Function at 0x10127630
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101b170a
mov eax, dword fs:[0]
push eax
sub esp, 0x438
mov eax, dword [0x1022c684]
xor eax, ebp
mov dword [ebp - 0x60], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3a4], ecx
mov eax, dword [ebp - 0x3a4]
cmp dword [eax + 0x298], 0
jne 0x10127680
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0
xor eax, eax
jmp 0x10128dc3
mov edx, dword [ebp + 0x14]
mov dword [edx], 1
mov byte [ebp - 0x11], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3a8], eax
mov ecx, dword [ebp - 0x3a8]
sub ecx, 1
mov dword [ebp - 0x3a8], ecx
cmp dword [ebp - 0x3a8], 0x4f
ja case.0x101276bf.8
mov edx, dword [ebp - 0x3a8]
movzx eax, byte [edx + 0x10128e08]
jmp dword [eax*4 + 0x10128de0]
push 0x50
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_KillTimer]
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x434]
mov dword [ecx + 0x124], 1
jmp 0x10128dc1
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x434]
movzx ecx, byte [eax + 0x64c]
test ecx, ecx
je 0x10127713
cmp dword [0x1022ee44], 0
je 0x10127718
jmp 0x10128dc1
mov edx, dword [ebp - 0x3a4]
cmp dword [edx + 0x498], 0
je 0x10127785
cmp dword [ebp - 0x3a4], 0
je 0x10127743
mov eax, dword [ebp - 0x3a4]
add eax, 0xc4
mov dword [ebp - 0x3ac], eax
jmp 0x1012774d
mov dword [ebp - 0x3ac], 0
push 0
mov ecx, dword [ebp - 0x3ac]
push ecx
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x498]
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x498]
mov edx, dword [eax]
mov eax, dword [edx + 0x28]
call eax
mov ecx, dword [ebp - 0x3a4]
mov dword [ecx + 0x498], 0
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x134
call fcn.1013a3e0
movzx edx, al
test edx, edx
jne 0x10127869
mov eax, dword [ebp - 0x3a4]
movzx ecx, byte [eax + 0x15a]
test ecx, ecx
je 0x10127869
mov ecx, 0x1022ee50
call fcn.1010c120
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x134
call fcn.1013a400
push eax
lea ecx, [ebp - 0x2c]
call fcn.1010bfe0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x134
call fcn.1013a440
mov ecx, 0x1022ee50
call fcn.1010c120
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0x328], esp
lea edx, [ebp - 0x2c]
push edx
call fcn.1010bfe0
mov dword [ebp - 0x3b0], eax
mov ecx, dword [ebp - 0x3a4]
call fcn.10131da0
mov eax, dword [ebp - 0x3a4]
movzx ecx, byte [eax + 0x15a]
test ecx, ecx
jne 0x10127855
mov byte [ebp - 0x11], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1010bfc0
jmp 0x10127869
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.1010bfc0
jmp 0x10127785
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x44c
call fcn.1013aa30
movzx edx, al
test edx, edx
jne 0x101279e2
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x44c
call fcn.100bfc80
jmp 0x101278ad
push 0
lea ecx, [ebp - 0x330]
push ecx
lea ecx, [ebp - 0x34]
call fcn.1013be10
lea edx, [ebp - 0x338]
push edx
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x44c
call fcn.100bf3c0
push eax
lea ecx, [ebp - 0x34]
call fcn.1013be50
movzx eax, al
test eax, eax
je 0x101279e2
lea ecx, [ebp - 0x34]
call fcn.1013bdf0
mov ecx, dword [eax]
mov dword [ebp - 0x38], ecx
xor edx, edx
mov word [ebp - 0x3c], dx
mov ecx, dword [ebp - 0x38]
call fcn.100116c0
test eax, eax
je 0x101279dd
mov ecx, dword [ebp - 0x38]
call fcn.100116c0
mov dword [ebp - 0x3b4], eax
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp - 0x3b4]
push ecx
mov edx, dword [ebp - 0x3b4]
mov eax, dword [edx]
mov ecx, dword [eax + 0x7c]
call ecx
movsx edx, word [ebp - 0x3c]
test edx, edx
jne 0x101279dd
mov eax, dword [ebp - 0x38]
cmp dword [eax + 0x30], 0
je 0x10127942
mov ecx, dword [ebp - 0x38]
add ecx, 0x2c
call fcn.100af900
mov ecx, dword [ebp - 0x38]
mov dword [ecx + 0x30], 0
mov edx, dword [ebp - 0x38]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x340], eax
mov ecx, dword [ebp - 0x340]
mov dword [ebp - 0x33c], ecx
cmp dword [ebp - 0x33c], 0
je 0x10127999
push 1
mov ecx, dword [ebp - 0x33c]
add ecx, 0x2c
mov edx, dword [ebp - 0x33c]
mov eax, dword [edx + 0x2c]
mov edx, dword [eax + 4]
call edx
mov dword [ebp - 0x3b8], eax
jmp 0x101279a3
mov dword [ebp - 0x3b8], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x348], eax
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x344], ecx
mov edx, dword [ebp - 0x344]
push edx
mov eax, dword [ebp - 0x348]
push eax
lea ecx, [ebp - 0x350]
push ecx
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x44c
call fcn.1013aa50
jmp 0x101279e2
jmp 0x1012789c
movzx edx, byte [ebp - 0x11]
test edx, edx
je 0x101279ef
jmp 0x10128dc1
mov dword [ebp - 0x10], 0
jmp 0x10127a01
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x68
call fcn.10012070
cmp dword [ebp - 0x10], eax
jae 0x10127a56
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x298]
add ecx, 0x68
call fcn.10012090
mov ecx, dword [eax]
mov dword [ebp - 0x3bc], ecx
push 0
push 0x101dd1d4
mov edx, dword [ebp - 0x3bc]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3bc]
mov edx, dword [eax + 0x58]
call edx
jmp 0x101279f8
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x298]
cmp dword [ecx + 0x130], 0
je 0x10127ade
mov dword [ebp - 0x10], 0
jmp 0x10127a7d
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x298]
mov ecx, dword [ecx + 0x130]
add ecx, 0x10
call fcn.10004b60
cmp dword [ebp - 0x10], eax
jae 0x10127ade
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x298]
mov ecx, dword [ecx + 0x130]
add ecx, 0x10
call fcn.100045f0
mov edx, dword [eax]
mov dword [ebp - 0x3c0], edx
push 0
push str.OnTimer
mov eax, dword [ebp - 0x3c0]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x3c0]
mov eax, dword [edx + 0x30]
call eax
jmp 0x10127a74
mov ecx, dword [ebp - 0x3a4]
movzx edx, byte [ecx + 0x1d1]
test edx, edx
je 0x10127c22
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x434]
movzx edx, byte [ecx + 0x640]
test edx, edx
je 0x10127b1a
mov ecx, dword [ebp - 0x3a4]
call fcn.10122860
jmp 0x10128dc1
lea ecx, [ebp - 0x44]
call fcn.100cec30
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10096f00
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x40]
call fcn.100987a0
push eax
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x434]
mov edx, dword [ecx + 0x628]
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x434]
mov eax, dword [ecx + 0x628]
mov ecx, dword [edx]
push eax
mov edx, dword [ecx + 0x48]
call edx
lea ecx, [ebp - 0x40]
call fcn.10014090
push eax
lea ecx, [ebp - 0x44]
call fcn.100cec90
push 0
lea ecx, [ebp - 0x44]
call fcn.1010cd80
movzx eax, al
test eax, eax
je 0x10127c02
lea ecx, [ebp - 0x48]
call fcn.10013790
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x44]
call fcn.10092ca0
mov dword [ebp - 0x3c4], eax
lea ecx, [ebp - 0x48]
call fcn.100137b0
push eax
mov ecx, dword [ebp - 0x3c4]
push ecx
mov edx, dword [ebp - 0x3c4]
mov eax, dword [edx]
mov ecx, dword [eax + 0x58]
call ecx
push str.complete
lea ecx, [ebp - 0x48]
call fcn.10098180
movzx edx, al
test edx, edx
jne 0x10127beb
push str.interactive
lea ecx, [ebp - 0x48]
call fcn.10098180
movzx eax, al
test eax, eax
je 0x10127bf6
mov ecx, dword [ebp - 0x3a4]
call fcn.10122860
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x48]
call fcn.100058a0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x40]
call fcn.10013e30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.100ce5a0
jmp 0x10127e79
mov ecx, dword [ebp - 0x3a4]
movzx edx, byte [ecx + 0x424]
test edx, edx
je 0x10127e79
mov byte [ebp - 0x49], 0
mov dword [ebp - 0x10], 0
jmp 0x10127c4d
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x114
call fcn.1002e0a0
cmp dword [ebp - 0x10], eax
jae 0x10127e5f
mov byte [ebp - 0x4a], 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x298]
add ecx, 0x114
call fcn.1002e0c0
mov ecx, dword [eax]
movzx edx, byte [ecx + 0x38]
test edx, edx
jne 0x10127e5a
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x114
call fcn.1002e0c0
mov edx, dword [eax]
add edx, 0x10
push edx
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x114
call fcn.10139030
cmp dword [eax], 1
je 0x10127e5a
push 0x101dd220
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x114
call fcn.1002e0c0
mov edx, dword [eax]
mov eax, dword [edx + 0x30]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x3a4]
mov ecx, dword [edx + 0x298]
add ecx, 0x114
call fcn.1002e0c0
mov eax, dword [eax]
add eax, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x354], esp
push eax
call fcn.10005d60
mov dword [ebp - 0x3c8], eax
mov ecx, dword [ebp - 0x3a4]
call fcn.101330a0
mov byte [ebp - 0x3c9], al
movzx ecx, byte [ebp - 0x3c9]
test ecx, ecx
jne 0x10127d82
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x298]
add ecx, 0x114
call fcn.1002e0c0
mov ecx, dword [eax]
cmp dword [ecx + 0x30], 0
jne 0x10127e5a
movzx edx, byte [0x10232fd1]
test edx, edx
jne 0x10127e5a
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x114
call fcn.1002e0c0
mov edx, dword [eax]
cmp dword [edx + 0x30], 0
jne 0x10127ddd
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x114
call fcn.1002e0c0
mov edx, dword [eax]
add edx, 0x10
push edx
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x114
call fcn.10139030
mov dword [eax], 1
mov byte [ebp - 0x4a], 1
mov byte [ebp - 0x49], 1
push 0
push 1
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x114
call fcn.1002e0c0
mov edx, dword [eax]
cmp dword [edx + 0x28], 0
setne al
movzx ecx, al
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x298]
add ecx, 0x114
call fcn.1002e0c0
mov ecx, dword [eax]
add ecx, 0x10
call fcn.100043a0
push eax
push 0
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x42c]
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x42c]
mov edx, dword [edx]
mov eax, dword [edx + 0x1c]
call eax
jmp 0x10127c44
movzx ecx, byte [0x10232fd1]
test ecx, ecx
jne 0x10127e79
movzx edx, byte [ebp - 0x49]
test edx, edx
je 0x10127e79
mov byte [0x10232fd1], 1
jmp 0x10128dc1
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x434]
mov byte [ecx + 0x635], 0
push 2
mov ecx, dword [ebp - 0x3a4]
add ecx, 4
call fcn.10099f80
jmp 0x10128dc1
mov byte [0x10232007], 0
cmp dword [0x1022ee44], 0
je 0x10127ebb
jmp 0x10128dc1
push 0x1022ee44
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
push 3
mov ecx, dword [ebp - 0x3a4]
add ecx, 4
call fcn.10099f80
push 0
mov ecx, dword [ebp - 0x3a4]
call fcn.10129390
mov dword [ebp - 0x10], 0
jmp 0x10127ef5
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x298]
add ecx, 0x68
call fcn.10012070
cmp dword [ebp - 0x10], eax
jae 0x10128005
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x3a4]
mov ecx, dword [edx + 0x298]
add ecx, 0x68
call fcn.10012090
mov eax, dword [eax]
mov dword [ebp - 0x3d0], eax
push 0x101dd23c
push 0x101dd240
mov ecx, dword [ebp - 0x3d0]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3d0]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x50], eax
push 0x101dd250
mov ecx, dword [ebp - 0x50]
push ecx
call fcn.1016f1ec
add esp, 8
test eax, eax
je 0x10127f7c
push 0x101dd268
mov edx, dword [ebp - 0x50]
push edx
call fcn.1016f1ec
add esp, 8
test eax, eax
jne 0x10127fdc
cmp dword [ebp - 0x3a4], 0
je 0x10127f98
mov eax, dword [ebp - 0x3a4]
add eax, 0xc4
mov dword [ebp - 0x3d4], eax
jmp 0x10127fa2
mov dword [ebp - 0x3d4], 0
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x3a4]
mov ecx, dword [edx + 0x298]
add ecx, 0x68
call fcn.10012090
mov eax, dword [eax]
mov dword [ebp - 0x3d8], eax
mov ecx, dword [ebp - 0x3d4]
push ecx
mov edx, dword [ebp - 0x3d8]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x3d8]
mov edx, dword [eax + 0x28]
call edx
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x3a4]
add ecx, 0xc4
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0xc4]
mov edx, dword [eax + 0xa8]
call edx
jmp 0x10127eec
push 1
mov ecx, dword [ebp - 0x3a4]
call fcn.10129390
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x434]
cmp dword [ecx + 0x638], 0
je 0x10128040
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x434]
mov ecx, dword [eax + 0x638]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x434]
mov dword [eax + 0x638], 0
push 0x1022ee44
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
jmp 0x10128dc1
push 4
mov ecx, dword [ebp - 0x3a4]
add ecx, 4
call fcn.10099f80
lea ecx, [ebp - 0x54]
call fcn.10005d40
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x5c]
call fcn.10005d40
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
call fcn.10005d40
mov byte [ebp - 4], 6
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x2c
call fcn.10004400
movzx edx, al
test edx, edx
je 0x10128280
mov ax, word [0x101dd280]
mov word [ebp - 0x26c], ax
push 0x206
push 0
lea ecx, [ebp - 0x26a]
push ecx
call fcn.1016f6c0
add esp, 0xc
push 0x104
lea edx, [ebp - 0x26c]
push edx
mov ecx, 0x1022ee50
call fcn.100aa6e0
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x26c]
push ecx
lea ecx, [ebp - 0x358]
call fcn.10005d80
mov dword [ebp - 0x3dc], eax
mov edx, dword [ebp - 0x3dc]
mov dword [ebp - 0x3e0], edx
mov byte [ebp - 4], 7
mov eax, dword [ebp - 0x3e0]
push eax
lea ecx, [ebp - 0x5c]
call fcn.10003ea0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x358]
call fcn.10005e00
push 1
lea ecx, [ebp - 0x35c]
push ecx
call fcn.100e14d0
add esp, 8
mov dword [ebp - 0x3e4], eax
mov edx, dword [ebp - 0x3e4]
mov dword [ebp - 0x3e8], edx
mov byte [ebp - 4], 8
mov eax, dword [ebp - 0x3e8]
push eax
lea ecx, [ebp - 0x58]
call fcn.10003ea0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x35c]
call fcn.10005e00
mov ecx, dword [str.uninstall.exe]
push ecx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.10090bb0
add esp, 0xc
mov dword [ebp - 0x3ec], eax
mov ecx, dword [ebp - 0x3ec]
mov dword [ebp - 0x3f0], ecx
mov byte [ebp - 4], 9
mov edx, dword [ebp - 0x3f0]
push edx
lea ecx, [ebp - 0x54]
call fcn.10003ea0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x360]
call fcn.10005e00
mov dword [ebp - 0x270], str.uninstaller.exe
mov eax, dword [ebp - 0x270]
push eax
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x368]
push edx
call fcn.10090bb0
add esp, 0xc
mov dword [ebp - 0x3f4], eax
mov ecx, dword [ebp - 0x3f4]
call fcn.10004390
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov dword [ebp - 0x364], eax
lea ecx, [ebp - 0x368]
call fcn.10005e00
cmp dword [ebp - 0x364], 0
je 0x1012827b
mov eax, dword [ebp - 0x270]
push eax
lea ecx, [ebp - 0x58]
push ecx
lea edx, [ebp - 0x36c]
push edx
call fcn.10090bb0
add esp, 0xc
mov dword [ebp - 0x3f8], eax
mov eax, dword [ebp - 0x3f8]
mov dword [ebp - 0x3fc], eax
mov byte [ebp - 4], 0xa
mov ecx, dword [ebp - 0x3fc]
push ecx
lea ecx, [ebp - 0x54]
call fcn.10003ea0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x36c]
call fcn.10005e00
jmp 0x10128341
push str.msiexec.exe
lea ecx, [ebp - 0x370]
call fcn.10005d80
mov dword [ebp - 0x400], eax
mov edx, dword [ebp - 0x400]
mov dword [ebp - 0x404], edx
mov byte [ebp - 4], 0xb
mov eax, dword [ebp - 0x404]
push eax
lea ecx, [ebp - 0x54]
call fcn.10003ea0
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x370]
call fcn.10005e00
push 0x101dd2bc
lea ecx, [ebp - 0x374]
call fcn.10010910
mov byte [ebp - 4], 0xc
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x298]
add edx, 0x2c
push edx
lea eax, [ebp - 0x374]
push eax
lea ecx, [ebp - 0x378]
push ecx
call fcn.100042a0
add esp, 0xc
mov dword [ebp - 0x408], eax
mov edx, dword [ebp - 0x408]
mov dword [ebp - 0x40c], edx
mov byte [ebp - 4], 0xd
mov eax, dword [ebp - 0x40c]
push eax
lea ecx, [ebp - 0x5c]
call fcn.10003ea0
mov byte [ebp - 4], 0xc
lea ecx, [ebp - 0x378]
call fcn.10005e00
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x374]
call fcn.10005e00
push 5
lea ecx, [ebp - 0x58]
call fcn.10004390
push eax
lea ecx, [ebp - 0x5c]
call fcn.10004390
push eax
lea ecx, [ebp - 0x54]
call fcn.10004390
push eax
push 0x101dd2c0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x58]
call fcn.10005e00
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x5c]
call fcn.10005e00
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.10005e00
jmp 0x10128dc1
mov ecx, dword [ebp - 0x3a4]
cmp dword [ecx + 0x1f4], 0
je 0x101283be
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x1f4]
movzx ecx, byte [eax + 0x32c]
cmp ecx, 1
jne 0x101283c3
jmp 0x10128dc1
push 5
mov ecx, dword [ebp - 0x3a4]
add ecx, 4
call fcn.10099f80
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x1f4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10128416
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x1f4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x1f4]
mov dword [eax + 4], 0
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x1f4]
mov dword [ebp - 0x380], edx
mov eax, dword [ebp - 0x380]
mov dword [ebp - 0x37c], eax
cmp dword [ebp - 0x37c], 0
je 0x1012845a
push 1
mov ecx, dword [ebp - 0x37c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x37c]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 0x410], eax
jmp 0x10128464
mov dword [ebp - 0x410], 0
mov ecx, dword [ebp - 0x3a4]
mov dword [ecx + 0x1f4], 0
jmp 0x10128dc1
push 6
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov ecx, dword [ebp - 0x3a4]
cmp dword [ecx + 0x1a4], 0
je 0x101285bb
mov edx, dword [ebp - 0x3a4]
movzx eax, byte [edx + 0x408]
test eax, eax
je 0x101285bb
call dword [sym.imp.USER32.dll_EndMenu]
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x1a4]
add ecx, 0x2c
call fcn.100043a0
push eax
push 0x101dd2cc
mov ecx, dword [ebp - 0x3a4]
add ecx, 0xc4
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0xc4]
mov edx, dword [eax + 0x44]
call edx
cmp dword [ebp - 0x3a4], 0
je 0x1012850c
mov eax, dword [ebp - 0x3a4]
add eax, 0xc4
mov dword [ebp - 0x414], eax
jmp 0x10128516
mov dword [ebp - 0x414], 0
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x1a4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x298]
mov ecx, dword [edx + 0x130]
add ecx, 0x10
call fcn.100045f0
mov eax, dword [eax]
mov dword [ebp - 0x418], eax
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x1a4]
mov eax, dword [edx + 0x10]
push eax
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x298]
mov ecx, dword [edx + 0x130]
add ecx, 0x10
call fcn.100045f0
mov eax, dword [eax]
mov dword [ebp - 0x41c], eax
mov ecx, dword [ebp - 0x418]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x418]
mov eax, dword [edx + 0x1c]
call eax
movzx ecx, al
push ecx
mov edx, dword [ebp - 0x414]
push edx
mov eax, dword [ebp - 0x41c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x41c]
mov eax, dword [edx + 0x28]
call eax
mov ecx, dword [ebp - 0x3a4]
mov dword [ecx + 0x1a4], 0
jmp 0x10128dc1
push 7
mov ecx, dword [ebp - 0x3a4]
add ecx, 4
call fcn.10099f80
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 4]
push eax
call fcn.100a5bd0
add esp, 4
mov dword [ebp - 0x288], eax
mov ecx, dword [ebp - 0x288]
push ecx
lea ecx, [ebp - 0x284]
call fcn.10006520
push 0
push 0
push 0x40000
lea ecx, [ebp - 0x284]
call fcn.1009a130
push 0x17
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x284]
call fcn.10004d10
lea edx, [ebp - 0x280]
push edx
lea ecx, [ebp - 0x284]
call fcn.1001a8b0
mov eax, dword [ebp - 0x27c]
add eax, 0x2d
mov dword [ebp - 0x274], eax
mov ecx, dword [ebp - 0x3a4]
call fcn.1012a3f0
add eax, dword [ebp - 0x280]
mov dword [ebp - 0x278], eax
push 1
lea ecx, [ebp - 0x280]
push ecx
lea ecx, [ebp - 0x284]
call fcn.1001a860
jmp 0x10128dc1
push 8
mov ecx, dword [ebp - 0x3a4]
add ecx, 4
call fcn.10099f80
push 0
push 0
push 0xb
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x298]
mov ecx, dword [eax + 0x134]
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x298]
mov edx, dword [eax + 0x134]
mov eax, dword [ecx]
mov ecx, edx
mov edx, dword [eax + 0x5c]
call edx
push eax
call fcn.1006b9e0
add esp, 0x10
lea ecx, [ebp - 0x2ac]
call fcn.1001ab30
lea eax, [ebp - 0x2ac]
push eax
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x298]
mov eax, dword [edx + 0x134]
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x298]
mov ecx, dword [edx + 0x134]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
call edx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 0x28c], 0
mov eax, dword [ebp - 0x2a4]
sub eax, dword [ebp - 0x2ac]
mov dword [ebp - 0x294], eax
mov ecx, dword [ebp - 0x2a0]
sub ecx, dword [ebp - 0x2a8]
mov dword [ebp - 0x29c], ecx
mov dword [ebp - 0x2cc], 0
xor edx, edx
mov dword [ebp - 0x2c8], edx
mov dword [ebp - 0x2c4], edx
mov dword [ebp - 0x2c0], edx
mov dword [ebp - 0x2bc], edx
mov dword [ebp - 0x2b8], edx
mov dword [ebp - 0x2b4], edx
mov dword [ebp - 0x2b0], edx
mov dword [ebp - 0x2cc], 0x20
mov dword [ebp - 0x2c8], 0x48
mov byte [ebp - 0x2bb], 0
mov dword [ebp - 0x298], 0xffffffff
mov dword [ebp - 0x2d0], 0
jmp 0x101287aa
mov eax, dword [ebp - 0x2d0]
add eax, 1
mov dword [ebp - 0x2d0], eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x68
call fcn.10012070
cmp dword [ebp - 0x2d0], eax
jae 0x101289a7
mov edx, dword [ebp - 0x2d0]
push edx
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x298]
add ecx, 0x68
call fcn.10012090
cmp dword [eax], 0
je 0x101289a2
mov ecx, dword [ebp - 0x2d0]
push ecx
mov edx, dword [ebp - 0x3a4]
mov ecx, dword [edx + 0x298]
add ecx, 0x68
call fcn.10012090
mov eax, dword [eax]
mov dword [ebp - 0x420], eax
push 0x101dd2e8
push 0x101dd2ec
mov ecx, dword [ebp - 0x420]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x420]
mov eax, dword [edx + 0xc]
call eax
push eax
lea ecx, [ebp - 0x2d4]
call fcn.10005d80
mov dword [ebp - 4], 0xe
cmp dword [ebp - 0x298], 0xffffffff
jne 0x1012892a
push 0x101dd2f8
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.10004370
add esp, 8
movzx edx, al
test edx, edx
jne 0x101288ba
push 0x101dd310
lea eax, [ebp - 0x2d4]
push eax
call fcn.10004370
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x101288ba
push 0x101dd31c
lea edx, [ebp - 0x2d4]
push edx
call fcn.10004370
add esp, 8
movzx eax, al
test eax, eax
jne 0x101288ba
push 0x101dd328
lea ecx, [ebp - 0x2d4]
push ecx
call fcn.10004370
add esp, 8
movzx edx, al
test edx, edx
je 0x1012892a
mov eax, dword [ebp - 0x2d0]
push eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x68
call fcn.10012090
mov edx, dword [eax]
mov dword [ebp - 0x2dc], edx
mov eax, dword [ebp - 0x2dc]
mov ecx, dword [eax + 0x90]
mov dword [ebp - 0x2d8], ecx
cmp dword [ebp - 0x2d8], 0
jle 0x10128906
mov edx, dword [ebp - 0x2d8]
mov dword [ebp - 0x424], edx
jmp 0x10128910
mov dword [ebp - 0x424], 0x3c
mov eax, dword [ebp - 0x424]
mov dword [ebp - 0x290], eax
mov ecx, dword [ebp - 0x2d0]
mov dword [ebp - 0x298], ecx
jmp 0x10128990
lea edx, [ebp - 0x2cc]
push edx
mov eax, dword [ebp - 0x2d0]
push eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x68
call fcn.10012090
mov edx, dword [eax]
mov eax, dword [edx + 0xc]
push eax
push 0x43f
mov ecx, dword [ebp - 0x3a4]
add ecx, 0xc4
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0xc4]
mov edx, dword [eax + 0x5c]
call edx
push eax
call fcn.1006b9e0
add esp, 0x10
movzx eax, word [ebp - 0x2ba]
add eax, dword [ebp - 0x28c]
mov dword [ebp - 0x28c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2d4]
call fcn.10005e00
jmp 0x1012879b
cmp dword [ebp - 0x298], 0xffffffff
je 0x10128bf4
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x68
call fcn.10012070
cmp dword [ebp - 0x298], eax
jae 0x10128bf4
mov edx, dword [ebp - 0x294]
sub edx, dword [ebp - 0x28c]
mov dword [ebp - 0x2f4], edx
mov eax, dword [ebp - 0x2f4]
cmp eax, dword [ebp - 0x290]
jge 0x10128a00
mov ecx, dword [ebp - 0x290]
mov dword [ebp - 0x2f4], ecx
lea ecx, [ebp - 0x2ec]
call fcn.1001ab30
lea edx, [ebp - 0x2ec]
push edx
mov eax, dword [ebp - 0x298]
push eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x68
call fcn.10012090
mov edx, dword [eax]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x3a4]
mov eax, dword [edx + 0x38]
call eax
mov ecx, dword [ebp - 0x2e4]
sub ecx, dword [ebp - 0x2ec]
mov edx, dword [ebp - 0x2f4]
sub edx, ecx
mov dword [ebp - 0x2f8], edx
mov eax, dword [ebp - 0x298]
push eax
mov ecx, dword [ebp - 0x3a4]
mov ecx, dword [ecx + 0x298]
add ecx, 0x68
call fcn.10012090
mov edx, dword [eax]
mov dword [ebp - 0x428], edx
lea eax, [ebp - 0x2f8]
push eax
push 0x101dd33c
mov ecx, dword [ebp - 0x428]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x428]
mov eax, dword [edx + 0x58]
call eax
push ecx
mov ecx, esp
mov dword [ebp - 0x384], esp
push 0x101dd34c
call fcn.10005d80
mov dword [ebp - 0x42c], eax
mov ecx, dword [ebp - 0x42c]
mov dword [ebp - 0x430], ecx
mov dword [ebp - 4], 0xf
push ecx
mov ecx, esp
mov dword [ebp - 0x388], esp
push 0x101dd350
call fcn.10005d80
mov dword [ebp - 0x434], eax
mov edx, dword [ebp - 0x298]
push edx
lea eax, [ebp - 0x2f0]
push eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x3a4]
call fcn.10133e10
mov dword [ebp - 0x438], eax
mov dword [ebp - 4], 0x10
mov ecx, dword [ebp - 0x2f4]
push ecx
push ecx
mov ecx, esp
mov dword [ebp - 0x38c], esp
lea edx, [ebp - 0x2f0]
push edx
call fcn.10005d60
mov dword [ebp - 0x43c], eax
mov ecx, dword [ebp - 0x3a4]
call fcn.1012ffd0
mov eax, dword [ebp - 0x298]
mov dword [ebp - 0x2fc], eax
jmp 0x10128b5e
mov ecx, dword [ebp - 0x2fc]
add ecx, 1
mov dword [ebp - 0x2fc], ecx
mov edx, dword [ebp - 0x3a4]
mov ecx, dword [edx + 0x298]
add ecx, 0x68
call fcn.10012070
cmp dword [ebp - 0x2fc], eax
jae 0x10128be2
cmp dword [ebp - 0x3a4], 0
je 0x10128b96
mov eax, dword [ebp - 0x3a4]
add eax, 0xc4
mov dword [ebp - 0x440], eax
jmp 0x10128ba0
mov dword [ebp - 0x440], 0
mov ecx, dword [ebp - 0x2fc]
push ecx
mov edx, dword [ebp - 0x3a4]
mov ecx, dword [edx + 0x298]
add ecx, 0x68
call fcn.10012090
mov eax, dword [eax]
mov dword [ebp - 0x444], eax
mov ecx, dword [ebp - 0x440]
push ecx
mov edx, dword [ebp - 0x444]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x444]
mov edx, dword [eax + 0x28]
call edx
jmp 0x10128b4f
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2f0]
call fcn.10005e00
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x434]
mov edx, dword [ecx + 0x648]
and edx, 1
je 0x10128ce9
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x434]
movzx edx, byte [ecx + 0x640]
test edx, edx
je 0x10128ce9
lea ecx, [ebp - 0x324]
call fcn.1001ab30
lea eax, [ebp - 0x324]
push eax
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x298]
mov eax, dword [edx + 0x134]
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x298]
mov ecx, dword [edx + 0x134]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
call edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov dword [ebp - 0x310], eax
lea ecx, [ebp - 0x30c]
call fcn.1001ab30
lea eax, [ebp - 0x30c]
push eax
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x434]
mov eax, dword [edx + 0x620]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov dword [ebp - 0x29c], 0x16
mov dword [ebp - 0x314], 0x3e8
push 1
mov ecx, dword [ebp - 0x29c]
push ecx
mov edx, dword [ebp - 0x294]
push edx
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x308]
push eax
mov ecx, dword [ebp - 0x324]
push ecx
mov edx, dword [ebp - 0x3a4]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_MoveWindow]
jmp 0x10128d27
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x434]
movzx eax, byte [edx + 0x640]
test eax, eax
je 0x10128d27
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x434]
mov eax, dword [ebp - 0x3a4]
mov ecx, dword [eax + 0x434]
add ecx, 0x14
mov edx, dword [edx + 0x14]
push ecx
mov eax, dword [edx + 0xb8]
call eax
push 0
push 1
push 0xb
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x298]
mov eax, dword [edx + 0x134]
mov ecx, dword [ebp - 0x3a4]
mov edx, dword [ecx + 0x298]
mov ecx, dword [edx + 0x134]
mov eax, dword [eax]
mov edx, dword [eax + 0x5c]
call edx
push eax
call fcn.1006b9e0
add esp, 0x10
jmp 0x10128dc1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x390], eax
lea ecx, [ebp - 0x3a0]
push ecx
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x178
call fcn.1013a610
push eax
lea edx, [ebp - 0x390]
push edx
lea eax, [ebp - 0x398]
push eax
mov ecx, dword [ebp - 0x3a4]
add ecx, 0x178
call fcn.1013a6c0
mov ecx, eax
call fcn.1013be80
movzx ecx, al
test ecx, ecx
je 0x10128dc1
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x3a4]
call fcn.10135f30
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x60]
xor ecx, ebp
call fcn.1016f6a2
mov esp, ebp
pop ebp
ret 0x10