Function at 0x10042d60
Capabilities:
Check if file exists
Copy file
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100a1284
mov eax, dword fs:[0]
push eax
sub esp, 0x598
mov eax, dword [0x100d07a8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4a8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x498], eax
call fcn.100689b0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10042f0b
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonpop_popexpoppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], al
call fcn.1000a260
push 3
push 0x100a680c
lea ecx, [ebp - 0x480]
mov dword [ebp - 4], 0
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0xf
mov byte [ebp - 0x480], 0
call fcn.1000a260
mov byte [ebp - 4], 1
call fcn.100689b0
mov edi, eax
lea ecx, [ebp - 0x5a4]
push 0xb2
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x480]
push eax
call fcn.10004790
mov esi, eax
push str.ExpRunTrayIconDllEx_enter__do_old_
push esi
mov byte [ebp - 4], 2
call fcn.10005a70
add esp, 8
mov ecx, esi
push dword [ebp + 0x10]
call fcn.10005710
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x5a4]
call fcn.10005bc0
mov edx, dword [ebp - 0x46c]
mov byte [ebp - 4], 0
cmp edx, 0x10
jb 0x10042eaf
mov ecx, dword [ebp - 0x480]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10042ea5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10044955
push edx
push ecx
call fcn.1006a15b
add esp, 8
mov edx, dword [ebp - 0x454]
mov dword [ebp - 0x470], 0
mov dword [ebp - 0x46c], 0xf
mov byte [ebp - 0x480], 0
mov dword [ebp - 4], 0xffffffff
cmp edx, 0x10
jb 0x10042f0b
mov ecx, dword [ebp - 0x468]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x10042f01
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1004495a
push edx
push ecx
call fcn.1006a15b
add esp, 8
push 0x2a
push dword [ebp - 0x498]
call fcn.10075c7f
add esp, 8
test eax, eax
je 0x10042f28
add eax, 2
mov dword [ebp - 0x498], eax
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x1004495f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x494], eax
push str.ExpRunTrayIconDll
lea ecx, [ebp - 0x494]
mov dword [ebp - 4], 3
call fcn.10003580
test al, al
jne 0x10042f74
push 0x11
push str.ExpRunTrayIconDll
lea ecx, [ebp - 0x494]
call fcn.10003220
mov dword [ebp - 4], 4
mov dword [ebp - method.LdsCommon::CMyLdsLogger.virtual_0], vtable.LdsCommon::CMyLdsLogger.0
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x10044969
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x478], eax
mov byte [ebp - 4], 5
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x10044973
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x474], eax
mov byte [ebp - 4], 6
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x1004497d
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x470], eax
mov byte [ebp - 4], 7
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x10044987
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x46c], eax
lea eax, [ebp - 0x494]
mov byte [ebp - 4], 8
push eax
lea ecx, [ebp - 0x478]
call fcn.10003470
lea ecx, [ebp - 0x470]
call fcn.100164e0
push 3
push 0x100ad4a4
lea ecx, [ebp - 0x474]
call fcn.10003220
mov edx, dword [ebp - 0x494]
or edi, 0xffffffff
mov byte [ebp - 4], 0xa
add edx, 0xfffffff0
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10043064
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x10044991
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4b4], eax
mov byte [ebp - 4], 0xb
call fcn.10011650
test eax, eax
je 0x10043110
call fcn.10011850
lea eax, [ebp - 0x450]
push eax
call fcn.1000fd00
add esp, 4
cmp dword [ebp - 0x43c], 8
lea edx, [ebp - 0x450]
mov byte [ebp - 4], 0xc
jb 0x100430c9
mov edx, dword [ebp - 0x450]
test edx, edx
jne 0x100430c9
xor ecx, ecx
jmp 0x100430df
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100430d0
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4b4]
call fcn.10003220
push dword [ebp - 0x4b4]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0xb
call fcn.100051b0
jmp 0x10043162
push 0x104
lea eax, [ebp - 0x420]
push eax
push dword [0x100d32e4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10043140
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x4b4]
call fcn.10003220
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x1004499b
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4a4], eax
push 0x100ad758
lea ecx, [ebp - 0x4a4]
mov byte [ebp - 4], 0xd
call fcn.10003580
test al, al
jne 0x100431ab
push 1
push 0x100ad758
lea ecx, [ebp - 0x4a4]
call fcn.10003220
mov byte [ebp - 4], 0xe
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x100449a5
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4b0], eax
push 0x100ad75c
lea eax, [ebp - 0x4b4]
mov byte [ebp - 4], 0xf
push eax
lea eax, [ebp - 0x4bc]
push eax
call fcn.1000e630
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 0x10
push str.AOXkC_dksstng3wq4imjZg
push eax
mov dword [ebp - 0x490], 1
mov dword [ebp - 0x484], 0
call fcn.1000ffb0
cmp dword [ebp - 0x424], 8
lea ecx, [ebp - 0x484]
lea eax, [ebp - 0x438]
mov byte [ebp - 4], 0x11
cmovae eax, dword [ebp - 0x438]
push ecx
push eax
call fcn.10012290
mov esi, eax
mov dword [ebp - 0x484], 0
lea eax, [ebp - 0x468]
push str.bcD0uhDtwqTS8M2HubIiFw
push eax
call fcn.1000ffb0
cmp dword [ebp - 0x454], 8
lea eax, [ebp - 0x484]
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x12
cmovae ecx, dword [ebp - 0x468]
push eax
push ecx
call fcn.10012290
add esp, 0x2c
test esi, esi
jne 0x10043285
test eax, eax
je 0x100432c7
mov esi, dword [ebp - 0x4a8]
mov ecx, dword [esi + 0x38]
test ecx, ecx
je 0x100432cd
call fcn.10041d70
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.10084802
add esp, 4
call fcn.100847e1
cdq
mov ecx, 0x64
idiv ecx
xor ecx, ecx
mov eax, 1
cmp edx, esi
cmovge eax, ecx
mov dword [ebp - 0x490], eax
mov esi, dword [ebp - 0x4a8]
mov edx, dword [ebp - 0x454]
mov byte [ebp - 4], 0x11
cmp edx, 8
jb 0x10043311
mov ecx, dword [ebp - 0x468]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10043307
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100449af
push edx
push ecx
call fcn.1006a15b
add esp, 8
mov edx, dword [ebp - 0x424]
xor eax, eax
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 7
mov word [ebp - 0x468], ax
mov byte [ebp - 4], 0x10
cmp edx, 8
jb 0x10043372
mov ecx, dword [ebp - 0x438]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x10043368
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100449b4
push edx
push ecx
call fcn.1006a15b
add esp, 8
cmp dword [ebp - 0x490], 0
je 0x100435f1
lea eax, [ebp - 0x490]
push 1
push eax
call fcn.1005d1b0
push dword [ebp + 0x10]
lea eax, [ebp - 0x48c]
mov byte [ebp - 4], 0x13
push eax
lea eax, [ebp - 0x4b0]
mov dword [ebp - 0x48c], 0
push eax
lea eax, [ebp - 0x4b4]
push eax
push str.rd_pop_ex
push dword [ebp - 0x490]
call fcn.100110d0
add esp, 0x20
cmp dword [esi + 0x38], 0
je 0x10043528
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x100449b9
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x484], eax
push dword [ebp - 0x4b0]
mov ecx, dword [esi + 0x38]
mov byte [ebp - 4], 0x14
call fcn.100244f0
push eax
lea eax, [ebp - 0x484]
push str.taskid:_d_strRundllTmpFileLink:_s
push eax
call fcn.10002ef0
add esp, 0x10
call fcn.100689b0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov esi, dword [ebp - 0x484]
movzx eax, al
sub eax, 1
jne 0x1004350d
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonpop_popexpoppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
call fcn.1000a260
push 3
push 0x100a680c
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x15
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000a260
mov byte [ebp - 4], 0x16
call fcn.100689b0
mov dword [ebp - 0x4b8], eax
lea ecx, [ebp - 0x5a4]
push 0xd6
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.10004790
mov edi, eax
test esi, esi
mov byte [ebp - 4], 0x17
mov ecx, 0x100a68c0
cmovne ecx, esi
push ecx
push edi
call fcn.10003800
mov ecx, dword [ebp - 0x4b8]
add esp, 8
mov eax, dword [ecx]
push edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x5a4]
call fcn.10005bc0
lea ecx, [ebp - 0x438]
call fcn.10002b00
lea ecx, [ebp - 0x468]
call fcn.10002b00
or edi, 0xffffffff
mov byte [ebp - 4], 0x13
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10043528
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
cmp dword [ebp + 0x10], 0
lea eax, [ebp - 0x420]
je 0x1004353b
push str.RunDll.exe
jmp 0x10043540
push str.RunDll_New.exe
push eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendW]
call eax
push 0
push dword [ebp - 0x4b0]
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x100435aa
mov esi, dword [ebp - 0x4b0]
lea ecx, [ebp - 0x420]
mov eax, ecx
mov edx, 0x104
sub esi, eax
lea eax, [edx + 0x7ffffefa]
test eax, eax
je 0x10043594
movzx eax, word [esi + ecx]
test ax, ax
je 0x10043594
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x10043576
test edx, edx
lea eax, [ecx - 2]
push 5
cmovne eax, ecx
xor ecx, ecx
push str._hdok
mov word [eax], cx
jmp 0x100435bc
lea ecx, [ebp - 0x4b0]
call fcn.100164e0
push 7
push str._hdfail
lea ecx, [ebp - 0x4a4]
call fcn.10014f90
mov edx, dword [ebp - 0x490]
mov eax, edi
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10043722
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
jmp 0x10043722
cmp dword [esi + 0x38], 0
je 0x100436fd
call fcn.100689b0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x100436fd
mov ecx, dword [esi + 0x38]
call fcn.100244f0
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonpop_popexpoppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x48c], eax
mov dword [ebp - 0x458], 0
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], 0
call fcn.1000a260
push 3
push 0x100a680c
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x18
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000a260
mov byte [ebp - 4], 0x19
call fcn.100689b0
mov edi, eax
lea ecx, [ebp - 0x5a4]
push 0xe7
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.10004790
mov esi, eax
push str.taskid:_d_no_rand_trayicon
push esi
mov byte [ebp - 4], 0x1a
call fcn.10003800
add esp, 8
mov ecx, esi
push dword [ebp - 0x48c]
call fcn.10005710
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x5a4]
call fcn.10005bc0
lea ecx, [ebp - 0x438]
call fcn.10002b00
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x10
call fcn.10002b00
or edi, 0xffffffff
push str.rundll.exe
lea eax, [ebp - 0x420]
push eax
mov eax, dword [sym.imp.SHLWAPI.dll_PathAppendW]
call eax
push 7
push str._hdnone
lea ecx, [ebp - 0x4a4]
call fcn.10014f90
lea eax, [ebp - 0x420]
push eax
call fcn.1004c350
add esp, 4
test eax, eax
jne 0x10043757
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x47c]
push str.fail_check_sign_s
push eax
call fcn.10042b80
add esp, 0xc
xor esi, esi
jmp 0x1004489f
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x100449c3
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4a0], eax
push dword [ebp - 0x498]
lea eax, [ebp - 0x4a0]
mov byte [ebp - 4], 0x1b
push str.RunTrayIcon
push dword [ebp - 0x4bc]
push str.__dll__s____entry_s__s
push eax
call fcn.10002ef0
add esp, 0x14
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x100449cd
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4ac], eax
push str.2C270724_DF0A_41F7_A928_B3A65925D396
lea ecx, [ebp - 0x4ac]
mov byte [ebp - 4], 0x1c
call fcn.10003580
test al, al
jne 0x100437e8
push 0x26
push str.2C270724_DF0A_41F7_A928_B3A65925D396
lea ecx, [ebp - 0x4ac]
call fcn.10003220
cmp dword [ebp + 0x10], 0
mov byte [ebp - 4], 0x1d
jne 0x1004384b
lea eax, [ebp - 0x450]
push 0x20
push eax
call fcn.10010e80
add esp, 8
mov edx, eax
cmp dword [edx + 0x14], 8
mov byte [ebp - 4], 0x1e
jb 0x10043811
mov edx, dword [edx]
test edx, edx
jne 0x10043819
xor ecx, ecx
jmp 0x1004382f
mov ecx, edx
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10043820
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4ac]
call fcn.10003220
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x1d
call fcn.100051b0
lea eax, [ebp - 0x4ac]
push eax
lea eax, [ebp - 0x4a0]
push eax
lea eax, [ebp - 0x4c4]
push eax
call fcn.1004fd90
add esp, 0xc
mov byte [ebp - 4], 0x1f
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x100449d7
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x494], eax
push str.940513FC_AF92_41C8_89EC_8371DF5938D4
push dword [ebp - 0x4ac]
lea eax, [ebp - 0x420]
mov byte [ebp - 4], 0x20
push dword [ebp - 0x4c4]
push eax
lea eax, [ebp - 0x494]
push str.__s____et_s___yek_s___mod_s___D6FBCCE039A5477EBDCD07660C8B8B30025381AF0C6D42119BBC9A469EC289A3
push eax
call fcn.10002ef0
mov ecx, dword [ebp - 0x4a8]
add esp, 0x18
mov dword [ebp - 0x490], 0
mov ecx, dword [ecx + 0x38]
call fcn.100244f0
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x48c]
push eax
call fcn.10029780
mov ecx, eax
call fcn.10024aa0
call fcn.100689b0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x100439ec
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonpop_popexpoppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x468]
mov dword [ebp - 0x458], eax
mov dword [ebp - 0x454], 0xf
mov byte [ebp - 0x468], al
call fcn.1000a260
push 3
push 0x100a680c
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x21
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000a260
mov byte [ebp - 4], 0x22
call fcn.100689b0
mov dword [ebp - 0x48c], eax
lea ecx, [ebp - 0x5a4]
push 0x10e
lea eax, [ebp - 0x468]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.10004790
mov edi, eax
push str.ExpRunTrayIconDll_ExplorerPrivilegeProcess__encrypt_cmd:
push edi
mov byte [ebp - 4], 0x23
call fcn.10005a70
mov esi, dword [ebp - 0x494]
mov ecx, 0x100a68c0
test esi, esi
cmovne ecx, esi
push ecx
push edi
call fcn.10003800
mov ecx, dword [ebp - 0x48c]
add esp, 0x10
mov eax, dword [ecx]
push edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x5a4]
call fcn.10005bc0
lea ecx, [ebp - 0x438]
call fcn.10002b00
lea ecx, [ebp - 0x468]
mov byte [ebp - 4], 0x20
call fcn.10002b00
jmp 0x100439f2
mov esi, dword [ebp - 0x494]
cmp dword [esi - 4], 1
jle 0x10043a0c
push dword [esi - 0xc]
lea ecx, [ebp - 0x494]
call fcn.10002e70
mov esi, dword [ebp - 0x494]
xorps xmm0, xmm0
mov dword [ebp - 0x488], 0
xor eax, eax
movlpd qword [ebp - 0x508], xmm0
mov word [ebp - 0x4ca], ax
mov eax, 1
movlpd qword [ebp - 0x500], xmm0
movlpd qword [ebp - 0x4f8], xmm0
movlpd qword [ebp - 0x4f0], xmm0
movlpd qword [ebp - 0x4e8], xmm0
movlpd qword [ebp - 0x4da], xmm0
movlpd qword [ebp - 0x4d2], xmm0
movups xmmword [ebp - 0x460], xmm0
mov dword [ebp - 0x50c], 0x44
mov dword [ebp - 0x4e0], 0x81
mov word [ebp - 0x4dc], ax
call fcn.10016ae0
mov dword [ebp - 0x484], eax
test eax, eax
je 0x10043b25
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x10043ab8
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x10043b1c
push str.CreateProcessWithTokenW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10043b1c
lea ecx, [ebp - 0x460]
push ecx
lea ecx, [ebp - 0x50c]
push ecx
push 0
push 0
push 0
push esi
mov esi, dword [ebp - 0x484]
push 0
push 0
push esi
call eax
test eax, eax
je 0x10043b22
cmp dword [ebp - 0x460], 0
je 0x10043b22
mov eax, dword [ebp - 0x45c]
test eax, eax
je 0x10043b22
push eax
call edi
mov eax, dword [ebp - 0x460]
mov dword [ebp - 0x490], eax
mov dword [ebp - 0x488], 1
jmp 0x10043b22
mov esi, dword [ebp - 0x484]
push esi
call edi
mov eax, dword [ebp - 0x4a0]
push dword [eax - 8]
push eax
call fcn.1007b3b9
mov edx, eax
add esp, 8
test edx, edx
js 0x1004494b
mov ecx, dword [ebp - 0x4a0]
cmp edx, dword [ecx - 8]
jg 0x1004494b
mov dword [ecx - 0xc], edx
xor ecx, ecx
mov eax, dword [ebp - 0x4a0]
mov word [eax + edx*2], cx
call fcn.100689b0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10043c55
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonpop_popexpoppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x450]
mov dword [ebp - 0x440], eax
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], al
call fcn.1000a260
push 3
push 0x100a680c
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x24
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000a260
mov byte [ebp - 4], 0x25
call fcn.100689b0
mov edi, eax
lea ecx, [ebp - 0x5a4]
push 0x113
lea eax, [ebp - 0x450]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.10004790
mov esi, eax
push str.ExpRunTrayIconDll_ExplorerPrivilegeProcess__cmd:
push esi
mov byte [ebp - 4], 0x26
call fcn.10005a70
mov ecx, dword [ebp - 0x4a0]
mov edx, 0x100a68c0
test ecx, ecx
cmovne edx, ecx
push edx
push esi
call fcn.10003800
mov eax, dword [edi]
add esp, 0x10
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x5a4]
call fcn.10005bc0
lea ecx, [ebp - 0x438]
call fcn.10002b00
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x20
call fcn.10002b00
mov esi, dword [ebp - 0x488]
test esi, esi
je 0x10043e67
mov edi, dword [ebp - 0x490]
test edi, edi
je 0x10043c95
mov eax, dword [ebp - 0x4a8]
mov ecx, dword [eax + 0x38]
call fcn.100244f0
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x48c]
push edi
push eax
call fcn.10029780
mov ecx, eax
call fcn.10024c40
or edi, 0xffffffff
test esi, esi
jne 0x100446e1
push 0x208
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.10075650
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0x10000000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov edi, dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call edi
push str.lpiHpSvc.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
jne 0x10043d2d
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call edi
push str.lpiWpSvc.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
jne 0x10043d5e
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call edi
push str.lpiTmSvc.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
jne 0x10043d8f
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call edi
push str.lpiCmSvc.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
jne 0x10043dc0
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call edi
push str.lpiMYNovelSvc.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
jne 0x10043df1
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call edi
push str.lpiHaloSvc.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
jne 0x10043e22
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call edi
push str.lpiYxhGameSvc.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
call esi
test eax, eax
jne 0x10043e53
lea eax, [ebp - 0x218]
push eax
call edi
lea eax, [ebp - 0x218]
push eax
call edi
push str.lpiLeyouGameSvc.dll
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x100449e1
jmp 0x10044472
call fcn.10024dc0
push 1
push 0
push str.launch_tray_rundll_fial
mov ecx, dword [eax]
push 0x100ada74
push eax
call dword [ecx]
cmp dword [ebp + 0x10], 0
je 0x10043e8f
xor esi, esi
or edi, 0xffffffff
jmp 0x1004481b
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x100449eb
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x484], eax
push dword [ebp - 0x498]
lea eax, [ebp - 0x484]
mov byte [ebp - 4], 0x27
push str.RunTrayIcon
push dword [ebp - 0x4bc]
push str.__dll__s____entry_s__s
push eax
call fcn.10002ef0
add esp, 0x14
lea ecx, [ebp - 0x490]
push str.6BBDB6A8_3742_40F9_98D9_F9591E4359D2
call fcn.10002930
lea eax, [ebp - 0x450]
mov byte [ebp - 4], 0x28
push 0x20
push eax
call fcn.10010e80
add esp, 8
cmp dword [eax + 0x14], 8
mov byte [ebp - 4], 0x29
jb 0x10043f08
mov eax, dword [eax]
push eax
lea ecx, [ebp - 0x490]
call fcn.10041ba0
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x28
call fcn.100051b0
lea eax, [ebp - 0x490]
push eax
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x48c]
push eax
call fcn.1004fd90
add esp, 0xc
mov byte [ebp - 4], 0x2a
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x100449f5
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x4b8], eax
push str.940513FC_AF92_41C8_89EC_8371DF5938D4
push dword [ebp - 0x490]
lea eax, [ebp - 0x4b8]
mov byte [ebp - 4], 0x2b
push dword [ebp - 0x48c]
push str.__et_s___yek_s___mod_s___D6FBCCE039A5477EBDCD07660C8B8B30025381AF0C6D42119BBC9A469EC289A3
push eax
call fcn.10002ef0
add esp, 0x14
call fcn.10003000
mov ecx, eax
test ecx, ecx
je 0x100449ff
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x498], eax
push dword [ebp - 0x484]
mov byte [ebp - 4], 0x2c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x498]
push str.LastError:_d__cmd_s
push eax
call fcn.10002ef0
add esp, 0x10
call fcn.100689b0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x100440bb
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonpop_popexpoppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], al
call fcn.1000a260
push 3
push 0x100a680c
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x2d
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000a260
mov byte [ebp - 4], 0x2e
call fcn.100689b0
mov edi, eax
lea ecx, [ebp - 0x5a4]
push 0x131
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10004790
mov esi, eax
mov ecx, dword [ebp - 0x498]
mov edx, 0x100a68c0
test ecx, ecx
mov byte [ebp - 4], 0x2f
cmovne edx, ecx
push edx
push esi
call fcn.10003800
mov eax, dword [edi]
add esp, 8
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x5a4]
call fcn.10005bc0
lea ecx, [ebp - 0x450]
call fcn.10002b00
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x2c
call fcn.10002b00
mov esi, dword [ebp - 0x4b8]
lea eax, [ebp - 0x420]
xorps xmm0, xmm0
mov dword [ebp - 0x4ec], 0
push 0
movlpd qword [ebp - 0x4e4], xmm0
movlpd qword [ebp - 0x4dc], xmm0
movlpd qword [ebp - 0x4d4], xmm0
mov dword [ebp - 0x4cc], 0
mov dword [ebp - 0x504], 0x3c
mov dword [ebp - 0x4fc], 0
mov dword [ebp - 0x4f4], eax
mov dword [ebp - 0x500], 0x1140
mov dword [ebp - 0x4f0], esi
mov dword [ebp - 0x4e8], 5
mov dword [ebp - 0x4f8], 0x100ac410
call dword [sym.imp.KERNEL32.dll_SetLastError]
call fcn.100689b0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10044234
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonpop_popexpoppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], al
call fcn.1000a260
push 3
push 0x100a680c
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x30
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000a260
mov byte [ebp - 4], 0x31
call fcn.100689b0
mov dword [ebp - 0x488], eax
lea ecx, [ebp - 0x5a4]
push 0x141
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10004790
mov edi, eax
push str.ExpRunTrayIconDll_ExplorerPrivilegeProcess__ShellExecuteEx_encrypt_cmd:
push edi
mov byte [ebp - 4], 0x32
call fcn.10005a70
test esi, esi
mov ecx, 0x100a68c0
cmovne ecx, esi
push ecx
push edi
call fcn.10003800
mov ecx, dword [ebp - 0x488]
add esp, 0x10
mov eax, dword [ecx]
push edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x5a4]
call fcn.10005bc0
lea ecx, [ebp - 0x450]
call fcn.10002b00
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x2c
call fcn.10002b00
lea eax, [ebp - 0x504]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edi, eax
mov dword [ebp - 0x488], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push eax
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x498]
push str.ShellExecuteEx_api__errcode_lu__hRet_d
push eax
call fcn.10002ef0
add esp, 0x10
call fcn.100689b0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov edi, dword [ebp - 0x498]
movzx eax, al
sub eax, 1
jne 0x1004436c
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonpop_popexpoppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000a260
push 3
push 0x100a680c
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x33
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000a260
mov byte [ebp - 4], 0x34
call fcn.100689b0
mov dword [ebp - 0x4c8], eax
lea ecx, [ebp - 0x5a4]
push 0x149
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10004790
mov dword [ebp - 0x4c0], eax
test edi, edi
mov byte [ebp - 4], 0x35
mov ecx, 0x100a68c0
cmovne ecx, edi
push ecx
push eax
call fcn.10003800
mov ecx, dword [ebp - 0x4c8]
add esp, 8
mov eax, dword [ecx]
push dword [ebp - 0x4c0]
call dword [eax + 0x1c]
lea ecx, [ebp - 0x5a4]
call fcn.10005bc0
lea ecx, [ebp - 0x450]
call fcn.10002b00
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x2c
call fcn.10002b00
push dword [ebp - 0x488]
lea eax, [ebp - 0x47c]
push dword [ebp - 0x49c]
push str.ShellExecuteEx_api__errcode_lu__hRet_d
push eax
call fcn.10042b80
add esp, 0x10
cmp dword [ebp - 0x488], 0
je 0x100443cb
cmp dword [ebp - 0x4cc], 0
je 0x100443cb
mov eax, dword [ebp - 0x4a8]
mov ecx, dword [eax + 0x38]
call fcn.100244f0
push dword [ebp - 0x4cc]
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x49c]
push eax
call fcn.10029780
mov ecx, eax
call fcn.10024c40
lea edx, [edi - 0x10]
mov byte [ebp - 4], 0x2b
or edi, 0xffffffff
mov eax, edi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100443e9
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov byte [ebp - 4], 0x2a
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x10044404
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x48c]
mov eax, edi
mov byte [ebp - 4], 0x28
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10044425
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x490]
mov eax, edi
mov byte [ebp - 4], 0x27
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10044446
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x484]
mov eax, edi
mov byte [ebp - 4], 0x20
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10044467
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x488]
jmp 0x10043c98
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x48c], eax
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 0x36
push eax
lea eax, [ebp - 0x48c]
push str.Lds_CallLudashiServiceEx_szSvcPath_s
push eax
call fcn.10002ef0
add esp, 0xc
call fcn.100689b0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
mov esi, dword [ebp - 0x48c]
movzx eax, al
sub eax, 1
jne 0x10044599
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonpop_popexpoppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], 0
call fcn.1000a260
push 3
push 0x100a680c
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x37
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000a260
mov byte [ebp - 4], 0x38
call fcn.100689b0
mov dword [ebp - 0x49c], eax
lea ecx, [ebp - 0x5a4]
push 0x183
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10004790
mov edi, eax
test esi, esi
mov byte [ebp - 4], 0x39
mov eax, 0x100a68c0
cmovne eax, esi
push eax
push edi
call fcn.10003800
mov ecx, dword [ebp - 0x49c]
add esp, 8
mov eax, dword [ecx]
push edi
call dword [eax + 0x1c]
lea ecx, [ebp - 0x5a4]
call fcn.10005bc0
lea ecx, [ebp - 0x450]
call fcn.10002b00
lea ecx, [ebp - 0x438]
mov byte [ebp - 4], 0x36
call fcn.10002b00
lea eax, [ebp - 0x218]
push eax
call fcn.1004c350
add esp, 4
test eax, eax
jne 0x100445d1
or edi, 0xffffffff
mov byte [ebp - 4], 0x20
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100445ca
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
xor esi, esi
jmp 0x1004481b
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
mov dword [ebp - 0x484], 0
mov eax, dword [ebp - 0x4a0]
mov dword [ebp - 0x49c], eax
test edi, edi
jne 0x10044604
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10044655
push str.CLSE
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x4c0], eax
test eax, eax
jne 0x10044627
push 0x490
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10044655
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
lea eax, [ebp - 0x484]
push eax
push str.processid
push dword [ebp - 0x49c]
lea eax, [ebp - 0x420]
push eax
push str.createprocess
call dword [ebp - 0x4c0]
mov eax, dword [ebp - 0x484]
xor ecx, ecx
push eax
test eax, eax
lea eax, [ebp - 0x47c]
push edi
setne cl
push str.Lds_CallLudashiServiceEx__p__u
push eax
mov dword [ebp - 0x488], ecx
call fcn.10042b80
add esp, 0x10
cmp dword [ebp - 0x488], 0
je 0x100446bd
cmp dword [ebp - 0x484], 0
je 0x100446bd
mov eax, dword [ebp - 0x4a8]
mov ecx, dword [eax + 0x38]
call fcn.100244f0
push dword [ebp - 0x484]
mov dword [ebp - 0x49c], eax
lea eax, [ebp - 0x49c]
push eax
call fcn.10029780
mov ecx, eax
call fcn.10024c70
or edi, 0xffffffff
mov byte [ebp - 4], 0x20
add esi, 0xfffffff0
mov eax, edi
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x100446db
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [ebp - 0x488]
test esi, esi
mov edx, str._exok
mov eax, str._exfail
cmove edx, eax
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100446f5
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x4a4]
call fcn.10014f90
call fcn.10024dc0
push 1
push 0
push dword [ebp - 0x4a4]
mov ecx, dword [eax]
push 0x100a7a60
push eax
call dword [ecx]
call fcn.100689b0
mov ecx, eax
push 1
mov edx, dword [eax]
mov eax, dword [edx + 8]
call eax
movzx eax, al
sub eax, 1
jne 0x10044815
push 0x61
push str.d:jenkins.jenkinsworkspacelib_commonpop_popexpoppop_popexpoppop_trayiconserialrunner.cpp
lea ecx, [ebp - 0x438]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x424], 0xf
mov byte [ebp - 0x438], al
call fcn.1000a260
push 3
push 0x100a680c
lea ecx, [ebp - 0x450]
mov byte [ebp - 4], 0x3a
mov dword [ebp - 0x440], 0
mov dword [ebp - 0x43c], 0xf
mov byte [ebp - 0x450], 0
call fcn.1000a260
mov byte [ebp - 4], 0x3b
call fcn.100689b0
mov edi, eax
lea ecx, [ebp - 0xa8]
push 0x196
lea eax, [ebp - 0x438]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.10004790
mov esi, eax
push str.Start_by_rundll._bSuccess
push esi
mov byte [ebp - 4], 0x3c
call fcn.10003800
add esp, 8
mov ecx, esi
push dword [ebp - 0x488]
call fcn.10005710
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x1c]
lea ecx, [ebp - 0xa8]
call fcn.10005bc0
lea ecx, [ebp - 0x450]
call fcn.10002b00
lea ecx, [ebp - 0x438]
call fcn.10002b00
or edi, 0xffffffff
mov esi, dword [ebp - 0x488]
mov edx, dword [ebp - 0x494]
mov eax, edi
mov byte [ebp - 4], 0x1f
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004483c
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4c4]
mov eax, edi
mov byte [ebp - 4], 0x1d
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004485d
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4ac]
mov eax, edi
mov byte [ebp - 4], 0x1b
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004487e
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4a0]
mov eax, edi
mov byte [ebp - 4], 0x10
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x1004489f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4bc]
mov eax, edi
mov byte [ebp - 4], 0xf
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100448c0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4b0]
mov eax, edi
mov byte [ebp - 4], 0xe
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100448e1
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov edx, dword [ebp - 0x4a4]
mov eax, edi
mov byte [ebp - 4], 0xb
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x10044902
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x4b4]
mov byte [ebp - 4], 0xa
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x10044921
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
lea ecx, [ebp - 0x47c]
call fcn.10042a00
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006a4da
mov esp, ebp
pop ebp
ret 0xc
push 0x80070057
call fcn.10002c70
call fcn.10078889
call fcn.10078889
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
call fcn.10078889
call fcn.10078889
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
push 0x80004005
call fcn.10002c70
int3