Function at 0x1036ad70
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get file attributes
Get file version info
Link many functions at runtime
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10417b02
mov eax, dword fs:[0]
push eax
sub esp, 0x890
mov eax, dword [0x104c5878]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x858]
xor ebx, ebx
mov dword [ebp - 0x878], ebx
mov ecx, eax
mov dword [ebp - 0x89c], ebx
mov dword [ebp - 0x87c], eax
call fcn.1031ee60
mov dword [ebp - 4], 2
lea ecx, [ebp - 0x858]
call fcn.10311190
mov dword [ebp - 4], 3
mov ecx, 0x104c6540
push 0x17
push str.iTunesMobileDevice.dll
call fcn.103111b0
lea eax, [ebp - 0x87c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
push str.ProgramFiles_x86_
call fcn.103deb54
mov edx, eax
add esp, 4
test edx, edx
je 0x1036ae36
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1036ae15
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x858]
call fcn.103111b0
jmp 0x1036af7d
push str.ProgramFiles
call fcn.103deb54
mov edx, eax
add esp, 4
test edx, edx
je 0x1036ae71
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1036ae50
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x858]
call fcn.103111b0
jmp 0x1036af7d
push str.SystemDrive
call fcn.103deb54
mov edx, eax
add esp, 4
test edx, edx
je 0x1036aec3
mov ecx, edx
lea esi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1036ae90
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x858]
call fcn.103111b0
push 0xe
push str.Program_Files
lea ecx, [ebp - 0x858]
call fcn.1031f490
jmp 0x1036af62
push str.Program_Files
lea ecx, [ebp - 0x840]
call fcn.1036dc80
mov byte [ebp - 4], 5
mov ecx, eax
push 2
push 0x10477650
push 0
call fcn.1036e290
push eax
lea ecx, [ebp - 0x828]
call fcn.1030cd10
push eax
lea ecx, [ebp - 0x858]
mov dword [ebp - 0x878], 0x1000
call fcn.1036dc10
mov ebx, 0x1000
mov dword [ebp - 0x878], ebx
and ebx, 0xffffefff
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x828]
call fcn.10311130
mov byte [ebp - 4], 4
lea eax, [ebp - 0x828]
mov dword [ebp - 0x884], eax
mov byte [ebp - 4], 0xa
lea ecx, [ebp - 0x840]
call fcn.10311130
mov byte [ebp - 4], 3
lea eax, [ebp - 0x840]
mov dword [ebp - 0x884], eax
mov byte [ebp - 4], 3
cmp dword [ebp - 0x87c], 0
je 0x1036af7d
push 6
push str.__x86_
lea ecx, [ebp - 0x858]
call fcn.1031f490
push str.CommonProgramFiles_x86_
call fcn.103deb54
mov edx, eax
add esp, 4
test edx, edx
je 0x1036afa2
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1036af95
jmp 0x1036afcb
push str.CommonProgramFiles
call fcn.103deb54
mov edx, eax
add esp, 4
test edx, edx
je 0x1036afdd
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1036afc0
sub ecx, esi
sar ecx, 1
push ecx
push edx
mov ecx, 0x104c6528
call fcn.103111b0
jmp 0x1036b028
push str.Common_Files
lea edx, [ebp - 0x858]
lea ecx, [ebp - 0x828]
call fcn.1036dd10
add esp, 4
mov byte [ebp - 4], 0xe
mov ecx, 0x104c6528
push eax
call fcn.1036dc10
mov byte [ebp - 4], 0xf
lea ecx, [ebp - 0x828]
call fcn.10311130
mov byte [ebp - 4], 3
lea eax, [ebp - 0x828]
mov dword [ebp - 0x884], eax
mov byte [ebp - 4], 3
push 0
push 0x400
lea eax, [ebp - 0x810]
mov edx, str.SOFTWAREApple_Inc.Apple_Application_Support
push eax
push str.InstallDir
mov ecx, reloc.WS2_32.dll_bind
call fcn.10368d70
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add esp, 0x10
test al, al
je 0x1036b0b4
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.1036dc80
mov byte [ebp - 4], 0x13
mov edx, eax
push 0x10477230
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x878], 1
call fcn.1036dde0
add esp, 4
mov dword [ebp - 4], 0x14
mov ebx, 3
mov ecx, eax
mov dword [ebp - 0x878], ebx
call fcn.1030cc70
push eax
call esi
mov byte [ebp - 0x871], 1
cmp eax, 0xffffffff
jne 0x1036b0bb
mov byte [ebp - 0x871], 0
mov dword [ebp - 4], 0x13
test bl, 2
je 0x1036b0fc
and ebx, 0xfffffffd
mov dword [ebp - 0x878], ebx
mov dword [ebp - 4], 0x15
lea ecx, [ebp - 0x828]
call fcn.10311130
mov dword [ebp - 4], 0x13
lea eax, [ebp - 0x828]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x13
mov dword [ebp - 4], 3
test bl, 1
je 0x1036b134
and ebx, 0xfffffffe
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x19
lea ecx, [ebp - 0x840]
call fcn.10311130
mov byte [ebp - 4], 3
lea eax, [ebp - 0x840]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 3
cmp byte [ebp - 0x871], 0
je 0x1036b167
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1036b146
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
mov ecx, 0x104c6558
call fcn.103111b0
push 0x400
lea eax, [ebp - 0x810]
mov edx, str.SOFTWAREApple_Inc.Apple_Mobile_Device_SupportShared
push eax
push str.iTunesMobileDeviceDLL
mov ecx, reloc.WS2_32.dll_bind
call fcn.10368cf0
add esp, 0xc
test al, al
je 0x1036b200
lea eax, [ebp - 0x810]
push eax
call esi
cmp eax, 0xffffffff
je 0x1036b200
lea eax, [ebp - 0x810]
push 0x5c
push eax
call fcn.103cde54
mov edi, eax
add esp, 8
test edi, edi
je 0x1036b200
push edi
call fcn.103dece7
mov ecx, edi
add esp, 4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1036b1c1
sub ecx, edx
sar ecx, 1
push ecx
push edi
mov ecx, 0x104c6540
call fcn.103111b0
xor eax, eax
lea ecx, [ebp - 0x810]
mov word [edi], ax
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1036b1f0
jmp 0x1036b320
push 0
push 0x400
lea eax, [ebp - 0x810]
mov edx, str.SOFTWAREApple_Inc.Apple_Mobile_Device_Support
push eax
push str.InstallDir
mov ecx, reloc.WS2_32.dll_bind
call fcn.10368d70
add esp, 0x10
test al, al
je 0x1036b283
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x840]
call fcn.1036dc80
mov byte [ebp - 4], 0x1d
or ebx, 4
push 0x104c6540
mov edx, eax
mov dword [ebp - 0x878], ebx
lea ecx, [ebp - 0x828]
call fcn.1036df50
add esp, 4
mov dword [ebp - 4], 0x1e
or ebx, 8
mov ecx, eax
mov dword [ebp - 0x878], ebx
call fcn.1030cc70
push eax
call esi
mov byte [ebp - 0x871], 1
cmp eax, 0xffffffff
jne 0x1036b28a
mov byte [ebp - 0x871], 0
mov dword [ebp - 4], 0x1d
test bl, 8
je 0x1036b2cb
and ebx, 0xfffffff7
mov dword [ebp - 0x878], ebx
mov dword [ebp - 4], 0x1f
lea ecx, [ebp - 0x828]
call fcn.10311130
mov dword [ebp - 4], 0x1d
lea eax, [ebp - 0x828]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0x1d
mov dword [ebp - 4], 3
test bl, 4
je 0x1036b303
and ebx, 0xfffffffb
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x23
lea ecx, [ebp - 0x840]
call fcn.10311130
mov byte [ebp - 4], 3
lea eax, [ebp - 0x840]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 3
cmp byte [ebp - 0x871], 0
je 0x1036b33b
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1036b315
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
mov ecx, 0x104c6510
call fcn.103111b0
jmp 0x1036b47e
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x870]
call fcn.1036dc80
mov byte [ebp - 4], 0x28
mov ecx, eax
push 4
push str._bin
call fcn.1031f490
push eax
lea ecx, [ebp - 0x840]
call fcn.1030cd10
or ebx, 0x10000
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x29
mov ecx, eax
push 0x104c6540
call fcn.1031eed0
push eax
lea ecx, [ebp - 0x828]
call fcn.1030cd10
or ebx, 0x20000
mov ecx, eax
mov dword [ebp - 0x878], ebx
call fcn.1030cc70
push eax
call esi
mov esi, dword [ebp - 0x878]
cmp eax, 0xffffffff
setne bl
and esi, 0xfffdffff
mov dword [ebp - 0x878], esi
mov byte [ebp - 4], 0x2a
lea ecx, [ebp - 0x828]
call fcn.10311130
mov byte [ebp - 4], 0x28
lea eax, [ebp - 0x828]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x28
and esi, 0xfffeffff
mov dword [ebp - 0x878], esi
mov byte [ebp - 4], 0x2e
lea ecx, [ebp - 0x840]
call fcn.10311130
mov byte [ebp - 4], 0x27
lea eax, [ebp - 0x840]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x32
lea ecx, [ebp - 0x870]
call fcn.10311130
mov byte [ebp - 4], 3
lea eax, [ebp - 0x870]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 3
test bl, bl
je 0x1036b472
lea ecx, [ebp - 0x810]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1036b440
sub ecx, edx
lea eax, [ebp - 0x810]
sar ecx, 1
push ecx
push eax
mov ecx, 0x104c6510
call fcn.103111b0
push 4
push str._bin
mov ecx, 0x104c6510
call fcn.1031f490
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [ebp - 0x878]
xor edi, edi
mov edx, dword [edi + 0x104784d0]
lea eax, [ebp - 0x810]
push 0x400
push eax
push 0
mov ecx, reloc.WS2_32.dll_bind
call fcn.10368cf0
add esp, 0xc
test al, al
je 0x1036b5d8
lea eax, [ebp - 0x810]
push eax
call fcn.103dece7
lea eax, [ebp - 0x810]
push str..exe
push eax
call fcn.103cdbd1
add esp, 0xc
test eax, eax
je 0x1036b5d8
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x810]
push 0x5c
push eax
call fcn.103cde54
add esp, 8
test eax, eax
je 0x1036b5d8
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x828]
call fcn.1036dc80
mov byte [ebp - 4], 0x36
lea edx, [ebp - 0x828]
push str.iTunescore.dll
lea ecx, [ebp - 0x870]
call fcn.1036dd10
add esp, 4
mov byte [ebp - 4], 0x37
mov ecx, eax
call fcn.1030cc70
push eax
call esi
mov esi, eax
mov byte [ebp - 4], 0x38
lea ecx, [ebp - 0x870]
call fcn.10311130
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x870]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x36
cmp esi, 0xffffffff
jne 0x1036b61d
push str.iTunes.dll
lea edx, [ebp - 0x828]
lea ecx, [ebp - 0x840]
call fcn.1036dd10
add esp, 4
mov byte [ebp - 4], 0x40
mov ecx, eax
call fcn.1030cc70
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov byte [ebp - 4], 0x41
lea ecx, [ebp - 0x840]
call fcn.10311130
mov byte [ebp - 4], 0x36
lea eax, [ebp - 0x840]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x36
cmp esi, 0xffffffff
jne 0x1036b5eb
mov byte [ebp - 4], 0x49
lea ecx, [ebp - 0x828]
call fcn.10311130
mov byte [ebp - 4], 3
lea eax, [ebp - 0x828]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 3
add edi, 4
cmp edi, 0x10
jae 0x1036b651
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1036b480
lea eax, [ebp - 0x828]
mov ecx, 0x104c64f8
push eax
call fcn.1030cca0
mov byte [ebp - 4], 0x45
lea ecx, [ebp - 0x828]
call fcn.10311130
mov byte [ebp - 4], 3
lea eax, [ebp - 0x828]
mov dword [ebp - 0x87c], eax
jmp 0x1036b64d
lea eax, [ebp - 0x828]
mov ecx, 0x104c64f8
push eax
call fcn.1030cca0
mov byte [ebp - 4], 0x3c
lea ecx, [ebp - 0x828]
call fcn.10311130
mov byte [ebp - 4], 3
lea eax, [ebp - 0x828]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 3
mov dword [ebp - 4], 0x4d
lea ecx, [ebp - 0x858]
call fcn.10311130
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x858]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x858]
mov ecx, eax
mov dword [ebp - 0x87c], eax
call fcn.1031ee60
mov dword [ebp - 4], 0x53
lea ecx, [ebp - 0x858]
call fcn.10311190
mov dword [ebp - 4], 0x54
push str.Path
call fcn.103deb54
mov edx, eax
add esp, 4
lea esi, [edx + 2]
nop dword [eax + eax]
mov cx, word [edx]
add edx, 2
test cx, cx
jne 0x1036b6c0
sub edx, esi
lea ecx, [ebp - 0x858]
sar edx, 1
push edx
push eax
call fcn.103111b0
mov eax, dword [ebp - 0x848]
lea ecx, [ebp - 0x858]
dec eax
push eax
call fcn.1030cc80
cmp word [eax], 0x3b
jne 0x1036b767
mov eax, dword [ebp - 0x848]
mov byte [ebp - 4], 0x55
lea ecx, [ebp - 0x871]
push ecx
dec eax
lea ecx, [ebp - 0x870]
push eax
push 0
lea eax, [ebp - 0x858]
push eax
call fcn.1036dcd0
or ebx, 0x100000
lea ecx, [ebp - 0x858]
push eax
mov dword [ebp - 0x878], ebx
call fcn.1036dc10
and ebx, 0xffefffff
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x56
lea ecx, [ebp - 0x870]
call fcn.10311130
mov byte [ebp - 4], 0x54
lea eax, [ebp - 0x870]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x54
push 0x3b
mov edx, 0x104c6510
lea ecx, [ebp - 0x840]
call fcn.1036dff0
add esp, 4
mov byte [ebp - 4], 0x5b
lea ecx, [ebp - 0x858]
push ecx
mov ecx, eax
call fcn.1031eed0
push eax
lea ecx, [ebp - 0x828]
call fcn.1030cd10
or ebx, 0x400000
mov esi, eax
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x5c
mov ecx, esi
push 0x3b
call fcn.1031f440
push esi
lea ecx, [ebp - 0x870]
call fcn.1030cd10
or ebx, 0x800000
lea ecx, [ebp - 0x858]
push eax
mov dword [ebp - 0x878], ebx
call fcn.1036dc10
and ebx, 0xff7fffff
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x5d
lea ecx, [ebp - 0x870]
call fcn.10311130
mov byte [ebp - 4], 0x5b
lea eax, [ebp - 0x870]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x5b
and ebx, 0xffbfffff
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x61
lea ecx, [ebp - 0x828]
call fcn.10311130
mov byte [ebp - 4], 0x5a
lea eax, [ebp - 0x828]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x65
lea ecx, [ebp - 0x840]
call fcn.10311130
mov byte [ebp - 4], 0x54
lea eax, [ebp - 0x840]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x54
mov edx, 0x104c6558
push 0x3b
lea ecx, [ebp - 0x840]
call fcn.1036dff0
add esp, 4
mov byte [ebp - 4], 0x6a
lea ecx, [ebp - 0x858]
push ecx
mov ecx, eax
call fcn.1031eed0
push eax
lea ecx, [ebp - 0x828]
call fcn.1030cd10
or ebx, 0x2000000
mov esi, eax
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x6b
mov ecx, esi
push 0x3b
call fcn.1031f440
push esi
lea ecx, [ebp - 0x870]
call fcn.1030cd10
or ebx, 0x4000000
lea ecx, [ebp - 0x858]
push eax
mov dword [ebp - 0x878], ebx
call fcn.1036dc10
and ebx, 0xfbffffff
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x6c
lea ecx, [ebp - 0x870]
call fcn.10311130
mov byte [ebp - 4], 0x6a
lea eax, [ebp - 0x870]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x6a
and ebx, 0xfdffffff
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x70
lea ecx, [ebp - 0x828]
call fcn.10311130
mov byte [ebp - 4], 0x69
lea eax, [ebp - 0x828]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x74
lea ecx, [ebp - 0x840]
call fcn.10311130
mov byte [ebp - 4], 0x54
lea eax, [ebp - 0x840]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x54
mov edx, 0x104c64f8
push 0x3b
lea ecx, [ebp - 0x840]
call fcn.1036dff0
add esp, 4
mov byte [ebp - 4], 0x79
lea ecx, [ebp - 0x858]
push ecx
mov ecx, eax
call fcn.1031eed0
push eax
lea ecx, [ebp - 0x828]
call fcn.1030cd10
or ebx, 0x10000000
mov esi, eax
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x7a
mov ecx, esi
push 0x3b
call fcn.1031f440
push esi
lea ecx, [ebp - 0x870]
call fcn.1030cd10
or ebx, 0x20000000
mov dword [ebp - 0x878], ebx
push eax
lea ecx, [ebp - 0x858]
call fcn.1036dc10
and ebx, 0xdfffffff
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x7b
lea ecx, [ebp - 0x870]
call fcn.10311130
mov byte [ebp - 4], 0x79
lea eax, [ebp - 0x870]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x79
and ebx, 0xefffffff
mov dword [ebp - 0x878], ebx
mov byte [ebp - 4], 0x7f
lea ecx, [ebp - 0x828]
call fcn.10311130
mov byte [ebp - 4], 0x78
lea eax, [ebp - 0x828]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x83
lea ecx, [ebp - 0x840]
call fcn.10311130
mov byte [ebp - 4], 0x54
lea eax, [ebp - 0x840]
mov dword [ebp - 0x87c], eax
mov byte [ebp - 4], 0x54
lea ecx, [ebp - 0x858]
call fcn.1030cc70
push eax
push str.Path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 4], 0xa5
lea ecx, [ebp - 0x858]
call fcn.10311130
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x858]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0xffffffff
cmp dword [0x104c6568], 0
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
je 0x1036bb24
xor esi, esi
nop dword [eax]
push 0x5c
mov edx, 0x104c6558
lea ecx, [ebp - 0x858]
call fcn.1036dff0
mov dword [ebp - 4], 0xa9
mov edx, eax
push dword [esi + 0x1047849c]
lea ecx, [ebp - 0x870]
call fcn.1036dde0
add esp, 8
mov byte [ebp - 4], 0xaa
mov ecx, eax
call fcn.1030cc70
push eax
call edi
mov byte [ebp - 4], 0xab
lea ecx, [ebp - 0x870]
call fcn.10311130
mov byte [ebp - 4], 0xa9
lea eax, [ebp - 0x870]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0xaf
lea ecx, [ebp - 0x858]
call fcn.10311130
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x858]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0xffffffff
add esi, 4
cmp esi, 0x34
jb 0x1036ba90
cmp dword [0x104c6520], 0
je 0x1036bb68
push 0x104c6540
mov edx, 0x104c6510
lea ecx, [ebp - 0x870]
call fcn.1036de90
add esp, 4
mov dword [ebp - 4], 0xb3
or ebx, 0x10
mov ecx, eax
mov dword [ebp - 0x878], ebx
call fcn.1030cc70
push eax
call edi
mov dword [0x104ccdf4], eax
test eax, eax
jne 0x1036bb81
mov ecx, 0x104c6540
call fcn.1030cc70
add eax, 2
push eax
call edi
mov dword [0x104ccdf4], eax
test eax, eax
je 0x1036bb9a
push 0x10477232
call edi
mov dword [0x104ccde8], eax
test eax, eax
je 0x1036bb9f
mov byte [ebp - 0x871], 1
jmp 0x1036bba6
mov eax, dword [0x104ccde8]
mov byte [ebp - 0x871], 0
mov dword [ebp - 4], 0xffffffff
test bl, 0x10
je 0x1036bbec
and ebx, 0xffffffef
mov dword [ebp - 0x878], ebx
mov dword [ebp - 4], 0xb4
lea ecx, [ebp - 0x870]
call fcn.10311130
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x870]
mov dword [ebp - 0x87c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, dword [0x104ccde8]
cmp byte [ebp - 0x871], 0
je 0x1036d1c2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor esi, esi
push str.CFWriteStreamCreateWithFile
push eax
call edi
push str.CFReadStreamCreateWithFile
push dword [0x104ccde8]
test eax, eax
mov dword [0x104ccc24], eax
mov ecx, 1
cmove esi, ecx
call edi
mov dword [0x104ccd00], eax
test eax, eax
jne 0x1036bc2f
inc esi
push str.CFStringCreateWithCString
push dword [0x104ccde8]
call edi
mov dword [0x104ccd84], eax
test eax, eax
jne 0x1036bc46
inc esi
push str.CFURLCreateWithFileSystemPath
push dword [0x104ccde8]
call edi
mov dword [0x104ccdbc], eax
test eax, eax
jne 0x1036bc5d
inc esi
push str.CFURLCreateWithString
push dword [0x104ccde8]
call edi
mov dword [0x104ccc58], eax
test eax, eax
jne 0x1036bc74
inc esi
push str.CFReadStreamOpen
push dword [0x104ccde8]
call edi
mov dword [0x104ccc60], eax
test eax, eax
jne 0x1036bc8b
inc esi
push str.CFWriteStreamOpen
push dword [0x104ccde8]
call edi
mov dword [0x104ccd9c], eax
test eax, eax
jne 0x1036bca2
inc esi
push str.CFPropertyListCreateFromStream
push dword [0x104ccde8]
call edi
mov dword [0x104ccbf8], eax
test eax, eax
jne 0x1036bcb9
inc esi
push str.CFReadStreamClose
push dword [0x104ccde8]
call edi
mov dword [0x104ccd58], eax
test eax, eax
jne 0x1036bcd0
inc esi
push str.CFPropertyListIsValid
push dword [0x104ccde8]
call edi
mov dword [0x104ccc14], eax
test eax, eax
jne 0x1036bce7
inc esi
push str.CFPropertyListCreateData
push dword [0x104ccde8]
call edi
mov dword [0x104ccc3c], eax
test eax, eax
jne 0x1036bcfe
inc esi
push str.CFPropertyListWriteToStream
push dword [0x104ccde8]
call edi
mov dword [0x104ccca4], eax
test eax, eax
jne 0x1036bd15
inc esi
push str.CFWriteStreamClose
push dword [0x104ccde8]
call edi
mov dword [0x104ccde4], eax
test eax, eax
jne 0x1036bd2c
inc esi
push str.CFRelease
push dword [0x104ccde8]
call edi
mov dword [0x104ccd34], eax
test eax, eax
jne 0x1036bd43
inc esi
push str.CFCopyTypeIDDescription
push dword [0x104ccde8]
call edi
mov dword [0x104ccc10], eax
test eax, eax
jne 0x1036bd5a
inc esi
push str.CFGetTypeID
push dword [0x104ccde8]
call edi
mov dword [0x104ccdcc], eax
test eax, eax
jne 0x1036bd71
inc esi
push str.CFRetain
push dword [0x104ccde8]
call edi
mov dword [0x104ccc20], eax
test eax, eax
jne 0x1036bd88
inc esi
push str.CFNumberGetValue
push dword [0x104ccde8]
call edi
mov dword [0x104ccd48], eax
test eax, eax
jne 0x1036bd9f
inc esi
push str.CFNumberCreate
push dword [0x104ccde8]
call edi
mov dword [0x104cccdc], eax
test eax, eax
jne 0x1036bdb6
inc esi
push str.CFPropertyListCreateFromXMLData
push dword [0x104ccde8]
call edi
mov dword [0x104ccc48], eax
test eax, eax
jne 0x1036bdcd
inc esi
push str.CFPropertyListCreateWithData
push dword [0x104ccde8]
call edi
mov dword [0x104ccce4], eax
test eax, eax
jne 0x1036bde4
inc esi
push str.CFPropertyListCreateXMLData
push dword [0x104ccde8]
call edi
mov dword [0x104ccd90], eax
test eax, eax
jne 0x1036bdfb
inc esi
push str.CFDataCreateWithBytesNoCopy
push dword [0x104ccde8]
call edi
mov dword [0x104ccda8], eax
test eax, eax
jne 0x1036be12
inc esi
push str.CFDataCreate
push dword [0x104ccde8]
call edi
mov dword [0x104cccf8], eax
test eax, eax
jne 0x1036be29
inc esi
push str.CFDateGetTypeID
push dword [0x104ccde8]
call edi
mov dword [0x104cccd0], eax
test eax, eax
jne 0x1036be40
inc esi
push str.CFDateGetAbsoluteTime
push dword [0x104ccde8]
call edi
mov dword [0x104ccd18], eax
test eax, eax
jne 0x1036be57
inc esi
push str.CFDataGetBytePtr
push dword [0x104ccde8]
call edi
mov dword [0x104ccc2c], eax
test eax, eax
jne 0x1036be6e
inc esi
push str.CFDataGetLength
push dword [0x104ccde8]
call edi
mov dword [0x104ccd30], eax
test eax, eax
jne 0x1036be85
inc esi
push str.CFDataGetMutableBytePtr
push dword [0x104ccde8]
call edi
mov dword [0x104cccbc], eax
test eax, eax
jne 0x1036be9c
inc esi
push str.CFDataCreateMutable
push dword [0x104ccde8]
call edi
mov dword [0x104ccc68], eax
test eax, eax
jne 0x1036beb3
inc esi
push str.CFDataSetLength
push dword [0x104ccde8]
call edi
mov dword [0x104ccbf4], eax
test eax, eax
jne 0x1036beca
inc esi
push str.CFArrayGetCount
push dword [0x104ccde8]
call edi
mov dword [0x104ccda0], eax
test eax, eax
jne 0x1036bee1
inc esi
push str.CFArrayCreate
push dword [0x104ccde8]
call edi
mov dword [0x104ccbe4], eax
test eax, eax
jne 0x1036bef8
inc esi
push str.CFArrayGetValueAtIndex
push dword [0x104ccde8]
call edi
mov dword [0x104ccbe0], eax
test eax, eax
jne 0x1036bf0f
inc esi
push str.CFDictionaryGetCount
push dword [0x104ccde8]
call edi
mov dword [0x104ccd78], eax
test eax, eax
jne 0x1036bf26
inc esi
push str.CFDictionaryGetValue
push dword [0x104ccde8]
call edi
mov dword [0x104ccce0], eax
test eax, eax
jne 0x1036bf3d
inc esi
push str.CFDictionaryCreateMutableCopy
push dword [0x104ccde8]
call edi
mov dword [0x104ccc90], eax
test eax, eax
jne 0x1036bf54
inc esi
push str.CFDictionarySetValue
push dword [0x104ccde8]
call edi
mov dword [0x104cccd8], eax
test eax, eax
jne 0x1036bf6b
inc esi
push str.CFDictionaryRemoveValue
push dword [0x104ccde8]
call edi
mov dword [0x104cccb4], eax
test eax, eax
jne 0x1036bf82
inc esi
push str.CFDictionaryGetKeysAndValues
push dword [0x104ccde8]
call edi
mov dword [0x104ccd70], eax
test eax, eax
jne 0x1036bf99
inc esi
push str.CFDictionaryCreate
push dword [0x104ccde8]
call edi
mov dword [0x104ccca0], eax
test eax, eax
jne 0x1036bfb0
inc esi
push str.CFStringGetCString
push dword [0x104ccde8]
call edi
mov dword [0x104cccf0], eax
test eax, eax
jne 0x1036bfc7
inc esi
push str.CFStringGetLength
push dword [0x104ccde8]
call edi
mov dword [0x104ccd08], eax
test eax, eax
jne 0x1036bfde
inc esi
push str.CFStringCompare
push dword [0x104ccde8]
call edi
mov dword [0x104ccc30], eax
test eax, eax
jne 0x1036bff5
inc esi
push str.CFBooleanGetValue
push dword [0x104ccde8]
call edi
mov dword [0x104cccc0], eax
test eax, eax
jne 0x1036c00c
inc esi
push str.kCFBooleanFalse
push dword [0x104ccde8]
call edi
mov dword [0x104ccc64], eax
test eax, eax
jne 0x1036c023
inc esi
push str.kCFBooleanTrue
push dword [0x104ccde8]
call edi
mov dword [0x104ccd54], eax
test eax, eax
jne 0x1036c03a
inc esi
push str.AMDeviceNotificationSubscribe
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd28], eax
test eax, eax
jne 0x1036c051
inc esi
push str.AMDeviceNotificationUnsubscribe
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc00], eax
test eax, eax
jne 0x1036c068
inc esi
push str.AMRestoreRegisterForDeviceNotifications
push dword [0x104ccdf4]
call edi
mov dword [0x104ccdc8], eax
test eax, eax
jne 0x1036c07f
inc esi
push str.AMDeviceConnect
push dword [0x104ccdf4]
call edi
mov dword [0x104ccbdc], eax
test eax, eax
jne 0x1036c096
inc esi
push str.AMDeviceIsPaired
push dword [0x104ccdf4]
call edi
mov dword [0x104cccf4], eax
test eax, eax
jne 0x1036c0ad
inc esi
push str.AMDeviceValidatePairing
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc0c], eax
test eax, eax
jne 0x1036c0c4
inc esi
push str.AMDeviceStartSession
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc04], eax
test eax, eax
jne 0x1036c0db
inc esi
push str.AMDeviceStopSession
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc28], eax
test eax, eax
jne 0x1036c0f2
inc esi
push str.AMDeviceStartService
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc44], eax
test eax, eax
jne 0x1036c109
inc esi
push str.AMDeviceSecureStartService
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd7c], eax
test eax, eax
jne 0x1036c120
inc esi
push str.AMDServiceConnectionGetSocket
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd2c], eax
test eax, eax
jne 0x1036c137
inc esi
push str.AMDServiceConnectionGetSecureIOContext
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc08], eax
test eax, eax
jne 0x1036c14e
inc esi
push str.AMDServiceConnectionSend
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd38], eax
test eax, eax
jne 0x1036c165
inc esi
push str.AMDServiceConnectionReceive
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd3c], eax
test eax, eax
jne 0x1036c17c
inc esi
push str.AFCConnectionSetSecureContext
push dword [0x104ccdf4]
call edi
mov dword [0x104ccccc], eax
test eax, eax
jne 0x1036c193
inc esi
push str.AMDeviceGetConnectionID
push dword [0x104ccdf4]
call edi
mov dword [0x104ccdb0], eax
test eax, eax
jne 0x1036c1aa
inc esi
push str.AMDeviceGetInterfaceType
push dword [0x104ccdf4]
call edi
mov dword [0x104ccdb4], eax
test eax, eax
jne 0x1036c1c1
inc esi
push str.USBMuxConnectByPort
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc4c], eax
test eax, eax
jne 0x1036c1d8
inc esi
push str.AMDeviceDisconnect
push dword [0x104ccdf4]
call edi
mov dword [0x104cccc8], eax
test eax, eax
jne 0x1036c1ef
inc esi
push str.AMDeviceRetain
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc84], eax
test eax, eax
jne 0x1036c206
inc esi
push str.AMDeviceRelease
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd5c], eax
test eax, eax
jne 0x1036c21d
inc esi
push str.AMDeviceCopyValue
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc74], eax
test eax, eax
jne 0x1036c234
inc esi
push str.AMDeviceCopyDeviceIdentifier
push dword [0x104ccdf4]
call edi
mov dword [0x104ccdac], eax
test eax, eax
jne 0x1036c24b
inc esi
push str.AMDPostNotification
push dword [0x104ccdf4]
call edi
mov dword [0x104ccdc0], eax
test eax, eax
jne 0x1036c262
inc esi
push str.AMDShutdownNotificationProxy
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd1c], eax
test eax, eax
jne 0x1036c279
inc esi
push str.AFCConnectionOpen
push dword [0x104ccdf4]
call edi
mov dword [0x104cccc4], eax
test eax, eax
jne 0x1036c290
inc esi
push str.AFCDeviceInfoOpen
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc18], eax
test eax, eax
jne 0x1036c2a7
inc esi
push str.AFCDirectoryOpen
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd14], eax
test eax, eax
jne 0x1036c2be
inc esi
push str.AFCDirectoryRead
push dword [0x104ccdf4]
call edi
mov dword [0x104cccec], eax
test eax, eax
jne 0x1036c2d5
inc esi
push str.AFCDirectoryClose
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd40], eax
test eax, eax
jne 0x1036c2ec
inc esi
push str.AFCDirectoryCreate
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc80], eax
test eax, eax
jne 0x1036c303
inc esi
push str.AFCRemovePath
push dword [0x104ccdf4]
call edi
mov dword [0x104ccda4], eax
test eax, eax
jne 0x1036c31a
inc esi
push str.AFCLinkPath
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd88], eax
test eax, eax
jne 0x1036c331
inc esi
push str.AFCRenamePath
push dword [0x104ccdf4]
call edi
mov dword [0x104cccd4], eax
test eax, eax
jne 0x1036c348
inc esi
push str.AFCConnectionClose
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd50], eax
test eax, eax
jne 0x1036c35f
inc esi
push str.AFCFileRefOpen
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc70], eax
test eax, eax
jne 0x1036c376
inc esi
push str.AFCFileRefRead
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd4c], eax
test eax, eax
jne 0x1036c38d
inc esi
push str.AFCFileRefWrite
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc88], eax
test eax, eax
jne 0x1036c3a4
inc esi
push str.AFCFileRefClose
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc7c], eax
test eax, eax
jne 0x1036c3bb
inc esi
push str.AFCFileRefSeek
push dword [0x104ccdf4]
call edi
mov dword [0x104ccce8], eax
test eax, eax
jne 0x1036c3d2
inc esi
push str.AFCFlushData
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc34], eax
test eax, eax
jne 0x1036c3e9
inc esi
push str.AFCFileRefTell
push dword [0x104ccdf4]
call edi
mov dword [0x104ccbd8], eax
test eax, eax
jne 0x1036c400
inc esi
push str.AFCFileRefSetFileSize
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd60], eax
test eax, eax
jne 0x1036c417
inc esi
push str.AFCFileInfoOpen
push dword [0x104ccdf4]
call edi
mov dword [0x104ccdb8], eax
test eax, eax
jne 0x1036c42e
inc esi
push str.AFCGetFileInfo
push dword [0x104ccdf4]
call edi
mov dword [0x104cccac], eax
test eax, eax
jne 0x1036c445
inc esi
push str.AFCKeyValueRead
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc40], eax
test eax, eax
jne 0x1036c45c
inc esi
push str.AFCKeyValueClose
push dword [0x104ccdf4]
call edi
mov dword [0x104ccbe8], eax
test eax, eax
jne 0x1036c473
inc esi
push str.AFCFileRefLock
push dword [0x104ccdf4]
call edi
mov dword [0x104ccdd8], eax
test eax, eax
jne 0x1036c48a
inc esi
push str.AFCFileRefUnlock
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc54], eax
test eax, eax
jne 0x1036c4a1
inc esi
push str.AMDeviceLookupApplications
push dword [0x104ccdf4]
call edi
mov dword [0x104ccbf0], eax
test eax, eax
jne 0x1036c4b8
inc esi
push str.AMDeviceUninstallApplication
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc5c], eax
test eax, eax
jne 0x1036c4cf
inc esi
push str.AMDeviceArchiveApplication
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd0c], eax
test eax, eax
jne 0x1036c4e6
inc esi
push str.AMDeviceInstallApplication
push dword [0x104ccdf4]
call edi
mov dword [0x104ccd44], eax
test eax, eax
jne 0x1036c4fd
inc esi
push str.AMDeviceRestoreApplication
push dword [0x104ccdf4]
call edi
mov dword [0x104cccb0], eax
test eax, eax
jne 0x1036c514
inc esi
push str.AMDeviceRemoveApplicationArchive
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc1c], eax
test eax, eax
jne 0x1036c52b
inc esi
push str.AMDeviceSecureUninstallApplication
push dword [0x104ccdf4]
call edi
mov dword [0x104ccca8], eax
test eax, eax
jne 0x1036c542
inc esi
push str.AMDeviceSecureArchiveApplication
push dword [0x104ccdf4]
call edi
mov dword [0x104ccc38], eax
test eax, eax
jne 0x1036c559
inc esi
push str.AMDeviceSecureInstallApplication
push dword [0x104ccdf4]
call edi
mov dword [0x104ccbfc], eax
test eax, eax
jne 0x1036c570
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.103b6385
mov esp, ebp
pop ebp
ret