0x1000e7c7
mov eax, dword [eax]
push eax
lea edx, [ebp - 0x21c]
push edx
lea eax, [ebp - 0x424]
push str._s_s_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x7f4]
push ecx
lea edx, [ebp - 0x424]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e94f
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpW]
nop
test byte [ebp - 0x7f4], 0x10
je 0x1000e83d
push 0x10040d9c
lea eax, [ebp - 0x7c8]
push eax
call ebx
test eax, eax
je 0x1000e83d
push 0x10041ca0
lea ecx, [ebp - 0x7c8]
push ecx
call ebx
test eax, eax
jne 0x1000e857
lea edx, [ebp - 0x7f4]
push edx
push esi
call edi
test eax, eax
jne 0x1000e810
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1000e94f
lea eax, [ebp - 0x7c8]
push eax
lea ecx, [ebp - 0x21c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0x21c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x4b4]
push eax
lea eax, [ebp - 0x21c]
call fcn.10001720
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x1000e94f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x810], eax
jmp 0x1000e94f
lea ecx, [ebp - 0x81c]
push ecx
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionSetup
push SysStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x810], eax
test eax, eax
jne 0x1000eb7a
lea edx, [ebp - 0x7f8]
push edx
mov edx, dword [ebp - 0x81c]
lea eax, [ebp - 0x424]
push eax
lea ecx, [ebp - 0x820]
push ecx
push 0
push str.DriverCachePath
push edx
mov dword [ebp - 0x820], 1
mov dword [ebp - 0x7f8], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x810], eax
test eax, eax
jne 0x1000e942
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea ecx, [ebp - 0x4b4]
push ecx
lea ecx, [ebp - 0x424]
call fcn.100285b0
add esp, 4
mov dword [ebp - 0x810], eax
mov edx, dword [ebp - 0x81c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x810], 0
jne 0x1000eb7a
push 0
lea eax, [ebp - 0x4b4]
push eax
or eax, 0xffffffff
lea ecx, [ebp - 0x440]
call fcn.10001820
xor edi, edi
mov esi, dword [ebp + edi*4 - 0x844]
mov edx, dword [ebp - 0x814]
mov eax, dword [ebp - 0x7fc]
lea ecx, [ebp - 0x7f8]
push ecx
push 0
push 0
push esi
push edx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupGetSourceInfoW]
test eax, eax
je 0x1000eb4d
mov ecx, dword [ebp - 0x7f8]
lea edx, [ecx + ecx]
push edx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x1000eb4d
mov eax, dword [ebp - 0x7f8]
mov ecx, dword [ebp - 0x814]
mov edx, dword [ebp - 0x7fc]
push 0
push eax
push ebx
push esi
push ecx
push edx
call dword [sym.imp.SETUPAPI.dll_SetupGetSourceInfoW]
test eax, eax
je 0x1000eb46
xor eax, eax
mov word [ebp - 0x4d0], ax
push eax
mov eax, 0x1003e860
lea esi, [ebp - 0x4d0]
mov dword [ebp - 0x4bc], 7
mov dword [ebp - 0x4c0], 0
call fcn.10001a60
mov eax, ebx
mov byte [ebp - 4], 9
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x1000ea20
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea esi, [ebp - 0x4d0]
call fcn.10001a60
cmp edi, 1
jne 0x1000eb01
call fcn.10027fe0
mov ecx, dword [eax + 0x120]
shr ecx, 8
test cl, 1
je 0x1000eb01
cmp dword [ebp - 0x4bc], 8
mov eax, dword [ebp - 0x4d0]
jae 0x1000ea6e
mov eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiW]
push str.DRIVER.CAB
push eax
call esi
test eax, eax
jne 0x1000eb01
mov eax, dword [ebp - 0x824]
add eax, 0xf0
cmp dword [eax + 0x14], 8
jb 0x1000ea97
mov eax, dword [eax]
push str.NTPRINT.inf
push eax
call esi
test eax, eax
jne 0x1000eb01
lea ecx, [ebp - 0x440]
lea esi, [ebp - 0x508]
call fcn.10002e20
mov edx, esi
push edx
mov eax, str.SP4.CAB
mov byte [ebp - 4], 0xa
call fcn.10001750
cmp dword [ebp - 0x4f4], 8
mov eax, dword [ebp - 0x508]
jae 0x1000ead6
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1000eaf2
lea eax, [ebp - 0x4d0]
push eax
mov eax, str.SP4.CAB
call fcn.10001720
lea esi, [ebp - 0x508]
mov byte [ebp - 4], 9
call fcn.10003540
push 0
lea ecx, [ebp - 0x4d0]
push ecx
or eax, 0xffffffff
lea esi, [ebp - 0x440]
call fcn.10001c90
test edi, edi
jne 0x1000eb2a
push 1
mov eax, 0x10041d68
mov ecx, esi
call fcn.10001930
mov byte [ebp - 4], 7
cmp dword [ebp - 0x4bc], 8
jb 0x1000eb46
mov edx, dword [ebp - 0x4d0]
push edx
call fcn.10029653
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
inc edi
cmp edi, 2
jb 0x1000e975
cmp dword [ebp - 0x42c], 8
mov eax, dword [ebp - 0x440]
jae 0x1000eb6c
lea eax, [ebp - 0x440]
push eax
push str.CInfInstallSection::GetCopyFilesHelper___Inbox_Path:__s
call fcn.100269c0
add esp, 8
mov ecx, dword [ebp - 0x440]
mov eax, 8
cmp dword [ebp - 0x42c], eax
jae 0x1000eb93
lea ecx, [ebp - 0x440]
cmp dword [ebp - 0x484], eax
mov eax, dword [ebp - 0x498]
jae 0x1000eba7
lea eax, [ebp - 0x498]
mov edx, dword [ebp - 0x828]
push ecx
mov ecx, dword [ebp - 0x80c]
push eax
mov eax, dword [ebp - 0x818]
push eax
mov eax, dword [ebp - 0x808]
push ecx
push edx
push eax
lea ecx, [ebp - 0x5a4]
push ecx
call fcn.1000a570
mov edi, dword [ebp - 0x800]
mov byte [ebp - 4], 0xb
mov ecx, dword [edi + 4]
lea edx, [ebp - 0x5a4]
cmp edx, ecx
jae 0x1000ecb4
mov eax, edi
mov edi, dword [eax]
cmp edi, edx
ja 0x1000ecb2
mov esi, edx
sub esi, edi
mov eax, 0xdd67c8a7
imul esi
mov eax, dword [ebp - 0x800]
mov ebx, dword [eax + 8]
add edx, esi
sar edx, 7
mov esi, edx
shr esi, 0x1f
add esi, edx
cmp ecx, ebx
jne 0x1000ec82
sub ecx, edi
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x1bacf90
ja 0x1000ee4d
sub ebx, edi
mov eax, 0xdd67c8a7
imul ebx
add edx, ebx
sar edx, 7
mov eax, edx
shr eax, 0x1f
inc ecx
add eax, edx
cmp ecx, eax
jbe 0x1000ec82
mov edx, eax
shr edx, 1
mov edi, 0x1bacf91
sub edi, edx
cmp edi, eax
jae 0x1000ec6a
xor eax, eax
jmp 0x1000ec6c
add eax, edx
cmp eax, ecx
jae 0x1000ec72
mov eax, ecx
mov edi, dword [ebp - 0x800]
push eax
mov ecx, edi
call fcn.1000f5a0
jmp 0x1000ec88
mov edi, dword [ebp - 0x800]
mov eax, dword [edi + 4]
imul esi, esi, 0x94
add esi, dword [edi]
mov dword [ebp - 0x808], eax
mov dword [ebp - 0x80c], eax
mov byte [ebp - 4], 0xc
test eax, eax
je 0x1000ed3e
mov ecx, esi
jmp 0x1000ed38
mov edi, eax
mov esi, dword [edi + 8]
cmp ecx, esi
jne 0x1000ed1b
mov ebx, dword [edi]
sub ecx, ebx
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
cmp ecx, 0x1bacf90
ja 0x1000ee4d
sub esi, ebx
mov eax, 0xdd67c8a7
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
inc ecx
add eax, edx
cmp ecx, eax
jbe 0x1000ed1b
mov edx, eax
shr edx, 1
mov esi, 0x1bacf91
sub esi, edx
cmp esi, eax
jae 0x1000ed0b
xor eax, eax
jmp 0x1000ed0d
add eax, edx
cmp eax, ecx
jae 0x1000ed13
mov eax, ecx
push eax
mov ecx, edi
call fcn.1000f5a0
mov eax, dword [edi + 4]
mov dword [ebp - 0x808], eax
mov dword [ebp - 0x80c], eax
mov byte [ebp - 4], 0xd
test eax, eax
je 0x1000ed3e
lea ecx, [ebp - 0x5a4]
push eax
call fcn.1000f940
add dword [edi + 4], 0x94
lea ecx, [ebp - 0x5a4]
push ecx
mov byte [ebp - 4], 7
call fcn.1000a6f0
mov byte [ebp - 4], 0xe
mov eax, dword [ebp - 0x83c]
mov ecx, dword [ebp - 0x838]
cmp eax, ecx
je 0x1000edc9
mov edx, dword [ebp - 0x820]
push edx
push ecx
call fcn.10003370
mov edi, eax
mov eax, dword [ebp - 0x838]
add esp, 8
mov ebx, eax
mov esi, edi
cmp edi, eax
je 0x1000edbb
lea esp, [esp]
cmp dword [esi + 0x14], 8
jb 0x1000eda1
mov eax, dword [esi]
push eax
call fcn.10029653
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
add esi, 0x1c
cmp esi, ebx
jne 0x1000ed90
mov eax, dword [ebp - 0x83c]
mov ecx, edi
mov dword [ebp - 0x838], ecx
mov ebx, 8
test eax, eax
je 0x1000ee19
mov edi, ecx
mov esi, eax
cmp eax, ecx
je 0x1000ee10
lea ebx, [ebx]
cmp dword [esi + 0x14], ebx
jb 0x1000edf0
mov eax, dword [esi]
push eax
call fcn.10029653
add esp, 4
xor ecx, ecx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], cx
add esi, 0x1c
cmp esi, edi
jne 0x1000ede0
mov eax, dword [ebp - 0x83c]
push eax
call fcn.10029653
add esp, 4
lea edx, [ebp - 0x854]
push edx
mov eax, edx
push eax
call dword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
je 0x1000ee57
cmp dword [ebp - 0x4d8], ebx
jb 0x1000e440
mov ecx, dword [ebp - 0x4ec]
push ecx
call fcn.10029653
add esp, 4
jmp 0x1000e440
push str.vector_T__too_long
call fcn.10028a1b
cmp dword [ebp - 0x4d8], ebx
jb 0x1000ee80
mov edx, dword [ebp - 0x4ec]
push edx
jmp 0x1000ee78
cmp dword [ebp - 0x4d8], 8
jb 0x1000ee80
mov eax, dword [ebp - 0x4ec]
push eax
call fcn.10029653
add esp, 4
mov eax, dword [ebp - 0x44c]
or esi, 0xffffffff
mov dword [ebp - 0x460], 0
cmp eax, 0xffffffff
jae 0x1000ee9e
mov esi, eax
test eax, eax
je 0x1000eef9
mov edi, dword [ebp - 0x448]
mov ecx, dword [ebp - 0x45c]
mov ebx, 8
mov edx, ecx
cmp edi, ebx
jae 0x1000eebd
lea edx, [ebp - 0x45c]
mov ecx, edx
sub eax, esi
add eax, eax
push eax
lea edx, [edx + esi*2]
push edx
push ecx
call fcn.100290e0
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0x45c]
sub eax, esi
add esp, 0xc
mov dword [ebp - 0x44c], eax
cmp dword [ebp - 0x448], ebx
jae 0x1000eef1
lea ecx, [ebp - 0x45c]
xor edx, edx
mov word [ecx + eax*2], dx
jmp 0x1000eefe
mov ebx, 8
cmp dword [ebp - 0x448], ebx
jb 0x1000ef15
mov eax, dword [ebp - 0x45c]
push eax
call fcn.10029653
add esp, 4
mov edi, 7
cmp dword [ebp - 0x42c], ebx
jb 0x1000ef31
mov ecx, dword [ebp - 0x440]
push ecx
call fcn.10029653
add esp, 4
xor edx, edx
mov dword [ebp - 0x42c], edi
mov dword [ebp - 0x430], 0
mov word [ebp - 0x440], dx
cmp dword [ebp - 0x4a0], ebx
jb 0x1000ef61
mov eax, dword [ebp - 0x4b4]
push eax
call fcn.10029653
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x4a0], edi
mov dword [ebp - 0x4a4], 0
mov word [ebp - 0x4b4], cx
cmp dword [ebp - 0x484], ebx
jb 0x1000ef91
mov edx, dword [ebp - 0x498]
push edx
call fcn.10029653
add esp, 4
xor eax, eax
mov dword [ebp - 0x484], edi
mov dword [ebp - 0x488], 0
mov word [ebp - 0x498], ax
cmp dword [ebp - 0x468], ebx
jb 0x1000efc1
mov ecx, dword [ebp - 0x47c]
push ecx
call fcn.10029653
add esp, 4
mov eax, dword [ebp - 0x804]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10028eba
mov esp, ebp
pop ebp
ret 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x804], eax
mov ebx, 8
jmp 0x1000ef1a