Function at 0x10005330
Capabilities:
Check for time delay via gettickcount
Check if file exists
Get common file path
Get thread local storage value
Query environment variable
Set thread local storage value

Disassembly:
push ebx
mov ebx, esp
sub esp, 8
and esp, 0xfffffff8
add esp, 4
push ebp
mov ebp, dword [ebx + 4]
mov dword [esp + 4], ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1010e617
mov eax, dword fs:[0]
push eax
push ebx
mov eax, 0x1f20
call fcn.100cfdd0
mov eax, dword [0x10160068]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x10166724], 0
mov esi, dword [ebx + 0xc]
mov edi, dword [ebx + 8]
mov dword [ebp - 0x1e30], esi
je 0x100054b9
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x100054b9
cmp dword [eax + 0x58], 4
jb 0x100054b9
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b18], 0
mov dword [ebp - 0x1b14], 0
mov dword [ebp - 0x1b18], 0
mov dword [ebp - 0x1b14], 7
mov word [ebp - 0x1b28], ax
mov dword [ebp - 4], eax
mov ecx, esi
cmp dword [esi + 0x14], 8
jb 0x100053f9
mov ecx, dword [esi]
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x10005403
mov eax, dword [edi]
push ecx
push eax
lea eax, [ebp - 0x1b28]
push str.JumpToProtectMainPage_link___s__path___s
push eax
call fcn.100b5f90
add esp, 0x10
lea eax, [ebp - 0x1b28]
mov ecx, 0x10166724
push 0x24a
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x1e25], 0
je 0x10005455
lea eax, [ebp - 0x1b28]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1b14]
cmp edx, 8
jb 0x1000549c
mov ecx, dword [ebp - 0x1b28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10005492
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c1a
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b18], 0
mov dword [ebp - 0x1b14], 7
mov word [ebp - 0x1b28], ax
xor eax, eax
mov dword [ebp - 0x1a4c], 0
mov dword [ebp - 0x1a48], 0
mov dword [ebp - 0x1a4c], 0
mov dword [ebp - 0x1a48], 7
mov word [ebp - 0x1a5c], ax
mov dword [ebp - 4], 1
mov byte [ebp - 0x1a5d], al
lea eax, [ebp - 0x1a5d]
push eax
lea eax, [ebp - 0x1a5c]
push eax
push ecx
call fcn.10016920
cmp dword [0x10166724], 0
mov dword [ebp - 0x1a2c], eax
je 0x1000564d
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov ecx, dword [0x10166724]
cmp byte [ecx + 0x54], 0
je 0x1000564d
cmp dword [ecx + 0x58], 4
jb 0x1000564d
mov al, byte [ecx + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b30], 0
mov dword [ebp - 0x1b2c], 0
mov dword [ebp - 0x1b30], 0
mov dword [ebp - 0x1b2c], 7
mov word [ebp - 0x1b40], ax
mov byte [ebp - 4], 2
lea eax, [ebp - 0x1a5c]
cmp dword [ebp - 0x1a48], 8
cmovae eax, dword [ebp - 0x1a5c]
push eax
push dword [ebp - 0x1a2c]
lea eax, [ebp - 0x1b40]
push str.GetProtectMainPage_dwErr__0x_X_protectMainPage___s
push eax
call fcn.100b5f90
add esp, 0x10
lea eax, [ebp - 0x1b40]
mov ecx, 0x10166724
push 0x251
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x1e25], 0
je 0x100055ec
lea eax, [ebp - 0x1b40]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1b2c]
cmp edx, 8
jb 0x10005630
mov ecx, dword [ebp - 0x1b40]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10005626
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c1f
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b30], 0
mov dword [ebp - 0x1b2c], 7
mov word [ebp - 0x1b40], ax
xor eax, eax
mov dword [ebp - 0x1a34], 0
mov dword [ebp - 0x1a30], 0
mov byte [ebp - 0x1e26], 0
mov dword [ebp - 0x1a34], 0
mov dword [ebp - 0x1a30], 7
mov word [ebp - 0x1a44], ax
mov byte [ebp - 4], 3
lea edx, [ebp - 0x1e26]
lea ecx, [ebp - 0x1a44]
call fcn.1000f720
test al, al
je 0x100056ab
cmp dword [ebp - 0x1a34], 0
jne 0x100057a7
push 0x800
lea eax, [ebp - 0x1228]
push 0
push eax
call fcn.100e7700
add esp, 0xc
lea eax, [ebp - 0x1e26]
lea ecx, [ebp - 0x1228]
push eax
call fcn.1002ecd0
add esp, 4
test al, al
je 0x100057a7
xor eax, eax
mov dword [ebp - 0x1e54], 0
lea ecx, [ebp - 0x1228]
mov dword [ebp - 0x1e50], 0
mov dword [ebp - 0x1e54], 0
lea edx, [ecx + 2]
mov dword [ebp - 0x1e50], 7
mov word [ebp - 0x1e64], ax
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10005720
sub ecx, edx
lea eax, [ebp - 0x1228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1e64]
call fcn.1000b730
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x1a44]
call fcn.1000b6d0
movups xmm0, xmmword [ebp - 0x1e64]
xor eax, eax
mov word [ebp - 0x1e64], ax
movups xmmword [ebp - 0x1a44], xmm0
movq xmm0, qword [ebp - 0x1e54]
movq qword [ebp - 0x1a34], xmm0
mov dword [ebp - 0x1e54], 0
mov dword [ebp - 0x1e50], 7
mov byte [ebp - 4], 3
mov dword [ebp - 0x1e54], eax
mov dword [ebp - 0x1e50], 7
mov word [ebp - 0x1e64], ax
mov eax, dword [0x10166724]
test eax, eax
je 0x100058e9
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x100058e9
cmp dword [eax + 0x58], 4
jb 0x100058e9
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b48], 0
mov dword [ebp - 0x1b44], 0
mov dword [ebp - 0x1b48], 0
mov dword [ebp - 0x1b44], 7
mov word [ebp - 0x1b58], ax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x1a44]
cmp dword [ebp - 0x1a30], 8
movzx eax, byte [ebp - 0x1e26]
cmovae ecx, dword [ebp - 0x1a44]
push eax
push ecx
lea eax, [ebp - 0x1b58]
push str.GetProtectMainPage_Other_Browser_protectMainPage___s__isLocked___d
push eax
call fcn.100b5f90
add esp, 0x10
lea eax, [ebp - 0x1b58]
mov ecx, 0x10166724
push 0x25f
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x1e25], 0
je 0x10005883
lea eax, [ebp - 0x1b58]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b44]
cmp edx, 8
jb 0x100058c7
mov ecx, dword [ebp - 0x1b58]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100058bd
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c24
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b48], 0
mov word [ebp - 0x1b58], ax
mov eax, dword [0x10166724]
mov dword [ebp - 0x1b44], 7
cmp dword [ebp - 0x1a4c], 0
jne 0x10005aec
cmp byte [ebp - 0x1e26], 0
jne 0x10005aec
test eax, eax
je 0x10005a1c
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x10005a1c
cmp dword [eax + 0x58], 4
jb 0x10005a1c
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b60], 0
mov dword [ebp - 0x1b5c], 0
mov dword [ebp - 0x1b60], 0
mov dword [ebp - 0x1b5c], 7
mov word [ebp - 0x1b70], ax
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x1b70]
push 0x1a
push str.GetProtectMainPage
call fcn.1000b730
push 0x264
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1b70]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x1e25], 0
je 0x100059bb
lea eax, [ebp - 0x1b70]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1b5c]
cmp edx, 8
jb 0x100059ff
mov ecx, dword [ebp - 0x1b70]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x100059f5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c29
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b60], 0
mov dword [ebp - 0x1b5c], 7
mov word [ebp - 0x1b70], ax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1a30]
cmp edx, 8
jb 0x10005a60
mov ecx, dword [ebp - 0x1a44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10005a56
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c2e
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1a34], 0
mov dword [ebp - 0x1a30], 7
mov word [ebp - 0x1a44], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1a48]
cmp edx, 8
jb 0x10005ac4
mov ecx, dword [ebp - 0x1a5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10005aba
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c33
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1a4c], 0
mov word [ebp - 0x1a5c], ax
mov eax, dword [ebp - 0x1a2c]
mov dword [ebp - 0x1a48], 7
jmp 0x10007bfc
lea ecx, [ebp - 0x1ab0]
call fcn.10089d40
mov byte [ebp - 4], 7
lea eax, [ebp - 0x1ab0]
cmp dword [ebp - 0x1a9c], 8
push str.explorer.exe
cmovae eax, dword [ebp - 0x1ab0]
push eax
call fcn.100ea461
add esp, 8
test eax, eax
je 0x10005d7b
call fcn.100084b0
test al, al
jne 0x10005d7b
cmp dword [0x10166724], 0
je 0x10005c50
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x10005c50
cmp dword [eax + 0x58], 4
jb 0x10005c50
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b78], 0
mov dword [ebp - 0x1b74], 0
mov dword [ebp - 0x1b78], 0
mov dword [ebp - 0x1b74], 7
mov word [ebp - 0x1b88], ax
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x1b88]
push 0x17
push str.other_desk_close_swtich
call fcn.1000b730
push 0x26e
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1b88]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x1e25], 0
je 0x10005bef
lea eax, [ebp - 0x1b88]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1b74]
cmp edx, 8
jb 0x10005c33
mov ecx, dword [ebp - 0x1b88]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10005c29
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c38
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b78], 0
mov dword [ebp - 0x1b74], 7
mov word [ebp - 0x1b88], ax
mov byte [ebp - 4], 3
mov edx, dword [ebp - 0x1a9c]
cmp edx, 8
jb 0x10005c94
mov ecx, dword [ebp - 0x1ab0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10005c8a
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c3d
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1aa0], 0
mov dword [ebp - 0x1a9c], 7
mov word [ebp - 0x1ab0], ax
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x1a30]
cmp edx, 8
jb 0x10005cf5
mov ecx, dword [ebp - 0x1a44]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10005ceb
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c42
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1a34], 0
mov dword [ebp - 0x1a30], 7
mov word [ebp - 0x1a44], ax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x1a48]
cmp edx, 8
jb 0x10005d59
mov ecx, dword [ebp - 0x1a5c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10005d4f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c47
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1a4c], 0
mov dword [ebp - 0x1a48], 7
mov word [ebp - 0x1a5c], ax
jmp 0x10007bf9
push 0x11
xor eax, eax
mov dword [ebp - 0x1e8c], 0
mov dword [ebp - 0x1e88], 0
lea ecx, [ebp - 0x1e9c]
push str.2345RTProtect.exe
mov dword [ebp - 0x1e8c], 0
mov dword [ebp - 0x1e88], 7
mov word [ebp - 0x1e9c], ax
call fcn.1000b730
mov byte [ebp - 4], 9
lea ecx, [ebp - 0x1e9c]
call fcn.10088cc0
test al, al
sete al
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1e88]
cmp edx, 8
jb 0x10005e22
mov ecx, dword [ebp - 0x1e9c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10005e12
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c4c
push edx
push ecx
call fcn.100cf0c8
mov al, byte [ebp - 0x1e25]
add esp, 8
xor ecx, ecx
mov dword [ebp - 0x1e8c], 0
mov dword [ebp - 0x1e88], 7
mov word [ebp - 0x1e9c], cx
test al, al
je 0x1000603b
mov dword [ebp - 0x1e74], ecx
xor eax, eax
mov dword [ebp - 0x1e70], ecx
push 0x11
mov dword [ebp - 0x1e74], ecx
lea ecx, [ebp - 0x1e84]
push str.2345RTProtect.exe
mov dword [ebp - 0x1e70], 7
mov word [ebp - 0x1e84], ax
call fcn.1000b730
mov byte [ebp - 4], 0xa
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
jne 0x10005e9a
mov byte [ebp - 0x1e25], 0
jmp 0x10005eac
push eax
lea ecx, [ebp - 0x1e84]
call fcn.10007c60
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1e70]
cmp edx, 8
jb 0x10005ef0
mov ecx, dword [ebp - 0x1e84]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10005ee6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c51
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1e74], 0
mov dword [ebp - 0x1e70], 7
mov word [ebp - 0x1e84], ax
cmp byte [ebp - 0x1e25], al
jne 0x1000603b
cmp dword [0x10166724], eax
je 0x10005c50
push ecx
mov ecx, 0x10166724
call fcn.100b50c0
mov eax, dword [0x10166724]
cmp byte [eax + 0x54], 0
je 0x10005c50
cmp dword [eax + 0x58], 4
jb 0x10005c50
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x1e25], al
xor eax, eax
mov dword [ebp - 0x1b90], 0
mov dword [ebp - 0x1b8c], 0
mov dword [ebp - 0x1b90], 0
mov dword [ebp - 0x1b8c], 7
mov word [ebp - 0x1ba0], ax
mov byte [ebp - 4], 0xb
lea ecx, [ebp - 0x1ba0]
push 0xd
push str.not_found_rtp
call fcn.1000b730
push 0x291
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1ba0]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp byte [ebp - 0x1e25], 0
je 0x10005fd5
lea eax, [ebp - 0x1ba0]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 7
mov edx, dword [ebp - 0x1b8c]
cmp edx, 8
jb 0x10006019
mov ecx, dword [ebp - 0x1ba0]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x1000600f
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c56
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1b90], 0
mov dword [ebp - 0x1b8c], 7
mov word [ebp - 0x1ba0], ax
jmp 0x10005c50
xor eax, eax
mov dword [ebp - 0x1b00], 0
mov dword [ebp - 0x1afc], 0
mov dword [ebp - 0x1b00], 0
mov dword [ebp - 0x1afc], 7
mov word [ebp - 0x1b10], ax
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1e4c]
push 0xa
mov dword [ebp - 0x1e3c], eax
mov dword [ebp - 0x1e38], eax
push str.2345PCSafe
mov dword [ebp - 0x1e3c], eax
mov dword [ebp - 0x1e38], 7
mov word [ebp - 0x1e4c], ax
call fcn.1000b730
mov byte [ebp - 4], 0xe
lea eax, [ebp - 0x1e4c]
cmp dword [ebp - 0x1e38], 8
lea ecx, [ebp - 0x1b10]
push dword [ebp - 0x1e3c]
cmovae eax, dword [ebp - 0x1e4c]
push eax
call fcn.1000b730
mov byte [ebp - 4], 0xd
mov edx, dword [ebp - 0x1e38]
cmp edx, 8
jb 0x10006113
mov ecx, dword [ebp - 0x1e4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10006109
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10007c3d
push edx
push ecx
call fcn.100cf0c8
add esp, 8
xor eax, eax
mov dword [ebp - 0x1e3c], 0
lea ecx, [ebp - 0x1b10]
mov dword [ebp - 0x1e38], 7
mov word [ebp - 0x1e4c], ax
call fcn.10033350
test al, al
je 0x10006287
push str.2345SafeTray.exe
lea ecx, [ebp - 0x1eb4]
call fcn.1000b340
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x1eb4]
call fcn.10088cc0
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1eb4]
call fcn.1000b6d0
cmp byte [ebp - 0x1e25], 0
jne 0x10006287
push str.2345SafeTray.exe
lea ecx, [ebp - 0x1ecc]
call fcn.1000b340
mov byte [ebp - 4], 0x10
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
cmp eax, 0xffffffff
jne 0x100061b0
mov byte [ebp - 0x1e25], 0
jmp 0x100061c2
push eax
lea ecx, [ebp - 0x1ecc]
call fcn.10007c60
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1ecc]
call fcn.1000b6d0
cmp byte [ebp - 0x1e25], 0
jne 0x10006287
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x10006282
xor eax, eax
mov dword [ebp - 0x1c34], 0
mov dword [ebp - 0x1c30], 0
mov dword [ebp - 0x1c34], 0
mov dword [ebp - 0x1c30], 7
mov word [ebp - 0x1c44], ax
mov byte [ebp - 4], 0x11
lea ecx, [ebp - 0x1c44]
push 0xe
push str.not_found_tray
call fcn.1000b730
push 0x29e
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1c44]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x10006273
lea eax, [ebp - 0x1c44]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1c44]
call fcn.1000b6d0
jmp 0x10007bba
cmp dword [ebp - 0x1a34], 0
je 0x100063c6
mov edx, str.__r_t_n
lea ecx, [ebp - 0x1a44]
call fcn.10086590
mov edx, str.__r_t_n
lea ecx, [ebp - 0x1a44]
call fcn.10086620
lea ecx, [ebp - 0x1a44]
call fcn.10086750
cmp dword [ebp - 0x1a30], 8
lea eax, [ebp - 0x1a44]
push 5
cmovae eax, dword [ebp - 0x1a44]
push str.http:
push eax
call fcn.100edc0b
add esp, 0xc
test eax, eax
je 0x100063c6
cmp dword [ebp - 0x1a30], 8
lea eax, [ebp - 0x1a44]
push 6
cmovae eax, dword [ebp - 0x1a44]
push str.https:
push eax
call fcn.100edc0b
add esp, 0xc
test eax, eax
je 0x100063c6
cmp dword [ebp - 0x1a30], 8
lea eax, [ebp - 0x1a44]
push 0xb
cmovae eax, dword [ebp - 0x1a44]
push str.about:blank
push eax
call fcn.100edc0b
add esp, 0xc
test eax, eax
je 0x100063c6
cmp dword [ebp - 0x1a30], 8
lea eax, [ebp - 0x1a44]
push 0xa
cmovae eax, dword [ebp - 0x1a44]
push str.about:tabs
push eax
call fcn.100edc0b
add esp, 0xc
test eax, eax
je 0x100063c6
push str.http:__
lea ecx, [ebp - 0x1e24]
call fcn.1000b340
mov byte [ebp - 4], 0x13
lea eax, [ebp - 0x1a44]
cmp dword [ebp - 0x1a30], 8
lea ecx, [ebp - 0x1e24]
push dword [ebp - 0x1a34]
cmovae eax, dword [ebp - 0x1a44]
push eax
call fcn.1000b9b0
lea eax, [ebp - 0x1e24]
push eax
lea ecx, [ebp - 0x1a44]
call fcn.1000b220
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1e24]
call fcn.1000b6d0
mov eax, dword [0x101660ec]
test eax, eax
je 0x100064bd
mov esi, dword [0x101660ec]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
movsd xmm0, qword [0x101431b0]
sub eax, esi
movd xmm1, eax
cvtdq2pd xmm1, xmm1
shr eax, 0x1f
addsd xmm1, qword [eax*8 + 0x10143220]
andps xmm1, xmmword [0x10143230]
comisd xmm0, xmm1
jb 0x100064b7
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x100064b2
xor eax, eax
mov dword [ebp - 0x1c4c], 0
mov dword [ebp - 0x1c48], 0
mov dword [ebp - 0x1c4c], 0
mov dword [ebp - 0x1c48], 7
mov word [ebp - 0x1c5c], ax
mov byte [ebp - 4], 0x14
lea ecx, [ebp - 0x1c5c]
push 0x1c
push str.JumpToProtectMainPage
call fcn.1000b730
push 0x2b8
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1c5c]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x100064a3
lea eax, [ebp - 0x1c5c]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1c5c]
call fcn.1000b6d0
jmp 0x10007bba
mov esi, dword [ebp - 0x1e30]
call fcn.1000ab00
test al, al
jne 0x100064d3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x101660ec
xchg dword [ecx], eax
push 1
push 0x10166098
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x100064e9
call fcn.1001a8f0
lea eax, [ebp - 0x1a5c]
push eax
call fcn.1001b090
test al, al
je 0x1000654a
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1d1c]
push eax
call fcn.10014b50
mov byte [ebp - 4], 0x16
mov ecx, dword [ebp - 0x1d0c]
test ecx, ecx
je 0x1000653b
cmp dword [ebp - 0x1d08], 8
lea eax, [ebp - 0x1d1c]
push ecx
cmovae eax, dword [ebp - 0x1d1c]
lea ecx, [ebp - 0x1a5c]
push eax
call fcn.1000b9b0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1d1c]
call fcn.1000b6d0
xor eax, eax
mov dword [ebp - 0x1a68], 0
mov dword [ebp - 0x1a64], 0
mov dword [ebp - 0x1a68], 0
mov dword [ebp - 0x1a64], 7
mov word [ebp - 0x1a78], ax
mov byte [ebp - 4], 0x17
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x10006589
mov eax, dword [edi]
lea ecx, [ebp - 0x1a78]
push ecx
push eax
call fcn.100157d0
push dword [0x10164080]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 4
mov ecx, 0x10166724
mov dword [ebp - 0x1e30], eax
call fcn.100b5ab0
mov dword [ebp - 0x1e34], eax
test eax, eax
je 0x1000667a
xor eax, eax
mov dword [ebp - 0x1c64], 0
mov dword [ebp - 0x1c60], 0
mov dword [ebp - 0x1c64], 0
mov dword [ebp - 0x1c60], 7
mov word [ebp - 0x1c74], ax
mov byte [ebp - 4], 0x18
cmp dword [esi + 0x14], 8
jb 0x100065ff
mov esi, dword [esi]
cmp dword [ebp - 0x1a64], 8
lea eax, [ebp - 0x1a78]
push esi
cmovae eax, dword [ebp - 0x1a78]
push eax
push dword [ebp - 0x1e30]
lea eax, [ebp - 0x1c74]
push str.pAction___p_targetFileName___s_currentPath___s
push eax
call fcn.100b5f90
add esp, 0x14
lea eax, [ebp - 0x1c74]
mov ecx, 0x10166724
push 0x2d0
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp dword [ebp - 0x1e34], 1
jbe 0x1000666b
lea eax, [ebp - 0x1c74]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1c74]
call fcn.1000b6d0
push 0
push dword [0x10164080]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
cmp dword [ebp - 0x1a4c], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
jne 0x10006777
cmp dword [ebp - 0x1a64], 8
lea eax, [ebp - 0x1a78]
push 0x10137fe4
cmovae eax, dword [ebp - 0x1a78]
push eax
call esi
test eax, eax
je 0x10006777
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x10006763
xor eax, eax
mov dword [ebp - 0x1c1c], 0
mov dword [ebp - 0x1c18], 0
mov dword [ebp - 0x1c1c], 0
mov dword [ebp - 0x1c18], 7
mov word [ebp - 0x1c2c], ax
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x1c2c]
push 0x26
push str.GetProtectMainPage_fail_and_path_is_ie
call fcn.1000b730
push 0x2d6
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1c2c]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x10006754
lea eax, [ebp - 0x1c2c]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1c2c]
call fcn.1000b6d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.1000b6d0
jmp 0x10007bba
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x10006781
mov eax, dword [edi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100067af
cmp dword [ebp - 0x1a64], 8
lea eax, [ebp - 0x1a78]
cmovae eax, dword [ebp - 0x1a78]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10006ae8
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x1e2c], esp
push edi
call fcn.1000b3b0
mov byte [ebp - 4], 0x1b
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ae0]
call fcn.100049f0
add esp, 0x18
mov byte [ebp - 4], 0x1c
cmp dword [ebp - 0x1ad0], 0
jne 0x10006908
cmp dword [ebp - 0x1a68], 0
jbe 0x10006ad9
sub esp, 0x18
lea eax, [ebp - 0x1a78]
mov ecx, esp
mov dword [ebp - 0x1e2c], esp
push eax
call fcn.1000b3b0
mov byte [ebp - 4], 0x1d
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1f14]
call fcn.100049f0
add esp, 0x18
mov byte [ebp - 4], 0x1e
lea ecx, [ebp - 0x1ae0]
push eax
call fcn.1000b290
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1f14]
call fcn.1000b6d0
cmp dword [ebp - 0x1ad0], 0
jbe 0x10006ad9
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x100069c3
xor eax, eax
mov dword [ebp - 0x1c04], 0
mov dword [ebp - 0x1c00], 0
mov dword [ebp - 0x1c04], 0
mov dword [ebp - 0x1c00], 7
mov word [ebp - 0x1c14], ax
mov byte [ebp - 4], 0x1f
lea eax, [ebp - 0x1ae0]
cmp dword [ebp - 0x1acc], 8
cmovae eax, dword [ebp - 0x1ae0]
push eax
lea eax, [ebp - 0x1c14]
push str.targetFileName_guid_file_path___ws
push eax
call fcn.100b5f90
add esp, 0xc
lea eax, [ebp - 0x1c14]
mov ecx, 0x10166724
push 0x2e7
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x100068f9
lea eax, [ebp - 0x1c14]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1c14]
jmp 0x100069be
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x100069c3
xor eax, eax
mov dword [ebp - 0x1bec], 0
mov dword [ebp - 0x1be8], 0
mov dword [ebp - 0x1bec], 0
mov dword [ebp - 0x1be8], 7
mov word [ebp - 0x1bfc], ax
mov byte [ebp - 4], 0x20
lea eax, [ebp - 0x1ae0]
cmp dword [ebp - 0x1acc], 8
cmovae eax, dword [ebp - 0x1ae0]
push eax
lea eax, [ebp - 0x1bfc]
push str.linkName_guid_file_path___ws
push eax
call fcn.100b5f90
add esp, 0xc
lea eax, [ebp - 0x1bfc]
mov ecx, 0x10166724
push 0x2ed
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x100069b4
lea eax, [ebp - 0x1bfc]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1bfc]
call fcn.1000b6d0
cmp dword [ebp - 0x1ad0], 0
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
jbe 0x10006ad9
cmp dword [ebp - 0x1acc], 8
lea eax, [ebp - 0x1ae0]
push 0x10137fe4
cmovae eax, dword [ebp - 0x1ae0]
push eax
call esi
test eax, eax
jne 0x10006a3a
cmp dword [ebp - 0x1acc], 8
lea eax, [ebp - 0x1ae0]
push str._shdocvw.dll
cmovae eax, dword [ebp - 0x1ae0]
push eax
call esi
test eax, eax
jne 0x10006a3a
cmp dword [ebp - 0x1acc], 8
lea eax, [ebp - 0x1ae0]
push str.ieframe.dll
cmovae eax, dword [ebp - 0x1ae0]
push eax
call esi
test eax, eax
je 0x10006ad9
lea eax, [ebp - 0x1f2c]
push eax
call fcn.100186e0
mov byte [ebp - 4], 0x21
lea ecx, [ebp - 0x1a5c]
push ecx
push eax
call fcn.10016c30
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 0x1c
lea ecx, [ebp - 0x1f2c]
call fcn.1000b6d0
cmp byte [ebp - 0x1e25], 0
je 0x10006ad9
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ae0]
call fcn.1000b6d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.1000b6d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1b10]
call fcn.1000b6d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1ab0]
call fcn.1000b6d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1a44]
call fcn.1000b6d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a5c]
call fcn.1000b6d0
xor eax, eax
jmp 0x10007bfc
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ae0]
call fcn.1000b6d0
cmp dword [ebp - 0x1e30], 1
jne 0x10006b99
cmp dword [ebp - 0x1a64], 8
lea eax, [ebp - 0x1a78]
push str.2345explorer.exe
cmovae eax, dword [ebp - 0x1a78]
push eax
call esi
test eax, eax
je 0x10006b6e
push 0x101376f0
lea ecx, [ebp - 0x1efc]
call fcn.1000b340
mov byte [ebp - 4], 0x23
lea eax, [ebp - 0x1efc]
push eax
lea eax, [ebp - 0x1a78]
push eax
call fcn.10016c30
mov byte [ebp - 0x1e25], al
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1efc]
call fcn.1000b6d0
cmp byte [ebp - 0x1e25], 0
je 0x10006b99
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.1000b6d0
jmp 0x10006a93
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1a78]
push eax
call fcn.10016c30
test al, al
je 0x10006b99
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.1000b6d0
jmp 0x10006a93
push edi
lea ecx, [ebp - 0x1ac8]
call fcn.1000b3b0
mov byte [ebp - 4], 0x26
lea eax, [ebp - 0x1ac8]
cmp dword [ebp - 0x1ab4], 8
cmovae eax, dword [ebp - 0x1ac8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10006ca9
push 0x800
push eax
lea eax, [ebp - 0x1a28]
push eax
call fcn.100e7700
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x1a28]
add esp, 0xc
push 1
push 0x10
push eax
push 0
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x10006caf
cmp dword [ebp - 0x1ab4], 8
lea ecx, [ebp - 0x1a28]
lea eax, [ebp - 0x1ac8]
cmovae eax, dword [ebp - 0x1ac8]
push ecx
push eax
call edi
test eax, eax
je 0x10006caf
cmp dword [ebp - 0x1ab4], 8
lea eax, [ebp - 0x1ac8]
cmovae eax, dword [ebp - 0x1ac8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov edi, eax
test edi, edi
je 0x10006ca9
push 0x800
lea eax, [ebp - 0xa28]
push 0
push eax
call fcn.100e7700
add esp, 0xc
lea eax, [ebp - 0xa28]
push 1
push 0x19
push eax
push 0
call esi
push edi
lea eax, [ebp - 0xa28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0xa28]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10006c87
sub ecx, edx
lea eax, [ebp - 0xa28]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1ac8]
call fcn.1000b730
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x101376f0
lea ecx, [ebp - 0x1a90]
call fcn.1000b340
mov byte [ebp - 4], 0x27
xor eax, eax
mov dword [ebp - 0x1ae8], 0
mov dword [ebp - 0x1ae4], 0
mov dword [ebp - 0x1ae8], 0
mov dword [ebp - 0x1ae4], 7
mov word [ebp - 0x1af8], ax
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x1ac8]
cmp dword [ebp - 0x1ab4], 8
lea ecx, [ebp - 0x1ee4]
cmovae eax, dword [ebp - 0x1ac8]
push eax
call fcn.1000b340
mov byte [ebp - 4], 0x29
lea eax, [ebp - 0x1af8]
push eax
lea eax, [ebp - 0x1a90]
push eax
lea eax, [ebp - 0x1ee4]
push eax
call fcn.1001a1b0
mov esi, eax
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1ee4]
call fcn.1000b6d0
test esi, esi
jne 0x10007b04
cmp dword [ebp - 0x1ae8], esi
jne 0x10006e6c
cmp dword [ebp - 0x1a7c], 8
lea eax, [ebp - 0x1a90]
push 0x10137fe4
cmovae eax, dword [ebp - 0x1a90]
push eax
call edi
test eax, eax
je 0x10006e6c
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x10006e14
lea ecx, [ebp - 0x1dc4]
call fcn.1000b390
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x1a90]
cmp dword [ebp - 0x1a7c], 8
lea eax, [ebp - 0x1dc4]
cmovae ecx, dword [ebp - 0x1a90]
push ecx
push 0x10138130
push eax
call fcn.100b5f90
add esp, 0xc
lea eax, [ebp - 0x1dc4]
mov ecx, 0x10166724
push 0x32f
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x10006e05
lea eax, [ebp - 0x1dc4]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1dc4]
call fcn.1000b6d0
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1a90]
push eax
call fcn.10016c30
test al, al
je 0x10006e6c
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1af8]
call fcn.1000b6d0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1a90]
call fcn.1000b6d0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ac8]
call fcn.1000b6d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.1000b6d0
jmp 0x10006a93
cmp byte [ebp - 0x1e26], 0
je 0x10007618
xorps xmm0, xmm0
lea ecx, [ebp - 0x1a98]
movlpd qword [ebp - 0x1a98], xmm0
call fcn.1000cc30
mov byte [ebp - 4], 0x2c
lea eax, [ebp - 0x1a44]
push eax
lea ecx, [ebp - 0x1a5c]
call fcn.1000b220
mov dword [ebp - 0x1bcc], 0
mov dword [ebp - 0x1bc8], 0
mov dword [ebp - 0x1bc4], 0
mov dword [ebp - 0x1bc0], 0
mov dword [ebp - 0x1bbc], 0
mov byte [ebp - 4], 0x2d
xor eax, eax
mov dword [ebp - 0x1ba8], 0
mov dword [ebp - 0x1ba4], 0
mov dword [ebp - 0x1ba8], 0
mov dword [ebp - 0x1ba4], 7
mov word [ebp - 0x1bb8], ax
mov byte [ebp - 4], 0x2f
sub esp, 0x18
lea eax, [ebp - 0x1a90]
mov dword [ebp - 0x1e2c], esp
mov ecx, esp
push eax
call fcn.1000b3b0
mov byte [ebp - 4], 0x30
lea eax, [ebp - 0x1bcc]
push eax
mov byte [ebp - 4], 0x2f
call fcn.1000f300
test al, al
je 0x1000759f
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x10007002
lea ecx, [ebp - 0x1ddc]
call fcn.1000b390
mov byte [ebp - 4], 0x31
lea ecx, [ebp - 0x1af8]
cmp dword [ebp - 0x1ae4], 8
lea eax, [ebp - 0x1a90]
cmovae ecx, dword [ebp - 0x1af8]
cmp dword [ebp - 0x1a7c], 8
mov dword [ebp - 0x1e34], ecx
cmovae eax, dword [ebp - 0x1a90]
mov dword [ebp - 0x1e6c], eax
lea eax, [ebp - 0x1e34]
push eax
lea eax, [ebp - 0x1e6c]
push eax
push 0x10138150
lea eax, [ebp - 0x1ddc]
push eax
call fcn.1000c080
push 0x33e
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1ddc]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x10006ff3
lea eax, [ebp - 0x1ddc]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1ddc]
call fcn.1000b6d0
lea eax, [ebp - 0x1af8]
push eax
lea eax, [ebp - 0x1a90]
push eax
call fcn.1000fc50
test al, al
je 0x1000759f
lea eax, [ebp - 0x1a5c]
push eax
call fcn.1001b090
test al, al
je 0x10007085
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1a90]
push eax
lea eax, [ebp - 0x1d04]
push eax
call fcn.10014700
mov byte [ebp - 4], 0x32
mov ecx, dword [ebp - 0x1cf4]
test ecx, ecx
je 0x10007076
cmp dword [ebp - 0x1cf0], 8
lea eax, [ebp - 0x1d04]
push ecx
cmovae eax, dword [ebp - 0x1d04]
lea ecx, [ebp - 0x1a5c]
push eax
call fcn.1000b9b0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1d04]
call fcn.1000b6d0
lea eax, [ebp - 0x1a5c]
push eax
lea ecx, [ebp - 0x1be4]
call fcn.1000b3b0
mov byte [ebp - 4], 0x33
mov ecx, 0x10166724
push 4
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x1000713c
lea ecx, [ebp - 0x1df4]
call fcn.1000b390
mov byte [ebp - 4], 0x34
lea ecx, [ebp - 0x1af8]
push dword [ebp - 0x1bc8]
cmp dword [ebp - 0x1ae4], 8
lea eax, [ebp - 0x1df4]
push dword [ebp - 0x1bcc]
cmovae ecx, dword [ebp - 0x1af8]
push ecx
push 0x101381a0
push eax
call fcn.100b5f90
add esp, 0x14
lea eax, [ebp - 0x1df4]
mov ecx, 0x10166724
push 0x34d
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x1000712d
lea eax, [ebp - 0x1df4]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1df4]
call fcn.1000b6d0
cmp dword [ebp - 0x1bc8], 1
jne 0x10007231
lea eax, [ebp - 0x1bb8]
push eax
lea eax, [ebp - 0x1bc4]
push eax
lea eax, [ebp - 0x1be4]
push eax
lea eax, [ebp - 0x1cd4]
push eax
call fcn.1000e830
mov byte [ebp - 4], 0x35
cmp dword [ebp - 0x1cc4], 0
je 0x10007222
lea eax, [ebp - 0x1cd4]
push eax
lea ecx, [ebp - 0x1be4]
call fcn.1000b220
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x10007222
lea ecx, [ebp - 0x1e0c]
call fcn.1000b390
mov byte [ebp - 4], 0x36
lea ecx, [ebp - 0x1cd4]
cmp dword [ebp - 0x1cc0], 8
lea eax, [ebp - 0x1e0c]
cmovae ecx, dword [ebp - 0x1cd4]
push ecx
push 0x10138220
push eax
call fcn.100b5f90
add esp, 0xc
lea eax, [ebp - 0x1e0c]
mov ecx, 0x10166724
push 0x356
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x10007213
lea eax, [ebp - 0x1e0c]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x35
lea ecx, [ebp - 0x1e0c]
call fcn.1000b6d0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1cd4]
call fcn.1000b6d0
cmp dword [ebp - 0x1bcc], 1
jne 0x10007330
sub esp, 0x18
lea eax, [ebp - 0x1be4]
mov ecx, esp
mov dword [ebp - 0x1e2c], esp
push eax
call fcn.1000b3b0
mov byte [ebp - 4], 0x37
lea eax, [ebp - 0x1cbc]
push eax
mov byte [ebp - 4], 0x33
call fcn.1000e280
mov byte [ebp - 4], 0x38
cmp dword [ebp - 0x1cac], 0
je 0x10007321
lea eax, [ebp - 0x1cbc]
push eax
lea ecx, [ebp - 0x1be4]
call fcn.1000b220
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x10007321
lea ecx, [ebp - 0x1d34]
call fcn.1000b390
mov byte [ebp - 4], 0x39
lea ecx, [ebp - 0x1cbc]
cmp dword [ebp - 0x1ca8], 8
lea eax, [ebp - 0x1d34]
cmovae ecx, dword [ebp - 0x1cbc]
push ecx
push 0x10138260
push eax
call fcn.100b5f90
add esp, 0xc
lea eax, [ebp - 0x1d34]
mov ecx, 0x10166724
push 0x361
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x10007312
lea eax, [ebp - 0x1d34]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x1d34]
call fcn.1000b6d0
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1cbc]
call fcn.1000b6d0
lea edx, [ebp - 0x1a90]
lea ecx, [ebp - 0x1cec]
call fcn.100100b0
mov byte [ebp - 4], 0x3a
lea eax, [ebp - 0x1be4]
cmp dword [ebp - 0x1cdc], 0
push eax
je 0x1000746d
lea eax, [ebp - 0x1cec]
push eax
call fcn.10016c30
test al, al
je 0x10007581
sub esp, 0x18
lea eax, [ebp - 0x1a90]
mov ecx, esp
mov dword [ebp - 0x1e2c], esp
push eax
call fcn.1000b3b0
mov byte [ebp - 4], 0x3b
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x1a98]
call fcn.1000d720
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1cec]
call fcn.1000b6d0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1be4]
call fcn.1000b6d0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x1bb8]
call fcn.1000b6d0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1bc4]
call fcn.1000b4e0
mov byte [ebp - 4], 0x3e
mov eax, dword [0x10166114]
test eax, eax
je 0x100073ec
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10166114]
sub dword [0x10164084], 1
jne 0x10007406
call fcn.10026240
mov ecx, eax
call fcn.10026550
mov eax, dword [0x10166114]
test eax, eax
je 0x10007411
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x1a98]
mov dword [ebp - 0x1e2c], eax
mov byte [ebp - 4], 0x28
mov ecx, eax
call fcn.10010bc0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1af8]
call fcn.1000b6d0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1a90]
call fcn.1000b6d0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ac8]
call fcn.1000b6d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.1000b6d0
jmp 0x10006a93
lea eax, [ebp - 0x1a90]
push eax
call fcn.10016c30
test al, al
je 0x10007581
sub esp, 0x18
lea eax, [ebp - 0x1a90]
mov ecx, esp
mov dword [ebp - 0x1e2c], esp
push eax
call fcn.1000b3b0
mov byte [ebp - 4], 0x41
mov byte [ebp - 4], 0x3a
lea ecx, [ebp - 0x1a98]
call fcn.1000d720
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1cec]
call fcn.1000b6d0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1be4]
call fcn.1000b6d0
mov byte [ebp - 4], 0x42
lea ecx, [ebp - 0x1bb8]
call fcn.1000b6d0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1bc4]
call fcn.1000b4e0
mov byte [ebp - 4], 0x44
mov eax, dword [0x10166114]
test eax, eax
je 0x10007500
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10166114]
sub dword [0x10164084], 1
jne 0x1000751a
call fcn.10026240
mov ecx, eax
call fcn.10026550
mov eax, dword [0x10166114]
test eax, eax
je 0x10007525
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x1a98]
mov dword [ebp - 0x1e2c], eax
mov byte [ebp - 4], 0x28
mov ecx, eax
call fcn.10010bc0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1af8]
call fcn.1000b6d0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1a90]
call fcn.1000b6d0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ac8]
call fcn.1000b6d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.1000b6d0
jmp 0x10006a93
mov byte [ebp - 4], 0x33
lea ecx, [ebp - 0x1cec]
call fcn.1000b6d0
mov byte [ebp - 4], 0x2f
lea ecx, [ebp - 0x1be4]
call fcn.1000b6d0
mov byte [ebp - 4], 0x47
lea ecx, [ebp - 0x1bb8]
call fcn.1000b6d0
mov byte [ebp - 4], 0x2c
lea ecx, [ebp - 0x1bc4]
call fcn.1000b4e0
mov byte [ebp - 4], 0x49
mov eax, dword [0x10166114]
test eax, eax
je 0x100075d6
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10166114]
sub dword [0x10164084], 1
jne 0x100075f0
call fcn.10026240
mov ecx, eax
call fcn.10026550
mov eax, dword [0x10166114]
test eax, eax
je 0x100075fb
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x1a98]
mov dword [ebp - 0x1e2c], eax
mov byte [ebp - 4], 0x28
mov ecx, eax
call fcn.10010bc0
jmp 0x10007692
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x10007692
lea ecx, [ebp - 0x1d4c]
call fcn.1000b390
mov byte [ebp - 4], 0x4b
lea ecx, [ebp - 0x1d4c]
push 0x1b
push str.Other_Browser_Home
call fcn.1000b730
push 0x37c
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1d4c]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x10007683
lea eax, [ebp - 0x1d4c]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1d4c]
call fcn.1000b6d0
xor eax, eax
mov dword [ebp - 0x1c94], 0
mov dword [ebp - 0x1c90], 0
mov dword [ebp - 0x1c94], 0
mov dword [ebp - 0x1c90], 7
mov word [ebp - 0x1ca4], ax
mov byte [ebp - 4], 0x4c
mov dword [ebp - 0x1c7c], eax
mov dword [ebp - 0x1c78], eax
mov dword [ebp - 0x1c7c], eax
mov dword [ebp - 0x1c78], 7
mov word [ebp - 0x1c8c], ax
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1a2c]
mov dword [ebp - 0x1a2c], eax
call fcn.10019530
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1a2c]
call fcn.10019760
lea eax, [ebp - 0x1a90]
push eax
lea ecx, [ebp - 0x1a2c]
call fcn.100199d0
test al, al
je 0x10007a30
lea eax, [ebp - 0x1c8c]
push eax
lea eax, [ebp - 0x1ca4]
push eax
push ecx
lea eax, [ebp - 0x1af8]
push eax
lea ecx, [ebp - 0x1a2c]
call fcn.10019910
test al, al
je 0x10007a30
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x100077e6
lea ecx, [ebp - 0x1d64]
call fcn.1000b390
mov byte [ebp - 4], 0x4f
lea ecx, [ebp - 0x1a90]
cmp dword [ebp - 0x1a7c], 8
lea eax, [ebp - 0x1d64]
cmovae ecx, dword [ebp - 0x1a90]
push ecx
push 0x101382dc
push eax
call fcn.100b5f90
add esp, 0xc
lea eax, [ebp - 0x1d64]
mov ecx, 0x10166724
push 0x387
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x100077d7
lea eax, [ebp - 0x1d64]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1d64]
call fcn.1000b6d0
cmp dword [ebp - 0x1a68], 0
jne 0x10007892
cmp dword [ebp - 0x1a7c], 8
lea eax, [ebp - 0x1a90]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x1a90]
push eax
call esi
test eax, eax
je 0x10007828
lea eax, [ebp - 0x1a90]
push eax
lea ecx, [ebp - 0x1a78]
call fcn.1000b220
jmp 0x10007892
push 0x20a
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.100e7700
add esp, 0xc
lea eax, [ebp - 0x228]
push 0x104
push eax
push str._ProgramFiles_Internet_Exploreriexplore.exe
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp - 0x228]
push eax
call esi
test eax, eax
je 0x10007892
lea ecx, [ebp - 0x228]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10007870
sub ecx, edx
lea eax, [ebp - 0x228]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x1a78]
call fcn.1000b730
cmp dword [ebp - 0x1a64], 8
lea eax, [ebp - 0x1a78]
push str.2345explorer.exe
cmovae eax, dword [ebp - 0x1a78]
push eax
call edi
test eax, eax
je 0x100078e8
lea eax, [ebp - 0x1af8]
push eax
lea ecx, [ebp - 0x1a5c]
call fcn.1000b220
push 1
push 0x10138354
lea ecx, [ebp - 0x1a5c]
call fcn.1000b9b0
push 0xb
push 0x10138358
lea ecx, [ebp - 0x1a5c]
call fcn.1000b9b0
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x100079a7
lea ecx, [ebp - 0x1d7c]
call fcn.1000b390
mov byte [ebp - 4], 0x50
lea ecx, [ebp - 0x1a5c]
cmp dword [ebp - 0x1a48], 8
lea eax, [ebp - 0x1a78]
cmovae ecx, dword [ebp - 0x1a5c]
cmp dword [ebp - 0x1a64], 8
mov dword [ebp - 0x1e68], ecx
cmovae eax, dword [ebp - 0x1a78]
mov dword [ebp - 0x1e2c], eax
lea eax, [ebp - 0x1e68]
push eax
lea eax, [ebp - 0x1e2c]
push eax
push 0x10138370
lea eax, [ebp - 0x1d7c]
push eax
call fcn.1000c080
push 0x3a1
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1d7c]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x10007998
lea eax, [ebp - 0x1d7c]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1d7c]
call fcn.1000b6d0
lea eax, [ebp - 0x1a5c]
push eax
lea eax, [ebp - 0x1a78]
push eax
call fcn.10016c30
test al, al
je 0x10007acc
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1a2c]
call fcn.100195a0
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x1c8c]
call fcn.1000b6d0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1ca4]
call fcn.1000b6d0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1af8]
call fcn.1000b6d0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1a90]
call fcn.1000b6d0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ac8]
call fcn.1000b6d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.1000b6d0
jmp 0x10006a93
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov edi, eax
test edi, edi
je 0x10007acc
lea ecx, [ebp - 0x1d94]
call fcn.1000b390
mov byte [ebp - 4], 0x52
lea esi, [ebp - 0x1ac8]
cmp dword [ebp - 0x1ab4], 8
cmovae esi, dword [ebp - 0x1ac8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
push eax
lea eax, [ebp - 0x1d94]
push str.RCBlackShortCut_Analyze_Fail___x_lnk___s
push eax
call fcn.100b5f90
add esp, 0x10
lea eax, [ebp - 0x1d94]
mov ecx, 0x10166724
push 0x3a9
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
push eax
push 4
call fcn.100b5af0
cmp edi, 1
jbe 0x10007abd
lea eax, [ebp - 0x1d94]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x4e
lea ecx, [ebp - 0x1d94]
call fcn.1000b6d0
mov eax, dword [ebp - 0x1a2c]
test eax, eax
je 0x10007ada
mov byte [eax + 4], 0
mov byte [ebp - 4], 0x4d
lea ecx, [ebp - 0x1a2c]
call fcn.100195a0
mov byte [ebp - 4], 0x4c
lea ecx, [ebp - 0x1c8c]
call fcn.1000b6d0
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1ca4]
jmp 0x10007b79
push 4
mov ecx, 0x10166724
call fcn.100b5ab0
mov esi, eax
test esi, esi
je 0x10007b7e
lea ecx, [ebp - 0x1dac]
call fcn.1000b390
mov byte [ebp - 4], 0x53
lea ecx, [ebp - 0x1dac]
push 0x1b
push str.GetShortCutTargetCmdEx_Fail
call fcn.1000b730
push 0x3af
push str.RC::RCApiHookNewFuns::JumpToProtectMainPage
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhinoprotectwebprotect_src_safeexpmon_src_rcapihooknewfuns.cpp
lea eax, [ebp - 0x1dac]
mov ecx, 0x10166724
push eax
push 4
call fcn.100b5af0
cmp esi, 1
jbe 0x10007b6f
lea eax, [ebp - 0x1dac]
mov ecx, 0x10166724
push eax
call fcn.100b5e10
mov byte [ebp - 4], 0x28
lea ecx, [ebp - 0x1dac]
call fcn.1000b6d0
mov byte [ebp - 4], 0x27
lea ecx, [ebp - 0x1af8]
call fcn.1000b6d0
mov byte [ebp - 4], 0x26
lea ecx, [ebp - 0x1a90]
call fcn.1000b6d0
mov byte [ebp - 4], 0x17
lea ecx, [ebp - 0x1ac8]
call fcn.1000b6d0
mov byte [ebp - 4], 0xd
lea ecx, [ebp - 0x1a78]
call fcn.1000b6d0
mov byte [ebp - 4], 7
lea ecx, [ebp - 0x1b10]
call fcn.1000b6d0
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1ab0]
call fcn.1000b6d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1a44]
call fcn.1000b6d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1a5c]
call fcn.1000b6d0
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.100ceb24
mov esp, ebp
pop ebp
mov esp, ebx
pop ebx
ret
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
call fcn.100ecf9f
int3