Function at 0x10002e70
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058380
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x100793d0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x10003de5
mov ecx, edx
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0xf
mov byte [ebp - 0x88], 0
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002ec5
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x88]
call fcn.100054c0
mov dword [ebp - 4], 0
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
lea eax, [ebp - 0x70]
mov byte [ebp - 4], 1
push eax
lea edx, [ebp - 0x8c]
lea ecx, [ebp - 0x88]
call fcn.10002860
mov eax, dword [ebp - 0x8c]
add esp, 4
add eax, 0xfffffffe
cmp eax, 4
ja case.default.0x10002f22
jmp dword [eax*4 + 0x10003e74]
call fcn.10010c60
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x100030bb
push 0x5d
push str.d:jenkins.jenkinsworkspace_bird_beautifydeskbeautifyexplorerhookcpipeservercallback.cpp
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], al
call fcn.100054c0
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
push 3
push 0x10074818
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.100054c0
mov byte [ebp - 4], 3
call fcn.10010c60
mov edi, eax
lea ecx, [ebp - 0x128]
push 0xa4
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10002610
mov esi, eax
mov edx, str.OnReceive:_kIPCExplorerHookDisable
mov byte [ebp - 4], 4
mov ecx, esi
call fcn.10002490
mov edx, dword [edi]
mov ecx, edi
push esi
call dword [edx + 0x1c]
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x12c], eax
lea ecx, [ebp - 0x124]
call fcn.10004b50
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x12c], eax
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 5
push eax
mov dword [ebp - 0xd8], vtable.std::ios_base.0
call fcn.1000e97f
mov byte [ebp - 4], 2
add esp, 4
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x10003071
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003067
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e03
push edx
push ecx
call fcn.10015690
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x100030bb
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100030b1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e08
push edx
push ecx
call fcn.10015690
add esp, 8
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
call fcn.100266b0
mov ecx, eax
add esp, 4
not ecx
and dword [ebx + 0xc], ecx
cmp eax, 1
jne 0x1000314b
push dword [sym.imp.USER32.dll_FillRect]
call fcn.10012370
push dword [sym.imp.USER32.dll_EndPaint]
call fcn.10012370
push dword [sym.imp.GDI32.dll_BitBlt]
call fcn.10012370
push dword [sym.imp.GDI32.dll_CreateCompatibleDC]
call fcn.10012370
cmp dword [ebx + 0xc], 0
jne 0x1000312c
push dword [sym.imp.USER32.dll_BeginPaint]
call fcn.10012370
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x10003125
push eax
call fcn.10012370
mov ecx, ebx
call fcn.10003e90
push 0x10073734
lea ecx, [ebx + 8]
call fcn.10005760
push 0
push 0x1000dc10
call dword [sym.imp.USER32.dll_EnumWindows]
jmp case.default.0x10002f22
cmp eax, 2
jne case.default.0x10002f22
push dword [ebx + 0x18]
mov dword [ebx + 0x1c], 0
mov dword [ebx + 0x24], 0xffffffff
mov dword [ebx + 0x20], 0
mov dword [ebx + 0x28], 0
mov dword [ebx + 0x10], eax
call fcn.10012370
mov ecx, ebx
call fcn.10003e90
jmp case.default.0x10002f22
call fcn.10010c60
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10003311
push 0x5d
push str.d:jenkins.jenkinsworkspace_bird_beautifydeskbeautifyexplorerhookcpipeservercallback.cpp
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], al
call fcn.100054c0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x40]
push 3
push 0x10074818
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.100054c0
mov byte [ebp - 4], 7
call fcn.10010c60
mov edi, eax
lea ecx, [ebp - 0x128]
push 0xc5
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10002610
mov esi, eax
mov edx, str.OnReceive:_kIPCExplorerHookEnable
mov byte [ebp - 4], 8
mov ecx, esi
call fcn.10002490
mov edx, dword [edi]
mov ecx, edi
push esi
call dword [edx + 0x1c]
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x12c], eax
lea ecx, [ebp - 0x124]
call fcn.10004b50
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x12c], eax
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 9
push eax
mov dword [ebp - 0xd8], vtable.std::ios_base.0
call fcn.1000e97f
mov edx, dword [ebp - 0x2c]
add esp, 4
cmp edx, 0x10
jb 0x100032cb
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100032c1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e0d
push edx
push ecx
call fcn.10015690
add esp, 8
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x10003311
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003307
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e12
push edx
push ecx
call fcn.10015690
add esp, 8
cmp dword [ebp - 0x5c], 0x10
lea eax, [ebp - 0x70]
cmovae eax, dword [ebp - 0x70]
push eax
call fcn.100266b0
mov edx, dword [ebx + 0xc]
add esp, 4
mov ecx, edx
and ecx, eax
cmp ecx, eax
je case.default.0x10002f22
or edx, eax
mov dword [ebx + 0xc], edx
test dl, 1
je 0x10003342
push 0
jmp 0x1000335a
cmp edx, 2
jne 0x1000335f
push dword [sym.imp.USER32.dll_BeginPaint]
call fcn.10012350
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x1000335f
push eax
call fcn.10012350
push 0
push 0x1000dc10
call dword [sym.imp.USER32.dll_EnumWindows]
jmp case.default.0x10002f22
call fcn.10010c60
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10003503
push 0x5d
push str.d:jenkins.jenkinsworkspace_bird_beautifydeskbeautifyexplorerhookcpipeservercallback.cpp
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], 0xf
mov byte [ebp - 0x58], al
call fcn.100054c0
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x40]
push 3
push 0x10074818
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.100054c0
mov byte [ebp - 4], 0xb
call fcn.10010c60
mov edi, eax
lea ecx, [ebp - 0x128]
push 0xd9
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10002610
mov esi, eax
mov edx, str.OnReceive:_kIPCSetFolderBgImagePath
mov byte [ebp - 4], 0xc
mov ecx, esi
call fcn.10002490
mov edx, dword [edi]
mov ecx, edi
push esi
call dword [edx + 0x1c]
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x12c], eax
lea ecx, [ebp - 0x124]
call fcn.10004b50
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x12c], eax
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0xd
push eax
mov dword [ebp - 0xd8], vtable.std::ios_base.0
call fcn.1000e97f
mov byte [ebp - 4], 0xa
add esp, 4
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x100034b9
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100034af
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e17
push edx
push ecx
call fcn.10015690
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x44]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x10003503
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100034f9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e1c
push edx
push ecx
call fcn.10015690
add esp, 8
push 0
call fcn.10012350
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x28]
call fcn.100042d0
push ecx
mov byte [ebp - 4], 0xe
lea ecx, [ebp - 0x70]
push 0x26
mov dword [ebp - 0x8c], 1
call fcn.10004140
mov esi, eax
cmp esi, 0xffffffff
je 0x100035e6
push esi
push 0
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x70]
call fcn.10004000
push eax
lea ecx, [ebp - 0x28]
call fcn.10004250
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x10003586
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000357c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e21
push edx
push ecx
call fcn.10015690
add esp, 8
push 1
lea eax, [esi + 1]
push eax
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x70]
call fcn.10004000
cmp dword [ebp - 0x44], 0x10
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push eax
call fcn.100266b0
mov edx, dword [ebp - 0x44]
add esp, 4
mov dword [ebp - 0x8c], eax
cmp edx, 0x10
jb 0x100035e6
mov ecx, dword [ebp - 0x58]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100035dc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e26
push edx
push ecx
call fcn.10015690
add esp, 8
cmp dword [ebp - 0x14], 0x10
lea esi, [ebp - 0x28]
push 0
cmovae esi, dword [ebp - 0x28]
push 0
push 0xffffffffffffffff
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [ebp - 0x90], eax
test eax, eax
jne 0x10003610
xor edi, edi
jmp 0x1000363f
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10015700
add esp, 4
mov edi, eax
push dword [ebp - 0x90]
push edi
push 0xffffffffffffffff
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push edi
lea ecx, [ebx + 8]
call fcn.10005760
cmp dword [ebp - 0x8c], 0
je 0x10003666
push 1
push 0
push 0
push str.::20D04FE0_3AEA_1069_A2D8_08002B30309D
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0
push 0x1000dc10
call dword [sym.imp.USER32.dll_EnumWindows]
mov edx, dword [ebp - 0x14]
cmp edx, 0x10
jb case.default.0x10002f22
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100036a1
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e2b
push edx
push ecx
call fcn.10015690
add esp, 8
jmp case.default.0x10002f22
call fcn.10010c60
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10003842
push 0x5d
push str.d:jenkins.jenkinsworkspace_bird_beautifydeskbeautifyexplorerhookcpipeservercallback.cpp
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.100054c0
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x40]
push 3
push 0x10074818
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.100054c0
mov byte [ebp - 4], 0x10
call fcn.10010c60
mov edi, eax
lea ecx, [ebp - 0x128]
push 0xed
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10002610
mov esi, eax
mov edx, str.OnReceive:_kIPCSetTaskListWndPosInfo
mov byte [ebp - 4], 0x11
mov ecx, esi
call fcn.10002490
mov edx, dword [edi]
mov ecx, edi
push esi
call dword [edx + 0x1c]
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x12c], eax
lea ecx, [ebp - 0x124]
call fcn.10004b50
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x12c], eax
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x12
push eax
mov dword [ebp - 0xd8], vtable.std::ios_base.0
call fcn.1000e97f
mov byte [ebp - 4], 0xf
add esp, 4
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x100037f8
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100037ee
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e30
push edx
push ecx
call fcn.10015690
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x10003842
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003838
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e35
push edx
push ecx
call fcn.10015690
add esp, 8
cmp dword [ebp - 0x5c], 0x10
lea ecx, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x70]
call fcn.1000bd20
mov esi, eax
mov dword [ebp - 0x90], esi
mov byte [ebp - 4], 0x13
test esi, esi
je 0x10003a46
push 6
push str.layout
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.100054c0
push 2
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x14
mov ecx, esi
call fcn.1000c110
mov byte [ebp - 4], 0x13
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x10], eax
cmp edx, 0x10
jb 0x100038d5
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100038cb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e3a
push edx
push ecx
call fcn.10015690
add esp, 8
push 4
push str.HWND
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.100054c0
push 0
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x15
mov ecx, esi
call fcn.1000c110
mov byte [ebp - 4], 0x13
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x8c], eax
cmp edx, 0x10
jb 0x10003947
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000393d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e3f
push edx
push ecx
call fcn.10015690
add esp, 8
push 1
push 0x10074924
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.100054c0
lea eax, [ebp - 0x8c]
mov byte [ebp - 4], 0x16
push eax
lea ecx, [ebx + 0x38]
call fcn.10003ef0
push 0
lea edx, [ebp - 0x28]
mov ecx, esi
mov edi, eax
call fcn.1000c110
mov byte [ebp - 4], 0x13
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [edi], eax
cmp edx, 0x10
jb 0x100039c6
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x100039bc
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e44
push edx
push ecx
call fcn.10015690
add esp, 8
push 1
push 0x10074928
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.100054c0
push 0
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x17
mov ecx, esi
call fcn.1000c110
add esp, 4
lea ecx, [ebx + 0x38]
mov edi, eax
lea eax, [ebp - 0x8c]
push eax
call fcn.10003ef0
mov byte [ebp - 4], 0x13
mov edx, dword [ebp - 0x14]
mov dword [eax + 4], edi
cmp edx, 0x10
jb 0x10003a46
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003a3c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e49
push edx
push ecx
call fcn.10015690
add esp, 8
mov byte [ebp - 4], 0x18
jmp 0x10003d5d
call fcn.10010c60
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10003be1
push 0x5d
push str.d:jenkins.jenkinsworkspace_bird_beautifydeskbeautifyexplorerhookcpipeservercallback.cpp
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], al
call fcn.100054c0
mov byte [ebp - 4], 0x1a
lea ecx, [ebp - 0x40]
push 3
push 0x10074818
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
call fcn.100054c0
mov byte [ebp - 4], 0x1b
call fcn.10010c60
mov edi, eax
lea ecx, [ebp - 0x128]
push 0xfa
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10002610
mov esi, eax
mov edx, str.OnReceive:_kIPCSetTaskBarWndCompositionAttrInfo
mov byte [ebp - 4], 0x1c
mov ecx, esi
call fcn.10002490
mov edx, dword [edi]
mov ecx, edi
push esi
call dword [edx + 0x1c]
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.virtual_0], vtable.std::basic_ostringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 0x50]
mov dword [ebp + ecx - 0x12c], eax
lea ecx, [ebp - 0x124]
call fcn.10004b50
mov eax, dword [ebp - 0x128]
mov eax, dword [eax + 4]
mov dword [ebp + eax - method.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.virtual_0], vtable.std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__.0
mov eax, dword [ebp - 0x128]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ebp + ecx - 0x12c], eax
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 0x1d
push eax
mov dword [ebp - 0xd8], vtable.std::ios_base.0
call fcn.1000e97f
mov byte [ebp - 4], 0x1a
add esp, 4
mov edx, dword [ebp - 0x2c]
cmp edx, 0x10
jb 0x10003b97
mov ecx, dword [ebp - 0x40]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003b8d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e4e
push edx
push ecx
call fcn.10015690
add esp, 8
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0xf
mov byte [ebp - 0x40], 0
cmp edx, 0x10
jb 0x10003be1
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003bd7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e53
push edx
push ecx
call fcn.10015690
add esp, 8
cmp dword [ebp - 0x5c], 0x10
lea ecx, [ebp - 0x70]
cmovae ecx, dword [ebp - 0x70]
call fcn.1000bd20
mov esi, eax
mov dword [ebp - 0x90], esi
mov byte [ebp - 4], 0x1e
test esi, esi
je 0x10003d59
push 0xb
push str.AccentState
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.100054c0
push 0
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x1f
mov ecx, esi
call fcn.1000c110
mov byte [ebp - 4], 0x1e
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x1c], eax
cmp edx, 0x10
jb 0x10003c74
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003c6a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e58
push edx
push ecx
call fcn.10015690
add esp, 8
push 0xd
push str.GradientColor
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.100054c0
push 0
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x20
mov ecx, esi
call fcn.1000c110
mov byte [ebp - 4], 0x1e
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x24], eax
cmp edx, 0x10
jb 0x10003ce3
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003cd9
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e5d
push edx
push ecx
call fcn.10015690
add esp, 8
push 0xb
push str.AccentFlags
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
call fcn.100054c0
push 0
lea edx, [ebp - 0x28]
mov byte [ebp - 4], 0x21
mov ecx, esi
call fcn.1000c110
mov byte [ebp - 4], 0x1e
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebx + 0x20], eax
cmp edx, 0x10
jb 0x10003d52
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003d48
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e62
push edx
push ecx
call fcn.10015690
add esp, 8
mov dword [ebx + 0x28], 0
mov byte [ebp - 4], 0x22
test esi, esi
je case.default.0x10002f22
mov ecx, esi
call fcn.1000b9b0
mov edx, dword [ebp - 0x5c]
cmp edx, 0x10
jb 0x10003d9c
mov ecx, dword [ebp - 0x70]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003d92
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e67
push edx
push ecx
call fcn.10015690
add esp, 8
mov edx, dword [ebp - 0x74]
mov dword [ebp - 0x60], 0
mov dword [ebp - 0x5c], 0xf
mov byte [ebp - 0x70], 0
cmp edx, 0x10
jb 0x10003de5
mov ecx, dword [ebp - 0x88]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10003ddb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10003e6c
push edx
push ecx
call fcn.10015690
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10014b80
mov esp, ebp
pop ebp
ret 0x14
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
call fcn.10024ec0
nop dword [eax]
sub dword [edi], ebp
add byte [eax], dl
xchg dword [ecx], esi
add byte [eax], dl
jno 0x10003eb1
add byte [eax], dl
mov al, 0x36
add byte [eax], dl
dec edi
cmp al, byte [eax]
adc ah, cl
int3
push ds
add eax, dword [eax]
add byte [eax - 1], dl
adc eax, sym.imp.USER32.dll_SendMessageW