Function at 0x10004820
Capabilities:
Accept command line arguments
Create process on windows
Create thread
Get common file path
Get graphical window text
Get keyboard layout
Open clipboard
Query or enumerate registry key
Query or enumerate registry value
Read clipboard data
Resolve function by parsing pe exports
Resume thread
Set environment variable
Set registry value
Write clipboard data

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x10002950
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x100029b2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x100029c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10002a22
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push 0x10003040
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x10003162
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
sub esp, 8
movzx ecx, byte [0x10016fea]
mov edx, dword [0x10016574]
shl ecx, 0x10
movzx eax, dx
or ecx, eax
mov dword [esp], ecx
test edx, edx
js 0x100047a6
cmp edx, 0xa
jae 0x100047a6
movzx ecx, word [edx*4 + 0x100176a0]
movzx eax, word [edx*4 + 0x100176a2]
jmp 0x100047b4
movzx ecx, word [0x10017488]
movzx eax, word [0x1001748a]
shl ecx, 0x10
or ecx, eax
cmp dword [0x1001672c], 0
mov dword [esp + 4], ecx
je 0x10004818
push esi
push 8
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x10004817
push 8
lea eax, [esp + 8]
mov byte [esi], 0
push eax
push esi
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x10016714
mov byte [0x100165fc], 0x11
mov dword [0x10016601], 8
mov dword [0x100165fd], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
add esp, 8
ret
sub esp, 0x7c4
push ebx
push ebp
push esi
push edi
mov edi, edx
cmp ecx, 0x786
ja 0x10005278
je 0x10005154
add ecx, 0xfffffa51
cmp ecx, 0x85
ja case.0x10004857.1461
movzx eax, byte [ecx + 0x100054c8]
jmp dword [eax*4 + 0x10005444]
call fcn.10001e90
test eax, eax
je case.0x10004857.1461
mov ecx, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp fcn.10001a90
push dword [0x10016b20]
lea eax, [esp + 0xbc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], 0
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x44
push eax
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x50], 0x1001638c
push 0
push 0
lea eax, [esp + 0xd8]
movlpd qword [esp + 0x5c], xmm0
push eax
push 0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
movlpd qword [esp + 0x8c], xmm0
movlpd qword [esp + 0x94], xmm0
movups xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je case.0x10004857.1461
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x10004923
push eax
call dword [0x10016590]
mov eax, dword [esp + 0x20]
test eax, eax
je case.0x10004857.1461
push eax
call dword [0x10016590]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
push 0x10017078
lea eax, [esp + 0x3c4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [esp + 0x1c]
mov dword [esp + 0x34], 0
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x34], 0x44
push eax
push 0
push 0
push 0
push 0
xorps xmm0, xmm0
mov dword [esp + 0x50], 0x100163c0
push 0
push 0
lea eax, [esp + 0x3e0]
movlpd qword [esp + 0x5c], xmm0
push eax
push 0
movlpd qword [esp + 0x6c], xmm0
movlpd qword [esp + 0x74], xmm0
movlpd qword [esp + 0x7c], xmm0
movlpd qword [esp + 0x84], xmm0
movlpd qword [esp + 0x8c], xmm0
movlpd qword [esp + 0x94], xmm0
movups xmmword [esp + 0x44], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je case.0x10004857.1461
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x100049e4
push eax
call dword [0x10016590]
mov eax, dword [esp + 0x20]
test eax, eax
je case.0x10004857.1461
push eax
call dword [0x10016590]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
push 1
push 0xf130
push 0x112
push dword [0x10016398]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
xor ecx, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10002990
mov ecx, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10002990
mov ecx, 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10002990
mov ecx, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10002990
push 0
push dword [0x10016374]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
xor ecx, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10003140
mov ecx, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10003140
mov ecx, 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10003140
mov ecx, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10003140
push 0
push dword [0x1001637c]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x100033b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je case.0x10004857.1461
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
push 0
push dword [0x10016378]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
xor ecx, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10002a00
mov ecx, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10002a00
mov ecx, 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10002a00
mov ecx, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10002a00
push 0
push dword [0x10016380]
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
push 0
mov dword [esp + 0x30], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x10004857.1461
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 1
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10004bfe
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x10004bfe
push 1
lea ecx, [esp + 0x30]
push ecx
push eax
call section..text
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
mov ecx, edi
call fcn.100011d0
mov ebp, eax
push edi
test ebp, ebp
je 0x10004e5e
push ebp
push dword [esp + 0x7e4]
call fcn.100017e0
add esp, 0xc
test eax, eax
je 0x10004e23
test edi, edi
je 0x10004da0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x10004cf6
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10004ce1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x10004ccc
push edi
push ebp
push eax
call section..text
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
xor ecx, ecx
test eax, eax
setne cl
mov dword [esp + 0x18], ecx
test eax, eax
jne 0x10004cb9
lea ebx, [eax + 5]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x10004d03
mov esi, dword [esp + 0x7c]
mov ebx, dword [esp + 0x80]
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x10004d03
mov ebx, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x10004d03
mov ebx, 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x10004d03
mov ebx, 2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp dword [esp + 0x18], 0
je 0x10004da7
mov eax, edi
shr eax, 1
dec eax
push eax
push dword [0x10016ba8]
lea eax, [esp + 0x100]
push eax
call fcn.10001200
add esp, 0xc
lea eax, [esp + 0xf8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [0x1001672c], 0
mov esi, eax
je 0x10004e2b
test esi, esi
je 0x10004e2b
mov ecx, esi
call fcn.100011d0
mov ebx, eax
test ebx, ebx
je 0x10004e2b
push esi
lea eax, [esp + 0xfc]
push eax
push ebx
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x10016714
mov byte [0x100165fc], 5
mov dword [0x10016601], esi
mov dword [0x100165fd], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x10004e2b
mov ebx, 1
xor esi, esi
push esi
push ebx
lea eax, [esp + 0x168]
push str.Set__clipboard_text_failed.__r_n_Error___d____08lx
push eax
call fcn.10001200
add esp, 0x10
lea eax, [esp + 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [0x1001672c], 0
mov esi, eax
je 0x10004e23
test esi, esi
je 0x10004e23
mov ecx, esi
call fcn.100011d0
mov ebx, eax
test ebx, ebx
je 0x10004e23
push esi
lea eax, [esp + 0x164]
push eax
push ebx
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0x10016714
mov byte [0x100165fc], 5
mov dword [0x10016601], esi
mov dword [0x100165fd], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
je case.0x10004857.1461
cmp edi, 0x1000
jbe 0x10004e4c
push 0x8000
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_VirtualFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
push dword [esp + 0x7e0]
call fcn.10001870
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
mov eax, dword [0x100165ac]
xor edi, edi
push edi
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je case.0x10004857.1461
push 0xd
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10004ee9
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x10004ee9
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebp, eax
test ebp, ebp
je 0x10004ee9
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov esi, eax
add esi, esi
je 0x10004ee0
add esi, 2
push esi
push edi
call dword [esp + 0x1c]
mov edi, eax
test edi, edi
je 0x10004ee0
push esi
push ebp
push edi
call section..text
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
jmp 0x10004eed
mov esi, dword [esp + 0x14]
call dword [sym.imp.USER32.dll_CloseClipboard]
test edi, edi
je case.0x10004857.1461
push esi
push edi
push 2
push 0x100165fc
call fcn.10007a00
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
dec dword [0x10016574]
call fcn.10004710
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10004770
inc dword [0x10016574]
call fcn.10004710
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp 0x10004770
push edi
push 0
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je case.0x10004857.1461
push edi
push esi
push dword [esp + 0x7e4]
call fcn.100017e0
add esp, 0xc
test eax, eax
je case.0x10004857.1461
lea eax, [esp + 0x14]
push eax
push 0
push esi
push 0x100093a0
jmp 0x10004aff
mov ecx, 0x100165fc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp fcn.10007b00
call fcn.100019a0
call fcn.10001d40
push dword [0x10016388]
call dword [sym.imp.USER32.dll_CloseDesktop]
push 0
push dword [esp + 0x7e0]
call fcn.100016c0
add esp, 8
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
mov dword [0x100163e8], 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
call fcn.100019a0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
jmp fcn.10001e90
call fcn.10001d40
push 0
push dword [esp + 0x7e0]
call fcn.100016c0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
push dword [0x10016a68]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor esi, esi
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, 0x20
jbe case.default.0x10005058
push dword [0x10016a74]
push eax
call ebp
mov edx, eax
test edx, edx
je case.default.0x10005058
lea ecx, [edi + 4]
cmp ecx, 3
ja case.default.0x10005058
jmp dword [ecx*4 + 0x10005550]
xor eax, eax
jmp 0x1000506f
mov eax, 1
jmp 0x1000506f
mov eax, 2
push eax
call edx
mov dword [esp + 0x14], eax
push dword [0x10016a78]
call ebx
mov ebx, eax
cmp ebx, 0x20
jbe 0x100050b7
push dword [0x10016a94]
push ebx
call ebp
test eax, eax
je 0x10005099
push edi
call eax
mov dword [esp + 0x18], eax
cmp edi, 0xfffffffe
jne 0x100050b7
push dword [0x10016a90]
push ebx
call ebp
test eax, eax
je 0x100050b7
call eax
test eax, eax
mov ecx, 1
cmovne esi, ecx
cmp dword [esp + 0x7d8], 0
jne case.0x10004857.1461
push esi
push dword [esp + 0x1c]
lea eax, [esp + 0x8c]
push dword [esp + 0x1c]
push str.OK__08lx__08lx__d
push eax
call fcn.10001200
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x100050f9
lea eax, [esp + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
cmp dword [0x1001672c], 0
je case.0x10004857.1461
test esi, esi
je case.0x10004857.1461
mov ecx, esi
call fcn.100011d0
mov edi, eax
test edi, edi
je case.0x10004857.1461
push esi
lea eax, [esp + 0x88]
push eax
push edi
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [0x100165fc], 5
mov dword [0x10016601], esi
mov dword [0x100165fd], edi
jmp 0x1000542d
push dword [0x10017754]
push dword [0x10017750]
call dword [sym.imp.USER32.dll_WindowFromPoint]
push 0x1000
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je case.0x10004857.1461
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x1c8]
push 0x64
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClassNameW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
test eax, eax
je 0x100051b2
lea eax, [esp + 0x1c8]
push eax
push esi
call edi
push 0x1000f304
push esi
call edi
push 0x64
lea eax, [esp + 0x3c4]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x100051da
lea eax, [esp + 0x3c0]
push eax
push esi
call edi
push 0x1000f304
push esi
call edi
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x10005219
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x5c8]
push 0x104
call fcn.10009960
add esp, 4
test eax, eax
je 0x10005219
lea eax, [esp + 0x5c8]
push eax
push esi
call edi
push 0x1000f304
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
add edi, edi
cmp dword [0x1001672c], 0
je case.0x10004857.1461
test edi, edi
je case.0x10004857.1461
mov ecx, edi
call fcn.100011d0
mov ebx, eax
test ebx, ebx
je case.0x10004857.1461
push edi
push esi
push ebx
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [0x10016708], 6
mov dword [0x1001670d], edi
mov dword [0x10016709], ebx
jmp 0x1000542d
sub ecx, 0x787
je 0x100052ec
sub ecx, 0x62
jne case.0x10004857.1461
push dword [0x10017754]
push dword [0x10017750]
call dword [sym.imp.USER32.dll_WindowFromPoint]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0x3e8
push 2
push edi
push 0
push 0x50
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
push 0
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x100052d9
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [0x100163f8], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
or eax, 0xffffffff
mov dword [0x100163f8], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push dword [esp + 0x28]
movzx eax, word [0x100176c6]
push dword [esp + 0x24]
push dword [esp + 0x2c]
push dword [esp + 0x28]
push eax
movzx eax, word [0x100176c4]
push eax
movzx eax, word [0x100176c2]
push eax
movzx eax, word [0x100176c0]
push eax
movzx eax, word [0x100176be]
push eax
movzx eax, word [0x100176bc]
push eax
movzx eax, word [0x100176ba]
push eax
movzx eax, word [0x100176b8]
push eax
movzx eax, word [0x100176b6]
push eax
movzx eax, word [0x100176b4]
push eax
movzx eax, word [0x100176b2]
push eax
movzx eax, word [0x100176b0]
push eax
movzx eax, word [0x100176ae]
push eax
movzx eax, word [0x100176ac]
push eax
movzx eax, word [0x100176aa]
push eax
movzx eax, word [0x100176a8]
push eax
movzx eax, word [0x100176a6]
push eax
movzx eax, word [0x100176a4]
push eax
movzx eax, word [0x100176a2]
push eax
movzx eax, word [0x100176a0]
push eax
movzx eax, word [0x1001748a]
push eax
movzx eax, word [0x10017488]
push eax
lea eax, [esp + 0x2f8]
push str.max:__d_:__d_r_n0:__d_:__d_r_n1:__d_:__d_r_n2:__d_:__d_r_n3:__d_:__d_r_n4:__d_:__d_r_n5:__d_:__d_r_n6:__d_:__d_r_n7:__d_:__d_r_n8:__d_:__d_r_n9:__d_:__d_r_nrect:__d_:__d_:__d_:__d_r_n
push eax
call fcn.10001200
add esp, 0x70
lea eax, [esp + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp dword [0x1001672c], 0
mov esi, eax
je case.0x10004857.1461
test esi, esi
je case.0x10004857.1461
mov ecx, esi
call fcn.100011d0
mov edi, eax
test edi, edi
je case.0x10004857.1461
push esi
lea eax, [esp + 0x294]
push eax
push edi
call section..text
add esp, 0xc
push 0x10016714
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [0x10016708], 5
mov dword [0x1001670d], esi
mov dword [0x10016709], edi
push 0x10016714
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x7c4
ret