Function at 0x1001eb30
Capabilities:
Check for time delay via gettickcount
Check if file exists
Create process on windows
Get common file path
Get file attributes
Get file system object information
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x100a09a0
push eax
mov eax, 0x1214
mov dword fs:[0], esp
call fcn.1009d950
push ebx
push esi
push edi
push 0x20a
lea eax, [ebp - 0x33c]
mov dword [ebp - 0x20], 0
push 0
push eax
call fcn.1007cff0
push 0x208
lea eax, [ebp - 0xd64]
push 0
push eax
call fcn.1007cff0
push 0x206
lea eax, [ebp - 0xb5a]
push 0
push eax
call fcn.1007cff0
xor eax, eax
mov byte [ebp - 0xd], 0
add esp, 0x24
mov byte [ebp - 0x16], 0
mov word [ebp - 0xb5c], ax
cmp dword [0x100c8008], eax
jne 0x1001ebe2
mov eax, dword [0x100c72d8]
test eax, eax
je 0x1001ec00
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x100c8028], 0
push dword [0x100c72d8]
je 0x1001ebfa
mov dword [0x100c8028], 0
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push 0x100c72bc
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x100c72d4]
test eax, eax
je 0x1001ec26
mov ecx, dword [ebp + 8]
cmp dword [eax + 4], ecx
je 0x1001eca5
mov eax, dword [eax]
test eax, eax
jne 0x1001ec17
push 0x100c72bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
jne 0x1001f010
mov edi, dword [eax + 0x10]
test edi, edi
je 0x1001f010
cmp dword [eax + 0x24], 0
jne 0x1001f010
cmp dword [eax + 0x14], 0
jne 0x1001f010
mov esi, 0xffffff9d
mov ebx, str.::26EE0668_A00A_44D7_9371_BEB064C98683
test esi, esi
js 0x1001ec72
mov eax, esi
dec esi
test eax, eax
jle 0x1001ecca
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x14], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
movzx ecx, ax
add esp, 8
mov eax, dword [ebp - 0x14]
cmp ax, cx
jne 0x1001ecb5
test ax, ax
je 0x1001ecca
add edi, 2
add ebx, 2
jmp 0x1001ec67
push 0x100c72bc
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x1001ebe2
test cx, cx
jne 0x1001ecbf
cmp esi, 0xffffff9d
je 0x1001ecca
movzx eax, ax
sub eax, ecx
jne 0x1001f00d
push 0x8000
call fcn.1008680d
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x1001f00d
push 0x3fff
lea esi, [ebx + 2]
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x100ade1c
push 0x104
push esi
call sym.dopuslib32.dll_SafePathAppend
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1001ed4c
test esi, esi
je 0x1001ed4c
mov edx, 0x100ade1c
mov ecx, 0x3fff
sub edx, esi
nop
lea eax, [ecx + 0x7fffbfff]
test eax, eax
je 0x1001ed47
movzx eax, word [edx + esi]
test ax, ax
je 0x1001ed40
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x1001ed20
jmp 0x1001ed44
test ecx, ecx
jne 0x1001ed47
sub esi, 2
xor eax, eax
mov word [esi], ax
mov eax, 0x22
mov edx, 0x4000
mov word [ebx], ax
mov eax, ebx
jmp 0x1001ed60
cmp word [eax], 0
je 0x1001ed6e
add eax, 2
sub edx, 1
jne 0x1001ed60
mov ecx, 0x4000
mov esi, edx
mov eax, ecx
sub eax, edx
neg esi
sbb esi, esi
and esi, eax
test edx, edx
je 0x1001edca
mov edx, ecx
lea eax, [ebx + esi*2]
sub edx, esi
je 0x1001edc2
mov edi, 0x100b0f00
mov esi, SysReAllocString
sub edi, eax
mov dword [ebp - 0x28], edi
jmp 0x1001eda0
test esi, esi
je 0x1001edc5
movzx edi, word [edi + eax]
test di, di
je 0x1001edbe
mov word [eax], di
dec esi
mov edi, dword [ebp - 0x28]
add eax, 2
sub edx, 1
jne 0x1001eda0
jmp 0x1001edc2
test edx, edx
jne 0x1001edc5
sub eax, 2
xor edx, edx
mov word [eax], dx
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x10]
cmp word [eax], 0x2f
je 0x1001ee40
mov edx, ecx
mov eax, ebx
lea ebx, [ebx]
cmp word [eax], 0
je 0x1001edee
add eax, 2
sub edx, 1
jne 0x1001ede0
mov eax, ecx
mov esi, edx
sub eax, edx
neg esi
sbb esi, esi
and esi, eax
test edx, edx
je 0x1001ee40
mov edx, ecx
lea eax, [ebx + esi*2]
sub edx, esi
je 0x1001ee38
mov edi, 0x100ade38
mov esi, SysReAllocString
sub edi, eax
mov dword [ebp - 0x28], edi
test esi, esi
je 0x1001ee3b
movzx edi, word [edi + eax]
test di, di
je 0x1001ee34
mov word [eax], di
dec esi
mov edi, dword [ebp - 0x28]
add eax, 2
sub edx, 1
jne 0x1001ee16
jmp 0x1001ee38
test edx, edx
jne 0x1001ee3b
sub eax, 2
xor edx, edx
mov word [eax], dx
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x1001ee51
xor eax, eax
mov word [ebx], ax
jmp 0x1001eeb0
mov edx, ecx
mov eax, ebx
cmp word [eax], 0
je 0x1001ee63
add eax, 2
sub edx, 1
jne 0x1001ee55
mov eax, ecx
mov esi, edx
sub eax, edx
neg esi
sbb esi, esi
and esi, eax
test edx, edx
je 0x1001eeb0
mov edx, ecx
lea eax, [ebx + esi*2]
sub edx, esi
je 0x1001eea8
sub edi, eax
mov esi, SysReAllocString
mov dword [ebp - 0x28], edi
test esi, esi
je 0x1001eeab
movzx edi, word [edi + eax]
test di, di
je 0x1001eea4
mov word [eax], di
dec esi
mov edi, dword [ebp - 0x28]
add eax, 2
sub edx, 1
jne 0x1001ee86
jmp 0x1001eea8
test edx, edx
jne 0x1001eeab
sub eax, 2
xor edx, edx
mov word [eax], dx
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
cmp word [eax], 0x2f
je 0x1001ef18
mov edx, ecx
mov eax, ebx
cmp word [eax], 0
je 0x1001eece
add eax, 2
sub edx, 1
jne 0x1001eec0
mov eax, ecx
mov esi, edx
sub eax, edx
neg esi
sbb esi, esi
and esi, eax
test edx, edx
je 0x1001ef18
lea eax, [ebx + esi*2]
sub ecx, esi
je 0x1001ef10
mov edi, 0x100ade38
mov edx, SysReAllocString
sub edi, eax
test edx, edx
je 0x1001ef13
movzx esi, word [edi + eax]
test si, si
je 0x1001ef0c
mov word [eax], si
dec edx
add eax, 2
sub ecx, 1
jne 0x1001eef1
jmp 0x1001ef10
test ecx, ecx
jne 0x1001ef13
sub eax, 2
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov dword [ebp - 0xa4], 0
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xa8]
mov dword [ebp - 0xa0], 0
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push ebx
push 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x94], 0
mov dword [ebp - 0x90], 0
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x88], 0
mov dword [ebp - 0x84], 0
mov dword [ebp - 0x80], 0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0xa8], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1001efef
push dword [ebp - 0x64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x60]
call esi
push ebx
call fcn.10086818
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0xc]
test edi, edi
je 0x1001f208
cmp word [edi], 0
je 0x1001f208
or esi, 0xffffffff
mov ebx, str.open
lea ecx, [ecx]
test esi, esi
js 0x1001f03f
mov eax, esi
dec esi
test eax, eax
jle 0x1001f208
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x14], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
movzx ecx, ax
add esp, 8
mov eax, dword [ebp - 0x14]
cmp ax, cx
jne 0x1001f076
test ax, ax
je 0x1001f208
add edi, 2
add ebx, 2
jmp 0x1001f030
test cx, cx
jne 0x1001f084
cmp esi, 0xffffff9d
je 0x1001f208
movzx eax, ax
sub eax, ecx
je 0x1001f208
mov eax, dword [ebp + 8]
or esi, 0xffffffff
mov ebx, str.explore
mov edi, dword [eax + 0xc]
test edi, edi
je 0x1001f0ff
test esi, esi
js 0x1001f0b0
mov eax, esi
dec esi
test eax, eax
jle 0x1001f208
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x14], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
mov ecx, dword [ebp - 0x14]
add esp, 8
movzx eax, ax
cmp cx, ax
jne 0x1001f0e7
test cx, cx
je 0x1001f208
add edi, 2
add ebx, 2
jmp 0x1001f0a1
test ax, ax
jne 0x1001f0f5
cmp esi, 0xffffff9d
je 0x1001f208
movzx ecx, cx
sub ecx, eax
mov eax, dword [ebp + 8]
jmp 0x1001f10d
xor ecx, ecx
test edi, edi
setne cl
lea ecx, [ecx*2 - 1]
test ecx, ecx
je 0x1001f208
mov edi, dword [eax + 0xc]
or esi, 0xffffffff
mov ebx, str.opennewwindow
test edi, edi
je 0x1001f182
test esi, esi
js 0x1001f133
mov eax, esi
dec esi
test eax, eax
jle 0x1001f208
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x14], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
mov ecx, dword [ebp - 0x14]
add esp, 8
movzx eax, ax
cmp cx, ax
jne 0x1001f16a
test cx, cx
je 0x1001f208
add edi, 2
add ebx, 2
jmp 0x1001f124
test ax, ax
jne 0x1001f178
cmp esi, 0xffffff9d
je 0x1001f208
movzx ecx, cx
sub ecx, eax
mov eax, dword [ebp + 8]
jmp 0x1001f190
xor ecx, ecx
test edi, edi
setne cl
lea ecx, [ecx*2 - 1]
test ecx, ecx
je 0x1001f208
mov edi, dword [eax + 0xc]
or esi, 0xffffffff
mov ebx, str.find
test edi, edi
je 0x1001f1f2
test esi, esi
js 0x1001f1ae
mov eax, esi
dec esi
test eax, eax
jle 0x1001f208
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x14], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
mov ecx, dword [ebp - 0x14]
add esp, 8
movzx eax, ax
cmp cx, ax
jne 0x1001f1e1
test cx, cx
je 0x1001f208
add edi, 2
add ebx, 2
jmp 0x1001f1a3
test ax, ax
jne 0x1001f1eb
cmp esi, 0xffffff9d
je 0x1001f208
movzx ecx, cx
sub ecx, eax
jmp 0x1001f200
xor ecx, ecx
test edi, edi
setne cl
lea ecx, [ecx*2 - 1]
test ecx, ecx
jne 0x1001ebe2
mov edi, dword [ebp + 8]
mov edi, dword [edi + 0xc]
test edi, edi
je 0x1001f26f
or esi, 0xffffffff
mov ebx, str.open
lea ebx, [ebx]
test esi, esi
js 0x1001f22b
mov eax, esi
dec esi
test eax, eax
jle 0x1001f26f
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x14], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
movzx ecx, ax
add esp, 8
mov eax, dword [ebp - 0x14]
cmp ax, cx
jne 0x1001f25e
test ax, ax
je 0x1001f26f
add edi, 2
add ebx, 2
jmp 0x1001f220
test cx, cx
jne 0x1001f268
cmp esi, 0xffffff9d
je 0x1001f26f
movzx eax, ax
sub eax, ecx
jne 0x1001f29a
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
test eax, eax
je 0x1001f29a
push eax
call sym.dopuslib32.dll_FindFileExtensionW
add esp, 4
test eax, eax
je 0x1001f29a
push str..fnd
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1001ebe2
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0xc]
test edi, edi
je 0x1001f3b7
or esi, 0xffffffff
mov ebx, str.opennewwindow
test esi, esi
js 0x1001f2bb
mov eax, esi
dec esi
test eax, eax
jle 0x1001f303
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x14], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
movzx ecx, ax
add esp, 8
mov eax, dword [ebp - 0x14]
cmp ax, cx
jne 0x1001f2ee
test ax, ax
je 0x1001f303
add edi, 2
add ebx, 2
jmp 0x1001f2b0
test cx, cx
jne 0x1001f2f8
cmp esi, 0xffffff9d
je 0x1001f303
movzx eax, ax
sub eax, ecx
jne 0x1001f3b2
mov edi, dword [ebp + 8]
xor bl, bl
cmp dword [edi + 0x24], 0
je 0x1001f3b9
test byte [edi + 4], 4
je 0x1001f3b9
push str.SHGetKnownFolderIDList
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1001f3b9
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0
push 0x100a3650
call eax
test eax, eax
js 0x1001f3b9
lea eax, [ebp - 0x40]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
js 0x1001f39f
mov esi, dword [ebp - 0x44]
mov edx, dword [edi + 0x24]
test esi, esi
jne 0x1001f36f
neg edx
sbb edx, edx
movzx esi, dx
jmp 0x1001f390
test edx, edx
jne 0x1001f378
lea esi, [edx + 1]
jmp 0x1001f390
mov ecx, dword [ebp - 0x40]
push edx
push esi
push 0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1c]
test eax, eax
jns 0x1001f38d
xor esi, esi
jmp 0x1001f390
movzx esi, ax
mov eax, dword [ebp - 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
test si, si
sete bl
push dword [ebp - 0x44]
call dword [sym.imp.SHELL32.dll_ILFree]
test bl, bl
jne 0x1001ebe2
jmp 0x1001f3b9
mov edi, dword [ebp + 8]
jmp 0x1001f3b9
mov edi, eax
push ecx
lea ecx, [ebp - 0x130]
call fcn.1001db00
mov dword [ebp - 4], 0
mov eax, dword [edi + 4]
and al, 5
cmp al, 4
jne 0x1001f46a
mov eax, dword [edi + 0x24]
test eax, eax
je 0x1001f46a
cmp dword [edi + 0x14], 0
jne 0x1001f46a
push 0x100b27cc
push eax
call sym.dopuslib32.dll_PIDLCheckCLSID
add esp, 8
test eax, eax
je 0x1001f46a
test byte [0x100c5cc8], 0xe0
je 0x1001f46a
mov edx, dword [ebp - 0x12c]
xor eax, eax
mov ecx, edx
and ecx, 0x800000
or eax, ecx
jne 0x1001f441
mov eax, dword [ebp - 0x130]
and edx, 0x1000000
and eax, 0x80
cmp eax, 0x80
jne 0x10020308
test edx, edx
jne 0x10020308
push 0
push 0
call sym.dopuslib32.dll_FindOrStartDOpusW
add esp, 8
test eax, eax
je 0x10020308
push 0
push 0
push 0x8162
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x1002033e
mov edi, dword [edi + 0x10]
xor eax, eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x15], al
test edi, edi
je 0x1001f564
mov esi, 6
mov ebx, 0x100b1220
test esi, esi
js 0x1001f492
mov eax, esi
dec esi
test eax, eax
jle 0x1001f4da
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x24], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
movzx ecx, ax
add esp, 8
mov eax, dword [ebp - 0x24]
cmp ax, cx
jne 0x1001f4c5
test ax, ax
je 0x1001f4da
add edi, 2
add ebx, 2
jmp 0x1001f487
test cx, cx
jne 0x1001f4cf
cmp esi, 0xffffff9d
je 0x1001f4da
movzx eax, ax
sub eax, ecx
jne 0x1001f564
mov eax, dword [ebp - 0x130]
and eax, 0x800000
or eax, 0
je 0x10020308
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0xc]
test edi, edi
je 0x1001f553
or esi, 0xffffffff
mov ebx, str.open
test esi, esi
js 0x1001f50b
mov eax, esi
dec esi
test eax, eax
jle 0x1001f553
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x14], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
movzx ecx, ax
add esp, 8
mov eax, dword [ebp - 0x14]
cmp ax, cx
jne 0x1001f53e
test ax, ax
je 0x1001f553
add edi, 2
add ebx, 2
jmp 0x1001f500
test cx, cx
jne 0x1001f548
cmp esi, 0xffffff9d
je 0x1001f553
movzx eax, ax
sub eax, ecx
jne 0x10020308
mov edi, dword [ebp + 8]
xor ebx, ebx
mov al, 1
mov cl, bl
mov esi, dword [edi + 0x10]
jmp 0x10020233
mov eax, dword [ebp - 0x130]
and eax, 0x80
or eax, 0
je 0x10020308
mov edi, dword [ebp + 8]
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x1001f6d9
call fcn.1001e5e0
test eax, eax
je 0x1001f6d9
test byte [0x100c5cc4], 4
mov byte [ebp - 0x16], 1
mov byte [ebp - 0x15], 1
jne 0x100202de
mov esi, dword [edi + 0x14]
test esi, esi
je 0x1001fb2d
movzx eax, word [esi]
cmp eax, 0x22
je 0x1001f5c0
cmp eax, 0x20
jne 0x1001f5c5
add esi, 2
jne 0x1001f5b3
mov edi, 7
mov ebx, str.http:__
test esi, esi
je 0x1001f63c
mov ecx, esi
sub ecx, ebx
mov dword [ebp - 0x2c], ecx
lea ebx, [ebx]
test edi, edi
js 0x1001f5ef
mov eax, edi
dec edi
test eax, eax
jle 0x10020308
movzx eax, word [ecx + ebx]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x24], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
mov ecx, dword [ebp - 0x24]
add esp, 8
movzx eax, ax
cmp cx, ax
jne 0x1001f627
test cx, cx
je 0x10020308
mov ecx, dword [ebp - 0x2c]
add ebx, 2
jmp 0x1001f5e0
test ax, ax
jne 0x1001f635
cmp edi, 0xffffff9d
je 0x10020308
movzx ecx, cx
sub ecx, eax
jmp 0x1001f64a
xor ecx, ecx
test esi, esi
setne cl
lea ecx, [ecx*2 - 1]
test ecx, ecx
je 0x10020308
mov edi, 8
mov ebx, str.https:__
test esi, esi
je 0x1001f6bb
sub esi, ebx
test edi, edi
js 0x1001f671
mov eax, edi
dec edi
test eax, eax
jle 0x10020308
movzx eax, word [esi + ebx]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x24], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
mov ecx, dword [ebp - 0x24]
add esp, 8
movzx eax, ax
cmp cx, ax
jne 0x1001f6a6
test cx, cx
je 0x10020308
add ebx, 2
jmp 0x1001f662
test ax, ax
jne 0x1001f6b4
cmp edi, 0xffffff9d
je 0x10020308
movzx ecx, cx
sub ecx, eax
jmp 0x1001f6c9
xor ecx, ecx
test esi, esi
setne cl
lea ecx, [ecx*2 - 1]
test ecx, ecx
je 0x10020308
mov edi, dword [ebp + 8]
jmp 0x1001fb2d
mov eax, dword [edi + 4]
test al, 3
je 0x1001fa61
cmp dword [edi + 0x2c], 0
je 0x1001fa61
mov edi, dword [edi + 0xc]
test edi, edi
je 0x1001fa5e
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], eax
or esi, 0xffffffff
mov ebx, str.find
lea ecx, [ecx]
test esi, esi
js 0x1001f71b
mov eax, esi
dec esi
test eax, eax
jle 0x1001f763
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x1c], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
movzx ecx, ax
add esp, 8
mov eax, dword [ebp - 0x1c]
cmp ax, cx
jne 0x1001f74e
test ax, ax
je 0x1001f763
add edi, 2
add ebx, 2
jmp 0x1001f710
test cx, cx
jne 0x1001f758
cmp esi, 0xffffff9d
je 0x1001f763
movzx eax, ax
sub eax, ecx
jne 0x1001f7fa
mov eax, dword [ebp + 8]
cmp dword [eax + 0x24], 0
lea esi, [eax + 0x24]
mov dword [ebp - 0x2c], 1
mov edi, esi
je 0x1001fa0c
lea ecx, [ebp - 0x34]
push ecx
push 0x12
push dword [eax + 8]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x1001fa0c
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jne 0x1001f7cb
mov esi, dword [esi]
test esi, esi
jne 0x1001f7d9
mov eax, dword [ebp - 0x34]
neg eax
sbb eax, eax
movzx esi, ax
mov eax, dword [ebp - 0x48]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov edi, dword [ebp + 8]
xor ebx, ebx
test si, si
setne bl
add edi, 0x24
mov dword [ebp - 0x2c], ebx
push dword [ebp - 0x34]
call dword [sym.imp.SHELL32.dll_ILFree]
jmp 0x1001fa02
mov edx, dword [ebp - 0x34]
test edx, edx
jne 0x1001f7e5
lea esi, [edx + 1]
jmp 0x1001f7b1
mov ecx, dword [ebp - 0x48]
push edx
push esi
push 0
mov eax, dword [ecx]
push ecx
call dword [eax + 0x1c]
test eax, eax
jns 0x1001f7ae
xor esi, esi
jmp 0x1001f7b1
mov eax, dword [ebp + 8]
or esi, 0xffffffff
mov ebx, str.explore
mov edi, dword [eax + 0xc]
test edi, edi
je 0x1001f86b
lea esp, [esp]
test esi, esi
js 0x1001f81f
mov eax, esi
dec esi
test eax, eax
jle 0x10020228
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x1c], eax
movzx eax, word [ebx]
push eax
call fcn.10086fcc
mov ecx, dword [ebp - 0x1c]
add esp, 8
movzx eax, ax
cmp cx, ax
jne 0x1001f856
test cx, cx
je 0x10020228
add edi, 2
add ebx, 2
jmp 0x1001f810
test ax, ax
jne 0x1001f864
cmp esi, 0xffffff9d
je 0x10020228
movzx ecx, cx
sub ecx, eax
jmp 0x1001f879
xor ecx, ecx
test edi, edi
setne cl
lea ecx, [ecx*2 - 1]
test ecx, ecx
je 0x10020228
push 0x208
lea eax, [ebp - 0x544]
push 0
push eax
call fcn.1007cff0
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x544]
push dword [ebx + 0xc]
push str.shell_scommand
push 0x104
push eax
call fcn.1000b000
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x50]
add esp, 0x1c
push eax
push 0x20019
push 0
lea eax, [ebp - 0x544]
push eax
push dword [ebx + 0x2c]
call edi
test eax, eax
jne 0x1002029b
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0xd64]
mov dword [ebp - 0x38], 0x104
push eax
push 0
push 0
push 0
push dword [ebp - 0x50]
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x1001f9f7
lea ecx, [ebp - 0xd64]
call fcn.1001e5e0
mov dword [ebp - 0x24], eax
test eax, eax
je 0x1001f9f7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], 1
push dword [eax + 0xc]
lea eax, [ebp - 0x544]
push str.shell_sddeexec
push 0x104
push eax
call fcn.1000b000
add esp, 0x10
lea eax, [ebp - 0x4c]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x544]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x2c]
call edi
test eax, eax
jne 0x1001f9f7
lea eax, [ebp - 0x38]
mov dword [ebp - 0x38], 0x104
push eax
lea eax, [ebp - 0x544]
push eax
push 0
push 0
push 0
push dword [ebp - 0x4c]
call esi
test eax, eax
jne 0x1001f9f2
mov esi, 0xa
xor edi, edi
nop
test esi, esi
js 0x1001f99b
mov eax, esi
dec esi
test eax, eax
jle 0x1001f9e0
movzx eax, word [ebp + edi - 0x544]
push eax
call fcn.10086fcc
movzx ebx, ax
movzx eax, word [edi + str._ShellFile]
push eax
call fcn.10086fcc
movzx eax, ax
add esp, 8
cmp bx, ax
jne 0x1001f9ce
test bx, bx
je 0x1001f9e0
add edi, 2
jmp 0x1001f990
test ax, ax
jne 0x1001f9d8
cmp esi, 0xffffff9d
je 0x1001f9e0
mov ecx, eax
mov eax, ebx
sub eax, ecx
jne 0x1001f9ec
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x4c]
call ebx
push dword [ebp - 0x50]
call ebx
mov edi, dword [ebp + 8]
add edi, 0x24
cmp dword [ebp - 0x2c], 0
je 0x10020228
mov eax, dword [edi]
mov dword [ebp - 0x20], eax
test eax, eax
jne 0x10020228
mov ebx, dword [ebp - 0x24]
test ebx, ebx
je 0x10020228
movzx eax, word [ebx]
mov edx, eax
test ax, ax
je 0x1001fa49
mov ecx, eax
movzx edx, cx
cmp cx, 0x20
je 0x1001fa49
movzx eax, word [ebx + 2]
add ebx, 2
mov ecx, eax
mov edx, eax
test ax, ax
jne 0x1001fa30
mov edi, dword [ebp + 8]
cmp dx, 0x20
jne 0x1001fb30
add ebx, 2
jmp 0x1001fb30
mov edi, dword [ebp + 8]
and al, 5
cmp al, 4
jne 0x1001fd84
mov esi, dword [edi + 0x24]
test esi, esi
je 0x1001fd84
push 0x2b4
lea eax, [ebp - 0x1220]
push 0
push eax
call fcn.1007cff0
add esp, 0xc
mov dword [ebp - 0x1218], 0x20000000
lea eax, [ebp - 0x1220]
push 0x20808
push 0x2b4
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x1001fad1
test dword [ebp - 0x1218], 0x20000000
je 0x1001fad1
mov eax, dword [edi + 0x24]
xor ebx, ebx
mov dword [ebp - 0x20], eax
mov cl, 1
mov al, bl
jmp 0x10020231
cmp dword [edi + 0x14], 0
je 0x1002022b
push 0x208
lea eax, [ebp - 0xf6c]
push 0
push eax
call fcn.1007cff0
add esp, 0xc
lea eax, [ebp - 0xf6c]
push eax
push dword [edi + 0x24]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x1002022b
lea ecx, [ebp - 0xf6c]
call fcn.1001e5e0
test eax, eax
je 0x1002022b
test byte [0x100c5cc4], 4
mov byte [ebp - 0x16], 1
jne 0x100202de
mov ebx, dword [edi + 0x14]
test ebx, ebx
je 0x1002022b
cmp word [ebx], 0
je 0x1002022b
push 0x208
lea eax, [ebp - 0x74c]
push 0
push eax
call fcn.1007cff0
push 0x208
lea eax, [ebp - 0x954]
push 0
push eax
call fcn.1007cff0
push 0x104
lea eax, [ebp - 0x954]
mov dword [ebp - 0x54], 0
push eax
push 0x104
lea eax, [ebp - 0x74c]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
call sym.dopuslib32.dll_ParseExplorerCmdLine
add esp, 0x30
test eax, eax
je 0x1002022b
mov ax, word [ebp - 0x74c]
mov dword [ebp - 0x30], 0
test ax, ax
je 0x1001fbba
lea esi, [ebp - 0x74c]
movzx eax, ax
jmp 0x1001fbc7
movzx eax, word [ebp - 0x954]
lea esi, [ebp - 0x954]
cmp ax, 0x22
jne 0x1001fc16
lea eax, [ebp - 0x74c]
lea edi, [ebp - 0x954]
cmp esi, eax
je 0x1001fbdf
mov edi, eax
add esi, 2
jne 0x1001fbeb
xor eax, eax
mov word [edi], ax
jmp 0x1001fbfa
push ecx
push esi
push ecx
mov edx, 0x104
mov ecx, edi
call fcn.1000aea0
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1001fc14
cmp word [edi + eax*2 - 2], 0x22
jne 0x1001fc14
xor ecx, ecx
mov word [edi + eax*2 - 2], cx
mov esi, edi
cmp byte [ebp - 0x15], 0
mov ebx, dword [ebp - 0x54]
je 0x1001fc3e
test bl, 8
jne 0x1001fc3e
cmp word [esi], 0
je 0x1001fc64
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1001fc3e
test al, 0x10
je 0x10020308
cmp word [esi], 0
je 0x1001fc64
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x3a
jne 0x1001fc64
push 0x100b0dec
mov edx, 0x104
mov ecx, esi
call fcn.1000ac90
test bl, 8
je 0x1001fccb
push esi
call sym.dopuslib32.dll_FindFilePartW
mov edi, eax
add esp, 4
test edi, edi
je 0x1001fccb
cmp edi, esi
jbe 0x1001fccb
lea ecx, [ebp - 0xb5c]
mov ebx, edi
mov eax, ecx
mov edx, 0x104
sub ebx, eax
lea ecx, [ecx]
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x1001fcb7
movzx eax, word [ecx + ebx]
test ax, ax
je 0x1001fcb0
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x1001fc90
jmp 0x1001fcb4
test edx, edx
jne 0x1001fcb7
sub ecx, 2
xor eax, eax
cmp word [edi - 2], 0x5c
mov word [ecx], ax
jne 0x1001fcc6
add edi, 0xfffffffe
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jne 0x10020228
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001fce2
mov edi, dword [ebp + 8]
sub ecx, edx
sar ecx, 1
cmp ecx, 0x2328
jae 0x1001fd17
mov ecx, dword [ebp - 0x30]
lea edx, [ebp - 0x20]
push 0
push edx
push 0
mov eax, dword [ecx]
push esi
push 0
push dword [edi + 8]
push ecx
call dword [eax + 0xc]
test eax, eax
je 0x1001fd69
mov edx, dword [edi + 0x18]
lea eax, [ebp - 0x33c]
push ecx
push eax
mov ecx, esi
call fcn.1001e4d0
mov edx, eax
add esp, 8
cmp edx, esi
je 0x1001fd70
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1001fd37
sub ecx, esi
sar ecx, 1
cmp ecx, 0x2328
jae 0x1001fd70
mov ecx, dword [ebp - 0x30]
lea esi, [ebp - 0x20]
push 0
push esi
push 0
mov eax, dword [ecx]
push edx
push 0
push dword [edi + 8]
push ecx
call dword [eax + 0xc]
test eax, eax
jne 0x1001fd70
mov dword [ebp - 0x14], 1
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ebx, dword [ebp - 0x14]
mov al, byte [ebp - 0xd]
jmp 0x1002022f
mov ebx, dword [edi + 0x10]
test ebx, ebx
je 0x1002022b
cmp word [ebx], 0
je 0x1002022b
push 7
push str.file:__
push ebx
mov dword [ebp - 0x3c], 0
mov esi, ebx
mov byte [ebp - 0x15], 0
call fcn.10086bcc
add esp, 0xc
test eax, eax
jne 0x1001fdca
add ebx, 0xe
cmp word [ebx], 0x2f
jne 0x1001fdc6
lea ebx, [esi + 0x10]
mov byte [ebp - 0x15], 1
mov esi, 6
mov edi, str.shell:
test ebx, ebx
je 0x1001fe3c
mov ecx, ebx
sub ecx, edi
mov dword [ebp - 0x14], ecx
nop
test esi, esi
js 0x1001fdef
mov eax, esi
dec esi
test eax, eax
jle 0x100201c3
movzx eax, word [edi + ecx]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x1c], eax
movzx eax, word [edi]
push eax
call fcn.10086fcc
mov ecx, dword [ebp - 0x1c]
add esp, 8
movzx eax, ax
cmp cx, ax
jne 0x1001fe27
test cx, cx
je 0x100201c3
mov ecx, dword [ebp - 0x14]
add edi, 2
jmp 0x1001fde0
test ax, ax
jne 0x1001fe35
cmp esi, 0xffffff9d
je 0x100201c3
movzx ecx, cx
sub ecx, eax
jmp 0x1001fe4a
xor ecx, ecx
test ebx, ebx
setne cl
lea ecx, [ecx*2 - 1]
test ecx, ecx
je 0x100201c3
mov esi, 3
mov edi, 0x100b12d4
test ebx, ebx
je 0x1001fec3
mov ecx, ebx
sub ecx, edi
mov dword [ebp - 0x14], ecx
test esi, esi
js 0x1001fe76
mov eax, esi
dec esi
test eax, eax
jle 0x100201c3
movzx eax, word [edi + ecx]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x1c], eax
movzx eax, word [edi]
push eax
call fcn.10086fcc
mov ecx, dword [ebp - 0x1c]
add esp, 8
movzx eax, ax
cmp cx, ax
jne 0x1001feae
test cx, cx
je 0x100201c3
mov ecx, dword [ebp - 0x14]
add edi, 2
jmp 0x1001fe67
test ax, ax
jne 0x1001febc
cmp esi, 0xffffff9d
je 0x100201c3
movzx ecx, cx
sub ecx, eax
jmp 0x1001fed1
xor ecx, ecx
test ebx, ebx
setne cl
lea ecx, [ecx*2 - 1]
test ecx, ecx
je 0x100201c3
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0xc]
test edi, edi
je 0x1002029f
or esi, 0xffffffff
mov dword [ebp - 0x14], str.open
test esi, esi
js 0x1001ff00
mov eax, esi
dec esi
test eax, eax
jle 0x1001ffd1
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
push eax
call fcn.10086fcc
movzx ecx, ax
add esp, 8
mov eax, dword [ebp - 0x1c]
cmp ax, cx
jne 0x1001ff3b
test ax, ax
je 0x1001ffd1
add edi, 2
add dword [ebp - 0x14], 2
jmp 0x1001fef1
test cx, cx
jne 0x1001ff49
cmp esi, 0xffffff9d
je 0x1001ffd1
movzx eax, ax
sub eax, ecx
je 0x1001ffd1
mov eax, dword [ebp + 8]
or esi, 0xffffffff
mov dword [ebp - 0x14], str.explore
mov edi, dword [eax + 0xc]
test edi, edi
je 0x1001ffbb
test esi, esi
js 0x1001ff73
mov eax, esi
dec esi
test eax, eax
jle 0x1001ffd1
movzx eax, word [edi]
push eax
call fcn.10086fcc
movzx eax, ax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, word [eax]
push eax
call fcn.10086fcc
mov ecx, dword [ebp - 0x1c]
add esp, 8
movzx eax, ax
cmp cx, ax
jne 0x1001ffaa
test cx, cx
je 0x1001ffd1
add edi, 2
add dword [ebp - 0x14], 2
jmp 0x1001ff68
test ax, ax
jne 0x1001ffb4
cmp esi, 0xffffff9d
je 0x1001ffd1
movzx ecx, cx
sub ecx, eax
jmp 0x1001ffc9
xor ecx, ecx
test edi, edi
setne cl
lea ecx, [ecx*2 - 1]
test ecx, ecx
jne 0x10020228
cmp byte [ebp - 0x15], 0
je 0x10020184
test ebx, ebx
jne 0x1001ffea
xor eax, eax
mov word [ebp - 0x33c], ax
jmp 0x10020033
lea ecx, [ebp - 0x33c]
mov edx, 0x105
mov eax, ecx
sub ebx, eax
lea esp, [esp]
lea eax, [edx + 0x7ffffef9]
test eax, eax
je 0x10020027
movzx eax, word [ecx + ebx]
test ax, ax
je 0x10020020
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10020000
jmp 0x10020024
test edx, edx
jne 0x10020027
sub ecx, 2
xor eax, eax
mov word [ecx], ax
mov ax, word [ebp - 0x33c]
lea edi, [ebp - 0x33c]
mov ecx, edi
test ax, ax
je 0x10020179
movzx edx, ax
jmp 0x10020050
cmp dx, 0x25
jne 0x10020154
movzx eax, word [ecx + 2]
cmp eax, 0x30
jb 0x10020068
cmp eax, 0x39
jbe 0x1002007f
cmp eax, 0x61
jb 0x10020072
cmp eax, 0x66
jbe 0x1002007f
add eax, 0xffffffbf
cmp ax, 5
ja 0x10020154
movzx eax, word [ecx + 4]
cmp eax, 0x30
jb 0x1002008d
cmp eax, 0x39
jbe 0x100200a4
cmp eax, 0x61
jb 0x10020097
cmp eax, 0x66
jbe 0x100200a4
add eax, 0xffffffbf
cmp ax, 5
ja 0x10020154
movzx edx, word [ecx + 2]
lea eax, [edx - 0x30]
movzx esi, ax
cmp ax, 9
ja 0x100200b8
mov edx, esi
jmp 0x100200df
lea eax, [edx - 0x61]
cmp ax, 5
ja 0x100200c9
lea eax, [edx - 0x57]
movzx edx, ax
jmp 0x100200df
lea eax, [edx - 0x41]
cmp ax, 5
ja 0x100200da
lea eax, [edx - 0x37]
movzx edx, ax
jmp 0x100200df
mov edx, 0xff
movzx esi, word [ecx + 4]
lea eax, [esi - 0x30]
movzx ebx, ax
cmp ax, 9
ja 0x10020101
mov eax, ebx
shl edx, 4
or edx, eax
add ecx, 4
movzx eax, dl
mov word [edi], ax
jmp 0x1002015b
lea eax, [esi - 0x61]
cmp ax, 5
ja 0x10020120
lea eax, [esi - 0x57]
shl edx, 4
movzx eax, ax
or edx, eax
add ecx, 4
movzx eax, dl
mov word [edi], ax
jmp 0x1002015b
lea eax, [esi - 0x41]
cmp ax, 5
ja 0x1002013f
lea eax, [esi - 0x37]
shl edx, 4
movzx eax, ax
or edx, eax
add ecx, 4
movzx eax, dl
mov word [edi], ax
jmp 0x1002015b
mov eax, 0xff
shl edx, 4
or edx, eax
add ecx, 4
movzx eax, dl
mov word [edi], ax
jmp 0x1002015b
cmp edi, ecx
jae 0x1002015b
mov word [edi], dx
movzx eax, word [ecx + 2]
add ecx, 2
add edi, 2
mov edx, eax
test ax, ax
jne 0x10020050
cmp edi, ecx
jae 0x10020179
xor eax, eax
mov word [edi], ax
mov edi, dword [ebp + 8]
lea esi, [ebp - 0x33c]
jmp 0x1002019e
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x33c]
push ecx
push eax
mov ecx, ebx
mov edx, dword [edi + 0x18]
call fcn.1001e4d0
add esp, 8
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100201b9
test al, 0x10
je 0x100201b9
xor ebx, ebx
mov cl, 1
mov al, bl
jmp 0x10020233
xor esi, esi
xor ebx, ebx
mov al, bl
mov cl, al
jmp 0x10020233
mov ecx, ebx
mov dword [ebp - 0x28], 0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100201d0
sub ecx, edx
sar ecx, 1
cmp ecx, 0x2328
jae 0x10020228
lea eax, [ebp - 0x28]
push eax
push 0x20000000
lea eax, [ebp - 0x3c]
push eax
push 0
push ebx
call dword [sym.imp.SHELL32.dll_SHParseDisplayName]
test eax, eax
js 0x10020228
test dword [ebp - 0x28], 0x20000000
je 0x1002021f
mov eax, dword [ebp - 0x3c]
mov cl, 1
mov edi, dword [ebp + 8]
mov ebx, 1
mov dword [ebp - 0x20], eax
mov al, byte [ebp - 0xd]
jmp 0x10020231
push dword [ebp - 0x3c]
call dword [sym.imp.SHELL32.dll_ILFree]
mov edi, dword [ebp + 8]
xor ebx, ebx
mov al, bl
mov cl, al
xor esi, esi
cmp dword [ebp - 0x20], 0
jne 0x100202a3
test esi, esi
jne 0x100202a3
test cl, cl
je 0x10020308
mov esi, dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [ebp - 0x16], 0
mov dword [0x100c8020], eax
mov dword [0x100c8024], esi
je 0x10020308
mov eax, dword [0x100c72d8]
test eax, eax
je 0x10020308
push 0xffffffffffffffff
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
push dword [0x100c72d8]
mov eax, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [0x100c8028], 1
call eax
mov esi, 1
jmp 0x10020340
mov edi, ebx
jmp 0x1002022b
mov edi, eax
jmp 0x1002022b
test al, al
jne 0x1002030f
push dword [ebp - 0x20]
push esi
call sym.dopuslib32.dll_Ordinal_42
add esp, 8
test eax, eax
jne 0x1002030f
test ebx, ebx
je 0x100202c4
push dword [ebp - 0x20]
call dword [sym.imp.SHELL32.dll_ILFree]
mov esi, dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp byte [ebp - 0x16], 0
mov dword [0x100c8020], eax
mov dword [0x100c8024], esi
je 0x10020308
mov eax, dword [0x100c72d8]
test eax, eax
je 0x10020308
push 0xffffffffffffffff
push eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
push dword [0x100c72d8]
mov eax, dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov dword [0x100c8028], 1
call eax
mov esi, 1
jmp 0x10020340
mov edx, dword [edi + 8]
lea eax, [ebp - 0xb5c]
push eax
push dword [edi + 4]
xor ecx, ecx
push ebx
push dword [ebp - 0x20]
push esi
push dword [edi + 0xc]
call fcn.10020370
add esp, 0x18
mov dword [edi + 0x20], eax
test ebx, ebx
je 0x1002033e
push dword [ebp - 0x20]
call dword [sym.imp.SHELL32.dll_ILFree]
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x130]
call fcn.1000b990
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4